MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9a9e4a5220ffdd46445c34e3892359ce7c02fecad554e617b6f2ece8d0df34a4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 7

Intelligence 7 IOCs YARA 2 File information Comments

SHA256 hash:	9a9e4a5220ffdd46445c34e3892359ce7c02fecad554e617b6f2ece8d0df34a4
SHA3-384 hash:	7e37bccca7ce1a94e7a649e0673719bc0a723a4d3e2225f2efddbce5a8eb7e7a2e27e65da313eea1c97afd8018d3178d
SHA1 hash:	62c1dfb140d326b32db106a600d2ab0faf251c4c
MD5 hash:	5224fb3eacc8670cd2c40f6e444effde
humanhash:	hamper-west-edward-three
File name:	av.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'535 bytes
First seen:	2026-08-31 16:11:55 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	12:q0FkLX0FtFio0FCGiuC0F110Fnd0FI6qCL0F5iEHC0FWf0F7LVD0FXiqC0FR90Fi:vlHiJC6Xw2G5d35mXZ02nPf5b3
TLSH	T1585180C517420F723CA39DE773BA9C083688AEFE58C26E15A5F938E4864ED84B040B53
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	BlinkzSec

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://46.151.182.200/bot.x86	c5badbc7eb2ff4f904156ed9b517c22c7dfba122e540dfbf7f0d4156d7a9976d	Mirai	elf mirai ua-wget
http://46.151.182.200/bot.mips	2bdcd6e8a368c28488926a4773bf4cc2d5840ced8cb6499e417c3743cec7c44c	Mirai	elf mirai ua-wget
http://46.151.182.200/bot.arc	f8a45723a8bcd8f0858b958a9d61f38a7b657949ffe3d43038be0e7f562c24d0	Mirai	elf mirai ua-wget
http://46.151.182.200/bot.i468	n/a	n/a	censys elf ua-wget
http://46.151.182.200/bot.i686	d9bce6c9a1e6dc24747f2b754bc3ec0b381bac755d2dcc52db38c87fce8a46ab	Mirai	elf mirai ua-wget
http://46.151.182.200/bot.x86_64	08ffaa3060aceda41990ab74a6f996b8fced28c3e3065e23e8cdebdb255be0e0	Mirai	elf mirai ua-wget
http://46.151.182.200/bot.mpsl	d0d1bbcd8900f190bc7b24e1b15e5558fbc917e5172712075207ee3e29c16a3f	Mirai	elf mirai ua-wget
http://46.151.182.200/bot.arm	3cf3edeeeac605be90d682b402ca8f34841633b05b45be6be2c50d30e5563fb2	Mirai	arm elf mirai ua-wget
http://46.151.182.200/bot.arm5	70dce1cfed01b0cbaa7a50d2d23f44cd80621947a082c424a0c55a2e3fe48d61	Mirai	elf mirai ua-wget
http://46.151.182.200/bot.arm6	6e2317a8a15f7dfdda44266aea43fa0579fe4319546e7a47e07b53e8e5e4fdae	Mirai	elf mirai ua-wget
http://46.151.182.200/bot.arm7	bdbcb94265f715c4e044499b7f18a9193972117c06daf9097f91afe812de6207	Mirai	arm elf mirai ua-wget
http://46.151.182.200/bot.ppc	d5c876aed3c43d53d1c37d5ea33a44e84fcd3af80a10c53b020fb8946bfd3765	Mirai	elf mirai ua-wget
http://46.151.182.200/bot.spc	6dea295dace414dcecb4580a7882b707364cd31ea7708e4ec0643a022091b152	Mirai	elf mirai ua-wget
http://46.151.182.200/bot.m68k	59b3e567a22126d9d26ab758dabe2a17908d0c48d326fdf2c260546fd8b220c8	Mirai	elf mirai ua-wget
http://46.151.182.200/bot.sh4	4892824a9316779d423c3190df9bcaa9cdbde0756eb225b7a7ad5746dc04f654	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-08-31T13:55:00Z UTC

Last seen:

2026-09-01T18:16:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/9a9e4a5220ffdd46445c34e3892359ce7c02fecad554e617b6f2ece8d0df34a4/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/d64933ad-b2d1-4dee-a416-959e83e936d4

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/9a9e4a5220ffdd46445c34e3892359ce7c02fecad554e617b6f2ece8d0df34a4

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/9a9e4a5220ffdd46445c34e3892359ce7c02fecad554e617b6f2ece8d0df34a4/

Threat name:

Linux.Downloader.Morila

Status:

Malicious

First seen:

2026-08-31 16:11:41 UTC

File Type:

Text (Shell)

AV detection:

24 of 38 (63.16%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=tkpeuura77oumrc4gtrysi2zzz6af7wk2vkomf5w6lworug7gssa._file

Result

Malware family:

n/a

Score:

7/10

Tags:

antivm defense_evasion discovery execution linux persistence privilege_escalation

Link:

https://tria.ge/reports/260831-tnlp1syshv/

Behaviour

Enumerates kernel/hardware configuration

Reads runtime system information

System Network Configuration Discovery

Writes file to shm directory

Writes file to tmp directory

Changes its process name

Checks CPU configuration

Creates a desktop entry file

Modifies Bash startup script

Creates/modifies Cron job

Creates/modifies environment variables

Deletes log files

Modifies init.d

Modifies rc script

Modifies systemd

Write file to user bin folder

Writes file to system bin folder

File and Directory Permissions Modification

Executes dropped EXE

Modifies Watchdog functionality

Traces itself

Malware family:

Mirai

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/9a9e4a5220ff/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/9a9e4a5220ffdd46445c34e3892359ce7c02fecad554e617b6f2ece8d0df34a4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Linux_Shellscript_Downloader Create hunting rule
Author:	albertzsigovits
Description:	Generic Approach to Shellscript downloaders

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh