MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a27aed9b008f416b6ca6ba938ea65189c60a02db446b7c4e622946d8076f3f4e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 4

Intelligence 4 IOCs YARA 1 File information Comments

SHA256 hash:	a27aed9b008f416b6ca6ba938ea65189c60a02db446b7c4e622946d8076f3f4e
SHA3-384 hash:	82a07e986c4b7021262f58123d4eb0d5b251fc1156d0d70458829c3377ed0f098a6b83dabdbf5d338f88fa0d8004eb65
SHA1 hash:	910c94ed55f36b0305940e6c3ff7ef7f742e9aff
MD5 hash:	65689c30da883dddf80de3a0f74fd3eb
humanhash:	asparagus-beer-arizona-social
File name:	lil
Download:	download sample
Signature	Mirai Create hunting rule
File size:	852 bytes
First seen:	2026-08-10 07:24:51 UTC
Last seen:	2026-08-10 16:19:45 UTC
File type:	sh
MIME type:	text/x-shellscript
ssdeep	12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkaakCQwFC7luCFR1KW6FCYKgV03CjX:kXCKysE2hi0ziQvZohaNGFWIfDFLiYX
TLSH	T1EC01EFC5D0544D0040D9948D32E75194F831C3C719468B69FFACA47D9B94D08F0B6F94
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://129.121.110.105/DjEq	0017ec0b36f0a10e37951329126e28d8bf03030124de8001061ee3c9193b4481	Mirai	mirai ua-wget
http://129.121.110.105/98oE	e1d415a506a4f0dcfae21620d8a7644d306b13b1879d91163b879911d0f2904b	Mirai	mirai ua-wget
http://129.121.110.105/1htR	954dd815b49eafe68cf6f493ca1cd9a409a6f1af48c25084c844a24f06ffa38a	Mirai	mirai ua-wget
http://129.121.110.105/2EUE	89b4a1ecfb1f6ac02f9bae48ca1086752646004da5039fb5cea166325a92dd86	Mirai	mirai ua-wget
http://129.121.110.105/cCf	73e3159ac2b6f55c2528734df1c7eee06bf68b41ebdd66e00beef77243ee644d	Mirai	mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

evasive mirai

Link:

https://www.filescan.io/uploads/6a797cf7cad448d6d9af4ceb/reports/4d2d7ab0-f8d1-478b-a084-a97f8c0dad24/overview

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/e941491b-fd9d-4560-960a-bc0bca4c12b9

Behavior Graph:

Download SVG

Score:

96%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/a27aed9b008f416b6ca6ba938ea65189c60a02db446b7c4e622946d8076f3f4e

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a27aed9b008f416b6ca6ba938ea65189c60a02db446b7c4e622946d8076f3f4e/

Gathering data

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=uj5o3gyar5aww3fgxkjy5jsrrhdauaw3irvxyttcffdnqb3ph5ha._file

Result

Malware family:

n/a

Score:

7/10

Tags:

defense_evasion discovery execution linux persistence privilege_escalation

Link:

https://tria.ge/reports/260810-h95jgatdqa/

Behaviour

Enumerates kernel/hardware configuration

Reads runtime system information

Writes file to tmp directory

Creates/modifies Cron job

Enumerates running processes

Modifies rc script

Modifies systemd

File and Directory Permissions Modification

Executes dropped EXE

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.26

Link:

https://yomi.yoroi.company/submissions/a27aed9b008f416b6ca6ba938ea65189c60a02db446b7c4e622946d8076f3f4e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.