MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a78fd62a477a4e7afe6d6945d47a0ae82a4f80947ae554f67c7e80aaebd762ed. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 5


Intelligence 5 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a78fd62a477a4e7afe6d6945d47a0ae82a4f80947ae554f67c7e80aaebd762ed
SHA3-384 hash: b6ca3cfddb658935ddf76c6d479e5f2321413d771e35dfa7b4d6e4e2bd5ddf9665bfe313e04d446474de055cc144138b
SHA1 hash: a7335fd0f10d9fc35942ad44c85c5bec7568365e
MD5 hash: 87cf7b05e5445c09cb8c9e19f4773ee1
humanhash: texas-whiskey-four-nine
File name:hnap
Download: download sample
Signature Mirai
Create hunting rule
File size:2'821 bytes
First seen:2026-02-03 16:39:57 UTC
Last seen:2026-02-03 17:10:10 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 48:vzyuHWz3UHWz58HWzHwHWzBwHWzdudzEHWzoCHWzR8HWzKuHWzLMHWzH+HWz7x7f:vzyu2z3U2z582zHw2zBw2zM9E2zoC2zc
TLSH T17151D5C432204BF8BFB55E92B6F6412574C5A1D5AAC70EC9E2FC24FE054CF096C916B6
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://94.26.106.177/bins/sora.x86e9e378387a21bdfc4c1f424ec79a209ceba05d1f0919d6dca05e5623e3f941fd Miraielf mirai ua-wget
http://94.26.106.177/bins/sora.mips5e74a50c9255cda93e51e37903260477800d9aac1301e8447a8793a83529c07a Mirai32-bit elf mirai Mozi
http://94.26.106.177/bins/sora.x86_649494683239ff99d86db9145ddd361c5014eef8506c720ef34bae542b1f140c88 Miraielf mirai ua-wget
http://94.26.106.177/bins/sora.i468n/an/an/a
http://94.26.106.177/bins/sora.i68628d2d9759823d69e7fc46485b53a413b38ef2f8ff504dd397b6726c21c5dcd19 Miraielf mirai ua-wget
http://94.26.106.177/bins/sora.mpslc62afaff80ce42bd7e8f6f3b66e45da9a3b36d00fcd630936d28fbce2c9d8f26 Miraielf mirai ua-wget
http://94.26.106.177/bins/sora.arm4n/an/an/a
http://94.26.106.177/bins/sora.arm5681c788f1f1c6beb7f7ef7dce47c3971dbb506c5ce58a0caedbb7999efb9bd66 Miraielf mirai ua-wget
http://94.26.106.177/bins/sora.arm69633a560c9e528465418f37cb0111f6cbda015a4b46f4ab2efe27eaa0b75413b Miraielf mirai ua-wget
http://94.26.106.177/bins/sora.arm7n/an/an/a
http://94.26.106.177/bins/sora.ppcf67c66b6e0cf80b0546171bc249b825601f1078f0df6fb18402441eba65ad610 Miraielf mirai ua-wget
http://94.26.106.177/bins/sora.ppc440fpn/an/an/a
http://94.26.106.177/bins/sora.m68k482fe1c5adf10b2feb46d79a6ba89ac5865e73fda816738642d61c03e2149e07 Miraielf mirai ua-wget
http://94.26.106.177/bins/sora.sh4be6d52de33de60fd6d03fc14a719eea4b605519b22370321e44acd102ba7447c Miraielf mirai ua-wget

Intelligence

File Origin
# of uploads :
2
# of downloads :
33
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL
Create hunting rule

Result
Gathering data
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/a76bccb7-b4ce-47a3-b739-c0e41b8e9344
Behavior Graph:
Download SVG
%3 guuid=49e13b57-1a00-0000-a19d-d605be0a0000 pid=2750 /usr/bin/sudo guuid=b800d959-1a00-0000-a19d-d605c50a0000 pid=2757 /tmp/sample.bin guuid=49e13b57-1a00-0000-a19d-d605be0a0000 pid=2750->guuid=b800d959-1a00-0000-a19d-d605c50a0000 pid=2757 execve guuid=e07f645a-1a00-0000-a19d-d605c60a0000 pid=2758 /usr/bin/wget guuid=b800d959-1a00-0000-a19d-d605c50a0000 pid=2757->guuid=e07f645a-1a00-0000-a19d-d605c60a0000 pid=2758 execve
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/a78fd62a477a4e7afe6d6945d47a0ae82a4f80947ae554f67c7e80aaebd762ed
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a78fd62a477a4e7afe6d6945d47a0ae82a4f80947ae554f67c7e80aaebd762ed/
Verdict:
Malicious
Threat:
Family.MIRAI
Link:
https://tip.neiki.dev/file/a78fd62a477a4e7afe6d6945d47a0ae82a4f80947ae554f67c7e80aaebd762ed
Threat name:
Linux.Downloader.Morila
Create hunting rule
Status:
Malicious
First seen:
2026-02-03 16:34:12 UTC
File Type:
Text (Shell)
AV detection:
22 of 36 (61.11%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=u6h5mkshpjhhv7tnnfc5i6qk5ave7aeuplsvj5t4p2akv26xmlwq._file
Result
Malware family:
n/a
Score:
  1/10
Tags:
linux
Link:
https://tria.ge/reports/260203-t6s7tahz8h/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.37
Link:
https://yomi.yoroi.company/submissions/a78fd62a477a4e7afe6d6945d47a0ae82a4f80947ae554f67c7e80aaebd762ed

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Linux_Shellscript_Downloader
Create hunting rule
Author:albertzsigovits
Description:Generic Approach to Shellscript downloaders
Rule name:MAL_Linux_IoT_MultiArch_BotnetLoader_Generic
Create hunting rule
Author:Anish Bogati
Description:Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:MalwareBazaar sample lilin.sh

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh a78fd62a477a4e7afe6d6945d47a0ae82a4f80947ae554f67c7e80aaebd762ed

(this sample)

Mirai

elf c6addcb5c29a71af7c97ff54bb61a8ff2b05449c778f96ab495d8ff1e46e3c61

Mirai

elf e9e378387a21bdfc4c1f424ec79a209ceba05d1f0919d6dca05e5623e3f941fd

  
URLhaus
https://urlhaus.abuse.ch/url/3771580/
  
Delivery method
Distributed via web download
  
Dropping
MD5 047966b2c20f2cffffca8e41a6683874
  
Dropping
SHA256 e9e378387a21bdfc4c1f424ec79a209ceba05d1f0919d6dca05e5623e3f941fd

Comments