MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 aa873a357986d261dab16e91d6e06fcde14e55e19d6c196ea7dd852c19f7aae0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	aa873a357986d261dab16e91d6e06fcde14e55e19d6c196ea7dd852c19f7aae0
SHA3-384 hash:	fb5f18fb39fee52f5f668125dddb1eaa450fd8e9559bfdc38f99ca11e8862ac038b2f96170a06055ddddff17c94cd1ff
SHA1 hash:	a11da3180ecf45edd096587821f8654b1f3de1d4
MD5 hash:	934e5faaf759bdaae159d67604f7a237
humanhash:	jupiter-ack-nitrogen-lemon
File name:	sora.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	1'933 bytes
First seen:	2025-08-01 12:13:35 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	24:veOSXaIOSsTDkaUoOS5oOShOSedOS/OSDOSKOSIWOl:veRvR49R5oRhR8R/RDRKR3e
TLSH	T1DD4163C977024571BFA25F6771B4C414B284A07A9EC0AE81D4FDB8BDE84EF08B852563
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://196.251.114.80/bins/sora.x86	813b6086d1811b2faa9fb11c36c278199fa6d8888b6f52b21c2cf8cc3aa2c1da	Mirai	elf mirai ua-wget
http://196.251.114.80/bins/sora.mips	d18ff0477805af0c84fc6ba9a90577aae44e0816cdc25272c3e9ab291209c13c	Mirai	elf mirai ua-wget
http://196.251.114.80/bins/sora.mpsl	645b72a3ed7028b13a0568437dfc4f16d388874fa0e0857404c4ec91d11aa746	Mirai	elf mirai ua-wget
http://196.251.114.80/bins/sora.arm4	n/a	n/a	elf ua-wget
http://196.251.114.80/bins/sora.arm5	fe9e37282681d2af4856224c0a1cd3553d584fc66f2b12bb558b88477e30c9f4	Mirai	elf mirai ua-wget
http://196.251.114.80/bins/sora.arm6	a269eb8b456a2b7450b6817f23553bea19da1f6a8044597f435f6f3201696b6d	Mirai	elf mirai ua-wget
http://196.251.114.80/bins/sora.arm7	bdf813c557f6d98e17cfe0f18e0c6d4f8337fcd49a681d954ba33894cc860d25	Mirai	elf mirai ua-wget
http://196.251.114.80/bins/sora.ppc	c02cb88f7e5dcefaeeac502350ccfcac564ee6cbac1630ea462ec18e1a5c5a50	Mirai	elf mirai ua-wget
http://196.251.114.80/bins/sora.m68k	7c08cb828c34cc9667406c559f972a8173aa9f9508160771577d143762c2b7ff	Mirai	elf mirai ua-wget
http://196.251.114.80/bins/sora.sh4	61132f2313f55e29e097b68cd2f0cb8cfc5305ef362e9ef66b1c056649173436	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL

Status:

Failed

Link:

https://sandbox.kunai.rocks/analysis/3faa4188-936c-4f1a-be0d-92aae74cc37e

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/aa873a357986d261dab16e91d6e06fcde14e55e19d6c196ea7dd852c19f7aae0

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/aa873a357986d261dab16e91d6e06fcde14e55e19d6c196ea7dd852c19f7aae0/

Verdict:

Malicious

Threat:

Family.MIRAI

Link:

https://tip.neiki.dev/file/aa873a357986d261dab16e91d6e06fcde14e55e19d6c196ea7dd852c19f7aae0

Threat name:

Linux.Downloader.Morila

Status:

Malicious

First seen:

2025-08-01 12:08:33 UTC

File Type:

Text (Shell)

AV detection:

23 of 38 (60.53%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=vkdtunlzq3jgdwvrn2i5nydpzxqu4vpbtvwbs3vh3wcsygpxvlqa._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai botnet:sora antivm botnet defense_evasion discovery linux upx

Link:

https://tria.ge/reports/250801-pegbqazps4/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Changes its process name

Checks CPU configuration

Reads system network configuration

UPX packed file

Enumerates active TCP sockets

Enumerates running processes

File and Directory Permissions Modification

Executes dropped EXE

Modifies Watchdog functionality

Contacts a large (369488) amount of remote hosts

Creates a large amount of network flows

Mirai

Mirai family

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.