MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 be70e29a7cd32aa4bbf485a19d71233cf5b8ea5ad930d01f6ac97c2979c2e540. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	be70e29a7cd32aa4bbf485a19d71233cf5b8ea5ad930d01f6ac97c2979c2e540
SHA3-384 hash:	5a1425661822f92be0cbafb09ff369e190ae210629e464901fc640ec0b0b792c4d0bc0c391dbd0b959b3feda4c3c5db3
SHA1 hash:	026f4bba35eff10d33437986dd9722c1d6abe1ac
MD5 hash:	f226e5066a68f1ff726206c5eafb611f
humanhash:	nebraska-neptune-tennessee-uranus
File name:	be70e29a7cd32aa4bbf485a19d71233cf5b8ea5ad930d01f6ac97c2979c2e540
Download:	download sample
Signature	Mirai Create hunting rule
File size:	1'834 bytes
First seen:	2026-07-23 05:23:28 UTC
Last seen:	2026-07-24 02:48:40 UTC
File type:	sh
MIME type:	text/x-shellscript
ssdeep	24:HXfNvSPGFrpUDzR1fqFmtKOtk3nbnun2an2MtyJivVtkxQFFaF2Ba:M4m7T8
TLSH	T18B31F29922B09179C64DCF03B0E542C4A277F584E2B3CFFAF5C11E61585BE80B45DAB6
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	c2hunter
Tags:	mirai sh wraith

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://195.201.123.9/iran.x86_64	3dfe3b06e573fe0827f00674846b663f9fb07ed0349db1010712632e9f96d544	Mirai	mirai wraith
http://195.201.123.9/iran.aarch64	259f8cf64985b2f985d35e36afa3e0b65a217a9807688afd9140f553cd1937ea	Mirai	mirai wraith
http://195.201.123.9/iran.m68k	10e7e57e903d87c3362e692e8a78b0e3df820464863867b3340ebe8e24508832	Mirai	mirai wraith
http://195.201.123.9/iran.mips	ac0c66ae69666045b1be74e366cf6c9e2e975b0f808854583fa5e954b27f8b59	Mirai	mirai wraith
http://195.201.123.9/iran.mipsel	733347ef5ccd49fe2e54c3984c81cf95351394a574269b761c01eace403a46d6	Mirai	mirai wraith
http://195.201.123.9/iran.powerpc	26dc5198545c66039719a1d42830c0957050c3d22d1bc0c0c8fed7da35279384	Mirai	elf mirai ua-wget
http://195.201.123.9/iran.sparc	324deb4b74dd1414deff93cd374b2b388736546ad6286d9dcfaeb6acd2b7f8c0	Mirai	elf mirai ua-wget
http://195.201.123.9/iran.sh4	055fe758fb12364dfe789edec50d3f3440804acf22f0500f23f3086b105aa7de	Mirai	elf mirai ua-wget
http://195.201.123.9/iran.arc	aa830216b7d13576349489cd2f13bf038330028d73200c10beb20be93bc986ba	Mirai	elf mirai ua-wget
http://195.201.123.9/iran.i486	62f6b3bb68ecf7969a48e7be27d35d6d4ebf99eecd774cbb7bb95de36feb0610	Mirai	elf mirai ua-wget
http://195.201.123.9/iran.armv4l	5f6bcd6d4a67cfe9a5340390f087138d443ebd17415ca3ee2f8c47aa833e024e	Gafgyt	elf gafgyt ua-wget
http://195.201.123.9/iran.armv5l	20ea19549d75930fee816ccace42c1a95e91bbff33e5ab2b003ae0983d2e5875	Mirai	elf mirai ua-wget
http://195.201.123.9/iran.armv6l	8f92b8cf6963841fc807c7bc8087e256f66939b7fc177ba784a3404a495ac23c	Mirai	elf mirai ua-wget
http://195.201.123.9/iran.armv7l	11b25298b460ef047e28ea94f036bb70988ffb4bc3ffcd100e947fcb89de5a03	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

downloader mirai

Link:

https://www.filescan.io/uploads/6a61a558f82efe7d3e90c667/reports/16ce0b37-ba5f-48d9-ace8-b2fc4d3cec27/overview

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-07-23T00:57:00Z UTC

Last seen:

2026-07-24T18:22:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/be70e29a7cd32aa4bbf485a19d71233cf5b8ea5ad930d01f6ac97c2979c2e540/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/07f09f92-8de0-434e-940d-bd6169c418a3

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/be70e29a7cd32aa4bbf485a19d71233cf5b8ea5ad930d01f6ac97c2979c2e540

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/be70e29a7cd32aa4bbf485a19d71233cf5b8ea5ad930d01f6ac97c2979c2e540/

Threat name:

Win32.Trojan.Vigorf

Status:

Malicious

First seen:

2026-07-23 05:24:51 UTC

File Type:

Text (Shell)

AV detection:

12 of 24 (50.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=xzyofgt42mvkjo7uqwqz24jdht23r2s23eynah3kzf6cs6oc4vaa._file

Result

Malware family:

n/a

Score:

7/10

Tags:

antivm defense_evasion discovery linux persistence

Link:

https://tria.ge/reports/260723-f3e9ws1fqe/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Changes its process name

Checks CPU configuration

Enumerates running processes

Modifies init.d

File and Directory Permissions Modification

Executes dropped EXE

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.11

Link:

https://yomi.yoroi.company/submissions/be70e29a7cd32aa4bbf485a19d71233cf5b8ea5ad930d01f6ac97c2979c2e540

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh