MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bf2549291776de2b7b1ed3f4ebe62ffb0551d0527543db8bd4207b7844b4c7cc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 5

Intelligence 5 IOCs YARA 3 File information Comments

SHA256 hash:	bf2549291776de2b7b1ed3f4ebe62ffb0551d0527543db8bd4207b7844b4c7cc
SHA3-384 hash:	e3ac90db670083859043e18907750d841ed03b00075ae7f4264ed9c310603994f2099522e543590906f83f0927a688b8
SHA1 hash:	7339d80f45c9c9402addfbcf8ffcfb94f949d06e
MD5 hash:	2f7ab08de34e17d0b07be198bbd7201a
humanhash:	jupiter-nine-pizza-aspen
File name:	bins.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'518 bytes
First seen:	2026-08-30 07:12:58 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:vDcKfj+MsDHN/fU+3sDdkVDRteDRTf2+BeJD/oHDVARDBf+DtKWYDJEXJDpRgDjd:voK7rsbtscsO6lTeOsgukMZaMeLk5Qc
TLSH	T1E45162D620E328717CA8E41BB36D4C123489E09F1CB5AF04ADFDB8F5C1ACD59A758A53
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://190.123.46.208/Okami.mips	4ec89628125884c7d789399c5983e84bc3c986c7c19b1d9879d969cb238da224	Mirai	cowrie honeypot mirai
http://190.123.46.208/Okami.mpsl	d26c0519e0636570c44bbf940601c6ebe9d0b4e835c090ca380234a04471f3a5	Mirai	elf ua-wget
http://190.123.46.208/Okami.sh4	cc684b5f7b07f75f82452c66ce377795f90d6194106f4f56de8e5f2e029cc1c1	Mirai	elf ua-wget
http://190.123.46.208/Okami.x86	69c703c3ac352be13303e14cebfe5e6bc72ae60584996d1bc749fecfa4eb4994	Mirai	elf ua-wget
http://190.123.46.208/Okami.arm6	32c87d6a1bd9fd87e9ea33bcd6d41ecc8145741b718bd11ce97bd38a0d54d0c4	Mirai	elf ua-wget
http://190.123.46.208/Okami.i686	aa3cd1ef678dd8427531e1bd2c695fdf9bc10690f91d35c6c79f12a50f0c365e	Mirai	elf ua-wget
http://190.123.46.208/Okami.ppc	5aaa6e61e77a0ae5c2e0909dc4b33ffe42be36a9caa0b23c69f94bd17c8e9a9a	Mirai	elf ua-wget
http://190.123.46.208/Okami.i586	c546f3bdfdfd8c9f1fea82cba068138fbce4a99120cd669a19e599666af7b15d	Mirai	elf ua-wget
http://190.123.46.208/Okami.m68k	12a56719352ae8b05f3bfb89a6fb3fa8ee72b09cc786d5c78db2a136dcbd6643	Mirai	elf ua-wget
http://190.123.46.208/Okami.sparc	74e00111529e7668048c7a7e9dcb37894341c377b736404e50092b49e726f9b3	Mirai	elf ua-wget
http://190.123.46.208/Okami.arm4	487802cb1226d9afd9eb0baa8672aca2cbab93ed612131eb4a9daf2a1fea5baf	Mirai	elf ua-wget
http://190.123.46.208/Okami.arm5	e3cda76bd383a3cbf3ab7923cce20e83f61b0fad46086842c94618abe8dc433f	Mirai	elf ua-wget
http://190.123.46.208/Okami.arm7	0c5a43a09933479366ed37cfe0eb036ac313677b227a82476f88664ffc1858e0	Mirai	elf ua-wget
http://190.123.46.208/Okami.ppc440	bc5ce535ad641bc9c447d8d57632481c2111f2726cbb52c45aec692a197f256b	Mirai	elf ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-08-29T03:22:00Z UTC

Last seen:

2026-08-29T14:01:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/bf2549291776de2b7b1ed3f4ebe62ffb0551d0527543db8bd4207b7844b4c7cc/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/fc912814-6229-4396-9217-2eddd2dbb556

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/bf2549291776de2b7b1ed3f4ebe62ffb0551d0527543db8bd4207b7844b4c7cc

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/bf2549291776de2b7b1ed3f4ebe62ffb0551d0527543db8bd4207b7844b4c7cc/

Threat name:

Linux.Downloader.Morila

Status:

Malicious

First seen:

2026-08-29 07:35:00 UTC

File Type:

Text (Shell)

AV detection:

21 of 36 (58.33%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=x4suskixo3pcw6y62p2oxzrp7mcvducsovb5xc6ueb5xqrfuy7ga._file

Result

Malware family:

n/a

Score:

7/10

Tags:

credential_access defense_evasion discovery linux

Link:

https://tria.ge/reports/260830-h16eeazbnb/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Changes its process name

Reads system network configuration

Reads process memory

Enumerates active TCP sockets

Enumerates running processes

File and Directory Permissions Modification

Executes dropped EXE

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.12

Link:

https://yomi.yoroi.company/submissions/bf2549291776de2b7b1ed3f4ebe62ffb0551d0527543db8bd4207b7844b4c7cc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ach_202412_suspect_bash_script Create hunting rule
Author:	abuse.ch
Description:	Detects suspicious Linux bash scripts

Rule name:	Linux_Shellscript_Downloader Create hunting rule
Author:	albertzsigovits
Description:	Generic Approach to Shellscript downloaders

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh