MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ca57cf60551cd43f7d5408d4d3d88ec1e6781a0840601f9f4548fbc14392020c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 3

Intelligence 3 IOCs YARA 1 File information Comments

SHA256 hash:	ca57cf60551cd43f7d5408d4d3d88ec1e6781a0840601f9f4548fbc14392020c
SHA3-384 hash:	c63be762e254b5f0fd55fd1addf08d90f8be2822daf9c238b7017a04152d338126bb0cf4ba4fbd9427e890c401033f45
SHA1 hash:	0e654089207334e04dd0c8c2e030f63ec3eafd76
MD5 hash:	29476f050704a01f1d7a1837fed2d6d4
humanhash:	mockingbird-pluto-connecticut-uranus
File name:	cat.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'430 bytes
First seen:	2026-10-27 12:54:47 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	24:spcBpNpcbp9pYpRpKpCEp4pxpqp1pWp/pIpdpapzpMpecZpmpDDpYpDU:sO3QXyr0TC7EnYRKv81uMko9Da9U
TLSH	T17041088D1BA9535ACAD8C562E0BAE9084F0CA78551FB3C34E949DE72FCE5C10F63D660
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	BlinkzSec

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://176.65.139.156/iranbot-ultimate.x86_64	n/a	n/a	elf ua-wget
http://176.65.139.156/iranbot-ultimate.aarch64	01dae93af638e17f975ba53ed4f69b2983d96dab32e2a45b4280eb03bfbbccb1	Mirai	176-65-139-156 elf ua-wget
http://176.65.139.156/iranbot-ultimate.mips	30ff3cdd0408a2ea5c2d19f519b34ac390d4ebdbc260f1871eaea0fddf3fd9a0	Mirai	176-65-139-156 elf mirai ua-wget
http://176.65.139.156/iranbot-ultimate.mipsel	34968bc2f981c733c1b8b1f0f44736a28c2d90e66e7f40f36affcad3c002426b	Mirai	elf ua-wget
http://176.65.139.156/iranbot-ultimate.x86_32	0b2f9d5b8d548b7ba4567cd174762d8a1ad5d0301379b81be77c17562de95487	Mirai	176-65-139-156 elf ua-wget
http://176.65.139.156/iranbot-ultimate.armv4l	be40fc53311e964e6c9b4676127c5a19b3368763fb0e0196fb2078265bb90cf1	Ngioweb	elf ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/12be2184-63ab-442e-ac20-79556ea7033e

Behavior Graph:

Download SVG

Score:

99%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/ca57cf60551cd43f7d5408d4d3d88ec1e6781a0840601f9f4548fbc14392020c

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ca57cf60551cd43f7d5408d4d3d88ec1e6781a0840601f9f4548fbc14392020c/

Gathering data

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=zjl46ycvdtkd67kubdknhweoyhthqgqiibqb7h2fjd54cq4saiga._file

Result

Malware family:

n/a

Score:

7/10

Tags:

antivm credential_access defense_evasion discovery linux

Link:

https://tria.ge/reports/261027-p5ycxsd12r/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Changes its process name

Checks CPU configuration

Reads process memory

Enumerates running processes

File and Directory Permissions Modification

Executes dropped EXE

Traces itself

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.11

Link:

https://yomi.yoroi.company/submissions/ca57cf60551cd43f7d5408d4d3d88ec1e6781a0840601f9f4548fbc14392020c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh