MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cac16de59cd6c00305f0d9a8fa5a2adb5e4dac2dde02b78705f126a94546fe85. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 8


Intelligence 8 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cac16de59cd6c00305f0d9a8fa5a2adb5e4dac2dde02b78705f126a94546fe85
SHA3-384 hash: bf826e3491d8953567382d4b99c1bef1ff24b6f01aeb3dfe5b7cc88444a8e14b1f73d82e0dc82332f73845f33f42a3fa
SHA1 hash: 337fc7a94259d4a117fe2eb35ba9184feb83ec89
MD5 hash: 2368ac3acb08766f54a6bf55852b6cc2
humanhash: artist-stream-low-alaska
File name:nz.sh
Download: download sample
Signature Mirai
Create hunting rule
File size:2'759 bytes
First seen:2026-06-20 13:00:22 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 48:iplrpcSEp//3pghpKlpitpsTOsTGFlpNbpKhLpvpJpA5rpatpnzTpp5VpGSF:i/eJywYOdazX+LVqkRjNF
TLSH T1AA5188C6108177326DF6DD32BABA88157280D09B64CFAF999DD8BBA984CDD04BC51743
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter BlinkzSec
Tags:mirai
URLMalware sample (SHA256 hash)SignatureTags
http://176.65.139.195/nz/nz.x86c544eee59638d1d3441f2626e2023dfc92c7c44ed88bdb08bef0ea097eb8728f Miraielf mirai ua-wget
http://176.65.139.195/nz/nz.mipsecd77437663c82b46b518c398a5dbe2c41c132822aa1d1a6c0fa8b3a94e32707 Miraielf mirai ua-wget
http://176.65.139.195/nz/nz.arcb6879f66c164afdb98d084b660bcf9e2297d70c1fe616007da9538f5d48cd6b2 Miraielf mirai ua-wget
http://176.65.139.195/nz/nz.i468n/an/aelf ua-wget
http://176.65.139.195/nz/nz.i686e79f3b7ebc19d82946535e4521866d5658ef41111c9bc162330c470b19680877 Miraielf mirai ua-wget
http://176.65.139.195/nz/nz.x86_64800ffd8e69478a788f8c22cb7b7968e63ab7b460d6d88fdab8a9f5d49766efcf Miraielf mirai ua-wget
http://176.65.139.195/nz/nz.mpsl416cb81120c61d0727cd1920a83513c3c46b5e36dac19db7b2137a5024730bc4 Miraielf mirai ua-wget
http://176.65.139.195/nz/nz.arm7b81b5ac951a02eefd5e0e401aabc2bb463365ed69dbd862c719bcb28646b33e Miraielf mirai ua-wget
http://176.65.139.195/nz/nz.arm586279b40d44922be8ab094828cd4a18bc74fbb8f45f0573bccc89890ae2f110f Miraielf mirai ua-wget
http://176.65.139.195/nz/nz.arm6bf24bb11d0dbdacf7e077a68f9db56e563a2c32287194f7c63c7f1a061aa177a Miraielf mirai ua-wget
http://176.65.139.195/nz/nz.arm758401f02567784b8db27ca0b0c2d01fc037c1b7c02ed269ce0d446eeda1aebbb Miraielf mirai ua-wget
http://176.65.139.195/nz/nz.ppc85d2eac1764a73f08fada318703215b8958d59226c7adb1832f15922f2ad3c2d Miraielf mirai ua-wget
http://176.65.139.195/nz/nz.spc0c5636e105c7572c4a64c6aef2564f67304f5d8c17b466d2ad7bc630d0a65956 Miraielf mirai ua-wget
http://176.65.139.195/nz/nz.m68k7ca44fd4dafbab0d887e95504b9ee69f0ba2b9fad8d9e656917557980d681532 Miraielf mirai ua-wget
http://176.65.139.195/nz/nz.sh4e8f4b4cd88fa898539e4ccc2c2de14df5bdc78b5e2dae1053725574169dfaa68 Miraielf mirai ua-wget

Intelligence

File Origin
# of uploads :
1
# of downloads :
50
Origin country :
SE SE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL
Create hunting rule

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
busybox evasive obfuscated
Link:
https://www.filescan.io/uploads/6a36910a90632a45f72e937c/reports/b62356f4-72de-4abe-b193-20742f79f633/overview
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/c7f3bd08-aa2d-4062-8203-6f66103f0948
Behavior Graph:
Download SVG
%3 guuid=a7f88747-1e00-0000-53c0-b341440c0000 pid=3140 /usr/bin/sudo guuid=6797674b-1e00-0000-53c0-b3414c0c0000 pid=3148 /tmp/sample.bin guuid=a7f88747-1e00-0000-53c0-b341440c0000 pid=3140->guuid=6797674b-1e00-0000-53c0-b3414c0c0000 pid=3148 execve guuid=f33edf4b-1e00-0000-53c0-b3414f0c0000 pid=3151 /usr/bin/cp guuid=6797674b-1e00-0000-53c0-b3414c0c0000 pid=3148->guuid=f33edf4b-1e00-0000-53c0-b3414f0c0000 pid=3151 execve guuid=40292f4d-1e00-0000-53c0-b341540c0000 pid=3156 /usr/bin/wget guuid=6797674b-1e00-0000-53c0-b3414c0c0000 pid=3148->guuid=40292f4d-1e00-0000-53c0-b341540c0000 pid=3156 execve
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/cac16de59cd6c00305f0d9a8fa5a2adb5e4dac2dde02b78705f126a94546fe85
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cac16de59cd6c00305f0d9a8fa5a2adb5e4dac2dde02b78705f126a94546fe85/
Verdict:
Malicious
Threat:
Family.MIRAI
Link:
https://tip.neiki.dev/file/cac16de59cd6c00305f0d9a8fa5a2adb5e4dac2dde02b78705f126a94546fe85
Threat name:
Linux.Downloader.Medusa
Create hunting rule
Status:
Malicious
First seen:
2026-06-20 12:59:57 UTC
File Type:
Text (Shell)
AV detection:
21 of 36 (58.33%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zlaw3zm423aagbpq3gupuwrk3npe3lbn3yblpbyf6etksrkg72cq._file
Result
Malware family:
mirai
Create hunting rule
Score:
  10/10
Tags:
family:mirai antivm botnet defense_evasion discovery linux
Link:
https://tria.ge/reports/260620-p9fcxagv2x/
Behaviour
Reads runtime system information
System Network Configuration Discovery
Writes file to tmp directory
Checks CPU configuration
Enumerates running processes
Writes file to system bin folder
File and Directory Permissions Modification
Modifies Watchdog functionality
Family: Mirai
Malware Config
C2 Extraction:
u87yy3f87b23f8293bfg83bgu94.bombamodzik.xyz
Malware family:
Mirai
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/cac16de59cd6/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.39
Link:
https://yomi.yoroi.company/submissions/cac16de59cd6c00305f0d9a8fa5a2adb5e4dac2dde02b78705f126a94546fe85

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts
Rule name:Linux_Shellscript_Downloader
Create hunting rule
Author:albertzsigovits
Description:Generic Approach to Shellscript downloaders
Rule name:MAL_Linux_IoT_MultiArch_BotnetLoader_Generic
Create hunting rule
Author:Anish Bogati
Description:Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:MalwareBazaar sample lilin.sh

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh cac16de59cd6c00305f0d9a8fa5a2adb5e4dac2dde02b78705f126a94546fe85

(this sample)

Mirai

elf 3e404a0ab97927b8b179e01d7ca0b1f20af0b35a8356103fb308b38fa9ac1b3c

Mirai

elf c544eee59638d1d3441f2626e2023dfc92c7c44ed88bdb08bef0ea097eb8728f

  
URLhaus
https://urlhaus.abuse.ch/url/3868160/
  
Delivery method
Distributed via web download
  
Dropping
MD5 d5f91fc95e3790abfe3d85ca6b4d114a
  
Dropping
SHA256 c544eee59638d1d3441f2626e2023dfc92c7c44ed88bdb08bef0ea097eb8728f

Comments