MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cf3cfd3dfd845daceaa8a13c39cd49aba786d6640255ec15c7a17e67b9a4e26a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 5


Intelligence 5 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cf3cfd3dfd845daceaa8a13c39cd49aba786d6640255ec15c7a17e67b9a4e26a
SHA3-384 hash: 7a4e7e0e8bd12ca4e10ed2730ad31281f36ceec8b151f0789bc9b4c568bfdece0d1c233449107545a8abe3b1331af812
SHA1 hash: ac4690eda0783a587fac417b5a8809a69d79332b
MD5 hash: afe511f4676b1ee0a9f7ec58fdccdae7
humanhash: robin-sixteen-eleven-vegan
File name:gpon443
Download: download sample
Signature Mirai
Create hunting rule
File size:2'863 bytes
First seen:2026-02-03 16:39:56 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 48:vzyu4z3U4z584zHw4zBw4zdudzE4zoC4zR84zKu4zLM4zH+4z7x7Uf4zAu4zjWb:vzyu4z3U4z584zHw4zBw4zM9E4zoC4z8
TLSH T1AB51BEC532214AF4AFB14DA6B6B644057489A0D5BEC70FC9E6FC34FE014CF0A6C916AA
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://94.26.106.177/bins/sora.x86e9e378387a21bdfc4c1f424ec79a209ceba05d1f0919d6dca05e5623e3f941fd Miraielf mirai ua-wget
http://94.26.106.177/bins/sora.mips5e74a50c9255cda93e51e37903260477800d9aac1301e8447a8793a83529c07a Mirai32-bit elf mirai Mozi
http://94.26.106.177/bins/sora.x86_649494683239ff99d86db9145ddd361c5014eef8506c720ef34bae542b1f140c88 Miraielf mirai ua-wget
http://94.26.106.177/bins/sora.i468n/an/aelf ua-wget
http://94.26.106.177/bins/sora.i68628d2d9759823d69e7fc46485b53a413b38ef2f8ff504dd397b6726c21c5dcd19 Miraielf mirai ua-wget
http://94.26.106.177/bins/sora.mpslc62afaff80ce42bd7e8f6f3b66e45da9a3b36d00fcd630936d28fbce2c9d8f26 Miraielf mirai ua-wget
http://94.26.106.177/bins/sora.arm4n/an/aelf ua-wget
http://94.26.106.177/bins/sora.arm5681c788f1f1c6beb7f7ef7dce47c3971dbb506c5ce58a0caedbb7999efb9bd66 Miraielf mirai ua-wget
http://94.26.106.177/bins/sora.arm69633a560c9e528465418f37cb0111f6cbda015a4b46f4ab2efe27eaa0b75413b Miraielf mirai ua-wget
http://94.26.106.177/bins/sora.arm7n/an/aelf ua-wget
http://94.26.106.177/bins/sora.ppcf67c66b6e0cf80b0546171bc249b825601f1078f0df6fb18402441eba65ad610 Miraielf mirai ua-wget
http://94.26.106.177/bins/sora.ppc440fpn/an/aelf ua-wget
http://94.26.106.177/bins/sora.m68k482fe1c5adf10b2feb46d79a6ba89ac5865e73fda816738642d61c03e2149e07 Miraielf mirai ua-wget
http://94.26.106.177/bins/sora.sh4be6d52de33de60fd6d03fc14a719eea4b605519b22370321e44acd102ba7447c Miraielf mirai ua-wget

Intelligence

File Origin
# of uploads :
1
# of downloads :
35
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL
Create hunting rule

Result
Gathering data
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/a3cab41f-26f2-4552-93b4-9fa06bb4880e
Behavior Graph:
Download SVG
%3 guuid=0e073c11-1900-0000-bf1a-7a87950c0000 pid=3221 /usr/bin/sudo guuid=dfa2b413-1900-0000-bf1a-7a879b0c0000 pid=3227 /tmp/sample.bin guuid=0e073c11-1900-0000-bf1a-7a87950c0000 pid=3221->guuid=dfa2b413-1900-0000-bf1a-7a879b0c0000 pid=3227 execve guuid=257a1914-1900-0000-bf1a-7a879d0c0000 pid=3229 /usr/bin/wget guuid=dfa2b413-1900-0000-bf1a-7a879b0c0000 pid=3227->guuid=257a1914-1900-0000-bf1a-7a879d0c0000 pid=3229 execve
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/cf3cfd3dfd845daceaa8a13c39cd49aba786d6640255ec15c7a17e67b9a4e26a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cf3cfd3dfd845daceaa8a13c39cd49aba786d6640255ec15c7a17e67b9a4e26a/
Verdict:
Malicious
Threat:
Family.MIRAI
Link:
https://tip.neiki.dev/file/cf3cfd3dfd845daceaa8a13c39cd49aba786d6640255ec15c7a17e67b9a4e26a
Threat name:
Linux.Downloader.Morila
Create hunting rule
Status:
Malicious
First seen:
2026-02-03 16:33:29 UTC
File Type:
Text (Shell)
AV detection:
22 of 36 (61.11%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=z46p2pp5qro2z2viue6dttkjvotynvteajk6yfohuf7gpone4jva._file
Result
Malware family:
n/a
Score:
  1/10
Tags:
linux
Link:
https://tria.ge/reports/260203-t6s7tahz8f/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.37
Link:
https://yomi.yoroi.company/submissions/cf3cfd3dfd845daceaa8a13c39cd49aba786d6640255ec15c7a17e67b9a4e26a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Linux_Shellscript_Downloader
Create hunting rule
Author:albertzsigovits
Description:Generic Approach to Shellscript downloaders
Rule name:MAL_Linux_IoT_MultiArch_BotnetLoader_Generic
Create hunting rule
Author:Anish Bogati
Description:Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:MalwareBazaar sample lilin.sh

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh cf3cfd3dfd845daceaa8a13c39cd49aba786d6640255ec15c7a17e67b9a4e26a

(this sample)

Mirai

elf c6addcb5c29a71af7c97ff54bb61a8ff2b05449c778f96ab495d8ff1e46e3c61

Mirai

elf e9e378387a21bdfc4c1f424ec79a209ceba05d1f0919d6dca05e5623e3f941fd

  
URLhaus
https://urlhaus.abuse.ch/url/3771581/
  
Delivery method
Distributed via web download
  
Dropping
MD5 047966b2c20f2cffffca8e41a6683874
  
Dropping
SHA256 e9e378387a21bdfc4c1f424ec79a209ceba05d1f0919d6dca05e5623e3f941fd

Comments