MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d89797f86209851d76e35e47f8cea372165b65f1fc6bb32446c980ff8bae7752. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 8

Intelligence 8 IOCs YARA 3 File information Comments

SHA256 hash:	d89797f86209851d76e35e47f8cea372165b65f1fc6bb32446c980ff8bae7752
SHA3-384 hash:	429a8286a0104d802c2a9bd319975ed5bf6d6d38598d9740f2552efd6f602d56b1fa596dd9b28351ceb6fe4c304d76cc
SHA1 hash:	64e5920f12cc3fa422681e830c60a346fc2f64d5
MD5 hash:	9816e90cfa33a7601f9cd6477ebd9913
humanhash:	stairway-johnny-tango-virginia
File name:	nz.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'759 bytes
First seen:	2026-06-29 21:45:57 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	24:ItS/LsST+TIhOESlK3SqdASkNPsScuS9Tn9TGF7JSIQIGASE8LS3n3NINksS+orK:ibhER3SkU6T9TGFlDaLLJkrAFTVV5F
TLSH	T10751C1C7110943322D729DE6BBBB486930D1C1AA64CBFF56E5D8B8A44E8DD0C7C62A53
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://41.216.189.157/nz/nz.x86	ae764a11e5a7aa0b064846590708a01c7541c73f50ced0637fcb7b786b196303	Mirai	elf mirai opendir ua-wget x86
http://41.216.189.157/nz/nz.mips	ecd48e585d767d48436611c32cde8150c75c640ffee1b19363801315bab2cd37	Mirai	elf mips mirai opendir ua-wget
http://41.216.189.157/nz/nz.arc	b833394b614d4635a17a3ae30d43380fbc0b8dcd7a8de601715f8d87e9489c85	Mirai	arc elf mirai opendir ua-wget
http://41.216.189.157/nz/nz.i468	n/a	n/a	elf ua-wget
http://41.216.189.157/nz/nz.i686	2d1e9c6afa3bcb327bdb9edaca055723e8b1f61f62d3f013d94c304aad396204	Mirai	elf mirai opendir ua-wget x86
http://41.216.189.157/nz/nz.x86_64	291d03172e06e9e95e794bb65db38e68c1c18489b03e6d5b00457350c13199e8	Mirai	elf mirai opendir ua-wget x86
http://41.216.189.157/nz/nz.mpsl	b86a145adcb90395127d64256074b4ec26c15a5b22f5a1fd4378763d915eb4f2	Mirai	elf mips mirai opendir ua-wget
http://41.216.189.157/nz/nz.arm	896700e89222787a983c34556c488d3f97e7a71126e25f8decb91ab9680a3bfe	Mirai	arm elf mirai opendir ua-wget
http://41.216.189.157/nz/nz.arm5	c354ef61b366b2e0989fc57af7e0ab64f7c4858ac54ebf473fc9560d0d9c8f28	Mirai	arm elf mirai opendir ua-wget
http://41.216.189.157/nz/nz.arm6	ddce145c358df4f6edf58ffebec7d43fbfff35e0d6495998a30a9d9f1ea31cee	Mirai	arm elf mirai opendir ua-wget
http://41.216.189.157/nz/nz.arm7	8793d30a43d8d26aad7c46f03752199a39434a1350708eedf2b238de7728c52a	Mirai	arm elf mirai opendir ua-wget
http://41.216.189.157/nz/nz.ppc	ff5db5caf6782f99d432fcb8f183fdafb3646319ffda1f0a4dc9d71c8b8ea072	Mirai	elf mirai opendir PowerPC ua-wget
http://41.216.189.157/nz/nz.spc	01bdd508596f3df96874ecc2fd43cacf0482f6e7041f383704ea2e7ea321ad4a	Mirai	elf mirai opendir sparc ua-wget
http://41.216.189.157/nz/nz.m68k	c26c49402f1bfdf8312b1a32d7875f8817243b389940051adc18b89bf338591b	Mirai	elf m68k mirai opendir ua-wget
http://41.216.189.157/nz/nz.sh4	bf237640d3c51687df288217abc2b25d7d43ea81780323b94a39b000f4bcd3cf	Mirai	elf mirai opendir SuperH ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

busybox evasive

Link:

https://www.filescan.io/uploads/6a42e7e03bd24e83dc3ebf08/reports/b84cf716-da08-4659-8628-68b1803719e8/overview

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-06-29T19:05:00Z UTC

Last seen:

2026-07-01T13:13:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/d89797f86209851d76e35e47f8cea372165b65f1fc6bb32446c980ff8bae7752/results?tab=lookup

Status:

Failed

Link:

https://sandbox.kunai.rocks/analysis/09baf975-4e3c-4b88-b798-27bc0d3b48ca

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/d89797f86209851d76e35e47f8cea372165b65f1fc6bb32446c980ff8bae7752

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d89797f86209851d76e35e47f8cea372165b65f1fc6bb32446c980ff8bae7752/

Threat name:

Linux.Downloader.Medusa

Status:

Malicious

First seen:

2026-06-29 21:48:33 UTC

File Type:

Text (Shell)

AV detection:

22 of 38 (57.89%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=3clzp6dcbgcr25xdlzd7rtvdoilfwzpr7rv3gjcgzgap7c5oo5ja._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai antivm botnet defense_evasion discovery linux

Link:

https://tria.ge/reports/260629-1mzntag15m/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Checks CPU configuration

Enumerates running processes

Writes file to system bin folder

File and Directory Permissions Modification

Modifies Watchdog functionality

Family: Mirai

Malware Config

C2 Extraction:

hjcddajltcsdas.hopto.org

Malware family:

Mirai

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/d89797f86209/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.36

Link:

https://yomi.yoroi.company/submissions/d89797f86209851d76e35e47f8cea372165b65f1fc6bb32446c980ff8bae7752

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ach_202412_suspect_bash_script Create hunting rule
Author:	abuse.ch
Description:	Detects suspicious Linux bash scripts

Rule name:	Linux_Shellscript_Downloader Create hunting rule
Author:	albertzsigovits
Description:	Generic Approach to Shellscript downloaders

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh