MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e596cb6f4084a8dbf3e7819d9b6b116bfcf84f4ed2c8c677c128af5aab7bf87d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 6

Intelligence 6 IOCs YARA 2 File information Comments

SHA256 hash:	e596cb6f4084a8dbf3e7819d9b6b116bfcf84f4ed2c8c677c128af5aab7bf87d
SHA3-384 hash:	1dcb47c01d3b91f726e9fbb76dad516d6a614f1cd111b0ddb3b3cd53c8b907402f58f4d4cecd174c6b2fc54f4c64220f
SHA1 hash:	e7ce92e92b52879d847f3e11b3dc64e0e0d0becb
MD5 hash:	96134070b6dfbf3ced3257262ce085a2
humanhash:	hydrogen-mango-pennsylvania-floor
File name:	gocl
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'565 bytes
First seen:	2026-08-31 16:12:22 UTC
Last seen:	2026-08-31 21:57:10 UTC
File type:	sh
MIME type:	text/x-shellscript
ssdeep	24:vLLHifLC6tLsLqL6L5dNLPLaLXvLQLqLnFLVL5bV:vviCa+cM5jTsDycnJ5b
TLSH	T186517CD527420E713DA39DE763BA9C083588AEFF54C26E1AA5F938E4464ED84F180B53
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	BlinkzSec

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://46.151.182.200/bot.x86	c5badbc7eb2ff4f904156ed9b517c22c7dfba122e540dfbf7f0d4156d7a9976d	Mirai	elf mirai ua-wget
http://46.151.182.200/bot.mips	2bdcd6e8a368c28488926a4773bf4cc2d5840ced8cb6499e417c3743cec7c44c	Mirai	elf mirai ua-wget
http://46.151.182.200/bot.arc	f8a45723a8bcd8f0858b958a9d61f38a7b657949ffe3d43038be0e7f562c24d0	Mirai	elf mirai ua-wget
http://46.151.182.200/bot.i468	n/a	n/a	censys elf ua-wget
http://46.151.182.200/bot.i686	d9bce6c9a1e6dc24747f2b754bc3ec0b381bac755d2dcc52db38c87fce8a46ab	Mirai	elf mirai ua-wget
http://46.151.182.200/bot.x86_64	08ffaa3060aceda41990ab74a6f996b8fced28c3e3065e23e8cdebdb255be0e0	Mirai	elf mirai ua-wget
http://46.151.182.200/bot.mpsl	d0d1bbcd8900f190bc7b24e1b15e5558fbc917e5172712075207ee3e29c16a3f	Mirai	elf mirai ua-wget
http://46.151.182.200/bot.arm	3cf3edeeeac605be90d682b402ca8f34841633b05b45be6be2c50d30e5563fb2	Mirai	arm elf mirai ua-wget
http://46.151.182.200/bot.arm5	70dce1cfed01b0cbaa7a50d2d23f44cd80621947a082c424a0c55a2e3fe48d61	Mirai	elf mirai ua-wget
http://46.151.182.200/bot.arm6	6e2317a8a15f7dfdda44266aea43fa0579fe4319546e7a47e07b53e8e5e4fdae	Mirai	elf mirai ua-wget
http://46.151.182.200/bot.arm7	bdbcb94265f715c4e044499b7f18a9193972117c06daf9097f91afe812de6207	Mirai	arm elf mirai ua-wget
http://46.151.182.200/bot.ppc	d5c876aed3c43d53d1c37d5ea33a44e84fcd3af80a10c53b020fb8946bfd3765	Mirai	elf mirai ua-wget
http://46.151.182.200/bot.spc	6dea295dace414dcecb4580a7882b707364cd31ea7708e4ec0643a022091b152	Mirai	elf mirai ua-wget
http://46.151.182.200/bot.m68k	59b3e567a22126d9d26ab758dabe2a17908d0c48d326fdf2c260546fd8b220c8	Mirai	elf mirai ua-wget
http://46.151.182.200/bot.sh4	4892824a9316779d423c3190df9bcaa9cdbde0756eb225b7a7ad5746dc04f654	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/a57181cb-ee01-4081-9a3c-79672c3809e3

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/e596cb6f4084a8dbf3e7819d9b6b116bfcf84f4ed2c8c677c128af5aab7bf87d

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e596cb6f4084a8dbf3e7819d9b6b116bfcf84f4ed2c8c677c128af5aab7bf87d/

Threat name:

Linux.Downloader.Morila

Status:

Malicious

First seen:

2026-08-31 16:11:55 UTC

File Type:

Text (Shell)

AV detection:

22 of 36 (61.11%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=4wlmw32aqsunx47hqgozw2yrnp6pqt2o2lemm56bfcxvvk337b6q._file

Result

Malware family:

n/a

Score:

7/10

Tags:

antivm defense_evasion discovery execution linux persistence privilege_escalation

Link:

https://tria.ge/reports/260831-tn61yswaph/

Behaviour

Enumerates kernel/hardware configuration

Reads runtime system information

System Network Configuration Discovery

Writes file to shm directory

Writes file to tmp directory

Changes its process name

Checks CPU configuration

Creates a desktop entry file

Modifies Bash startup script

Creates/modifies Cron job

Creates/modifies environment variables

Deletes log files

Modifies init.d

Modifies rc script

Modifies systemd

Write file to user bin folder

Writes file to system bin folder

File and Directory Permissions Modification

Executes dropped EXE

Modifies Watchdog functionality

Traces itself

Unexpected DNS network traffic destination

Malware family:

Mirai

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/e596cb6f4084/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/e596cb6f4084a8dbf3e7819d9b6b116bfcf84f4ed2c8c677c128af5aab7bf87d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Linux_Shellscript_Downloader Create hunting rule
Author:	albertzsigovits
Description:	Generic Approach to Shellscript downloaders

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh