MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ea12483a63740d36605fd21c42ce7aae67b19c90e4fcfbf7ecea9f36492be5ce. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	ea12483a63740d36605fd21c42ce7aae67b19c90e4fcfbf7ecea9f36492be5ce
SHA3-384 hash:	dabacdabe0f1cd893789be4c6d854672ecd4c51795c3d04d26f5b9a9b00384f2fe425f9bbe5761b1a423d9c7b3eb0515
SHA1 hash:	8816aef5a1d625210c1b8f1c6a453c2f48bd34fb
MD5 hash:	566f92a54330ccda16c05cc9a09794d8
humanhash:	oranges-oven-solar-undress
File name:	w.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	1'817 bytes
First seen:	2026-08-16 17:30:39 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:6Wdx+pxCSxCLpxvWRx6IxGDxuixsUxuHxYzFxcQxyAx9M:r+rCkCLruD6CG9u0seuRYzXcayeM
TLSH	T1023184E4B3616E713D4E8F2CBE6411E946872D95A49F34E8D4C39DC4289E21CBA19A32
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	BlinkzSec
Tags:	mirai

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://94.154.43.122/bins/x86	de5e52a010cb1a88b64c410dda44d56d03cfed8aded705cbb3b305ee7b9245a8	Mirai	94-154-43-122 elf mirai ua-wget
http://94.154.43.122/bins/mips	b1f1b197882e2b6547bd2bea358bf949a12724fb024bbe8899e912e066ce2e16	Mirai	94-154-43-122 elf mirai ua-wget
http://94.154.43.122/bins/mipsel	cacb6c487a48887fd5567e4dc61dd799ab03edcc153608e7b8c0df9eb01c6cff	Mirai	94-154-43-122 elf mirai ua-wget
http://94.154.43.122/bins/arm	d335f4e78a5622c11efc213ad8aa577b2d76f12b6bf44c9d645f423f315eb694	Mirai	94-154-43-122 elf mirai ua-wget
http://94.154.43.122/bins/arm5	d8af3f2541124c25bd8bca1970eea9283229fb67adbed45a2bb9e368c30ea45f	Mirai	94-154-43-122 elf mirai ua-wget
http://94.154.43.122/bins/arm6	5eee1f6a29b6c1c13130ae1c2e7020dd83fc755d6b995c04e4db457e5c5a92af	Mirai	94-154-43-122 elf mirai ua-wget
http://94.154.43.122/bins/arm7	9017f68b9ef0c1f5954e3b50c1984d88e1e49449f1b7afd220b6931fecfe0430	Mirai	94-154-43-122 elf mirai ua-wget
http://94.154.43.122/bins/ppc	8220c8b6785864f587a492d44176ed986fb30ef10c459c3068b183e7d20033a2	Mirai	94-154-43-122 elf mirai ua-wget
http://94.154.43.122/bins/spc	39f9dc4520e018356d2b6678d248f5c7b8c70449bc356a6e86cd243ccc0adc1d	Mirai	94-154-43-122 elf mirai ua-wget
http://94.154.43.122/bins/m68k	fd375233ae40384734539bd50dca5cdc44f5b2309389a1c58c17b90f7f04888d	Mirai	94-154-43-122 elf mirai ua-wget
http://94.154.43.122/bins/sh4	0456e20d11f2d38aa5b216487ffbff956da517c4121d91bc6e2461793aa40d71	Mirai	94-154-43-122 elf mirai ua-wget
http://94.154.43.122/bins/x86_64	6c326405d6be80549c0ccb6f57a318f1c553fea01ac24bfca03fe66dd5e545dd	Mirai	94-154-43-122 elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

evasive mirai

Link:

https://www.filescan.io/uploads/6a81f5ac51ad642e4bc51d42/reports/c9aba233-9762-4232-9518-c0172fb3b75f/overview

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-08-16T03:40:00Z UTC

Last seen:

2026-08-17T13:08:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/ea12483a63740d36605fd21c42ce7aae67b19c90e4fcfbf7ecea9f36492be5ce/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/7392e479-34d0-4156-bf6c-24b0491db7d9

Behavior Graph:

Download SVG

Score:

99%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/ea12483a63740d36605fd21c42ce7aae67b19c90e4fcfbf7ecea9f36492be5ce

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ea12483a63740d36605fd21c42ce7aae67b19c90e4fcfbf7ecea9f36492be5ce/

Threat name:

Win32.Trojan.Malgent

Status:

Malicious

First seen:

2026-08-16 08:37:36 UTC

File Type:

Text (Shell)

AV detection:

9 of 24 (37.50%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=5ijeqotdoqgtmyc72ioeftt2vzt3dheq4t6px57m5kptmsjl4xha._file

Result

Malware family:

mirai

Score:

10/10

Tags:

family:mirai botnet:owari botnet defense_evasion discovery linux

Link:

https://tria.ge/reports/260816-v36jeatakg/

Behaviour

System Network Configuration Discovery

Writes file to tmp directory

Changes its process name

Reads system network configuration

Enumerates active TCP sockets

File and Directory Permissions Modification

Executes dropped EXE

Modifies Watchdog functionality

Family: Mirai

Malware Config

C2 Extraction:

tuxbot.cc
94.154.43.122

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh