MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ee5a675efa018c0679a321c2de42fd26d7440f5cd904f772c84e0f744f459978. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	ee5a675efa018c0679a321c2de42fd26d7440f5cd904f772c84e0f744f459978
SHA3-384 hash:	dcdd3311be5ac0ee31a2073ac6153236f98d46461e3df38b6a37f3d7d5279c482aef7564a183f14915751d4ee13fc2c8
SHA1 hash:	3846e6a26793ae43d289076e3895cf2632fd688a
MD5 hash:	ba45e1276f0860934ea9aa557e87cf1c
humanhash:	yankee-low-neptune-black
File name:	blink.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	4'837 bytes
First seen:	2026-08-10 15:20:22 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	96:jll87v5iTLxr6yAh33oJPujVyC65nn42Q7dA2SPB0LaTm/ViVXhIxF14px8fTcdd:jll87v5iTLxr6yAh33oJPujVyC65nn4o
TLSH	T15FA1E48A2470D73CA86FDE6C79E54B40988945E232B23F3A9EB018571CC9970B349F5E
Magika	csv
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://130.12.182.77/main.aarch64	n/a	n/a	arm elf mirai opendir ua-wget
http://130.12.182.77/main.aarch64be	n/a	n/a	arm elf opendir ua-wget
http://130.12.182.77/main.arc700	n/a	n/a	arc elf mirai opendir ua-wget
http://130.12.182.77/main.archs38	n/a	n/a	elf mirai opendir ua-wget
http://130.12.182.77/main.arm7	8e309f91353197022b436a770fff7421b76552fc7eb052685413f08e17db49f6	Mirai	arm elf mirai opendir ua-wget
http://130.12.182.77/main.armebv7	n/a	n/a	arm elf mirai opendir ua-wget
http://130.12.182.77/main.armv4	59f255347969aa82d875e878ee41604dcc7475a63c73dba58cf8ff2569669116	Mirai	arm elf mirai opendir ua-wget
http://130.12.182.77/main.armv4eb	n/a	n/a	arm elf mirai opendir ua-wget
http://130.12.182.77/main.armv4tl	146ae2b9523e9bdadb477b51e6e66b5e7f643f20c9706f0a3572446ddc3ba849	Mirai	arm elf mirai opendir ua-wget
http://130.12.182.77/main.armv5	8ae5df9b6e67b60c19a55793d8ba1b614c6fa4d42e75582697a6db2d3eda150b	Mirai	arm elf mirai opendir ua-wget
http://130.12.182.77/main.armv5-eabi	n/a	n/a	arm elf mirai opendir ua-wget
http://130.12.182.77/main.armv6	28c8a375115f283377aab40b697d6019d3360c5e913f0d159b1ee8f5af9003ec	Mirai	arm elf mirai opendir ua-wget
http://130.12.182.77/main.armv6-eabihf	28c3620bf420d2fe4fd54ab0b34c06eea18f61da419be2d482b85c4cf30d7321	Mirai	arm elf mirai opendir ua-wget
http://130.12.182.77/main.armv7-eabihf	bb0ae3b1ad361529bd2b8a6b5523cadebae95c82fa0ea8cb9206963ef597f40b	Mirai	arm elf mirai opendir ua-wget
http://130.12.182.77/main.e300c3	n/a	n/a	elf mirai opendir PowerPC ua-wget
http://130.12.182.77/main.e500mc	n/a	n/a	elf opendir PowerPC ua-wget
http://130.12.182.77/main.e5500	aa17ea69626b98e2b911e39b4c3fdd2963f8c40d8f58f69d0a70509b89f6e7e6	Mirai	elf mirai opendir PowerPC ua-wget
http://130.12.182.77/main.e6500	n/a	n/a	elf opendir PowerPC ua-wget
http://130.12.182.77/main.i486	eeafc43bb1ff4f056d0e5e8c40b6b0561889c430a27ada2e87b5f8b57df9c1ab	Mirai	elf mirai opendir ua-wget x86
http://130.12.182.77/main.m68k-68xxx	n/a	n/a	elf m68k opendir ua-wget
http://130.12.182.77/main.microblazebe	n/a	n/a	elf mirai opendir ua-wget
http://130.12.182.77/main.microblazeel	n/a	n/a	elf mirai opendir ua-wget
http://130.12.182.77/main.mips	a743806caf6bc8b7bd42ac45890b5259af91068ab0f1062e717c00a9a5d3c7d4	Mirai	elf mips mirai opendir ua-wget
http://130.12.182.77/main.mips32	n/a	n/a	elf mips opendir ua-wget
http://130.12.182.77/main.mips32el	fd8712d7e332f6e2974131788a2b23ddce1e11fb5cde91e5edb6801a68857e22	Mirai	elf mips mirai opendir ua-wget
http://130.12.182.77/main.mips32r5el	n/a	n/a	elf mips opendir ua-wget
http://130.12.182.77/main.mips32r6el	n/a	n/a	elf mips opendir ua-wget
http://130.12.182.77/main.mips64	62385232479b24892b542b2123c0514f7899814f0ee1a6e5c7b692f8fb96618d	Mirai	elf mips mirai opendir ua-wget
http://130.12.182.77/main.mips64el-n32	n/a	n/a	elf mips opendir ua-wget
http://130.12.182.77/main.mips64-n32	n/a	n/a	elf mips opendir ua-wget
http://130.12.182.77/main.mips64r6el-n32	n/a	n/a	elf mips opendir ua-wget
http://130.12.182.77/main.mipsel	4b9e703299491e1ef17eb53dbb7a9949e02e081c319c6fa6c5e2b8ed84f28eae	Mirai	elf mips mirai opendir ua-wget
http://130.12.182.77/main.nios2	9cb871a274b7163c58dbf2ad5663e4c5c8b807f6ce887db3959f8e620ce2185b	Mirai	elf mirai opendir ua-wget
http://130.12.182.77/main.openrisc	n/a	n/a	elf mirai opendir ua-wget
http://130.12.182.77/main.power8	n/a	n/a	elf opendir PowerPC ua-wget
http://130.12.182.77/main.power8le	n/a	n/a	elf opendir PowerPC ua-wget
http://130.12.182.77/main.powerpc	n/a	n/a	elf mirai opendir PowerPC ua-wget
http://130.12.182.77/main.ppc440fp	n/a	n/a	elf mirai opendir PowerPC ua-wget
http://130.12.182.77/main.riscv32	59a463d1610d03625f803d11ba91b9380e636f1830e103039681ad18edb7b1ca	Mirai	elf mirai opendir RISC-V ua-wget
http://130.12.182.77/main.riscv64	n/a	n/a	elf mirai opendir RISC-V ua-wget
http://130.12.182.77/main.s390x	7a174f653381d7c791070a68d87249f1bad916d201664b31b440297230c6b726	Mirai	elf mirai opendir s390x ua-wget
http://130.12.182.77/main.sh4	2464b4ef4d95ed605329fb87dde5ef20230926c0571dd47bd427af045c01c0f0	Mirai	elf mirai opendir SuperH ua-wget
http://130.12.182.77/main.sh4aeb	302819a3568a56fcbbfce3649328c18e900267dcc11c2fdf1c61d0318eb831c6	Mirai	elf opendir SuperH ua-wget
http://130.12.182.77/main.sh4musl	n/a	n/a	elf mirai opendir SuperH ua-wget
http://130.12.182.77/main.sparc	n/a	n/a	elf mirai opendir sparc ua-wget
http://130.12.182.77/main.sparc64	8c54f60dcda7e913f32acc07568b2b761e7d4e8cbeec229b9d2777066b426e14	Mirai	elf mirai opendir ua-wget
http://130.12.182.77/main.sparcv8	0273d3705b043809cb63e3f09f2b776a2a5d66e5b0afc85baaa2ee455a718b67	Gafgyt	elf gafgyt opendir sparc ua-wget
http://130.12.182.77/main.x86-64	n/a	n/a	elf mirai opendir ua-wget x86
http://130.12.182.77/main.x86_64	1417470886b23fe79a76d8015a6ef15ed4b8507507f6332598035ce66b40278e	Mirai	elf gafgyt mirai opendir ua-wget x86
http://130.12.182.77/main.x86-64-i7	n/a	n/a	elf mirai opendir ua-wget x86
http://130.12.182.77/main.x86-64-v2	9ab5ac47c2042d48c073cecf3e3781167e2863c1c4840d4be6c0e81036ad80f8	Mirai	elf opendir ua-wget x86
http://130.12.182.77/main.x86-64-v3	9caad13ae137c6e82ae28866abf3d2a8f0f1ae5f6ce8b185a3a454b9b3f10ced	Mirai	elf opendir ua-wget x86
http://130.12.182.77/main.x86-64-v4	n/a	n/a	elf mirai opendir ua-wget x86
http://130.12.182.77/main.x86-core2	n/a	n/a	elf mirai opendir ua-wget x86
http://130.12.182.77/main.x86-i686	n/a	n/a	elf mirai opendir ua-wget x86
http://130.12.182.77/main.xtensa	n/a	n/a	elf mirai opendir ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

mirai

Link:

https://www.filescan.io/uploads/6a79ec44b831bf6082d5e9fd/reports/4cdca546-2ca9-4769-b22a-9f9471e68ba8/overview

Verdict:

Malicious

File Type:

text

First seen:

2026-08-10T14:07:00Z UTC

Last seen:

2026-08-10T14:14:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/ee5a675efa018c0679a321c2de42fd26d7440f5cd904f772c84e0f744f459978/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/d775f8cf-b01e-4a34-a667-8b69c4f880e3

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/ee5a675efa018c0679a321c2de42fd26d7440f5cd904f772c84e0f744f459978

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ee5a675efa018c0679a321c2de42fd26d7440f5cd904f772c84e0f744f459978/

Threat name:

Win32.Trojan.Qwexlafiba

Status:

Malicious

First seen:

2026-08-10 16:09:37 UTC

File Type:

Text (Shell)

AV detection:

8 of 24 (33.33%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=5zngoxx2aggam6ndehbn4qx5e3luid243ecpo4wijyhxit2ftf4a._file

Result

Malware family:

n/a

Score:

3/10

Tags:

execution

Link:

https://tria.ge/reports/260810-sq37eaxtdx/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Executes a command shell one-liner

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/ee5a675efa018c0679a321c2de42fd26d7440f5cd904f772c84e0f744f459978

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh