MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 efa115e73cc5b6e62de9a8dc6484abb63d67ea0dc9869f16607c94fd22157661. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	efa115e73cc5b6e62de9a8dc6484abb63d67ea0dc9869f16607c94fd22157661
SHA3-384 hash:	afca3e98372f9dea6731c3093d4efcc788fb17741b167d82875cb91d29fb148cea0f130454bbcaf79bea30d742f6b2ae
SHA1 hash:	c613b2c0044d88d84d6f1deea824848840bf4dd6
MD5 hash:	6584b9dc352a8d3b903d25d990edc01c
humanhash:	beryllium-fourteen-lithium-golf
File name:	run.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'434 bytes
First seen:	2026-08-06 13:13:17 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:7CU0bWAxqr/NocieyzF5XsYXgvvQjfxMPfRFSX0zEAUbSy1ExVj68f8Kh:7CU0jx6/NociegvRgvoCJFSX0zEAUWy6
TLSH	T188412E8E10705A3DA46FDD5C39F74700685486E276B23F295EA808739CC6B34736AF6D
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://130.12.182.77/main.aarch64	n/a	n/a	arm elf mirai opendir ua-wget
http://130.12.182.77/main.arc700	n/a	n/a	arc elf mirai opendir ua-wget
http://130.12.182.77/main.archs38	48dfe414f0a7c65142e363655ea7144eb74c9d23b246904b21e4685031c2c6e8	Mirai	elf mirai opendir ua-wget
http://130.12.182.77/main.arm7	8e309f91353197022b436a770fff7421b76552fc7eb052685413f08e17db49f6	Mirai	arm elf mirai opendir ua-wget
http://130.12.182.77/main.armebv7	a2c234532b5d6f314b3ec4cf29eff0ea6f39d3ce23940e97c339a562c1e570d4	Mirai	arm elf mirai opendir ua-wget
http://130.12.182.77/main.armv4	59f255347969aa82d875e878ee41604dcc7475a63c73dba58cf8ff2569669116	Mirai	arm elf mirai opendir ua-wget
http://130.12.182.77/main.armv4eb	ca14dc48ccad7c092d942e290e4519c861eb6145a1fbd89ed81b3c15e2da0f83	Mirai	arm elf mirai opendir ua-wget
http://130.12.182.77/main.armv4tl	28f8e370da1c68269b2ee15985216d9cc0dded716687833bac18379b235c43a3	Mirai	arm elf mirai opendir ua-wget
http://130.12.182.77/main.armv5	8ae5df9b6e67b60c19a55793d8ba1b614c6fa4d42e75582697a6db2d3eda150b	Mirai	arm elf mirai opendir ua-wget
http://130.12.182.77/main.armv5-eabi	c238e2f72a3940662daa22b1b5c81c4b42eba1b78a75a764a7ebb4f67ec40bd7	Mirai	arm elf mirai opendir ua-wget
http://130.12.182.77/main.armv6	28c8a375115f283377aab40b697d6019d3360c5e913f0d159b1ee8f5af9003ec	Mirai	arm elf mirai opendir ua-wget
http://130.12.182.77/main.armv6-eabihf	bf1654fc2e9fd294ab2243fd088a0f933d66f7a8db2cd4542ee94ba48c1a4816	Mirai	arm elf mirai opendir ua-wget
http://130.12.182.77/main.armv7-eabihf	d6f5cfc4c369d784a0cd75a520d6e719954c6aef4f9a3720150390fa0fcb3345	Mirai	arm elf mirai opendir ua-wget
http://130.12.182.77/main.e300c3	650cccc991d70a021d8b5efecce182378657fa7385cf0ec487cc6056662babb5	Mirai	elf mirai opendir PowerPC ua-wget
http://130.12.182.77/main.i486	n/a	n/a	elf mirai opendir ua-wget x86
http://130.12.182.77/main.microblazebe	n/a	n/a	elf mirai opendir ua-wget
http://130.12.182.77/main.microblazeel	n/a	n/a	elf mirai opendir ua-wget
http://130.12.182.77/main.mips	d2dad3befbc3598b574187cfca2ca7cd2f8bb55bbd682d4190767b98d03cb1ea	Mirai	elf mips mirai opendir ua-wget
http://130.12.182.77/main.mips32el	n/a	n/a	elf mips mirai opendir ua-wget
http://130.12.182.77/main.mips64	e6c403005b6b5573b35c5f37918e3297183ba5de0266b4fb878036be67ea4092	Mirai	elf mips mirai opendir ua-wget
http://130.12.182.77/main.mipsel	62900587da4553f9f3c84a31bf2fbac85c286731836a83e7c213cb614ccc152b	Mirai	elf mips mirai opendir ua-wget
http://130.12.182.77/main.nios2	626e8187d504a416705b551c52f91856c71d98eab341c5820acf555e0bb23f1d	Mirai	elf mirai opendir ua-wget
http://130.12.182.77/main.openrisc	n/a	n/a	elf mirai opendir ua-wget
http://130.12.182.77/main.powerpc	1c707bbdf2937e5c5e64e6a6bc03349ddd4b2ed7f870de7b8bf7e8989e09fa78	Mirai	elf mirai opendir PowerPC ua-wget
http://130.12.182.77/main.riscv32	4f2c77768598082bb7574eef1d558826b4016106cadb07962b8144162d7ce956	Mirai	elf mirai opendir RISC-V ua-wget
http://130.12.182.77/main.sh4	c81efd1b47f6c372d670d6f0ebde6b3dcba715c0f4bf172a7662ba4240f41944	Mirai	elf mirai opendir SuperH ua-wget
http://130.12.182.77/main.riscv64	1129446cb94148988acd6efd5ba70a7077ef3e2c9db62230a61c44da92345810	Mirai	elf mirai opendir RISC-V ua-wget
http://130.12.182.77/main.sparc	7e9fa00a2d3224c15c3d15a8aea4590d5e257d63cd51b0f92ab1eb85af19db04	Mirai	elf mirai opendir sparc ua-wget
http://130.12.182.77/main.x86_64	ad6095e0cd1aac8e57137bff757e195fb617b9332fcc47d9be11c52ff42c42b4	Mirai	elf gafgyt mirai opendir ua-wget x86
http://130.12.182.77/main.xtensa	0eaee2cebbeca2f7f2c0cdee58d0f7d039c53576148604f7da30e05b05a13ea2	Mirai	elf mirai opendir ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/6a7488b6d3a317bde9512880/reports/d9f561a6-7f6d-42b8-a9ed-6c137e99d3ea/overview

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-08-05T16:57:00Z UTC

Last seen:

2026-08-06T13:03:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/efa115e73cc5b6e62de9a8dc6484abb63d67ea0dc9869f16607c94fd22157661/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/8ff200f1-97e0-4534-9773-8fc41f2f2d5e

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/efa115e73cc5b6e62de9a8dc6484abb63d67ea0dc9869f16607c94fd22157661

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/efa115e73cc5b6e62de9a8dc6484abb63d67ea0dc9869f16607c94fd22157661/

Threat name:

Script-Shell.Worm.Mirai

Status:

Malicious

First seen:

2026-08-05 19:53:53 UTC

File Type:

Text (Shell)

AV detection:

13 of 24 (54.17%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=56qrlzz4yw3omlpjvdogjbflwy6wp2qnzgdj6ftapskp2iqvozqq._file

Result

Malware family:

n/a

Score:

7/10

Tags:

defense_evasion discovery linux

Link:

https://tria.ge/reports/260806-qgjqasaa52/

Behaviour

System Network Configuration Discovery

Writes file to tmp directory

File and Directory Permissions Modification

Executes dropped EXE

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh