MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 efa115e73cc5b6e62de9a8dc6484abb63d67ea0dc9869f16607c94fd22157661. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	efa115e73cc5b6e62de9a8dc6484abb63d67ea0dc9869f16607c94fd22157661
SHA3-384 hash:	afca3e98372f9dea6731c3093d4efcc788fb17741b167d82875cb91d29fb148cea0f130454bbcaf79bea30d742f6b2ae
SHA1 hash:	c613b2c0044d88d84d6f1deea824848840bf4dd6
MD5 hash:	6584b9dc352a8d3b903d25d990edc01c
humanhash:	beryllium-fourteen-lithium-golf
File name:	run.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'434 bytes
First seen:	2026-08-06 13:13:17 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:7CU0bWAxqr/NocieyzF5XsYXgvvQjfxMPfRFSX0zEAUbSy1ExVj68f8Kh:7CU0jx6/NociegvRgvoCJFSX0zEAUWy6
TLSH	T188412E8E10705A3DA46FDD5C39F74700685486E276B23F295EA808739CC6B34736AF6D
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://130.12.182.77/main.aarch64	1c479b17d535928324765344297c6db41d144187130e411a950899c27ffb645c	Mirai	arm elf opendir ua-wget
http://130.12.182.77/main.arc700	c05d9e7c066b34ff31758c1ef678050d6f54b96d2aa6ac14c38a018d7fc9ee42	Mirai	arc elf opendir ua-wget
http://130.12.182.77/main.archs38	66821e5e5a4412eff9dc12b311595306f7625bd2bfcf01d2fa3f95813526bfc9	Mirai	elf opendir ua-wget
http://130.12.182.77/main.arm7	c9b93460facc84ad45aabe5cae0ecdde85cb68318f2346762aabebac61cb44a8	Mirai	arm elf opendir ua-wget
http://130.12.182.77/main.armebv7	17d30c6e0d88661e9ebed465c517245c82c32f981d86b507d7ad46449b8af259	Mirai	arm elf opendir ua-wget
http://130.12.182.77/main.armv4	659524ce4fc21df3f40342cb8ed64800a774944870d1e485fa386978318ca494	Mirai	arm elf opendir ua-wget
http://130.12.182.77/main.armv4eb	d0de9a68edb496b195291c034c9b1545dfbed89a66f037f94cf530f3ad7e568a	Mirai	arm elf opendir ua-wget
http://130.12.182.77/main.armv4tl	c3af80ab3698a8af577c11ab1b41132e16cecc19d67c8dd7051236dc6bc2cf88	Mirai	arm elf opendir ua-wget
http://130.12.182.77/main.armv5	380ae1df7465ce458e1fd8b343c2c132e98f45d8e9947e8f4de596e00a7d44a3	Mirai	arm elf opendir ua-wget
http://130.12.182.77/main.armv5-eabi	c303427198210a7326fc46db3cf4518d8891b785cb7ee73e068da25192d393cd	Mirai	arm elf opendir ua-wget
http://130.12.182.77/main.armv6	87682daf2c7e812a982d8afb7e4af1eb13eb8de9a8636fb81e95bb845bc701e1	Mirai	arm elf opendir ua-wget
http://130.12.182.77/main.armv6-eabihf	8050259673238818b7ca1a4db72b737864423b3f8256420bfb5bde81e1c101a5	Mirai	arm elf opendir ua-wget
http://130.12.182.77/main.armv7-eabihf	5fdde879e2d203e52b76780ff8320d24939712bd86fa1784f4920b5bb2cfecb3	Mirai	arm elf opendir ua-wget
http://130.12.182.77/main.e300c3	afe86bde95df45ca3dca8c600521b0be377f4f238196621ae6b5052e3633c0bc	Mirai	elf opendir PowerPC ua-wget
http://130.12.182.77/main.i486	4d5f56042c16c2040b8736588363e47101b6a12c387f9021e95e3bb381212a70	Mirai	elf opendir ua-wget x86
http://130.12.182.77/main.microblazebe	30f692360dcbd48498857cac7a7ce2e1118e9f9d1531a47f1d4a08a6a3ecc298	Mirai	elf opendir ua-wget
http://130.12.182.77/main.microblazeel	7e77daab048b12f2251f6d67f90fcd7a7810a798c2130006258340db0fd28217	Mirai	elf opendir ua-wget
http://130.12.182.77/main.mips	2382ed9a5978527dc5a0eb0cde51737a513e46b944c084debf9eed19dc3eb4d4	Mirai	elf mips opendir ua-wget
http://130.12.182.77/main.mips32el	348168a1b5956e10c04390d58b867a0d5ab801a118a36ee2db8a77febac98216	Mirai	elf mips opendir ua-wget
http://130.12.182.77/main.mips64	c26f9ff29660f2a7ddac08f331e32745a8cd5d6ace666188323bb68013b86099	Mirai	elf mips opendir ua-wget
http://130.12.182.77/main.mipsel	da8c479c595e43bb952b8011a5d15c35e69a45371e887b8ebf1f74aee5804a32	Mirai	elf mips opendir ua-wget
http://130.12.182.77/main.nios2	3080c315540b3013faf6669709bd92c4b958262ede77b76c88f4daf993b859e1	Mirai	elf opendir ua-wget
http://130.12.182.77/main.openrisc	7290b8236a71c07e509ff0f6b23f0fbb3bc8da70869359fe6d609fc6900e1130	Mirai	elf opendir ua-wget
http://130.12.182.77/main.powerpc	20153f76d585aaf1896d3b0689770bab3ec9fdd829121b5f4d0fc1e5c39ee686	Mirai	elf opendir PowerPC ua-wget
http://130.12.182.77/main.riscv32	fc74ff6113dff8b86c5c5ef9e5bb6307a557ff4234a0e67a76b98c2bae5d931d	Mirai	elf opendir RISC-V ua-wget
http://130.12.182.77/main.sh4	478bc2e8c99e73aba5f68ea8bd7247d3931a2f20151d0315537c9162bdfdaece	Mirai	elf opendir SuperH ua-wget
http://130.12.182.77/main.riscv64	f79dbd577ae5552492651e5f972afc2a571858de06ae45c438de402ec102881d	Mirai	elf opendir RISC-V ua-wget
http://130.12.182.77/main.sparc	f1b6c216445db6d4bbbea78817b5bfeb9a3c670b0cfe5331e75e6b951525e958	Mirai	elf opendir sparc ua-wget
http://130.12.182.77/main.x86_64	c7dea8868503193794cf725b9f7858b41086b248f61a4ac47c9242833275b896	Mirai	elf opendir ua-wget x86
http://130.12.182.77/main.xtensa	c2b48bfc06814d4f60b56e0dc441e6f536e2cbd7efb2dc393f34393d90970167	Mirai	elf opendir ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/6a7488b6d3a317bde9512880/reports/d9f561a6-7f6d-42b8-a9ed-6c137e99d3ea/overview

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-08-05T16:57:00Z UTC

Last seen:

2026-08-06T13:03:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/efa115e73cc5b6e62de9a8dc6484abb63d67ea0dc9869f16607c94fd22157661/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/8ff200f1-97e0-4534-9773-8fc41f2f2d5e

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/efa115e73cc5b6e62de9a8dc6484abb63d67ea0dc9869f16607c94fd22157661

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/efa115e73cc5b6e62de9a8dc6484abb63d67ea0dc9869f16607c94fd22157661/

Threat name:

Script-Shell.Worm.Mirai

Status:

Malicious

First seen:

2026-08-05 19:53:53 UTC

File Type:

Text (Shell)

AV detection:

13 of 24 (54.17%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=56qrlzz4yw3omlpjvdogjbflwy6wp2qnzgdj6ftapskp2iqvozqq._file

Result

Malware family:

n/a

Score:

7/10

Tags:

defense_evasion discovery linux

Link:

https://tria.ge/reports/260806-qgjqasaa52/

Behaviour

System Network Configuration Discovery

Writes file to tmp directory

File and Directory Permissions Modification

Executes dropped EXE

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh