MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f1326d3d4cdb020010c11926d30d89517fccdd6f56c7d7eba3692afd6cda4ae0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 5

Intelligence 5 IOCs YARA 1 File information Comments

SHA256 hash:	f1326d3d4cdb020010c11926d30d89517fccdd6f56c7d7eba3692afd6cda4ae0
SHA3-384 hash:	17312c5e9ac7606e4fbaffade9fa027d1a77ac0774def6eda89a69b24ff0f4d56528fcbf1157e68e0395317bdbf7a01d
SHA1 hash:	888f433cf12466c1a988e3e4e7652ebffd205131
MD5 hash:	70fa3ac8764e2120332aaae12a051777
humanhash:	apart-uranus-paris-alabama
File name:	c.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	929 bytes
First seen:	2026-10-28 18:51:58 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	12:+f2ol7f2AsV7f2eNIOOA7f2DNK4H7f2pKA7f2csH7f2N7f2sTDkw7f2QvH7f2EcY:qpVAHNISSKYNQ+b+tTDkAtTPX
TLSH	T152115ADE7351B452DB3C9F8430798800E544C3D17AAE2A48FEFC1426AAEC7087275F0A
Magika	batch
Reporter	BlinkzSec

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://176.65.139.131/bins/sora.arm	c2527edd8a151bd38c285fae5b1a05073dd007eb41b9742e4e8c6302cda74171	Mirai	176-65-139-131 elf mirai ua-wget
http://176.65.139.131/bins/sora.arm5	a7bee7772c36d3bca082ef978f0701fd19828214a3ef037c081a67875606353c	Mirai	176-65-139-131 elf mirai ua-wget
http://176.65.139.131/bins/sora.arm6	ed9700be3e503a5f0daa4aaac62ea9a0afd6cb4d084f297219e848d915541001	Mirai	176-65-139-131 elf mirai ua-wget
http://176.65.139.131/bins/sora.arm7	f0a829d16d7436e44c779c21aef6baef0108ca2a56aa1aa81f519d1c6e149695	Mirai	176-65-139-131 elf mirai ua-wget
http://176.65.139.131/bins/sora.sh4	e61e3c03c5cd1ca820771b2d52fe8c6cea275278b883e502afdcacac60e388d7	Mirai	176-65-139-131 elf mirai ua-wget
http://176.65.139.131/bins/sora.ppc	98bb3cb82cc8213b1a9d0f7ffb975426ab02a839f0bdf3f31dff6a016de8fb41	Mirai	176-65-139-131 elf mirai ua-wget
http://176.65.139.131/bins/sora.mips	948e5aebf2f51f680b8a8267c7eb8b00f43ec3beb89064bb37a0b46e177df227	Mirai	176-65-139-131 elf mirai ua-wget
http://176.65.139.131/bins/sora.mpsl	ede49f0f9c0ce3158c1b200ef49f9b2f431568aee58673015ade392bb998332f	Mirai	176-65-139-131 elf mirai ua-wget
http://176.65.139.131/bins/sora.spc	8e3f6ff473c300175a24302f9a16e14a0a2cd8f6475039abcc7b024eca6a5a97	Mirai	176-65-139-131 elf mirai ua-wget
http://176.65.139.131/bins/sora.x86	e82ed993402d454dfd3951cc29e839d0eef5634d3f14ec25e1ecc1ada967ac52	Mirai	176-65-139-131 elf mirai ua-wget
http://176.65.139.131/bins/sora.m68k	76fb8ec93b54a0cbf042ec82363b09286ddc821a13e4d1b0830b9b5df0260912	Mirai	176-65-139-131 elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

SecuriteInfo.com.Shell.Downloader.Gen-1.UNOFFICIAL

Verdict:

Malicious

File Type:

text

First seen:

2026-10-27T21:03:00Z UTC

Last seen:

2026-10-29T11:52:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/f1326d3d4cdb020010c11926d30d89517fccdd6f56c7d7eba3692afd6cda4ae0/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/90492f9b-167b-4188-bd1b-38bacb011d14

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/f1326d3d4cdb020010c11926d30d89517fccdd6f56c7d7eba3692afd6cda4ae0

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f1326d3d4cdb020010c11926d30d89517fccdd6f56c7d7eba3692afd6cda4ae0/

Threat name:

Document-HTML.Trojan.Multiverze

Status:

Malicious

First seen:

2026-10-28 00:24:41 UTC

File Type:

Text (Shell)

AV detection:

14 of 36 (38.89%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=6ezg2pkm3mbaaegbdetngdmjkf74zxlpk3d5p25dnevp23g2jlqa._file

Result

Malware family:

n/a

Score:

3/10

Tags:

execution

Link:

https://tria.ge/reports/261028-xh6d1sev5t/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Executes a command shell one-liner

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/f1326d3d4cdb020010c11926d30d89517fccdd6f56c7d7eba3692afd6cda4ae0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh