MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f45d00b523ab87329167f45e2de8522a07d9d2a5f63dd7a5bbb422e75519a4c1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 6

Intelligence 6 IOCs YARA 2 File information Comments

SHA256 hash:	f45d00b523ab87329167f45e2de8522a07d9d2a5f63dd7a5bbb422e75519a4c1
SHA3-384 hash:	28cf423e19098f112c87d909ae5f16a9a208c6cd26cba102e4daec093d824107013a76d82e9930b5d7e7887b9619156f
SHA1 hash:	f5522717e66525f2ed3b07dbd653a519f3d6e6e2
MD5 hash:	fc2e4b260983e987319379a81cda1d2b
humanhash:	carolina-triple-bacon-twenty
File name:	bins.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	1'364 bytes
First seen:	2026-10-17 19:28:09 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	24:v+FAqVzFlJNJeF+IlFQs+VKFD4UFwLTNI4FN/ks2K4FlXFF:v+FAqVzFTbeF+IlF1FFDfFwLbFN/J2z7
TLSH	T173214FD691E15A36AC64D877B4AE5DA478D0E4D604E56F0828FC38F064CDE4EE481B93
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://104.168.4.206/dissmips	65988926d1a02d38a6c08ee0e0dbb966dabcb337aff3344c635fd53e43512d8d	Mirai	censys elf gafgyt mirai ua-wget
http://104.168.4.206/dissmpsl	2fbd50ef3b12511425f2ee45e07b39c11fa261953ebfec45d4a31426148320fa	Mirai	censys elf gafgyt mirai ua-wget
http://104.168.4.206/disssh4	35e9f2443d7fa3c500ab7be64d9ffb5f90fd30453f4e4d3adfe43b6ecce8330e	Mirai	censys elf mirai ua-wget
http://104.168.4.206/dissx86	b9b00a11b0bdecee5e9e1a56a89611267cc5881b258196e4df6166372ba1ea98	Mirai	censys elf gafgyt mirai ua-wget
http://104.168.4.206/dissarm4	d849fb8000891cf3cca1b755eac2eda328135ae73041cfcd6f7eb612f6b9ab20	Gafgyt	censys elf gafgyt mirai ua-wget
http://104.168.4.206/adissarm5	d9a4f09acbe5baf37d129ddc8a22c25a2fb42c3437667ad676ea3a08e4d0371c	Mirai	censys elf gafgyt mirai ua-wget
http://104.168.4.206/dissarm6	1fdac0e0f2fda9d161056beab78fa1c4fc82216e1158eeb8ecabc643139a7fc3	Mirai	censys elf gafgyt mirai ua-wget
http://104.168.4.206/dissarm7	8d88cda5439279eb70e789a8718f8f27a40d328bc674d6d5197731935dbd16a5	Mirai	censys elf mirai ua-wget
http://104.168.4.206/disspoor	b8529448ca17ba76f5dbc39be1fd5d82c83bac8e2dd946e84b13414666967d9f	Mirai	elf gafgyt mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

evasive

Link:

https://www.filescan.io/uploads/6ad3cc53f47d9339f6e9b82a/reports/e2fa9737-c351-4e05-91f7-5caede005066/overview

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-10-17T16:46:00Z UTC

Last seen:

2026-10-19T17:08:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/f45d00b523ab87329167f45e2de8522a07d9d2a5f63dd7a5bbb422e75519a4c1/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/3cf1d8ea-ef3a-4168-901f-c5f6a13f4183

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/f45d00b523ab87329167f45e2de8522a07d9d2a5f63dd7a5bbb422e75519a4c1

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f45d00b523ab87329167f45e2de8522a07d9d2a5f63dd7a5bbb422e75519a4c1/

Threat name:

Linux.Downloader.Morila

Status:

Malicious

First seen:

2026-10-17 19:28:23 UTC

File Type:

Text (Shell)

AV detection:

15 of 23 (65.22%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=6roqbnjdvodtfelh6rpc32csfid5tuvf6y65pjn3wqroovizutaq._file

Result

Malware family:

n/a

Score:

7/10

Tags:

defense_evasion discovery linux

Link:

https://tria.ge/reports/261017-x6rwjabw7j/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Changes its process name

File and Directory Permissions Modification

Executes dropped EXE

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.16

Link:

https://yomi.yoroi.company/submissions/f45d00b523ab87329167f45e2de8522a07d9d2a5f63dd7a5bbb422e75519a4c1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Linux_Shellscript_Downloader Create hunting rule
Author:	albertzsigovits
Description:	Generic Approach to Shellscript downloaders

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh