MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0ac60e87e97270103a1b3d6bc8b359c106284decb8e2087d09adb8a768791a81. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	0ac60e87e97270103a1b3d6bc8b359c106284decb8e2087d09adb8a768791a81
SHA3-384 hash:	87f8b896c6052d966b8198b1ef67725ef92fe8ce0d566081a415c39b06053ef9cee644b7cc8daabce58f6ae9a2e60e95
SHA1 hash:	994088e19bd6fe5481a5469a5e9243c77466b5b5
MD5 hash:	e72cfea2632c610345a973e0e1d6a450
humanhash:	sad-mountain-nuts-delaware
File name:	bins.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	1'301 bytes
First seen:	2026-10-01 11:40:43 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	24:ZToB+oQToQA+ogToBNIQ+oxNITToyKPB+okKP2ToqDH+oqnTo83+o5QToZHB+oRL:ZToB+oQToQA+ogTov+ooToyKPB+okKPR
TLSH	T12C21E1DA62E170B3C469EDA2B39880D4E04985C650E77FBEFCAC64B1489941CF1B5BA1
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	BlinkzSec

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://176.65.139.219/amd64	16bc0dfc9d6d24b682b76a61405ef05b250341b2fe48a46b1672267c979ca2de	Mirai	176-65-139-219 elf mirai ua-wget
http://176.65.139.219/arm	dbc1a1977dd3fc6d5540a93cd4ee8c6bc15d3e956616634367624beffbb49016	Mirai	176-65-139-219 elf mirai ua-wget
http://176.65.139.219/arm6	207c09e098f00a3426beb07a22c7697b12db8003da9a0e0d044875babc8f687f	Mirai	176-65-139-219 elf GoDDoSAgent mirai ua-wget
http://176.65.139.219/arm64	68315ccc5dba003a026b9a6a8a4cd6026be2494d3720d19b8df6ee5e0258c208	Mirai	176-65-139-219 elf mirai ua-wget
http://176.65.139.219/bot.exe	c05a49f1183b96574f47cf0cc5b88f81e2d7fb2e66a11e921782a18f78214a34	GORAT	176-65-139-219 exe gorat ua-wget
http://176.65.139.219/mips	95b54f0e5d5d5ef2bd87167bb0da4dd553aaf2da8e6a3a919e0ce881a78b6124	Mirai	176-65-139-219 DDoSAgent elf GoDDoSAgent mirai ua-wget
http://176.65.139.219/mipsle	76d3fe2d4d446368e8a26fe8e7fc13159dfb4acfb9ed530b39ad5ca367765102	Mirai	176-65-139-219 elf mirai ua-wget
http://176.65.139.219/x86	d3fec8b8daa70334fe2e8f803309dd916bcee7381d8a71d299f9dff46867d04c	Mirai	176-65-139-219 elf GoDDoSAgent mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-10-01T09:53:00Z UTC

Last seen:

2026-10-03T03:08:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/0ac60e87e97270103a1b3d6bc8b359c106284decb8e2087d09adb8a768791a81/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/c7d2838e-ccfc-4db8-a0e9-30042522396d

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/0ac60e87e97270103a1b3d6bc8b359c106284decb8e2087d09adb8a768791a81

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/0ac60e87e97270103a1b3d6bc8b359c106284decb8e2087d09adb8a768791a81/

Threat name:

Win32.Trojan.Egairtigado

Status:

Malicious

First seen:

2026-10-01 11:40:30 UTC

File Type:

Text (Shell)

AV detection:

17 of 38 (44.74%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=blda5b7jojybaoq3hvv4rm2zyedcqtpmxdraq7ijvw4ko2dzdkaq._file

Result

Malware family:

n/a

Score:

8/10

Tags:

antivm defense_evasion discovery linux persistence privilege_escalation

Link:

https://tria.ge/reports/261001-ntn5fatxcs/

Behaviour

Enumerates kernel/hardware configuration

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Checks CPU configuration

Modifies Bash startup script

Creates/modifies environment variables

Write file to user bin folder

File and Directory Permissions Modification

Executes dropped EXE

Downloads MZ/PE file

Malware family:

MultiGoDDoS

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/0ac60e87e972/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.42

Link:

https://yomi.yoroi.company/submissions/0ac60e87e97270103a1b3d6bc8b359c106284decb8e2087d09adb8a768791a81

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh