MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0c24349de012b44ecfbf50064f41eae9cf8036ca8ff9e0c58a095abdeb31c6c2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 6


Intelligence 6 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0c24349de012b44ecfbf50064f41eae9cf8036ca8ff9e0c58a095abdeb31c6c2
SHA3-384 hash: 6bd3284d5437e769bb01f31d0828b7431bd2ec7ae948abc941d28676f4d5f51915fa008105f846bb54998c5e3084282d
SHA1 hash: 35fc684108de5e79c88e584df5d9244f519085aa
MD5 hash: 7d2614c881747b43e0696812155c712d
humanhash: michigan-comet-timing-robert
File name:nigger.sh
Download: download sample
Signature Mirai
Create hunting rule
File size:1'716 bytes
First seen:2026-01-12 15:08:42 UTC
Last seen:Never
File type: sh
MIME type:text/plain
ssdeep 48:AVThJWdVjNJ6C9EyrNjAiGOWy48Tk78GQn2:AVTh0VjNRE0NjAu743vQ2
TLSH T12631C9CF463F39154EC7CF1B73E107CA5185A3E1E097DBF59808192668C5888749DEE9
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://91.92.241.10/x86_64.kok78e260a5118578e0b4d1a55374c217c218c48ab8f7455dd5a28a70746f99f715 Miraielf geofenced mirai ua-wget USA x86
http://91.92.241.10/x86_32.kok03d7a243a18f053113e199837d74324b063c744679e681dde068d129d109af9f Miraielf geofenced mirai ua-wget USA x86
http://91.92.241.10/nigga44d1b3689ea3188249b2d008020bec2dc2c5d82d25eeff708c1d776e0801ecf6 Miraielf geofenced mirai ua-wget USA x86
http://91.92.241.10/powerpc.kok7570d065c824764a1a3a6c65496685bfc83eff811cc1345ccb7273141950cb46 Miraielf geofenced mirai PowerPC ua-wget USA
http://91.92.241.10/mips.kokdf84c58145c759e99c74fed1570dbf9089dfb200669fb911f4d60f307ef63648 Miraielf geofenced mips mirai ua-wget USA
http://91.92.241.10/mipsel.kokd8409d9322d329c981e3ebaa0f02336bcfd122f93210ad1aa627a125196d5a57 Miraielf geofenced mips mirai ua-wget USA
http://91.92.241.10/arm.kokf762c3e51a32e4e93fd41fe3be4eac71606d84cc1372f5e100bff5b35241e74f Miraiarm elf geofenced mirai ua-wget USA
http://91.92.241.10/arm5.kokff4abf773e3047ea1a94dbb4d2a7032a9dccc7a396cad04511d991c66dc37448 Miraiarm elf geofenced mirai ua-wget USA
http://91.92.241.10/arm6.kok6ae6ed76ac1b59475676b279f542a724967a0a91c61aa76cb9e2d307b1e26fa7 Miraiarm elf geofenced mirai ua-wget USA
http://91.92.241.10/arm7.kok32a28b0a2b16b3f4d89f1931ee19a6726c967b9da88e8da04548dd90b900e1cd Miraiarm elf geofenced mirai ua-wget USA
http://91.92.241.10/sparc.kokn/an/aelf ua-wget
http://91.92.241.10/m68k.kokn/an/aelf ua-wget
http://91.92.241.10/sh4.kokn/an/aelf ua-wget

Intelligence

File Origin
# of uploads :
1
# of downloads :
43
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive mirai
Link:
https://www.filescan.io/uploads/69650ea547c44dd4f7755bf1/reports/cd6c84f2-fa77-4c51-8a3d-9f9eae8c31c4/overview
Result
Gathering data
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/0c24349de012b44ecfbf50064f41eae9cf8036ca8ff9e0c58a095abdeb31c6c2
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0c24349de012b44ecfbf50064f41eae9cf8036ca8ff9e0c58a095abdeb31c6c2/
Verdict:
Malicious
Threat:
Trojan-Downloader.Shell.Agent
Link:
https://tip.neiki.dev/file/0c24349de012b44ecfbf50064f41eae9cf8036ca8ff9e0c58a095abdeb31c6c2
Threat name:
Script-Shell.Trojan.Geninst
Create hunting rule
Status:
Malicious
First seen:
2026-01-12 10:42:33 UTC
File Type:
Text (Shell)
AV detection:
10 of 36 (27.78%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bqsdjhpack2e5t57kade6qpk5hhyanwkr746brmkbfnl32zry3ba._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/260112-sjnhdae15h/
Behaviour
Modifies registry class
Suspicious use of SetWindowsHookEx
Enumerates physical storage devices
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/0c24349de012b44ecfbf50064f41eae9cf8036ca8ff9e0c58a095abdeb31c6c2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts
Rule name:MAL_Linux_IoT_MultiArch_BotnetLoader_Generic
Create hunting rule
Author:Anish Bogati
Description:Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:MalwareBazaar sample lilin.sh

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh 0c24349de012b44ecfbf50064f41eae9cf8036ca8ff9e0c58a095abdeb31c6c2

(this sample)

Mirai

elf 78e260a5118578e0b4d1a55374c217c218c48ab8f7455dd5a28a70746f99f715

  
URLhaus
https://urlhaus.abuse.ch/url/3754457/
  
Delivery method
Distributed via web download
  
Dropping
MD5 0b7361d89981dd2fc528a089b8563377
  
Dropping
SHA256 78e260a5118578e0b4d1a55374c217c218c48ab8f7455dd5a28a70746f99f715

Comments