MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0cff3d53bc4c2b36478f401d8ea437eb990f2818f9dd20cb116f894bdf0f18ff. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 5

Intelligence 5 IOCs YARA 1 File information Comments

SHA256 hash:	0cff3d53bc4c2b36478f401d8ea437eb990f2818f9dd20cb116f894bdf0f18ff
SHA3-384 hash:	025eeb0703a82203aa8cd5ba8ec8e999be51bbadba8fccbf3c0af5acdb8b7b64b096ad5e11fecc951793ff3db790f94a
SHA1 hash:	5facbf0d4bd0a8bd7c8fd4a7b3a4002d9de5daf5
MD5 hash:	9e57e9d3415565f1ce390c95c4e47845
humanhash:	kentucky-india-jersey-minnesota
File name:	w.sh
Download:	download sample
File size:	1'172 bytes
First seen:	2026-05-14 02:49:07 UTC
Last seen:	2026-05-14 14:04:47 UTC
File type:	sh
MIME type:	text/plain
ssdeep	12:y75bA1MftNIOWAerKgHgKAlN3Q3qgNrX47OrcALyuAzA+90Ln:W5bhNIvKsJpI7sm9In
TLSH	T14121F5D802A1BE99C989CD04706E87446184C6D334E4EBD89CBD58BF6B85E10F16DFAF
Magika	txt
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://156.238.242.196/manji.arm4	02f4cc2631d467285e7da67c1cc6a94f5719bce4e26ce26ff8605ad37697abbe	Mirai	arm elf mirai opendir ua-wget
http://156.238.242.196/manji.arm5	c217d74d21449bed31d7a882a830b0b35ca7e1c9da1aa9d4d5ca1923e4401c93	Mirai	arm elf mirai opendir ua-wget
http://156.238.242.196/manji.arm6	cdf7e0346ea4f27dc3aa07e98ef4d1d87fe269bcf45022999931f84ddb0c0ece	Mirai	arm elf mirai opendir ua-wget
http://156.238.242.196/manji.arm7	5fa602bdd9f6156629e7b8ef4ac87b7c3f903a812ec63e7988fb343cfa36bc89	Mirai	arm elf mirai opendir ua-wget
http://156.238.242.196/manji.sh4	927eaae876733594f2889b37b1701a8d90ad708bf83da4dd77e967966c51873f	Mirai	elf mirai opendir SuperH ua-wget
http://156.238.242.196/manji.arc	4d10e894f61f4145fcb923f4f465058e2f8b0ec03b06be9dce9678f35d94a134	Mirai	arc elf mirai opendir ua-wget
http://156.238.242.196/manji.mips	1319fc34a179751881b02a64be28a48be30ec0aaef7100e964995d60ed478973	Mirai	elf mips mirai opendir ua-wget
http://156.238.242.196/manji.mpsl	da6b482991f7adca439cc9208321e0e05fafcf3dcfd41a299cb0b667256ac276	Mirai	elf mips mirai opendir ua-wget
http://156.238.242.196/manji.spc	019df454f6accab72dcb3c8723043e8a4ce512ef15748547d370ef89872685a0	Mirai	elf mirai opendir sparc ua-wget
http://156.238.242.196/manji.x86	298f12ed211ccb843022b76357e7daca81b4adc337bc12e4a82e093ce06b6ade	Mirai	elf mirai opendir ua-wget x86
http://156.238.242.196/manji.i686	4dfec9b7cd5d733c4873b773316e804d380f90ae5562fb7b2cc7a9304b6fabf8	Mirai	elf mirai opendir ua-wget x86
http://156.238.242.196/manji.i486	2ee7081223b0b64ae4994d8caaaa586468850287daa93b0c980b42177d37b1f8	Mirai	elf mirai opendir ua-wget x86
http://156.238.242.196/manji.apk	5fa602bdd9f6156629e7b8ef4ac87b7c3f903a812ec63e7988fb343cfa36bc89	Mirai	arm elf mirai opendir ua-wget

Intelligence

File Origin

# of uploads :

369

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

busybox mirai

Link:

https://www.filescan.io/uploads/6a05c3b09b72a1a5304d54a4/reports/b846a121-7d55-40fe-a88e-e467e0964bde/overview

Result

Gathering data

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/ba8b9c89-fbab-4298-ab9e-4189a52a3f46

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/0cff3d53bc4c2b36478f401d8ea437eb990f2818f9dd20cb116f894bdf0f18ff

Gathering data

Threat name:

Linux.Downloader.Generic

Status:

Suspicious

First seen:

2026-05-14 07:28:44 UTC

File Type:

Text (Shell)

AV detection:

14 of 36 (38.89%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=bt7t2u54jqvtmr4piaoy5jbx5omq6kay7hosbsyrn6euxxypdd7q._file

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.05

Link:

https://yomi.yoroi.company/submissions/0cff3d53bc4c2b36478f401d8ea437eb990f2818f9dd20cb116f894bdf0f18ff

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh