MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 11fff7d4c7e60460c9f27211964df7dca64b318fec736298cac7342fefe464ef. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	11fff7d4c7e60460c9f27211964df7dca64b318fec736298cac7342fefe464ef
SHA3-384 hash:	056b9c55e2596adcce4b8b9b44f7cb293d5f937c6fe1190cbc7cbe4dfe9c05d3d7a854cfb66de5a9ecfb327b47a02863
SHA1 hash:	9adc64a40f047d55c8f0742cbb9162841b185838
MD5 hash:	d1891d8b0ce656c66ab86f3d25954451
humanhash:	mexico-oscar-early-music
File name:	Sassy-Cats.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'160 bytes
First seen:	2026-04-15 04:11:53 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	24:fvpbEGELH2kEkECv+cE6mfvvVE36v+cE6F1RFvgRTgRBEgR/zgRiIvW4WKEWkWZm:RXIH7ytnB1A+rbdUteO0lZ1o9H0fmI
TLSH	T17041878947F4238EF1C48E07FC998D756196A4A016BC5A00E0740DF2E3BF887B6F5567
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://46.101.46.29/.Sassy/.Sassy.x86_64	ecf3db15e6f1b63848133bf3bcbd2159e54469886c1088630d789cba08ddacca	Mirai	elf mirai opendir ua-wget
http://46.101.46.29/.Sassy.aarch64	n/a	n/a	elf opendir ua-wget
http://46.101.46.29/.Sassy/.Sassy.m68k	ce9a05f2f5ce82cd3a4345423047209e347fb64d7c7cb2c34510e4a4186e3d58	Mirai	elf mirai opendir ua-wget
http://46.101.46.29/.Sassy/.Sassy.mips	7bf180a23a1791906926eeba7b9a1221eafec493a8f17ef728e684d5c32d9afd	Mirai	elf mirai opendir ua-wget
http://46.101.46.29/.Sassy/.Sassy.mipsel	ab49bad666a613ef9463a859c84d2784190b679056c7ea8d73708dd63342d4dc	Mirai	elf mirai opendir ua-wget
http://46.101.46.29/.Sassy/.Sassy.powerpc	61b2da52a289fe536edbeab608d4636a224dafdca9fc469f0fb94bda88576542	Mirai	elf mirai opendir ua-wget
http://46.101.46.29/.Sassy/.Sassy.sparc	cce4491ecb2ed2904d0ca07e99fea9c2d2e7a6bebc89832258f0e0e7cb754e85	Mirai	elf mirai opendir ua-wget
http://46.101.46.29/.Sassy/.Sassy.sh4	3b45af43b673ee124c89887e3aad20e888a5e645d7cfc7279f24278f4352a5c1	Mirai	elf mirai opendir ua-wget
http://46.101.46.29/.Sassy/.Sassy.arc	cbad2d84ad74e4a952f8a76dc0393c4957789b0b57ba928851c6958a44a832e0	Mirai	elf mirai opendir ua-wget
http://46.101.46.29/.Sassy/.Sassy.i486	6bc2a651fe1fa718397d940038c2dd042dc8713067b89d9b27c223b1f599c553	Mirai	elf mirai opendir ua-wget
http://46.101.46.29/.Sassy/.Sassy.armv4l	6cc239ce8c0cbfaac004f6b1f2a7bff2f4cbdbb9ed94792f835706f234f34708	Mirai	elf mirai opendir ua-wget
http://46.101.46.29/.Sassy/.Sassy.armv5l	5ed132a40feb2d2610e1c4b0cefddcc244412385d48f3474df040244505094b3	Mirai	elf mirai opendir ua-wget
http://46.101.46.29/.Sassy/.Sassy.armv6l	aba7bc64fa57c4acb34a72b172b79add710a327b54d3ce3a01d77c2bf3ec31d1	Mirai	elf mirai opendir ua-wget
http://46.101.46.29/.Sassy/.Sassy.armv7l	8deeea0a052e3acd8818c4cd95825347ccdb37d0870befccc6027a21d937819d	Mirai	elf mirai opendir ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

mirai

Link:

https://www.filescan.io/uploads/69df102dd920e19044fc2e3c/reports/f2b4572c-ec5e-4316-b2a7-4596aa8c53a8/overview

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-04-15T01:23:00Z UTC

Last seen:

2026-04-15T17:49:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan-Downloader.Shell.Agent.a

Link:

https://opentip.kaspersky.com/11fff7d4c7e60460c9f27211964df7dca64b318fec736298cac7342fefe464ef/results?tab=lookup

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/11fff7d4c7e60460c9f27211964df7dca64b318fec736298cac7342fefe464ef

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/11fff7d4c7e60460c9f27211964df7dca64b318fec736298cac7342fefe464ef/

Verdict:

Malicious

Threat:

Family.MIRAI

Link:

https://tip.neiki.dev/file/11fff7d4c7e60460c9f27211964df7dca64b318fec736298cac7342fefe464ef

Threat name:

Win32.Trojan.Vigorf

Status:

Malicious

First seen:

2026-04-15 04:12:36 UTC

File Type:

Text (Shell)

AV detection:

10 of 24 (41.67%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ch77pvgh4ycgbspsoiizmtpx3stewmmp5rzwfggky42c737emtxq._file

Result

Malware family:

n/a

Score:

7/10

Tags:

antivm defense_evasion discovery linux upx

Link:

https://tria.ge/reports/260415-esrdqshx9t/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Changes its process name

Checks CPU configuration

UPX packed file

Enumerates running processes

File and Directory Permissions Modification

Deletes itself

Executes dropped EXE

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.11

Link:

https://yomi.yoroi.company/submissions/11fff7d4c7e60460c9f27211964df7dca64b318fec736298cac7342fefe464ef

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh