MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 14896331c3585918ef42074368d2a9033e8d84e0e30dc669d17dccb74e052f00. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 8

Intelligence 8 IOCs YARA 1 File information Comments

SHA256 hash:	14896331c3585918ef42074368d2a9033e8d84e0e30dc669d17dccb74e052f00
SHA3-384 hash:	d4dad315948257139a17e7f720356f333c791eb084fb8a324443d382d6cab4374179a2c0a2a1e1c8453246b689c095b9
SHA1 hash:	0978653ad336aca667fe8384d86cb406c4fb8ffd
MD5 hash:	9fdaf0614336ff33861762137cd82db3
humanhash:	beryllium-wolfram-music-princess
File name:	bins.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	1'924 bytes
First seen:	2026-10-02 23:29:55 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:ZscUrtCZaAIq6wpOpP8/SiKPpUKP8S2v9w2v4+7sJHph8kXt:KF6DIHvz9
TLSH	T1B141B98BA2E090B3C46EFD41F35494C4E0DD8EC361E7AEBCF8B45562589920CF196F66
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://176.65.139.76/x86	a138a9724a77dad169312f39e94269413555448ec89ffc73b55a51cb4ccc3e25	Mirai	176-65-139-76 elf mirai ua-wget
http://176.65.139.76/i386	e338e66901aeb11277b6893e3efc7da98f5f39dbd9cec3f30165136359f4aff7	Mirai	176-65-139-76 elf mirai ua-wget
http://176.65.139.76/amd64	fed71588688e9b44f975c184ee74acd701f84a05c23fa84b3c75f748e75ef39f	Mirai	176-65-139-76 elf mirai ua-wget
http://176.65.139.76/arm	43965cd116c26ca11f398ffda6cffad8a7db120d57f237ac1b91df1a4acc8e76	Mirai	176-65-139-76 elf mirai ua-wget
http://176.65.139.76/armv7l	43965cd116c26ca11f398ffda6cffad8a7db120d57f237ac1b91df1a4acc8e76	Mirai	176-65-139-76 elf mirai ua-wget
http://176.65.139.76/arm5	0414f25737af79556052339a47afdb264eea578cf8e8d2a9cc9b3850f86fdc3f	Mirai	176-65-139-76 elf mirai ua-wget
http://176.65.139.76/arm6	6e03f1ce7db58a8e89f749d2030d2a4c99c6a1916c2308b54255d59d645b74ba	Mirai	176-65-139-76 elf mirai ua-wget
http://176.65.139.76/arm64	7b0e005cee2388e5910efec3f8400bbde16be352e13fdd45c9f0f34ab31d0ccd	Mirai	176-65-139-76 elf mirai ua-wget
http://176.65.139.76/android_arm64	cf2b195fefeb5468e919494f2547b6b5b84cba3a08c9224beaa56132e057e7a1	Mirai	176-65-139-76 elf mirai ua-wget
http://176.65.139.76/mips	46e7e46e6da369fe558eeca7b263345914b3d1b2af550b89080e17a1fd30cd03	Mirai	176-65-139-76 elf mirai ua-wget
http://176.65.139.76/mipsle	8dede99d342da101b7a9f0b255619b8b9b77732f4f5c808be112117d2307a95f	Mirai	176-65-139-76 elf mirai ua-wget
http://176.65.139.76/bot.exe	n/a	n/a	176-65-139-76 exe ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

evasive

Link:

https://www.filescan.io/uploads/6ac03e8e5e5f21069a689e86/reports/49884d24-87c1-46b9-937f-4b16b8ebc6c2/overview

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-10-02T21:24:00Z UTC

Last seen:

2026-10-03T18:58:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/14896331c3585918ef42074368d2a9033e8d84e0e30dc669d17dccb74e052f00/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/dc2da90d-7574-451d-8840-613245e742b4

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/14896331c3585918ef42074368d2a9033e8d84e0e30dc669d17dccb74e052f00

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/14896331c3585918ef42074368d2a9033e8d84e0e30dc669d17dccb74e052f00/

Threat name:

Script-Shell.Trojan.Egairtigado

Status:

Malicious

First seen:

2026-10-02 23:30:25 UTC

File Type:

Text (Shell)

AV detection:

14 of 24 (58.33%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=csewgmodlbmrr32ca5bwruvjam7i3bha4mg4m2orpxglotqff4aa._file

Result

Malware family:

goddosagent

Score:

10/10

Tags:

family:goddosagent antivm botnet defense_evasion discovery linux persistence privilege_escalation

Link:

https://tria.ge/reports/261002-3ha6rsvfke/

Behaviour

Enumerates kernel/hardware configuration

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Checks CPU configuration

Modifies Bash startup script

Creates/modifies environment variables

Write file to user bin folder

File and Directory Permissions Modification

Executes dropped EXE

Unexpected DNS network traffic destination

Detects GoDDoSAgent

Family: GoDDoSAgent

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/14896331c3585918ef42074368d2a9033e8d84e0e30dc669d17dccb74e052f00

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh