MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1fcc31906c391dc3f7d1e239c66fe1fb595065d46eff693fefba859f712c43b6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	1fcc31906c391dc3f7d1e239c66fe1fb595065d46eff693fefba859f712c43b6
SHA3-384 hash:	8025e53b6c0969a9ba942d1f2510b9aa5e60c7b69af6ad2b74213ad79093cbd3326d97746bb65d643f2869199ce5fd41
SHA1 hash:	18b6ebba73679a90a95f52a02b3a5ce523dcef69
MD5 hash:	a405fc02fba98a0ac6da3099543a8f1a
humanhash:	wolfram-foxtrot-magazine-uniform
File name:	bins.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	1'924 bytes
First seen:	2026-09-04 07:41:39 UTC
Last seen:	2026-09-05 06:00:23 UTC
File type:	sh
MIME type:	text/x-shellscript
ssdeep	24:yJOJtOdIz64rBQxNINNIhKPvKPy2vz2vYiTHCA3De:yStOB4tQ3KPvKPy2vz2vzHCA3De
TLSH	T1C341A78B33703DB3880DDF45F36814E4D89F96C2A1679EF8F4B54A62189960CF696A60
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://94.154.43.107/x86	72132935414eded9ba3f60a5f64259fa3be2164c8bf33bd40f585d144ce955b3	Mirai	94-154-43-107 elf mirai ua-wget
http://94.154.43.107/i386	72132935414eded9ba3f60a5f64259fa3be2164c8bf33bd40f585d144ce955b3	Mirai	94-154-43-107 elf mirai ua-wget
http://94.154.43.107/amd64	ff2af1bee37dabe5002e041af32916b011df23ae472a428f5b5056c984795d91	Mirai	94-154-43-107 elf mirai ua-wget
http://94.154.43.107/arm	27e91f9d674323b32ad4a3d5482945172f5f09e946e1d613f3bf25f21ccbf5f1	Mirai	94-154-43-107 elf mirai ua-wget
http://94.154.43.107/armv7l	27e91f9d674323b32ad4a3d5482945172f5f09e946e1d613f3bf25f21ccbf5f1	Mirai	94-154-43-107 elf mirai ua-wget
http://94.154.43.107/arm5	391892d080b4a9fc3925068f77c917d6b60560d6f22281ca7302c0ff958a46d4	Mirai	94-154-43-107 elf mirai ua-wget
http://94.154.43.107/arm6	a2daf5a37aff430055e7d30ca6e5428d941ed19a2c4d12ff0833812a668ba0a4	Mirai	94-154-43-107 elf mirai ua-wget
http://94.154.43.107/arm64	ea742f219642d77bb4a6e9ebd32152e9f0aad49a2600b8d2c612558456bc720b	Mirai	94-154-43-107 elf mirai ua-wget
http://94.154.43.107/android_arm64	8ee0e1f223f578cbaa63028cc6f70eab0ac5eb858169f168d525a1b0d71977f5	Mirai	94-154-43-107 elf mirai ua-wget
http://94.154.43.107/mips	86fcaaddc87ded3edc8d6d33e424689bfb6ae057f3b446548e8887974036e0d8	Mirai	94-154-43-107 elf mirai ua-wget
http://94.154.43.107/mipsle	016c75e8c1956e4829f60ad86d5026ffd5ca153da114ada8d3f9c4ab3c94f4f8	Mirai	94-154-43-107 elf mirai ua-wget
http://94.154.43.107/bot.exe	n/a	n/a	94-154-43-107 exe ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

102

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

evasive mirai

Link:

https://www.filescan.io/uploads/6a9a76577ad4c53e66e2cd4c/reports/34b35efb-ae59-465d-bd54-6d9ebbfab297/overview

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-09-04T05:28:00Z UTC

Last seen:

2026-09-04T05:48:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/1fcc31906c391dc3f7d1e239c66fe1fb595065d46eff693fefba859f712c43b6/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/1f1d83ac-7060-4373-b49c-5619bf684994

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/1fcc31906c391dc3f7d1e239c66fe1fb595065d46eff693fefba859f712c43b6

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/1fcc31906c391dc3f7d1e239c66fe1fb595065d46eff693fefba859f712c43b6/

Threat name:

Script-Shell.Worm.Mirai

Status:

Malicious

First seen:

2026-09-04 07:42:25 UTC

File Type:

Text (Shell)

AV detection:

14 of 24 (58.33%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=d7gddedmheo4h56r4i44m37b7nmvazoun37wsp7pxkcz64jmio3a._file

Result

Malware family:

n/a

Score:

7/10

Tags:

antivm defense_evasion discovery linux persistence privilege_escalation

Link:

https://tria.ge/reports/260904-jjsyesea87/

Behaviour

Enumerates kernel/hardware configuration

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Checks CPU configuration

Modifies Bash startup script

Creates/modifies environment variables

Write file to user bin folder

File and Directory Permissions Modification

Executes dropped EXE

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/1fcc31906c391dc3f7d1e239c66fe1fb595065d46eff693fefba859f712c43b6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh