MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3bf71df19c91091b29d73a25e61ad421d51e13f1926c222b7b37f26e02c5c68d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 7

Intelligence 7 IOCs YARA 2 File information Comments

SHA256 hash:	3bf71df19c91091b29d73a25e61ad421d51e13f1926c222b7b37f26e02c5c68d
SHA3-384 hash:	235f76edf661687f7faa0804823f1a864e0a5874ff882774e066902df73c36e7845ebe159604cfb256548636c25b25b1
SHA1 hash:	5f39f577b5561a7a489734f7960ec462bafd3b96
MD5 hash:	6afe59ca9594d1189b537ff009ba649c
humanhash:	enemy-uranus-thirteen-helium
File name:	nigger.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	1'602 bytes
First seen:	2026-01-12 02:27:30 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	24:A5Xf+h+NhJWd5Xf+w+o1jJQpr5rta8Y/TiTCrjTdzTdtz8PSAAAiGOWsDxeG5GcE:AVThJWdVjNJOyrNjAiGOWy48Tk78GQn2
TLSH	T1F231C7CF063F39154EC7CF1B73E107CA5189A3E1E097DBF59808192668C5888749CEE9
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://91.92.241.10/x86_64.kok	78e260a5118578e0b4d1a55374c217c218c48ab8f7455dd5a28a70746f99f715	Mirai	elf geofenced mirai ua-wget USA x86
http://91.92.241.10/x86_32.kok	03d7a243a18f053113e199837d74324b063c744679e681dde068d129d109af9f	Mirai	elf geofenced mirai ua-wget USA x86
http://91.92.241.10/powerpc.kok	7570d065c824764a1a3a6c65496685bfc83eff811cc1345ccb7273141950cb46	Mirai	elf geofenced mirai PowerPC ua-wget USA
http://91.92.241.10/mips.kok	df84c58145c759e99c74fed1570dbf9089dfb200669fb911f4d60f307ef63648	Mirai	elf geofenced mips mirai ua-wget USA
http://91.92.241.10/mipsel.kok	d8409d9322d329c981e3ebaa0f02336bcfd122f93210ad1aa627a125196d5a57	Mirai	elf geofenced mips mirai ua-wget USA
http://91.92.241.10/arm.kok	f762c3e51a32e4e93fd41fe3be4eac71606d84cc1372f5e100bff5b35241e74f	Mirai	arm elf geofenced mirai ua-wget USA
http://91.92.241.10/arm5.kok	ff4abf773e3047ea1a94dbb4d2a7032a9dccc7a396cad04511d991c66dc37448	Mirai	arm elf geofenced mirai ua-wget USA
http://91.92.241.10/arm6.kok	6ae6ed76ac1b59475676b279f542a724967a0a91c61aa76cb9e2d307b1e26fa7	Mirai	arm elf geofenced mirai ua-wget USA
http://91.92.241.10/arm7.kok	32a28b0a2b16b3f4d89f1931ee19a6726c967b9da88e8da04548dd90b900e1cd	Mirai	arm elf geofenced mirai ua-wget USA
http://91.92.241.10/sparc.kok	n/a	n/a	elf ua-wget
http://91.92.241.10/m68k.kok	n/a	n/a	elf ua-wget
http://91.92.241.10/sh4.kok	n/a	n/a	elf ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

evasive mirai

Link:

https://www.filescan.io/uploads/69645c4840358be74af90ffa/reports/77b79212-d1ce-4897-91f9-6fdd8336fa64/overview

Verdict:

Malicious

File Type:

text

First seen:

2026-01-11T22:37:00Z UTC

Last seen:

2026-01-11T23:44:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan-Downloader.Shell.Agent.a

Link:

https://opentip.kaspersky.com/3bf71df19c91091b29d73a25e61ad421d51e13f1926c222b7b37f26e02c5c68d/results?tab=lookup

Status:

Failed

Link:

https://sandbox.kunai.rocks/analysis/f22b5f6a-a7f4-46c7-a1a0-5da922660dd6

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/3bf71df19c91091b29d73a25e61ad421d51e13f1926c222b7b37f26e02c5c68d

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/3bf71df19c91091b29d73a25e61ad421d51e13f1926c222b7b37f26e02c5c68d/

Verdict:

Malicious

Threat:

Trojan-Downloader.Shell.Agent

Link:

https://tip.neiki.dev/file/3bf71df19c91091b29d73a25e61ad421d51e13f1926c222b7b37f26e02c5c68d

Threat name:

Script-Shell.Worm.Mirai

Status:

Malicious

First seen:

2026-01-12 02:28:26 UTC

File Type:

Text (Shell)

AV detection:

9 of 24 (37.50%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=hp3r34m4seerwkoxhis6mgwuehkr4e7rsjwcek33g7zg4awfy2gq._file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/260112-cx7keaay2b/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/3bf71df19c91091b29d73a25e61ad421d51e13f1926c222b7b37f26e02c5c68d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ach_202412_suspect_bash_script Create hunting rule
Author:	abuse.ch
Description:	Detects suspicious Linux bash scripts

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh