MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3eba9f72af04225b4c4b8cd424a89ad8b965dbed30173afc636e5d5bcdcd527a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	3eba9f72af04225b4c4b8cd424a89ad8b965dbed30173afc636e5d5bcdcd527a
SHA3-384 hash:	38502e29888ae77ffb5f97d9bae04ce7014e16375d0fd878b3c657ded67dc43fbb47722870331aa1920b2669ef1513ea
SHA1 hash:	ae6d08f1b0273737e5672d5e727b3181b6af4d50
MD5 hash:	a85282d6a7e9412a6aca62aacd219abf
humanhash:	robin-monkey-asparagus-cat
File name:	bins.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'286 bytes
First seen:	2026-02-27 11:11:35 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	24:mOJmvIBYCVBy/NInNI7KPdKPyM2vR2vCwtHoWY:3mzCXylKPdKPyM2vR2vxHoWY
TLSH	T15741D49B327149F3C70ADE45F79490D0E9FE46C3A5E2CBB8B0EE44A26068058F592E71
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	juroots
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://87.106.146.245:5001/x86	0b83905c06cab88e86e29b13ad4e704ee260ae9e55f5340eba1984a75aa66bee	Mirai	mirai
http://87.106.146.245:5001/i386	0b83905c06cab88e86e29b13ad4e704ee260ae9e55f5340eba1984a75aa66bee	Mirai	mirai
http://87.106.146.245:5001/amd64	3db4bf876aedfa44d27192a7cadbe2a97b573174e1054f972953c6d9121a1287	Mirai	mirai
http://87.106.146.245:5001/arm	f21a10b3ef988b58af67112540c72b1bbe48ab240b2cc561a6348f1483a35c97	Mirai	mirai
http://87.106.146.245:5001/armv7l	f21a10b3ef988b58af67112540c72b1bbe48ab240b2cc561a6348f1483a35c97	Mirai	mirai
http://87.106.146.245:5001/arm5	f6c613f81ab9ff70562ddb8d8a84d570c7ce10a326f74e2101a97c088d3e07f3	Mirai	mirai
http://87.106.146.245:5001/arm6	3f09238ee563f9a990a1184909ef1bbf3b3e26c23b3bf0edb3b5952466db0baa	Mirai	mirai
http://87.106.146.245:5001/arm64	d84d2cf0613613fcbc963c0257c78c6ba500274d5581a2771d2b790c4a265321	Mirai	mirai
http://87.106.146.245:5001/android_arm	f21a10b3ef988b58af67112540c72b1bbe48ab240b2cc561a6348f1483a35c97	Mirai	mirai
http://87.106.146.245:5001/android_arm64	d84d2cf0613613fcbc963c0257c78c6ba500274d5581a2771d2b790c4a265321	Mirai	mirai
http://87.106.146.245:5001/mips	db4c8b7d0cd176397b2a42ff2902e2661be614842dcd9b3e5cd427ab43a44d47	Mirai	mirai
http://87.106.146.245:5001/mipsle	780600c6734871c76df8f477eef9299103617eaf5de1017ff08784bd40d521d3	Mirai	mirai
http://87.106.146.245:5001/bot.exe	n/a	n/a	n/a

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Result

Gathering data

Verdict:

Malicious

File Type:

unix shell

Detections:

HEUR:Trojan-Downloader.Shell.Agent.gen HEUR:Trojan-Downloader.Shell.Agent.a

Link:

https://opentip.kaspersky.com/3eba9f72af04225b4c4b8cd424a89ad8b965dbed30173afc636e5d5bcdcd527a/results?tab=lookup

Status:

Failed

Link:

https://sandbox.kunai.rocks/analysis/c29c75d6-5f7c-4d86-8c24-4c69376ac18e

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/3eba9f72af04225b4c4b8cd424a89ad8b965dbed30173afc636e5d5bcdcd527a

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/3eba9f72af04225b4c4b8cd424a89ad8b965dbed30173afc636e5d5bcdcd527a/

Verdict:

Malicious

Threat:

Trojan-Downloader.Shell.Agent

Link:

https://tip.neiki.dev/file/3eba9f72af04225b4c4b8cd424a89ad8b965dbed30173afc636e5d5bcdcd527a

Threat name:

Script-Shell.Worm.Mirai

Status:

Malicious

First seen:

2026-02-27 11:12:38 UTC

File Type:

Text (Shell)

AV detection:

9 of 36 (25.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=h25j64vpaqrfwtclrtkcjke23c4wlw7ngaltv7ddnzovxtonkj5a._file

Result

Malware family:

n/a

Score:

7/10

Tags:

antivm defense_evasion discovery execution linux persistence privilege_escalation

Link:

https://tria.ge/reports/260227-na4e1ses8a/

Behaviour

Enumerates kernel/hardware configuration

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Checks CPU configuration

Creates/modifies Cron job

Modifies systemd

Write file to user bin folder

File and Directory Permissions Modification

Executes dropped EXE

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/3eba9f72af04225b4c4b8cd424a89ad8b965dbed30173afc636e5d5bcdcd527a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh