MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 522ab5263da1883e27cb376b5ac300debf0214a201710140280a3517e8207ded. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	522ab5263da1883e27cb376b5ac300debf0214a201710140280a3517e8207ded
SHA3-384 hash:	3774be4b513b1737daf933e5e6f6991fea68702c09b53935bb23fea767f72130f4eb7981bef81dba75ac5040c3c4ddcc
SHA1 hash:	e3ae125455d0c5b008c984a0c9da1031d5b15145
MD5 hash:	ecfc505d1a4edb4642d7a5e9d4fd5b61
humanhash:	september-winter-edward-hamper
File name:	bins.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	1'948 bytes
First seen:	2026-09-16 11:05:07 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:ZTcFrwxi5PIZbD9pDpu8uRBKPp5KP8x2v9R2v4T7EHp08TX6:9SQrHuSK
TLSH	T11E41878B22E094B3C46DED41F35594C4E0995AE361E79EBCF8AC55E2489940CF3B6B60
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	BlinkzSec
Tags:	mirai

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://176.65.139.220/x86	bc1b5337acaf45129b9752bf96375e8d588cf0b806b4635790ebe74f6e862275	Mirai	176-65-139-220 elf mirai ua-wget
http://176.65.139.220/i386	bc1b5337acaf45129b9752bf96375e8d588cf0b806b4635790ebe74f6e862275	Mirai	176-65-139-220 elf mirai ua-wget
http://176.65.139.220/amd64	9ef5ad92f3d681ad3509f94ad3a4d27f10d40ec054e8a0533c45a248e4b009d5	Mirai	176-65-139-220 elf mirai ua-wget
http://176.65.139.220/arm	601d830aab39745760acd6142a5ba3ee67a1a0ad59d49d79a840b3a6aaabd7be	Mirai	176-65-139-220 elf mirai ua-wget
http://176.65.139.220/armv7l	601d830aab39745760acd6142a5ba3ee67a1a0ad59d49d79a840b3a6aaabd7be	Mirai	176-65-139-220 elf mirai ua-wget
http://176.65.139.220/arm5	d5b07009143e2c2fc09f393e878fcfa76946e6066180bf14451126fbee1e7658	Mirai	176-65-139-220 elf mirai ua-wget
http://176.65.139.220/arm6	999ceeda77c4552adb04e486f8771daea56a99e9642e1e4510b7e985a3684d89	Mirai	176-65-139-220 elf mirai ua-wget
http://176.65.139.220/arm64	5cc1ee595d741ec25b89cfefd35513dcc556b2757f5bf059005a87909446f5a9	Mirai	176-65-139-220 elf mirai ua-wget
http://176.65.139.220/android_arm64	6820d53db71e83035f57967b56f34ba68bb6608a1dccb26145b644432450dc04	Mirai	176-65-139-220 elf mirai ua-wget
http://176.65.139.220/mips	7f6fb92970eba963868bb57d5c6cdad49bf410918e6148eb869efc3c61677fe9	Mirai	176-65-139-220 elf mirai ua-wget
http://176.65.139.220/mipsle	3acc9265a1e24ec2367f86417a3284bdfc3a9a668cd7986e31d905bacb9f8550	Mirai	176-65-139-220 elf mirai ua-wget
http://176.65.139.220/bot.exe	n/a	n/a	176-65-139-220 exe ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Gathering data

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-09-10T10:18:00Z UTC

Last seen:

2026-09-16T14:57:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/522ab5263da1883e27cb376b5ac300debf0214a201710140280a3517e8207ded/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/135deda3-9517-4ecf-a746-208032c36976

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/522ab5263da1883e27cb376b5ac300debf0214a201710140280a3517e8207ded

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/522ab5263da1883e27cb376b5ac300debf0214a201710140280a3517e8207ded/

Threat name:

Linux.Trojan.Vigorf

Status:

Malicious

First seen:

2026-09-10 13:39:57 UTC

File Type:

Text (Shell)

AV detection:

20 of 38 (52.63%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=kivlkjr5uged4j6lg5vvvqya327qeffcafyqcqbibi2rp2bapxwq._file

Result

Malware family:

n/a

Score:

7/10

Tags:

antivm defense_evasion discovery linux persistence privilege_escalation

Link:

https://tria.ge/reports/260916-m62evsxtew/

Behaviour

Enumerates kernel/hardware configuration

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Checks CPU configuration

Modifies Bash startup script

Creates/modifies environment variables

Write file to user bin folder

File and Directory Permissions Modification

Executes dropped EXE

Malware family:

MultiGoDDoS

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/522ab5263da1/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.42

Link:

https://yomi.yoroi.company/submissions/522ab5263da1883e27cb376b5ac300debf0214a201710140280a3517e8207ded

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh