MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 93c211e68e7351cbbc26717eeede0eff728545cc4e36fd9fbad4c1cd4f64cb42. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	93c211e68e7351cbbc26717eeede0eff728545cc4e36fd9fbad4c1cd4f64cb42
SHA3-384 hash:	4cf920c580940900241c61ce707ac615f0d8d5b2c32a19968343cdbb3de6571e5ff767600a1751aca2f99ac163a98082
SHA1 hash:	ca93ba3f17f4cabdf570b8ce0c519b505cc52b05
MD5 hash:	f1ad5016866462ae089bc1b3f03b98fa
humanhash:	september-glucose-indigo-saturn
File name:	bins.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	538 bytes
First seen:	2025-11-04 06:29:10 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	12:v0Fv7Mf/p7Mfk70TNnrv7gzo75D5N7Q5q:UTMftMfw2/ic5
TLSH	T11BF0BBC80A5525350EC7AA4723628DC4F397D456ED338EF85D9CF8E16854C20682CD7E
Magika	batch
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://193.111.248.202/0x83911d24Fx.sh	8e532e6644d0256ffcb15e8e7721de2e8ba19b626d21c96cb3517742f63e81ed	Mirai	mirai sh ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL

Verdict:

Malicious

File Type:

text

First seen:

2025-11-04T04:42:00Z UTC

Last seen:

2025-11-04T04:52:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/93c211e68e7351cbbc26717eeede0eff728545cc4e36fd9fbad4c1cd4f64cb42/results?tab=lookup

Status:

Failed

Link:

https://sandbox.kunai.rocks/analysis/e87681a3-2891-469f-af95-42516f235900

Score:

99%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/93c211e68e7351cbbc26717eeede0eff728545cc4e36fd9fbad4c1cd4f64cb42

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/93c211e68e7351cbbc26717eeede0eff728545cc4e36fd9fbad4c1cd4f64cb42/

Threat name:

Script.Downloader.Heuristic

Status:

Malicious

First seen:

2025-11-04 06:13:42 UTC

File Type:

Text (Shell)

AV detection:

5 of 38 (13.16%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=spbbdzuooni4xpbgof7o5xqo75zikromjy3p3h522ta42t3eznba._file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/251104-g9atesyrbp/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Malware family:

Mirai

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/93c211e68e73/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/93c211e68e7351cbbc26717eeede0eff728545cc4e36fd9fbad4c1cd4f64cb42

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.