MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 983bb4bd448f92cf70e2be82926442ea9f217cce55872c364dc7c8f1d17f0aad. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 6

Intelligence 6 IOCs YARA 2 File information Comments

SHA256 hash:	983bb4bd448f92cf70e2be82926442ea9f217cce55872c364dc7c8f1d17f0aad
SHA3-384 hash:	e6c8b6ac1f6cc5da061d80c8a8b7ff213b31d7f1138ec39126a85b84651e035e5f3d6b24b066def37b20925a4f2e1aae
SHA1 hash:	d691612f7ee4909abcc64d341338eedb42374b27
MD5 hash:	c772a55734c99d428cd141da4ceb2c09
humanhash:	eighteen-virginia-shade-robert
File name:	dlink
Download:	download sample
Signature	Mirai Create hunting rule
File size:	1'503 bytes
First seen:	2026-08-29 06:09:35 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	24:pcURUgNIYUeKDNUXUoUVw/dJU0UZUVw/dJUX6Z:pNKbeJkZuUFSuUC
TLSH	T18A31B9CA28529D80C0869AADB13D9855D130D1DA4ABF9BD5ECDD1DAEC1BCFEC7024618
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	BlinkzSec

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://31.220.3.140/ri/la.bot.arm	f85299205e1596ab621b06343f49a58606ae480ea3a7460d9db11de62fdc97bc	Mirai	32 arm elf mirai
http://31.220.3.140/ri/la.bot.arm5	8ecb1ac8be0165ab2d27abf995719a59154f5516f9408271475f52b68c640c7b	Mirai	32 arm elf mirai
http://31.220.3.140/ri/la.bot.arm6	1a644b96e353f644bd85ee3c195635f749c93130f99afe544a5b624b2d987db9	Mirai	32 arm elf mirai
http://31.220.3.140/ri/la.bot.arm7	1a644b96e353f644bd85ee3c195635f749c93130f99afe544a5b624b2d987db9	Mirai	32 arm elf mirai
http://31.220.3.140/ri/la.bot.mips	e1419805e587355ca7d9d0be4faeebc4fa0e683600a62e282af58f0b88e2ba27	Mirai	ddos elf mirai
http://31.220.3.140/ri/la.bot.mipsel	c000f4ff8aaa12a0bc5216b658d447405a4fb3ac67d5d7dafea45751e910e8bf	Mirai	ddos elf mirai
http://31.220.3.140/ri/la.bot.powerpc	addec310024be796b4e327aa586b0bcad080a09cdd4c654ee70d6d0896eff568	Mirai	elf mirai
http://31.220.3.140/ri/la.bot.m68k	0b63ad7fbb676f27359d28c2c9ab4465e6e81d3765e3931541fe3b97f39e6ecd	Mirai	elf
http://31.220.3.140/ri/la.bot.x86_64	589b4a0dda2510fba387e41677898bb4d596f8676944fb24b3130f5434d0c04c	Mirai	ddos elf mirai
http://31.220.3.140/ri/la.bot.sparc	1995363af372df9ae64a2b641234ee8870b908702bb7b15c8dec92b52da6d0ee	Mirai	elf

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-08-29T03:34:00Z UTC

Last seen:

2026-08-30T21:52:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/983bb4bd448f92cf70e2be82926442ea9f217cce55872c364dc7c8f1d17f0aad/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/5edf34c6-ec45-48ca-9cb1-1e9601215f77

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/983bb4bd448f92cf70e2be82926442ea9f217cce55872c364dc7c8f1d17f0aad

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/983bb4bd448f92cf70e2be82926442ea9f217cce55872c364dc7c8f1d17f0aad/

Threat name:

Linux.Trojan.Multiverze

Status:

Malicious

First seen:

2026-08-29 06:03:02 UTC

File Type:

Text (Shell)

AV detection:

16 of 24 (66.67%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ta53jpker6jm64hcx2bjezcc5kpsc7gokwdsynsny7epdul7bkwq._file

Result

Malware family:

n/a

Score:

9/10

Tags:

defense_evasion discovery linux

Link:

https://tria.ge/reports/260829-gw6c6sgk9t/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Changes its process name

Reads system network configuration

Enumerates active TCP sockets

Enumerates running processes

File and Directory Permissions Modification

Executes dropped EXE

Modifies Watchdog functionality

Unexpected DNS network traffic destination

Contacts a large (37135) amount of remote hosts

Creates a large amount of network flows

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.51

Link:

https://yomi.yoroi.company/submissions/983bb4bd448f92cf70e2be82926442ea9f217cce55872c364dc7c8f1d17f0aad

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ach_202412_suspect_bash_script Create hunting rule
Author:	abuse.ch
Description:	Detects suspicious Linux bash scripts

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh