MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a1ba8a41efdf01d5346c05a73a2ab09be01407a5c7513b377eee82dbd54b81d8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 9

Intelligence 9 IOCs YARA 1 File information Comments

SHA256 hash:	a1ba8a41efdf01d5346c05a73a2ab09be01407a5c7513b377eee82dbd54b81d8
SHA3-384 hash:	5369857ab054d92840d5ee57d2a796d4795fcdc69e55a89a6db56dc3bd134f082d1b87b27619b9247ed2ca7a4a2b87e7
SHA1 hash:	35cb17546921c5b2d7efd1753ea9f45ee0efec5c
MD5 hash:	3dcfeab7c414b550438018348887ef6d
humanhash:	don-september-social-autumn
File name:	bins.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	2'062 bytes
First seen:	2026-11-07 08:06:20 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	24:ROJZ0IaBBSBZUNIUNI+KPqKPl2va2vz9oiHPXX:qZUB4ZOKPqKPl2va2vNHPXX
TLSH	T14741B98B23B1C0B3C9199DC2F3A578E1E08C46C2B277DFBC75A544A21D5A74CB992F90
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://185.226.92.150:1001/x86	840b953a4da8557b6ac82b5a3ed63a1fedc5328e5681a48c8e20465bd3e8712d	Mirai	n/a
http://185.226.92.150:1001/i386	840b953a4da8557b6ac82b5a3ed63a1fedc5328e5681a48c8e20465bd3e8712d	Mirai	n/a
http://185.226.92.150:1001/amd64	7c1bd97197781beb3d410a0eaf7103bafe2961da44f7b0a331c2d0d6e94c5e14	Mirai	n/a
http://185.226.92.150:1001/arm	96c10d439a40beafe8d8e7e2db1b6e37d11fdb0e8df3925c5e9e14254819f2d3	Mirai	n/a
http://185.226.92.150:1001/armv7l	9e6da804ae9ca0a07348e92d99416bcf3fc650ccbdf4a9b4db34f6d546ddfb10	Mirai	n/a
http://185.226.92.150:1001/arm5	530908e3cd3f7a04590960a3abc2820356890eb0c2df115825d457b223aaef3a	Mirai	n/a
http://185.226.92.150:1001/arm6	34186fba4b5a9c640517020d43a1ba70bdf59f1163867917950e2f7459a0839f	Mirai	n/a
http://185.226.92.150:1001/arm64	ada33a0316d364d1d3be6d23ca2e590c16db7d845795619935e42e53f9293f6b	Mirai	n/a
http://185.226.92.150:1001/android_arm64	de85991fa5ddbed3360c31ea412c9a8b41d42531a81863ef2a7cfac34de3e37c	Mirai	n/a
http://185.226.92.150:1001/mips	2b7e8ac60ace152cadc7da94bf1401a290f942923735db061af41bd50cb501d4	Mirai	n/a
http://185.136.205.173:1001/mipsle	n/a	n/a	ua-wget
http://185.226.92.150:1001/mipsle	add3a24af01e12693ff8afe21713f9b784e9fb741d6c03587783f6fa3348ec02	Mirai	n/a
http://185.226.92.150:1001/bot.exe	6be52f150e87c8918370420c36df9c535c9c31f4c97b93af2e982694b6785860	GORAT	n/a

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

base64 crypto evasive expand golang lolbin packed

Link:

https://www.filescan.io/uploads/6aeedc33d92dc117821979aa/reports/097c31ce-4348-4444-8a32-66c726452a0b/overview

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-10-23T20:24:00Z UTC

Last seen:

2026-10-30T05:05:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/a1ba8a41efdf01d5346c05a73a2ab09be01407a5c7513b377eee82dbd54b81d8/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/4508c592-c410-4534-a68d-6f830ee5ca0c

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a1ba8a41efdf01d5346c05a73a2ab09be01407a5c7513b377eee82dbd54b81d8/

Threat name:

Script-Shell.Trojan.Egairtigado

Status:

Malicious

First seen:

2026-11-07 08:07:24 UTC

File Type:

Text (Shell)

AV detection:

13 of 38 (34.21%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ug5iuqpp34a5kndmawttukvqtpqbib5fy5itwn3652bnxvklqhma._file

Result

Malware family:

ladvix

Score:

10/10

Tags:

family:goddosagent family:ladvix antivm botnet defense_evasion discovery infector linux persistence privilege_escalation trojan

Link:

https://tria.ge/reports/261107-jz2khaed32/

Behaviour

Enumerates kernel/hardware configuration

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Checks CPU configuration

Modifies Bash startup script

Creates/modifies environment variables

Write file to user bin folder

File and Directory Permissions Modification

Executes dropped EXE

Detects GoDDoSAgent

Family: GoDDoSAgent

Family: Ladvix

Malware Family:

bash

Malicious:

True

Tags:

shell

Link:

https://intel.virussign.com/intelligence/file/a1ba8a41efdf01d5346c05a73a2ab09be01407a5c7513b377eee82dbd54b81d8

Malware family:

MultiGoDDoS

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/a1ba8a41efdf/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.42

Link:

https://yomi.yoroi.company/submissions/a1ba8a41efdf01d5346c05a73a2ab09be01407a5c7513b377eee82dbd54b81d8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh