MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b9d41f8aace627c5590a0fd0ddeac4afdaf6efc2a7e4d4c294595a779ba57820. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 5

Intelligence 5 IOCs YARA 1 File information Comments

SHA256 hash:	b9d41f8aace627c5590a0fd0ddeac4afdaf6efc2a7e4d4c294595a779ba57820
SHA3-384 hash:	9b4a2d7317191c66410e4077073270703b2ceb045c54b380a8581251a59b4b4c7095c182758eec3456a057f50d509dcd
SHA1 hash:	0d19a1e0ff491b79678ab68b76c7a72e791b92d1
MD5 hash:	160218d9bb5ed01e3ddc8a8bdf637348
humanhash:	friend-spaghetti-glucose-massachusetts
File name:	mass.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	140 bytes
First seen:	2026-10-01 18:24:50 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	3:LmXeEUZGFGN3zSICLKi1fx8eEU2PFGBzSEyLTUWTcQe:Lep+GFa0LKipSpeIrcL
TLSH	T166C08CAD30122041C840BF51A023C8D4A28FD3C82060032450841038D4A8840B838E81
Magika	batch
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://89.185.82.24/arm7	9ae981175d5e8cf979faf9c4e3e13b3b8270c52a707b3ffc3e6f53b37ea091d2	Mirai	mirai
http://89.185.82.24/mips	9cb2019fe444feea3d3127b1c43d62e6418942e0868a76862aed46b85a215fa0	Mirai	mirai

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/6abea597b561b9466f5a9ab6/reports/3c1389d9-fa68-4b0f-bfc5-8c4799fcd417/overview

Verdict:

Malicious

File Type:

text

First seen:

2026-10-01T16:22:00Z UTC

Last seen:

2026-10-03T16:04:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/b9d41f8aace627c5590a0fd0ddeac4afdaf6efc2a7e4d4c294595a779ba57820/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/8a5836e1-9b0a-486e-9c13-343f03a028f4

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/b9d41f8aace627c5590a0fd0ddeac4afdaf6efc2a7e4d4c294595a779ba57820

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b9d41f8aace627c5590a0fd0ddeac4afdaf6efc2a7e4d4c294595a779ba57820/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=xhkb7cvm4yt4kwikb7in32wev7npn36cu7snjquulfnhpg5fpaqa._file

Result

Malware family:

n/a

Score:

3/10

Tags:

execution

Link:

https://tria.ge/reports/261001-w2rjjaysgz/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Executes a command shell one-liner

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/b9d41f8aace627c5590a0fd0ddeac4afdaf6efc2a7e4d4c294595a779ba57820

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh