MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d907b66be5929ba2a48a758cc32b17c789ec1bcc24c4a8a502f76f0b49c0bd35. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	d907b66be5929ba2a48a758cc32b17c789ec1bcc24c4a8a502f76f0b49c0bd35
SHA3-384 hash:	6cb6982b203835154698c9cab8fae754ebf813b6bfda807a94c32aebd7fb6cbce78511304660a1149edbd4702cd2a525
SHA1 hash:	89b3373225f5b77e77b915d70fb57cf2bd1e198f
MD5 hash:	bdd439fa874a68481b2f6f0c3952505f
humanhash:	fourteen-violet-hotel-mockingbird
File name:	bins.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	978 bytes
First seen:	2026-02-13 00:09:46 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	12:kvu1AxXaAo3JAX9Ki3qdG3X8y0iU04ANxXUYFmwuw3XU74QmxXU6FuR7wdXUpc:kNRKM9D8ymh4UYFRuwHU7dmRUWblUpc
TLSH	T1121182E604D4C023D89E9E8EF3B1835AD4ADB3CD7CE12A0E9994DDF48C2562434CBA51
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://185.196.41.201/x86_64	3f302d91b24c943426d71e0775c4041b04123d78b0b9e778a64136708e9ee4f4	Mirai	elf geofenced mirai ua-wget USA x86
http://185.196.41.201/mips	39ea5c77595791f225804dfe8ad36c485a391191dc31326dc08f4527bf18577f	Mirai	elf geofenced mips mirai ua-wget USA
http://185.196.41.201/mipsel	n/a	n/a	elf ua-wget
http://185.196.41.201/arm4	96a988d15e8d342e9f2ba4eda3a9bdded94170f743821fa1d97ab612cf69fac2	Mirai	arm elf geofenced mirai ua-wget USA
http://185.196.41.201/arm5	f53ac40dcd7fc5392041756ce0c422eb634fd8025d6dbeab88d038269074bbd9	Mirai	arm elf geofenced mirai ua-wget USA
http://185.196.41.201/arm6	505c7dad1f153d877d0eaf49c96fc5aea03000d3127fe927ffa4a1812f793186	Mirai	arm elf geofenced mirai ua-wget USA
http://185.196.41.201/arm7	39826aaef71a256b7f220273335c9c36ca7382023f110045b718f98107987f91	Mirai	arm elf geofenced mirai ua-wget USA

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

expand lolbin

Link:

https://www.filescan.io/uploads/698e6bf02ffccda0976ebb64/reports/884f4557-2d95-4236-9cef-2bee743ff430/overview

Result

Gathering data

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/93c4c194-aa28-4160-892b-8f2651941e60

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/d907b66be5929ba2a48a758cc32b17c789ec1bcc24c4a8a502f76f0b49c0bd35

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d907b66be5929ba2a48a758cc32b17c789ec1bcc24c4a8a502f76f0b49c0bd35/

Verdict:

Malicious

Threat:

Family.MIRAI

Link:

https://tip.neiki.dev/file/d907b66be5929ba2a48a758cc32b17c789ec1bcc24c4a8a502f76f0b49c0bd35

Threat name:

Linux.Downloader.Generic

Status:

Suspicious

First seen:

2026-02-13 00:10:18 UTC

File Type:

Text (Shell)

AV detection:

5 of 36 (13.89%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=3ed3m27fskn2fjekowgmgkyxy6e6yg6metckrjic65xqwsoaxu2q._file

Result

Malware family:

n/a

Score:

7/10

Tags:

antivm defense_evasion discovery linux

Link:

https://tria.ge/reports/260213-af5y5sds3g/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Changes its process name

Checks CPU configuration

Reads system network configuration

Enumerates active TCP sockets

Enumerates running processes

File and Directory Permissions Modification

Executes dropped EXE

Unexpected DNS network traffic destination

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.36

Link:

https://yomi.yoroi.company/submissions/d907b66be5929ba2a48a758cc32b17c789ec1bcc24c4a8a502f76f0b49c0bd35

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh