MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dff1b3c38399041374f9187127d29a27f91205f7332454df83853e979dedbcec. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 5

Intelligence 5 IOCs YARA 1 File information Comments

SHA256 hash:	dff1b3c38399041374f9187127d29a27f91205f7332454df83853e979dedbcec
SHA3-384 hash:	4ce2d4ab53c1e2ee5a40f58a3f5cc7977b1e43a6e58977ef307ba4689c750314ea538b4e3294ac9c2456396e5b24d8e2
SHA1 hash:	8c66fc7528c91705f3a4e7a03ce5fd2040a3e2a4
MD5 hash:	a2ef95b78937e8ae3aa5363fdaebd5d9
humanhash:	georgia-paris-maryland-mobile
File name:	lilin.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	1'008 bytes
First seen:	2025-11-28 19:15:22 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	24:t9SYZIBWNkHkHOWNk0+WNkRnRhWNk0IBWNkGUWNkYDYdWNTodTWNb:tQYZIBWNkEuWNk0+WNk17WNkHBWNkGUM
TLSH	T12F11C9FF015008963440FD997B938829B01DA5DB2DC78F5D9CBD0C31109B91CB825FEA
Magika	batch
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://93.88.204.28/mips	184d820b0b5abcbae2c9182a79b1dfa7d2a01a591f7b689e1ceb4f94bf4bc3b1	Mirai	elf mirai ua-wget
http://93.88.204.28/mpsl	fbb77ed0fb7aced896923a0e84d0a8e81dd3579c1153b670dd74790c2d7a6182	Mirai	elf mirai ua-wget
http://93.88.204.28/arm	9509d435fd06cbbc54650bbd726b305a6329f120f1773d1df72983b75fd9baaa	Hailbot	32-bit elf HailBot mirai Mozi
http://93.88.204.28/arm5	f0e4053dbc98fb02647723387d37cf787790c4396a726a3320832e96ff5289ce	Mirai	elf mirai ua-wget
http://93.88.204.28/arm7	132642594484be9b085575349d591bb32740ddcdd710e75a642aa8e6b333d3cb	Mirai	elf mirai ua-wget
http://93.88.204.28/arm6	91f08dc2f072a8c9cd9797ce235ef8748c95b0326bd2b164eccb7cca6829555f	Mirai	elf mirai ua-wget
http://93.88.204.28/x86	6382a8453de7da60f5803084b57f4c2eae393356bff00d9f3322402aa902530b	Mirai	32-bit elf HailBot mirai Mozi
http://93.88.204.28/sh4	afb8fbc54946cfd886f0bcd0806484d978dfa59297fe3e116ec24582865b4fee	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

busybox evasive mirai

Link:

https://www.filescan.io/uploads/6929f4e91b65ca0bb926e36d/reports/ca6b16fa-8bd0-4b6b-8a65-2ad1ad5f0575/overview

Result

Gathering data

Status:

Failed

Link:

https://sandbox.kunai.rocks/analysis/e5e665f8-58ae-42ea-aa42-c93dfc128eff

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/dff1b3c38399041374f9187127d29a27f91205f7332454df83853e979dedbcec

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/dff1b3c38399041374f9187127d29a27f91205f7332454df83853e979dedbcec/

Threat name:

Linux.Trojan.Generic

Status:

Suspicious

First seen:

2025-11-28 14:52:03 UTC

File Type:

Text (Shell)

AV detection:

15 of 35 (42.86%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=37y3hq4dtecbg5hzdbyspuu2e74rebpxgmsfjx4dqu7jphpnxtwa._file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/251128-xymxlszqcj/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/dff1b3c38399041374f9187127d29a27f91205f7332454df83853e979dedbcec

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.