MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f6f3b06ff42116c675cdf5a6165a9d52b30fdfd232622eaa3840383bf363f25e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 5

Intelligence 5 IOCs YARA 1 File information Comments

SHA256 hash:	f6f3b06ff42116c675cdf5a6165a9d52b30fdfd232622eaa3840383bf363f25e
SHA3-384 hash:	ba66ece1361dbe17922e865741fef0cc466ba4fac6e8eae310baad486a7b38db4509844774545b0e00bc44bbac1df4f2
SHA1 hash:	68208ebc39593e3be91f2ec536f90ed2ac5ef9d9
MD5 hash:	05fda71868fe0643b0a4935897800eeb
humanhash:	three-item-ink-five
File name:	bins.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	1'900 bytes
First seen:	2026-06-27 18:01:56 UTC
Last seen:	2026-06-28 06:47:37 UTC
File type:	sh
MIME type:	text/x-shellscript
ssdeep	24:1OJXUI6TpeBtmNIiNI+KPOKPnn2vsH2vpdUHTdR:eX8pctCKPOKPnn2vsH2vMHTdR
TLSH	T1C241B28B726434B3C40AEE55F3E495C4E18997E3E2B7CAB8B4A48763105D12CF5A6F70
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://91.92.42.125/x86	caa9408fdf9272b4a2c02061218f78c96124608dd23694cfc19ab0747ec1a43c	Mirai	elf mirai ua-wget
http://91.92.42.125/i386	caa9408fdf9272b4a2c02061218f78c96124608dd23694cfc19ab0747ec1a43c	Mirai	elf mirai ua-wget
http://91.92.42.125/amd64	ba01bc4f787871ce0f3ab3c2382cf5fe250dbdda7a06bdf38908d22fe79d6b8a	Mirai	elf mirai ua-wget
http://91.92.42.125/arm	cc5adaad983d6eae97c7e7abc75452e6fbc8caf9a57f413f646164e2d4ca044a	Mirai	elf mirai ua-wget
http://91.92.42.125/armv7l	cc5adaad983d6eae97c7e7abc75452e6fbc8caf9a57f413f646164e2d4ca044a	Mirai	elf mirai ua-wget
http://91.92.42.125/arm5	72ae99c2af2f47b65dc99c828a8227d88b3143f698ba7bf4370f8a90f18ac37d	Mirai	elf mirai ua-wget
http://91.92.42.125/arm6	527430cb7b27167ef60dfaf0cfa44d1cebab0466b331bc25e4b21072cccf72eb	Mirai	elf mirai ua-wget
http://91.92.42.125/arm64	f44b6ad0761b7503866d2ec0881a5b73523cd761d4e9e3db4b9f83b172e11ec7	Mirai	elf mirai ua-wget
http://91.92.42.125/android_arm64	edc55031874e45f3ddf47ab9c5940911bf59f290a781bcfe79b77d0d830dec8f	Mirai	elf mirai ua-wget
http://91.92.42.125/mips	457ff20c00a295e27fe60a0a3e1a1aed1d297cc1cebe4c5cd876bcc21903fbfc	Mirai	elf mirai ua-wget
http://91.92.42.125/mipsle	94c4072f7e4c6020f5f9c2eb4dcf1ac1808776804ee4daeaf798c01e69fcbce3	Mirai	elf mirai ua-wget
http://91.92.42.125/bot.exe	n/a	n/a	exe

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-06-27T15:24:00Z UTC

Last seen:

2026-06-28T12:58:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/f6f3b06ff42116c675cdf5a6165a9d52b30fdfd232622eaa3840383bf363f25e/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/97098a76-8edb-47b1-bad6-21a166eebbe3

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/f6f3b06ff42116c675cdf5a6165a9d52b30fdfd232622eaa3840383bf363f25e

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f6f3b06ff42116c675cdf5a6165a9d52b30fdfd232622eaa3840383bf363f25e/

Threat name:

Linux.Trojan.Vigorf

Status:

Malicious

First seen:

2026-06-27 02:40:50 UTC

File Type:

Text (Shell)

AV detection:

19 of 38 (50.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=63z3a37ueelmm5on6wtbmwu5kkzq7x6sgjrc5kryia4dx43d6jpa._file

Result

Malware family:

n/a

Score:

7/10

Tags:

antivm defense_evasion discovery linux persistence privilege_escalation

Link:

https://tria.ge/reports/260627-wmss2scx5p/

Behaviour

Enumerates kernel/hardware configuration

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Checks CPU configuration

Modifies Bash startup script

Creates/modifies environment variables

Write file to user bin folder

File and Directory Permissions Modification

Executes dropped EXE

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.39

Link:

https://yomi.yoroi.company/submissions/f6f3b06ff42116c675cdf5a6165a9d52b30fdfd232622eaa3840383bf363f25e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh