🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 02afacab8fe2e07c68d28c74d94b1b0ad4e99d84bbf855f66f8f2a08247f52f3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 02afacab8fe2e07c68d28c74d94b1b0ad4e99d84bbf855f66f8f2a08247f52f3
SHA3-384 hash: 239ec1263ef046dce9d87c97a6a47b8bf6f02e492c193dbcf5c19c95bfd7bb80f691d565606e3f1f9a3ff57d78ef77c3
SHA1 hash: 75332c77a4818a4cd0a480d4311aabbd2f02a497
MD5 hash: 7131b5008a7ef45a05eb27a62256ebb0
humanhash: hawaii-september-shade-east
File name:cat.sh
Download: download sample
Signature Mirai
Create hunting rule
File size:1'903 bytes
First seen:2026-10-07 07:32:26 UTC
Last seen:2026-10-07 22:05:07 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 48:sakb0/2e+LaYqceqBgUc8+Cp6N2mwTq0bqM29D:c+HD
TLSH T15E41428918B0E113E1D8CE01B0E1C7945266F58672F62EBEEDC92DAFE8D9D40B035B35
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://176.65.139.204/iran.x86_647bd6aa495ec7595c0576d069e8274e2372f218b6e79ee71c9100cf5c541b24ed Mirai176-65-139-204 elf mirai ua-wget
http://176.65.139.204/iran.aarch648f4c0563e9fd8901e1c6282740685c4521b877bb0e2bdfd792510672e2b007c9 Mirai176-65-139-204 elf mirai ua-wget
http://176.65.139.204/iran.m68k6ace19d81500192e18a25f9b42068e116c20f541ae51f49a1ac2638605081963 Mirai176-65-139-204 elf mirai ua-wget
http://176.65.139.204/iran.mips47ae5b0371a638ce7dddcbec7869fc6fa2e67e546bb1e814f19e87a518233461 Mirai176-65-139-204 elf mirai ua-wget
http://176.65.139.204/iran.mipselb2238267cad870db41151a195b2f05870ed72aeda6650a8b9d727b52f2c3ae56 Mirai176-65-139-204 elf mirai ua-wget
http://176.65.139.204/iran.powerpc4d980590fdc794458e66ecde82b683e0b2b057811de970befa53c8ccb5c44b05 Mirai176-65-139-204 elf mirai ua-wget
http://176.65.139.204/iran.sparc95aff8f144f665a442574864787b4f7f81988631946e9a8405abc7cc1116cac5 Mirai176-65-139-204 elf mirai ua-wget
http://176.65.139.204/iran.sh41bb4fbf5df215757d7a6b1f9601515ec4e12a41c4d695e17898793db2e5b38a8 Mirai176-65-139-204 elf mirai ua-wget
http://176.65.139.204/iran.arc45ac99a83d99879ba0cba10fce2f81f772f67e44ef3df726b4c074c2d7a5f230 Mirai176-65-139-204 elf mirai ua-wget
http://176.65.139.204/iran.i486e09fe1bcfefb15f916979a7bb04a1a570ed999e2e751f7d80266502727e2b6b2 Mirai176-65-139-204 elf mirai ua-wget
http://176.65.139.204/iran.armv4l209844df102aea0ebb0c185029f2eaf8f89e9309bfdc1127594b1761519f89a6 Mirai176-65-139-204 elf mirai ua-wget
http://176.65.139.204/iran.armv5l7e47c19f82d8a932da2ec9bd42d7b815a05bf4be9ae0e512544fdbfce5f930b8 Mirai176-65-139-204 elf mirai ua-wget
http://176.65.139.204/iran.armv6lb22e4c920695bb35526ff1173f8a8344190576228af1791d941c54ca60fc01e3 Mirai176-65-139-204 elf mirai ua-wget
http://176.65.139.204/iran.armv7l6b2171ad66224954ed1845a46ea6aa8f047304957f3e8e514bdeee6abf5139e8 Mirai176-65-139-204 elf mirai ua-wget

Intelligence

File Origin
# of uploads :
2
# of downloads :
78
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/6ac5f5ba391680edb673a8ec/reports/4ed53003-33e2-4b53-b7fb-837816460012/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-10-06T20:43:00Z UTC
Last seen:
2026-10-06T20:59:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/02afacab8fe2e07c68d28c74d94b1b0ad4e99d84bbf855f66f8f2a08247f52f3/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/14604d2a-ddcb-458c-a768-7a4e7580ea7e
Behavior Graph:
Download SVG
%3 guuid=d500982b-1b00-0000-f139-7544090c0000 pid=3081 /usr/bin/sudo guuid=9dd09c2e-1b00-0000-f139-75440b0c0000 pid=3083 /tmp/sample.bin guuid=d500982b-1b00-0000-f139-7544090c0000 pid=3081->guuid=9dd09c2e-1b00-0000-f139-75440b0c0000 pid=3083 execve guuid=c413fb2e-1b00-0000-f139-75440d0c0000 pid=3085 /usr/bin/wget net send-data write-file guuid=9dd09c2e-1b00-0000-f139-75440b0c0000 pid=3083->guuid=c413fb2e-1b00-0000-f139-75440d0c0000 pid=3085 execve guuid=15732539-1b00-0000-f139-7544170c0000 pid=3095 /usr/bin/chmod guuid=9dd09c2e-1b00-0000-f139-75440b0c0000 pid=3083->guuid=15732539-1b00-0000-f139-7544170c0000 pid=3095 execve guuid=8009ac39-1b00-0000-f139-7544180c0000 pid=3096 /home/sandbox/x86_64 guuid=9dd09c2e-1b00-0000-f139-75440b0c0000 pid=3083->guuid=8009ac39-1b00-0000-f139-7544180c0000 pid=3096 execve guuid=9712bd3a-1b00-0000-f139-75441a0c0000 pid=3098 /usr/bin/wget net send-data write-file guuid=9dd09c2e-1b00-0000-f139-75440b0c0000 pid=3083->guuid=9712bd3a-1b00-0000-f139-75441a0c0000 pid=3098 execve guuid=77246942-1b00-0000-f139-75441f0c0000 pid=3103 /usr/bin/chmod guuid=9dd09c2e-1b00-0000-f139-75440b0c0000 pid=3083->guuid=77246942-1b00-0000-f139-75441f0c0000 pid=3103 execve guuid=55b30d45-1b00-0000-f139-7544200c0000 pid=3104 /usr/bin/dash guuid=9dd09c2e-1b00-0000-f139-75440b0c0000 pid=3083->guuid=55b30d45-1b00-0000-f139-7544200c0000 pid=3104 clone guuid=15bf3e45-1b00-0000-f139-7544210c0000 pid=3105 /usr/bin/wget net send-data write-file guuid=9dd09c2e-1b00-0000-f139-75440b0c0000 pid=3083->guuid=15bf3e45-1b00-0000-f139-7544210c0000 pid=3105 execve guuid=bc81ab4c-1b00-0000-f139-7544240c0000 pid=3108 /usr/bin/chmod guuid=9dd09c2e-1b00-0000-f139-75440b0c0000 pid=3083->guuid=bc81ab4c-1b00-0000-f139-7544240c0000 pid=3108 execve guuid=8ac9754d-1b00-0000-f139-7544250c0000 pid=3109 /usr/bin/dash guuid=9dd09c2e-1b00-0000-f139-75440b0c0000 pid=3083->guuid=8ac9754d-1b00-0000-f139-7544250c0000 pid=3109 clone guuid=9faa1f4f-1b00-0000-f139-7544270c0000 pid=3111 /usr/bin/wget net send-data write-file guuid=9dd09c2e-1b00-0000-f139-75440b0c0000 pid=3083->guuid=9faa1f4f-1b00-0000-f139-7544270c0000 pid=3111 execve guuid=bd1b3a55-1b00-0000-f139-75442f0c0000 pid=3119 /usr/bin/chmod guuid=9dd09c2e-1b00-0000-f139-75440b0c0000 pid=3083->guuid=bd1b3a55-1b00-0000-f139-75442f0c0000 pid=3119 execve guuid=e533b855-1b00-0000-f139-7544300c0000 pid=3120 /usr/bin/dash guuid=9dd09c2e-1b00-0000-f139-75440b0c0000 pid=3083->guuid=e533b855-1b00-0000-f139-7544300c0000 pid=3120 clone guuid=347adf56-1b00-0000-f139-7544320c0000 pid=3122 /usr/bin/wget net send-data write-file guuid=9dd09c2e-1b00-0000-f139-75440b0c0000 pid=3083->guuid=347adf56-1b00-0000-f139-7544320c0000 pid=3122 execve guuid=29fccc5d-1b00-0000-f139-75443c0c0000 pid=3132 /usr/bin/curl net send-data write-file guuid=9dd09c2e-1b00-0000-f139-75440b0c0000 pid=3083->guuid=29fccc5d-1b00-0000-f139-75443c0c0000 pid=3132 execve guuid=dcfeea71-1b00-0000-f139-7544440c0000 pid=3140 /usr/bin/chmod guuid=9dd09c2e-1b00-0000-f139-75440b0c0000 pid=3083->guuid=dcfeea71-1b00-0000-f139-7544440c0000 pid=3140 execve guuid=ce096973-1b00-0000-f139-7544460c0000 pid=3142 /usr/bin/dash guuid=9dd09c2e-1b00-0000-f139-75440b0c0000 pid=3083->guuid=ce096973-1b00-0000-f139-7544460c0000 pid=3142 clone guuid=0fb8e277-1b00-0000-f139-7544500c0000 pid=3152 /usr/bin/wget net send-data write-file guuid=9dd09c2e-1b00-0000-f139-75440b0c0000 pid=3083->guuid=0fb8e277-1b00-0000-f139-7544500c0000 pid=3152 execve guuid=069bb27f-1b00-0000-f139-7544590c0000 pid=3161 /usr/bin/chmod guuid=9dd09c2e-1b00-0000-f139-75440b0c0000 pid=3083->guuid=069bb27f-1b00-0000-f139-7544590c0000 pid=3161 execve guuid=fa483280-1b00-0000-f139-75445a0c0000 pid=3162 /usr/bin/dash guuid=9dd09c2e-1b00-0000-f139-75440b0c0000 pid=3083->guuid=fa483280-1b00-0000-f139-75445a0c0000 pid=3162 clone guuid=e487bf81-1b00-0000-f139-75445e0c0000 pid=3166 /usr/bin/wget net send-data write-file guuid=9dd09c2e-1b00-0000-f139-75440b0c0000 pid=3083->guuid=e487bf81-1b00-0000-f139-75445e0c0000 pid=3166 execve guuid=8d7ea386-1b00-0000-f139-7544660c0000 pid=3174 /usr/bin/chmod guuid=9dd09c2e-1b00-0000-f139-75440b0c0000 pid=3083->guuid=8d7ea386-1b00-0000-f139-7544660c0000 pid=3174 execve guuid=8fba7b87-1b00-0000-f139-7544690c0000 pid=3177 /usr/bin/dash guuid=9dd09c2e-1b00-0000-f139-75440b0c0000 pid=3083->guuid=8fba7b87-1b00-0000-f139-7544690c0000 pid=3177 clone guuid=aab75c88-1b00-0000-f139-75446d0c0000 pid=3181 /usr/bin/wget net send-data guuid=9dd09c2e-1b00-0000-f139-75440b0c0000 pid=3083->guuid=aab75c88-1b00-0000-f139-75446d0c0000 pid=3181 execve guuid=b3819d8b-1b00-0000-f139-7544770c0000 pid=3191 /usr/bin/curl net send-data write-file guuid=9dd09c2e-1b00-0000-f139-75440b0c0000 pid=3083->guuid=b3819d8b-1b00-0000-f139-7544770c0000 pid=3191 execve guuid=6b304093-1b00-0000-f139-7544830c0000 pid=3203 /usr/bin/chmod guuid=9dd09c2e-1b00-0000-f139-75440b0c0000 pid=3083->guuid=6b304093-1b00-0000-f139-7544830c0000 pid=3203 execve guuid=7a128193-1b00-0000-f139-7544850c0000 pid=3205 /usr/bin/dash guuid=9dd09c2e-1b00-0000-f139-75440b0c0000 pid=3083->guuid=7a128193-1b00-0000-f139-7544850c0000 pid=3205 clone guuid=66170696-1b00-0000-f139-75448c0c0000 pid=3212 /usr/bin/wget net send-data write-file guuid=9dd09c2e-1b00-0000-f139-75440b0c0000 pid=3083->guuid=66170696-1b00-0000-f139-75448c0c0000 pid=3212 execve guuid=44ce289b-1b00-0000-f139-7544980c0000 pid=3224 /usr/bin/chmod guuid=9dd09c2e-1b00-0000-f139-75440b0c0000 pid=3083->guuid=44ce289b-1b00-0000-f139-7544980c0000 pid=3224 execve guuid=d7c5679b-1b00-0000-f139-7544990c0000 pid=3225 /usr/bin/dash guuid=9dd09c2e-1b00-0000-f139-75440b0c0000 pid=3083->guuid=d7c5679b-1b00-0000-f139-7544990c0000 pid=3225 clone guuid=14488d9c-1b00-0000-f139-75449d0c0000 pid=3229 /usr/bin/wget net send-data write-file guuid=9dd09c2e-1b00-0000-f139-75440b0c0000 pid=3083->guuid=14488d9c-1b00-0000-f139-75449d0c0000 pid=3229 execve guuid=fb2a66a1-1b00-0000-f139-7544a20c0000 pid=3234 /usr/bin/curl net send-data write-file guuid=9dd09c2e-1b00-0000-f139-75440b0c0000 pid=3083->guuid=fb2a66a1-1b00-0000-f139-7544a20c0000 pid=3234 execve guuid=db9bbba8-1b00-0000-f139-7544b60c0000 pid=3254 /usr/bin/chmod guuid=9dd09c2e-1b00-0000-f139-75440b0c0000 pid=3083->guuid=db9bbba8-1b00-0000-f139-7544b60c0000 pid=3254 execve guuid=4ded1ea9-1b00-0000-f139-7544b80c0000 pid=3256 /home/sandbox/i486 guuid=9dd09c2e-1b00-0000-f139-75440b0c0000 pid=3083->guuid=4ded1ea9-1b00-0000-f139-7544b80c0000 pid=3256 execve guuid=83948aab-1b00-0000-f139-7544bf0c0000 pid=3263 /usr/bin/wget net send-data write-file guuid=9dd09c2e-1b00-0000-f139-75440b0c0000 pid=3083->guuid=83948aab-1b00-0000-f139-7544bf0c0000 pid=3263 execve guuid=c0a8b4b3-1b00-0000-f139-7544c40c0000 pid=3268 /usr/bin/chmod guuid=9dd09c2e-1b00-0000-f139-75440b0c0000 pid=3083->guuid=c0a8b4b3-1b00-0000-f139-7544c40c0000 pid=3268 execve guuid=cfe66db4-1b00-0000-f139-7544c60c0000 pid=3270 /usr/bin/dash guuid=9dd09c2e-1b00-0000-f139-75440b0c0000 pid=3083->guuid=cfe66db4-1b00-0000-f139-7544c60c0000 pid=3270 clone guuid=7ef28ab5-1b00-0000-f139-7544ca0c0000 pid=3274 /usr/bin/wget net send-data guuid=9dd09c2e-1b00-0000-f139-75440b0c0000 pid=3083->guuid=7ef28ab5-1b00-0000-f139-7544ca0c0000 pid=3274 execve guuid=b5612abb-1b00-0000-f139-7544d40c0000 pid=3284 /usr/bin/curl net send-data write-file guuid=9dd09c2e-1b00-0000-f139-75440b0c0000 pid=3083->guuid=b5612abb-1b00-0000-f139-7544d40c0000 pid=3284 execve guuid=2e539dc2-1b00-0000-f139-7544e40c0000 pid=3300 /usr/bin/chmod guuid=9dd09c2e-1b00-0000-f139-75440b0c0000 pid=3083->guuid=2e539dc2-1b00-0000-f139-7544e40c0000 pid=3300 execve guuid=ee3c61c3-1b00-0000-f139-7544e50c0000 pid=3301 /usr/bin/dash guuid=9dd09c2e-1b00-0000-f139-75440b0c0000 pid=3083->guuid=ee3c61c3-1b00-0000-f139-7544e50c0000 pid=3301 clone guuid=c29ea2c7-1b00-0000-f139-7544ea0c0000 pid=3306 /usr/bin/wget net send-data write-file guuid=9dd09c2e-1b00-0000-f139-75440b0c0000 pid=3083->guuid=c29ea2c7-1b00-0000-f139-7544ea0c0000 pid=3306 execve guuid=eb31f5cd-1b00-0000-f139-7544f20c0000 pid=3314 /usr/bin/chmod guuid=9dd09c2e-1b00-0000-f139-75440b0c0000 pid=3083->guuid=eb31f5cd-1b00-0000-f139-7544f20c0000 pid=3314 execve guuid=fe2848ce-1b00-0000-f139-7544f30c0000 pid=3315 /usr/bin/dash guuid=9dd09c2e-1b00-0000-f139-75440b0c0000 pid=3083->guuid=fe2848ce-1b00-0000-f139-7544f30c0000 pid=3315 clone guuid=7afe1acf-1b00-0000-f139-7544f60c0000 pid=3318 /usr/bin/wget net send-data write-file guuid=9dd09c2e-1b00-0000-f139-75440b0c0000 pid=3083->guuid=7afe1acf-1b00-0000-f139-7544f60c0000 pid=3318 execve guuid=ac9b12d7-1b00-0000-f139-7544fc0c0000 pid=3324 /usr/bin/chmod guuid=9dd09c2e-1b00-0000-f139-75440b0c0000 pid=3083->guuid=ac9b12d7-1b00-0000-f139-7544fc0c0000 pid=3324 execve guuid=f28261d8-1b00-0000-f139-7544ff0c0000 pid=3327 /usr/bin/dash guuid=9dd09c2e-1b00-0000-f139-75440b0c0000 pid=3083->guuid=f28261d8-1b00-0000-f139-7544ff0c0000 pid=3327 clone b3c394b2-ff94-56d4-98ed-d1d45e5f1df2 176.65.139.204:80 guuid=c413fb2e-1b00-0000-f139-75440d0c0000 pid=3085->b3c394b2-ff94-56d4-98ed-d1d45e5f1df2 send: 140B guuid=26979c3a-1b00-0000-f139-7544190c0000 pid=3097 /home/sandbox/x86_64 zombie guuid=8009ac39-1b00-0000-f139-7544180c0000 pid=3096->guuid=26979c3a-1b00-0000-f139-7544190c0000 pid=3097 clone guuid=7f94cb3a-1b00-0000-f139-75441b0c0000 pid=3099 /home/sandbox/x86_64 write-config zombie guuid=26979c3a-1b00-0000-f139-7544190c0000 pid=3097->guuid=7f94cb3a-1b00-0000-f139-75441b0c0000 pid=3099 clone guuid=9712bd3a-1b00-0000-f139-75441a0c0000 pid=3098->b3c394b2-ff94-56d4-98ed-d1d45e5f1df2 send: 141B guuid=8b00b73b-1b00-0000-f139-75441c0c0000 pid=3100 /home/sandbox/x86_64 net guuid=7f94cb3a-1b00-0000-f139-75441b0c0000 pid=3099->guuid=8b00b73b-1b00-0000-f139-75441c0c0000 pid=3100 clone f58f5b1c-bd27-5369-b91a-8202db930d9c 94.154.43.242:6666 guuid=8b00b73b-1b00-0000-f139-75441c0c0000 pid=3100->f58f5b1c-bd27-5369-b91a-8202db930d9c con guuid=f2ec703c-1b00-0000-f139-75441d0c0000 pid=3101 /home/sandbox/x86_64 guuid=8b00b73b-1b00-0000-f139-75441c0c0000 pid=3100->guuid=f2ec703c-1b00-0000-f139-75441d0c0000 pid=3101 clone guuid=f5897d3c-1b00-0000-f139-75441e0c0000 pid=3102 /home/sandbox/x86_64 guuid=f2ec703c-1b00-0000-f139-75441d0c0000 pid=3101->guuid=f5897d3c-1b00-0000-f139-75441e0c0000 pid=3102 clone guuid=15bf3e45-1b00-0000-f139-7544210c0000 pid=3105->b3c394b2-ff94-56d4-98ed-d1d45e5f1df2 send: 138B guuid=9faa1f4f-1b00-0000-f139-7544270c0000 pid=3111->b3c394b2-ff94-56d4-98ed-d1d45e5f1df2 send: 138B guuid=347adf56-1b00-0000-f139-7544320c0000 pid=3122->b3c394b2-ff94-56d4-98ed-d1d45e5f1df2 send: 140B guuid=29fccc5d-1b00-0000-f139-75443c0c0000 pid=3132->b3c394b2-ff94-56d4-98ed-d1d45e5f1df2 send: 89B guuid=0fb8e277-1b00-0000-f139-7544500c0000 pid=3152->b3c394b2-ff94-56d4-98ed-d1d45e5f1df2 send: 141B guuid=e487bf81-1b00-0000-f139-75445e0c0000 pid=3166->b3c394b2-ff94-56d4-98ed-d1d45e5f1df2 send: 139B guuid=aab75c88-1b00-0000-f139-75446d0c0000 pid=3181->b3c394b2-ff94-56d4-98ed-d1d45e5f1df2 send: 137B guuid=b3819d8b-1b00-0000-f139-7544770c0000 pid=3191->b3c394b2-ff94-56d4-98ed-d1d45e5f1df2 send: 86B guuid=66170696-1b00-0000-f139-75448c0c0000 pid=3212->b3c394b2-ff94-56d4-98ed-d1d45e5f1df2 send: 137B guuid=14488d9c-1b00-0000-f139-75449d0c0000 pid=3229->b3c394b2-ff94-56d4-98ed-d1d45e5f1df2 send: 138B guuid=fb2a66a1-1b00-0000-f139-7544a20c0000 pid=3234->b3c394b2-ff94-56d4-98ed-d1d45e5f1df2 send: 87B guuid=d7f27eab-1b00-0000-f139-7544be0c0000 pid=3262 /home/sandbox/i486 guuid=4ded1ea9-1b00-0000-f139-7544b80c0000 pid=3256->guuid=d7f27eab-1b00-0000-f139-7544be0c0000 pid=3262 clone guuid=2aed90ab-1b00-0000-f139-7544c00c0000 pid=3264 /home/sandbox/i486 write-config zombie guuid=d7f27eab-1b00-0000-f139-7544be0c0000 pid=3262->guuid=2aed90ab-1b00-0000-f139-7544c00c0000 pid=3264 clone guuid=83948aab-1b00-0000-f139-7544bf0c0000 pid=3263->b3c394b2-ff94-56d4-98ed-d1d45e5f1df2 send: 140B guuid=0506b0ab-1b00-0000-f139-7544c10c0000 pid=3265 /home/sandbox/i486 net guuid=2aed90ab-1b00-0000-f139-7544c00c0000 pid=3264->guuid=0506b0ab-1b00-0000-f139-7544c10c0000 pid=3265 clone guuid=0506b0ab-1b00-0000-f139-7544c10c0000 pid=3265->f58f5b1c-bd27-5369-b91a-8202db930d9c con guuid=0506b0ab-1b00-0000-f139-7544c10c0000 pid=3266 /home/sandbox/i486 guuid=0506b0ab-1b00-0000-f139-7544c10c0000 pid=3265->guuid=0506b0ab-1b00-0000-f139-7544c10c0000 pid=3266 clone guuid=7ef28ab5-1b00-0000-f139-7544ca0c0000 pid=3274->b3c394b2-ff94-56d4-98ed-d1d45e5f1df2 send: 140B guuid=b5612abb-1b00-0000-f139-7544d40c0000 pid=3284->b3c394b2-ff94-56d4-98ed-d1d45e5f1df2 send: 89B guuid=c29ea2c7-1b00-0000-f139-7544ea0c0000 pid=3306->b3c394b2-ff94-56d4-98ed-d1d45e5f1df2 send: 140B guuid=7afe1acf-1b00-0000-f139-7544f60c0000 pid=3318->b3c394b2-ff94-56d4-98ed-d1d45e5f1df2 send: 140B
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/02afacab8fe2e07c68d28c74d94b1b0ad4e99d84bbf855f66f8f2a08247f52f3
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/02afacab8fe2e07c68d28c74d94b1b0ad4e99d84bbf855f66f8f2a08247f52f3/
Threat name:
Win32.Trojan.Qwexlafiba
Create hunting rule
Status:
Malicious
First seen:
2026-10-07 01:38:54 UTC
File Type:
Text (Shell)
AV detection:
13 of 24 (54.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=akx2zk4p4lqhy2gsrr2nssy3blkothmexp4fl5tpr4vaqjd7klzq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux persistence
Link:
https://tria.ge/reports/261007-jdl8pavw7m/
Behaviour
Reads runtime system information
System Network Configuration Discovery
Writes file to tmp directory
Changes its process name
Checks CPU configuration
Enumerates running processes
Modifies init.d
File and Directory Permissions Modification
Executes dropped EXE
Malware family:
Gafgyt
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/02afacab8fe2/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.11
Link:
https://yomi.yoroi.company/submissions/02afacab8fe2e07c68d28c74d94b1b0ad4e99d84bbf855f66f8f2a08247f52f3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MAL_Linux_IoT_MultiArch_BotnetLoader_Generic
Create hunting rule
Author:Anish Bogati
Description:Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:MalwareBazaar sample lilin.sh

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh 02afacab8fe2e07c68d28c74d94b1b0ad4e99d84bbf855f66f8f2a08247f52f3

(this sample)

Mirai

elf 7bd6aa495ec7595c0576d069e8274e2372f218b6e79ee71c9100cf5c541b24ed

  
URLhaus
https://urlhaus.abuse.ch/url/3943812/
  
Delivery method
Distributed via web download
  
Dropping
MD5 b5644a585e5a60a66f4fee4ba04b7a80
  
Dropping
SHA256 7bd6aa495ec7595c0576d069e8274e2372f218b6e79ee71c9100cf5c541b24ed

Comments