MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 16f9d8874ecdec3a674c410173789bcfe5ca87f939e06dc3de7484ca33eeb8ef. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	16f9d8874ecdec3a674c410173789bcfe5ca87f939e06dc3de7484ca33eeb8ef
SHA3-384 hash:	586bacaf100243a8e9695e5c11e6b5cee8ba6dc46fa41d62c6c8408ffba8a46b87287537343b88642cbdbdc1575cc973
SHA1 hash:	8b11617e7a963cf08c449cf533c1c6aea4a4fcf3
MD5 hash:	1953942d0345854820ed3688d2784fd4
humanhash:	uncle-don-chicken-jupiter
File name:	1.sh
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	1'228 bytes
First seen:	2026-10-21 17:48:20 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	24:HrqF2uhl4CBO+7pB40FqlFU70o9uau0fAcKpp4XFcyqCvyQ:WF2uD4fupBiTU70o9unHcKpQcyJz
TLSH	T14021B5F0FA656C32764DC829F64A5482BA9B0D37181D2D54F49AEC343F3C408E314B6A
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	BlinkzSec
Tags:	mirai

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

48

Origin country :

AT

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.Linux.DownLoader.2650.873.26622.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

busybox

Link:

https://www.filescan.io/uploads/6ad8fc09e9b4edde89dcf9a2/reports/8885fb78-130e-4aa2-b7d3-5867fc2b40ca/overview

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-09-30T00:20:00Z UTC

Last seen:

2026-10-22T19:53:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/16f9d8874ecdec3a674c410173789bcfe5ca87f939e06dc3de7484ca33eeb8ef/results?tab=lookup

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/10d546dd-324a-47d4-9f8d-5a5eea33df1a

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

21%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/16f9d8874ecdec3a674c410173789bcfe5ca87f939e06dc3de7484ca33eeb8ef

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/16f9d8874ecdec3a674c410173789bcfe5ca87f939e06dc3de7484ca33eeb8ef/

ReversingLabs TitaniumCloud Win32.Trojan.Qwexlafiba

Threat name:

Win32.Trojan.Qwexlafiba

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-10-03 23:33:55 UTC

File Type:

Text (Shell)

AV detection:

7 of 24 (29.17%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=c345rb2ozxwduz2mieaxg6e3z7s4vb7zhhqg3q66oscmum7oxdxq._file

Hatching Triage mirai

Result

Malware family:

mirai

Alert

Create hunting rule

Score:

  10/10

Tags:

family:mirai antivm botnet defense_evasion discovery execution linux persistence privilege_escalation upx

Link:

https://tria.ge/reports/261021-wd3lwsew2v/

Behaviour

Command and Scripting Interpreter: Unix Shell

Enumerates kernel/hardware configuration

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Changes its process name

Checks CPU configuration

Reads system network configuration

UPX packed file

Creates/modifies Cron job

Enumerates active TCP sockets

Enumerates running processes

Modifies systemd

Writes file to system bin folder

File and Directory Permissions Modification

Executes dropped EXE

Modifies Watchdog functionality

Contacts a large (94641) amount of remote hosts

Creates a large amount of network flows

Family: Mirai

Mirai ARM payload

Malware Config

C2 Extraction:

94.154.43.30

VMRay Mirai.CondiBot

Malware family:

Mirai.CondiBot

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/16f9d8874ecd/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/16f9d8874ecdec3a674c410173789bcfe5ca87f939e06dc3de7484ca33eeb8ef