MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 24bf2ac2cdb0751046e0a3e3c118f7ed4ed399ef449ee6a3fab3324950f2304f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 5

Intelligence 5 IOCs YARA 1 File information Comments

SHA256 hash:	24bf2ac2cdb0751046e0a3e3c118f7ed4ed399ef449ee6a3fab3324950f2304f
SHA3-384 hash:	9b3a3c25c248bbde9190cad7b69517760dc374c32ad620d56c625fbe0e68212e71d7c021e8e1af3ec46b40ad9d3e33ba
SHA1 hash:	9f16c0d6953ba99b2c87dc6aa9bac95ebe44030e
MD5 hash:	a2c6fafcb80fd35a851966455ff0991d
humanhash:	johnny-charlie-lactose-violet
File name:	lel.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	716 bytes
First seen:	2026-10-10 12:57:58 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	12:P4Czjku6rZfJT/5rTfJT/46rZfJT8CrTfJT8byTv:5jv6rpd1d46rpu0ubyTv
TLSH	T18301D682B0A58937DDEEC82B3B658C0CB0C4428618E77F48CCF67162D98EF547646E65
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	BlinkzSec

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://176.65.139.41/x64s-l7	80163426481ee9c85839da927aa861ff55021680a7e836653054bd1092463072	Mirai	elf ua-wget
http://176.65.139.41/armv7-l7	b821afb910005d067ad8ec2708ddb10727db728ccc28958a18f6a240e594af51	Mirai	elf ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-10-10T10:20:00Z UTC

Last seen:

2026-10-12T05:27:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/24bf2ac2cdb0751046e0a3e3c118f7ed4ed399ef449ee6a3fab3324950f2304f/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/dc030362-3424-4d66-bf5c-b106b9738173

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/24bf2ac2cdb0751046e0a3e3c118f7ed4ed399ef449ee6a3fab3324950f2304f

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/24bf2ac2cdb0751046e0a3e3c118f7ed4ed399ef449ee6a3fab3324950f2304f/

Threat name:

Script-Shell.Downloader.Heuristic

Status:

Malicious

First seen:

2026-10-10 12:40:10 UTC

File Type:

Text (Shell)

AV detection:

11 of 24 (45.83%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=es7svqwnwb2rarxaupr4cghx5vhnhgppisponi72wmzesuhsgbhq._file

Result

Malware family:

n/a

Score:

9/10

Tags:

antivm defense_evasion discovery linux

Link:

https://tria.ge/reports/261010-p7naqsww9q/

Behaviour

Enumerates kernel/hardware configuration

Reads runtime system information

Writes file to tmp directory

Changes its process name

Checks CPU configuration

Reads CPU attributes

Enumerates running processes

Reads MAC address of network interface

Reads network interface configuration

File and Directory Permissions Modification

Executes dropped EXE

Renames itself

Contacts a large (830348) amount of remote hosts

Creates a large amount of network flows

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.