MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 58af3efe757e3952eddc58f1ecde0ef00a00ba7ddc656826fc31872ea7cfa71e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Mirai


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 58af3efe757e3952eddc58f1ecde0ef00a00ba7ddc656826fc31872ea7cfa71e
SHA3-384 hash: f458e33ecdeb47bd220c9ea60799be8752a8cd2689b80e7d5af547a1a183ee8b847213ea1468e104887a5bb0a20c8035
SHA1 hash: 9ccb519c3e04b13f831e400a65dc27fbc7380e3e
MD5 hash: 4ba79ef0833c5b390f5a7b29f3bee399
humanhash: grey-glucose-edward-quebec
File name:telnet.sh
Download: download sample
Signature Mirai
Create hunting rule
File size:1'834 bytes
First seen:2026-08-18 15:12:37 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 48:OwJSNUy8gBg10meedql0emQ5PsskAJwFc+:OwJSNUNgBg10pedql0emQ5Ps1AJwFc+
TLSH T19A3121CD32F8B293CB5DCF41BCE142C6B247D58662D8AE72E8C11CA16969FC13475A36
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter BlinkzSec
URLMalware sample (SHA256 hash)SignatureTags
http://167.86.99.169/iran.x86_64a7a3258c80a7705fc24c355cdb611e53af1bca8331d579972e06d415983d56af Miraimirai wraith
http://167.86.99.169/iran.aarch64n/an/aua-wget
http://167.86.99.169/iran.m68k4441a3dc0d374d429465add007d13258841c8879eaf125cac2b2d1b800182142 Miraimirai wraith
http://167.86.99.169/iran.mips618458f34b310c98eaf141c4439a4e2e5f1bccad9618c3f80ffb4c6697a7cdcb Miraimirai wraith
http://167.86.99.169/iran.mipsel53d327644cba4fb137d3da3b20098e300083ab531c95ebc143ae6f3955a33338 Mirai167-86-99-169 elf mirai ua-wget
http://167.86.99.169/iran.powerpcf2192cd642df1a6259bd9467a126f0b05cb11434ac4990739c61b7edecd7b0ea Mirai167-86-99-169 elf mirai ua-wget
http://167.86.99.169/iran.sparc4a1c964410a1b276730da5718a1ee803aa813bfc69553bc6991da0ccffc201a3 Mirai167-86-99-169 elf mirai ua-wget
http://167.86.99.169/iran.sh4d061665e475ea1fd41c3018c8ebece8b9d78542a9846c6dfe980c99f0ff6058f Mirai167-86-99-169 elf mirai ua-wget
http://167.86.99.169/iran.arcdf3b427471a3448eaaaab4bba704e80d0e088eca74e1e21d8a1bb420458b4282 Mirai167-86-99-169 elf mirai ua-wget
http://167.86.99.169/iran.i48625fe0bb77f36b063c98560713422f221dfd3ad4bdd3310e20be4e2441da97452 Mirai167-86-99-169 elf mirai ua-wget
http://167.86.99.169/iran.armv4lb4e5b6bc43212f3baf52ff82c6223e370aff5f263cc34e968b7c52746288ff47 Mirai167-86-99-169 elf mirai ua-wget
http://167.86.99.169/iran.armv5l0e31d3cfb24baf38d3faec21b52465842fbe5c16e6e16bc2efcd3a5025dde324 Mirai167-86-99-169 elf mirai ua-wget
http://167.86.99.169/iran.armv6l941a55cbeab2d3527fdfa23666f81147fc4ca5e1f5545a624d654e6b66bd921a Mirai167-86-99-169 elf mirai ua-wget
http://167.86.99.169/iran.armv7l80cdd1d492acc561d54dad9e8f09c121ba28876c2dd44bf4ceb4a0b1073206ce Mirai167-86-99-169 elf mirai ua-wget

Intelligence

File Origin
# of uploads :
1
# of downloads :
54
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/968c86b2-c0f4-418f-9f3a-f61d9ebcdb8f
Behavior Graph:
Download SVG
%3 guuid=15dd49b5-1b00-0000-5355-2f56180a0000 pid=2584 /usr/bin/sudo guuid=0dd335b8-1b00-0000-5355-2f561c0a0000 pid=2588 /tmp/sample.bin guuid=15dd49b5-1b00-0000-5355-2f56180a0000 pid=2584->guuid=0dd335b8-1b00-0000-5355-2f561c0a0000 pid=2588 execve guuid=c13da3b8-1b00-0000-5355-2f561e0a0000 pid=2590 /usr/bin/wget net send-data write-file guuid=0dd335b8-1b00-0000-5355-2f561c0a0000 pid=2588->guuid=c13da3b8-1b00-0000-5355-2f561e0a0000 pid=2590 execve guuid=0d4f22c0-1b00-0000-5355-2f562b0a0000 pid=2603 /usr/bin/chmod guuid=0dd335b8-1b00-0000-5355-2f561c0a0000 pid=2588->guuid=0d4f22c0-1b00-0000-5355-2f562b0a0000 pid=2603 execve guuid=fc236ac0-1b00-0000-5355-2f562d0a0000 pid=2605 /home/sandbox/x86_64 guuid=0dd335b8-1b00-0000-5355-2f561c0a0000 pid=2588->guuid=fc236ac0-1b00-0000-5355-2f562d0a0000 pid=2605 execve guuid=a588eac0-1b00-0000-5355-2f56300a0000 pid=2608 /usr/bin/wget net send-data guuid=0dd335b8-1b00-0000-5355-2f561c0a0000 pid=2588->guuid=a588eac0-1b00-0000-5355-2f56300a0000 pid=2608 execve guuid=314ceec5-1b00-0000-5355-2f56380a0000 pid=2616 /usr/bin/curl guuid=0dd335b8-1b00-0000-5355-2f561c0a0000 pid=2588->guuid=314ceec5-1b00-0000-5355-2f56380a0000 pid=2616 execve guuid=221b6ac9-1b00-0000-5355-2f56400a0000 pid=2624 /usr/bin/chmod guuid=0dd335b8-1b00-0000-5355-2f561c0a0000 pid=2588->guuid=221b6ac9-1b00-0000-5355-2f56400a0000 pid=2624 execve guuid=a43ee1c9-1b00-0000-5355-2f56430a0000 pid=2627 /home/sandbox/aarch64 guuid=0dd335b8-1b00-0000-5355-2f561c0a0000 pid=2588->guuid=a43ee1c9-1b00-0000-5355-2f56430a0000 pid=2627 execve guuid=d2b886cd-1b00-0000-5355-2f564b0a0000 pid=2635 /usr/bin/wget net send-data write-file guuid=0dd335b8-1b00-0000-5355-2f561c0a0000 pid=2588->guuid=d2b886cd-1b00-0000-5355-2f564b0a0000 pid=2635 execve guuid=b2cd3fd6-1b00-0000-5355-2f56540a0000 pid=2644 /usr/bin/chmod guuid=0dd335b8-1b00-0000-5355-2f561c0a0000 pid=2588->guuid=b2cd3fd6-1b00-0000-5355-2f56540a0000 pid=2644 execve guuid=f367bdd6-1b00-0000-5355-2f56560a0000 pid=2646 /usr/bin/dash guuid=0dd335b8-1b00-0000-5355-2f561c0a0000 pid=2588->guuid=f367bdd6-1b00-0000-5355-2f56560a0000 pid=2646 clone guuid=277eaed7-1b00-0000-5355-2f565a0a0000 pid=2650 /usr/bin/wget net send-data write-file guuid=0dd335b8-1b00-0000-5355-2f561c0a0000 pid=2588->guuid=277eaed7-1b00-0000-5355-2f565a0a0000 pid=2650 execve guuid=1d6654e1-1b00-0000-5355-2f56650a0000 pid=2661 /usr/bin/chmod guuid=0dd335b8-1b00-0000-5355-2f561c0a0000 pid=2588->guuid=1d6654e1-1b00-0000-5355-2f56650a0000 pid=2661 execve guuid=fe6db3e1-1b00-0000-5355-2f56670a0000 pid=2663 /usr/bin/dash guuid=0dd335b8-1b00-0000-5355-2f561c0a0000 pid=2588->guuid=fe6db3e1-1b00-0000-5355-2f56670a0000 pid=2663 clone guuid=b89757e3-1b00-0000-5355-2f566c0a0000 pid=2668 /usr/bin/wget net send-data write-file guuid=0dd335b8-1b00-0000-5355-2f561c0a0000 pid=2588->guuid=b89757e3-1b00-0000-5355-2f566c0a0000 pid=2668 execve guuid=0f67b3e7-1b00-0000-5355-2f56760a0000 pid=2678 /usr/bin/chmod guuid=0dd335b8-1b00-0000-5355-2f561c0a0000 pid=2588->guuid=0f67b3e7-1b00-0000-5355-2f56760a0000 pid=2678 execve guuid=ec2924e8-1b00-0000-5355-2f56770a0000 pid=2679 /usr/bin/dash guuid=0dd335b8-1b00-0000-5355-2f561c0a0000 pid=2588->guuid=ec2924e8-1b00-0000-5355-2f56770a0000 pid=2679 clone guuid=aeef1ae9-1b00-0000-5355-2f567a0a0000 pid=2682 /usr/bin/wget net send-data write-file guuid=0dd335b8-1b00-0000-5355-2f561c0a0000 pid=2588->guuid=aeef1ae9-1b00-0000-5355-2f567a0a0000 pid=2682 execve guuid=252aa1f4-1b00-0000-5355-2f568c0a0000 pid=2700 /usr/bin/chmod guuid=0dd335b8-1b00-0000-5355-2f561c0a0000 pid=2588->guuid=252aa1f4-1b00-0000-5355-2f568c0a0000 pid=2700 execve guuid=ab99eff4-1b00-0000-5355-2f568d0a0000 pid=2701 /usr/bin/dash guuid=0dd335b8-1b00-0000-5355-2f561c0a0000 pid=2588->guuid=ab99eff4-1b00-0000-5355-2f568d0a0000 pid=2701 clone guuid=530ecaf5-1b00-0000-5355-2f568f0a0000 pid=2703 /usr/bin/wget net guuid=0dd335b8-1b00-0000-5355-2f561c0a0000 pid=2588->guuid=530ecaf5-1b00-0000-5355-2f568f0a0000 pid=2703 execve guuid=ad023dfa-1b00-0000-5355-2f56940a0000 pid=2708 /usr/bin/curl net send-data write-file guuid=0dd335b8-1b00-0000-5355-2f561c0a0000 pid=2588->guuid=ad023dfa-1b00-0000-5355-2f56940a0000 pid=2708 execve guuid=9b992f01-1c00-0000-5355-2f569c0a0000 pid=2716 /usr/bin/chmod guuid=0dd335b8-1b00-0000-5355-2f561c0a0000 pid=2588->guuid=9b992f01-1c00-0000-5355-2f569c0a0000 pid=2716 execve guuid=51d77501-1c00-0000-5355-2f569d0a0000 pid=2717 /usr/bin/dash guuid=0dd335b8-1b00-0000-5355-2f561c0a0000 pid=2588->guuid=51d77501-1c00-0000-5355-2f569d0a0000 pid=2717 clone guuid=39101002-1c00-0000-5355-2f56a00a0000 pid=2720 /usr/bin/wget net send-data write-file guuid=0dd335b8-1b00-0000-5355-2f561c0a0000 pid=2588->guuid=39101002-1c00-0000-5355-2f56a00a0000 pid=2720 execve guuid=9a61fa0c-1c00-0000-5355-2f56ad0a0000 pid=2733 /usr/bin/curl net send-data write-file guuid=0dd335b8-1b00-0000-5355-2f561c0a0000 pid=2588->guuid=9a61fa0c-1c00-0000-5355-2f56ad0a0000 pid=2733 execve guuid=f3223d18-1c00-0000-5355-2f56b80a0000 pid=2744 /usr/bin/chmod guuid=0dd335b8-1b00-0000-5355-2f561c0a0000 pid=2588->guuid=f3223d18-1c00-0000-5355-2f56b80a0000 pid=2744 execve guuid=8c4d7d18-1c00-0000-5355-2f56b90a0000 pid=2745 /usr/bin/dash guuid=0dd335b8-1b00-0000-5355-2f561c0a0000 pid=2588->guuid=8c4d7d18-1c00-0000-5355-2f56b90a0000 pid=2745 clone guuid=49045219-1c00-0000-5355-2f56bb0a0000 pid=2747 /usr/bin/wget net send-data write-file guuid=0dd335b8-1b00-0000-5355-2f561c0a0000 pid=2588->guuid=49045219-1c00-0000-5355-2f56bb0a0000 pid=2747 execve guuid=c5caff1d-1c00-0000-5355-2f56c30a0000 pid=2755 /usr/bin/chmod guuid=0dd335b8-1b00-0000-5355-2f561c0a0000 pid=2588->guuid=c5caff1d-1c00-0000-5355-2f56c30a0000 pid=2755 execve guuid=d1bf451e-1c00-0000-5355-2f56c40a0000 pid=2756 /usr/bin/dash guuid=0dd335b8-1b00-0000-5355-2f561c0a0000 pid=2588->guuid=d1bf451e-1c00-0000-5355-2f56c40a0000 pid=2756 clone guuid=2e5f051f-1c00-0000-5355-2f56c70a0000 pid=2759 /usr/bin/wget net send-data write-file guuid=0dd335b8-1b00-0000-5355-2f561c0a0000 pid=2588->guuid=2e5f051f-1c00-0000-5355-2f56c70a0000 pid=2759 execve guuid=5f4d3524-1c00-0000-5355-2f56d30a0000 pid=2771 /usr/bin/chmod guuid=0dd335b8-1b00-0000-5355-2f561c0a0000 pid=2588->guuid=5f4d3524-1c00-0000-5355-2f56d30a0000 pid=2771 execve guuid=cdd19b24-1c00-0000-5355-2f56d50a0000 pid=2773 /home/sandbox/i486 guuid=0dd335b8-1b00-0000-5355-2f561c0a0000 pid=2588->guuid=cdd19b24-1c00-0000-5355-2f56d50a0000 pid=2773 execve guuid=59b35d27-1c00-0000-5355-2f56da0a0000 pid=2778 /usr/bin/wget net send-data write-file guuid=0dd335b8-1b00-0000-5355-2f561c0a0000 pid=2588->guuid=59b35d27-1c00-0000-5355-2f56da0a0000 pid=2778 execve guuid=0a729532-1c00-0000-5355-2f56ea0a0000 pid=2794 /usr/bin/curl net send-data write-file guuid=0dd335b8-1b00-0000-5355-2f561c0a0000 pid=2588->guuid=0a729532-1c00-0000-5355-2f56ea0a0000 pid=2794 execve guuid=4cccfe37-1c00-0000-5355-2f56f90a0000 pid=2809 /usr/bin/chmod guuid=0dd335b8-1b00-0000-5355-2f561c0a0000 pid=2588->guuid=4cccfe37-1c00-0000-5355-2f56f90a0000 pid=2809 execve guuid=6adda038-1c00-0000-5355-2f56fb0a0000 pid=2811 /usr/bin/dash guuid=0dd335b8-1b00-0000-5355-2f561c0a0000 pid=2588->guuid=6adda038-1c00-0000-5355-2f56fb0a0000 pid=2811 clone guuid=c6926639-1c00-0000-5355-2f56ff0a0000 pid=2815 /usr/bin/wget net send-data write-file guuid=0dd335b8-1b00-0000-5355-2f561c0a0000 pid=2588->guuid=c6926639-1c00-0000-5355-2f56ff0a0000 pid=2815 execve guuid=af84623d-1c00-0000-5355-2f56090b0000 pid=2825 /usr/bin/chmod guuid=0dd335b8-1b00-0000-5355-2f561c0a0000 pid=2588->guuid=af84623d-1c00-0000-5355-2f56090b0000 pid=2825 execve guuid=e0bbea3d-1c00-0000-5355-2f560b0b0000 pid=2827 /usr/bin/dash guuid=0dd335b8-1b00-0000-5355-2f561c0a0000 pid=2588->guuid=e0bbea3d-1c00-0000-5355-2f560b0b0000 pid=2827 clone guuid=ef0a1f3f-1c00-0000-5355-2f560e0b0000 pid=2830 /usr/bin/wget net send-data write-file guuid=0dd335b8-1b00-0000-5355-2f561c0a0000 pid=2588->guuid=ef0a1f3f-1c00-0000-5355-2f560e0b0000 pid=2830 execve guuid=451b7a43-1c00-0000-5355-2f56170b0000 pid=2839 /usr/bin/chmod guuid=0dd335b8-1b00-0000-5355-2f561c0a0000 pid=2588->guuid=451b7a43-1c00-0000-5355-2f56170b0000 pid=2839 execve guuid=578cc444-1c00-0000-5355-2f561a0b0000 pid=2842 /usr/bin/dash guuid=0dd335b8-1b00-0000-5355-2f561c0a0000 pid=2588->guuid=578cc444-1c00-0000-5355-2f561a0b0000 pid=2842 clone guuid=6e48b245-1c00-0000-5355-2f561e0b0000 pid=2846 /usr/bin/wget net send-data write-file guuid=0dd335b8-1b00-0000-5355-2f561c0a0000 pid=2588->guuid=6e48b245-1c00-0000-5355-2f561e0b0000 pid=2846 execve guuid=ce7cca4a-1c00-0000-5355-2f56260b0000 pid=2854 /usr/bin/chmod guuid=0dd335b8-1b00-0000-5355-2f561c0a0000 pid=2588->guuid=ce7cca4a-1c00-0000-5355-2f56260b0000 pid=2854 execve guuid=5d0d354b-1c00-0000-5355-2f56280b0000 pid=2856 /usr/bin/dash guuid=0dd335b8-1b00-0000-5355-2f561c0a0000 pid=2588->guuid=5d0d354b-1c00-0000-5355-2f56280b0000 pid=2856 clone 98c9877f-15cb-5222-85f7-40b8c7e5dc5d 167.86.99.169:80 guuid=c13da3b8-1b00-0000-5355-2f561e0a0000 pid=2590->98c9877f-15cb-5222-85f7-40b8c7e5dc5d send: 139B guuid=a043d8c0-1b00-0000-5355-2f562f0a0000 pid=2607 /home/sandbox/x86_64 zombie guuid=fc236ac0-1b00-0000-5355-2f562d0a0000 pid=2605->guuid=a043d8c0-1b00-0000-5355-2f562f0a0000 pid=2607 clone guuid=829bf4c0-1b00-0000-5355-2f56310a0000 pid=2609 /home/sandbox/x86_64 write-config zombie guuid=a043d8c0-1b00-0000-5355-2f562f0a0000 pid=2607->guuid=829bf4c0-1b00-0000-5355-2f56310a0000 pid=2609 clone guuid=a588eac0-1b00-0000-5355-2f56300a0000 pid=2608->98c9877f-15cb-5222-85f7-40b8c7e5dc5d send: 140B guuid=3adf7fc1-1b00-0000-5355-2f56320a0000 pid=2610 /home/sandbox/x86_64 net send-data guuid=829bf4c0-1b00-0000-5355-2f56310a0000 pid=2609->guuid=3adf7fc1-1b00-0000-5355-2f56320a0000 pid=2610 clone e4104527-b966-527a-8954-2fccb0d3f916 167.86.99.169:8060 guuid=3adf7fc1-1b00-0000-5355-2f56320a0000 pid=2610->e4104527-b966-527a-8954-2fccb0d3f916 send: 35B guuid=d68dabc1-1b00-0000-5355-2f56330a0000 pid=2611 /home/sandbox/x86_64 guuid=3adf7fc1-1b00-0000-5355-2f56320a0000 pid=2610->guuid=d68dabc1-1b00-0000-5355-2f56330a0000 pid=2611 clone guuid=3d7eb0c1-1b00-0000-5355-2f56340a0000 pid=2612 /home/sandbox/x86_64 guuid=d68dabc1-1b00-0000-5355-2f56330a0000 pid=2611->guuid=3d7eb0c1-1b00-0000-5355-2f56340a0000 pid=2612 clone guuid=d2b886cd-1b00-0000-5355-2f564b0a0000 pid=2635->98c9877f-15cb-5222-85f7-40b8c7e5dc5d send: 137B guuid=277eaed7-1b00-0000-5355-2f565a0a0000 pid=2650->98c9877f-15cb-5222-85f7-40b8c7e5dc5d send: 137B guuid=b89757e3-1b00-0000-5355-2f566c0a0000 pid=2668->98c9877f-15cb-5222-85f7-40b8c7e5dc5d send: 139B guuid=aeef1ae9-1b00-0000-5355-2f567a0a0000 pid=2682->98c9877f-15cb-5222-85f7-40b8c7e5dc5d send: 140B guuid=530ecaf5-1b00-0000-5355-2f568f0a0000 pid=2703->98c9877f-15cb-5222-85f7-40b8c7e5dc5d con guuid=ad023dfa-1b00-0000-5355-2f56940a0000 pid=2708->98c9877f-15cb-5222-85f7-40b8c7e5dc5d send: 87B guuid=39101002-1c00-0000-5355-2f56a00a0000 pid=2720->98c9877f-15cb-5222-85f7-40b8c7e5dc5d send: 136B guuid=9a61fa0c-1c00-0000-5355-2f56ad0a0000 pid=2733->98c9877f-15cb-5222-85f7-40b8c7e5dc5d send: 85B guuid=49045219-1c00-0000-5355-2f56bb0a0000 pid=2747->98c9877f-15cb-5222-85f7-40b8c7e5dc5d send: 136B guuid=2e5f051f-1c00-0000-5355-2f56c70a0000 pid=2759->98c9877f-15cb-5222-85f7-40b8c7e5dc5d send: 137B guuid=e87d4d27-1c00-0000-5355-2f56d90a0000 pid=2777 /home/sandbox/i486 guuid=cdd19b24-1c00-0000-5355-2f56d50a0000 pid=2773->guuid=e87d4d27-1c00-0000-5355-2f56d90a0000 pid=2777 clone guuid=3d836427-1c00-0000-5355-2f56db0a0000 pid=2779 /home/sandbox/i486 write-config zombie guuid=e87d4d27-1c00-0000-5355-2f56d90a0000 pid=2777->guuid=3d836427-1c00-0000-5355-2f56db0a0000 pid=2779 clone guuid=59b35d27-1c00-0000-5355-2f56da0a0000 pid=2778->98c9877f-15cb-5222-85f7-40b8c7e5dc5d send: 139B guuid=91198b27-1c00-0000-5355-2f56dc0a0000 pid=2780 /home/sandbox/i486 net send-data guuid=3d836427-1c00-0000-5355-2f56db0a0000 pid=2779->guuid=91198b27-1c00-0000-5355-2f56dc0a0000 pid=2780 clone guuid=91198b27-1c00-0000-5355-2f56dc0a0000 pid=2780->e4104527-b966-527a-8954-2fccb0d3f916 send: 182B guuid=91198b27-1c00-0000-5355-2f56dc0a0000 pid=2781 /home/sandbox/i486 guuid=91198b27-1c00-0000-5355-2f56dc0a0000 pid=2780->guuid=91198b27-1c00-0000-5355-2f56dc0a0000 pid=2781 clone guuid=0a729532-1c00-0000-5355-2f56ea0a0000 pid=2794->98c9877f-15cb-5222-85f7-40b8c7e5dc5d send: 88B guuid=c6926639-1c00-0000-5355-2f56ff0a0000 pid=2815->98c9877f-15cb-5222-85f7-40b8c7e5dc5d send: 139B guuid=ef0a1f3f-1c00-0000-5355-2f560e0b0000 pid=2830->98c9877f-15cb-5222-85f7-40b8c7e5dc5d send: 139B guuid=6e48b245-1c00-0000-5355-2f561e0b0000 pid=2846->98c9877f-15cb-5222-85f7-40b8c7e5dc5d send: 139B
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/58af3efe757e3952eddc58f1ecde0ef00a00ba7ddc656826fc31872ea7cfa71e
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/58af3efe757e3952eddc58f1ecde0ef00a00ba7ddc656826fc31872ea7cfa71e/
Threat name:
Win32.Trojan.Malgent
Create hunting rule
Status:
Malicious
First seen:
2026-08-18 15:12:31 UTC
File Type:
Text (Shell)
AV detection:
11 of 23 (47.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lcxt57tvpy4vf3o4ldy6zxqo6afabot53rswqjx4ggds5j6pu4pa._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux persistence
Link:
https://tria.ge/reports/260818-sl7n2adj2z/
Behaviour
Reads runtime system information
System Network Configuration Discovery
Writes file to tmp directory
Changes its process name
Checks CPU configuration
Enumerates running processes
Modifies init.d
File and Directory Permissions Modification
Executes dropped EXE
Malware family:
BASHLITE
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/58af3efe757e/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MAL_Linux_IoT_MultiArch_BotnetLoader_Generic
Create hunting rule
Author:Anish Bogati
Description:Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:MalwareBazaar sample lilin.sh

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Mirai

sh 58af3efe757e3952eddc58f1ecde0ef00a00ba7ddc656826fc31872ea7cfa71e

(this sample)

Mirai

elf a7a3258c80a7705fc24c355cdb611e53af1bca8331d579972e06d415983d56af

  
URLhaus
https://urlhaus.abuse.ch/url/3905399/
  
Delivery method
Distributed via web download
  
Dropping
MD5 a5e4f393aec18b97a9cb7590f5400186
  
Dropping
SHA256 a7a3258c80a7705fc24c355cdb611e53af1bca8331d579972e06d415983d56af

Comments