MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7824e906e6bc2fe40b62b7fed3990103dd894ac0e27367ac4509eb9e2209dbcf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7824e906e6bc2fe40b62b7fed3990103dd894ac0e27367ac4509eb9e2209dbcf
SHA3-384 hash: b7e9c2b61cf1d3758cf2291997798cabc8cc4d52a790a229a6aa5eda515b41f3e3a3a7e632c1c948d4533d408f5d82cb
SHA1 hash: e1d58b9264a9130151600cedecacea29fb995c31
MD5 hash: 80cb96d9ab4cf0d5fe5195e7d942a897
humanhash: carpet-item-mars-apart
File name:cat.sh
Download: download sample
File size:1'903 bytes
First seen:2026-08-15 15:47:52 UTC
Last seen:2026-08-15 20:07:39 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 24:ylfYdc9csFOEm2DNCVuy3svKpvkzdOd6d2dd2MtmmYbKLE2C1KW9asWDD:C4qL5CstgD
TLSH T13341BFCE10F055918384CEA1B2F24ED45666E5A93296CAB3DFC19FADA88DDC03135E3D
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://77.239.124.108/iran.x86_64n/an/aelf ua-wget
http://77.239.124.108/iran.aarch64n/an/aelf ua-wget
http://77.239.124.108/iran.m68kn/an/aelf ua-wget
http://77.239.124.108/iran.mipsn/an/aelf ua-wget
http://77.239.124.108/iran.mipseln/an/aelf ua-wget
http://77.239.124.108/iran.powerpcn/an/aelf ua-wget
http://77.239.124.108/iran.sparcn/an/aelf ua-wget
http://77.239.124.108/iran.sh4n/an/aelf ua-wget
http://77.239.124.108/iran.arcn/an/aelf ua-wget
http://77.239.124.108/iran.i486n/an/aelf ua-wget
http://77.239.124.108/iran.armv4ln/an/aelf ua-wget
http://77.239.124.108/iran.armv5ln/an/aelf ua-wget
http://77.239.124.108/iran.armv6ln/an/aelf ua-wget
http://77.239.124.108/iran.armv7ln/an/aelf ua-wget

Intelligence

File Origin
# of uploads :
2
# of downloads :
68
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
downloader mirai
Link:
https://www.filescan.io/uploads/6a808a5289427f5756d6c2f2/reports/a09f2cf5-3d92-467d-a664-169a94bb6302/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-08-15T02:03:00Z UTC
Last seen:
2026-08-16T17:52:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/7824e906e6bc2fe40b62b7fed3990103dd894ac0e27367ac4509eb9e2209dbcf/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/ccb30640-8406-4f42-aa94-2896b117bcbc
Behavior Graph:
Download SVG
%3 guuid=a24c9bc7-1600-0000-b64c-937d330c0000 pid=3123 /usr/bin/sudo guuid=b9d3fbc9-1600-0000-b64c-937d390c0000 pid=3129 /tmp/sample.bin guuid=a24c9bc7-1600-0000-b64c-937d330c0000 pid=3123->guuid=b9d3fbc9-1600-0000-b64c-937d390c0000 pid=3129 execve guuid=191d50ca-1600-0000-b64c-937d3a0c0000 pid=3130 /usr/bin/wget net send-data write-file guuid=b9d3fbc9-1600-0000-b64c-937d390c0000 pid=3129->guuid=191d50ca-1600-0000-b64c-937d3a0c0000 pid=3130 execve guuid=9f270dd5-1600-0000-b64c-937d420c0000 pid=3138 /usr/bin/chmod guuid=b9d3fbc9-1600-0000-b64c-937d390c0000 pid=3129->guuid=9f270dd5-1600-0000-b64c-937d420c0000 pid=3138 execve guuid=9e76d8d5-1600-0000-b64c-937d430c0000 pid=3139 /home/sandbox/x86_64 guuid=b9d3fbc9-1600-0000-b64c-937d390c0000 pid=3129->guuid=9e76d8d5-1600-0000-b64c-937d430c0000 pid=3139 execve guuid=cdadf9d6-1600-0000-b64c-937d450c0000 pid=3141 /usr/bin/wget net send-data write-file guuid=b9d3fbc9-1600-0000-b64c-937d390c0000 pid=3129->guuid=cdadf9d6-1600-0000-b64c-937d450c0000 pid=3141 execve guuid=a70f64de-1600-0000-b64c-937d5d0c0000 pid=3165 /usr/bin/chmod guuid=b9d3fbc9-1600-0000-b64c-937d390c0000 pid=3129->guuid=a70f64de-1600-0000-b64c-937d5d0c0000 pid=3165 execve guuid=6dff94de-1600-0000-b64c-937d5f0c0000 pid=3167 /usr/bin/dash guuid=b9d3fbc9-1600-0000-b64c-937d390c0000 pid=3129->guuid=6dff94de-1600-0000-b64c-937d5f0c0000 pid=3167 clone guuid=da1fafde-1600-0000-b64c-937d610c0000 pid=3169 /usr/bin/wget net send-data write-file guuid=b9d3fbc9-1600-0000-b64c-937d390c0000 pid=3129->guuid=da1fafde-1600-0000-b64c-937d610c0000 pid=3169 execve guuid=a6f2ade4-1600-0000-b64c-937d750c0000 pid=3189 /usr/bin/chmod guuid=b9d3fbc9-1600-0000-b64c-937d390c0000 pid=3129->guuid=a6f2ade4-1600-0000-b64c-937d750c0000 pid=3189 execve guuid=840af4e4-1600-0000-b64c-937d770c0000 pid=3191 /usr/bin/dash guuid=b9d3fbc9-1600-0000-b64c-937d390c0000 pid=3129->guuid=840af4e4-1600-0000-b64c-937d770c0000 pid=3191 clone guuid=e31f70e6-1600-0000-b64c-937d7c0c0000 pid=3196 /usr/bin/wget net send-data write-file guuid=b9d3fbc9-1600-0000-b64c-937d390c0000 pid=3129->guuid=e31f70e6-1600-0000-b64c-937d7c0c0000 pid=3196 execve guuid=ded616ec-1600-0000-b64c-937d8b0c0000 pid=3211 /usr/bin/chmod guuid=b9d3fbc9-1600-0000-b64c-937d390c0000 pid=3129->guuid=ded616ec-1600-0000-b64c-937d8b0c0000 pid=3211 execve guuid=5ed36aec-1600-0000-b64c-937d8d0c0000 pid=3213 /usr/bin/dash guuid=b9d3fbc9-1600-0000-b64c-937d390c0000 pid=3129->guuid=5ed36aec-1600-0000-b64c-937d8d0c0000 pid=3213 clone guuid=646a3ced-1600-0000-b64c-937d910c0000 pid=3217 /usr/bin/wget net send-data write-file guuid=b9d3fbc9-1600-0000-b64c-937d390c0000 pid=3129->guuid=646a3ced-1600-0000-b64c-937d910c0000 pid=3217 execve guuid=d44d85f1-1600-0000-b64c-937d990c0000 pid=3225 /usr/bin/curl net send-data write-file guuid=b9d3fbc9-1600-0000-b64c-937d390c0000 pid=3129->guuid=d44d85f1-1600-0000-b64c-937d990c0000 pid=3225 execve guuid=7686b905-1700-0000-b64c-937db40c0000 pid=3252 /usr/bin/chmod guuid=b9d3fbc9-1600-0000-b64c-937d390c0000 pid=3129->guuid=7686b905-1700-0000-b64c-937db40c0000 pid=3252 execve guuid=2410ba06-1700-0000-b64c-937db50c0000 pid=3253 /usr/bin/dash guuid=b9d3fbc9-1600-0000-b64c-937d390c0000 pid=3129->guuid=2410ba06-1700-0000-b64c-937db50c0000 pid=3253 clone guuid=e1e8c908-1700-0000-b64c-937dbc0c0000 pid=3260 /usr/bin/wget net send-data write-file guuid=b9d3fbc9-1600-0000-b64c-937d390c0000 pid=3129->guuid=e1e8c908-1700-0000-b64c-937dbc0c0000 pid=3260 execve guuid=ad1f090f-1700-0000-b64c-937dcc0c0000 pid=3276 /usr/bin/chmod guuid=b9d3fbc9-1600-0000-b64c-937d390c0000 pid=3129->guuid=ad1f090f-1700-0000-b64c-937dcc0c0000 pid=3276 execve guuid=e96eef0f-1700-0000-b64c-937dce0c0000 pid=3278 /usr/bin/dash guuid=b9d3fbc9-1600-0000-b64c-937d390c0000 pid=3129->guuid=e96eef0f-1700-0000-b64c-937dce0c0000 pid=3278 clone guuid=70efa710-1700-0000-b64c-937dd20c0000 pid=3282 /usr/bin/wget net send-data write-file guuid=b9d3fbc9-1600-0000-b64c-937d390c0000 pid=3129->guuid=70efa710-1700-0000-b64c-937dd20c0000 pid=3282 execve guuid=343a4915-1700-0000-b64c-937dde0c0000 pid=3294 /usr/bin/chmod guuid=b9d3fbc9-1600-0000-b64c-937d390c0000 pid=3129->guuid=343a4915-1700-0000-b64c-937dde0c0000 pid=3294 execve guuid=98349815-1700-0000-b64c-937de00c0000 pid=3296 /usr/bin/dash guuid=b9d3fbc9-1600-0000-b64c-937d390c0000 pid=3129->guuid=98349815-1700-0000-b64c-937de00c0000 pid=3296 clone guuid=53d95916-1700-0000-b64c-937de50c0000 pid=3301 /usr/bin/wget net send-data write-file guuid=b9d3fbc9-1600-0000-b64c-937d390c0000 pid=3129->guuid=53d95916-1700-0000-b64c-937de50c0000 pid=3301 execve guuid=345ca91b-1700-0000-b64c-937df20c0000 pid=3314 /usr/bin/chmod guuid=b9d3fbc9-1600-0000-b64c-937d390c0000 pid=3129->guuid=345ca91b-1700-0000-b64c-937df20c0000 pid=3314 execve guuid=3033e71b-1700-0000-b64c-937df40c0000 pid=3316 /usr/bin/dash guuid=b9d3fbc9-1600-0000-b64c-937d390c0000 pid=3129->guuid=3033e71b-1700-0000-b64c-937df40c0000 pid=3316 clone guuid=d953761c-1700-0000-b64c-937df80c0000 pid=3320 /usr/bin/wget net send-data write-file guuid=b9d3fbc9-1600-0000-b64c-937d390c0000 pid=3129->guuid=d953761c-1700-0000-b64c-937df80c0000 pid=3320 execve guuid=3e0cbb21-1700-0000-b64c-937d100d0000 pid=3344 /usr/bin/chmod guuid=b9d3fbc9-1600-0000-b64c-937d390c0000 pid=3129->guuid=3e0cbb21-1700-0000-b64c-937d100d0000 pid=3344 execve guuid=5a03f721-1700-0000-b64c-937d120d0000 pid=3346 /usr/bin/dash guuid=b9d3fbc9-1600-0000-b64c-937d390c0000 pid=3129->guuid=5a03f721-1700-0000-b64c-937d120d0000 pid=3346 clone guuid=d8b79d22-1700-0000-b64c-937d170d0000 pid=3351 /usr/bin/wget net send-data write-file guuid=b9d3fbc9-1600-0000-b64c-937d390c0000 pid=3129->guuid=d8b79d22-1700-0000-b64c-937d170d0000 pid=3351 execve guuid=d9409d27-1700-0000-b64c-937d270d0000 pid=3367 /usr/bin/chmod guuid=b9d3fbc9-1600-0000-b64c-937d390c0000 pid=3129->guuid=d9409d27-1700-0000-b64c-937d270d0000 pid=3367 execve guuid=c2bfcb27-1700-0000-b64c-937d280d0000 pid=3368 /home/sandbox/i486 guuid=b9d3fbc9-1600-0000-b64c-937d390c0000 pid=3129->guuid=c2bfcb27-1700-0000-b64c-937d280d0000 pid=3368 execve guuid=e0b64629-1700-0000-b64c-937d310d0000 pid=3377 /usr/bin/wget net send-data write-file guuid=b9d3fbc9-1600-0000-b64c-937d390c0000 pid=3129->guuid=e0b64629-1700-0000-b64c-937d310d0000 pid=3377 execve guuid=338c162f-1700-0000-b64c-937d4d0d0000 pid=3405 /usr/bin/chmod guuid=b9d3fbc9-1600-0000-b64c-937d390c0000 pid=3129->guuid=338c162f-1700-0000-b64c-937d4d0d0000 pid=3405 execve guuid=d449bb2f-1700-0000-b64c-937d500d0000 pid=3408 /usr/bin/dash guuid=b9d3fbc9-1600-0000-b64c-937d390c0000 pid=3129->guuid=d449bb2f-1700-0000-b64c-937d500d0000 pid=3408 clone guuid=8964b530-1700-0000-b64c-937d560d0000 pid=3414 /usr/bin/wget net send-data write-file guuid=b9d3fbc9-1600-0000-b64c-937d390c0000 pid=3129->guuid=8964b530-1700-0000-b64c-937d560d0000 pid=3414 execve guuid=cf4e1e36-1700-0000-b64c-937d690d0000 pid=3433 /usr/bin/chmod guuid=b9d3fbc9-1600-0000-b64c-937d390c0000 pid=3129->guuid=cf4e1e36-1700-0000-b64c-937d690d0000 pid=3433 execve guuid=b9805f36-1700-0000-b64c-937d6a0d0000 pid=3434 /usr/bin/dash guuid=b9d3fbc9-1600-0000-b64c-937d390c0000 pid=3129->guuid=b9805f36-1700-0000-b64c-937d6a0d0000 pid=3434 clone guuid=f783f936-1700-0000-b64c-937d6c0d0000 pid=3436 /usr/bin/wget net send-data write-file guuid=b9d3fbc9-1600-0000-b64c-937d390c0000 pid=3129->guuid=f783f936-1700-0000-b64c-937d6c0d0000 pid=3436 execve guuid=1f81253e-1700-0000-b64c-937d7a0d0000 pid=3450 /usr/bin/chmod guuid=b9d3fbc9-1600-0000-b64c-937d390c0000 pid=3129->guuid=1f81253e-1700-0000-b64c-937d7a0d0000 pid=3450 execve guuid=fdbc673e-1700-0000-b64c-937d7b0d0000 pid=3451 /usr/bin/dash guuid=b9d3fbc9-1600-0000-b64c-937d390c0000 pid=3129->guuid=fdbc673e-1700-0000-b64c-937d7b0d0000 pid=3451 clone guuid=5c832e40-1700-0000-b64c-937d7e0d0000 pid=3454 /usr/bin/wget net send-data write-file guuid=b9d3fbc9-1600-0000-b64c-937d390c0000 pid=3129->guuid=5c832e40-1700-0000-b64c-937d7e0d0000 pid=3454 execve guuid=7efabf45-1700-0000-b64c-937d900d0000 pid=3472 /usr/bin/chmod guuid=b9d3fbc9-1600-0000-b64c-937d390c0000 pid=3129->guuid=7efabf45-1700-0000-b64c-937d900d0000 pid=3472 execve guuid=48fadd46-1700-0000-b64c-937d950d0000 pid=3477 /usr/bin/dash guuid=b9d3fbc9-1600-0000-b64c-937d390c0000 pid=3129->guuid=48fadd46-1700-0000-b64c-937d950d0000 pid=3477 clone 6f6c834a-add9-5b4e-a656-4fd6f9524b47 77.239.124.108:80 guuid=191d50ca-1600-0000-b64c-937d3a0c0000 pid=3130->6f6c834a-add9-5b4e-a656-4fd6f9524b47 send: 140B guuid=f870dcd6-1600-0000-b64c-937d440c0000 pid=3140 /home/sandbox/x86_64 zombie guuid=9e76d8d5-1600-0000-b64c-937d430c0000 pid=3139->guuid=f870dcd6-1600-0000-b64c-937d440c0000 pid=3140 clone guuid=d65009d7-1600-0000-b64c-937d460c0000 pid=3142 /home/sandbox/x86_64 write-config zombie guuid=f870dcd6-1600-0000-b64c-937d440c0000 pid=3140->guuid=d65009d7-1600-0000-b64c-937d460c0000 pid=3142 clone guuid=cdadf9d6-1600-0000-b64c-937d450c0000 pid=3141->6f6c834a-add9-5b4e-a656-4fd6f9524b47 send: 141B guuid=4c1cddd7-1600-0000-b64c-937d480c0000 pid=3144 /home/sandbox/x86_64 net guuid=d65009d7-1600-0000-b64c-937d460c0000 pid=3142->guuid=4c1cddd7-1600-0000-b64c-937d480c0000 pid=3144 clone 117b72ac-02e8-5763-bb79-e509ea62bbc7 77.239.124.108:2000 guuid=4c1cddd7-1600-0000-b64c-937d480c0000 pid=3144->117b72ac-02e8-5763-bb79-e509ea62bbc7 con guuid=e318c7d8-1600-0000-b64c-937d490c0000 pid=3145 /home/sandbox/x86_64 guuid=4c1cddd7-1600-0000-b64c-937d480c0000 pid=3144->guuid=e318c7d8-1600-0000-b64c-937d490c0000 pid=3145 clone guuid=6230f0d8-1600-0000-b64c-937d4a0c0000 pid=3146 /home/sandbox/x86_64 guuid=e318c7d8-1600-0000-b64c-937d490c0000 pid=3145->guuid=6230f0d8-1600-0000-b64c-937d4a0c0000 pid=3146 clone guuid=da1fafde-1600-0000-b64c-937d610c0000 pid=3169->6f6c834a-add9-5b4e-a656-4fd6f9524b47 send: 138B guuid=e31f70e6-1600-0000-b64c-937d7c0c0000 pid=3196->6f6c834a-add9-5b4e-a656-4fd6f9524b47 send: 138B guuid=646a3ced-1600-0000-b64c-937d910c0000 pid=3217->6f6c834a-add9-5b4e-a656-4fd6f9524b47 send: 140B guuid=d44d85f1-1600-0000-b64c-937d990c0000 pid=3225->6f6c834a-add9-5b4e-a656-4fd6f9524b47 send: 89B guuid=e1e8c908-1700-0000-b64c-937dbc0c0000 pid=3260->6f6c834a-add9-5b4e-a656-4fd6f9524b47 send: 141B guuid=70efa710-1700-0000-b64c-937dd20c0000 pid=3282->6f6c834a-add9-5b4e-a656-4fd6f9524b47 send: 139B guuid=53d95916-1700-0000-b64c-937de50c0000 pid=3301->6f6c834a-add9-5b4e-a656-4fd6f9524b47 send: 137B guuid=d953761c-1700-0000-b64c-937df80c0000 pid=3320->6f6c834a-add9-5b4e-a656-4fd6f9524b47 send: 137B guuid=d8b79d22-1700-0000-b64c-937d170d0000 pid=3351->6f6c834a-add9-5b4e-a656-4fd6f9524b47 send: 138B guuid=4b1f3b29-1700-0000-b64c-937d300d0000 pid=3376 /home/sandbox/i486 guuid=c2bfcb27-1700-0000-b64c-937d280d0000 pid=3368->guuid=4b1f3b29-1700-0000-b64c-937d300d0000 pid=3376 clone guuid=1daa4b29-1700-0000-b64c-937d320d0000 pid=3378 /home/sandbox/i486 write-config zombie guuid=4b1f3b29-1700-0000-b64c-937d300d0000 pid=3376->guuid=1daa4b29-1700-0000-b64c-937d320d0000 pid=3378 clone guuid=e0b64629-1700-0000-b64c-937d310d0000 pid=3377->6f6c834a-add9-5b4e-a656-4fd6f9524b47 send: 140B guuid=1d4b5c29-1700-0000-b64c-937d330d0000 pid=3379 /home/sandbox/i486 net guuid=1daa4b29-1700-0000-b64c-937d320d0000 pid=3378->guuid=1d4b5c29-1700-0000-b64c-937d330d0000 pid=3379 clone guuid=1d4b5c29-1700-0000-b64c-937d330d0000 pid=3379->117b72ac-02e8-5763-bb79-e509ea62bbc7 con guuid=1d4b5c29-1700-0000-b64c-937d330d0000 pid=3380 /home/sandbox/i486 guuid=1d4b5c29-1700-0000-b64c-937d330d0000 pid=3379->guuid=1d4b5c29-1700-0000-b64c-937d330d0000 pid=3380 clone guuid=8964b530-1700-0000-b64c-937d560d0000 pid=3414->6f6c834a-add9-5b4e-a656-4fd6f9524b47 send: 140B guuid=f783f936-1700-0000-b64c-937d6c0d0000 pid=3436->6f6c834a-add9-5b4e-a656-4fd6f9524b47 send: 140B guuid=5c832e40-1700-0000-b64c-937d7e0d0000 pid=3454->6f6c834a-add9-5b4e-a656-4fd6f9524b47 send: 140B
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/7824e906e6bc2fe40b62b7fed3990103dd894ac0e27367ac4509eb9e2209dbcf
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7824e906e6bc2fe40b62b7fed3990103dd894ac0e27367ac4509eb9e2209dbcf/
Threat name:
Script-Shell.Downloader.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2026-08-15 05:17:57 UTC
File Type:
Text (Shell)
AV detection:
12 of 24 (50.00%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pasosbxgxqx6ic3cw77nhgibapoysswa4jzwplcfbhvz4iqj3phq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux persistence
Link:
https://tria.ge/reports/260815-s83ctsdp5y/
Behaviour
Reads runtime system information
System Network Configuration Discovery
Writes file to tmp directory
Changes its process name
Checks CPU configuration
Enumerates running processes
Modifies init.d
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.37
Link:
https://yomi.yoroi.company/submissions/7824e906e6bc2fe40b62b7fed3990103dd894ac0e27367ac4509eb9e2209dbcf

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MAL_Linux_IoT_MultiArch_BotnetLoader_Generic
Create hunting rule
Author:Anish Bogati
Description:Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:MalwareBazaar sample lilin.sh

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 7824e906e6bc2fe40b62b7fed3990103dd894ac0e27367ac4509eb9e2209dbcf

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3904054/
  
Delivery method
Distributed via web download

Comments