MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dc7815509fa8976eaca782547f3f64471e875b37536a8aefc6b81222c4ac8646. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Mirai

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	dc7815509fa8976eaca782547f3f64471e875b37536a8aefc6b81222c4ac8646
SHA3-384 hash:	0b6e6b7ada23de625930cee3aa5a65a705d81657b85469563ba01635708af5d56560dce5eb02064b717648ee81213994
SHA1 hash:	9b5ce6ab843e43f693662b7c7778ddfdf7ac792f
MD5 hash:	e9cfb65b9c7ed1b514fd4802e0ab40e4
humanhash:	dakota-sad-oven-undress
File name:	telnet.sh
Download:	download sample
Signature	Mirai Create hunting rule
File size:	1'077 bytes
First seen:	2026-10-09 06:09:58 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	24:iPo+elnvDTOnOX+Kh/xxUhmI8OQLEmhBg75JePByPwW:iLcvOOX/rxOgBuDePcPb
TLSH	T10411808CE21BD5F55594E814B383529CC7C05B0949921BC8FE6FF17C742C48EB239266
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://103.238.235.250:9999/lol.sh	189d9cb2885638238f19f4dd911ac1ed72a16703cdf5a84985b0d3de4f0ba6f9	Mirai	cowrie honeypot

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

SecuriteInfo.com.Linux.DownLoader.2650.638.22678.UNOFFICIAL

Verdict:

Unknown

Threat level:

2.5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/6ac885508e4342ea6ad94cfb/reports/4deaa36b-1891-46c8-af32-cc4724786449/overview

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-10-08T18:28:00Z UTC

Last seen:

2026-10-10T23:23:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/dc7815509fa8976eaca782547f3f64471e875b37536a8aefc6b81222c4ac8646/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/aca3ac88-32f0-43fe-ae5b-173532b38547

Behavior Graph:

Download SVG

Score:

99%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/dc7815509fa8976eaca782547f3f64471e875b37536a8aefc6b81222c4ac8646

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/dc7815509fa8976eaca782547f3f64471e875b37536a8aefc6b81222c4ac8646/

Threat name:

Win32.Trojan.Qwexlafiba

Status:

Malicious

First seen:

2026-10-08 23:51:06 UTC

File Type:

Text (Shell)

AV detection:

8 of 24 (33.33%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=3r4bkue7vclw5lfhqjkh6p3ei4piowzxknviv36gxajcfrfmqzda._file

Result

Malware family:

n/a

Score:

1/10

Tags:

linux

Link:

https://tria.ge/reports/261009-gw77rsztc1/

Malware family:

Mirai

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/dc7815509fa8/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/dc7815509fa8976eaca782547f3f64471e875b37536a8aefc6b81222c4ac8646

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	LIN_Downloader_Unknown_WgetChmodExecute Create hunting rule
Author:	Marjoriefort
Description:	Script shell downloader : wget+curl, chmod 777, execution, effacement (rm -rf) - botnet style
Reference:	misses_archive / grappe 5.182.210.174