MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e5297a689104db2dada5d241f2aeed000fe3b2a4c08623ebf7ef72d237c4f870. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e5297a689104db2dada5d241f2aeed000fe3b2a4c08623ebf7ef72d237c4f870
SHA3-384 hash: 1b308f30b95500cb76c0898b0a9bd93e11e431d2bbc10f51c8eee54c653583afae846fae947edf0992eddcc4ae87b5d7
SHA1 hash: 0909303dbd19c30aa066bfc98204731df4e12a85
MD5 hash: 0e54628ea332bec9a12705b76a729a0c
humanhash: rugby-colorado-lactose-seventeen
File name:cat.sh
Download: download sample
File size:1'929 bytes
First seen:2026-03-23 09:52:17 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 48:pkeQWbg72F1+XzSJOLIugeR6y3o7ZpO7gqXm+c:2g1i9w
TLSH T10641139E60F45069E6CCCF05F4F54DC863079EA861DA4A3AEEC10E6B8D8AD54B019F36
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://192.109.200.199/iran.x86_64n/an/aelf ua-wget
http://192.109.200.199/iran.aarch64n/an/aelf ua-wget
http://192.109.200.199/iran.m68kn/an/aelf ua-wget
http://192.109.200.199/iran.mipsn/an/aelf ua-wget
http://192.109.200.199/iran.mipseln/an/aelf ua-wget
http://192.109.200.199/iran.powerpcn/an/aelf ua-wget
http://192.109.200.199/iran.sparcn/an/aelf ua-wget
http://192.109.200.199/iran.sh4n/an/aelf ua-wget
http://192.109.200.199/iran.arcn/an/aelf ua-wget
http://192.109.200.199/iran.i486n/an/aelf ua-wget
http://192.109.200.199/iran.armv4ln/an/aelf ua-wget
http://192.109.200.199/iran.armv5ln/an/aelf ua-wget
http://192.109.200.199/iran.armv6ln/an/aelf ua-wget
http://192.109.200.199/iran.armv7ln/an/aelf ua-wget

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
mirai
Link:
https://www.filescan.io/uploads/69c10d8a2000fc76c3f8adda/reports/d459e937-c0d2-451e-b3a4-84ae8af70f01/overview
Verdict:
Malicious
File Type:
unix shell
Detections:
HEUR:Trojan-Downloader.Shell.Agent.a
Link:
https://opentip.kaspersky.com/e5297a689104db2dada5d241f2aeed000fe3b2a4c08623ebf7ef72d237c4f870/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/24574042-fe6a-4bc9-b9fa-c1406f495b51
Behavior Graph:
Download SVG
%3 guuid=9a61b4f7-1600-0000-2ad0-7aec3b0f0000 pid=3899 /usr/bin/sudo guuid=d04653fa-1600-0000-2ad0-7aec450f0000 pid=3909 /tmp/sample.bin guuid=9a61b4f7-1600-0000-2ad0-7aec3b0f0000 pid=3899->guuid=d04653fa-1600-0000-2ad0-7aec450f0000 pid=3909 execve guuid=a45dc3fa-1600-0000-2ad0-7aec460f0000 pid=3910 /usr/bin/wget net send-data write-file guuid=d04653fa-1600-0000-2ad0-7aec450f0000 pid=3909->guuid=a45dc3fa-1600-0000-2ad0-7aec460f0000 pid=3910 execve guuid=9ed72e04-1700-0000-2ad0-7aec610f0000 pid=3937 /usr/bin/chmod guuid=d04653fa-1600-0000-2ad0-7aec450f0000 pid=3909->guuid=9ed72e04-1700-0000-2ad0-7aec610f0000 pid=3937 execve guuid=fb9f8004-1700-0000-2ad0-7aec630f0000 pid=3939 /home/sandbox/iran.x86_64 mprotect-exec guuid=d04653fa-1600-0000-2ad0-7aec450f0000 pid=3909->guuid=fb9f8004-1700-0000-2ad0-7aec630f0000 pid=3939 execve guuid=e422e905-1700-0000-2ad0-7aec690f0000 pid=3945 /usr/bin/wget net send-data write-file guuid=d04653fa-1600-0000-2ad0-7aec450f0000 pid=3909->guuid=e422e905-1700-0000-2ad0-7aec690f0000 pid=3945 execve guuid=4800810f-1700-0000-2ad0-7aec820f0000 pid=3970 /usr/bin/chmod guuid=d04653fa-1600-0000-2ad0-7aec450f0000 pid=3909->guuid=4800810f-1700-0000-2ad0-7aec820f0000 pid=3970 execve guuid=496dcf0f-1700-0000-2ad0-7aec830f0000 pid=3971 /usr/bin/dash guuid=d04653fa-1600-0000-2ad0-7aec450f0000 pid=3909->guuid=496dcf0f-1700-0000-2ad0-7aec830f0000 pid=3971 clone guuid=e0a08c10-1700-0000-2ad0-7aec890f0000 pid=3977 /usr/bin/wget net send-data write-file guuid=d04653fa-1600-0000-2ad0-7aec450f0000 pid=3909->guuid=e0a08c10-1700-0000-2ad0-7aec890f0000 pid=3977 execve guuid=2bc47918-1700-0000-2ad0-7aeca30f0000 pid=4003 /usr/bin/chmod guuid=d04653fa-1600-0000-2ad0-7aec450f0000 pid=3909->guuid=2bc47918-1700-0000-2ad0-7aeca30f0000 pid=4003 execve guuid=5c16ce18-1700-0000-2ad0-7aeca50f0000 pid=4005 /usr/bin/dash guuid=d04653fa-1600-0000-2ad0-7aec450f0000 pid=3909->guuid=5c16ce18-1700-0000-2ad0-7aeca50f0000 pid=4005 clone guuid=9b6b8719-1700-0000-2ad0-7aeca90f0000 pid=4009 /usr/bin/wget net send-data write-file guuid=d04653fa-1600-0000-2ad0-7aec450f0000 pid=3909->guuid=9b6b8719-1700-0000-2ad0-7aeca90f0000 pid=4009 execve guuid=f7ac7a21-1700-0000-2ad0-7aeccd0f0000 pid=4045 /usr/bin/chmod guuid=d04653fa-1600-0000-2ad0-7aec450f0000 pid=3909->guuid=f7ac7a21-1700-0000-2ad0-7aeccd0f0000 pid=4045 execve guuid=d778b421-1700-0000-2ad0-7aecce0f0000 pid=4046 /usr/bin/dash guuid=d04653fa-1600-0000-2ad0-7aec450f0000 pid=3909->guuid=d778b421-1700-0000-2ad0-7aecce0f0000 pid=4046 clone guuid=8e667022-1700-0000-2ad0-7aecd20f0000 pid=4050 /usr/bin/wget net send-data write-file guuid=d04653fa-1600-0000-2ad0-7aec450f0000 pid=3909->guuid=8e667022-1700-0000-2ad0-7aecd20f0000 pid=4050 execve guuid=9cfb372a-1700-0000-2ad0-7aeced0f0000 pid=4077 /usr/bin/chmod guuid=d04653fa-1600-0000-2ad0-7aec450f0000 pid=3909->guuid=9cfb372a-1700-0000-2ad0-7aeced0f0000 pid=4077 execve guuid=e2c2792a-1700-0000-2ad0-7aecef0f0000 pid=4079 /usr/bin/dash guuid=d04653fa-1600-0000-2ad0-7aec450f0000 pid=3909->guuid=e2c2792a-1700-0000-2ad0-7aecef0f0000 pid=4079 clone guuid=7fe9272b-1700-0000-2ad0-7aecf40f0000 pid=4084 /usr/bin/wget net send-data write-file guuid=d04653fa-1600-0000-2ad0-7aec450f0000 pid=3909->guuid=7fe9272b-1700-0000-2ad0-7aecf40f0000 pid=4084 execve guuid=580f4132-1700-0000-2ad0-7aec0c100000 pid=4108 /usr/bin/chmod guuid=d04653fa-1600-0000-2ad0-7aec450f0000 pid=3909->guuid=580f4132-1700-0000-2ad0-7aec0c100000 pid=4108 execve guuid=a1bfad32-1700-0000-2ad0-7aec0d100000 pid=4109 /usr/bin/dash guuid=d04653fa-1600-0000-2ad0-7aec450f0000 pid=3909->guuid=a1bfad32-1700-0000-2ad0-7aec0d100000 pid=4109 clone guuid=8d2d9033-1700-0000-2ad0-7aec0f100000 pid=4111 /usr/bin/wget net send-data write-file guuid=d04653fa-1600-0000-2ad0-7aec450f0000 pid=3909->guuid=8d2d9033-1700-0000-2ad0-7aec0f100000 pid=4111 execve guuid=a82e1138-1700-0000-2ad0-7aec12100000 pid=4114 /usr/bin/chmod guuid=d04653fa-1600-0000-2ad0-7aec450f0000 pid=3909->guuid=a82e1138-1700-0000-2ad0-7aec12100000 pid=4114 execve guuid=0ffb7b38-1700-0000-2ad0-7aec13100000 pid=4115 /usr/bin/dash guuid=d04653fa-1600-0000-2ad0-7aec450f0000 pid=3909->guuid=0ffb7b38-1700-0000-2ad0-7aec13100000 pid=4115 clone guuid=5d526739-1700-0000-2ad0-7aec19100000 pid=4121 /usr/bin/wget net send-data write-file guuid=d04653fa-1600-0000-2ad0-7aec450f0000 pid=3909->guuid=5d526739-1700-0000-2ad0-7aec19100000 pid=4121 execve guuid=e64c0e41-1700-0000-2ad0-7aec2c100000 pid=4140 /usr/bin/chmod guuid=d04653fa-1600-0000-2ad0-7aec450f0000 pid=3909->guuid=e64c0e41-1700-0000-2ad0-7aec2c100000 pid=4140 execve guuid=ea927041-1700-0000-2ad0-7aec30100000 pid=4144 /usr/bin/dash guuid=d04653fa-1600-0000-2ad0-7aec450f0000 pid=3909->guuid=ea927041-1700-0000-2ad0-7aec30100000 pid=4144 clone guuid=e7e83342-1700-0000-2ad0-7aec35100000 pid=4149 /usr/bin/wget net send-data write-file guuid=d04653fa-1600-0000-2ad0-7aec450f0000 pid=3909->guuid=e7e83342-1700-0000-2ad0-7aec35100000 pid=4149 execve guuid=40e3524a-1700-0000-2ad0-7aec50100000 pid=4176 /usr/bin/chmod guuid=d04653fa-1600-0000-2ad0-7aec450f0000 pid=3909->guuid=40e3524a-1700-0000-2ad0-7aec50100000 pid=4176 execve guuid=5ae6bd4a-1700-0000-2ad0-7aec51100000 pid=4177 /usr/bin/dash guuid=d04653fa-1600-0000-2ad0-7aec450f0000 pid=3909->guuid=5ae6bd4a-1700-0000-2ad0-7aec51100000 pid=4177 clone guuid=9e18614b-1700-0000-2ad0-7aec55100000 pid=4181 /usr/bin/wget net send-data write-file guuid=d04653fa-1600-0000-2ad0-7aec450f0000 pid=3909->guuid=9e18614b-1700-0000-2ad0-7aec55100000 pid=4181 execve guuid=903f8151-1700-0000-2ad0-7aec63100000 pid=4195 /usr/bin/chmod guuid=d04653fa-1600-0000-2ad0-7aec450f0000 pid=3909->guuid=903f8151-1700-0000-2ad0-7aec63100000 pid=4195 execve guuid=aedfc751-1700-0000-2ad0-7aec67100000 pid=4199 /home/sandbox/iran.i486 guuid=d04653fa-1600-0000-2ad0-7aec450f0000 pid=3909->guuid=aedfc751-1700-0000-2ad0-7aec67100000 pid=4199 execve guuid=754b1852-1700-0000-2ad0-7aec69100000 pid=4201 /usr/bin/wget net send-data write-file guuid=d04653fa-1600-0000-2ad0-7aec450f0000 pid=3909->guuid=754b1852-1700-0000-2ad0-7aec69100000 pid=4201 execve guuid=1fbf3f59-1700-0000-2ad0-7aec83100000 pid=4227 /usr/bin/chmod guuid=d04653fa-1600-0000-2ad0-7aec450f0000 pid=3909->guuid=1fbf3f59-1700-0000-2ad0-7aec83100000 pid=4227 execve guuid=27fa9159-1700-0000-2ad0-7aec85100000 pid=4229 /usr/bin/dash guuid=d04653fa-1600-0000-2ad0-7aec450f0000 pid=3909->guuid=27fa9159-1700-0000-2ad0-7aec85100000 pid=4229 clone guuid=bc7a6a5a-1700-0000-2ad0-7aec89100000 pid=4233 /usr/bin/wget net send-data write-file guuid=d04653fa-1600-0000-2ad0-7aec450f0000 pid=3909->guuid=bc7a6a5a-1700-0000-2ad0-7aec89100000 pid=4233 execve guuid=cd232e62-1700-0000-2ad0-7aeca1100000 pid=4257 /usr/bin/chmod guuid=d04653fa-1600-0000-2ad0-7aec450f0000 pid=3909->guuid=cd232e62-1700-0000-2ad0-7aeca1100000 pid=4257 execve guuid=5ae57e62-1700-0000-2ad0-7aeca3100000 pid=4259 /usr/bin/dash guuid=d04653fa-1600-0000-2ad0-7aec450f0000 pid=3909->guuid=5ae57e62-1700-0000-2ad0-7aeca3100000 pid=4259 clone guuid=0cd63163-1700-0000-2ad0-7aecaa100000 pid=4266 /usr/bin/wget net send-data write-file guuid=d04653fa-1600-0000-2ad0-7aec450f0000 pid=3909->guuid=0cd63163-1700-0000-2ad0-7aecaa100000 pid=4266 execve guuid=0b39d86a-1700-0000-2ad0-7aecc3100000 pid=4291 /usr/bin/chmod guuid=d04653fa-1600-0000-2ad0-7aec450f0000 pid=3909->guuid=0b39d86a-1700-0000-2ad0-7aecc3100000 pid=4291 execve guuid=c34d2e6b-1700-0000-2ad0-7aecc4100000 pid=4292 /usr/bin/dash guuid=d04653fa-1600-0000-2ad0-7aec450f0000 pid=3909->guuid=c34d2e6b-1700-0000-2ad0-7aecc4100000 pid=4292 clone guuid=3a7b306c-1700-0000-2ad0-7aeccb100000 pid=4299 /usr/bin/wget net send-data write-file guuid=d04653fa-1600-0000-2ad0-7aec450f0000 pid=3909->guuid=3a7b306c-1700-0000-2ad0-7aeccb100000 pid=4299 execve guuid=c8c9ef73-1700-0000-2ad0-7aece5100000 pid=4325 /usr/bin/chmod guuid=d04653fa-1600-0000-2ad0-7aec450f0000 pid=3909->guuid=c8c9ef73-1700-0000-2ad0-7aece5100000 pid=4325 execve guuid=11ff4a74-1700-0000-2ad0-7aece7100000 pid=4327 /usr/bin/dash guuid=d04653fa-1600-0000-2ad0-7aec450f0000 pid=3909->guuid=11ff4a74-1700-0000-2ad0-7aece7100000 pid=4327 clone 541bcee1-0f03-5bad-8d46-6911d9d8c0ba 192.109.200.199:80 guuid=a45dc3fa-1600-0000-2ad0-7aec460f0000 pid=3910->541bcee1-0f03-5bad-8d46-6911d9d8c0ba send: 141B guuid=5f90da05-1700-0000-2ad0-7aec680f0000 pid=3944 /home/sandbox/iran.x86_64 zombie guuid=fb9f8004-1700-0000-2ad0-7aec630f0000 pid=3939->guuid=5f90da05-1700-0000-2ad0-7aec680f0000 pid=3944 clone guuid=44aaf905-1700-0000-2ad0-7aec6a0f0000 pid=3946 /home/sandbox/iran.x86_64 delete-file net send-data zombie guuid=5f90da05-1700-0000-2ad0-7aec680f0000 pid=3944->guuid=44aaf905-1700-0000-2ad0-7aec6a0f0000 pid=3946 clone guuid=e422e905-1700-0000-2ad0-7aec690f0000 pid=3945->541bcee1-0f03-5bad-8d46-6911d9d8c0ba send: 142B 12a5af73-f93d-5670-adaa-80db4e9da54a 192.109.200.199:23 guuid=44aaf905-1700-0000-2ad0-7aec6a0f0000 pid=3946->12a5af73-f93d-5670-adaa-80db4e9da54a send: 242B guuid=b6cefbe7-2200-0000-2ad0-7aecc7140000 pid=5319 /home/sandbox/iran.x86_64 guuid=44aaf905-1700-0000-2ad0-7aec6a0f0000 pid=3946->guuid=b6cefbe7-2200-0000-2ad0-7aecc7140000 pid=5319 clone guuid=e0a08c10-1700-0000-2ad0-7aec890f0000 pid=3977->541bcee1-0f03-5bad-8d46-6911d9d8c0ba send: 139B guuid=9b6b8719-1700-0000-2ad0-7aeca90f0000 pid=4009->541bcee1-0f03-5bad-8d46-6911d9d8c0ba send: 139B guuid=8e667022-1700-0000-2ad0-7aecd20f0000 pid=4050->541bcee1-0f03-5bad-8d46-6911d9d8c0ba send: 141B guuid=7fe9272b-1700-0000-2ad0-7aecf40f0000 pid=4084->541bcee1-0f03-5bad-8d46-6911d9d8c0ba send: 142B guuid=8d2d9033-1700-0000-2ad0-7aec0f100000 pid=4111->541bcee1-0f03-5bad-8d46-6911d9d8c0ba send: 140B guuid=5d526739-1700-0000-2ad0-7aec19100000 pid=4121->541bcee1-0f03-5bad-8d46-6911d9d8c0ba send: 138B guuid=e7e83342-1700-0000-2ad0-7aec35100000 pid=4149->541bcee1-0f03-5bad-8d46-6911d9d8c0ba send: 138B guuid=9e18614b-1700-0000-2ad0-7aec55100000 pid=4181->541bcee1-0f03-5bad-8d46-6911d9d8c0ba send: 139B guuid=03311352-1700-0000-2ad0-7aec68100000 pid=4200 /home/sandbox/iran.i486 guuid=aedfc751-1700-0000-2ad0-7aec67100000 pid=4199->guuid=03311352-1700-0000-2ad0-7aec68100000 pid=4200 clone guuid=fd251e52-1700-0000-2ad0-7aec6a100000 pid=4202 /home/sandbox/iran.i486 delete-file net send-data zombie guuid=03311352-1700-0000-2ad0-7aec68100000 pid=4200->guuid=fd251e52-1700-0000-2ad0-7aec6a100000 pid=4202 clone guuid=754b1852-1700-0000-2ad0-7aec69100000 pid=4201->541bcee1-0f03-5bad-8d46-6911d9d8c0ba send: 141B guuid=fd251e52-1700-0000-2ad0-7aec6a100000 pid=4202->12a5af73-f93d-5670-adaa-80db4e9da54a send: 19B guuid=bc7a6a5a-1700-0000-2ad0-7aec89100000 pid=4233->541bcee1-0f03-5bad-8d46-6911d9d8c0ba send: 141B guuid=0cd63163-1700-0000-2ad0-7aecaa100000 pid=4266->541bcee1-0f03-5bad-8d46-6911d9d8c0ba send: 141B guuid=3a7b306c-1700-0000-2ad0-7aeccb100000 pid=4299->541bcee1-0f03-5bad-8d46-6911d9d8c0ba send: 141B guuid=1a0907e8-2200-0000-2ad0-7aecc8140000 pid=5320 /home/sandbox/iran.x86_64 send-data guuid=b6cefbe7-2200-0000-2ad0-7aecc7140000 pid=5319->guuid=1a0907e8-2200-0000-2ad0-7aecc8140000 pid=5320 clone a48e8239-4a46-5d60-949c-0b21e7db65d9 50.7.23.74:80 guuid=1a0907e8-2200-0000-2ad0-7aecc8140000 pid=5320->a48e8239-4a46-5d60-949c-0b21e7db65d9 send: 2097664B
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/e5297a689104db2dada5d241f2aeed000fe3b2a4c08623ebf7ef72d237c4f870
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e5297a689104db2dada5d241f2aeed000fe3b2a4c08623ebf7ef72d237c4f870/
Verdict:
Malicious
Threat:
Trojan-Downloader.Shell.Agent
Link:
https://tip.neiki.dev/file/e5297a689104db2dada5d241f2aeed000fe3b2a4c08623ebf7ef72d237c4f870
Threat name:
Script.Downloader.Iranbot
Create hunting rule
Status:
Malicious
First seen:
2026-03-20 14:06:00 UTC
File Type:
Text (Shell)
AV detection:
14 of 36 (38.89%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4uuxu2eratns3lnf2ja7flxnaah6hmveycdch27x55znen6e7bya._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
defense_evasion discovery linux upx
Link:
https://tria.ge/reports/260323-lwq1psav4l/
Behaviour
Reads runtime system information
System Network Configuration Discovery
Writes file to tmp directory
Changes its process name
UPX packed file
Enumerates running processes
File and Directory Permissions Modification
Deletes itself
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.37
Link:
https://yomi.yoroi.company/submissions/e5297a689104db2dada5d241f2aeed000fe3b2a4c08623ebf7ef72d237c4f870

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MAL_Linux_IoT_MultiArch_BotnetLoader_Generic
Create hunting rule
Author:Anish Bogati
Description:Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:MalwareBazaar sample lilin.sh

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh e5297a689104db2dada5d241f2aeed000fe3b2a4c08623ebf7ef72d237c4f870

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3802585/
  
Delivery method
Distributed via web download

Comments