MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e5b028c788ffdb8e4531e623f9a7aad5e5b1c540bc59bbc845bfad2170578c9c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

FlyLegitBot

Vendor detections: 5

Intelligence 5 IOCs YARA 1 File information Comments

SHA256 hash:	e5b028c788ffdb8e4531e623f9a7aad5e5b1c540bc59bbc845bfad2170578c9c
SHA3-384 hash:	0b574c9291379e60be412baccb3c438b453554441e68bb86d6125ee7f415a4288d59ebcce03f1c8f89ee1b57e9042a58
SHA1 hash:	c25dcd8b842de374403342a110ca0117daa0b7ac
MD5 hash:	d109196d93b8f7423c7482f156d34269
humanhash:	neptune-mockingbird-five-failed
File name:	payload.sh
Download:	download sample
Signature	FlyLegitBot Create hunting rule
File size:	1'771 bytes
First seen:	2026-09-16 11:07:17 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:Zzet2itRx1atqnutY6xtf+tPetIKt1Do7TtYahtvKtC2tRf:4DB1a6uVckdfCRQff
TLSH	T1CC31F6CB60F46243C7DCDE00B0E589CA6705A691B1DE6A3AED812D77CCC9D547429F36
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	BlinkzSec

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://176.65.139.152/iran.x86_64	f399c13f5dcb562ade12d2cb24d67a88e5895b70569fd4973bff0fe263566f48	FlyLegitBot	176-65-139-152 elf ua-wget
http://176.65.139.152/iran.m68k	371764e598b0ad9edb0c0d126f107352aa82a2123fdee397b5f727581d1030aa	Mirai	176-65-139-152 elf ua-wget
http://176.65.139.152/iran.mips	48c3b9ced04800a4d78ea8f888db0b9c9b7c0c6ffb182ab0cda04dc2c003e163	Mirai	176-65-139-152 elf mirai ua-wget
http://176.65.139.152/iran.mipsel	n/a	n/a	176-65-139-152 elf ua-wget
http://176.65.139.152/iran.powerpc	n/a	n/a	176-65-139-152 elf ua-wget
http://176.65.139.152/iran.sparc	n/a	n/a	n/a
http://176.65.139.152/iran.sh4	n/a	n/a	176-65-139-152 elf ua-wget
http://176.65.139.152/iran.arc	92fe687f06ec777333cabddae706aa49d634e85115011f59267f21032ec3d4da	Mirai	176-65-139-152 elf ua-wget
http://176.65.139.152/iran.i486	92694a136bddfbf016d614772211835421f78902a785c8519e579e91126e0dfb	FlyLegitBot	176-65-139-152 elf ua-wget
http://176.65.139.152/iran.armv4l	3424504bf416e75370e746568ea1ee15636f5008c4d8044b2bc4d9846fbdb2b0	Mirai	176-65-139-152 elf mirai ua-wget
http://176.65.139.152/iran.armv5l	7df5e7b61cc18642193b7d6bdc5a512dc4e64af201c00c9ebed80bc90325c956	Mirai	176-65-139-152 elf mirai ua-wget
http://176.65.139.152/iran.armv6l	17fddbfbe647004f4e933c2b95eb7a6188bb7bc06ab599c8d388eefa1e4c5d52	Mirai	176-65-139-152 elf mirai ua-wget
http://176.65.139.152/iran.armv7l	18547a337812ec93e0a6ae6101811590ecf634e21076436eaea376b65d2c016e	Mirai	176-65-139-152 elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-09-16T08:24:00Z UTC

Last seen:

2026-09-16T14:57:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/e5b028c788ffdb8e4531e623f9a7aad5e5b1c540bc59bbc845bfad2170578c9c/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/a427f16f-f4b5-47e8-9825-bdac18eb8ac6

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/e5b028c788ffdb8e4531e623f9a7aad5e5b1c540bc59bbc845bfad2170578c9c

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e5b028c788ffdb8e4531e623f9a7aad5e5b1c540bc59bbc845bfad2170578c9c/

Threat name:

Script.Downloader.Iranbot

Status:

Malicious

First seen:

2026-09-16 11:06:31 UTC

File Type:

Text (Shell)

AV detection:

11 of 36 (30.56%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=4wycrr4i77ny4rjr4yr7tj5k2xs3drkaxrm3xscfx6wsc4cxrsoa._file

Result

Malware family:

n/a

Score:

1/10

Tags:

linux

Link:

https://tria.ge/reports/260916-m8qq5sxtfz/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/e5b028c788ffdb8e4531e623f9a7aad5e5b1c540bc59bbc845bfad2170578c9c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh