MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f8df8372a8ec968ccd8141198559d610c41e1fa783db2d525f3ff8114e9d326a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

FlyLegitBot

Vendor detections: 5

Intelligence 5 IOCs YARA 1 File information Comments

SHA256 hash:	f8df8372a8ec968ccd8141198559d610c41e1fa783db2d525f3ff8114e9d326a
SHA3-384 hash:	658cf4d0f0570ea023c210392040b24d5ca8b2b331702562095dbeeae556314a6f7e082919a7698b1cafab39d8d043ca
SHA1 hash:	a99b20418b91a916913c0031ef2d33f6c0c03b4e
MD5 hash:	76df0198bb3eb60d01e67846ed9b940b
humanhash:	mexico-autumn-finch-alanine
File name:	cat.sh
Download:	download sample
Signature	FlyLegitBot Create hunting rule
File size:	1'757 bytes
First seen:	2026-09-16 11:07:16 UTC
Last seen:	2026-09-17 04:54:17 UTC
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:szJ2EqRx1lqn5Y6afpPJI11Do78Yaqv1CxRw:aa1ink
TLSH	T1E731D6CB60F46242C7DCCE0070E589CA6716A595B1DE2A3AED812E77CCC9D54742DF36
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	BlinkzSec

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://176.65.139.152/iran.x86_64	f399c13f5dcb562ade12d2cb24d67a88e5895b70569fd4973bff0fe263566f48	FlyLegitBot	176-65-139-152 elf ua-wget
http://176.65.139.152/iran.m68k	371764e598b0ad9edb0c0d126f107352aa82a2123fdee397b5f727581d1030aa	Mirai	176-65-139-152 elf ua-wget
http://176.65.139.152/iran.mips	48c3b9ced04800a4d78ea8f888db0b9c9b7c0c6ffb182ab0cda04dc2c003e163	Mirai	176-65-139-152 elf mirai ua-wget
http://176.65.139.152/iran.mipsel	n/a	n/a	176-65-139-152 elf ua-wget
http://176.65.139.152/iran.powerpc	n/a	n/a	176-65-139-152 elf ua-wget
http://176.65.139.152/iran.sparc	n/a	n/a	n/a
http://176.65.139.152/iran.sh4	68af4ba316961a0bcbdace5497718b850934297134f908d4d0dcb2e037c3fe68	Mirai	176-65-139-152 elf ua-wget
http://176.65.139.152/iran.arc	92fe687f06ec777333cabddae706aa49d634e85115011f59267f21032ec3d4da	Mirai	176-65-139-152 elf ua-wget
http://176.65.139.152/iran.i486	92694a136bddfbf016d614772211835421f78902a785c8519e579e91126e0dfb	FlyLegitBot	176-65-139-152 elf ua-wget
http://176.65.139.152/iran.armv4l	3424504bf416e75370e746568ea1ee15636f5008c4d8044b2bc4d9846fbdb2b0	Mirai	176-65-139-152 elf mirai ua-wget
http://176.65.139.152/iran.armv5l	7df5e7b61cc18642193b7d6bdc5a512dc4e64af201c00c9ebed80bc90325c956	Mirai	176-65-139-152 elf mirai ua-wget
http://176.65.139.152/iran.armv6l	17fddbfbe647004f4e933c2b95eb7a6188bb7bc06ab599c8d388eefa1e4c5d52	Mirai	176-65-139-152 elf mirai ua-wget
http://176.65.139.152/iran.armv7l	18547a337812ec93e0a6ae6101811590ecf634e21076436eaea376b65d2c016e	Mirai	176-65-139-152 elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-09-16T08:24:00Z UTC

Last seen:

2026-09-16T14:57:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/f8df8372a8ec968ccd8141198559d610c41e1fa783db2d525f3ff8114e9d326a/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/718bd6eb-0de4-4182-beab-19a7c30107e9

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/f8df8372a8ec968ccd8141198559d610c41e1fa783db2d525f3ff8114e9d326a

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f8df8372a8ec968ccd8141198559d610c41e1fa783db2d525f3ff8114e9d326a/

Threat name:

Script.Downloader.Iranbot

Status:

Malicious

First seen:

2026-09-16 11:06:29 UTC

File Type:

Text (Shell)

AV detection:

17 of 38 (44.74%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7dpyg4vi5sliztmbiemykwowcdcb4h5hqpns2us7h74bctu5gjva._file

Result

Malware family:

n/a

Score:

7/10

Tags:

antivm defense_evasion discovery linux

Link:

https://tria.ge/reports/260916-m8qq5sxtfy/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Changes its process name

Checks CPU configuration

Enumerates running processes

File and Directory Permissions Modification

Deletes itself

Executes dropped EXE

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.11

Link:

https://yomi.yoroi.company/submissions/f8df8372a8ec968ccd8141198559d610c41e1fa783db2d525f3ff8114e9d326a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh