MB-947c8d6b5b163f060774dbc4aaa76661749bfe107f5d0323e17c7e8aa4543059
high
📛 Threat Title
Unknown: selfrep.sh
Description
File type: sh. Size: 1877 bytes. Tags: sh. Reporter: abuse_ch. First seen: 2026-05-14 01:46:32.
Remediations (8)
-
web:archive.org
Full text of "NEW" See other formats Word . the , > < br to of and a : " in you that i it he is was for - with ) on ( ? his as this ; be at but not have had from will are they -- ! all by if him one your or up her there can so out them an my when she 1 no which me were we then 2 into 5 do what get go their now said would about time quot ] [ more only back been who down like has some --- just 3 ...
-
web:askubuntu.com
We are running a bunch of containers for a cyber security teaching environment, where students can execute arbitrary commands (unprivileged). Our system (Ubuntu 24.04.4 LTS) is affected by the recently-published "Copy Fail" vulnerability (CVE-2026-31431). Unfortunately, updating did not produce any new kernel packages, and we are still stuck with 6.8.0-110: # uname -a Linux teaching-host 6.8.0 ...
-
web:cocalc.com
CoCalc provides the best real-time collaborative environment for Jupyter Notebooks, LaTeX documents, and SageMath, scalable from individual use to large groups and classes!
-
web:deepwiki.com
The SELFREP Compilation Flag The bot client's self-replication functionality is conditionally compiled using the SELFREP preprocessor flag. When enabled during compilation (via build.sh), the bot includes scanner modules that actively seek out vulnerable targets while simultaneously executing attack commands from the C&C server.
-
web:docs.redhat.com
The Release Notes provide high-level coverage of the improvements and additions that have been implemented in Red Hat Enterprise Linux 8.10 and document known problems in this release, as well as notable bug fixes, Technology Previews, deprecated functionality, and other details.
-
web:github.com
Explore RootSec's DDOS Archive, featuring top-tier scanners, powerful botnets (Mirai & QBot) and other variants, high-impact exploits, advanced methods, and efficient sniffers. Ideal for cy...
-
web:panorays.com
Discover the difference between remediation and mitigation in risk management and how each strategy impacts security and resilience.
-
web:www.google.com
Click here if you are not automatically redirected after 5 seconds.
Indicators of Compromise (4)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
selfrep.sh
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/selfrep.sh
IOC database
- Type
- domain
- Value
selfrep.sh- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Extracted from Threat MB-947c8d6b5b163f060774dbc4aaa76661749bfe107f5d0323e17c7e8aa4543059
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/selfrep.sh
hash_sha256
947c8d6b5b163f060774dbc4aaa76661749bfe107f5d0323e17c7e8aa4543059
VT: VT base fetch failed: HTTPError: 429 Too Many Requests for files/947c8d6b5b163f060774dbc4aaa76661749bfe107f5d0323e17c7e8aa4543059
1 feed
IOC database
- Type
- hash_sha256
- Value
947c8d6b5b163f060774dbc4aaa76661749bfe107f5d0323e17c7e8aa4543059- First seen
- Last seen
- Attached to this threat
- Appears in
- 2 threats
- Description
- Unknown
Threat Hunt — feed corroboration
Listed by 1 threat-intel feed vendor: Abuse.ch. Open in Threat Hunt →
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Too Many Requests for files/947c8d6b5b163f060774dbc4aaa76661749bfe107f5d0323e17c7e8aa4543059
hash_sha1
5177075231b4e58d8fd2d75410ab4a50c56dd658
VT: VT base fetch failed: HTTPError: 429 Too Many Requests for files/5177075231b4e58d8fd2d75410ab4a50c56dd658
2 feeds
IOC database
- Type
- hash_sha1
- Value
5177075231b4e58d8fd2d75410ab4a50c56dd658- First seen
- Last seen
- Attached to this threat
- Appears in
- 2 threats
Threat Hunt — feed corroboration
Listed by 2 threat-intel feed vendors: Abuse.ch, threatview.io. Open in Threat Hunt →
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Too Many Requests for files/5177075231b4e58d8fd2d75410ab4a50c56dd658
hash_md5
31f14d0d1160b7e8e8da0e7699b9be31
VT 29 / 75
2 feeds
IOC database
- Type
- hash_md5
- Value
31f14d0d1160b7e8e8da0e7699b9be31- First seen
- Last seen
- Attached to this threat
- Appears in
- 2 threats
Threat Hunt — feed corroboration
Listed by 2 threat-intel feed vendors: Abuse.ch, threatview.io. Open in Threat Hunt →
Flagged by 29 of 75 VirusTotal vendors
| Vendor | Verdict | Detection |
|---|---|---|
| AhnLab-V3 | malicious | Downloader/Shell.Generic.S2969 |
| alibabacloud | malicious | Trojan[downloader]:Linux/Wacatac.B9nj |
| Arcabit | malicious | Trojan.Generic.D261C073 |
| Avast | malicious | BV:Downloader-AEH [Drp] |
| AVG | malicious | BV:Downloader-AEH [Drp] |
| Avira | malicious | HTML/ExpKit.Gen2 |
| BitDefender | malicious | Trojan.Generic.39960691 |
| CTX | malicious | shell.trojan.expkit |
| Cynet | malicious | Malicious (score: 99) |
| DrWeb | malicious | Linux.DownLoader.683 |
| Emsisoft | malicious | Trojan.Generic.39960691 (B) |
| ESET-NOD32 | malicious | Linux/TrojanDownloader.SH.FFM trojan |
| F-Secure | malicious | Malware.HTML/ExpKit.Gen2 |
| Fortinet | malicious | BASH/Mirai.AEH!tr.dldr |
| GData | malicious | Trojan.Generic.39960691 |
| malicious | Detected |
|
| huorong | malicious | TrojanDownloader/Linux.Agent.cv |
| Ikarus | malicious | Trojan-Downloader.Linux.Sh |
| Kaspersky | malicious | HEUR:Trojan-Downloader.Shell.Agent.a |
| Kingsoft | malicious | Win32.Troj.Undef.a |
| Lionic | malicious | Trojan.Script.Shell.4!c |
| McAfeeD | malicious | ti!947C8D6B5B16 |
| Microsoft | malicious | Trojan:Win32/Vigorf.A |
| MicroWorld-eScan | malicious | Trojan.Generic.39960691 |
| Symantec | malicious | CL.Downloader!gen277 |
| Tencent | malicious | Html.Trojan.Expkit.Ekjl |
| TrendMicro | malicious | Possible_BASHDLOD.SMLBO1 |
| TrendMicro-HouseCall | malicious | Possible_BASHDLOD.SMLBO1 |
| Varist | malicious | SH/Mirai.C.gen!Camelot |
Details From VirusTotal
Basic Properties
| MD5 | 31f14d0d1160b7e8e8da0e7699b9be31 |
| SHA-1 | 5177075231b4e58d8fd2d75410ab4a50c56dd658 |
| SHA-256 | 947c8d6b5b163f060774dbc4aaa76661749bfe107f5d0323e17c7e8aa4543059 |
| SSDEEP | 24:kGNY1DGuRJRUv/WRgG2GsGRGlGVfWwGTQgGiRGwGGSfGpw5GZHw0sj7:39ubEWV9PEIVfWDTQziEwNSuWcZHW |
| TLSH | T1F54194CB14150FF2C20DEFC6FB648955D107AAF0F7D7977AA61308627C9A7807916B81 |
| File type | Shell script |
| File type tag | shell |
| File extension | sh |
| Magic | POSIX shell script, ASCII text executable, with CRLF line terminators |
| File size | 1.8 KB |
History
| First seen on VirusTotal | 2026-05-14 01:48 UTC |
| Last submission | 2026-05-14 02:00 UTC |
| Last analysis | 2026-05-15 10:16 UTC |
| Last modified on VirusTotal | 2026-05-15 12:26 UTC |
Known Names
selfrep.shmjmldwf.exe_947c8d6b5b163f060774dbc4aaa76661749bfe107f5d0323e17c7e8aa4543059.sh
References (1)
-
MalwareBazaar sample page
Abuse.ch
File type: sh. Size: 1877 bytes. Tags: sh. Reporter: abuse_ch. First seen: 2026-05-14 01:46:32.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.