TF-1932727
high
📛 Threat Title
Unknown malware: SHA256 hash of a malware sample (payload) 167c1bb2ab7f26ec474ed6862d3f84b966c7f7a45dcfcb37a0cbc629651fd0f6
Description
Indicator that identifies a malware sample (payload). IOC type: SHA256 hash of a malware sample (payload). Attributed malware: Unknown malware. Confidence: 75. First seen: 2026-09-25 08:34:32 UTC. Reporter: Portfwd. Tags: cowrie, elf, ssh-honeypot.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
hash_sha256
167c1bb2ab7f26ec474ed6862d3f84b966c7f7a45dcfcb37a0cbc629651fd0f6
VT 16 / 75
IOC database
- Type
- hash_sha256
- Value
167c1bb2ab7f26ec474ed6862d3f84b966c7f7a45dcfcb37a0cbc629651fd0f6- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- SHA256 hash of a malware sample (payload) attributed to Unknown malware
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Flagged by 16 of 75 VirusTotal vendors
| Vendor | Verdict | Detection |
|---|---|---|
| alibabacloud | malicious | DDoS:Linux/Mirai.QZ |
| Avira | malicious | PUA/LINUX.Agent.BQZ |
| Cynet | malicious | Malicious (score: 99) |
| F-Secure | malicious | PotentialRisk.PUA/LINUX.Agent.BQZ |
| malicious | Detected |
|
| huorong | malicious | Trojan/Linux.Mirai.q |
| Ikarus | malicious | Trojan.Linux.Mirai |
| Kingsoft | malicious | Linux.Backdoor.Mirai.ml |
| Lionic | malicious | Trojan.Linux.Mirai.K!c |
| McAfeeD | malicious | ti!167C1BB2AB7F |
| Microsoft | malicious | Backdoor:Linux/Multiverze!rfn |
| MicroWorld-eScan | malicious | Trojan.Linux.GenericKD.60058468 |
| Sophos | malicious | Mal/Generic-S |
| Symantec | malicious | PUA.Gen.2 |
| Tencent | malicious | Linux.Backdoor.Mirai.Mjgl |
| TrendMicro-HouseCall | malicious | Backdoor.Linux.MIRAI.USBLIP26 |
Details From VirusTotal
Basic Properties
| MD5 | 230c4d6183612ad7998fa844fe7050de |
| SHA-1 | 03f86b7bc47853875d9d47948d8dc02e00391653 |
| SHA-256 | 167c1bb2ab7f26ec474ed6862d3f84b966c7f7a45dcfcb37a0cbc629651fd0f6 |
| VHash | ea73b7e8c01fd8e53b7e4f1937c0a056 |
| SSDEEP | 3072:agZ/BcbmRwqX8xDNm0imTB7ePxPLvHLqdHSBQxnLXHdI6a/f6G24oVg:aPief9N7Te7oyBunL3i16G2Bg |
| TLSH | T12BE3127B243512F4CCFE3474852A2B30DE6E17D5901AC728284AB687B8C7F9EBB454D6 |
| File type | ELF |
| File type tag | elf |
| Magic | ELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, no section header |
| File size | 142.7 KB |
History
| First seen on VirusTotal | 2026-09-24 14:34 UTC |
| Last submission | 2026-09-24 14:34 UTC |
| Last analysis | 2026-09-26 00:31 UTC |
| Last modified on VirusTotal | 2026-09-26 00:48 UTC |
Known Names
nsno8n.exevldnn4x2.exemips
References (2)
- Malpedia profile ThreatFox IOCs
-
ThreatFox IOC page
ThreatFox IOCs
Indicator that identifies a malware sample (payload). IOC type: SHA256 hash of a malware sample (payload). Attributed malware: Unknown malware. Confidence: 75. First seen: 2026-09-25 08:34:32 UTC. Reporter: Portfwd. Tags: cowrie, elf, ssh-honeypot.
Remediations (10)
-
web:bazaar.abuse.ch
MalwareBazaar MalwareBazaar is a platform from abuse.ch and Spamhaus, dedicated to sharing malware samples with the infosec community, antivirus vendors, and threat intelligence providers. Upload malware samples and explore the database for valuable intelligence. Set alerts to track newly observed malware , use APIs to seamlessly push or pull signals, and automate bulk queries. With this ...
-
web:bazaar.abuse.ch
Using the form below, you can search for malware samples by a hash (MD5, SHA256 , SHA1), imphash, tlsh hash , ClamAV signature, tag or malware family. Browse Database
-
web:cipherssecurity.com
What it does When you encounter an unknown executable, the fastest triage step is hash reputation: compute its cryptographic fingerprint and check threat-intel feeds for prior submissions. Our checker queries MalwareBazaar (abuse.ch's curated malicious- sample database) and VirusTotal, returning the aggregated verdict plus per-source details.
-
web:github.com
A public repository that provides regularly updated lists of malicious file hashes (MD5, SHA-1, SHA-256 ) and related metadata for use in firewall, gateway endpoint or other security device blocking...
-
web:inventivehq.com
Check any file hash in seconds. Paste an MD5, SHA-1 or SHA-256 hash , or drop a file to hash it locally, then check it against live malware feeds.
-
web:ismalicious.com
Database of known malware file hashes. MD5, SHA1, and SHA256 hashes with malware family classification. Updated daily from sandbox analysis and vendor feeds.
-
web:ismalicious.com
File Hash Reputation MD5, SHA1, and SHA256 malware hash lookup Check a file hash before it becomes a manual investigation bottleneck. Enrich MD5, SHA1, and SHA256 indicators with reputation, malware context, related infrastructure, and API-ready evidence for SOC queues and incident response.
-
web:talosintelligence.com
Use Talos' File Reputation lookup to find the reputation, file name, weighted reputation score, and detection information available for a given SHA256 .
-
web:threatfox.abuse.ch
ThreatFox Database Indicators of Compromise (IOCs) on ThreatFox are associated with a certain malware fas. A malware sample can be associated with only one malware family. The page below gives you an overview on indicators of compromise associated with unknown . You can also get this data through the ThreatFox API. Database Entry
-
web:www.virustotal.com
VirusTotal provides tools for inspecting files, domains, IPs, and URLs to detect malware and other threats.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.