🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 371188405bfded45d2b7d0259c204611064d3bb4da5364ed70ce1b33e0f70fff. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 371188405bfded45d2b7d0259c204611064d3bb4da5364ed70ce1b33e0f70fff
SHA3-384 hash: dce019c3b21b4d17ec30db1ba6173a640a14105595a6e46773bc25302c7a070c8ab1ddbc0e908ad0d6434b7faac5b7a9
SHA1 hash: 6d515b2868662d03609abe061fdd1797f69bdcba
MD5 hash: 568ad9be7eff24105ee6c601c551dcf4
humanhash: timing-lithium-shade-kilo
File name:mbupload-_os2ruh8.bin
Download: download sample
File size:530 bytes
First seen:2026-10-01 04:41:54 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 6:IOnFflR0mvwPn2GvwNNd9UFovwiGvw59UFovwRE2GvwRg9t:IPn27fdii75il7aX
TLSH T16BF03085FF04EA776407DE5733A803305747B8FAA4C30256AC627D9A1CC8AC97406EB5
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter wristhulk
Tags:Downloader honeypot sh


Avatar
wristhulk
Captured by the submitter's honeypot (Cowrie SSH/Telnet or Dionaea SMB). VirusTotal label at capture: downloader.bash/crit.
URLMalware sample (SHA256 hash)SignatureTags
http://94.154.43.214/phantom_bins/phantom.x86n/an/an/a
http://94.154.43.214/phantom_bins/phantom.armn/an/aarm elf ua-wget
http://94.154.43.214/phantom_bins/phantom.mips925216bc36653e4fc476bccf970e1a88122c9867f431f83ec7eeb3c6115d459a DDoSAgentDDoSAgent elf mips ua-wget

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
US US
Vendor Threat Intelligence
No detections
Gathering data
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-09-20T04:19:00Z UTC
Last seen:
2026-09-20T05:18:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/371188405bfded45d2b7d0259c204611064d3bb4da5364ed70ce1b33e0f70fff/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/60ef1f74-f849-45ca-8ff2-b46a29ae3aad
Behavior Graph:
Download SVG
%3 guuid=d9fc130f-1900-0000-e75a-2ecce7080000 pid=2279 /usr/bin/sudo guuid=b3dc5c13-1900-0000-e75a-2ecceb080000 pid=2283 /tmp/sample.bin guuid=d9fc130f-1900-0000-e75a-2ecce7080000 pid=2279->guuid=b3dc5c13-1900-0000-e75a-2ecceb080000 pid=2283 execve guuid=47f42c14-1900-0000-e75a-2eccee080000 pid=2286 /usr/bin/wget net send-data guuid=b3dc5c13-1900-0000-e75a-2ecceb080000 pid=2283->guuid=47f42c14-1900-0000-e75a-2eccee080000 pid=2286 execve guuid=7991d21b-1900-0000-e75a-2eccf3080000 pid=2291 /usr/bin/curl net send-data write-file guuid=b3dc5c13-1900-0000-e75a-2ecceb080000 pid=2283->guuid=7991d21b-1900-0000-e75a-2eccf3080000 pid=2291 execve guuid=35c4dd24-1900-0000-e75a-2ecc01090000 pid=2305 /usr/bin/chmod guuid=b3dc5c13-1900-0000-e75a-2ecceb080000 pid=2283->guuid=35c4dd24-1900-0000-e75a-2ecc01090000 pid=2305 execve guuid=00ca6025-1900-0000-e75a-2ecc04090000 pid=2308 /usr/bin/bash guuid=b3dc5c13-1900-0000-e75a-2ecceb080000 pid=2283->guuid=00ca6025-1900-0000-e75a-2ecc04090000 pid=2308 clone guuid=cd195b26-1900-0000-e75a-2ecc08090000 pid=2312 /usr/bin/wget net send-data guuid=b3dc5c13-1900-0000-e75a-2ecceb080000 pid=2283->guuid=cd195b26-1900-0000-e75a-2ecc08090000 pid=2312 execve guuid=aee8c329-1900-0000-e75a-2ecc0e090000 pid=2318 /usr/bin/curl net send-data write-file guuid=b3dc5c13-1900-0000-e75a-2ecceb080000 pid=2283->guuid=aee8c329-1900-0000-e75a-2ecc0e090000 pid=2318 execve guuid=1f37d037-1900-0000-e75a-2ecc22090000 pid=2338 /usr/bin/chmod guuid=b3dc5c13-1900-0000-e75a-2ecceb080000 pid=2283->guuid=1f37d037-1900-0000-e75a-2ecc22090000 pid=2338 execve guuid=9a68f138-1900-0000-e75a-2ecc26090000 pid=2342 /usr/bin/bash guuid=b3dc5c13-1900-0000-e75a-2ecceb080000 pid=2283->guuid=9a68f138-1900-0000-e75a-2ecc26090000 pid=2342 clone guuid=a5d51e3a-1900-0000-e75a-2ecc2a090000 pid=2346 /usr/bin/wget net send-data guuid=b3dc5c13-1900-0000-e75a-2ecceb080000 pid=2283->guuid=a5d51e3a-1900-0000-e75a-2ecc2a090000 pid=2346 execve guuid=921d673e-1900-0000-e75a-2ecc2f090000 pid=2351 /usr/bin/curl net send-data write-file guuid=b3dc5c13-1900-0000-e75a-2ecceb080000 pid=2283->guuid=921d673e-1900-0000-e75a-2ecc2f090000 pid=2351 execve guuid=92731e47-1900-0000-e75a-2ecc41090000 pid=2369 /usr/bin/chmod guuid=b3dc5c13-1900-0000-e75a-2ecceb080000 pid=2283->guuid=92731e47-1900-0000-e75a-2ecc41090000 pid=2369 execve guuid=df1cde47-1900-0000-e75a-2ecc44090000 pid=2372 /usr/bin/bash guuid=b3dc5c13-1900-0000-e75a-2ecceb080000 pid=2283->guuid=df1cde47-1900-0000-e75a-2ecc44090000 pid=2372 clone c6e1cb59-5669-5d19-bd8b-c226c2487f9c 94.154.43.214:80 guuid=47f42c14-1900-0000-e75a-2eccee080000 pid=2286->c6e1cb59-5669-5d19-bd8b-c226c2487f9c send: 152B guuid=7991d21b-1900-0000-e75a-2eccf3080000 pid=2291->c6e1cb59-5669-5d19-bd8b-c226c2487f9c send: 101B guuid=cd195b26-1900-0000-e75a-2ecc08090000 pid=2312->c6e1cb59-5669-5d19-bd8b-c226c2487f9c send: 152B guuid=aee8c329-1900-0000-e75a-2ecc0e090000 pid=2318->c6e1cb59-5669-5d19-bd8b-c226c2487f9c send: 101B guuid=a5d51e3a-1900-0000-e75a-2ecc2a090000 pid=2346->c6e1cb59-5669-5d19-bd8b-c226c2487f9c send: 153B guuid=921d673e-1900-0000-e75a-2ecc2f090000 pid=2351->c6e1cb59-5669-5d19-bd8b-c226c2487f9c send: 102B
Score:
93%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/371188405bfded45d2b7d0259c204611064d3bb4da5364ed70ce1b33e0f70fff
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/371188405bfded45d2b7d0259c204611064d3bb4da5364ed70ce1b33e0f70fff/
Threat name:
Linux.Downloader.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-09-20 09:14:04 UTC
File Type:
Text (Shell)
AV detection:
13 of 24 (54.17%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=g4iyqqc37xwuluvx2aszyicgcede2o5u3jjwj3lqzynthyhxb77q._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/261001-fbvkhaad77/
Behaviour
Reads runtime system information
System Network Configuration Discovery
Writes file to tmp directory
Checks CPU configuration
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.16
Link:
https://yomi.yoroi.company/submissions/371188405bfded45d2b7d0259c204611064d3bb4da5364ed70ce1b33e0f70fff

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Linux_Shellscript_Downloader
Create hunting rule
Author:albertzsigovits
Description:Generic Approach to Shellscript downloaders
Rule name:MAL_Linux_IoT_MultiArch_BotnetLoader_Generic
Create hunting rule
Author:Anish Bogati
Description:Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:MalwareBazaar sample lilin.sh

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 371188405bfded45d2b7d0259c204611064d3bb4da5364ed70ce1b33e0f70fff

(this sample)

elf ec13090ee2ca4de93df8d1700cbd8ef29f46b7722f2e281f5fc213cd22cd1801

  
Delivery method
Distributed via web download
  
Dropping
MD5 0f3ae6c35738a65e54ba19b6af1d4c45
  
Dropping
SHA256 ec13090ee2ca4de93df8d1700cbd8ef29f46b7722f2e281f5fc213cd22cd1801

Comments