MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 42fcb4c9a50adebbdfb329c597b0aedcd912d22c8f6844b3829891626ced50a2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 5

Intelligence 5 IOCs YARA 2 File information Comments

SHA256 hash:	42fcb4c9a50adebbdfb329c597b0aedcd912d22c8f6844b3829891626ced50a2
SHA3-384 hash:	05135bc0413e1777f927c236127973e0fd545db2a7143afb9047b68396a1faaafa5a5f016425670280d54475ceba7308
SHA1 hash:	765517bb18142f4ff36e5d47e296705e7466ddb8
MD5 hash:	1da78b7e8d0ed5aca5156baf3fafd474
humanhash:	arkansas-stream-charlie-nevada
File name:	w.sh
Download:	download sample
File size:	1'225 bytes
First seen:	2026-08-29 06:09:35 UTC
Last seen:	2026-08-29 22:12:52 UTC
File type:	sh
MIME type:	text/plain
ssdeep	12:kiR5FibNIuWA5FiXg5FibNIuWA5FiI3H5FiHb5FiEP5FiDv5FiYw735FiUyc4TAt:8NIu6NIu4RGdw7ATC7Rn
TLSH	T1902165CA20250695D05ECADD712D880AC52867E8AC3F97C46CDE86B2D265DFC762AF08
Magika	txt
Reporter	BlinkzSec

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://31.220.3.140/la.bot.arm	4ffeb4b3473d4260056d9299ad19d5b589907e6b219608523699022888ebd761	Mirai	mirai
http://31.220.3.140/la.bot.arm6	53deedcc375335665302254a3c350db57cc3609f586e9e828200074b589ae626	Mirai	elf mirai
http://31.220.3.140/la.bot.arm5	f6a1d4b5d998c93cdfd06d47543266d93784dc59f224f0733cf3a03337abd4b0	Mirai	32 arm elf mirai
http://31.220.3.140/la.bot.arm7	4c87489b721ef25f97a32caac6bd70e0697c5ead70f4ee10b6ca40386f0ed5f7	Mirai	32 arm elf mirai
http://31.220.3.140/la.bot.m68k	n/a	n/a	elf mirai
http://31.220.3.140/la.bot.mips	n/a	n/a	n/a
http://31.220.3.140/la.bot.mipsel	60a3bf42783d46200f19f987e416e493448994cc5aae516fb0aa0eee9e67ae2b	Mirai	32 elf mips mirai
http://31.220.3.140/la.bot.powerpc	n/a	n/a	elf mirai
http://31.220.3.140/la.bot.x86_64	n/a	n/a	elf mirai
http://31.220.3.140/la.bot.sh4	214b6f8fb89b4923fa57c160c26e4fea98bcabf73046d43be28c8eb4ecc96c98	Gafgyt	32 bashlite elf gafgyt renesas
http://31.220.3.140/la.bot.sparc	n/a	n/a	elf mirai

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

SecuriteInfo.com.Linux.Downloader-32.UNOFFICIAL

Verdict:

Malicious

File Type:

text

First seen:

2026-08-29T04:22:00Z UTC

Last seen:

2026-08-29T04:26:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/42fcb4c9a50adebbdfb329c597b0aedcd912d22c8f6844b3829891626ced50a2/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/043833c5-4402-40ba-93e7-0a6e3d99dfdc

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/42fcb4c9a50adebbdfb329c597b0aedcd912d22c8f6844b3829891626ced50a2

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/42fcb4c9a50adebbdfb329c597b0aedcd912d22c8f6844b3829891626ced50a2/

Threat name:

Script-Shell.Downloader.Heuristic

Status:

Malicious

First seen:

2026-08-29 06:03:12 UTC

File Type:

Text (Shell)

AV detection:

9 of 36 (25.00%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=il6ljsnfblplxx5tfhczpmfo3tmrfurmr5uejm4ctciwe3hnkcra._file

Result

Malware family:

n/a

Score:

3/10

Tags:

execution

Link:

https://tria.ge/reports/260829-gw6c6swygv/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Executes a command shell one-liner

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/42fcb4c9a50adebbdfb329c597b0aedcd912d22c8f6844b3829891626ced50a2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ach_202412_suspect_bash_script Create hunting rule
Author:	abuse.ch
Description:	Detects suspicious Linux bash scripts

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh