MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 54b86103584d9afb4b6a5ba719a458f7463bdd59816b69bf69676b31eabe7b8a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 54b86103584d9afb4b6a5ba719a458f7463bdd59816b69bf69676b31eabe7b8a
SHA3-384 hash: e50d5b887e486e35255b181daa3d6ee70574f6633cf9487939b13653486f7956c0e2a7417592701e92e12b2fe83116e7
SHA1 hash: f509b69b543e702cbccc8b789903acbed77ffa12
MD5 hash: e2948707b459e85a78b9361e3929ccfc
humanhash: wyoming-south-sierra-washington
File name:wget.sh
Download: download sample
File size:776 bytes
First seen:2026-01-01 19:36:16 UTC
Last seen:2026-01-02 18:24:54 UTC
File type: sh
MIME type:text/plain
ssdeep 12:+WbxNWt2W8NIjlTNW9iKl2DWmY7Wk9NWpFG10NWq16aW/mW1WqbUWoRn:ZxMiNIpXKlnR+16VSn
TLSH T112017DDFD871761103CECE45707D4958F109D5C063A26F9A9E6944F64CE77493026F86
Magika txt
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://178.16.53.211/parmn/an/aelf ua-wget
http://178.16.53.211/parm5n/an/aelf ua-wget
http://178.16.53.211/parm6n/an/aelf ua-wget
http://178.16.53.211/parm7n/an/aelf ua-wget
http://178.16.53.211/pm68kn/an/aelf ua-wget
http://178.16.53.211/pmipsn/an/aelf ua-wget
http://178.16.53.211/pmpsln/an/aelf ua-wget
http://178.16.53.211/pppcn/an/aelf ua-wget
http://178.16.53.211/psh4n/an/aelf ua-wget
http://178.16.53.211/pspcn/an/aelf ua-wget
http://178.16.53.211/px86n/an/aelf ua-wget
http://178.16.53.211/px86_64n/an/aelf ua-wget

Intelligence

File Origin
# of uploads :
2
# of downloads :
30
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
mirai
Link:
https://www.filescan.io/uploads/6956cce8127d6a14e0cb79a6/reports/abd802b4-b40a-4992-a113-69c59f15829a/overview
Verdict:
Malicious
File Type:
text
First seen:
2026-01-01T13:29:00Z UTC
Last seen:
2026-01-01T16:47:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan-Downloader.Shell.Agent.a
Link:
https://opentip.kaspersky.com/54b86103584d9afb4b6a5ba719a458f7463bdd59816b69bf69676b31eabe7b8a/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/1ac61898-bf5e-4914-aa0e-c5a2d5ddb178
Behavior Graph:
Download SVG
%3 guuid=50c401b4-1d00-0000-983a-1643be070000 pid=1982 /usr/bin/sudo guuid=d95f0bb7-1d00-0000-983a-1643c1070000 pid=1985 /tmp/sample.bin guuid=50c401b4-1d00-0000-983a-1643be070000 pid=1982->guuid=d95f0bb7-1d00-0000-983a-1643c1070000 pid=1985 execve guuid=fda16db7-1d00-0000-983a-1643c4070000 pid=1988 /usr/bin/wget net guuid=d95f0bb7-1d00-0000-983a-1643c1070000 pid=1985->guuid=fda16db7-1d00-0000-983a-1643c4070000 pid=1988 execve guuid=533411be-1d00-0000-983a-1643cb070000 pid=1995 /usr/bin/chmod guuid=d95f0bb7-1d00-0000-983a-1643c1070000 pid=1985->guuid=533411be-1d00-0000-983a-1643cb070000 pid=1995 execve guuid=f8b975be-1d00-0000-983a-1643cd070000 pid=1997 /usr/bin/dash guuid=d95f0bb7-1d00-0000-983a-1643c1070000 pid=1985->guuid=f8b975be-1d00-0000-983a-1643cd070000 pid=1997 clone guuid=1bab84be-1d00-0000-983a-1643ce070000 pid=1998 /usr/bin/wget net guuid=d95f0bb7-1d00-0000-983a-1643c1070000 pid=1985->guuid=1bab84be-1d00-0000-983a-1643ce070000 pid=1998 execve guuid=7bf236c2-1d00-0000-983a-1643d3070000 pid=2003 /usr/bin/chmod guuid=d95f0bb7-1d00-0000-983a-1643c1070000 pid=1985->guuid=7bf236c2-1d00-0000-983a-1643d3070000 pid=2003 execve guuid=c82d85c2-1d00-0000-983a-1643d4070000 pid=2004 /usr/bin/dash guuid=d95f0bb7-1d00-0000-983a-1643c1070000 pid=1985->guuid=c82d85c2-1d00-0000-983a-1643d4070000 pid=2004 clone guuid=61f594c2-1d00-0000-983a-1643d5070000 pid=2005 /usr/bin/wget net guuid=d95f0bb7-1d00-0000-983a-1643c1070000 pid=1985->guuid=61f594c2-1d00-0000-983a-1643d5070000 pid=2005 execve guuid=070065c6-1d00-0000-983a-1643dd070000 pid=2013 /usr/bin/chmod guuid=d95f0bb7-1d00-0000-983a-1643c1070000 pid=1985->guuid=070065c6-1d00-0000-983a-1643dd070000 pid=2013 execve guuid=c62abec6-1d00-0000-983a-1643de070000 pid=2014 /usr/bin/dash guuid=d95f0bb7-1d00-0000-983a-1643c1070000 pid=1985->guuid=c62abec6-1d00-0000-983a-1643de070000 pid=2014 clone guuid=673bd4c6-1d00-0000-983a-1643df070000 pid=2015 /usr/bin/wget net guuid=d95f0bb7-1d00-0000-983a-1643c1070000 pid=1985->guuid=673bd4c6-1d00-0000-983a-1643df070000 pid=2015 execve guuid=fc9bd1ca-1d00-0000-983a-1643e6070000 pid=2022 /usr/bin/chmod guuid=d95f0bb7-1d00-0000-983a-1643c1070000 pid=1985->guuid=fc9bd1ca-1d00-0000-983a-1643e6070000 pid=2022 execve guuid=85ca1ecb-1d00-0000-983a-1643e8070000 pid=2024 /usr/bin/dash guuid=d95f0bb7-1d00-0000-983a-1643c1070000 pid=1985->guuid=85ca1ecb-1d00-0000-983a-1643e8070000 pid=2024 clone guuid=aa532dcb-1d00-0000-983a-1643e9070000 pid=2025 /usr/bin/wget net guuid=d95f0bb7-1d00-0000-983a-1643c1070000 pid=1985->guuid=aa532dcb-1d00-0000-983a-1643e9070000 pid=2025 execve guuid=a4eb1fd0-1d00-0000-983a-1643f2070000 pid=2034 /usr/bin/chmod guuid=d95f0bb7-1d00-0000-983a-1643c1070000 pid=1985->guuid=a4eb1fd0-1d00-0000-983a-1643f2070000 pid=2034 execve guuid=878879d0-1d00-0000-983a-1643f4070000 pid=2036 /usr/bin/dash guuid=d95f0bb7-1d00-0000-983a-1643c1070000 pid=1985->guuid=878879d0-1d00-0000-983a-1643f4070000 pid=2036 clone guuid=3ff091d0-1d00-0000-983a-1643f6070000 pid=2038 /usr/bin/wget net guuid=d95f0bb7-1d00-0000-983a-1643c1070000 pid=1985->guuid=3ff091d0-1d00-0000-983a-1643f6070000 pid=2038 execve guuid=4cd68ad4-1d00-0000-983a-1643ff070000 pid=2047 /usr/bin/chmod guuid=d95f0bb7-1d00-0000-983a-1643c1070000 pid=1985->guuid=4cd68ad4-1d00-0000-983a-1643ff070000 pid=2047 execve guuid=c530eed4-1d00-0000-983a-164301080000 pid=2049 /usr/bin/dash guuid=d95f0bb7-1d00-0000-983a-1643c1070000 pid=1985->guuid=c530eed4-1d00-0000-983a-164301080000 pid=2049 clone guuid=47bcfcd4-1d00-0000-983a-164302080000 pid=2050 /usr/bin/wget net guuid=d95f0bb7-1d00-0000-983a-1643c1070000 pid=1985->guuid=47bcfcd4-1d00-0000-983a-164302080000 pid=2050 execve guuid=3750f4d8-1d00-0000-983a-16430d080000 pid=2061 /usr/bin/chmod guuid=d95f0bb7-1d00-0000-983a-1643c1070000 pid=1985->guuid=3750f4d8-1d00-0000-983a-16430d080000 pid=2061 execve guuid=f03d34d9-1d00-0000-983a-16430f080000 pid=2063 /usr/bin/dash guuid=d95f0bb7-1d00-0000-983a-1643c1070000 pid=1985->guuid=f03d34d9-1d00-0000-983a-16430f080000 pid=2063 clone guuid=bb493ed9-1d00-0000-983a-164310080000 pid=2064 /usr/bin/wget net guuid=d95f0bb7-1d00-0000-983a-1643c1070000 pid=1985->guuid=bb493ed9-1d00-0000-983a-164310080000 pid=2064 execve guuid=3f374bdd-1d00-0000-983a-16431a080000 pid=2074 /usr/bin/chmod guuid=d95f0bb7-1d00-0000-983a-1643c1070000 pid=1985->guuid=3f374bdd-1d00-0000-983a-16431a080000 pid=2074 execve guuid=8d2a99dd-1d00-0000-983a-16431b080000 pid=2075 /usr/bin/dash guuid=d95f0bb7-1d00-0000-983a-1643c1070000 pid=1985->guuid=8d2a99dd-1d00-0000-983a-16431b080000 pid=2075 clone guuid=c438b3dd-1d00-0000-983a-16431c080000 pid=2076 /usr/bin/wget net guuid=d95f0bb7-1d00-0000-983a-1643c1070000 pid=1985->guuid=c438b3dd-1d00-0000-983a-16431c080000 pid=2076 execve guuid=7f5c78e2-1d00-0000-983a-164325080000 pid=2085 /usr/bin/chmod guuid=d95f0bb7-1d00-0000-983a-1643c1070000 pid=1985->guuid=7f5c78e2-1d00-0000-983a-164325080000 pid=2085 execve guuid=a26cbfe2-1d00-0000-983a-164326080000 pid=2086 /usr/bin/dash guuid=d95f0bb7-1d00-0000-983a-1643c1070000 pid=1985->guuid=a26cbfe2-1d00-0000-983a-164326080000 pid=2086 clone guuid=24bccae2-1d00-0000-983a-164328080000 pid=2088 /usr/bin/wget net guuid=d95f0bb7-1d00-0000-983a-1643c1070000 pid=1985->guuid=24bccae2-1d00-0000-983a-164328080000 pid=2088 execve guuid=3d3a97e7-1d00-0000-983a-164330080000 pid=2096 /usr/bin/chmod guuid=d95f0bb7-1d00-0000-983a-1643c1070000 pid=1985->guuid=3d3a97e7-1d00-0000-983a-164330080000 pid=2096 execve guuid=6a10fbe7-1d00-0000-983a-164331080000 pid=2097 /usr/bin/dash guuid=d95f0bb7-1d00-0000-983a-1643c1070000 pid=1985->guuid=6a10fbe7-1d00-0000-983a-164331080000 pid=2097 clone guuid=80af0de8-1d00-0000-983a-164332080000 pid=2098 /usr/bin/wget net guuid=d95f0bb7-1d00-0000-983a-1643c1070000 pid=1985->guuid=80af0de8-1d00-0000-983a-164332080000 pid=2098 execve guuid=c23e67ec-1d00-0000-983a-16433b080000 pid=2107 /usr/bin/chmod guuid=d95f0bb7-1d00-0000-983a-1643c1070000 pid=1985->guuid=c23e67ec-1d00-0000-983a-16433b080000 pid=2107 execve guuid=058ab1ec-1d00-0000-983a-16433d080000 pid=2109 /usr/bin/dash guuid=d95f0bb7-1d00-0000-983a-1643c1070000 pid=1985->guuid=058ab1ec-1d00-0000-983a-16433d080000 pid=2109 clone guuid=4fd5bfec-1d00-0000-983a-16433e080000 pid=2110 /usr/bin/wget net guuid=d95f0bb7-1d00-0000-983a-1643c1070000 pid=1985->guuid=4fd5bfec-1d00-0000-983a-16433e080000 pid=2110 execve guuid=4a3cdaf0-1d00-0000-983a-164349080000 pid=2121 /usr/bin/chmod guuid=d95f0bb7-1d00-0000-983a-1643c1070000 pid=1985->guuid=4a3cdaf0-1d00-0000-983a-164349080000 pid=2121 execve guuid=1d873cf1-1d00-0000-983a-16434a080000 pid=2122 /usr/bin/dash guuid=d95f0bb7-1d00-0000-983a-1643c1070000 pid=1985->guuid=1d873cf1-1d00-0000-983a-16434a080000 pid=2122 clone guuid=a4e849f1-1d00-0000-983a-16434c080000 pid=2124 /usr/bin/rm delete-file guuid=d95f0bb7-1d00-0000-983a-1643c1070000 pid=1985->guuid=a4e849f1-1d00-0000-983a-16434c080000 pid=2124 execve 8e72c737-d284-5672-8c67-6b288cd05c8e 178.16.53.211:80 guuid=fda16db7-1d00-0000-983a-1643c4070000 pid=1988->8e72c737-d284-5672-8c67-6b288cd05c8e con guuid=1bab84be-1d00-0000-983a-1643ce070000 pid=1998->8e72c737-d284-5672-8c67-6b288cd05c8e con guuid=61f594c2-1d00-0000-983a-1643d5070000 pid=2005->8e72c737-d284-5672-8c67-6b288cd05c8e con guuid=673bd4c6-1d00-0000-983a-1643df070000 pid=2015->8e72c737-d284-5672-8c67-6b288cd05c8e con guuid=aa532dcb-1d00-0000-983a-1643e9070000 pid=2025->8e72c737-d284-5672-8c67-6b288cd05c8e con guuid=3ff091d0-1d00-0000-983a-1643f6070000 pid=2038->8e72c737-d284-5672-8c67-6b288cd05c8e con guuid=47bcfcd4-1d00-0000-983a-164302080000 pid=2050->8e72c737-d284-5672-8c67-6b288cd05c8e con guuid=bb493ed9-1d00-0000-983a-164310080000 pid=2064->8e72c737-d284-5672-8c67-6b288cd05c8e con guuid=c438b3dd-1d00-0000-983a-16431c080000 pid=2076->8e72c737-d284-5672-8c67-6b288cd05c8e con guuid=24bccae2-1d00-0000-983a-164328080000 pid=2088->8e72c737-d284-5672-8c67-6b288cd05c8e con guuid=80af0de8-1d00-0000-983a-164332080000 pid=2098->8e72c737-d284-5672-8c67-6b288cd05c8e con guuid=4fd5bfec-1d00-0000-983a-16433e080000 pid=2110->8e72c737-d284-5672-8c67-6b288cd05c8e con
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/54b86103584d9afb4b6a5ba719a458f7463bdd59816b69bf69676b31eabe7b8a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/54b86103584d9afb4b6a5ba719a458f7463bdd59816b69bf69676b31eabe7b8a/
Verdict:
Malicious
Threat:
Trojan-Downloader.Shell.Agent
Link:
https://tip.neiki.dev/file/54b86103584d9afb4b6a5ba719a458f7463bdd59816b69bf69676b31eabe7b8a
Threat name:
Document-HTML.Downloader.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2026-01-01 18:29:41 UTC
File Type:
Text (Shell)
AV detection:
16 of 38 (42.11%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ks4gca2yjwnpws3klotrtjcy65ddxxkzqfvwtp3jm5vtd2v6pofa._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/260106-k7j6vsyphy/
Behaviour
Modifies registry class
Suspicious use of SetWindowsHookEx
Enumerates physical storage devices
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/54b86103584d9afb4b6a5ba719a458f7463bdd59816b69bf69676b31eabe7b8a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MAL_Linux_IoT_MultiArch_BotnetLoader_Generic
Create hunting rule
Author:Anish Bogati
Description:Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:MalwareBazaar sample lilin.sh

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 54b86103584d9afb4b6a5ba719a458f7463bdd59816b69bf69676b31eabe7b8a

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3747932/
  
Delivery method
Distributed via web download

Comments