MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5c657d45e2ac8e1bdda8945ba0176d012a5c10dc3b0504bed890c8a6a3451397. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	5c657d45e2ac8e1bdda8945ba0176d012a5c10dc3b0504bed890c8a6a3451397
SHA3-384 hash:	101f08c38a760301bb84c428330d4955323c201679686bcc7f9647a28b36c40845b2859cf2a1051934a7592471e3fc05
SHA1 hash:	dc0b3853afa441dfd17ad0169efdd70bc46eab0a
MD5 hash:	5eb308b2d4f3c52b3e78b86874f9fedb
humanhash:	ten-idaho-emma-fillet
File name:	lilin.sh
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	618 bytes
First seen:	2025-07-03 11:50:57 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	12:bIbXPD3pCVPDN+/I/PN7KFPDrPDEPYKz2LYKzM2YKztYKzl:0LpCV5+/I/V7enczmzMQzVzl
TLSH	T173F0A277F178C881A8070D1E30C5C228B8E7C2B415D7EF4CEC9F9525C48861D7022B9C
Magika	shell
Reporter	abuse_ch
Tags:	sh

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

19

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Linux.Downloader-36.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68666ec0900df8e7f8661cb9linux22vpnfull_triage

Tags:

downloader mirai agent virus

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/a44054c6-b635-436e-9425-1930c49c0ae9

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

91%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/5c657d45e2ac8e1bdda8945ba0176d012a5c10dc3b0504bed890c8a6a3451397

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/5c657d45e2ac8e1bdda8945ba0176d012a5c10dc3b0504bed890c8a6a3451397/

Neiki downloader.bashdlod/gen2

Verdict:

Malicious

Threat:

downloader.bashdlod/gen2

Link:

https://tip.neiki.dev/file/5c657d45e2ac8e1bdda8945ba0176d012a5c10dc3b0504bed890c8a6a3451397

ReversingLabs TitaniumCloud Document-HTML.Trojan.Multiverze

Threat name:

Document-HTML.Trojan.Multiverze

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-07-03 11:37:38 UTC

File Type:

Text (Shell)

AV detection:

12 of 24 (50.00%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=lrsx2rpcvshbxxnisrn2af3naevfyeg4hmcqjpwysdekni2fcolq._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

credential_access defense_evasion discovery linux

Link:

https://tria.ge/reports/250703-n1bspawzgy/

Behaviour

Reads runtime system information

Writes file to tmp directory

Changes its process name

Reads system network configuration

Reads process memory

Reads MAC address of network interface

Reads system routing table

File and Directory Permissions Modification

Executes dropped EXE

Renames itself

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.31

Link:

https://yomi.yoroi.company/submissions/5c657d45e2ac8e1bdda8945ba0176d012a5c10dc3b0504bed890c8a6a3451397