MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7134cbfe70583aeb8673bc8c6f0e6b4966c0117c5c9820fc2d32535bb2f4e649. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	7134cbfe70583aeb8673bc8c6f0e6b4966c0117c5c9820fc2d32535bb2f4e649
SHA3-384 hash:	5666d7e731e7a9dbb521b7674337ceb973b8fc117bece5e2d4c58cd1bb1cc80051069629df472c8d4f77db0e055e9d9d
SHA1 hash:	21b8efeb37326ebc1eb4c53e5858367356f3ebd5
MD5 hash:	3ce804e1d1eea25e4998b1e11e9335f1
humanhash:	michigan-massachusetts-stairway-zebra
File name:	lterouter
Download:	download sample
File size:	5'027 bytes
First seen:	2026-08-28 07:55:31 UTC
Last seen:	2026-08-28 13:05:20 UTC
File type:	sh
MIME type:	text/plain
ssdeep	96:Ugjo5XCBq1yI8qL2QiUFu8eC6ByrXQD01gCGsLEmi+FI8cJtaVGXD8v1Hp9ZLko3:Ugjo5XCBq1yI8425IZeC6ByrXQD01gC9
TLSH	T1D2A1659E1BB69201CA887E7074FF21C850E3578526A40E2DF6D6EC71D88B9C1F17EB19
Magika	csv
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://160.119.71.134/n2/aarch64	0f0111f70ed0f619d5a47744dd319ba00312bee71f545e51e1c5e754df837d5b	Mirai	elf mirai ua-wget
http://160.119.71.134/n2/armv4l	98c3a5f5142672e5206dbe7c7858541f215686cf836a11ce729763de21db96f2	Mirai	elf mirai ua-wget
http://160.119.71.134/n2/armv5l	e02b22dbb4074aa2aef9f606d7b86808f882ab9752dadd18bc486176d4c99da9	Mirai	elf mirai ua-wget
http://160.119.71.134/n2/armv6l	e32122ad84f511843008e2d7f8c1f3f80df5f38ded4e7e3ae56bddefad0d6d11	Mirai	elf mirai ua-wget
http://160.119.71.134/n2/armv7l	d2ae3982f07f89253b21d45321e97f57b4b81c78164c2504b2578958ca186362	Mirai	elf mirai ua-wget
http://160.119.71.134/n2/m68k	a7fee620e24fadf8042fa7cab43301d0cb3c49fb29d8184c7b2649b565a197d4	Mirai	elf mirai ua-wget
http://160.119.71.134/n2/mips64	a9cf1a5bfb3a15b9e9e114dc22267d3ef75d373abb6aa8ff663d3fc5558825a5	Mirai	elf mirai ua-wget
http://160.119.71.134/n2/mips64l	d1ba4a0f0518577fcfecfd8136cca2b460337022504f442bc8e8351764200a30	Mirai	elf mirai ua-wget
http://160.119.71.134/n2/mips64b	18e997dcfec0942bacb3c31725d76a83f824dc5c6b1810c95c53266a6c91c7d3	Mirai	elf mirai ua-wget
http://160.119.71.134/n2/ppc	dc4a18a63af8a3dffb52f60e93e229fa8bf3fef9e5f8cab98e0e0748adf13842	Mirai	elf mirai ua-wget
http://160.119.71.134/n2/sh4	bb5c1edcefe73120769c5e8ac1f518641c99eb07e1789e12ab54434c9e98973b	Mirai	elf mirai ua-wget
http://160.119.71.134/n2/mips	6754b6bc55c6843c6730d1204d4fd442e2f040e89d9fb7e2084555aa8f9249f4	Mirai	elf mips mirai ua-wget
http://160.119.71.134/n2/mpsl	6cc212883df2861669b9b61feeb9b7735fbadc81093f20feea95612375f87d64	Mirai	elf mips mirai ua-wget
http://160.119.71.134/n2/x86_64	c5dd9e8c0208ef12b84edbb57362e2a07c5c0bf94b581036411dfa55962b6129	Mirai	elf mirai ua-wget
http://160.119.71.134/n2/x86	4edf0f15b4bc5919472a932858d8c1d21540b28e0dfc2e560227b4b52a303908	Mirai	elf mirai ua-wget
http://160.119.71.134/n2/xtensa	ba01adf83586c9d32cc0ba0c35ee23216cf51862c2af46dae4eb8e944bcaaefc	Mirai	elf mirai ua-wget
http://160.119.71.134/n2/sparc	2713443f82e94c2ccb500e851e3dcebd9173a6faf5348e25366c800d45c73825	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

221

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

downloader evasive

Link:

https://www.filescan.io/uploads/6a9187c70ce17dd267155760/reports/e053cb5e-6ef1-4a47-85b0-4671f01b9e46/overview

Verdict:

Malicious

File Type:

text

First seen:

2026-08-28T05:17:00Z UTC

Last seen:

2026-08-29T20:13:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/7134cbfe70583aeb8673bc8c6f0e6b4966c0117c5c9820fc2d32535bb2f4e649/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/383fc0fc-ea26-4def-ba05-ae9f5a12a16c

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/7134cbfe70583aeb8673bc8c6f0e6b4966c0117c5c9820fc2d32535bb2f4e649

Gathering data

Threat name:

Linux.Downloader.Generic

Status:

Suspicious

First seen:

2026-08-28 13:06:18 UTC

File Type:

Text (Shell)

AV detection:

12 of 36 (33.33%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=oe2mx7tqla5oxbttxsgg6dtljftmael4lsmcb7bngjjvxmxu4zeq._file

Result

Malware family:

n/a

Score:

3/10

Tags:

execution

Link:

https://tria.ge/reports/260828-qb6ymsyale/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Executes a command shell one-liner

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/7134cbfe70583aeb8673bc8c6f0e6b4966c0117c5c9820fc2d32535bb2f4e649

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh