MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7ae77b6447c720de0cf06bae39e6f5c447a403fd636675f31bdd8f878e47b556. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 6

Intelligence 6 IOCs YARA 2 File information Comments

SHA256 hash:	7ae77b6447c720de0cf06bae39e6f5c447a403fd636675f31bdd8f878e47b556
SHA3-384 hash:	dd13637279d1c2c4461b0fe4f8e51f59a6c992cfbdf72a392f297145c48da8dbad18309b90dd271b6e8b8f82e2ff06df
SHA1 hash:	56015efac942b83ba6f8067714ff524f97aedf29
MD5 hash:	b1449637f0c8a4b116777c43bc1aa46b
humanhash:	yankee-sweet-north-two
File name:	wget.sh
Download:	download sample
File size:	2'097 bytes
First seen:	2025-05-23 14:37:17 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	24:wCnvnCucZC9b95CAyAC9CADARRVCA6bA6ZTCARAzvCewCIOI2EwC9Y/u2:wWn8+55N9C9NsRPNPYTNCzvmoxu2
TLSH	T1304160D6138233726C55992E36B6494C78E0B4A767E31F0495DD38F8825CE0DB662F72
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://92.112.124.247/bins/navo.x86	bdb702657db4a6fb1616b42e6a2cd457a76e48e866edeea479be35711b518447	Mirai	censys elf mirai opendir ua-wget
http://92.112.124.247/bins/navo.mips	d06165b8132be657be9e85cc65cc5f2d701656d9ed3f0250defc4d0746c7927b	Mirai	censys elf mirai opendir ua-wget
http://92.112.124.247/bins/navo.mpsl	741ba2d53d54dc42195da1268d8680ab395f74d79bb90710910d9d597fc7b152	Mirai	censys elf mirai opendir ua-wget
http://92.112.124.247/bins/navo.arm	c3c2ed4c2a13f3244b9ad4f21816703bb5bddb7aa8505888c838c2a7eece9dbe	Mirai	censys elf mirai opendir ua-wget
http://92.112.124.247/bins/navo.arm5	fa7577577f7cee474d3276a04db1543b3bdb1bba1ca7a05262f67588360ee077	Mirai	censys elf mirai opendir ua-wget
http://92.112.124.247/bins/navo.arm6	cdd280215ecf04e93af5a7bb70005d71bf860a52bff3e691135d585eff09bcc5	Mirai	censys elf mirai opendir ua-wget
http://92.112.124.247/bins/navo.arm7	d338e32bb255f02484b9a24117a0cc0fbc151eed3bb690a83b14f015dd757811	Mirai	censys elf mirai opendir ua-wget
http://92.112.124.247/bins/navo.ppc	db3d12a2e4ebbffe25f4088c934f8d51feb3b50c435086bbe80459edf5d8e2c7	Mirai	censys elf mirai opendir ua-wget
http://92.112.124.247/bins/navo.m68k	17d4ee1b8bac608dc2e6333a73a145509392fc65f2700c327405033a6f352bdf	Mirai	censys elf mirai opendir ua-wget
http://92.112.124.247/bins/navo.sh4	c89055af96171ca11e02cda5da78991bc1d496ce0f15df3d9709fc52e7cebd20	Mirai	censys elf mirai opendir ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL

Verdict:

Malicious

Score:

91.7%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6830890b4912a6b9dd4c72d4linux22vpnfull_triage

Tags:

trojandownloader agent

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/7ae77b6447c720de0cf06bae39e6f5c447a403fd636675f31bdd8f878e47b556

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/7ae77b6447c720de0cf06bae39e6f5c447a403fd636675f31bdd8f878e47b556/

Threat name:

Linux.Downloader.Morila

Status:

Malicious

First seen:

2025-05-23 14:37:35 UTC

File Type:

Text (Shell)

AV detection:

23 of 38 (60.53%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=pltxwzchy4qn4dhqnoxdtzxvyrd2ia75mnthl4y33whypdshwvla._file

Result

Malware family:

n/a

Score:

1/10

Tags:

linux

Link:

https://tria.ge/reports/250523-rzfa9sxjy3/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/7ae77b6447c720de0cf06bae39e6f5c447a403fd636675f31bdd8f878e47b556

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.