MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7ec75133a89b2d89f7cd51046f66a0fc6543ba005c590315daacabe78ecd85fa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 4

Intelligence 4 IOCs YARA 1 File information Comments

SHA256 hash:	7ec75133a89b2d89f7cd51046f66a0fc6543ba005c590315daacabe78ecd85fa
SHA3-384 hash:	62143f83b134b7144a24fc13fdf7c775231f215795303c8886966253ba685e6ee3eba9b5912f198d8946aed1edaa2342
SHA1 hash:	c91cbbd985999815927ed0a6be5c644efeb6987e
MD5 hash:	5e1b995cae7931602c55c55a103d1569
humanhash:	four-edward-mobile-apart
File name:	w.sh
Download:	download sample
File size:	3'282 bytes
First seen:	2026-01-25 00:52:42 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	96:vi3vCBy+k656LGn92YZCBAf7ZV3q4jfDi:vi3K0WZA2r8
TLSH	T18C614DF9BA70A130B2084DECF025D49C7CA358BF11702B351CEA9DB1C3AD96C915667D
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://77.42.21.37/systemcl/arc	fb73d8b20485136882c270df6fc64b7499dd9af4c1361bb8893f6ff827e8926d	Mirai	elf mirai ua-wget
http://77.42.21.37/systemcl/arm	0ebf87b4e6f9225a6062947618de49be2a4cdb146e9b68c07056d2fa0c91f16b	Mirai	32-bit elf mirai Mozi
http://77.42.21.37/systemcl/arm5	dfd8a925739e4df860e83995e0625d562ec32ab5f7b338b204a30939b2019f3e	Mirai	elf mirai ua-wget
http://77.42.21.37/systemcl/arm6	ad083a1f9186ffc38fbd148fe515812a7ccc82f410ac74ed6ac7fbd88f135ac3	Mirai	elf mirai ua-wget
http://77.42.21.37/systemcl/arm7	fa67b277479419302ccc82d5862c7c47723de5185f5798c3f21befbc0e26af9f	Mirai	elf mirai ua-wget
http://77.42.21.37/systemcl/i486	n/a	n/a	elf ua-wget
http://77.42.21.37/systemcl/m68k	3c4697891ad492001f880868fe557f2b1b4627ec60a2058e6ffa57bd5934243c	Mirai	elf mirai ua-wget
http://77.42.21.37/systemcl/mips	a4d03d28364c3c527fb20f3cf9984f78abaef31182f25e106cf7bffb2094cdef	Mirai	32-bit elf mirai Mozi
http://77.42.21.37/systemcl/mpsl	e5fa9517ae35e916913e60115a385e0173239103f707688804b299ddf5c3ec36	Mirai	elf mirai ua-wget
http://77.42.21.37/systemcl/ppc	9e74dc5377747bdd06bd70cbcb4325e0218a8dd31f66dcccfa41069b7a11ca00	Mirai	elf mirai ua-wget
http://77.42.21.37/systemcl/ppc440	n/a	n/a	elf ua-wget
http://77.42.21.37/systemcl/sh4	105e02593bad28306e810b5c3ccfd4f3c76d8b1bb33e0dba4540381289ab8bda	Mirai	elf mirai ua-wget
http://77.42.21.37/systemcl/spc	911f54971bce91bd384ad1e66296f0baab373b3bfdba78a21baa0b6fd1f7f358	Mirai	elf mirai ua-wget
http://77.42.21.37/systemcl/x86	b1eca05ac8f0dca29557632c95eab45b6cdedd3a594cc28c6d94ce8f7ef37bba	Mirai	32-bit elf mirai Mozi
http://77.42.21.37/systemcl/x86_64	27968814839edb77bd46fe35bb64115b75985e9069a045b86f1dd73ade0d2de6	Mirai	elf mirai ua-wget
http://77.42.21.37/systemcl/x86_32	60246e66a15265caf6b8d57f52e17f1f58f33498944d18dede0b91b8d4ebd087	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

Sanesecurity.Malware.32160.LX.BOT.UNOFFICIAL

Result

Gathering data

Verdict:

Clean

File Type:

unix shell

Link:

https://opentip.kaspersky.com/7ec75133a89b2d89f7cd51046f66a0fc6543ba005c590315daacabe78ecd85fa/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/7013ba68-af3c-45f8-8602-cc33c16bb857

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/7ec75133a89b2d89f7cd51046f66a0fc6543ba005c590315daacabe78ecd85fa

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/7ec75133a89b2d89f7cd51046f66a0fc6543ba005c590315daacabe78ecd85fa/

Verdict:

Clean

Link:

https://tip.neiki.dev/file/7ec75133a89b2d89f7cd51046f66a0fc6543ba005c590315daacabe78ecd85fa

Threat name:

Script-Shell.Worm.Mirai

Status:

Malicious

First seen:

2026-01-25 00:53:12 UTC

File Type:

Text (Shell)

AV detection:

12 of 36 (33.33%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=p3dvcm5itmwyt56nkecg6zva7rsuhoqalrmqgfo2vsv6pdwnqx5a._file

Result

Malware family:

n/a

Score:

1/10

Tags:

linux

Link:

https://tria.ge/reports/260125-a8svaaby5d/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/7ec75133a89b2d89f7cd51046f66a0fc6543ba005c590315daacabe78ecd85fa

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh