MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 88520fc501d166eba13a67657c090e803b868007679c01b9bcd98900a5b75b09. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 5

Intelligence 5 IOCs YARA 1 File information Comments

SHA256 hash:	88520fc501d166eba13a67657c090e803b868007679c01b9bcd98900a5b75b09
SHA3-384 hash:	4f8057933392ab2071f21b264de54544c028e67822e35c2c66da054737222607763e853df29e072b919820a5256c596a
SHA1 hash:	37133627a994a37fc4ae81062e1f2daea67444bc
MD5 hash:	fd1aac562e2709072a4fef5ad13c72b0
humanhash:	fourteen-illinois-lima-paris
File name:	bins.sh
Download:	download sample
File size:	1'389 bytes
First seen:	2026-10-05 06:27:59 UTC
Last seen:	2026-10-05 19:20:29 UTC
File type:	sh
MIME type:	text/x-shellscript
ssdeep	24:vOn5gyEOn2rOnPMvPWHsOnKrOnrUOnTwOnq/On/WJOnKjOn4TOn5Mm:vOfEO2rO8+MOKrOrUOEOkO/UO4OoO5x
TLSH	T16821ACD721D30974ACE5D963316A4C1871E1A08708CA7F85FEEC38F9488DE447059B93
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://146.19.198.131/ntpd	a23686eecb67c17371393bfd7dd5480ee1b07f5f07a061c1d71f8c5f49d84c67	Gafgyt	elf gafgyt ua-wget
http://146.19.198.131/sshd	5b9c569ed427882d17d347ed511ce60e1a20f5876609e14eba6e44423ccc33d9	Gafgyt	elf gafgyt ua-wget
http://146.19.198.131/openssh	1dc37e8413a51944538b79eb66ccefe9d79265faa1d3c61a2d43f218a45633bd	Gafgyt	elf gafgyt ua-wget
http://146.19.198.131/bash	845ed2ec2c004bb7984cfd378401d6733a49b5b3a377498d2e900b86a8bc17ef	Gafgyt	elf gafgyt ua-wget
http://146.19.198.131/wget	d1512d32e201a11a71e0dfde80d53794992925a8886065d1fd44aeb46bd0a653	Gafgyt	elf gafgyt ua-wget
http://146.19.198.131/cron	64a88cfc1298f0b1133d0406c886b785353354229351fa3f682d37bf7ea004e3	Gafgyt	elf gafgyt ua-wget
http://146.19.198.131/ftp	69725001be9a372fcd6036b03a48f162005ec7eb3003b07bcf94a190e07c6f7f	Gafgyt	elf gafgyt ua-wget
http://146.19.198.131/pftp	d7194f37d79c9cab3807f66fbc7d9256aac67760acefb5c326c67215dcaacdbb	Gafgyt	elf gafgyt ua-wget
http://146.19.198.131/sh	e3b92a7a862b5dff786e1884368b1cf2b27d7ecefe47176a81e43ea21f61dc06	Gafgyt	elf gafgyt ua-wget
http://146.19.198.131/apache2	04e7fdea2b3b477690916242f19bd5f772b5fb7f622b69588c885f68d693e898	Gafgyt	elf gafgyt ua-wget
http://146.19.198.131/telnetd	acc414985ce162463f6d5fe873d3bfbe723206121c4da0d3ce565cd89cfd23c0	Gafgyt	elf gafgyt ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

Gathering data

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-10-05T03:59:00Z UTC

Last seen:

2026-10-06T19:47:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/88520fc501d166eba13a67657c090e803b868007679c01b9bcd98900a5b75b09/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/86440a6e-d152-4287-a85d-d3c3f9b65b0e

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/88520fc501d166eba13a67657c090e803b868007679c01b9bcd98900a5b75b09

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/88520fc501d166eba13a67657c090e803b868007679c01b9bcd98900a5b75b09/

Threat name:

Linux.Downloader.Morila

Status:

Malicious

First seen:

2026-10-05 06:29:46 UTC

File Type:

Text (Shell)

AV detection:

17 of 24 (70.83%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=rbja7rib2ftoxij2m5sxycioqa5ynaahm6oadon43geqbjnxlmeq._file

Result

Malware family:

n/a

Score:

7/10

Tags:

defense_evasion discovery linux

Link:

https://tria.ge/reports/261005-g8k8rsvhlc/

Behaviour

Writes file to tmp directory

Changes its process name

Reads system network configuration

Reads system routing table

File and Directory Permissions Modification

Executes dropped EXE

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.36

Link:

https://yomi.yoroi.company/submissions/88520fc501d166eba13a67657c090e803b868007679c01b9bcd98900a5b75b09

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.