🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9f27db82076a01e92cd9aaf415d86f1789352e288c3d1f1b4f5e4383a2a47653. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9f27db82076a01e92cd9aaf415d86f1789352e288c3d1f1b4f5e4383a2a47653
SHA3-384 hash: e834d32a3dfcf04c30665395c4890c60ff2e9b7560fb6452d119705f5b62a6c08b922f8530125683852432734e6befd6
SHA1 hash: 56d5031bdf530d22566c5c9637c2db1245728a2d
MD5 hash: 4cdef51c5a01fab1caf632805fab56bd
humanhash: indigo-california-avocado-west
File name:9f27db82076a01e92cd9aaf415d86f1789352e288c3d1f1b4f5e4383a2a47653.sh
Download: download sample
File size:7'779 bytes
First seen:2026-09-20 05:18:47 UTC
Last seen:2026-09-21 02:25:42 UTC
File type: sh
MIME type:text/plain
ssdeep 96:cLuP3B67IBZIBuIBvMIBoItIiIImzATzAOezAnzA4zAAzAgHfZ8U2:cLu567q9vD8n4oxK6tXfU
TLSH T17EF1C57025F08D732E21AA80B3372BA5ABB7D95745E7218C36DE1D265F86B12B0FF411
Magika xml
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://185.225.74.161/ahn/an/an/a
http://38.6.178.140/easy_cloud.shn/an/an/a
http://154.9.30.146/srb.shn/an/aelf mirai
http://193.243.147.115/avTECHbfb53568a2c7b74606886f9b1a535fe582a41c5d73149302e1c8331ea76c323f NgiowebNgioweb ua-wget
http://107.189.1.200/2.sh3b1294e989efd51c9e373b06f5548ebd176910eb311bba61333f3f76ccd46751 Miraimirai sh ua-wget
http://103.145.106.96/bins/1.shn/an/abotnet iot mirai
http://zuoye.free.fr/files/av.pngn/an/an/a

Intelligence

File Origin
# of uploads :
3
# of downloads :
59
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive
Link:
https://www.filescan.io/uploads/6aaf6cd73b712614a1e98202/reports/5e327311-69e8-477b-8a4c-19310564bfe4/overview
Verdict:
Unknown
File Type:
text
Link:
https://opentip.kaspersky.com/9f27db82076a01e92cd9aaf415d86f1789352e288c3d1f1b4f5e4383a2a47653/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/5a3e88ff-d84c-43ce-8575-133ef728d175
Behavior Graph:
Download SVG
%3 guuid=f98803f3-1b00-0000-a6d9-e7091b090000 pid=2331 /usr/bin/sudo guuid=139407f5-1b00-0000-a6d9-e70922090000 pid=2338 /tmp/sample.bin guuid=f98803f3-1b00-0000-a6d9-e7091b090000 pid=2331->guuid=139407f5-1b00-0000-a6d9-e70922090000 pid=2338 execve
Score:
0%
Verdict:
Benign
File Type:
SCRIPT
Link:
https://malprob.io/report/9f27db82076a01e92cd9aaf415d86f1789352e288c3d1f1b4f5e4383a2a47653
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9f27db82076a01e92cd9aaf415d86f1789352e288c3d1f1b4f5e4383a2a47653/
Threat name:
Script-BAT.Trojan.Multiverze
Create hunting rule
Status:
Malicious
First seen:
2026-09-20 05:19:22 UTC
File Type:
Text (Shell)
AV detection:
9 of 38 (23.68%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=t4t5xaqhnia6slgzvl2blwdpc6etklrirq6r6g2plzbyhiveozjq._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
execution
Link:
https://tria.ge/reports/260920-fzyxtsself/
Behaviour
Modifies registry class
Suspicious use of SetWindowsHookEx
Enumerates physical storage devices
Executes a command shell one-liner
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/9f27db82076a01e92cd9aaf415d86f1789352e288c3d1f1b4f5e4383a2a47653

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:LIN_Downloader_Unknown_WgetChmodExecute
Create hunting rule
Author:Marjoriefort
Description:Script shell downloader : wget+curl, chmod 777, execution, effacement (rm -rf) - botnet style
Reference:misses_archive / grappe 5.182.210.174
Rule name:SCRIPT_Downloader_Unknown_AVTECH_ConfigInject
Create hunting rule
Author:Marjoriefort
Description:Config camera/routeur (format AVTECH) avec injection downloader : wget http:// + chmod 7 + sh dans un champ Password
Reference:Veille glissante 2026-09-17_18 / grappe 8 configs

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 9f27db82076a01e92cd9aaf415d86f1789352e288c3d1f1b4f5e4383a2a47653

(this sample)

007f065e58d07a799a21a2849a3907334abca1a31392e638d9343126079ca9b5

  
URLhaus
https://urlhaus.abuse.ch/url/3783397/
  
Delivery method
Distributed via web download
  
Dropping
MD5 c488c5f8367ad4612d371973e8aed705
  
Dropping
SHA256 007f065e58d07a799a21a2849a3907334abca1a31392e638d9343126079ca9b5

Comments