MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ad4bd5691c35f58e93d2cbdbb8521b351f91753f691112d4879b33ac4caa6bfc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	ad4bd5691c35f58e93d2cbdbb8521b351f91753f691112d4879b33ac4caa6bfc
SHA3-384 hash:	eadf539bd40df9695237932a27837813eaf1a7e13b2d56a1c48a16c9819308681fd3020b6a878e2c4cc8ce35136ab326
SHA1 hash:	62411dcf94be3c1509710d6e8093126c89a46b94
MD5 hash:	2d379f2cbae7386a92fec888398d07f9
humanhash:	arizona-muppet-lion-west
File name:	r
Download:	download sample
File size:	971 bytes
First seen:	2025-04-22 15:22:06 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	12:3rWKIw+u5ZMoOF7+MB05FMLZDzMiDNkB9MxCzMxRDNkB9KOzKNDNkB9HyTzHygDB:yRk5zOt+MB02Z1kBokB8kBEkBa
TLSH	T1FA11D3DF40A88C21E4429DED76938954E5CDC5DA2EC9CE85649E413BB8CCB0E3892F59
Magika	txt
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://82.24.200.71/vv/mips	n/a	n/a	elf gafgyt ua-wget
http://82.24.200.71/vv/mipsel	a49f50fdba0de9c330d0980f6cce815c1525d0800adeab6c3d82a7954923ef02	Mirai	elf gafgyt mirai ua-wget
http://82.24.200.71/vv/armv4l	35c14500814ac5bc2c71312bb1323f3be34afa878c7f06cefb0bf26f983564db	Mirai	elf gafgyt mirai ua-wget
http://82.24.200.71/vv/armv7l	200e571bc0a6d2562563022dfcc60ac5ac8c2e40eb73a053be8555349a674a69	Mirai	elf gafgyt mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6807b55ea37ff28e12980d4flinux22vpnfull_triage

Tags:

agent hype sage

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/6807b42990767142c3e00f71/reports/3bd5b8bf-e1a6-4c8c-b357-fb264d4b407d/overview

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/ad4bd5691c35f58e93d2cbdbb8521b351f91753f691112d4879b33ac4caa6bfc

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ad4bd5691c35f58e93d2cbdbb8521b351f91753f691112d4879b33ac4caa6bfc/

Threat name:

Linux.Downloader.Generic

Status:

Suspicious

First seen:

2025-04-22 15:24:19 UTC

File Type:

Text (Shell)

AV detection:

5 of 38 (13.16%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=vvf5k2i4gx2y5e6szpn3quq3gupzc5j7neirfvehtmz2ytfknp6a._file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/250422-ss6ejstkt9/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/ad4bd5691c35f58e93d2cbdbb8521b351f91753f691112d4879b33ac4caa6bfc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.