MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b12e3b32bdf9b4611cf49382fc95dcc37dc906990fc176a8ccf69636458d6a12. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

DDoSAgent

Vendor detections: 6

Intelligence 6 IOCs YARA 2 File information Comments

SHA256 hash:	b12e3b32bdf9b4611cf49382fc95dcc37dc906990fc176a8ccf69636458d6a12
SHA3-384 hash:	453b2cb13ff392a18bda4a653b1e3129022c1778a8df3686423c8a13a27f3a8137fa0dc31d588c51da4441dbb23c7508
SHA1 hash:	93e86f4a175b39ddd85495bd8385257de9234b6b
MD5 hash:	1e7083e7aeabd141a0a3f3799b32e0a9
humanhash:	april-mobile-eight-colorado
File name:	phantom_bash.sh
Download:	download sample
Signature	DDoSAgent Create hunting rule
File size:	536 bytes
First seen:	2026-08-06 05:36:54 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	6:IOnFflR0mvwd+n2GvwdKNd9UFovwiGvw59UFovwRE2GvwRg9t:IYn27YNdii75il7aX
TLSH	T1E2F03085FB14E9336507CE9733A803305747B8FAA4C31656AC627D9A18C9AC97407EB5
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://94.154.43.214/phantom_bins/phantom.x86_64	7326662e29abdd3dc8cedb6adb0fe394b111221e18ee24c14d2c15dd85abc1a3	DDoSAgent	DDoSAgent elf ua-wget x86
http://94.154.43.214/phantom_bins/phantom.arm	n/a	n/a	arm elf ua-wget
http://94.154.43.214/phantom_bins/phantom.mips	925216bc36653e4fc476bccf970e1a88122c9867f431f83ec7eeb3c6115d459a	DDoSAgent	DDoSAgent elf mips ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

evasive

Link:

https://www.filescan.io/uploads/6a741da0f0ac55b2041cc1de/reports/ca245962-fcba-4e15-8c16-7d21060a9b0d/overview

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-08-06T00:38:00Z UTC

Last seen:

2026-08-07T22:22:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan-Downloader.Shell.Agent.p

Link:

https://opentip.kaspersky.com/b12e3b32bdf9b4611cf49382fc95dcc37dc906990fc176a8ccf69636458d6a12/results?tab=lookup

Status:

Failed

Link:

https://sandbox.kunai.rocks/analysis/3380eba3-da6e-4126-be07-eb69fc6caa15

Score:

93%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/b12e3b32bdf9b4611cf49382fc95dcc37dc906990fc176a8ccf69636458d6a12

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b12e3b32bdf9b4611cf49382fc95dcc37dc906990fc176a8ccf69636458d6a12/

Threat name:

Linux.Downloader.Generic

Status:

Suspicious

First seen:

2026-08-06 05:38:37 UTC

File Type:

Text (Shell)

AV detection:

12 of 24 (50.00%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=wexdwmv57g2gchhusobpzfo4yn64sbuzb7axnkgm62ldmrmnnija._file

Result

Malware family:

n/a

Score:

7/10

Tags:

antivm defense_evasion discovery linux

Link:

https://tria.ge/reports/260806-gbepqaek2s/

Behaviour

Enumerates kernel/hardware configuration

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Checks CPU configuration

File and Directory Permissions Modification

Executes dropped EXE

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.39

Link:

https://yomi.yoroi.company/submissions/b12e3b32bdf9b4611cf49382fc95dcc37dc906990fc176a8ccf69636458d6a12

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Linux_Shellscript_Downloader Create hunting rule
Author:	albertzsigovits
Description:	Generic Approach to Shellscript downloaders

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh