MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b1a84cfd4176a472e319ee7733e55998ae69b9752fd26f8c853cefd836a477b9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 4

Intelligence 4 IOCs YARA 1 File information Comments

SHA256 hash:	b1a84cfd4176a472e319ee7733e55998ae69b9752fd26f8c853cefd836a477b9
SHA3-384 hash:	c608ad6e9dbab3715656e7cbfda3cbdd7603e504c67dafec67d564ae3b7fc7dfbaa0226cb70222a788ad5d29bc838890
SHA1 hash:	57e64e12b878922a9f8b30ab28e89fc012b25dce
MD5 hash:	ef38b770bef2edfe47529229264fde1e
humanhash:	floor-lactose-beryllium-spring
File name:	loader.sh
Download:	download sample
File size:	1'969 bytes
First seen:	2026-10-29 01:01:05 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:8VdxxzGG1eCFeZdzVKN5Q1f/neHuDmmlBFInKIYgQAul4N7vGxQ:2dnIu2mQlGaL2nKI3QaTGC
TLSH	T17C41BDCA7AA3D97197C7C4391FDAE101E35624430995A998B09EBC303F6D120FCB1E57
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	adliwahid

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Adware

File Type:

unix shell

First seen:

2026-10-28T20:47:00Z UTC

Last seen:

2026-10-30T19:32:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/b1a84cfd4176a472e319ee7733e55998ae69b9752fd26f8c853cefd836a477b9/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/88d3d4d1-d92c-4f7e-bd0d-0f057158a29c

Behavior Graph:

Download SVG

Score:

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/b1a84cfd4176a472e319ee7733e55998ae69b9752fd26f8c853cefd836a477b9

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b1a84cfd4176a472e319ee7733e55998ae69b9752fd26f8c853cefd836a477b9/

Threat name:

Linux.Trojan.Multiverze

Status:

Malicious

First seen:

2026-10-29 01:01:25 UTC

File Type:

Text (Shell)

AV detection:

13 of 38 (34.21%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=wguez7kbo2shfyyz5z3thzkztcxgtolvf7jg7defhtx5qnveo64q._file

Result

Malware family:

n/a

Score:

7/10

Tags:

defense_evasion discovery execution linux persistence privilege_escalation upx

Link:

https://tria.ge/reports/261029-bddybagt7s/

Behaviour

Enumerates kernel/hardware configuration

Reads runtime system information

Writes file to shm directory

Writes file to tmp directory

UPX packed file

Creates/modifies Cron job

Enumerates running processes

File and Directory Permissions Modification

Executes dropped EXE

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.42

Link:

https://yomi.yoroi.company/submissions/b1a84cfd4176a472e319ee7733e55998ae69b9752fd26f8c853cefd836a477b9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	LIN_Downloader_Botnet_KernelNames_MultiArch Create hunting rule
Author:	Marjoriefort
Description:	Downloader botnet ELF multi-archi - binaires deguises en taches kernel Linux, C2 IP en clair

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample