MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b43891483e082ae72eb4c535dd885002b7feab1d74640468a863fe21b4bc0083. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	b43891483e082ae72eb4c535dd885002b7feab1d74640468a863fe21b4bc0083
SHA3-384 hash:	9186f434decf6605b7dfe5dae4ad263cd1322a0c3dfeead54a4913f92674e7bb9e1ae27acc8551b47aa7cc930de9a316
SHA1 hash:	aa76488843e5af239d24ec174f6ee220d5d515ba
MD5 hash:	7dce8b6be746d0f11ef118f761cc8cfd
humanhash:	pennsylvania-july-march-november
File name:	lil
Download:	download sample
File size:	705 bytes
First seen:	2025-02-19 16:26:44 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	12:sXOsYxPC7JlqZ1ZUJZI4WAdp4NgeDF5EYggFYxc0q7:sXCZG+1ZuZI4Wup4CeDF5dgAYG0q7
TLSH	T103017BEA80540E21A150997C36D364D9B49083CB0D0EDF54BE7F0C3EFF88629B878A94
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://83.150.218.193/g	n/a	n/a	sh ua-wget
http://83.150.218.193/g2	n/a	n/a	elf
http://83.150.218.193/g3	n/a	n/a	elf
http://83.150.218.193/g6	n/a	n/a	elf

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67b60812a0fd713c335bc9f4linux22vpnfull_triage

Tags:

agent hype sage

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

evasive

Link:

https://www.filescan.io/uploads/67b6079b25fbbe92dbdf5068/reports/9a299fcb-cbfd-49b5-9223-5aa07766ca4a/overview

Result

Verdict:

UNKNOWN

Score:

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/b43891483e082ae72eb4c535dd885002b7feab1d74640468a863fe21b4bc0083

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b43891483e082ae72eb4c535dd885002b7feab1d74640468a863fe21b4bc0083/

Threat name:

Win32.Trojan.Generic

Status:

Malicious

First seen:

2025-02-19 16:29:26 UTC

File Type:

Text (Shell)

AV detection:

7 of 36 (19.44%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=wq4jcsb6bavoolvuyu253ccqak375ky5orsai2fimp7cdnf4acbq._file

Result

Malware family:

n/a

Score:

7/10

Tags:

defense_evasion discovery linux

Link:

https://tria.ge/reports/250219-tzee3swm13/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Changes its process name

Reads system network configuration

Enumerates active TCP sockets

Enumerates running processes

File and Directory Permissions Modification

Executes dropped EXE

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/b43891483e082ae72eb4c535dd885002b7feab1d74640468a863fe21b4bc0083

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.