MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b524ca7cbafab904d0090fa29ebb79941c65ec1c42011aa234cc33f6d47cfdbe. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Prometei

Vendor detections: 8

Intelligence 8 IOCs YARA 2 File information Comments

SHA256 hash:	b524ca7cbafab904d0090fa29ebb79941c65ec1c42011aa234cc33f6d47cfdbe
SHA3-384 hash:	2d5e80fa6b8ccd4647cab1770d43704b44ee43f66fdc230704173fe3d286b737ee98b9f68b403f8ad11529d37c485e56
SHA1 hash:	e32341cfb0aa624c444ddc823c14f0fc329c6965
MD5 hash:	449633cd5ba6fe0ab0635bb8027acc89
humanhash:	ten-romeo-king-summer
File name:	b524ca7cbafab904d0090fa29ebb79941c65ec1c42011aa234cc33f6d47cfdbe
Download:	download sample
Signature	Prometei Create hunting rule
File size:	1'646 bytes
First seen:	2026-06-05 05:26:22 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	12:q0FgsV0Fg20FXc43fX0FCneekX0Fstk0Fs7Cd0FkaX0FaK1FZ0FkuGEX0Fgm0Fjr:vgs+gjXc4kCnasMwzsaK++EsgTCJlG7
TLSH	T1D031A4CA32F10A70ADA0A927726EC80070E6F5CB19CA5FD87CDD39F6418DF497001AA3
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	c2hunter
Tags:	Prometei sh wraith

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://46.23.108.238/mips	d6181fab256865b24e4a8926786083b1476d1f39b792c6126535ff87526a67c0	Mirai	mirai wraith
http://46.23.108.238/mipsel	104633cc17f2294fc5a6ac7f7224ab30b26be13908a3a64ade05b048af275f0e	Mirai	mirai wraith
http://46.23.108.238/sh4	5ba1f8e403c81c479fb098384ea24c99cd2171827982552ca854e79ea713aefc	Mirai	mirai wraith
http://46.23.108.238/x86	c4b7349adb2e8fb25431c7f05dbff02eebe436ae6014d0423869c26969d406bd	Mirai	mirai wraith
http://46.23.108.238/armv6l	aab64d03bf58874d37fbf8c07d003885a8dc3a75b30e623a82918ef13f90de7d	Mirai	elf mirai ua-wget
http://46.23.108.238/armv7l	b9f773d7b0318d62c42764c84c27d7618b9268117cb2d8b85f084d3dab4d33f6	Mirai	elf mirai ua-wget
http://46.23.108.238/i686	9f2b9acf5ba4f3c9057eb20457cc5bf43606cb05e8188728aa3c62c834a87ce5	Mirai	elf mirai ua-wget
http://46.23.108.238/powerpc	1939d20bc8e84b21e24f7eb6d09860c0071780ec1bb110718109a54c8a5d84b9	Mirai	elf mirai ua-wget
http://46.23.108.238/i586	62eb9e723d53a1b836bfe87e2af0c38b94ddd6a65e14bd2a89b41dca9b2b96d8	Mirai	elf mirai ua-wget
http://46.23.108.238/m68k	4286fa6edd5aa7c0a797b15c54cc5b0ebcdc7f1789592557660fe1b037d6781c	Mirai	elf mirai ua-wget
http://46.23.108.238/sparc	n/a	n/a	elf ua-wget
http://46.23.108.238/armv4l	e0c87ef7802f4c48d6f8a51349006ed9f2c5759cdff62288316f678e8b7d676b	Mirai	elf mirai ua-wget
http://46.23.108.238/armv5l	1c07ec4db3c95af750a0160e579d538a0b5a107d49cbb5966912dddc0f6b0d8e	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

evasive

Link:

https://www.filescan.io/uploads/6a225e02099ef368af20cb95/reports/81c1f175-7802-4fc4-a0ca-73cf952cdd72/overview

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-06-05T02:35:00Z UTC

Last seen:

2026-06-05T10:21:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan-Downloader.Shell.Agent.p HEUR:Trojan-Downloader.Shell.Agent.gen HEUR:Trojan-Downloader.Shell.Agent.cx HEUR:Trojan-Downloader.Shell.Agent.a

Link:

https://opentip.kaspersky.com/b524ca7cbafab904d0090fa29ebb79941c65ec1c42011aa234cc33f6d47cfdbe/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/92197c1b-850f-4f9d-baae-f187c6a4ced5

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/b524ca7cbafab904d0090fa29ebb79941c65ec1c42011aa234cc33f6d47cfdbe

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b524ca7cbafab904d0090fa29ebb79941c65ec1c42011aa234cc33f6d47cfdbe/

Verdict:

Malicious

Threat:

Trojan-Downloader.Shell.Agent

Link:

https://tip.neiki.dev/file/b524ca7cbafab904d0090fa29ebb79941c65ec1c42011aa234cc33f6d47cfdbe

Threat name:

Linux.Downloader.Morila

Status:

Malicious

First seen:

2026-06-05 05:27:24 UTC

File Type:

Text (Shell)

AV detection:

24 of 36 (66.67%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=wusmu7f27k4qjuajb6rj5o3zsqogl3a4iiarviruzqz7nvd47w7a._file

Result

Malware family:

n/a

Score:

7/10

Tags:

credential_access defense_evasion discovery linux

Link:

https://tria.ge/reports/260605-f43ftacv6q/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Changes its process name

Reads system network configuration

Reads process memory

Creates a large amount of network flows

Enumerates running processes

Reads system routing table

File and Directory Permissions Modification

Executes dropped EXE

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.86

Link:

https://yomi.yoroi.company/submissions/b524ca7cbafab904d0090fa29ebb79941c65ec1c42011aa234cc33f6d47cfdbe

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ach_202412_suspect_bash_script Create hunting rule
Author:	abuse.ch
Description:	Detects suspicious Linux bash scripts

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh