MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c2c47fa2b124c7ffbc291e76473ff1fae19bd7de17d30a4fdbd0615b843e0c4f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c2c47fa2b124c7ffbc291e76473ff1fae19bd7de17d30a4fdbd0615b843e0c4f
SHA3-384 hash: e0ba36102fb8ef9471456e9fec3f94342be8b7ddeb3e1f7aec968c1f089e8f86a28b02b59ff6c38021e51a151e93e01d
SHA1 hash: ad56902568ce4252fc7cec46aad3ead81ed0ee8d
MD5 hash: 8a0679d9c1479ae9f4e644524099d528
humanhash: lamp-missouri-west-six
File name:w.sh
Download: download sample
File size:1'212 bytes
First seen:2025-12-21 09:31:43 UTC
Last seen:2025-12-24 13:21:55 UTC
File type: sh
MIME type:text/plain
ssdeep 24:1E5u6EcRgNIZEtzEoEVKTXREHygEOjGMETtE23E3epyEKV3EzgtE1GCEkzA:wuER8wPQX4ywjGptE2EepaVwgQGEE
TLSH T1A52141CF0018B95A054DCF50312654EC33F0D7E860A2AE4B2848B9F3BA886577272E9F
Magika txt
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://91.92.243.68/Fantazy.armn/an/acensys elf ua-wget
http://91.92.243.68/Fantazy.arm5ecc57dad5f28e2f8b0cb3182917d3e985894130c8ad4f640f28dad25a3dd8ccb Miraicensys elf mirai ua-wget
http://91.92.243.68/Fantazy.arm69b51caf8e94f32dab03ffef1c66022182ce2876bd1ce474721f52c3f336e03fc Miraicensys elf mirai ua-wget
http://91.92.243.68/Fantazy.arm7d0e69826172390416075ecef3feb17d339b41888896f3868f3d206da1a26bf85 Miraielf mirai ua-wget
http://91.92.243.68/Fantazy.m68kde368b33b9e3f721e2f25faa827ab02ad9e834d8e79a5c032bc8230b9e1175a1 Miraicensys elf mirai ua-wget
http://91.92.243.68/Fantazy.mips0f6b0327fb3d814eab9fb2a7674195a381936da4e4c4dcad7f42553d37dc0b28 Miraicensys elf mirai ua-wget
http://91.92.243.68/Fantazy.mpslf43e3602afc7424afe5aa04e34f5a6603a220696cf9954afc849bd16d17fe54a Miraicensys elf mirai ua-wget
http://91.92.243.68/Fantazy.ppcdc9650fb46972e8461b462ed2e2c9ce6e90157c15743f63f1e977459a7b5bad9 Miraicensys elf mirai ua-wget
http://91.92.243.68/Fantazy.sh49e794fdbae88d594f54e5b2c4d568e2d552e14063cb66963b21f78504a248434 Miraicensys elf mirai ua-wget
http://91.92.243.68/Fantazy.spcaab2354eb4373b0b6ac3b4ffbd9fcace62ec787b473f231f55976594757cbdf5 Miraicensys elf mirai ua-wget
http://91.92.243.68/Fantazy.x86165e9ae4a6cb930e7560a3e88063642a1e5c356cbd6be7d6545ab1d50f7c1a0b Miraielf mirai ua-wget
http://91.92.243.68/Fantazy.x86_648e40e40a596baaa7a901898832a4508f9b0f7ca527ce42fabd80ce01cf8452de Miraicensys elf mirai ua-wget

Intelligence

File Origin
# of uploads :
2
# of downloads :
31
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.Downloader-32.UNOFFICIAL
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
busybox mirai
Link:
https://www.filescan.io/uploads/6947beb2e126b9ff438a9708/reports/68e2e440-032f-4bd5-b239-f29733bb70cc/overview
Verdict:
Malicious
File Type:
ps1
First seen:
2025-12-21T07:17:00Z UTC
Last seen:
2025-12-21T12:48:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/c2c47fa2b124c7ffbc291e76473ff1fae19bd7de17d30a4fdbd0615b843e0c4f/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/e042d694-d06f-4ab3-abec-43f4e79352b8
Behavior Graph:
Download SVG
%3 guuid=d7b727d3-1a00-0000-95ad-7426430c0000 pid=3139 /usr/bin/sudo guuid=5d24e8d4-1a00-0000-95ad-7426480c0000 pid=3144 /tmp/sample.bin guuid=d7b727d3-1a00-0000-95ad-7426430c0000 pid=3139->guuid=5d24e8d4-1a00-0000-95ad-7426480c0000 pid=3144 execve guuid=1b5136d5-1a00-0000-95ad-74264a0c0000 pid=3146 /usr/bin/busybox net send-data guuid=5d24e8d4-1a00-0000-95ad-7426480c0000 pid=3144->guuid=1b5136d5-1a00-0000-95ad-74264a0c0000 pid=3146 execve guuid=aa6630db-1a00-0000-95ad-7426550c0000 pid=3157 /usr/bin/chmod guuid=5d24e8d4-1a00-0000-95ad-7426480c0000 pid=3144->guuid=aa6630db-1a00-0000-95ad-7426550c0000 pid=3157 execve guuid=0cb16fdb-1a00-0000-95ad-7426570c0000 pid=3159 /usr/bin/dash guuid=5d24e8d4-1a00-0000-95ad-7426480c0000 pid=3144->guuid=0cb16fdb-1a00-0000-95ad-7426570c0000 pid=3159 clone guuid=308d80db-1a00-0000-95ad-7426580c0000 pid=3160 /usr/bin/busybox net send-data write-file guuid=5d24e8d4-1a00-0000-95ad-7426480c0000 pid=3144->guuid=308d80db-1a00-0000-95ad-7426580c0000 pid=3160 execve guuid=5428f4e6-1a00-0000-95ad-7426680c0000 pid=3176 /usr/bin/chmod guuid=5d24e8d4-1a00-0000-95ad-7426480c0000 pid=3144->guuid=5428f4e6-1a00-0000-95ad-7426680c0000 pid=3176 execve guuid=d5dc74e7-1a00-0000-95ad-7426690c0000 pid=3177 /usr/bin/dash guuid=5d24e8d4-1a00-0000-95ad-7426480c0000 pid=3144->guuid=d5dc74e7-1a00-0000-95ad-7426690c0000 pid=3177 clone guuid=3b1e69e8-1a00-0000-95ad-74266b0c0000 pid=3179 /usr/bin/busybox net send-data write-file guuid=5d24e8d4-1a00-0000-95ad-7426480c0000 pid=3144->guuid=3b1e69e8-1a00-0000-95ad-74266b0c0000 pid=3179 execve guuid=4bb3abf4-1a00-0000-95ad-74266f0c0000 pid=3183 /usr/bin/chmod guuid=5d24e8d4-1a00-0000-95ad-7426480c0000 pid=3144->guuid=4bb3abf4-1a00-0000-95ad-74266f0c0000 pid=3183 execve guuid=a99459f5-1a00-0000-95ad-7426710c0000 pid=3185 /usr/bin/dash guuid=5d24e8d4-1a00-0000-95ad-7426480c0000 pid=3144->guuid=a99459f5-1a00-0000-95ad-7426710c0000 pid=3185 clone guuid=354ccbf6-1a00-0000-95ad-7426760c0000 pid=3190 /usr/bin/busybox net send-data write-file guuid=5d24e8d4-1a00-0000-95ad-7426480c0000 pid=3144->guuid=354ccbf6-1a00-0000-95ad-7426760c0000 pid=3190 execve guuid=69ae0f06-1b00-0000-95ad-7426940c0000 pid=3220 /usr/bin/chmod guuid=5d24e8d4-1a00-0000-95ad-7426480c0000 pid=3144->guuid=69ae0f06-1b00-0000-95ad-7426940c0000 pid=3220 execve guuid=702e6c06-1b00-0000-95ad-7426950c0000 pid=3221 /usr/bin/dash guuid=5d24e8d4-1a00-0000-95ad-7426480c0000 pid=3144->guuid=702e6c06-1b00-0000-95ad-7426950c0000 pid=3221 clone guuid=68235408-1b00-0000-95ad-7426970c0000 pid=3223 /usr/bin/busybox net send-data write-file guuid=5d24e8d4-1a00-0000-95ad-7426480c0000 pid=3144->guuid=68235408-1b00-0000-95ad-7426970c0000 pid=3223 execve guuid=f2218414-1b00-0000-95ad-7426980c0000 pid=3224 /usr/bin/chmod guuid=5d24e8d4-1a00-0000-95ad-7426480c0000 pid=3144->guuid=f2218414-1b00-0000-95ad-7426980c0000 pid=3224 execve guuid=fa53f814-1b00-0000-95ad-7426990c0000 pid=3225 /usr/bin/dash guuid=5d24e8d4-1a00-0000-95ad-7426480c0000 pid=3144->guuid=fa53f814-1b00-0000-95ad-7426990c0000 pid=3225 clone guuid=ecd2b116-1b00-0000-95ad-74269b0c0000 pid=3227 /usr/bin/busybox net send-data write-file guuid=5d24e8d4-1a00-0000-95ad-7426480c0000 pid=3144->guuid=ecd2b116-1b00-0000-95ad-74269b0c0000 pid=3227 execve guuid=bf4c9322-1b00-0000-95ad-7426a40c0000 pid=3236 /usr/bin/chmod guuid=5d24e8d4-1a00-0000-95ad-7426480c0000 pid=3144->guuid=bf4c9322-1b00-0000-95ad-7426a40c0000 pid=3236 execve guuid=c90ce722-1b00-0000-95ad-7426a60c0000 pid=3238 /usr/bin/dash guuid=5d24e8d4-1a00-0000-95ad-7426480c0000 pid=3144->guuid=c90ce722-1b00-0000-95ad-7426a60c0000 pid=3238 clone guuid=480c7623-1b00-0000-95ad-7426a90c0000 pid=3241 /usr/bin/busybox net send-data write-file guuid=5d24e8d4-1a00-0000-95ad-7426480c0000 pid=3144->guuid=480c7623-1b00-0000-95ad-7426a90c0000 pid=3241 execve guuid=b886ae31-1b00-0000-95ad-7426bb0c0000 pid=3259 /usr/bin/chmod guuid=5d24e8d4-1a00-0000-95ad-7426480c0000 pid=3144->guuid=b886ae31-1b00-0000-95ad-7426bb0c0000 pid=3259 execve guuid=8899fa31-1b00-0000-95ad-7426bd0c0000 pid=3261 /usr/bin/dash guuid=5d24e8d4-1a00-0000-95ad-7426480c0000 pid=3144->guuid=8899fa31-1b00-0000-95ad-7426bd0c0000 pid=3261 clone guuid=ca78a532-1b00-0000-95ad-7426c00c0000 pid=3264 /usr/bin/busybox net send-data write-file guuid=5d24e8d4-1a00-0000-95ad-7426480c0000 pid=3144->guuid=ca78a532-1b00-0000-95ad-7426c00c0000 pid=3264 execve guuid=5b53093f-1b00-0000-95ad-7426cf0c0000 pid=3279 /usr/bin/chmod guuid=5d24e8d4-1a00-0000-95ad-7426480c0000 pid=3144->guuid=5b53093f-1b00-0000-95ad-7426cf0c0000 pid=3279 execve guuid=aa037a3f-1b00-0000-95ad-7426d00c0000 pid=3280 /usr/bin/dash guuid=5d24e8d4-1a00-0000-95ad-7426480c0000 pid=3144->guuid=aa037a3f-1b00-0000-95ad-7426d00c0000 pid=3280 clone guuid=b6851c41-1b00-0000-95ad-7426d40c0000 pid=3284 /usr/bin/busybox net send-data write-file guuid=5d24e8d4-1a00-0000-95ad-7426480c0000 pid=3144->guuid=b6851c41-1b00-0000-95ad-7426d40c0000 pid=3284 execve guuid=52a53a4d-1b00-0000-95ad-7426ee0c0000 pid=3310 /usr/bin/chmod guuid=5d24e8d4-1a00-0000-95ad-7426480c0000 pid=3144->guuid=52a53a4d-1b00-0000-95ad-7426ee0c0000 pid=3310 execve guuid=9688974d-1b00-0000-95ad-7426ef0c0000 pid=3311 /usr/bin/dash guuid=5d24e8d4-1a00-0000-95ad-7426480c0000 pid=3144->guuid=9688974d-1b00-0000-95ad-7426ef0c0000 pid=3311 clone guuid=104e554e-1b00-0000-95ad-7426f40c0000 pid=3316 /usr/bin/busybox net send-data write-file guuid=5d24e8d4-1a00-0000-95ad-7426480c0000 pid=3144->guuid=104e554e-1b00-0000-95ad-7426f40c0000 pid=3316 execve guuid=0f96845a-1b00-0000-95ad-7426110d0000 pid=3345 /usr/bin/chmod guuid=5d24e8d4-1a00-0000-95ad-7426480c0000 pid=3144->guuid=0f96845a-1b00-0000-95ad-7426110d0000 pid=3345 execve guuid=403ae55a-1b00-0000-95ad-7426130d0000 pid=3347 /usr/bin/dash guuid=5d24e8d4-1a00-0000-95ad-7426480c0000 pid=3144->guuid=403ae55a-1b00-0000-95ad-7426130d0000 pid=3347 clone guuid=163ad15b-1b00-0000-95ad-7426180d0000 pid=3352 /usr/bin/busybox net send-data write-file guuid=5d24e8d4-1a00-0000-95ad-7426480c0000 pid=3144->guuid=163ad15b-1b00-0000-95ad-7426180d0000 pid=3352 execve guuid=99af3e67-1b00-0000-95ad-7426210d0000 pid=3361 /usr/bin/chmod guuid=5d24e8d4-1a00-0000-95ad-7426480c0000 pid=3144->guuid=99af3e67-1b00-0000-95ad-7426210d0000 pid=3361 execve guuid=8e989367-1b00-0000-95ad-7426220d0000 pid=3362 /home/sandbox/Fantazy.x86 net guuid=5d24e8d4-1a00-0000-95ad-7426480c0000 pid=3144->guuid=8e989367-1b00-0000-95ad-7426220d0000 pid=3362 execve guuid=d117ca67-1b00-0000-95ad-7426250d0000 pid=3365 /usr/bin/busybox net send-data write-file guuid=5d24e8d4-1a00-0000-95ad-7426480c0000 pid=3144->guuid=d117ca67-1b00-0000-95ad-7426250d0000 pid=3365 execve guuid=e2b23474-1b00-0000-95ad-7426350d0000 pid=3381 /usr/bin/chmod guuid=5d24e8d4-1a00-0000-95ad-7426480c0000 pid=3144->guuid=e2b23474-1b00-0000-95ad-7426350d0000 pid=3381 execve guuid=e873ae74-1b00-0000-95ad-7426370d0000 pid=3383 /home/sandbox/Fantazy.x86_64 net guuid=5d24e8d4-1a00-0000-95ad-7426480c0000 pid=3144->guuid=e873ae74-1b00-0000-95ad-7426370d0000 pid=3383 execve guuid=8674509f-1c00-0000-95ad-74262a100000 pid=4138 /usr/bin/rm guuid=5d24e8d4-1a00-0000-95ad-7426480c0000 pid=3144->guuid=8674509f-1c00-0000-95ad-74262a100000 pid=4138 execve 0019fe1c-758c-5273-830a-1cc9dac5b043 91.92.243.68:80 guuid=1b5136d5-1a00-0000-95ad-74264a0c0000 pid=3146->0019fe1c-758c-5273-830a-1cc9dac5b043 send: 86B guuid=308d80db-1a00-0000-95ad-7426580c0000 pid=3160->0019fe1c-758c-5273-830a-1cc9dac5b043 send: 87B guuid=3b1e69e8-1a00-0000-95ad-74266b0c0000 pid=3179->0019fe1c-758c-5273-830a-1cc9dac5b043 send: 87B guuid=354ccbf6-1a00-0000-95ad-7426760c0000 pid=3190->0019fe1c-758c-5273-830a-1cc9dac5b043 send: 87B guuid=68235408-1b00-0000-95ad-7426970c0000 pid=3223->0019fe1c-758c-5273-830a-1cc9dac5b043 send: 87B guuid=ecd2b116-1b00-0000-95ad-74269b0c0000 pid=3227->0019fe1c-758c-5273-830a-1cc9dac5b043 send: 87B guuid=480c7623-1b00-0000-95ad-7426a90c0000 pid=3241->0019fe1c-758c-5273-830a-1cc9dac5b043 send: 87B guuid=ca78a532-1b00-0000-95ad-7426c00c0000 pid=3264->0019fe1c-758c-5273-830a-1cc9dac5b043 send: 86B guuid=b6851c41-1b00-0000-95ad-7426d40c0000 pid=3284->0019fe1c-758c-5273-830a-1cc9dac5b043 send: 86B guuid=104e554e-1b00-0000-95ad-7426f40c0000 pid=3316->0019fe1c-758c-5273-830a-1cc9dac5b043 send: 86B guuid=163ad15b-1b00-0000-95ad-7426180d0000 pid=3352->0019fe1c-758c-5273-830a-1cc9dac5b043 send: 86B 8b0a01dc-0728-52c1-8024-c4ba7801b8d6 8.8.8.8:53 guuid=8e989367-1b00-0000-95ad-7426220d0000 pid=3362->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=db0cb967-1b00-0000-95ad-7426230d0000 pid=3363 /home/sandbox/Fantazy.x86 guuid=8e989367-1b00-0000-95ad-7426220d0000 pid=3362->guuid=db0cb967-1b00-0000-95ad-7426230d0000 pid=3363 clone guuid=4534bc67-1b00-0000-95ad-7426240d0000 pid=3364 /home/sandbox/Fantazy.x86 net send-data zombie guuid=8e989367-1b00-0000-95ad-7426220d0000 pid=3362->guuid=4534bc67-1b00-0000-95ad-7426240d0000 pid=3364 clone guuid=4534bc67-1b00-0000-95ad-7426240d0000 pid=3364->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con 78e3738d-7262-5540-8dc6-5596f84d4d72 91.92.243.68:63645 guuid=4534bc67-1b00-0000-95ad-7426240d0000 pid=3364->78e3738d-7262-5540-8dc6-5596f84d4d72 send: 19B guuid=8a9cce67-1b00-0000-95ad-7426260d0000 pid=3366 /home/sandbox/Fantazy.x86 guuid=4534bc67-1b00-0000-95ad-7426240d0000 pid=3364->guuid=8a9cce67-1b00-0000-95ad-7426260d0000 pid=3366 clone guuid=2349d867-1b00-0000-95ad-7426270d0000 pid=3367 /home/sandbox/Fantazy.x86 guuid=4534bc67-1b00-0000-95ad-7426240d0000 pid=3364->guuid=2349d867-1b00-0000-95ad-7426270d0000 pid=3367 clone guuid=af1ae567-1b00-0000-95ad-7426280d0000 pid=3368 /home/sandbox/Fantazy.x86 net net-scan send-data guuid=4534bc67-1b00-0000-95ad-7426240d0000 pid=3364->guuid=af1ae567-1b00-0000-95ad-7426280d0000 pid=3368 clone guuid=d117ca67-1b00-0000-95ad-7426250d0000 pid=3365->0019fe1c-758c-5273-830a-1cc9dac5b043 send: 89B guuid=af1ae567-1b00-0000-95ad-7426280d0000 pid=3368->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=af1ae567-1b00-0000-95ad-7426280d0000 pid=3368|send-data send-data to 160 IP addresses review logs to see them all guuid=af1ae567-1b00-0000-95ad-7426280d0000 pid=3368->guuid=af1ae567-1b00-0000-95ad-7426280d0000 pid=3368|send-data send guuid=e873ae74-1b00-0000-95ad-7426370d0000 pid=3383->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con 349af0aa-1d52-5b54-ab86-2f426b84e968 0.0.0.0:59025 guuid=e873ae74-1b00-0000-95ad-7426370d0000 pid=3383->349af0aa-1d52-5b54-ab86-2f426b84e968 con guuid=0772469f-1c00-0000-95ad-742628100000 pid=4136 /home/sandbox/Fantazy.x86_64 zombie guuid=e873ae74-1b00-0000-95ad-7426370d0000 pid=3383->guuid=0772469f-1c00-0000-95ad-742628100000 pid=4136 clone guuid=08c5489f-1c00-0000-95ad-742629100000 pid=4137 /home/sandbox/Fantazy.x86_64 net send-data zombie guuid=e873ae74-1b00-0000-95ad-7426370d0000 pid=3383->guuid=08c5489f-1c00-0000-95ad-742629100000 pid=4137 clone guuid=08c5489f-1c00-0000-95ad-742629100000 pid=4137->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=08c5489f-1c00-0000-95ad-742629100000 pid=4137->78e3738d-7262-5540-8dc6-5596f84d4d72 send: 40B guuid=fc46579f-1c00-0000-95ad-74262b100000 pid=4139 /home/sandbox/Fantazy.x86_64 guuid=08c5489f-1c00-0000-95ad-742629100000 pid=4137->guuid=fc46579f-1c00-0000-95ad-74262b100000 pid=4139 clone guuid=cf74599f-1c00-0000-95ad-74262c100000 pid=4140 /home/sandbox/Fantazy.x86_64 zombie guuid=08c5489f-1c00-0000-95ad-742629100000 pid=4137->guuid=cf74599f-1c00-0000-95ad-74262c100000 pid=4140 clone guuid=46f05f9f-1c00-0000-95ad-74262d100000 pid=4141 /home/sandbox/Fantazy.x86_64 net net-scan send-data zombie guuid=08c5489f-1c00-0000-95ad-742629100000 pid=4137->guuid=46f05f9f-1c00-0000-95ad-74262d100000 pid=4141 clone guuid=46f05f9f-1c00-0000-95ad-74262d100000 pid=4141->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con 8a2a0a32-480c-5d21-a7c6-059a7691ccff 34.43.193.90:23 guuid=46f05f9f-1c00-0000-95ad-74262d100000 pid=4141->8a2a0a32-480c-5d21-a7c6-059a7691ccff send: 40B 3759a564-33ef-5a9b-8476-7a9d1cd2904a 165.12.102.95:23 guuid=46f05f9f-1c00-0000-95ad-74262d100000 pid=4141->3759a564-33ef-5a9b-8476-7a9d1cd2904a send: 40B guuid=46f05f9f-1c00-0000-95ad-74262d100000 pid=4141|send-data send-data to 4097 IP addresses review logs to see them all guuid=46f05f9f-1c00-0000-95ad-74262d100000 pid=4141->guuid=46f05f9f-1c00-0000-95ad-74262d100000 pid=4141|send-data send
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/c2c47fa2b124c7ffbc291e76473ff1fae19bd7de17d30a4fdbd0615b843e0c4f
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c2c47fa2b124c7ffbc291e76473ff1fae19bd7de17d30a4fdbd0615b843e0c4f/
Threat name:
Linux.Downloader.Generic
Create hunting rule
Status:
Suspicious
First seen:
2025-12-21 09:32:28 UTC
File Type:
Text
AV detection:
14 of 24 (58.33%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ylch7ivretd77pbjdz3eop7r7lqzxv66c7jqut632bqvxbb6brhq._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/251223-lcs1ys1qay/
Behaviour
Modifies registry class
Suspicious use of SetWindowsHookEx
Enumerates physical storage devices
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/c2c47fa2b124c7ffbc291e76473ff1fae19bd7de17d30a4fdbd0615b843e0c4f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MAL_Linux_IoT_MultiArch_BotnetLoader_Generic
Create hunting rule
Author:Anish Bogati
Description:Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:MalwareBazaar sample lilin.sh

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh c2c47fa2b124c7ffbc291e76473ff1fae19bd7de17d30a4fdbd0615b843e0c4f

(this sample)

Mirai

elf ecc57dad5f28e2f8b0cb3182917d3e985894130c8ad4f640f28dad25a3dd8ccb

  
URLhaus
https://urlhaus.abuse.ch/url/3738773/
  
Delivery method
Distributed via web download
  
Dropping
MD5 0d4f854cbdaa7495c863028baf2a9223
  
Dropping
SHA256 ecc57dad5f28e2f8b0cb3182917d3e985894130c8ad4f640f28dad25a3dd8ccb

Comments