MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c568f7ecf6a2883d38d87c27360ddd2f1c38eef253edbc31901c96afbd4d8b07. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	c568f7ecf6a2883d38d87c27360ddd2f1c38eef253edbc31901c96afbd4d8b07
SHA3-384 hash:	98bcb87e5fef6d416dc7e2f023ad7b83187aa7990e6575228a66564e0456dc06e5d868764199d1c3d36e68430c979af2
SHA1 hash:	e413590c112c5f8ecaa7fff4310aa82149607faa
MD5 hash:	f634f8d292b7b222ce63311e555a9828
humanhash:	grey-king-asparagus-sixteen
File name:	c568f7ecf6a2883d38d87c27360ddd2f1c38eef253edbc31901c96afbd4d8b07
Download:	download sample
File size:	939 bytes
First seen:	2026-11-07 22:38:24 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	24:Eob4Pib4Php4P44PfN4Psp4PXp4PM4PA4PJ4PRth:EGFgvKHWZ9cuh
TLSH	T10611339D021536D84845DB7E3791811CB144DBCC28AB8E58F8D30A3885BD6CE3036B1F
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	spydisec
Tags:	cowrie dropper honeypot sh

spydisec

Captured by an SSH/Telnet honeypot (cowrie). Downloaded from http://45.90.163.37/tot; attacker IP(s): 45.90.163.37; first seen 2026-11-07T22:18:38Z.

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://45.90.163.37/jklarm	n/a	n/a	arm elf
http://45.90.163.37/jklarm5	db3587693b2199cd5ae490cca7c8bc5d35a388a6a00bf5d7108c64d080375fac	Mirai	arm elf mirai
http://45.90.163.37/jklarm6	n/a	n/a	arm elf
http://45.90.163.37/jklarm7	n/a	n/a	arm elf
http://45.90.163.37/jklm68k	n/a	n/a	elf m68k
http://45.90.163.37/jklmips	n/a	n/a	elf mips
http://45.90.163.37/jklmpsl	e00d01a8da0fd374ee3cd8009f300a1917b48614abc8ad6870f536cd179d1929	Mirai	elf mipsel mirai
http://45.90.163.37/jklppc	n/a	n/a	elf PowerPC
http://45.90.163.37/jklsh4	n/a	n/a	elf SuperH
http://45.90.163.37/jklspc	n/a	n/a	elf sparc
http://45.90.163.37/jklx86	n/a	n/a	elf x86

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

n/a

Vendor Threat Intelligence

No detections

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

evasive

Link:

https://www.filescan.io/uploads/6aefa89464efbda0c7b2a038/reports/5e37036c-c0ae-4fff-8a87-116cef04f63e/overview

Verdict:

Malicious

File Type:

unix shell

Link:

https://opentip.kaspersky.com/c568f7ecf6a2883d38d87c27360ddd2f1c38eef253edbc31901c96afbd4d8b07/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/9002fb36-b90c-417e-988b-2e56ee061232

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c568f7ecf6a2883d38d87c27360ddd2f1c38eef253edbc31901c96afbd4d8b07/

Threat name:

Win32.Trojan.Qwexlafiba

Status:

Malicious

First seen:

2026-11-07 22:39:15 UTC

File Type:

Text (Shell)

AV detection:

15 of 24 (62.50%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=yvupp3hwuked2ogypqttmdo5f4odr3xskpw3ymmqdslk7pknrmdq._file

Result

Malware family:

n/a

Score:

1/10

Tags:

linux

Link:

https://tria.ge/reports/261107-2k1nrsfy8t/

Malware Family:

shell

Malicious:

True

Tags:

shell

Link:

https://intel.virussign.com/intelligence/file/c568f7ecf6a2883d38d87c27360ddd2f1c38eef253edbc31901c96afbd4d8b07

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.20

Link:

https://yomi.yoroi.company/submissions/c568f7ecf6a2883d38d87c27360ddd2f1c38eef253edbc31901c96afbd4d8b07

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	LIN_Downloader_Unknown_WgetChmodExecute Create hunting rule
Author:	Marjoriefort
Description:	Script shell downloader : wget+curl, chmod 777, execution, effacement (rm -rf) - botnet style
Reference:	misses_archive / grappe 5.182.210.174