MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c94c22e2e48d9157faded38be687d1db7bfd0d02e57038bc4e3c030478537964. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	c94c22e2e48d9157faded38be687d1db7bfd0d02e57038bc4e3c030478537964
SHA3-384 hash:	201373e5b9ddefea077873a2b46121ae5dc71c57a4cb9f15340cc11570a074dd4688132d5a5b03a7b25ebb913c2dc61e
SHA1 hash:	e847f31b168842f96cf59e2d8f5129c6b7cd99fd
MD5 hash:	771f86f86c9ba96cbd44678784e4852f
humanhash:	vegan-blossom-neptune-fifteen
File name:	asusrt
Download:	download sample
File size:	5'019 bytes
First seen:	2026-06-11 05:30:34 UTC
Last seen:	2026-06-12 01:45:23 UTC
File type:	sh
MIME type:	text/plain
ssdeep	48:Qv8y24OT/fgwEf6y8d3+r48Ijiyu8UrHRrGUOT/ftax+3+ruSajQEuWCrHnrG61O:A8B69HTRC2X7TnCTerF1MbLb
TLSH	T17DA1D4C60372E652C8867D61B17F329C64EB1AA16B98CE6CF7A64CF15C458D2F022751
Magika	csv
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://162.248.101.153/n2/aarch64	2639cea58eb054074923f9864d0ec50513c0a8d2896d0a2cb6bef80ee3443500	Mirai	elf mirai ua-wget
http://162.248.101.153/n2/armv4l	f23b456e8367faa29e586ba1463c9686cac03c6b6720685908a0600c64f924e2	Mirai	elf mirai ua-wget
http://162.248.101.153/n2/armv5l	ec41a35c7df2a684c7a97da730d93c63a15dc34f619474e8cc03fd7afe063ef4	Mirai	arm elf mirai ua-wget
http://162.248.101.153/n2/armv6l	b6a0ae0f7b27ba1aa7624d55aed39f1229b8039286a033451b8a89829ef40998	Mirai	elf mirai ua-wget
http://162.248.101.153/n2/armv7l	f40e7d990ef4a2b9e7b3444eb480968ffa74b608779920e63ed5ac246825eedd	Mirai	elf mirai ua-wget
http://162.248.101.153/n2/m68k	a43d47cdd979a2d22a5ca513cd28b376802afcf96bea135b745788ddbecaa4a2	Mirai	elf mirai ua-wget
http://162.248.101.153/n2/mips64	640b19b8dd91986eb609c7323946b4252a2477e3c87b9f725aa61f593f19a635	Mirai	botnet mirai
http://162.248.101.153/n2/ppc	1bde358e28aed0805f12946c2a8995da1b986f59f75a332e121d78948e2c5516	Mirai	elf mirai ua-wget
http://162.248.101.153/n2/sh4	66273723b54321eaf2581cdf7d2bf1d5f747fd3d4fbb3c61785b002ccf8d96d8	Mirai	elf mirai ua-wget
http://162.248.101.153/n2/mips	69a3f8207de0386d28e743b27f532b3413d83f5b57b88213f633c6061fdb3361	Mirai	elf mips mirai ua-wget
http://162.248.101.153/n2/mpsl	01e6c07cd6d6f7c9b5d9af76eb1631ece66ac36c627668101cf2498b7e577273	Mirai	elf mips mirai ua-wget
http://162.248.101.153/n2/x86_64	a530187d666f996d308daea3f08eeeb6d67252bf2f491babd3815b882c265246	Mirai	elf mirai ua-wget
http://162.248.101.153/n2/x86	ac48eac307da45bfbb2fbbd9238ae75cf83367e27ef89f61db0d75366714fbe7	Mirai	elf mirai ua-wget x86

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

SecuriteInfo.com.Linux.Downloader-34.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

evasive

Link:

https://www.filescan.io/uploads/6a2a4b861f652d68657756ad/reports/9031db25-9386-4976-97ee-a7e43ef424ca/overview

Verdict:

Malicious

File Type:

ps1

First seen:

2026-06-11T02:47:00Z UTC

Last seen:

2026-06-12T18:38:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan-Downloader.Shell.Agent.p HEUR:Trojan-Downloader.Shell.Agent.gen

Link:

https://opentip.kaspersky.com/c94c22e2e48d9157faded38be687d1db7bfd0d02e57038bc4e3c030478537964/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/18cc00ff-dcba-482f-b85a-d96f835c5106

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/c94c22e2e48d9157faded38be687d1db7bfd0d02e57038bc4e3c030478537964

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c94c22e2e48d9157faded38be687d1db7bfd0d02e57038bc4e3c030478537964/

Verdict:

Malicious

Threat:

Trojan-Downloader.Shell.Agent

Link:

https://tip.neiki.dev/file/c94c22e2e48d9157faded38be687d1db7bfd0d02e57038bc4e3c030478537964

Threat name:

Script-BAT.Downloader.Heuristic

Status:

Malicious

First seen:

2026-06-11 05:45:53 UTC

File Type:

Text (Shell)

AV detection:

10 of 23 (43.48%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=zfgcfyxerwivp6w62of6nb6r3n572dic4vydrpcohqbqi6ctpfsa._file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/260611-gf4veahx7z/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/c94c22e2e48d9157faded38be687d1db7bfd0d02e57038bc4e3c030478537964

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh