MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cc510630402a9d788db922a1fbaa2cdeaeb797ab14844f7d2c0fdbb3268c38d3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 6

Intelligence 6 IOCs YARA 2 File information Comments

SHA256 hash:	cc510630402a9d788db922a1fbaa2cdeaeb797ab14844f7d2c0fdbb3268c38d3
SHA3-384 hash:	471346ec34fa24071e3069f14a3d6da1e894724d4a3fb8d588792180cc156f79a4ec384aec2218f3c2945eb8477b467f
SHA1 hash:	db4b9964917ccd17d4555d40b18f66a5a45ef255
MD5 hash:	d3057ccffb0fa3f8bb0c4235fa78967a
humanhash:	ceiling-berlin-may-artist
File name:	wget.sh
Download:	download sample
File size:	2'147 bytes
First seen:	2025-05-23 20:43:03 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	24:wws7sNWBws2se2ws3ps32wsWAsWCewsWxsWRRiwsW6psW6ZkwsWPsWz4wsSsTwsw:weWB95w20kCe0zR80aYk0Fz4tzroj
TLSH	T14141D5D702620FB26C56985625B9844C3476A1AB79F2EF1CA4CF24E8858CE0FF161F71
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://151.243.213.208/bins/navo.x86	0383603650e7ac2422926bd93cecc65f5f49f9217fe6e2a06f517130f52d8825	Mirai	censys elf mirai opendir ua-wget
http://151.243.213.208/bins/navo.mips	95c02c290a3d37d3e81b46f6ed65e20af3ffbfbbff88b039d4798f9158cc8674	Mirai	censys elf mirai opendir ua-wget
http://151.243.213.208/bins/navo.mpsl	07f6d68bbfd15a15e7353f5b8c9f6b974e4ad2c3f4180af21d0ad7bad5b48134	Mirai	censys elf mirai opendir ua-wget
http://151.243.213.208/bins/navo.arm	09befe06e046e0ff65a4a479cfaf1b5eed92eebbe49e8d484bcd870e26d05a37	Mirai	censys elf mirai opendir ua-wget
http://151.243.213.208/bins/navo.arm5	ba86aac36c7c86f1222f62547c0e787abbe7b89214ff39b75d58eb41ca65c776	Mirai	censys elf mirai opendir ua-wget
http://151.243.213.208/bins/navo.arm6	3edc2b21ce949e5bf8596481d8ed88c401345af88804e1a4a826ae86bde4c141	Mirai	censys elf mirai opendir ua-wget
http://151.243.213.208/bins/navo.arm7	b3df308027e5c8a298fb597f3906ea6814fecdcad415952e64ded679f77413ff	Mirai	censys elf mirai opendir ua-wget
http://151.243.213.208/bins/navo.ppc	68d3ce3bced2498629bf054631f78332f8b68f5df7fd6c9879da05059024f688	Mirai	censys elf mirai opendir ua-wget
http://151.243.213.208/bins/navo.m68k	2d39cfdcc84c1a186d2f92eee9161bc67ebed639cf1f099734a0b964445039e2	Mirai	censys elf mirai opendir ua-wget
http://151.243.213.208/bins/navo.sh4	4448d21d1e90ae69990783a43102e3163baf7cb56b92ce31512fc11525b2bf8b	Mirai	censys elf mirai opendir ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

102

Origin country :

Vendor Threat Intelligence

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL

Verdict:

Malicious

Score:

91.7%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6830ded94912a6b9dd4c8a53linux22vpnfull_triage

Tags:

trojandownloader agent

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/cc510630402a9d788db922a1fbaa2cdeaeb797ab14844f7d2c0fdbb3268c38d3

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/cc510630402a9d788db922a1fbaa2cdeaeb797ab14844f7d2c0fdbb3268c38d3/

Threat name:

Linux.Downloader.Morila

Status:

Malicious

First seen:

2025-05-23 20:42:16 UTC

File Type:

Text (Shell)

AV detection:

17 of 24 (70.83%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=zriqmmcafkoxrdnzekq7xkrm32xlpf5lcsce67jmb7n3gjumhdjq._file

Result

Malware family:

n/a

Score:

1/10

Tags:

linux

Link:

https://tria.ge/reports/250523-zhrxqsxydx/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/cc510630402a9d788db922a1fbaa2cdeaeb797ab14844f7d2c0fdbb3268c38d3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.