MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d25edced6e2f469c654c4286437bc965fe5551e1987a33fd2e7b014281af929a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	d25edced6e2f469c654c4286437bc965fe5551e1987a33fd2e7b014281af929a
SHA3-384 hash:	96741a991d89f13602621fff6eca1dec347e5697f7bbdf3e4b9b5eda3934ec28b316e258f93e38d8f71229302f219a4d
SHA1 hash:	20acffc8e3f3f6b6c06a5ce5fbf3808b8c3a3bd2
MD5 hash:	8a00af728871459b2368de05f503d37d
humanhash:	chicken-lima-earth-december
File name:	k
Download:	download sample
File size:	686 bytes
First seen:	2025-05-16 04:17:33 UTC
Last seen:	2025-05-21 00:46:01 UTC
File type:	sh
MIME type:	text/plain
ssdeep	12:3rWKIwB5ZMoLF7+MB05vWPOtWPNDNkQNXWIyTtWIygDNkQN8Tvn:yRM5zLt+MB0A1DkAmm0kA8jn
TLSH	T1F9012BDF0198CC7228958CEE31D2191974CEC5EA5BCACF87608E00BDA4CDE0CB162EB5
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://185.218.87.28/vv/armv4l	35c14500814ac5bc2c71312bb1323f3be34afa878c7f06cefb0bf26f983564db	Mirai	elf gafgyt mirai ua-wget
http://185.218.87.28/vv/armv7l	200e571bc0a6d2562563022dfcc60ac5ac8c2e40eb73a053be8555349a674a69	Mirai	elf gafgyt mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6826be41e16384d6a704e3b8linux22vpnfull_triage

Tags:

agent hype sage

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

busybox evasive

Link:

https://www.filescan.io/uploads/6826bc810de036ed65a984b3/reports/1a2097b9-2105-4e7f-9afc-f5f2430a96bd/overview

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/d25edced6e2f469c654c4286437bc965fe5551e1987a33fd2e7b014281af929a

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d25edced6e2f469c654c4286437bc965fe5551e1987a33fd2e7b014281af929a/

Threat name:

Linux.Downloader.Generic

Status:

Suspicious

First seen:

2025-05-16 04:20:13 UTC

File Type:

Text (Shell)

AV detection:

8 of 24 (33.33%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=2jpnz3lof5djyzkmikdeg66jmx7fkupbtb5dh7jopmaufanpskna._file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/250516-ex6n8agp7v/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/d25edced6e2f469c654c4286437bc965fe5551e1987a33fd2e7b014281af929a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.