MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d3eace21a07aa1c4d8ae0a88abc30f9376b83793d36f7820a05bc60872f4234a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 4

Intelligence 4 IOCs YARA 1 File information Comments

SHA256 hash:	d3eace21a07aa1c4d8ae0a88abc30f9376b83793d36f7820a05bc60872f4234a
SHA3-384 hash:	4c14233a0f53e37f49fb386db8356148a9de815514f224038b474140b219777ea4c346721d5d481678075e6741a284d1
SHA1 hash:	9cbfb31c6c69f12835f1cdfec0f37cbf14613eac
MD5 hash:	fc85e73db50bcff0d02207a76512b386
humanhash:	jersey-ack-missouri-ten
File name:	w.sh
Download:	download sample
File size:	819 bytes
First seen:	2026-02-01 06:42:24 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	12:nVHP3GvnVHtRxPVH8NIjlT0VH9iKl2CVHpNVHI67VHk90VHpFG100VHcVHuh7NVr:p3GneNIpbKlG6iVrRjn
TLSH	T1F001A9DA40652F7143A48F1CA523C82C500AC9D0F783169CAA4E007A5DE9B6BF626FCA
Magika	txt
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://94.156.152.67/bins/parm4	8967d1600dc0ad2effcdeda7eae9a666a5b1090eb07a75c754ef71659bec5cbc	Mirai	elf mirai ua-wget
http://94.156.152.67/bins/parm5	249bc7c5f69ca45551a7b7c35076a8a63b9c6de3d5228ca3006bd92583351fcf	Mirai	arm elf geofenced mirai opendir ua-wget USA
http://94.156.152.67/bins/parm6	6ba731baef133d63bdb492b29f8f148ffde09a43e8638bb09ac2d12632239978	Mirai	arm elf geofenced mirai opendir ua-wget USA
http://94.156.152.67/bins/parm7	02618f3738f979bad10a6cb98bfaf9a45e200394ef955972c0ed9a3e567d4873	Mirai	arm elf geofenced mirai opendir ua-wget USA
http://94.156.152.67/bins/psh4	n/a	n/a	elf mirai
http://94.156.152.67/bins/pppc	6e675c36a690663707594e209383561ca3dd8e732e623bd9339f3819561cb00a	Mirai	elf mirai
http://94.156.152.67/bins/pmips	n/a	n/a	elf geofenced mips mirai opendir ua-wget USA
http://94.156.152.67/bins/pmpsl	n/a	n/a	elf geofenced mips mirai opendir ua-wget USA
http://94.156.152.67/bins/pspc	b8d3fa58b5c2de4ae7ac3ab396ce12f3db1fdcd1471115dcfaed4acb996f1d39	Mirai	elf mirai
http://94.156.152.67/bins/px86	n/a	n/a	elf geofenced mirai opendir ua-wget USA x86
http://94.156.152.67/bins/pm68k	354c87c3d98f170852b5857bba1cb6a92adba034222b9558b3869f3f0149bc26	Mirai	elf mirai

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Gathering data

Detection(s):

SecuriteInfo.com.Linux.Downloader-32.UNOFFICIAL

Result

Gathering data

Verdict:

Clean

File Type:

cmd

Link:

https://opentip.kaspersky.com/d3eace21a07aa1c4d8ae0a88abc30f9376b83793d36f7820a05bc60872f4234a/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/6dcc19c6-cc19-4b69-828f-5c44aebf865e

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/d3eace21a07aa1c4d8ae0a88abc30f9376b83793d36f7820a05bc60872f4234a

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d3eace21a07aa1c4d8ae0a88abc30f9376b83793d36f7820a05bc60872f4234a/

Verdict:

Clean

Link:

https://tip.neiki.dev/file/d3eace21a07aa1c4d8ae0a88abc30f9376b83793d36f7820a05bc60872f4234a

Threat name:

Win32.Trojan.Alevaul

Status:

Malicious

First seen:

2026-02-01 05:18:07 UTC

File Type:

Text (Shell)

AV detection:

12 of 36 (33.33%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=2pvm4inapkq4jwfobkekxqypsn3lqn4t2nxxqifalpdaq4xuenfa._file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/260201-hg4fpscw9a/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/d3eace21a07aa1c4d8ae0a88abc30f9376b83793d36f7820a05bc60872f4234a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh