MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d5ecab0f13eb33cf39c40cd671c78a44f20d619d52abf26da31fc86f1dac738c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	d5ecab0f13eb33cf39c40cd671c78a44f20d619d52abf26da31fc86f1dac738c
SHA3-384 hash:	38decd3d513bc091b858d0e9d553295fb919c6e158d0a3fb55a3707c0c37e7f9cd75db2147608e4a8ee7225ae269ff6a
SHA1 hash:	2792659ebe971210c7d166c6fec3b26d7f9cd65f
MD5 hash:	4bcfcebb2b7bc24efd72c278727f9867
humanhash:	network-hotel-ink-golf
File name:	dl600
Download:	download sample
File size:	8'012 bytes
First seen:	2026-06-13 12:09:02 UTC
Last seen:	2026-06-25 16:48:25 UTC
File type:	sh
MIME type:	text/plain
ssdeep	96:l6InWckW7E9WUv48wYWO5aDB4RTmRXs31mWOJnLwhzim7sHuezcCW3DGAgfaka9i:py4d228XOIGLQy
TLSH	T146F193CD03D642305841760F35D66F18A89857E1ACF34F9AB8CDEEEA1924E55F528F09
Magika	batch
Reporter	Blackdome
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://31.170.22.205/bins/whisper.armv5	55d6cc5c314be3c2c988a797eeed584c7844549513e5eb9106a3a266f5c9c527	DDoSAgent	DDoSAgent elf
http://31.170.22.205/bins/whisper.armv6	2b4c87240aaf767982d676933e628f8bf2957c931d906a90c88ccf3a18dc55ce	DDoSAgent	DDoSAgent elf
http://31.170.22.205/bins/whisper.armv7	e97da696893a2a090ac962789c524119aacab5583df1f2074c081295a0f582e3	DDoSAgent	DDoSAgent elf
http://31.170.22.205/bins/whisper.aarch64	38b7cbe9ff53cec015d67d04da59bcced70fae6c7e1d15baf95abc34035cc862	DDoSAgent	DDoSAgent elf
http://31.170.22.205/bins/whisper.aarch64be	5b489dfd7395de9106468d7b92374c56d30af994b4ea06be6c77e98ba540cf6a	DDoSAgent	DDoSAgent elf
http://31.170.22.205/bins/whisper.arcle750d	6001350ab65adfd7a9e0fca7560c49fc5d8f6e96939f1bdb630599e5fb902a14	DDoSAgent	DDoSAgent elf
http://31.170.22.205/bins/whisper.arclehs38	1a3c8f2dbd32b05b5dc1c7ebd3b5cdaaf24fb5296978e6061671edca802a41f4	DDoSAgent	DDoSAgent elf
http://31.170.22.205/bins/whisper.mips	3d0ff85391334a8130b92bf85bb1b760f7f060508a5bfaab3ff7eb9a2ca53b0a	DDoSAgent	DDoSAgent elf mirai opendir
http://31.170.22.205/bins/whisper.mips64	b8c1191781c9feb322cfcacf40f4f1d207a09af4d786e26a7455e8a36afd4a1c	DDoSAgent	DDoSAgent elf mirai opendir
http://31.170.22.205/bins/whisper.mips64le	527a822afceebc65d8926a1dd0c3c97862f3e114db26f104797c58f45a2e609c	DDoSAgent	DDoSAgent elf mirai opendir
http://31.170.22.205/bins/whisper.mips64len32	c6a1cd7348531c4c0db50ecf21f64e444b33a3ff194ed55a467adb938ec22408	DDoSAgent	DDoSAgent elf
http://31.170.22.205/bins/whisper.mips64n32	90676d5a951bfb339c20472a0d3ff253767268f54be520eb6410522eeba9741e	DDoSAgent	DDoSAgent elf
http://31.170.22.205/bins/whisper.mipsle	e479f82af03dd6087f688cd398fc792a6443e362c9a36348ab53a3f6ddc591a2	DDoSAgent	DDoSAgent elf mirai opendir
http://31.170.22.205/bins/whisper.riscv32	45ca399bc539910e391f87bb398acac0f5c47410acb0d329ea3bf82406b3c189	DDoSAgent	DDoSAgent elf
http://31.170.22.205/bins/whisper.riscv64	84dbcc96a5ede7cb185d06f1116aee3bbe07e85ab020e86b5d4bfa9dcc6e60e1	DDoSAgent	DDoSAgent elf
http://31.170.22.205/bins/whisper.m68k	c304b1825bfe337bc1801440ca0bb1cda35aa96672d60952b852a5b2e3255f06	DDoSAgent	DDoSAgent elf
http://31.170.22.205/bins/whisper.sh4	n/a	n/a	elf
http://31.170.22.205/bins/whisper.i686	2ba541b4a6c62619d785852c86d67829118e70a52105ef37f32010aecb64784b	DDoSAgent	DDoSAgent elf
http://31.170.22.205/bins/whisper.x64	11742623bba0e1ca221814a36cd8239be94898c59fcc61c1328a6230a9981219	DDoSAgent	DDoSAgent elf mirai opendir
http://31.170.22.205/bins/whisper.powerpc440fp	197455fb6ac704dea344ee392427a842c243f6919c6886965b9586424b65e00b	DDoSAgent	DDoSAgent elf
http://31.170.22.205/bins/whisper.powerpc64e5500	1033d5f5d215d7df4d05737606f8323406eaeb9c215e1308fe48e77aba6f00f4	DDoSAgent	DDoSAgent elf
http://31.170.22.205/bins/whisper.powerpc64e6500	a97c72cdfb63586cf2bbf84c6839b38eaf7af1a474d6f5f27af0b11f7140f067	DDoSAgent	DDoSAgent elf
http://31.170.22.205/bins/whisper.powerpc64lepower8	4d5ef555aac80b752223c279e28e49de774e1a68309e426095c52690a105f313	DDoSAgent	DDoSAgent elf
http://31.170.22.205/bins/whisper.powerpc64power8	e3ed9343357d6cb963060d7908aa2637165f89cf21a4eb8f7538bb2ddb79e54f	DDoSAgent	DDoSAgent elf
http://31.170.22.205/bins/whisper.powerpce300c3	95d23e5693047c429dcf68baf9141ee074a578d08d434f6e1ae520374d0c7928	DDoSAgent	DDoSAgent elf
http://31.170.22.205/bins/whisper.powerpce500mc	189b5636d5a9a46a6ed38a7fdcd6b4f063fd7abc292363ff9ef7ac77852eae49	DDoSAgent	DDoSAgent elf
http://31.170.22.205/bins/whisper.sparc	25bf2d5845b6d3497bbceeeda40ba99a78e27f8ca88ec2efb690d919b4c5b8f6	DDoSAgent	DDoSAgent elf
http://31.170.22.205/bins/whisper.sparc64	0e7338e304ae5c960e232d80d98edb0a281d03c974ab13c6de4b0596fd0557c9	DDoSAgent	DDoSAgent elf
http://31.170.22.205/bins/whisper.armv4	n/a	n/a	elf

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

busybox

Link:

https://www.filescan.io/uploads/6a2d733f1f652d68657ded25/reports/7af77b05-bbdd-45e1-a45c-f3c4db859541/overview

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-06-13T08:54:00Z UTC

Last seen:

2026-06-15T00:48:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/d5ecab0f13eb33cf39c40cd671c78a44f20d619d52abf26da31fc86f1dac738c/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/a3c5fb86-059e-4d3b-b31f-cd11bb3cbaa8

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/d5ecab0f13eb33cf39c40cd671c78a44f20d619d52abf26da31fc86f1dac738c

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d5ecab0f13eb33cf39c40cd671c78a44f20d619d52abf26da31fc86f1dac738c/

Threat name:

Linux.Downloader.Generic

Status:

Suspicious

First seen:

2026-06-13 14:49:56 UTC

File Type:

Text (Shell)

AV detection:

11 of 23 (47.83%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=2xwkwdyt5mz46ooebtlhdr4kitza2ym5kkv7e3ndd7eg6hnmooga._file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/260613-sjdm6shw2m/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/d5ecab0f13eb33cf39c40cd671c78a44f20d619d52abf26da31fc86f1dac738c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh