MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 daeb35512ea892ed7b7778bf39fdab506cc2a76f805cea64461af00f3b0e08d0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 6

Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash:	daeb35512ea892ed7b7778bf39fdab506cc2a76f805cea64461af00f3b0e08d0
SHA3-384 hash:	1e1ab2657dcbf62da8ae6cb3801f10849296e0fe0400901a915a42823dd7c017a5277b03a5b8692b208b1c17dc4ddc85
SHA1 hash:	585d05e4e3ed55bfd7fbfa9d2630011d96b85769
MD5 hash:	3c6c32c6e66cff4270553606a4a971ea
humanhash:	paris-white-don-foxtrot
File name:	lel.sh
Download:	download sample
File size:	2'081 bytes
First seen:	2026-10-07 12:29:34 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	24:5jv6ry6rG6rGB8r6r9ru6ri6rGUvUBr6rGUvUF:6PrGB39PfGK8sGKa
TLSH	T13041D38260918B72DE8DCA567A688D0C70D972C1A8D1FF0ADCF665B7DD4EE483002E61
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://143.20.185.213/x64s	2aabae20e3321ad0e102a7a3fcf546115a310710110712dad7b43127fa0eb6b0	Mirai	elf mirai sh
http://143.20.185.213/mips	87636741a0c01869a100e6d9d396eafe24d8392cd543af30f07d9c28291be1ce	Mirai	mirai
http://143.20.185.213/mpsl	89aad9f5cee8dabb4b6ae728d320511620df1e51e9fb5d783f603147e4a27e44	Mirai	mirai
http://143.20.185.213/armv7	873144883b9cb2baa3750b087e537d3032e4cd1ad32fd874ac82d83f3063d14f	Mirai	elf mirai ua-wget
http://143.20.185.213/armv5	92a0e46d71aa833ac83ab35b5d05d05731a3ffef45eb2dc76317c0459c3202cb	Mirai	elf mirai ua-wget
http://143.20.185.213/aarch64	00beaa403e9b2c5087f4d366d3b49a2066075de0378ae3dfbeff9e722c6b94a7	Mirai	elf mirai sh

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

busybox evasive expand lolbin

Link:

https://www.filescan.io/uploads/6ac63b686fdf977218a63f17/reports/464e8fb6-fbeb-43d2-abf9-ec68b6be6d7f/overview

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-10-07T11:03:00Z UTC

Last seen:

2026-10-07T11:16:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/daeb35512ea892ed7b7778bf39fdab506cc2a76f805cea64461af00f3b0e08d0/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/dda32d51-8d16-4916-9feb-b3991190c0d2

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/daeb35512ea892ed7b7778bf39fdab506cc2a76f805cea64461af00f3b0e08d0

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/daeb35512ea892ed7b7778bf39fdab506cc2a76f805cea64461af00f3b0e08d0/

Threat name:

Linux.Trojan.Ravartar

Status:

Malicious

First seen:

2026-10-07 12:30:28 UTC

File Type:

Text (Shell)

AV detection:

13 of 38 (34.21%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=3lvtkujovcjo263xpc7tt7nlkbwmfj3pqboouzcgdlya6oyobdia._file

Result

Malware family:

n/a

Score:

9/10

Tags:

antivm defense_evasion discovery linux

Link:

https://tria.ge/reports/261007-ppmw9aax6p/

Behaviour

Enumerates kernel/hardware configuration

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Changes its process name

Checks CPU configuration

Reads CPU attributes

Enumerates running processes

Reads MAC address of network interface

Reads network interface configuration

File and Directory Permissions Modification

Executes dropped EXE

Renames itself

Contacts a large (1126296) amount of remote hosts

Creates a large amount of network flows

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.29

Link:

https://yomi.yoroi.company/submissions/daeb35512ea892ed7b7778bf39fdab506cc2a76f805cea64461af00f3b0e08d0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.