MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e3daa5b01a686d80b44d14b58cf595955a7dcaa8e9c715871b02c694c3f6e3ec. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e3daa5b01a686d80b44d14b58cf595955a7dcaa8e9c715871b02c694c3f6e3ec
SHA3-384 hash: 0f06a5930c9f51d9ef2010ad13a65fcb440018053b0c4e3a3b4dacfaba12a3ff03396f3053d60df925891042cb274c24
SHA1 hash: ab7f581e733a1ca828d6d81e773002815e6cfbb6
MD5 hash: ded9b72d63efbd24411bec4fbdfe776c
humanhash: princess-carolina-wolfram-kilo
File name:l
Download: download sample
File size:986 bytes
First seen:2025-05-01 06:07:19 UTC
Last seen:Never
File type: sh
MIME type:text/plain
ssdeep 24:yRk5zOt+MB08xJxDkpxSxnkx0kpxSx3x0kpxSxSx0kpx8jn:4k5CEA0gzDkpxOo0kpxOh0kpxOO0kpxY
TLSH T1BB11E9CF50A8DE7268404EDD31D31A15B8C6C9D906CF8FC6E04E01A9A1CC94DB661E7A
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://94.26.90.217/vv/armv4la82594f321a14d22c63b44b8b3f4e5dcb725aeda14db201cfe59d6b37cb8093f Miraielf gafgyt mirai ua-wget
http://94.26.90.217/vv/armv7lae5dbccdfcd0e48e2065b462be5879d1c103e3dc9c553ce8eb319c6385580d78 Miraielf gafgyt mirai ua-wget

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
DE DE
Vendor Threat Intelligence
Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=681315dccc5fb3600cc5add6linux22vpnfull_triage
Tags:
agent hype sage
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
busybox evasive obfuscated
Link:
https://www.filescan.io/uploads/68130fc8218c4a98adea94af/reports/0306f449-8692-42d4-bb54-ef16a384867c/overview
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/e3daa5b01a686d80b44d14b58cf595955a7dcaa8e9c715871b02c694c3f6e3ec
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e3daa5b01a686d80b44d14b58cf595955a7dcaa8e9c715871b02c694c3f6e3ec/
Threat name:
Script-Shell.Downloader.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2025-04-30 23:07:48 UTC
File Type:
Text (Shell)
AV detection:
5 of 36 (13.89%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4pnklma2nbwybncncs2yz5mvsvnh3svi5hdrlby3aldjjq7w4pwa._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/250501-gw5rmstk17/
Behaviour
Modifies registry class
Suspicious use of SetWindowsHookEx
Enumerates physical storage devices
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/e3daa5b01a686d80b44d14b58cf595955a7dcaa8e9c715871b02c694c3f6e3ec

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh e3daa5b01a686d80b44d14b58cf595955a7dcaa8e9c715871b02c694c3f6e3ec

(this sample)

Mirai

elf 35c14500814ac5bc2c71312bb1323f3be34afa878c7f06cefb0bf26f983564db

  
URLhaus
https://urlhaus.abuse.ch/url/3531257/
  
Delivery method
Distributed via web download
  
Dropping
MD5 9aff45bce598a65ad3f904f1bda32707
  
Dropping
SHA256 35c14500814ac5bc2c71312bb1323f3be34afa878c7f06cefb0bf26f983564db

Comments