MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e62bdc48e767f2042935aa38a054fa3f2795859ab842ff94d99e5ea554fa8a13. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 4

Intelligence 4 IOCs YARA 1 File information Comments

SHA256 hash:	e62bdc48e767f2042935aa38a054fa3f2795859ab842ff94d99e5ea554fa8a13
SHA3-384 hash:	00c96bd8367a1a015c4299ae445248fb1f307c07befccf2055005bd8f89fcf5feef95292c0f272516faf4f925ba2a78f
SHA1 hash:	67cf267e81e9cb510598430178d2eb48b33a5dff
MD5 hash:	6320d89b34b0f10203fcb1b2a89f445e
humanhash:	dakota-salami-eighteen-minnesota
File name:	ssh
Download:	download sample
File size:	1'010 bytes
First seen:	2026-10-27 05:10:15 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	24:ZeV59C7ieKVCNGth4TVTm8CT7LoRCeXiOts70Tv8K8B5XrQ/Sj8C74tWshtYHIWV:ZeVW7lKogC50/LoMeXrtnHk7BP49MIWV
TLSH	T1E2111FD50DA2791FD95CAA3AB391894DD0987B8524BF2FACECD33D3884918907424F8F
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	BlinkzSec

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://176.65.139.40/jklarm	2f052afbdbe8e7c75152865006dab713d06d0595bca172acd4127c2cf9850aa1	Mirai	elf mirai
http://176.65.139.40/jklarm5	abca7c4519e1e81d7085adfc60a0afe5a04153a00f3e019f1c181e96334c1c6d	Mirai	automated cowrie honeypot mirai
http://176.65.139.40/jklarm6	0687b48240325ea8a4a79e4bd9af103d7c9d176145253ade5b036ba5bc25c766	Mirai	automated cowrie honeypot mirai
http://176.65.139.40/jklarm7	fd7d3abff959a5790edc95eba30479e19c6242d3b32abc95a95fd12a55e989dc	Mirai	elf mirai
http://176.65.139.40/jklm68k	9e6be07d6fb7ed87dd4b55ea892d823719cf5d102324e6bbfacb15861ec1ded6	Mirai	elf mirai ua-wget
http://176.65.139.40/jklmips	7df9ad411f034395500a16dfe33d100ea2ab34c9ca0520e101b0b298db3918fc	Mirai	elf mirai ua-wget
http://176.65.139.40/jklmpsl	353e0bac2ad9ad2c57365688c47666edf1f9424853e7e4f47ef9f8278d62e1ee	Mirai	elf mirai ua-wget
http://176.65.139.40/jklppc	51283ea23f0e9ab8d8eff3cd7f06e5e357c0abc5cfac80289b9b7d94587faa7e	Mirai	elf mirai ua-wget
http://176.65.139.40/jklsh4	30ddb929abcea6e444fea8a74824302df2c66ddb48b99a3ba58f5a9aa967e6d4	Mirai	elf mirai ua-wget
http://176.65.139.40/jklspc	bb8aa148998808a63fa6db511dd144d4942831a4975d12ca8c7f50abbe36a9d8	Mirai	elf mirai ua-wget
http://176.65.139.40/jklx86	d0312239fdb46ff37e658af54855ff867b1a158e70b04a444c37d236fc68cb55	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/b358042a-a66c-4eae-b439-998de4778426

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/e62bdc48e767f2042935aa38a054fa3f2795859ab842ff94d99e5ea554fa8a13

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e62bdc48e767f2042935aa38a054fa3f2795859ab842ff94d99e5ea554fa8a13/

Threat name:

Document-HTML.Downloader.Heuristic

Status:

Malicious

First seen:

2026-10-27 05:08:38 UTC

File Type:

Text (Shell)

AV detection:

9 of 36 (25.00%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=4yv5yshhm7zaikjvvi4kavh2h4tzlbm2xbbp7fgztzpkkvh2rijq._file

Result

Malware family:

n/a

Score:

1/10

Tags:

linux

Link:

https://tria.ge/reports/261027-ft47naax2z/

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh