MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f91e2a2fdb4a9d2b29b048447b8037efbb32b6a1fea8dc184c04dddd0c15d9e6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 4

Intelligence 4 IOCs YARA 4 File information Comments

SHA256 hash:	f91e2a2fdb4a9d2b29b048447b8037efbb32b6a1fea8dc184c04dddd0c15d9e6
SHA3-384 hash:	772d82c2c90500f63fb2e04771977cbde59fde7ab086f0a806f8ff920d6cd3e9033fed51dcf61be76a25f88b076c381a
SHA1 hash:	3ac061bb3e4aebb6ace9111883b1fe8d6595b75f
MD5 hash:	85f6f26e92628223fa33b256028f2524
humanhash:	sierra-queen-aspen-jupiter
File name:	dvr.sh
Download:	download sample
File size:	1'420 bytes
First seen:	2026-10-10 13:07:37 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	24:UpmApmiXxpm6NI7wpmSKwprJDpn9JpIp8YpNTtJptZpGmu:UpLpPhpkwp5Tpdpn9JpIplpNTpXpGmu
TLSH	T1A72123CA619265776CE8ED67717A8804B190E18F60CF6F495CDC38F984CEE0474147A7
Magika	batch
Reporter	BlinkzSec

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://176.65.139.135/arm	ceb3064b2db7948711964dbfaba861aee73ef415a4454929528b3f26a8dda263	Mirai	elf mirai ua-wget
http://176.65.139.135/arm5	9fac6abd1c35da9e68fb4f00f33de82306adf96093ea806f3c42d4a153e39c9e	Mirai	elf mirai ua-wget
http://176.65.139.135/arm6	311d843746a0c17469003556ee0fcce655f97ff20a304a3d6cf2c800dae44e50	Mirai	elf mirai ua-wget
http://176.65.139.135/arm7	f0cd29fff42a7dad4b00c7b1c684a7e759a159baef96f57a285e1ff7f61bbab5	Mirai	elf mirai ua-wget
http://176.65.139.135/mips	4dcfaccade6044355f8b933ad74c97085497d7e34762e5eab473dd2b5804b486	Mirai	elf mirai ua-wget
http://176.65.139.135/mpsl	dbe8e30860c8fc4f1470138113f3ea1983129319938b3bb98f3616df0ac23f01	Mirai	elf mirai ua-wget
http://176.65.139.135/x86_64	7050da3bd5b59468f4ab8457cf5f11b1cd5f556e54e2e0b1d5b1556088b949d8	Mirai	elf mirai ua-wget
http://176.65.139.135/ppc	d6bac5a15715c7e1f917c1e9bda5631e852f0e61388efbbace90b5a00b653ad3	Mirai	elf mirai ua-wget
http://176.65.139.135/sh4	bb85d7ed379fee306fa43fb0724720e5584bbcc6792780889408daf6f4024604	Mirai	elf mirai ua-wget
http://176.65.139.135/spc	7a0efc7fd55dd9e665342b788b092f5660597ba1e3526f1bec3be14399a06e53	Mirai	elf mirai ua-wget
http://176.65.139.135/m68k	df00f0dd7e94d5b0fa9bab04f681f313e8f7de19b8af9eca5e862290e1f7d519	Mirai	elf mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/9cb2ba05-f735-4d03-b40c-ff12d0899399

Behavior Graph:

Download SVG

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/f91e2a2fdb4a9d2b29b048447b8037efbb32b6a1fea8dc184c04dddd0c15d9e6

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f91e2a2fdb4a9d2b29b048447b8037efbb32b6a1fea8dc184c04dddd0c15d9e6/

Threat name:

Linux.Downloader.Medusa

Status:

Malicious

First seen:

2026-10-10 13:07:39 UTC

File Type:

Text (Shell)

AV detection:

21 of 36 (58.33%)

Threat level:

3/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7epcul63jkoswknqjbchxabx565tfnvb72unygcmato52dav3hta._file

Result

Malware family:

n/a

Score:

3/10

Tags:

execution

Link:

https://tria.ge/reports/261010-qdcsksvxft/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Executes a command shell one-liner

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ach_202412_suspect_bash_script Create hunting rule
Author:	abuse.ch
Description:	Detects suspicious Linux bash scripts

Rule name:	LIN_Downloader_Unknown_WgetChmodExecute Create hunting rule
Author:	Marjoriefort
Description:	Script shell downloader : wget+curl, chmod 777, execution, effacement (rm -rf) - botnet style
Reference:	misses_archive / grappe 5.182.210.174

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh