MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fbed4f44e5ec71bdbcc695d5d88f0b0c1e8497a4f0e6dddd07105f8bc3447949. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fbed4f44e5ec71bdbcc695d5d88f0b0c1e8497a4f0e6dddd07105f8bc3447949
SHA3-384 hash: 3c0779ca2216f78d3a809f78c8f5cd891d860ba988614b784af4ca8e3b08a1ca90279afd6f9c23e7182587898eae64a3
SHA1 hash: c9263180f39e42f058fef9f3a2236f4d7a56aa90
MD5 hash: 2ea787f8601af46d41caafa7904d95eb
humanhash: table-jig-salami-lactose
File name:adb.sh
Download: download sample
File size:2'995 bytes
First seen:2026-05-15 13:21:05 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 48:RFkByGFGHgFsbFsgFmcF01FKBFmD8WFYYFUGFo3FC91:RPGGgUfVEWwzhru4b
TLSH T1FB51CBC40371793669961430B5E38408B17D78B477C3192ABDF96875C88CE1633EEEB6
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter adliwahid
URLMalware sample (SHA256 hash)SignatureTags
http://46.8.78.55/systemctl/bin.powerpc13bf410c074e93d0630ac25e6ee673f44af8413231515083632fa036458c1b48 Miraielf mirai ua-wget
http://46.8.78.55/systemctl/bin.mipsdee911cd0b2987cedfbad85a750a8e56ce10815569212dfa548bc61e83fadb7d Miraielf mirai ua-wget
http://46.8.78.55/systemctl/bin.mipselb47494d1bf71d36cd689e11d4620e61748a91199431c5bd3ac8f3e50879e1b6d Miraielf mirai ua-wget
http://46.8.78.55/systemctl/bin.armv4l903b4771836b5d15d001ce1016694b79b2d7bd3cd07f750128fe6ebe6e9c7d6e Miraielf mirai ua-wget
http://46.8.78.55/systemctl/bin.armv5lb05b5b535f82ac5278c8d97f4dffad2fae85520fca637fd338c77282eab04463 Miraielf mirai ua-wget
http://46.8.78.55/systemctl/bin.armv6ldb007854a1f8f35678d3f16be61a8f949ef508da346e9b694b57aa885fddf807 Miraielf mirai ua-wget
http://46.8.78.55/systemctl/bin.armv7l46744f9bd253813f795c7ee141b39ee1748789dd79d29fcbb9e7aeb0dd0e7868 Miraielf mirai ua-wget
http://46.8.78.55/systemctl/bin.m68k9685d9bf268852a383694557b1bf2b2c0c584792425cb923fb7ff9de0b71357e Miraielf mirai ua-wget
http://46.8.78.55/systemctl/bin.sh4a94da43bdbb1fcdee40090d5db164c836ce7158276cf31394152d5ff7106ab93 Miraielf mirai ua-wget
http://46.8.78.55/systemctl/bin.sparca86b1ce27facb1e90ff1d4a99ae5e997cda168ce3371065fb50599db11be316a Miraielf mirai ua-wget
http://46.8.78.55/systemctl/bin.arcf72c63b9bb8ea52c32c395d742a8f5d2428b230c18b87a4b7877e259344adc99 Miraielf mirai ua-wget
http://46.8.78.55/systemctl/bin.i586369ea644e59db3ef1068d7615223835628388b2e3ac5c6aadc83b871c061611d Miraielf mirai ua-wget

Intelligence

File Origin
# of uploads :
1
# of downloads :
37
Origin country :
NL NL
Vendor Threat Intelligence
No detections
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-05-14T22:27:00Z UTC
Last seen:
2026-05-16T01:40:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan-Downloader.Shell.Agent.gen HEUR:Trojan-Downloader.Shell.Agent.a
Link:
https://opentip.kaspersky.com/fbed4f44e5ec71bdbcc695d5d88f0b0c1e8497a4f0e6dddd07105f8bc3447949/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/bf4890e4-c62f-4405-9c64-0bc01a615e2d
Behavior Graph:
Download SVG
%3
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/fbed4f44e5ec71bdbcc695d5d88f0b0c1e8497a4f0e6dddd07105f8bc3447949
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fbed4f44e5ec71bdbcc695d5d88f0b0c1e8497a4f0e6dddd07105f8bc3447949/
Verdict:
Malicious
Threat:
Trojan-Downloader.Shell.Agent
Link:
https://tip.neiki.dev/file/fbed4f44e5ec71bdbcc695d5d88f0b0c1e8497a4f0e6dddd07105f8bc3447949
Threat name:
Script-Shell.Trojan.Vigorf
Create hunting rule
Status:
Malicious
First seen:
2026-05-15 03:28:22 UTC
File Type:
Text (Shell)
AV detection:
8 of 24 (33.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7pwu6rhf5ry33pggsxk5rdylbqpijf5e6dtn3xihcbpyxq2epfeq._file
Result
Malware family:
n/a
Score:
  1/10
Tags:
linux
Link:
https://tria.ge/reports/260515-qmbxmsdz5q/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/fbed4f44e5ec71bdbcc695d5d88f0b0c1e8497a4f0e6dddd07105f8bc3447949

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MAL_Linux_IoT_MultiArch_BotnetLoader_Generic
Create hunting rule
Author:Anish Bogati
Description:Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:MalwareBazaar sample lilin.sh

File information

The table below shows additional information about this malware sample such as delivery method and external references.

sh fbed4f44e5ec71bdbcc695d5d88f0b0c1e8497a4f0e6dddd07105f8bc3447949

(this sample)

Mirai

elf 437fe2ea35b2f241e8a6210fbfa41b2e550cbec12948e0d9035e5a4b11b18331

  
Dropping
MD5 a981f56215e28c2b20cd07f1375010bb
  
Dropping
SHA256 437fe2ea35b2f241e8a6210fbfa41b2e550cbec12948e0d9035e5a4b11b18331

Comments