MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fde5c61d83476d9cc56e34ddb546e6431e8c59eb48401a7cf8a11db348e2d59c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fde5c61d83476d9cc56e34ddb546e6431e8c59eb48401a7cf8a11db348e2d59c
SHA3-384 hash: 97030ec8ac0074c9d71b228fb63bf4037ccbf124e618132000c985ba5d4821375e98c30413af273fa99c6fc4e6ab400b
SHA1 hash: 073b24d629d052f4ea0119c2b92d0de75283e76a
MD5 hash: 7a3bc22470e50d7f37acc43d4d19ffe5
humanhash: winner-berlin-foxtrot-berlin
File name:wget.sh
Download: download sample
File size:1'017 bytes
First seen:2025-12-25 19:18:52 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 12:oMyxEhbVsljf9NIl5tnCa0LK+WNgO1OJiccO7ChSvVANtjKVrf2G9Pc0ftdv:t4lRNI7IKG1ieUA2NtmdO0Plf7
TLSH T1BB1149CF159152714808DEACA97B441C959AB5C1AEB0EF3D9CC45E3FCCDA62D3038E66
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://143.20.185.93/bins/armn/an/aelf ua-wget
http://143.20.185.93/bins/arm5n/an/aelf ua-wget
http://143.20.185.93/bins/arm6n/an/aelf ua-wget
http://143.20.185.93/bins/arm7n/an/aelf ua-wget
http://143.20.185.93/bins/m68kn/an/aelf ua-wget
http://143.20.185.93/bins/mipsn/an/aelf ua-wget
http://143.20.185.93/bins/mpsln/an/aelf ua-wget
http://143.20.185.93/bins/ppcn/an/aelf ua-wget
http://143.20.185.93/bins/sh4n/an/aelf ua-wget
http://143.20.185.93/bins/spcn/an/aelf ua-wget
http://143.20.185.93/bins/x86n/an/aelf ua-wget
http://143.20.185.93/bins/x86_64n/an/aelf ua-wget

Intelligence

File Origin
# of uploads :
1
# of downloads :
34
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.DownLoader.37.515.5683.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive
Link:
https://www.filescan.io/uploads/694d8e4ce126b9ff43914d95/reports/bff29826-bab9-42b0-ac55-982c30dd942d/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2025-12-25T16:31:00Z UTC
Last seen:
2025-12-26T12:48:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan-Downloader.Shell.Agent.p HEUR:Trojan-Downloader.Shell.Agent.a
Link:
https://opentip.kaspersky.com/fde5c61d83476d9cc56e34ddb546e6431e8c59eb48401a7cf8a11db348e2d59c/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/53f2e538-4d10-44eb-9f3a-600acc4ac6bd
Behavior Graph:
Download SVG
%3 guuid=50a59544-1900-0000-0011-df8471060000 pid=1649 /usr/bin/sudo guuid=93134747-1900-0000-0011-df847a060000 pid=1658 /tmp/sample.bin guuid=50a59544-1900-0000-0011-df8471060000 pid=1649->guuid=93134747-1900-0000-0011-df847a060000 pid=1658 execve guuid=93eaa847-1900-0000-0011-df847c060000 pid=1660 /usr/bin/wget net send-data guuid=93134747-1900-0000-0011-df847a060000 pid=1658->guuid=93eaa847-1900-0000-0011-df847c060000 pid=1660 execve guuid=b6fac44f-1900-0000-0011-df8495060000 pid=1685 /usr/bin/chmod guuid=93134747-1900-0000-0011-df847a060000 pid=1658->guuid=b6fac44f-1900-0000-0011-df8495060000 pid=1685 execve guuid=db472950-1900-0000-0011-df8497060000 pid=1687 /usr/bin/bash guuid=93134747-1900-0000-0011-df847a060000 pid=1658->guuid=db472950-1900-0000-0011-df8497060000 pid=1687 clone guuid=749ec251-1900-0000-0011-df849d060000 pid=1693 /usr/bin/wget net send-data guuid=93134747-1900-0000-0011-df847a060000 pid=1658->guuid=749ec251-1900-0000-0011-df849d060000 pid=1693 execve guuid=653d3158-1900-0000-0011-df84b1060000 pid=1713 /usr/bin/chmod guuid=93134747-1900-0000-0011-df847a060000 pid=1658->guuid=653d3158-1900-0000-0011-df84b1060000 pid=1713 execve guuid=7df18058-1900-0000-0011-df84b5060000 pid=1717 /usr/bin/bash guuid=93134747-1900-0000-0011-df847a060000 pid=1658->guuid=7df18058-1900-0000-0011-df84b5060000 pid=1717 clone guuid=4ac90d5a-1900-0000-0011-df84b8060000 pid=1720 /usr/bin/wget net send-data guuid=93134747-1900-0000-0011-df847a060000 pid=1658->guuid=4ac90d5a-1900-0000-0011-df84b8060000 pid=1720 execve guuid=c2bb0f60-1900-0000-0011-df84c4060000 pid=1732 /usr/bin/chmod guuid=93134747-1900-0000-0011-df847a060000 pid=1658->guuid=c2bb0f60-1900-0000-0011-df84c4060000 pid=1732 execve guuid=4e715560-1900-0000-0011-df84c6060000 pid=1734 /usr/bin/bash guuid=93134747-1900-0000-0011-df847a060000 pid=1658->guuid=4e715560-1900-0000-0011-df84c6060000 pid=1734 clone guuid=97f4f460-1900-0000-0011-df84ca060000 pid=1738 /usr/bin/wget net send-data guuid=93134747-1900-0000-0011-df847a060000 pid=1658->guuid=97f4f460-1900-0000-0011-df84ca060000 pid=1738 execve guuid=2b8bfd66-1900-0000-0011-df84d9060000 pid=1753 /usr/bin/chmod guuid=93134747-1900-0000-0011-df847a060000 pid=1658->guuid=2b8bfd66-1900-0000-0011-df84d9060000 pid=1753 execve guuid=1b534567-1900-0000-0011-df84db060000 pid=1755 /usr/bin/bash guuid=93134747-1900-0000-0011-df847a060000 pid=1658->guuid=1b534567-1900-0000-0011-df84db060000 pid=1755 clone guuid=ec8cd767-1900-0000-0011-df84de060000 pid=1758 /usr/bin/wget net send-data guuid=93134747-1900-0000-0011-df847a060000 pid=1658->guuid=ec8cd767-1900-0000-0011-df84de060000 pid=1758 execve guuid=95c1a36d-1900-0000-0011-df84f0060000 pid=1776 /usr/bin/chmod guuid=93134747-1900-0000-0011-df847a060000 pid=1658->guuid=95c1a36d-1900-0000-0011-df84f0060000 pid=1776 execve guuid=8946ec6d-1900-0000-0011-df84f2060000 pid=1778 /usr/bin/bash guuid=93134747-1900-0000-0011-df847a060000 pid=1658->guuid=8946ec6d-1900-0000-0011-df84f2060000 pid=1778 clone guuid=c812796e-1900-0000-0011-df84f5060000 pid=1781 /usr/bin/wget net send-data guuid=93134747-1900-0000-0011-df847a060000 pid=1658->guuid=c812796e-1900-0000-0011-df84f5060000 pid=1781 execve guuid=1d156074-1900-0000-0011-df8401070000 pid=1793 /usr/bin/chmod guuid=93134747-1900-0000-0011-df847a060000 pid=1658->guuid=1d156074-1900-0000-0011-df8401070000 pid=1793 execve guuid=5bbfb674-1900-0000-0011-df8402070000 pid=1794 /usr/bin/bash guuid=93134747-1900-0000-0011-df847a060000 pid=1658->guuid=5bbfb674-1900-0000-0011-df8402070000 pid=1794 clone guuid=c7dad875-1900-0000-0011-df8407070000 pid=1799 /usr/bin/wget net send-data guuid=93134747-1900-0000-0011-df847a060000 pid=1658->guuid=c7dad875-1900-0000-0011-df8407070000 pid=1799 execve guuid=3e68447c-1900-0000-0011-df8412070000 pid=1810 /usr/bin/chmod guuid=93134747-1900-0000-0011-df847a060000 pid=1658->guuid=3e68447c-1900-0000-0011-df8412070000 pid=1810 execve guuid=8904af7c-1900-0000-0011-df8414070000 pid=1812 /usr/bin/bash guuid=93134747-1900-0000-0011-df847a060000 pid=1658->guuid=8904af7c-1900-0000-0011-df8414070000 pid=1812 clone guuid=b5fd377e-1900-0000-0011-df8418070000 pid=1816 /usr/bin/wget net send-data guuid=93134747-1900-0000-0011-df847a060000 pid=1658->guuid=b5fd377e-1900-0000-0011-df8418070000 pid=1816 execve guuid=fcba7d85-1900-0000-0011-df8429070000 pid=1833 /usr/bin/chmod guuid=93134747-1900-0000-0011-df847a060000 pid=1658->guuid=fcba7d85-1900-0000-0011-df8429070000 pid=1833 execve guuid=61a7d985-1900-0000-0011-df842b070000 pid=1835 /usr/bin/bash guuid=93134747-1900-0000-0011-df847a060000 pid=1658->guuid=61a7d985-1900-0000-0011-df842b070000 pid=1835 clone guuid=f4ce5d88-1900-0000-0011-df8431070000 pid=1841 /usr/bin/wget net send-data guuid=93134747-1900-0000-0011-df847a060000 pid=1658->guuid=f4ce5d88-1900-0000-0011-df8431070000 pid=1841 execve guuid=9c73a58e-1900-0000-0011-df843e070000 pid=1854 /usr/bin/chmod guuid=93134747-1900-0000-0011-df847a060000 pid=1658->guuid=9c73a58e-1900-0000-0011-df843e070000 pid=1854 execve guuid=5834088f-1900-0000-0011-df8440070000 pid=1856 /usr/bin/bash guuid=93134747-1900-0000-0011-df847a060000 pid=1658->guuid=5834088f-1900-0000-0011-df8440070000 pid=1856 clone guuid=c4477c90-1900-0000-0011-df8444070000 pid=1860 /usr/bin/wget net send-data guuid=93134747-1900-0000-0011-df847a060000 pid=1658->guuid=c4477c90-1900-0000-0011-df8444070000 pid=1860 execve guuid=c2731f97-1900-0000-0011-df8452070000 pid=1874 /usr/bin/chmod guuid=93134747-1900-0000-0011-df847a060000 pid=1658->guuid=c2731f97-1900-0000-0011-df8452070000 pid=1874 execve guuid=cdffc197-1900-0000-0011-df8453070000 pid=1875 /usr/bin/bash guuid=93134747-1900-0000-0011-df847a060000 pid=1658->guuid=cdffc197-1900-0000-0011-df8453070000 pid=1875 clone guuid=f2e09c98-1900-0000-0011-df8456070000 pid=1878 /usr/bin/wget net send-data guuid=93134747-1900-0000-0011-df847a060000 pid=1658->guuid=f2e09c98-1900-0000-0011-df8456070000 pid=1878 execve guuid=a9f6149f-1900-0000-0011-df8464070000 pid=1892 /usr/bin/chmod guuid=93134747-1900-0000-0011-df847a060000 pid=1658->guuid=a9f6149f-1900-0000-0011-df8464070000 pid=1892 execve guuid=8b96859f-1900-0000-0011-df8466070000 pid=1894 /usr/bin/bash guuid=93134747-1900-0000-0011-df847a060000 pid=1658->guuid=8b96859f-1900-0000-0011-df8466070000 pid=1894 clone guuid=0b3d1da0-1900-0000-0011-df8469070000 pid=1897 /usr/bin/wget net send-data guuid=93134747-1900-0000-0011-df847a060000 pid=1658->guuid=0b3d1da0-1900-0000-0011-df8469070000 pid=1897 execve guuid=deb565a6-1900-0000-0011-df8478070000 pid=1912 /usr/bin/chmod guuid=93134747-1900-0000-0011-df847a060000 pid=1658->guuid=deb565a6-1900-0000-0011-df8478070000 pid=1912 execve guuid=ec43ada6-1900-0000-0011-df8479070000 pid=1913 /usr/bin/bash guuid=93134747-1900-0000-0011-df847a060000 pid=1658->guuid=ec43ada6-1900-0000-0011-df8479070000 pid=1913 clone guuid=244d1fa9-1900-0000-0011-df847f070000 pid=1919 /usr/bin/rm delete-file guuid=93134747-1900-0000-0011-df847a060000 pid=1658->guuid=244d1fa9-1900-0000-0011-df847f070000 pid=1919 execve 231a35ab-eb87-5dd8-a50b-9644d4223c8a 143.20.185.93:80 guuid=93eaa847-1900-0000-0011-df847c060000 pid=1660->231a35ab-eb87-5dd8-a50b-9644d4223c8a send: 136B guuid=749ec251-1900-0000-0011-df849d060000 pid=1693->231a35ab-eb87-5dd8-a50b-9644d4223c8a send: 137B guuid=4ac90d5a-1900-0000-0011-df84b8060000 pid=1720->231a35ab-eb87-5dd8-a50b-9644d4223c8a send: 137B guuid=97f4f460-1900-0000-0011-df84ca060000 pid=1738->231a35ab-eb87-5dd8-a50b-9644d4223c8a send: 137B guuid=ec8cd767-1900-0000-0011-df84de060000 pid=1758->231a35ab-eb87-5dd8-a50b-9644d4223c8a send: 137B guuid=c812796e-1900-0000-0011-df84f5060000 pid=1781->231a35ab-eb87-5dd8-a50b-9644d4223c8a send: 137B guuid=c7dad875-1900-0000-0011-df8407070000 pid=1799->231a35ab-eb87-5dd8-a50b-9644d4223c8a send: 137B guuid=b5fd377e-1900-0000-0011-df8418070000 pid=1816->231a35ab-eb87-5dd8-a50b-9644d4223c8a send: 136B guuid=f4ce5d88-1900-0000-0011-df8431070000 pid=1841->231a35ab-eb87-5dd8-a50b-9644d4223c8a send: 136B guuid=c4477c90-1900-0000-0011-df8444070000 pid=1860->231a35ab-eb87-5dd8-a50b-9644d4223c8a send: 136B guuid=f2e09c98-1900-0000-0011-df8456070000 pid=1878->231a35ab-eb87-5dd8-a50b-9644d4223c8a send: 136B guuid=0b3d1da0-1900-0000-0011-df8469070000 pid=1897->231a35ab-eb87-5dd8-a50b-9644d4223c8a send: 139B
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/fde5c61d83476d9cc56e34ddb546e6431e8c59eb48401a7cf8a11db348e2d59c
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fde5c61d83476d9cc56e34ddb546e6431e8c59eb48401a7cf8a11db348e2d59c/
Verdict:
Malicious
Threat:
Trojan-Downloader.Shell.Agent
Link:
https://tip.neiki.dev/file/fde5c61d83476d9cc56e34ddb546e6431e8c59eb48401a7cf8a11db348e2d59c
Threat name:
Document-HTML.Downloader.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2025-12-25 19:19:35 UTC
File Type:
Text (Shell)
AV detection:
13 of 24 (54.17%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7xs4mhmdi5wzzrlogto3krxgimpiywpljbabu7hyueo3gshc2woa._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
defense_evasion discovery linux
Link:
https://tria.ge/reports/251225-x1skwaznhp/
Behaviour
System Network Configuration Discovery
Writes file to tmp directory
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.31
Link:
https://yomi.yoroi.company/submissions/fde5c61d83476d9cc56e34ddb546e6431e8c59eb48401a7cf8a11db348e2d59c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:MAL_Linux_IoT_MultiArch_BotnetLoader_Generic
Create hunting rule
Author:Anish Bogati
Description:Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:MalwareBazaar sample lilin.sh

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh fde5c61d83476d9cc56e34ddb546e6431e8c59eb48401a7cf8a11db348e2d59c

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3743563/
  
Delivery method
Distributed via web download

Comments