MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 00b9891e563d57484eb3fb74b168b4b37e60bfb3bce93adbd0bb978844097eb2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	00b9891e563d57484eb3fb74b168b4b37e60bfb3bce93adbd0bb978844097eb2
SHA3-384 hash:	084261fcff4a633c183f066d098ea01d0c1a3e376f358a4a275ac4b4976db7820ab423fa5b69033b5c41b58983e71d01
SHA1 hash:	b1a99ecd4bffe5c8c449d5024d9aba8f919c2364
MD5 hash:	4b022bf148edeea3f7cc8cb33008d8c1
humanhash:	harry-paris-oranges-william
File name:	wg
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	998 bytes
First seen:	2025-12-22 16:41:07 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	24:6LM5f6BXAyGhciaDpFh+GUIKtprkhwiZxAhbL:BZ6BwELF0GUIewjA
TLSH	T1D91151DF042CDF23918C5A6A7E91783660F807A5387B07BC7FE5489A188E540236CE63
Magika	batch
Reporter	abuse_ch
Tags:	sh

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

35

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/00b9891e563d57484eb3fb74b168b4b37e60bfb3bce93adbd0bb978844097eb2

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

text

First seen:

2025-12-22T14:43:00Z UTC

Last seen:

2025-12-22T15:01:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/00b9891e563d57484eb3fb74b168b4b37e60bfb3bce93adbd0bb978844097eb2/results?tab=lookup

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/416f6497-9735-4f47-9a82-c95b85b7a9b9

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/00b9891e563d57484eb3fb74b168b4b37e60bfb3bce93adbd0bb978844097eb2

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/00b9891e563d57484eb3fb74b168b4b37e60bfb3bce93adbd0bb978844097eb2/

ReversingLabs TitaniumCloud Script-Shell.Downloader.Heuristic

Threat name:

Script-Shell.Downloader.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-12-22 16:41:05 UTC

File Type:

Text (Shell)

AV detection:

9 of 24 (37.50%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ac4yshswhvluqtvt7n2lc2fuwn7gbp5txtutvw6qxolyqrajp2za._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

n/a

Link:

https://tria.ge/reports/251223-k1m9ya1ndv/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/00b9891e563d57484eb3fb74b168b4b37e60bfb3bce93adbd0bb978844097eb2