MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 00cef478e2ba3d10e81076021d5f944613d1eeafcff46e2366a7512980ddee60. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	00cef478e2ba3d10e81076021d5f944613d1eeafcff46e2366a7512980ddee60
SHA3-384 hash:	e04c85a03a44b3c114f32afab097f32c426e79e8762fcdbd73a593478153c1cd5de38c3d91f1d4d7647d7bd2a1d026f8
SHA1 hash:	18322dcb95b6e284e8237ca74843c2da7a12585f
MD5 hash:	dd5ad7b51c0c377133f18b141d2de211
humanhash:	earth-burger-william-jig
File name:	w.sh
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	804 bytes
First seen:	2025-11-02 18:12:24 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	12:llHFS4UFKNIl5LF30LKGJD+OTJUJFJoabSTHbSTH8iHkYpyS:ouNI78KuD+4UJvoWw7wciEW/
TLSH	T1C601DEDD60B2E7920649DF44A067CA3D90148ED1A390CF9D68CC0E72ADD4D15731AA49
Magika	batch
Reporter	abuse_ch
Tags:	mirai sh

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

38

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Linux.Downloader-32.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

busybox

Link:

https://www.filescan.io/uploads/69079f23de25fddba0617fe2/reports/5b906114-4a82-4f63-a1dc-1ebdaf55f2bd/overview

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

ps1

First seen:

2025-11-02T15:27:00Z UTC

Last seen:

2025-11-03T10:18:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/00cef478e2ba3d10e81076021d5f944613d1eeafcff46e2366a7512980ddee60/results?tab=lookup

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/71f55f33-4b27-496d-b77c-458369def45f

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/00cef478e2ba3d10e81076021d5f944613d1eeafcff46e2366a7512980ddee60

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/00cef478e2ba3d10e81076021d5f944613d1eeafcff46e2366a7512980ddee60/

ReversingLabs TitaniumCloud Script-Shell.Worm.Mirai

Threat name:

Script-Shell.Worm.Mirai

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-11-02 18:13:35 UTC

File Type:

Text (Shell)

AV detection:

11 of 24 (45.83%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=adhpi6hcxi6rb2aqoybb2x4uiyj5d3vpz72g4i3gu5istag55zqa._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

n/a

Link:

https://tria.ge/reports/251102-wtgz5abp2x/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/00cef478e2ba3d10e81076021d5f944613d1eeafcff46e2366a7512980ddee60