MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 02dd4c1e806a307797c96fa87b7f3f3079a7b367fb57ef7bdd1ac57be815d13b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	02dd4c1e806a307797c96fa87b7f3f3079a7b367fb57ef7bdd1ac57be815d13b
SHA3-384 hash:	45024656716f8f38f6838db01cbe2bf200801fc2344c73754be023d416d71b1c611154e6257fff235dc55970dab7d18a
SHA1 hash:	0b49a0dacc1325e04b8c9642973d9e5542ca03c4
MD5 hash:	879e65e87627b1943893fbd8f80d4434
humanhash:	cardinal-montana-delta-jupiter
File name:	c.sh
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	910 bytes
First seen:	2025-02-06 15:51:51 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	24:3J3KQHNQLOQnNIqnQuKx0QZQkQJ/QEQV1x6QaQQtbQ/HR:oQHNQLOQnnQuS0QZQkQJ/QEQN6QaQQlY
TLSH	T15411CECD90D9E0C2192DCDDA715DDC0D6250A7D8B4BD5735FDB58C32409A2023064BBB
Magika	txt
Reporter	abuse_ch
Tags:	mirai sh

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

81

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Linux.Downloader-33.UNOFFICIAL

Alert

Create hunting rule

Sanesecurity.Malware.30762.LX.BOT.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

94.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67a4db6251193558eb19a434linux22vpnfull_triage

Tags:

downloader trojan agent

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

bash lolbin remote

Link:

https://www.filescan.io/uploads/67a4dab86f3db6cc3aaa880c/reports/d4c29820-d5f5-4bce-909c-821be3f869f5/overview

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Nucleon Malprob Benign

Score:

0%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/02dd4c1e806a307797c96fa87b7f3f3079a7b367fb57ef7bdd1ac57be815d13b

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/02dd4c1e806a307797c96fa87b7f3f3079a7b367fb57ef7bdd1ac57be815d13b/

ReversingLabs TitaniumCloud Linux.Trojan.Mirai

Threat name:

Linux.Trojan.Mirai

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-02-06 15:52:19 UTC

File Type:

Text

AV detection:

12 of 24 (50.00%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=alouyhuaniyhpf6jn6uhw7z7gb42pm3h7nl66665dlcxx2av2e5q._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

discovery

Link:

https://tria.ge/reports/250206-ta7eka1nap/

Behaviour

Modifies registry class

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Mirai

Threat name:

Mirai

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/02dd4c1e806a307797c96fa87b7f3f3079a7b367fb57ef7bdd1ac57be815d13b