MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 034b43879b59d26f4b9850da7c7839c7eb5a2de6aac1f1239f52d8d0187d507d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	034b43879b59d26f4b9850da7c7839c7eb5a2de6aac1f1239f52d8d0187d507d
SHA3-384 hash:	109b952e9fc370b0f6db39fb028f5e513344254aabdee6e470ff856f663eb48236a39239dc91f833c54c62d3577d0831
SHA1 hash:	2db402aa5c9ed56bf1c73c586b627f86bc91f5c9
MD5 hash:	48ce3846e2a0adacad981bcff3f78b4f
humanhash:	whiskey-oklahoma-seventeen-mississippi
File name:	c.sh
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	829 bytes
First seen:	2025-01-09 04:21:32 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	24:Wr/MnQInXnRNIyxmn2OKUFn+DynZlOnu0n/NYndYnXZ:qEQUXfw2Oh+GZYu0/NYdYXZ
TLSH	T16001ADCE2D60254A0805DDC875A14C50EE66FFEAD4968B5FF4C88E395AC8B187125F8B
Magika	batch
Reporter	abuse_ch
Tags:	sh

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

90

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Shell.Downloader.Gen-1.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=677f4faeffdcee13ec882a58linux22vpnfull_triage

Tags:

downloader mirai agent overt

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-debug packed

Link:

https://www.filescan.io/uploads/677f4eecc2f29c0c6d8889dd/reports/6bd047f1-c84c-4e74-bb8a-261a1fdfe0a4/overview

Nucleon Malprob Benign

Score:

0%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/034b43879b59d26f4b9850da7c7839c7eb5a2de6aac1f1239f52d8d0187d507d

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/034b43879b59d26f4b9850da7c7839c7eb5a2de6aac1f1239f52d8d0187d507d/

ReversingLabs TitaniumCloud Document-HTML.Downloader.Heuristic

Threat name:

Document-HTML.Downloader.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-01-09 04:22:04 UTC

File Type:

Text (Shell)

AV detection:

11 of 24 (45.83%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=anfuhb43lhjg6s4ykdnhy6bzy7vvulpgvla7ci47klmnagd5kb6q._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

discovery

Link:

https://tria.ge/reports/250109-ey8j7syjes/

Behaviour

Modifies registry class

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/034b43879b59d26f4b9850da7c7839c7eb5a2de6aac1f1239f52d8d0187d507d