MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0e5180dfefa0f9d6b4ed013b9777bc7860a520b2e79ea6d1fe07d45cb40d3397. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	0e5180dfefa0f9d6b4ed013b9777bc7860a520b2e79ea6d1fe07d45cb40d3397
SHA3-384 hash:	12296c1ac5b73527a7506f9105956fbb81893fa059f8a8f09c9ac556092e62bd20fcbdd3b79c96d6407f27ce88a95106
SHA1 hash:	ea3dc0a2939ac8f0eabd1757b0ca444afd8be2b9
MD5 hash:	0c313ff8f3fb1cfebcab053cb67a4d3c
humanhash:	hydrogen-five-happy-juliet
File name:	cats.sh
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	2'300 bytes
First seen:	2026-07-31 17:38:39 UTC
Last seen:	2026-08-01 11:33:46 UTC
File type:	sh
MIME type:	text/plain
ssdeep	24:npucuscpitpkYvWp5cpAdJp6Y+rpuZpmFmXCNp1IGupEXDLzVbdp7FkpD4XpuHuB:nkHPsmTs8Ark+kGuodcwkOgvO
TLSH	T1A941B8ED11518DBD9D63DD37F2A58016B29AEDD624CB7F19DADC3AA480CCD0831416D2
Magika	shell
Reporter	abuse_ch
Tags:	sh

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

91

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

downloader evasive mirai

Link:

https://www.filescan.io/uploads/6a6cddcd71ab86aa26abc77d/reports/a4a77461-ed88-4a63-94d7-8e2f5cc25c18/overview

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-07-31T14:53:00Z UTC

Last seen:

2026-08-02T01:44:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/0e5180dfefa0f9d6b4ed013b9777bc7860a520b2e79ea6d1fe07d45cb40d3397/results?tab=lookup

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/675acea8-cea9-45d3-95c6-c473ca4e93e0

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/0e5180dfefa0f9d6b4ed013b9777bc7860a520b2e79ea6d1fe07d45cb40d3397

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/0e5180dfefa0f9d6b4ed013b9777bc7860a520b2e79ea6d1fe07d45cb40d3397/

ReversingLabs TitaniumCloud Linux.Downloader.Morila

Threat name:

Linux.Downloader.Morila

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-07-31 17:39:39 UTC

File Type:

Text (Shell)

AV detection:

16 of 24 (66.67%)

Threat level:

  3/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=bziybx7pud45nnhnae5zo554pbqkkifs46pknup6a7kfznangolq._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

execution

Link:

https://tria.ge/reports/260731-v8gr8sdj4x/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Executes a command shell one-liner

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/0e5180dfefa0f9d6b4ed013b9777bc7860a520b2e79ea6d1fe07d45cb40d3397