MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1b3ba6b3b880ac4d194ed3d97cb0ad83ce7b28a301bab59f34c7fd3b2aff3cd2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	1b3ba6b3b880ac4d194ed3d97cb0ad83ce7b28a301bab59f34c7fd3b2aff3cd2
SHA3-384 hash:	291e578bc5ef146d99ec7dbf7e721bd974603a1ee14711ef2fb808e56c23efe2899652a9d62c07c5477cc0732d3de7e3
SHA1 hash:	fee50e2bf4eec65d54d6012a9fac7a59cf43e2a0
MD5 hash:	2064e33cac1d2984ab6a861bc7e6a1da
humanhash:	vermont-salami-pip-autumn
File name:	run.sh
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	3'131 bytes
First seen:	2026-04-17 15:14:48 UTC
Last seen:	2026-04-18 13:29:22 UTC
File type:	sh
MIME type:	text/plain
ssdeep	96:CovCeC2JMkbabbiBgn7nuZo9b+H676bwH5PPPA3CDA/2fQ6:Cov3ju/n7nuZo9b+H676bwH5PPPA3CD5
TLSH	T15251FD9A02C49B31D65DD64FB7F4B174610AB0C3ABDF9A04E99C89AD8EC9D4C7385F40
Magika	txt
Reporter	abuse_ch
Tags:	sh

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

46

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

evasive mirai

Link:

https://www.filescan.io/uploads/69e24eaed920e190440058ba/reports/e43bf877-b50e-4a67-9826-57357ebb5a07/overview

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-04-17T11:19:00Z UTC

Last seen:

2026-04-19T00:41:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan-Downloader.Shell.Agent.gen HEUR:Trojan-Downloader.Shell.Agent.a

Link:

https://opentip.kaspersky.com/1b3ba6b3b880ac4d194ed3d97cb0ad83ce7b28a301bab59f34c7fd3b2aff3cd2/results?tab=lookup

Kunai Sandbox

Status:

Failed

Link:

https://sandbox.kunai.rocks/analysis/633d1b0a-10ac-483e-9987-9adfbbe40afb

Nucleon Malprob Malware

Score:

99%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/1b3ba6b3b880ac4d194ed3d97cb0ad83ce7b28a301bab59f34c7fd3b2aff3cd2

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/1b3ba6b3b880ac4d194ed3d97cb0ad83ce7b28a301bab59f34c7fd3b2aff3cd2/

Neiki Trojan-Downloader.Shell.Agent

Verdict:

Malicious

Threat:

Trojan-Downloader.Shell.Agent

Link:

https://tip.neiki.dev/file/1b3ba6b3b880ac4d194ed3d97cb0ad83ce7b28a301bab59f34c7fd3b2aff3cd2

ReversingLabs TitaniumCloud Script-Shell.Worm.Mirai

Threat name:

Script-Shell.Worm.Mirai

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-04-17 15:15:27 UTC

File Type:

Text (Shell)

AV detection:

8 of 24 (33.33%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=dm52nm5yqcwe2gko2pmxzmfnqphhwkfdag5llhzuy76twkx7htja._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

n/a

Link:

https://tria.ge/reports/260417-sndtqsax6m/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/1b3ba6b3b880ac4d194ed3d97cb0ad83ce7b28a301bab59f34c7fd3b2aff3cd2