MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1dc484d51fb96c2097c2eb3695ff55d641e6778dbe8780cbbd0dbdfa688708ca. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	1dc484d51fb96c2097c2eb3695ff55d641e6778dbe8780cbbd0dbdfa688708ca
SHA3-384 hash:	2563b3ec8c350f8288f052ae3f54bb975fa9b352f6c1c9ff02ed1561ea7ac47a7212c0d0f470fe5aeef6acede32feaae
SHA1 hash:	cea67c26c372d03b795bbba678569256385d3b83
MD5 hash:	544a2f391e2800bac07e883d902bcc75
humanhash:	illinois-idaho-dakota-ten
File name:	download.sh
Download:	download sample
Signature	Kaiji Alert Create hunting rule
File size:	2'998 bytes
First seen:	2025-04-16 18:37:53 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:ayS2sF7qC7B58tC7B58bdJjrpwsIdiEfr0ZVjVMn79m//BSEYRBXRc:S2s0C73UC734/jtxIAEzgsC/wf+
TLSH	T1FF51C2CA0D43D4B292965E2663E451ABCC8420D3E9A51505F7CCBF230B78BA4F721ED0
Magika	shell
Reporter	abuse_ch
Tags:	kaiji sh

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

75

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.BV.Downloader-AEH.29638.23861.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67fffb19954c9c53de0c0930linux22vpnfull_triage

Tags:

mirai virus shell agent

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

busybox evasive

Link:

https://www.filescan.io/uploads/67fff91390767142c3d7b021/reports/52c83e67-0534-4a46-ab8a-d9e45fc9670c/overview

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/1dc484d51fb96c2097c2eb3695ff55d641e6778dbe8780cbbd0dbdfa688708ca

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/1dc484d51fb96c2097c2eb3695ff55d641e6778dbe8780cbbd0dbdfa688708ca/

ReversingLabs TitaniumCloud Script-Shell.Downloader.MiraiA

Threat name:

Script-Shell.Downloader.MiraiA

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-04-16 18:38:11 UTC

File Type:

Text (Shell)

AV detection:

9 of 24 (37.50%)

Threat level:

  3/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=dxcijvi7xfwcbf6c5m3jl72v2za6m54nx2dybs55bw67u2ehbdfa._file

Hatching Triage kaiji

Result

Malware family:

kaiji

Alert

Create hunting rule

Score:

  10/10

Tags:

family:kaiji defense_evasion discovery execution linux persistence privilege_escalation

Link:

https://tria.ge/reports/250416-w94h3atygy/

Behaviour

Command and Scripting Interpreter: Unix Shell

Enumerates kernel/hardware configuration

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Changes its process name

Modifies Bash startup script

Creates/modifies Cron job

Creates/modifies environment variables

Enumerates running processes

Modifies init.d

Write file to user bin folder

File and Directory Permissions Modification

Executes dropped EXE

Modifies Watchdog functionality

Kaiji

Kaiji family

Malware Config

C2 Extraction:

154.40.47.248:888

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.