MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 20267b5829c69e1b3e41c0e7920c9542126bbcca98dd42937e5c23d1ce071650. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	20267b5829c69e1b3e41c0e7920c9542126bbcca98dd42937e5c23d1ce071650
SHA3-384 hash:	da50096c008b9bc25dc07f9e9c0571d387e6b6e6ec00660aae5c54f77696ecf280d9cf52f58f91db5693a03d843f27ef
SHA1 hash:	01f133edfc71234d793a8d11ca7580d197b15f84
MD5 hash:	65d6f499200b2a9712a600acffd00d86
humanhash:	freddie-bakerloo-nine-hotel
File name:	iot.sh
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	250 bytes
First seen:	2025-09-17 15:17:32 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	3:GRFSdkCGN3zSICLKijLEYmC8SdoU7GBzSEyLTUW45XSdooBzSE8eU2QIPARFSd9e:SSta0LKi+SwIGXShHQxFSDdhanICTn
TLSH	T171D05B8D61712FB18410EECC75674965510BC7CDF4581F1EE44888378098931F594FC7
Magika	batch
Reporter	abuse_ch
Tags:	sh

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

37

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Linux.DownLoader.37.8504.8963.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/68cad1385ebd1d861ec4d037/reports/6243f0c6-b058-4928-87e2-33a0d62fffff/overview

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

text

First seen:

2025-09-17T12:52:00Z UTC

Last seen:

2025-09-17T12:52:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/20267b5829c69e1b3e41c0e7920c9542126bbcca98dd42937e5c23d1ce071650/results?tab=lookup

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/27caf343-fe70-40e1-a658-a0f075d8d2be

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/20267b5829c69e1b3e41c0e7920c9542126bbcca98dd42937e5c23d1ce071650

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/20267b5829c69e1b3e41c0e7920c9542126bbcca98dd42937e5c23d1ce071650/

ReversingLabs TitaniumCloud Document-HTML.Downloader.Heuristic

Threat name:

Document-HTML.Downloader.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-09-17 14:57:06 UTC

File Type:

Text (Shell)

AV detection:

10 of 38 (26.32%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=eathwwbjy2pbwpsbydtzedeviijgxpgktdoufe36lqr5dtqhczia._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

n/a

Link:

https://tria.ge/reports/250917-sph5va1xby/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/20267b5829c69e1b3e41c0e7920c9542126bbcca98dd42937e5c23d1ce071650