MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 220ca3b38128eb2cc5f7d60d203d3fe0c67edce7cec9acad68b131422e91952d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	220ca3b38128eb2cc5f7d60d203d3fe0c67edce7cec9acad68b131422e91952d
SHA3-384 hash:	9849171b8f76cdebf9d02efdb34889a5575aec8cd597138ffc5ac6d4227110c78cc2adf3772c83a463e412c08bb2448a
SHA1 hash:	d9e4e16419412a3aada741fd947478df70905f13
MD5 hash:	2483b9cb6dcf940e5fef3c25802cadd2
humanhash:	friend-comet-maryland-pasta
File name:	nu
Download:	download sample
File size:	293 bytes
First seen:	2025-10-09 04:55:32 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	6:hftJ+pUKUF2RVYs5CYf53InkjKM3FoF/fkVKhOXqIKXD73IKX+N1IEWYq1IKBK0:ZtJ+jREY64KF0ghsOTh4WYO80
TLSH	T133E02B9DF853487378788CB8B7D72495A50FA20B2E0695CE35CD521EEBE4E60B050593
Magika	shell
Reporter	abuse_ch
Tags:	sh

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

50

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Linux.Downloader-23.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/68e740845a3bccf09ebe7f72/reports/b73f1548-3ce2-4e4b-bb9f-6e08c6e6dda4/overview

Hybrid Analysis Bash.MiraiB.Generic

Verdict:

Malicious

Labled as:

Bash.MiraiB.Generic

Link:

https://www.hybrid-analysis.com/sample/220ca3b38128eb2cc5f7d60d203d3fe0c67edce7cec9acad68b131422e91952d

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

unix shell

First seen:

2025-10-09T02:47:00Z UTC

Last seen:

2025-10-09T03:19:00Z UTC

Hits:

~10

Detections:

Trojan-Downloader.Shell.Agent.bi HEUR:Trojan-Downloader.Shell.Agent.p

Link:

https://opentip.kaspersky.com/220ca3b38128eb2cc5f7d60d203d3fe0c67edce7cec9acad68b131422e91952d/results?tab=lookup

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/8fa71b67-b4ed-406c-ac1d-cdb9751e4e64

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/220ca3b38128eb2cc5f7d60d203d3fe0c67edce7cec9acad68b131422e91952d

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/220ca3b38128eb2cc5f7d60d203d3fe0c67edce7cec9acad68b131422e91952d/

Neiki Family.MIRAI

Verdict:

Malicious

Threat:

Family.MIRAI

Link:

https://tip.neiki.dev/file/220ca3b38128eb2cc5f7d60d203d3fe0c67edce7cec9acad68b131422e91952d

ReversingLabs TitaniumCloud Linux.Downloader.MiraiB

Threat name:

Linux.Downloader.MiraiB

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-10-09 05:10:05 UTC

File Type:

Text (Shell)

AV detection:

13 of 24 (54.17%)

Threat level:

  3/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=eigkhm4bfdvszrpx2ygsapj74ddh5xhhz3e2zlliweyuelursuwq._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  9/10

Tags:

defense_evasion discovery linux

Link:

https://tria.ge/reports/251009-f9prxaaq8y/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Changes its process name

File and Directory Permissions Modification

Executes dropped EXE

Contacts a large (36201) amount of remote hosts

Creates a large amount of network flows

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/220ca3b38128eb2cc5f7d60d203d3fe0c67edce7cec9acad68b131422e91952d