MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2285df6e099990a09534b394c899a44d5d0f5227a7e961eb64b02deb0a5f04ed. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	2285df6e099990a09534b394c899a44d5d0f5227a7e961eb64b02deb0a5f04ed
SHA3-384 hash:	59815f5ce4958bd4b24f1310916ac59c3f818dc821335ffb222e0bb77d552e0d1759e9c6c2b0d481ae9322d805d1f7cf
SHA1 hash:	05614f5e95703545099f28b83287a13d35f8de75
MD5 hash:	6516694780e6ca3f2fb65ab01f29c8d7
humanhash:	queen-emma-twenty-pennsylvania
File name:	curl.sh
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	989 bytes
First seen:	2025-01-08 16:51:19 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	24:sXCZG+1ZuZI4WQbW4BGKBMuABEE2B1aABtPEFBV:20b54hbWMGaTkdmcktPE7V
TLSH	T16B11E1E682A2DF3361941828B2F22BADB05850CB17180A84B73D9E67FF8D6F570A4240
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

82

Origin country :

DE

Vendor Threat Intelligence

CyberFortress Clean

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=677eae29c029bd73f2870e81linux22vpnfull_triage

Tags:

n/a

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

busybox

Link:

https://www.filescan.io/uploads/677ead368608099de3fc351f/reports/ae9bbfb5-e1a9-4860-ae2a-b0c440c38a9e/overview

Nucleon Malprob Benign

Score:

1%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/2285df6e099990a09534b394c899a44d5d0f5227a7e961eb64b02deb0a5f04ed

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2285df6e099990a09534b394c899a44d5d0f5227a7e961eb64b02deb0a5f04ed/

ReversingLabs TitaniumCloud Linux.Backdoor.Mirai

Threat name:

Linux.Backdoor.Mirai

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-01-08 16:52:04 UTC

File Type:

Text (Shell)

AV detection:

9 of 24 (37.50%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ekc563qjtgikbfjuwokmrgnejvoq6urhu7uwd23ewaw6wcs7atwq._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

antivm defense_evasion discovery linux

Link:

https://tria.ge/reports/250108-vddgbswma1/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Checks CPU configuration

File and Directory Permissions Modification

Executes dropped EXE

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

0.70

Link:

https://yomi.yoroi.company/submissions/2285df6e099990a09534b394c899a44d5d0f5227a7e961eb64b02deb0a5f04ed