MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 23580c09a2edb3be083aa143f499fe7b55f2d7f0122d37eec2e1a93bad76ec4a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	23580c09a2edb3be083aa143f499fe7b55f2d7f0122d37eec2e1a93bad76ec4a
SHA3-384 hash:	74b5a46844d1e65cd0e35ad2485fc73d6acff492a66bb8310eb1075490262f12955a01448d57d54f86424e0f56c24ca2
SHA1 hash:	77066d955f77ee228e786ce3f5089389c1af6f6d
MD5 hash:	f7e0f3279ea175896e720210784d92e3
humanhash:	eighteen-east-iowa-social
File name:	lil.sh
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	816 bytes
First seen:	2025-10-18 00:52:33 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	24:oNZNyHk93LHk93pHk93hj3Hk93EAHk93pHk93N/:uZNyHk97Hk9ZHk9pHk9lHk9ZHk9d/
TLSH	T1D70182DF12D4077924058E1F39534E2AAC1445E617F44B0FF85D2A7297C495CB854F7E
Magika	txt
Reporter	abuse_ch
Tags:	sh

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

39

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Linux.Downloader-36.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

busybox evasive expand lolbin

Link:

https://www.filescan.io/uploads/68f2e545c85c5c56972d1535/reports/5677d62b-2a36-4323-8cc5-965d62efca50/overview

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

text

First seen:

2025-10-17T22:13:00Z UTC

Last seen:

2025-10-17T22:20:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/23580c09a2edb3be083aa143f499fe7b55f2d7f0122d37eec2e1a93bad76ec4a/results?tab=lookup

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/4a93f746-bcda-436b-95ed-eb3f380292e7

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/23580c09a2edb3be083aa143f499fe7b55f2d7f0122d37eec2e1a93bad76ec4a/

ReversingLabs TitaniumCloud Linux.Downloader.ShellAgnt

Threat name:

Linux.Downloader.ShellAgnt

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-10-18 00:47:59 UTC

File Type:

Text (Shell)

AV detection:

10 of 24 (41.67%)

Threat level:

  3/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=enmaycnc5wz34cb2ufb7jgp6pnk7fv7qciwtp3wc4gutxllw5rfa._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

n/a

Link:

https://tria.ge/reports/251018-a9jm1aar6v/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/23580c09a2edb3be083aa143f499fe7b55f2d7f0122d37eec2e1a93bad76ec4a