MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2b68a68a3a138c1149b1483e074fd1c84ca67a59652f83a2bb38dc2a2f7c2a80. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	2b68a68a3a138c1149b1483e074fd1c84ca67a59652f83a2bb38dc2a2f7c2a80
SHA3-384 hash:	a1757d400dc44f18d53d701894dd422b913c581dd6512d0c32fc26adec4d94571e8b20a9c82be7382cd2708c95d4f6b0
SHA1 hash:	5674a6179c3ed46c3794368335ee2465d976d51f
MD5 hash:	005ce539d40aa0a3c2caea1face9e898
humanhash:	tennessee-three-ohio-mirror
File name:	weed
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	997 bytes
First seen:	2025-12-23 01:44:43 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	24:+7NdJOa7AtJOa7rJOa7oJOa7vRDJOa7wJOa7goJOa7boJOa7AJOa73dJOa7njJOf:+wa1a8a/abqavaGaja3aLqakf
TLSH	T1B211219E1301DD90888DD47A77D1820DB4818FDD297B07656D5251B954E06CE737891A
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

52

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

evasive mirai

Link:

https://www.filescan.io/uploads/694a4e7184afa5547b5ca33f/reports/6ae49fba-bab7-4bb0-9ca0-d033c7b7de1c/overview

Hybrid Analysis Trojan[Downloader]/Shell.Agent

Verdict:

Malicious

Labled as:

Trojan[Downloader]/Shell.Agent

Link:

https://www.hybrid-analysis.com/sample/2b68a68a3a138c1149b1483e074fd1c84ca67a59652f83a2bb38dc2a2f7c2a80

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

unix shell

First seen:

2025-12-22T23:23:00Z UTC

Last seen:

2025-12-22T23:49:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/2b68a68a3a138c1149b1483e074fd1c84ca67a59652f83a2bb38dc2a2f7c2a80/results?tab=lookup

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/c42137c7-0e00-492f-aa60-3fd2dabc923e

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/2b68a68a3a138c1149b1483e074fd1c84ca67a59652f83a2bb38dc2a2f7c2a80

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2b68a68a3a138c1149b1483e074fd1c84ca67a59652f83a2bb38dc2a2f7c2a80/

ReversingLabs TitaniumCloud Linux.Worm.Mirai

Threat name:

Linux.Worm.Mirai

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-12-23 02:10:15 UTC

File Type:

Text (Shell)

AV detection:

17 of 36 (47.22%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=fnukncr2cogbcsnrja7aot6rzbgkm6szmuxyhiv3hdocul34fkaa._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  1/10

Tags:

linux

Link:

https://tria.ge/reports/251223-k1rmcs1ndw/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/2b68a68a3a138c1149b1483e074fd1c84ca67a59652f83a2bb38dc2a2f7c2a80