MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3865c2b357dc288da29103f62ea755d2100701151cdcd89d321f76e830f3d6a3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	3865c2b357dc288da29103f62ea755d2100701151cdcd89d321f76e830f3d6a3
SHA3-384 hash:	6813eadd92d4296be4e1c808651ed550912317e2f320200842dc90cfbd287a818f9fead8fbc0412ac1dde487cc09f41a
SHA1 hash:	1247b4f3e438620781166082135ac4fbfee0b191
MD5 hash:	2ec697de65823b612ab354b14b950ecf
humanhash:	alanine-six-massachusetts-angel
File name:	g.sh
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	795 bytes
First seen:	2025-07-24 08:43:45 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	24:NoWBGhBh9Mk8QobepEBkV/I/V7n9qatkk0:NoGGhL8QobVBkVwV7n9qat/0
TLSH	T1D701F14AE58097B0A9820008F3CBD53BB0A743FC166129ACFD0F6E35BA9CC84F461331
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

34

Origin country :

DE

Vendor Threat Intelligence

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

busybox evasive

Link:

https://www.filescan.io/uploads/6881f2677bc45bdee1b76ffe/reports/e39f5235-2dba-4bdd-96c8-b407e246fb74/overview

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/602a28a0-c06e-488f-bc3f-d0d440ae687f

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

15%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/3865c2b357dc288da29103f62ea755d2100701151cdcd89d321f76e830f3d6a3

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/3865c2b357dc288da29103f62ea755d2100701151cdcd89d321f76e830f3d6a3/

Neiki Clean

Verdict:

Clean

Link:

https://tip.neiki.dev/file/3865c2b357dc288da29103f62ea755d2100701151cdcd89d321f76e830f3d6a3

ReversingLabs TitaniumCloud Script-BAT.Trojan.Heuristic

Threat name:

Script-BAT.Trojan.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-07-24 17:06:16 UTC

File Type:

Text (Shell)

AV detection:

6 of 23 (26.09%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=hbs4fm2x3qui3iurap3c5j2v2iiaoaivdtonrhjsd53oqmht22rq._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

n/a

Link:

https://tria.ge/reports/250724-knas3shq4y/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/3865c2b357dc288da29103f62ea755d2100701151cdcd89d321f76e830f3d6a3