MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 394e8923d75fa08a78a11e9c4cfd63dc1e7bde5d1c376c23c9abebf8aa2bd4d3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	394e8923d75fa08a78a11e9c4cfd63dc1e7bde5d1c376c23c9abebf8aa2bd4d3
SHA3-384 hash:	1cc151724b0811af4237645b99fc3a85f273880c3689d7f42b77c3d45b05e6b57eae8118086d39230a795f1865856b3f
SHA1 hash:	2ba387995d7b8e6415dee1604612ef8c37770f1b
MD5 hash:	61fdf9e750d9e48081d748d140650d77
humanhash:	magazine-golf-mango-winter
File name:	c.sh
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	910 bytes
First seen:	2025-04-20 14:53:42 UTC
Last seen:	2025-04-24 23:27:58 UTC
File type:	sh
MIME type:	text/plain
ssdeep	12:3J3fiVQExCWEQaNI9kxwAQnySKxWHQ4xRI4qKAQI6QGPCQEoeVQ1JeQBx7+cAQfo:3J3KZGNIqyKxW1xWOoPasR
TLSH	T16411C2CD1098ADD65A1FCDC7739D881E6681C6D0E4BB6731F2269D3258CA300F854BE6
Magika	txt
Reporter	abuse_ch
Tags:	sh

Intelligence

---

File Origin

# of uploads :

4

# of downloads :

69

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Linux.Downloader-33.UNOFFICIAL

Alert

Create hunting rule

Sanesecurity.Malware.30762.LX.BOT.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

94.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68050a94280f5f89a0d26978linux22vpnfull_triage

Tags:

downloader trojan agent

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/68050a9290767142c3dc80b9/reports/aba42169-3ad4-425c-9f3f-31561189be95/overview

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/394e8923d75fa08a78a11e9c4cfd63dc1e7bde5d1c376c23c9abebf8aa2bd4d3

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/394e8923d75fa08a78a11e9c4cfd63dc1e7bde5d1c376c23c9abebf8aa2bd4d3/

ReversingLabs TitaniumCloud Linux.Worm.Mirai

Threat name:

Linux.Worm.Mirai

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-04-20 14:54:12 UTC

File Type:

Text

AV detection:

13 of 24 (54.17%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=hfhisi6xl6qiu6fbd2oez7ld3qphxxs5dq3wyi6jvpv7rkrl2tjq._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

n/a

Link:

https://tria.ge/reports/250420-r9xnas1q13/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/394e8923d75fa08a78a11e9c4cfd63dc1e7bde5d1c376c23c9abebf8aa2bd4d3