MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3f0b89a18e3d13af18201773f7b79ef5176b1885e8cd6c7290d665c5dcbf9c80. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	3f0b89a18e3d13af18201773f7b79ef5176b1885e8cd6c7290d665c5dcbf9c80
SHA3-384 hash:	c1ba8a30c9325da3c042f2c8787dfe450f4717f0c5c9e9e93dcf691661b994840baa5a57c2bebc882243a11459cf6f08
SHA1 hash:	0d65df791f768a3cf32f11362b8817b99f93f36b
MD5 hash:	c922de0efb612a12f20b0c9d9ccd7503
humanhash:	beer-lemon-ten-network
File name:	c.sh
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	960 bytes
First seen:	2026-01-10 18:47:10 UTC
Last seen:	2026-01-11 21:58:02 UTC
File type:	sh
MIME type:	text/plain
ssdeep	12:3J3UUfwxUUPxUU1kxUUDc+HxUUAAAxUUEAxUUuOsxUUAjCxUUApxUUE1ZxUU+/ph:3J3Rp2q0/ZAytBiexn
TLSH	T1761133AC91F56547D73C5E09F0AE92589885D6C53EF7CE50E42C1CB258871017065F67
Magika	shell
Reporter	abuse_ch
Tags:	sh

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

52

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.Linux.Downloader-33.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

mirai

Link:

https://www.filescan.io/uploads/69629ec530368802bb7f6aae/reports/e0362366-78a3-413f-b815-8a1b9c9ba0e7/overview

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-01-10T14:31:00Z UTC

Last seen:

2026-01-12T12:48:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan-Downloader.Shell.Agent.a

Link:

https://opentip.kaspersky.com/3f0b89a18e3d13af18201773f7b79ef5176b1885e8cd6c7290d665c5dcbf9c80/results?tab=lookup

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/9bd13c8f-3d83-4d69-bcfd-9a5193f87662

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/3f0b89a18e3d13af18201773f7b79ef5176b1885e8cd6c7290d665c5dcbf9c80

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/3f0b89a18e3d13af18201773f7b79ef5176b1885e8cd6c7290d665c5dcbf9c80/

Neiki Trojan-Downloader.Shell.Agent

Verdict:

Malicious

Threat:

Trojan-Downloader.Shell.Agent

Link:

https://tip.neiki.dev/file/3f0b89a18e3d13af18201773f7b79ef5176b1885e8cd6c7290d665c5dcbf9c80

ReversingLabs TitaniumCloud Document-HTML.Worm.Mirai

Threat name:

Document-HTML.Worm.Mirai

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-01-10 18:47:34 UTC

File Type:

Text (Shell)

AV detection:

14 of 36 (38.89%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=h4fytimohuj26gbac5z7pn466ulwwgef5dgwy4uq2zs4lxf7tsaa._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

n/a

Link:

https://tria.ge/reports/260110-xff2caaw4d/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/3f0b89a18e3d13af18201773f7b79ef5176b1885e8cd6c7290d665c5dcbf9c80