MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4118542e923070f543e63f847c85081a052c9786a3f8a265480d41011c4f829c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	4118542e923070f543e63f847c85081a052c9786a3f8a265480d41011c4f829c
SHA3-384 hash:	6590446464d389fa70491e66adea83a78b1b10ae8ea3b5049f6f8370c41deddef653e4bdae0216cdaa5fa74c0e42b872
SHA1 hash:	de00f7c0a8eac2c0b5132b849aa201a33e15678e
MD5 hash:	6fa439591c829bb1ef03ae7ca5d1ae1a
humanhash:	alpha-william-one-fix
File name:	x.sh
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	725 bytes
First seen:	2025-12-05 18:22:14 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	12:6h+0jUah+sLqUah+6NIl5zAUah+H0LKjUahFtaKAUah++7nUahVCUahPFEUahHjK:I+0go+sL7o+6NI75o+SKgoFtBlo+oUoc
TLSH	T15E011EFE225E9275094C4D41F06E8818766B8BE66071CF4C644CB4B17698E247163F58
Magika	txt
Reporter	abuse_ch
Tags:	sh

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

28

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.Linux.Downloader-32.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

busybox mirai

Link:

https://www.filescan.io/uploads/693322eabc15eab491f57c56/reports/32a60184-9231-4945-b281-b530e565b678/overview

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

text

First seen:

2025-12-05T20:50:00Z UTC

Last seen:

2025-12-05T21:02:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/4118542e923070f543e63f847c85081a052c9786a3f8a265480d41011c4f829c/results?tab=lookup

Kunai Sandbox

Status:

Failed

Link:

https://sandbox.kunai.rocks/analysis/971f7b5c-a8d0-4825-81e9-c58cdfa9f4f1

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/4118542e923070f543e63f847c85081a052c9786a3f8a265480d41011c4f829c

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/4118542e923070f543e63f847c85081a052c9786a3f8a265480d41011c4f829c/

ReversingLabs TitaniumCloud Linux.Trojan.Egairtigado

Threat name:

Linux.Trojan.Egairtigado

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-12-05 18:25:49 UTC

File Type:

Text (Shell)

AV detection:

14 of 24 (58.33%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=iemfilusgbypkq7gh6chzbiidicszf4gup4kezkibvaqchcpqkoa._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

n/a

Link:

https://tria.ge/reports/251205-w2ejzahy9g/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/4118542e923070f543e63f847c85081a052c9786a3f8a265480d41011c4f829c