MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4ac1ea9fb43533ce8e917583041b899b9d1d66033c6c2c02f21b756a191e82db. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	4ac1ea9fb43533ce8e917583041b899b9d1d66033c6c2c02f21b756a191e82db
SHA3-384 hash:	b90da9eee51d3a98c461ee887fee2e9fed7acf0cd2b5f7329074e786da0c338711410a242c901907b56b4793d34d8687
SHA1 hash:	16d19766ba50e3d5e1ddbad7ae8666812b2f6077
MD5 hash:	8cc9bcf3a3f205d80e3e05ce5690017d
humanhash:	mango-two-nine-oscar
File name:	w.sh
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	1'152 bytes
First seen:	2025-10-10 18:20:24 UTC
Last seen:	2025-10-11 08:07:05 UTC
File type:	sh
MIME type:	text/plain
ssdeep	24:qwrw2w6NIvwPKXwc50F9wgwkAwKwMZwMiwEOwdxn:/850BCJUx
TLSH	T1DC2138D92290622450086B30349B493A8DDFF7C6602266F8547ED8B7A2CFD90FB25F3D
Magika	csv
Reporter	abuse_ch
Tags:	sh

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

32

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Linux.Downloader-32.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

busybox mirai

Link:

https://www.filescan.io/uploads/68e94e9471883144ef30d401/reports/5b303bd1-5025-42fb-8dde-5e7f53c79b5d/overview

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

text

First seen:

2025-09-24T16:04:00Z UTC

Last seen:

2025-09-24T20:16:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/4ac1ea9fb43533ce8e917583041b899b9d1d66033c6c2c02f21b756a191e82db/results?tab=lookup

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/be690023-c4b1-4dee-90f3-d55c8ae2580d

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/4ac1ea9fb43533ce8e917583041b899b9d1d66033c6c2c02f21b756a191e82db

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/4ac1ea9fb43533ce8e917583041b899b9d1d66033c6c2c02f21b756a191e82db/

ReversingLabs TitaniumCloud Linux.Trojan.Alevaul

Threat name:

Linux.Trojan.Alevaul

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-09-22 22:55:14 UTC

File Type:

Text (Shell)

AV detection:

16 of 34 (47.06%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=jla6vh5uguz45durowbqig4jtoor2zqdhrwcyaxsdn2wugi6qlnq._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

n/a

Link:

https://tria.ge/reports/251010-wy8nmszmx7/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/4ac1ea9fb43533ce8e917583041b899b9d1d66033c6c2c02f21b756a191e82db