MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 51f965c0203a0d2788b37e8b51f840d295c5dc63b2846969fe9fd3ea4778a1ca. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	51f965c0203a0d2788b37e8b51f840d295c5dc63b2846969fe9fd3ea4778a1ca
SHA3-384 hash:	d59205759fae24f40540e6bbea82f03705eea88697291b13344b1a60df7ce81cf6b2a8ffccfa2db6006db0a6fdbfb21b
SHA1 hash:	05a4d8684aa74d2f699bc61fad55d839ac1f82d4
MD5 hash:	007b993638ea593123a9de564acc4707
humanhash:	eleven-william-tango-aspen
File name:	pdvr
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	267 bytes
First seen:	2025-07-05 13:09:09 UTC
Last seen:	2025-07-05 18:42:34 UTC
File type:	sh
MIME type:	text/plain
ssdeep	3:hV/muU3/IfDSIQ1RsLAXuU3/IVKzSIOUauU3/IhNIOSIHK+uF+0uU3/I3GN3zSIm:z/nU3TsLFU36mU3iNIl50U3Ka0LKieo
TLSH	T17ED08CAC32210AF748598EA3F03384D0603DE0CCA0B48B59798F04FE0DA26807414B05
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

16

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Linux.DownLoader.37.2079.6240.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Clean

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=686926a5900df8e7f86715ad

Tags:

n/a

Hybrid Analysis TrojanDownloader/Linux.Mirai

Verdict:

Malicious

Labled as:

TrojanDownloader/Linux.Mirai

Link:

https://www.hybrid-analysis.com/sample/51f965c0203a0d2788b37e8b51f840d295c5dc63b2846969fe9fd3ea4778a1ca

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/7be21637-0f70-4178-8352-7c30073fdac8

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/51f965c0203a0d2788b37e8b51f840d295c5dc63b2846969fe9fd3ea4778a1ca

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/51f965c0203a0d2788b37e8b51f840d295c5dc63b2846969fe9fd3ea4778a1ca/

ReversingLabs TitaniumCloud Linux.Worm.Mirai

Threat name:

Linux.Worm.Mirai

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-07-05 13:02:54 UTC

File Type:

Text (Shell)

AV detection:

8 of 37 (21.62%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=kh4wlqbahigspcftp2fvd6ca2kk4lxddwkcgs2p6t7j6ur3yuhfa._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

n/a

Link:

https://tria.ge/reports/250705-qknhnazky9/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/51f965c0203a0d2788b37e8b51f840d295c5dc63b2846969fe9fd3ea4778a1ca