MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5f54b5cb4992c23a03107b420d935e4c7625f4ebbcadb9b378af47fbe155a7ab. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	5f54b5cb4992c23a03107b420d935e4c7625f4ebbcadb9b378af47fbe155a7ab
SHA3-384 hash:	c4595829cda7c4f7a97915a7cd9128ca45a7c33329a9254252a52d104407f86fc7c480091d6c797a84f4c1ef4f013031
SHA1 hash:	c3bda2939f701ce8fd34c7e6646e3de6ae3e2895
MD5 hash:	d62db9501b934e52a6d6d25d5ab55543
humanhash:	green-oranges-grey-stairway
File name:	weed
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	4'644 bytes
First seen:	2025-08-31 08:07:01 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	96:cUYODenkHVlLWdg3Citi4iqiX0lumrSU+ylGbUdnYnbnEApoTQoLb81dOk2/ePEd:ZG+FvcCl
TLSH	T131A159EF752256D64D8C8E0BB1B1546E7022CFCA21468BB4FD4D3C7973C8A08B115B7A
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

30

Origin country :

DE

Vendor Threat Intelligence

Hybrid Analysis TrojanDownloader/Linux.Shell

Verdict:

Malicious

Labled as:

TrojanDownloader/Linux.Shell

Link:

https://www.hybrid-analysis.com/sample/5f54b5cb4992c23a03107b420d935e4c7625f4ebbcadb9b378af47fbe155a7ab

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

unix shell

First seen:

2025-08-31T07:00:00Z UTC

Last seen:

2025-08-31T07:00:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan-Downloader.Shell.Agent.p HEUR:Trojan-Downloader.Shell.Agent.a

Link:

https://opentip.kaspersky.com/5f54b5cb4992c23a03107b420d935e4c7625f4ebbcadb9b378af47fbe155a7ab/results?tab=lookup

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/70125ba8-f0a3-489e-b1c1-f591d34fc07d

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/5f54b5cb4992c23a03107b420d935e4c7625f4ebbcadb9b378af47fbe155a7ab

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/5f54b5cb4992c23a03107b420d935e4c7625f4ebbcadb9b378af47fbe155a7ab/

Neiki Trojan-Downloader.Shell.Agent

Verdict:

Malicious

Threat:

Trojan-Downloader.Shell.Agent

Link:

https://tip.neiki.dev/file/5f54b5cb4992c23a03107b420d935e4c7625f4ebbcadb9b378af47fbe155a7ab

ReversingLabs TitaniumCloud Linux.Worm.Mirai

Threat name:

Linux.Worm.Mirai

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-08-31 08:14:01 UTC

File Type:

Text (Shell)

AV detection:

16 of 24 (66.67%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=l5klls2jslbduayqpnba3e26jr3cl5hlxsw3tm3yv5d7xykvu6vq._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

n/a

Link:

https://tria.ge/reports/250831-ppt1kahk2s/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/5f54b5cb4992c23a03107b420d935e4c7625f4ebbcadb9b378af47fbe155a7ab