MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 63fc686a2c9ebb524c0fa6c10a6266741b8dbbd219afd6b551f5cfa6fd01e3d2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	63fc686a2c9ebb524c0fa6c10a6266741b8dbbd219afd6b551f5cfa6fd01e3d2
SHA3-384 hash:	b0034472523b4ea3b796ec641705b5f84fb722c0433ab026fbc080900ff345a57eb901e85981d15a736117f9999b2e8b
SHA1 hash:	62cd788732b5ac3ecbe9a3610366c3791ecc7fd4
MD5 hash:	1c9dbb9d00a37397e292ad86de0e8000
humanhash:	single-hot-colorado-ack
File name:	w.sh
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	1'374 bytes
First seen:	2025-10-04 13:41:17 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	12:qUvD6xUKUvDucArEUKUvDoNI+3BEAUKUvDxTKRiHUKUvDGNZIqUKUvDpQiUKUvD2:X2ENI6mpKVqN+7F2KcKBMJwalFk3guHR
TLSH	T1CD2160FF03558153885DCFC1306A8614A28986E3645C4BF9ABDE8C767E84ED9EC42E1D
Magika	txt
Reporter	abuse_ch
Tags:	sh

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

50

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Linux.Downloader-32.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

busybox

Link:

https://www.filescan.io/uploads/68e124b2d4a0085473c02ae9/reports/075807b4-fb0e-49be-8154-096ef17b2b00/overview

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

text

First seen:

2025-10-04T13:10:00Z UTC

Last seen:

2025-10-04T15:50:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/63fc686a2c9ebb524c0fa6c10a6266741b8dbbd219afd6b551f5cfa6fd01e3d2/results?tab=lookup

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/d19916a1-934b-4a19-88e6-124e3bb9ed24

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/63fc686a2c9ebb524c0fa6c10a6266741b8dbbd219afd6b551f5cfa6fd01e3d2

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/63fc686a2c9ebb524c0fa6c10a6266741b8dbbd219afd6b551f5cfa6fd01e3d2/

ReversingLabs TitaniumCloud Linux.Trojan.Egairtigado

Threat name:

Linux.Trojan.Egairtigado

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-10-04 13:23:11 UTC

File Type:

Text (Shell)

AV detection:

17 of 38 (44.74%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=mp6gq2rmt25vetapu3aquytgoqny3o6sdgx5nnkr6xh2n7ib4pja._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

n/a

Link:

https://tria.ge/reports/251004-q1qmysszcv/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.