MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6667c4b3ed4e73b0cd3638d00f80dd4bd25038fdfb8afd16fb75314d5ef67131. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	6667c4b3ed4e73b0cd3638d00f80dd4bd25038fdfb8afd16fb75314d5ef67131
SHA3-384 hash:	fe76f9b9410a590d92a4528d1a392de8e147d153b28c36f3b7af8accf1a11fa8e0332c79467c8f060e4eb6ac44eb0069
SHA1 hash:	8780e3db00cd94d1b61ecb2a133a40b27252f758
MD5 hash:	a285aa35bfe007aedce959fd65c42301
humanhash:	black-artist-texas-bravo
File name:	5
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	4'709 bytes
First seen:	2025-06-19 15:36:34 UTC
Last seen:	2025-08-02 23:20:53 UTC
File type:	sh
MIME type:	text/plain
ssdeep	96:1xER+vREGcPaX4kNstCft4GgrWXmcGRX5f/JYMSV:HzXLNstCft+rWXm7XxKxV
TLSH	T17EA1B0C93E621277CE549F2AE716C52F3C4A90D0C1208FF5286A70BC7CBBD44EB61566
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

68

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=685467e3c0425dfc161b1a89linux22vpnfull_triage

Tags:

agent virus hype

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/6667c4b3ed4e73b0cd3638d00f80dd4bd25038fdfb8afd16fb75314d5ef67131

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/91347180-51c0-4e0d-90bf-740d6c76a495

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/6667c4b3ed4e73b0cd3638d00f80dd4bd25038fdfb8afd16fb75314d5ef67131

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/6667c4b3ed4e73b0cd3638d00f80dd4bd25038fdfb8afd16fb75314d5ef67131/

Neiki Malicious

Verdict:

Malicious

Link:

https://tip.neiki.dev/file/6667c4b3ed4e73b0cd3638d00f80dd4bd25038fdfb8afd16fb75314d5ef67131

ReversingLabs TitaniumCloud Linux.Downloader.Medusa

Threat name:

Linux.Downloader.Medusa

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-06-15 11:44:02 UTC

File Type:

Text (Shell)

AV detection:

18 of 38 (47.37%)

Threat level:

  3/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=mzt4jm7njzz3btjwhdia7ag5jpjfaoh57ofp2fx3ouyu2xxwoeyq._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

n/a

Link:

https://tria.ge/reports/250619-ycsreaxwe1/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/6667c4b3ed4e73b0cd3638d00f80dd4bd25038fdfb8afd16fb75314d5ef67131