MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 688a1caabb35c524537f8a290b8ef52f469cc1ba378f13fa069bf2f3279b2683. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	688a1caabb35c524537f8a290b8ef52f469cc1ba378f13fa069bf2f3279b2683
SHA3-384 hash:	7676e493256f232dd978d59b02fbaf4fa99addfe5c15b8e6569214c8e29cee6eebf6c2ca56905a6342c4d15302783545
SHA1 hash:	db575fc38735b4a9a95a182b2e081da0d98f9f81
MD5 hash:	d3f856d42e9b8b71a2fcadc241f0eb7d
humanhash:	eight-spaghetti-virginia-maryland
File name:	w.sh
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	584 bytes
First seen:	2025-12-14 06:35:14 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	12:A8x/yoEQDNIjlT0AJwiKl24Qddn9iQr0/Rhwv:1xahONIpBXKlGA+v
TLSH	T1FEF0C2F91527120A8B1DAE5FA4294418F423FBC3D231CE1C9894312A69C66263032F87
Magika	shell
Reporter	abuse_ch
Tags:	sh

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

42

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

ps1

First seen:

2025-12-13T21:59:00Z UTC

Last seen:

2025-12-15T12:13:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/688a1caabb35c524537f8a290b8ef52f469cc1ba378f13fa069bf2f3279b2683/results?tab=lookup

Kunai Sandbox

Status:

Failed

Link:

https://sandbox.kunai.rocks/analysis/55b0aed1-4ef2-4d38-a3a6-a48f55bf58a1

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/688a1caabb35c524537f8a290b8ef52f469cc1ba378f13fa069bf2f3279b2683

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/688a1caabb35c524537f8a290b8ef52f469cc1ba378f13fa069bf2f3279b2683/

ReversingLabs TitaniumCloud Document-HTML.Downloader.Heuristic

Threat name:

Document-HTML.Downloader.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-12-14 03:29:54 UTC

AV detection:

10 of 24 (41.67%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ncfbzkv3gxcsiu37riuqxdxvf5djzqn2g6hrh6qgtpzpgj43e2bq._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

n/a

Link:

https://tria.ge/reports/251214-hclp4aey2c/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/688a1caabb35c524537f8a290b8ef52f469cc1ba378f13fa069bf2f3279b2683