MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6f945200a5df3549418a926f17e81fa8eb031747f9e271d6c7837f86782d1503. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	6f945200a5df3549418a926f17e81fa8eb031747f9e271d6c7837f86782d1503
SHA3-384 hash:	8ff173114a29a8f25dc3bd17e44e5a7f3dc9a39193e0ff0cc8fcff54b812fe8b4f89d10343d3913fbe61e85cc2d60094
SHA1 hash:	f94d4364ca304af4aa78acee1a025cd7ad0454a0
MD5 hash:	9f7032f912da92c90577ebc87aa89e42
humanhash:	pip-low-alpha-zebra
File name:	w.sh
Download:	download sample
File size:	510 bytes
First seen:	2025-05-02 18:42:03 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	12:6AEjCA8LqCAKNIl5zACA30LKjCM2CCMqC7iAUn:vET8LUKNI7yiKeW2n
TLSH	T1B0F0B4FD2196236A44485E11F02E8908647B9FCA6070CB5E644E34B6B794D30F522F09
Magika	shell
Reporter	abuse_ch
Tags:	sh

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

81

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Linux.Downloader-32.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

90.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=681516594355f44aee688a8blinux22vpnfull_triage

Tags:

mirai

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

busybox

Link:

https://www.filescan.io/uploads/681512000b64e174c415264b/reports/27bfa6dd-a18f-4259-82dc-7007cbcf9f5a/overview

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/6f945200a5df3549418a926f17e81fa8eb031747f9e271d6c7837f86782d1503

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/6f945200a5df3549418a926f17e81fa8eb031747f9e271d6c7837f86782d1503/

ReversingLabs TitaniumCloud Linux.Downloader.SAgnt

Threat name:

Linux.Downloader.SAgnt

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-05-02 18:43:08 UTC

File Type:

Text (Shell)

AV detection:

11 of 24 (45.83%)

Threat level:

  3/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=n6kfeaff342usqmksjxrp2a7vdvqgf2h7hrhdvwhqn7ym6bncubq._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

n/a

Link:

https://tria.ge/reports/250502-xccvhsfj21/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/6f945200a5df3549418a926f17e81fa8eb031747f9e271d6c7837f86782d1503