MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7bb5461853cc60cb6540a4eb6cb92e96e28addd7795fcb90f2fc6b322fc54918. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	7bb5461853cc60cb6540a4eb6cb92e96e28addd7795fcb90f2fc6b322fc54918
SHA3-384 hash:	77615a4f6d27dc2afe2fd6f166a455366cbbb3e7c550b74db46ada27d9bcd14d753b901d672957739a3261001a7c4fae
SHA1 hash:	427edc4e8acba05ea1f76fc427538275c64bcd7e
MD5 hash:	03d09b5ce3ef15dc2b1134bace6918ab
humanhash:	one-april-carbon-vermont
File name:	ru.sh
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	4'905 bytes
First seen:	2025-12-10 08:14:55 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	96:1xLc8okWcegXz49Lt6o/IvUAkMSg2MX/Bq6X6dvkrUB1fOfe:R7Xz49Lt6owvUAkMB2MXpvX6dvkrUB1/
TLSH	T19BA108DD78603333CD92AE3DF6A58D1F2081C0C089258F94E65930FD75ABE56F650EA9
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

46

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL

Alert

Create hunting rule

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

text

First seen:

2025-12-10T06:26:00Z UTC

Last seen:

2025-12-10T11:18:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/7bb5461853cc60cb6540a4eb6cb92e96e28addd7795fcb90f2fc6b322fc54918/results?tab=lookup

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/7bb5461853cc60cb6540a4eb6cb92e96e28addd7795fcb90f2fc6b322fc54918

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/7bb5461853cc60cb6540a4eb6cb92e96e28addd7795fcb90f2fc6b322fc54918/

ReversingLabs TitaniumCloud Linux.Downloader.Medusa

Threat name:

Linux.Downloader.Medusa

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-12-10 07:18:43 UTC

File Type:

Text (Shell)

AV detection:

12 of 24 (50.00%)

Threat level:

  3/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=po2umgctzrqmwzkautvwzojos3rivxoxpfp4xehs7rvtel6fjema._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

n/a

Link:

https://tria.ge/reports/251210-j5vzxagm6w/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/7bb5461853cc60cb6540a4eb6cb92e96e28addd7795fcb90f2fc6b322fc54918