MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7f89d99237f2b6601d8edb53307aed1edf5df1f72522ccd57e1e975f67a716ec. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	7f89d99237f2b6601d8edb53307aed1edf5df1f72522ccd57e1e975f67a716ec
SHA3-384 hash:	94e665ffd2a7ca4de96577f2ba8f967a2be0700f521d6622bddc5c2d484d03192be3f5d922505c4aaaa3f5309e18c60b
SHA1 hash:	d713b47365b934b142e46946e5c674b52dfc6764
MD5 hash:	ba8e1ad9207754839af7f33715a16fcd
humanhash:	pennsylvania-ohio-nevada-montana
File name:	3sh
Download:	download sample
Signature	Tsunami Alert Create hunting rule
File size:	777 bytes
First seen:	2026-01-26 01:24:36 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	12:3J3lJK1xks/4ambzFt5KPaR5XxwEUugcRwXD:3J3lJ9jZ8E1Y
TLSH	T179011AD43DBA70A92640CC45B5A140886009E2CC2AE65F6AF32D1EB0948D718F7753D9
Magika	shell
Reporter	abuse_ch
Tags:	sh

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

116

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

mirai

Link:

https://www.filescan.io/uploads/69770af255805a763ff5e395/reports/517dacb6-fbcb-467e-bac6-b2e00cd58969/overview

Hybrid Analysis Linux/TrojanDownloader.SH

Verdict:

Malicious

Labled as:

Linux/TrojanDownloader.SH

Link:

https://www.hybrid-analysis.com/sample/7f89d99237f2b6601d8edb53307aed1edf5df1f72522ccd57e1e975f67a716ec

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

text

First seen:

2026-01-25T22:39:00Z UTC

Last seen:

2026-01-26T04:34:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan-Downloader.Shell.Agent.a

Link:

https://opentip.kaspersky.com/7f89d99237f2b6601d8edb53307aed1edf5df1f72522ccd57e1e975f67a716ec/results?tab=lookup

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/8e6d94bf-22ca-49d9-8f75-8c47a461528f

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/7f89d99237f2b6601d8edb53307aed1edf5df1f72522ccd57e1e975f67a716ec

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/7f89d99237f2b6601d8edb53307aed1edf5df1f72522ccd57e1e975f67a716ec/

Neiki Trojan-Downloader.Shell.Agent

Verdict:

Malicious

Threat:

Trojan-Downloader.Shell.Agent

Link:

https://tip.neiki.dev/file/7f89d99237f2b6601d8edb53307aed1edf5df1f72522ccd57e1e975f67a716ec

ReversingLabs TitaniumCloud Linux.Downloader.Generic

Threat name:

Linux.Downloader.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2026-01-26 01:29:34 UTC

File Type:

Text (Shell)

AV detection:

7 of 24 (29.17%)

Threat level:

  3/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=p6e5terx6k3gahmo3njta6xnd3pv34pxeurmzvl6d2lv6z5hc3wa._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

n/a

Link:

https://tria.ge/reports/260126-hby9sse16b/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/7f89d99237f2b6601d8edb53307aed1edf5df1f72522ccd57e1e975f67a716ec