MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8639977fbb7f8a242889744c8ce08e3b02d208a7a7d55a00e23deffb842871cb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	8639977fbb7f8a242889744c8ce08e3b02d208a7a7d55a00e23deffb842871cb
SHA3-384 hash:	3f464f96f3553a4a630ba96e0b28db02460db975bb69067e1f9ac3019bfe9fcffa93118eeb3f1dd94897d0304e2ec1fa
SHA1 hash:	32bf01dbd412abdacfa59d120cb1e7707b220a9c
MD5 hash:	1cc72f9690e3abdfe86ba009a24a8da4
humanhash:	eleven-equal-grey-texas
File name:	w.sh
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	886 bytes
First seen:	2025-03-29 15:22:10 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	12:GjU4qUMNIl5zAUt0LKjUN+OsU4CUi/U3SEUKtaKAUgjUQiAUFyfAUR:Gg47MNI75UKgsi4Di83EKtBl3QaFMHR
TLSH	T13A11A0CE325893D1DC8C8FA071AA88986558F7C076558F4DEB4C88B2A9C4D197999F3C
Magika	txt
Reporter	abuse_ch
Tags:	sh

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

61

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Linux.Downloader-32.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67e8119ccfd0a37f83098880linux22vpnfull_triage

Tags:

backdoor trojan hype

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

mirai

Link:

https://www.filescan.io/uploads/67e8105e631830704a8afcfb/reports/352efc19-6f24-4083-94be-cbf3c236e2fd/overview

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/8639977fbb7f8a242889744c8ce08e3b02d208a7a7d55a00e23deffb842871cb

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/8639977fbb7f8a242889744c8ce08e3b02d208a7a7d55a00e23deffb842871cb/

ReversingLabs TitaniumCloud Script-Shell.Downloader.Mirai

Threat name:

Script-Shell.Downloader.Mirai

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-03-29 15:23:13 UTC

File Type:

Text (Shell)

AV detection:

13 of 24 (54.17%)

Threat level:

  3/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=qy4zo753p6fcikejorgizyeohmbnecfhu7kvuahchxx7xbbiohfq._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

discovery

Link:

https://tria.ge/reports/250329-sshngswtgv/

Behaviour

Modifies registry class

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/8639977fbb7f8a242889744c8ce08e3b02d208a7a7d55a00e23deffb842871cb