MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8961686ad08adc4ac8609d42419b8059fdcb0e44ccfbf3b311e290fd6a9475e4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	8961686ad08adc4ac8609d42419b8059fdcb0e44ccfbf3b311e290fd6a9475e4
SHA3-384 hash:	141aa9910d271e032288dea56d79d76c3460b81ffa72e46acea6372c4e91b05708dee73f6e9f939db1416cf43034a19f
SHA1 hash:	b81d7f400bf0a81791c21a2ccbd1d1d32314248a
MD5 hash:	a0d2c8bf87e2a1d5559f36224b166c9b
humanhash:	chicken-lactose-asparagus-washington
File name:	oem.sh
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	996 bytes
First seen:	2025-02-16 10:41:48 UTC
Last seen:	2025-06-05 17:48:45 UTC
File type:	sh
MIME type:	text/plain
ssdeep	24:8IEMenIEMy+IEMONIIhIEMkKSEIEMojIEMUl9qIEMo9TIEMGuIEM+KIEM6ZIEMK0:8IYnI8+IuhICxEISjIo9qIu9TIQuIIK+
TLSH	T12C1143CD0695E63928E0CD4C30E98828A579AAC730614BDDAD5C0D7391969787E3BF0D
Magika	txt
Reporter	abuse_ch
Tags:	sh

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

83

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Linux.Downloader-32.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67b1c1c828ab76d43a5b3278linux22vpnfull_triage

Tags:

shellcode hype sage

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

bash lolbin mirai remote

Link:

https://www.filescan.io/uploads/67b1c10b991985e0a959c6dd/reports/8001a934-ba01-4107-b801-7f1d1e281769/overview

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Nucleon Malprob Benign

Score:

0%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/8961686ad08adc4ac8609d42419b8059fdcb0e44ccfbf3b311e290fd6a9475e4

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/8961686ad08adc4ac8609d42419b8059fdcb0e44ccfbf3b311e290fd6a9475e4/

ReversingLabs TitaniumCloud Script-Shell.Downloader.Heuristic

Threat name:

Script-Shell.Downloader.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-02-16 10:42:18 UTC

File Type:

Text (Shell)

AV detection:

13 of 37 (35.14%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=rfqwq2wqrloevsdatvbedg4alh64wdsezt57hmyr4kip22uuoxsa._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

discovery

Link:

https://tria.ge/reports/250216-mrrbcasqdj/

Behaviour

Modifies registry class

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

System Network Configuration Discovery: Internet Connection Discovery

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/8961686ad08adc4ac8609d42419b8059fdcb0e44ccfbf3b311e290fd6a9475e4