MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8d0b6819f514d1d364535e9c2658efffd5fa1cf52133bb897d7643f9ae9b5e7b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	8d0b6819f514d1d364535e9c2658efffd5fa1cf52133bb897d7643f9ae9b5e7b
SHA3-384 hash:	3cfbd8e42965be962a84b48d99866794b2ef02b7f356f4f9e2c0d1a5269b30021c1808a9f9e2abf30cd580fb2960b788
SHA1 hash:	e092fd3d7e06cfdc3fe683135015eda7ce619202
MD5 hash:	09a4fd0f8d705c3de339b6d889dc03dd
humanhash:	berlin-nine-undress-october
File name:	w.sh
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	1'111 bytes
First seen:	2025-01-06 17:11:24 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	24:QBgU1QNIIoqKSfgTlcuqa7Gl9529mAqgU/lgV+IR:QBgU1GoqxfgTlcuqa7A9529mAqgU/lgF
TLSH	T12D21ABDA21D0942508ECCD0C32AD6824AD7BC6C974918F1D9DBC887751A9ABCBF5CF0C
Magika	txt
Reporter	abuse_ch
Tags:	mirai Moobot sh

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

119

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Linux.Downloader-32.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=677c0fb6c029bd73f2846c23linux22vpnfull_triage

Tags:

hype sage

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

anti-debug bash lolbin remote

Link:

https://www.filescan.io/uploads/677c0ee3d3e0ca0ffef68094/reports/587b53cd-a28f-48ac-ae47-98bef5764800/overview

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Nucleon Malprob Benign

Score:

0%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/8d0b6819f514d1d364535e9c2658efffd5fa1cf52133bb897d7643f9ae9b5e7b

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/8d0b6819f514d1d364535e9c2658efffd5fa1cf52133bb897d7643f9ae9b5e7b/

ReversingLabs TitaniumCloud Win32.Trojan.Alevaul

Threat name:

Win32.Trojan.Alevaul

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-01-06 17:12:03 UTC

File Type:

Text (Shell)

AV detection:

14 of 38 (36.84%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=rufwqgpvcti5gzctl2ocmwhp77k7uhhveez3xcl5ozb7tlu3lz5q._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

discovery

Link:

https://tria.ge/reports/250106-vqtdbaskh1/

Behaviour

Modifies registry class

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI MooBot

Threat name:

MooBot

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/8d0b6819f514d1d364535e9c2658efffd5fa1cf52133bb897d7643f9ae9b5e7b