MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8d3a3fff55ebc2c5fd1cfd41d3b824779788c1604804160197da086e28e526de. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	8d3a3fff55ebc2c5fd1cfd41d3b824779788c1604804160197da086e28e526de
SHA3-384 hash:	6cd973242afb9aece8753427fdf7c95eab60fa3432660a49b50a8d2a3b5322ab23688b228b848af176ac661ffb711663
SHA1 hash:	5527884ce5e595c50875a913872f25466f488b60
MD5 hash:	e5af93ea3215bc131408799f2f499857
humanhash:	solar-ink-uncle-california
File name:	t
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	2'470 bytes
First seen:	2024-12-25 06:56:05 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	48:4k5CEA0hZ2k1ck1/I7k1kk1gk1Uk10k10k1mk1A0gk10k1/Jak16k1bj:tCEA0FN5lpVd1rvdtvZ
TLSH	T19B51C6CF05D988A1988889DD77D34AE474CED5C925CDCE8FE4AF1532AC8CA2EF014E59
Magika	shell
Reporter	abuse_ch
Tags:	sh

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

83

Origin country :

DE

Vendor Threat Intelligence

CyberFortress Malicious

Verdict:

Malicious

Score:

95.7%

Link:

https://cyber-fortress.com/docs/result/index.php?id=676bbcf18a4d48ee35ff2f6clinux22vpnfull_triage

Tags:

agent hype sage

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

anti-debug busybox evasive

Link:

https://www.filescan.io/uploads/676bacccd986a2005f8c24c7/reports/cd7450c6-b8cd-4699-be07-6d99f6a720f9/overview

Hybrid Analysis Bash.MiraiA.Generic

Verdict:

Malicious

Labled as:

Bash.MiraiA.Generic

Link:

https://www.hybrid-analysis.com/sample/8d3a3fff55ebc2c5fd1cfd41d3b824779788c1604804160197da086e28e526de

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Nucleon Malprob Benign

Score:

1%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/8d3a3fff55ebc2c5fd1cfd41d3b824779788c1604804160197da086e28e526de

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/8d3a3fff55ebc2c5fd1cfd41d3b824779788c1604804160197da086e28e526de/

ReversingLabs TitaniumCloud Script-Shell.Trojan.Multiverze

Threat name:

Script-Shell.Trojan.Multiverze

Alert

Create hunting rule

Status:

Malicious

First seen:

2024-12-25 07:04:28 UTC

File Type:

Text (Shell)

AV detection:

8 of 23 (34.78%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ru5d772v5pbml7i47va5hobeo6lyrqlajacbmamx3ieg4khfe3pa._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

discovery

Link:

https://tria.ge/reports/241225-jzd47s1mbw/

Behaviour

Modifies registry class

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/8d3a3fff55ebc2c5fd1cfd41d3b824779788c1604804160197da086e28e526de