MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 913b28f279bda19e212d19963bdad35f79cdcc43c6fe7e301a35631a9d84474f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry



Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments

SHA256 hash: 913b28f279bda19e212d19963bdad35f79cdcc43c6fe7e301a35631a9d84474f
SHA3-384 hash: c91f236b9b3e42cd3f77ab109f39ba58e88d8fd3ad0212437b11267df16a7fcb6f0a48174558dc06aafa07fc68a0477c
SHA1 hash: f8408779cdcc63b287eb4cca721b52737cefee67
MD5 hash: a9e32a5bf06eb9c7f5d93550f760c103
humanhash: minnesota-video-fourteen-five
File name:913b28f279bda19e212d19963bdad35f79cdcc43c6fe7e301a35631a9d84474f.sh
Download: download sample
File size:10'779 bytes
First seen:2026-02-22 13:18:30 UTC
Last seen:Never
File type: sh
MIME type:text/plain
ssdeep 96:cCuO7sht+O+v1fsn+h4+tIicqbA/GsGFnI78ORtgjo5C4wEJgEFElG3+:cCuOC4hvZ5mzjG5fd+0
TLSH T1E122387721F08B3297D021C8A36716A15F72E60B456714B8F4BE1A3A9F1DA0370EBF21
Magika xml
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://38.6.178.140/easy_cloud.shn/an/an/a
http://23.224.176.63/sh/easy_av_wget.shn/an/an/a
http://45.152.112.110/rj1.sh9d468b03d3b0421f40cea70584f3681ee3e8651177c1a2a2b19129ea4346f2d9 Miraimirai sh ua-wget
http://107.189.1.200/2.sh3b1294e989efd51c9e373b06f5548ebd176910eb311bba61333f3f76ccd46751 Miraimirai sh ua-wget
http://103.145.106.96/bins/1.shn/an/abotnet iot mirai
http://109.205.213.2/download.shn/an/an/a
http://194.156.102.210/bins/bins.shn/an/an/a
http://196.189.96.138:81/hiddenbin/dvr1.shn/an/an/a

Intelligence


File Origin
# of uploads :
1
# of downloads :
6
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive soft-404
Result
Gathering data
Status:
terminated
Behavior Graph:
%3 guuid=5ebde90e-1c00-0000-dbe8-e5c1d9040000 pid=1241 /usr/bin/sudo guuid=f025e910-1c00-0000-dbe8-e5c1dd040000 pid=1245 /tmp/sample.bin guuid=5ebde90e-1c00-0000-dbe8-e5c1d9040000 pid=1241->guuid=f025e910-1c00-0000-dbe8-e5c1dd040000 pid=1245 execve
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Behaviour
Modifies registry class
Suspicious use of SetWindowsHookEx
Enumerates physical storage devices
Please note that we are no longer able to provide a coverage score for Virus Total.

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 913b28f279bda19e212d19963bdad35f79cdcc43c6fe7e301a35631a9d84474f

(this sample)

1fdfc6e3ae612b736236df4579ff7a10954d47d9e7be67e6ebe8da173b0671c8

  
Delivery method
Distributed via web download
  
Dropping
MD5 bc422233b2512d7d5eb5500daf8a7822
  
Dropping
SHA256 1fdfc6e3ae612b736236df4579ff7a10954d47d9e7be67e6ebe8da173b0671c8

Comments