MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 99aa98d40814af564c229f1d2e674fbe3ef48dc338fbbd6224e10253b1af35f8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	99aa98d40814af564c229f1d2e674fbe3ef48dc338fbbd6224e10253b1af35f8
SHA3-384 hash:	9da8b394353ee1537fc63288ab0a96508b788e7cdbfc0910ae72bb14528a381c1f6aeaca036a1d6d865c6b2d7fc09a4a
SHA1 hash:	5a38478ce7757bd920f4f6b51146b14be6f68e28
MD5 hash:	30b61d9e154378cb7cce6089ec84d11b
humanhash:	nevada-glucose-neptune-five
File name:	w
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	1'983 bytes
First seen:	2025-05-07 14:32:59 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	24:ihdHAPNIM022ikxKCN+XDXnKDqmIyndHANNIM024ikxKMT+JDJ5MDsmeh:S1A4DpxwuDx1AOtpx2kJM
TLSH	T155416ECE1BB05761085BCC8220E58FC9B30896EF21445EDCE68C157E4AC9DE6756BEF8
Magika	shell
Reporter	abuse_ch
Tags:	sh

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

82

Origin country :

DE

Vendor Threat Intelligence

CyberFortress Malicious

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=681b73e76c95617a27b5ceedlinux22vpnfull_triage

Tags:

mirai virus shell html

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

busybox

Link:

https://www.filescan.io/uploads/681b6f310b64e174c41c118c/reports/bbcc70b5-96d3-427e-bf9c-c2cee56ae9af/overview

Hybrid Analysis Bash.MiraiA.Generic

Verdict:

Malicious

Labled as:

Bash.MiraiA.Generic

Link:

https://www.hybrid-analysis.com/sample/99aa98d40814af564c229f1d2e674fbe3ef48dc338fbbd6224e10253b1af35f8

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/99aa98d40814af564c229f1d2e674fbe3ef48dc338fbbd6224e10253b1af35f8

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/99aa98d40814af564c229f1d2e674fbe3ef48dc338fbbd6224e10253b1af35f8/

ReversingLabs TitaniumCloud Script-Shell.Worm.Mirai

Threat name:

Script-Shell.Worm.Mirai

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-04-29 10:53:05 UTC

File Type:

Text (Shell)

AV detection:

15 of 36 (41.67%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=tgvjrvaicsxvmtbct4os4z2pxy7pjdodhd532yre4ebfhmnpgx4a._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

n/a

Link:

https://tria.ge/reports/250507-r9fpsasyb1/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/99aa98d40814af564c229f1d2e674fbe3ef48dc338fbbd6224e10253b1af35f8