MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a5b68b594c36b0fccf3d73575ea46e820c372daf3ff295cf22a16948a5748642. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	a5b68b594c36b0fccf3d73575ea46e820c372daf3ff295cf22a16948a5748642
SHA3-384 hash:	d6a7c6072cb1a840a69606ee2f6f05e2caf21fc455aa946d8649effcc177d6bf2b20d92dee06ed3f1b8e3455ee389533
SHA1 hash:	96430b92f58cc5255990997d379eeb6453f5e6bb
MD5 hash:	e0f77678dc02f1388ff330d31c1eefab
humanhash:	winter-saturn-cup-quiet
File name:	c.sh
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	970 bytes
First seen:	2026-06-02 00:41:37 UTC
Last seen:	2026-06-02 13:44:34 UTC
File type:	sh
MIME type:	text/plain
ssdeep	12:3J3j9SqViWQj95BqQj95NI3PAQj9iIKqlEHQj9zQj9NLqQj908ZQj92DQj9+jdKX:3J3gqSNIpKq8L3PYgloB0m98yHR
TLSH	T12111BF8D021293A61D0D8E4CB05AD40DEBE2C1F8F9B4ADD0B0F44734B49B70A7188BB7
Magika	batch
Reporter	abuse_ch
Tags:	sh

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

57

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.Linux.Downloader-33.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/6a1e26f1099ef368af14917a/reports/aa69d837-ea1a-4614-aa2a-561b844e4061/overview

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-06-01T22:03:00Z UTC

Last seen:

2026-06-03T04:26:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan-Downloader.Shell.Agent.cl

Link:

https://opentip.kaspersky.com/a5b68b594c36b0fccf3d73575ea46e820c372daf3ff295cf22a16948a5748642/results?tab=lookup

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/4ee59732-7210-4f15-b653-ec8934c0337c

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/a5b68b594c36b0fccf3d73575ea46e820c372daf3ff295cf22a16948a5748642

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a5b68b594c36b0fccf3d73575ea46e820c372daf3ff295cf22a16948a5748642/

Neiki Trojan-Downloader.Shell.Agent

Verdict:

Malicious

Threat:

Trojan-Downloader.Shell.Agent

Link:

https://tip.neiki.dev/file/a5b68b594c36b0fccf3d73575ea46e820c372daf3ff295cf22a16948a5748642

ReversingLabs TitaniumCloud Linux.Trojan.Qwexlafiba

Threat name:

Linux.Trojan.Qwexlafiba

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-06-02 00:42:50 UTC

File Type:

Text (Shell)

AV detection:

14 of 24 (58.33%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=uw3iwwkmg2ypztz5onlv5jdoqigdolnph7zjltzcufuurjluqzba._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

n/a

Link:

https://tria.ge/reports/260602-a2g47shz61/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/a5b68b594c36b0fccf3d73575ea46e820c372daf3ff295cf22a16948a5748642