MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a84df504ca9afde415974e0c8ffe0d89877448e8924cfba1ac4b2753f4b6501e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	a84df504ca9afde415974e0c8ffe0d89877448e8924cfba1ac4b2753f4b6501e
SHA3-384 hash:	4290dd7fd09accb0c8565fc1055bc00dd0cd95a8907cef00a44a643c17a5b76e4b577056a162124fe2b957d033c735ab
SHA1 hash:	d915bcc827fa8f5b8b9e7269fc5fb81ef8285d2d
MD5 hash:	0298b4788fde52043b91c2a67483914d
humanhash:	high-double-sweet-november
File name:	c.sh
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	2'134 bytes
First seen:	2026-04-30 02:07:01 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	24:3J3PFUJcu5ieigEmEfE2E5MX0TwXUvAfMg:RFUJcu5ieigreveMXaAfMg
TLSH	T1A8417ADE3304E735A3199D4DF7EDA2707B06E4D17AEE8B05E28408694DCFD0D5A90B51
Magika	shell
Reporter	BlinkzSec

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

45

Origin country :

SK

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.Linux.Downloader-33.UNOFFICIAL

Alert

Create hunting rule

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

ps1

First seen:

2026-04-29T23:22:00Z UTC

Last seen:

2026-04-30T12:58:00Z UTC

Hits:

~100

Detections:

Trojan-Downloader.Agent.HTTP.C&C HEUR:Backdoor.Linux.Mirai.la HEUR:Backdoor.Linux.Gafgyt.ix NetTool.PowerShellUA.HTTP.C&C NetTool.PowerShellGet.HTTP.C&C

Link:

https://opentip.kaspersky.com/a84df504ca9afde415974e0c8ffe0d89877448e8924cfba1ac4b2753f4b6501e/results?tab=lookup

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/b89a9f84-37c0-4426-b1a0-2a7e8423b00e

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

99%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/a84df504ca9afde415974e0c8ffe0d89877448e8924cfba1ac4b2753f4b6501e

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a84df504ca9afde415974e0c8ffe0d89877448e8924cfba1ac4b2753f4b6501e/

Neiki Backdoor.Linux.Mirai

Verdict:

Malicious

Threat:

Backdoor.Linux.Mirai

Link:

https://tip.neiki.dev/file/a84df504ca9afde415974e0c8ffe0d89877448e8924cfba1ac4b2753f4b6501e

ReversingLabs TitaniumCloud Document-HTML.Hacktool.Heuristic

Threat name:

Document-HTML.Hacktool.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-04-30 02:10:42 UTC

File Type:

Text (Shell)

AV detection:

7 of 24 (29.17%)

Threat level:

  1/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=vbg7kbgktl66ifmxjygi77qnrgdxishisjgpxinmjmtvh5fwkapa._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

n/a

Link:

https://tria.ge/reports/260430-ckdrkaat41/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/a84df504ca9afde415974e0c8ffe0d89877448e8924cfba1ac4b2753f4b6501e