MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 afaea86058dc0a8475b6a07a7404e37624cf8a70aa9fb9f3a2038ec61862eb4c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	afaea86058dc0a8475b6a07a7404e37624cf8a70aa9fb9f3a2038ec61862eb4c
SHA3-384 hash:	a44fbef00aaa562d94fb7c9be84559e4dee60c400635e43fd07b8f13d8f98d138302e52e72c74f9d42b7ce6623ebc5a5
SHA1 hash:	eaea1966505cca62e2f950acb02abe79aba35cf2
MD5 hash:	10c1d25dfd571af943ee6193731c56fb
humanhash:	seventeen-yankee-jupiter-don
File name:	c.sh
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	912 bytes
First seen:	2026-07-26 21:11:55 UTC
Last seen:	2026-07-27 08:43:05 UTC
File type:	sh
MIME type:	text/plain
ssdeep	24:3J30C9GHjsFJNIxKVXKn0ydfh6zTks20hp3AtZEsGyhOfThlHA:fQDCXJeqTkxiAZTjhGhlg
TLSH	T15A11B2DA4118A3461B488D14FC5B8C3D796B96E67136E514B286F8F48DCC2052D39FEF
Magika	batch
Reporter	abuse_ch
Tags:	sh

Intelligence

---

File Origin

# of uploads :

3

# of downloads :

73

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.Linux.Downloader-33.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

downloader mirai

Link:

https://www.filescan.io/uploads/6a66783c1bcc38a694b7f9a9/reports/e0424c3b-0e56-4726-8667-cb5f2d1c22ac/overview

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

ps1

First seen:

2026-07-26T19:35:00Z UTC

Last seen:

2026-07-27T03:33:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/afaea86058dc0a8475b6a07a7404e37624cf8a70aa9fb9f3a2038ec61862eb4c/results?tab=lookup

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/09cd7b82-70c2-4b46-af7b-e290038ab3c3

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/afaea86058dc0a8475b6a07a7404e37624cf8a70aa9fb9f3a2038ec61862eb4c

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/afaea86058dc0a8475b6a07a7404e37624cf8a70aa9fb9f3a2038ec61862eb4c/

ReversingLabs TitaniumCloud Linux.Downloader.Generic

Threat name:

Linux.Downloader.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2026-07-26 21:12:34 UTC

File Type:

Text (Shell)

AV detection:

11 of 36 (30.56%)

Threat level:

  3/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=v6xkqycy3qfii5nwub5hibhdoysm7ctqvkp3t45caohmmgdc5nga._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

execution

Link:

https://tria.ge/reports/260726-z2dt8adp3z/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Executes a command shell one-liner

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/afaea86058dc0a8475b6a07a7404e37624cf8a70aa9fb9f3a2038ec61862eb4c