MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b7d11cda9b9c4f108981c03ca3f6fdc4b67b77a374812f1e2ed9967e19dbcd91. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	b7d11cda9b9c4f108981c03ca3f6fdc4b67b77a374812f1e2ed9967e19dbcd91
SHA3-384 hash:	c37b4c3908ef2b01363e79ebb2cc8bae1e7063ce8fb7aff1d92e5fc126785576cf1fda58a4f1eb6991c0eaaf7ce99020
SHA1 hash:	6d742ea5c5226093c1b0dd313ddbbd777d43d45c
MD5 hash:	17a421fa0db07b0dbf75f1952e5ccb2f
humanhash:	wisconsin-neptune-texas-maine
File name:	f
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	831 bytes
First seen:	2025-12-06 22:34:43 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	24:Z+ZOBkRD3v6oYkRD3v688kRD3v6l5Dl5nkRD3v6aO9kRD3v6SmkRD3vXw:UZAkR+kRYkR6n9kRWkRmkRTw
TLSH	T125015BFF004D96354E40894DB5A7892974338BEB90E5C60DA98DA527B389E2CB433E5C
Magika	batch
Reporter	abuse_ch
Tags:	sh

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

38

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

Hybrid Analysis TrojanDownloader/Linux.Agent

Verdict:

Malicious

Labled as:

TrojanDownloader/Linux.Agent

Link:

https://www.hybrid-analysis.com/sample/b7d11cda9b9c4f108981c03ca3f6fdc4b67b77a374812f1e2ed9967e19dbcd91

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

text

First seen:

2025-12-07T01:30:00Z UTC

Last seen:

2025-12-07T21:52:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/b7d11cda9b9c4f108981c03ca3f6fdc4b67b77a374812f1e2ed9967e19dbcd91/results?tab=lookup

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/b7d11cda9b9c4f108981c03ca3f6fdc4b67b77a374812f1e2ed9967e19dbcd91

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b7d11cda9b9c4f108981c03ca3f6fdc4b67b77a374812f1e2ed9967e19dbcd91/

ReversingLabs TitaniumCloud Linux.Downloader.Generic

Threat name:

Linux.Downloader.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2025-12-06 22:40:19 UTC

File Type:

Text (Shell)

AV detection:

10 of 36 (27.78%)

Threat level:

  3/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=w7irzwu3trhrbcmbya6kh5x5ys3hw55dosas6hro3glh4go3zwiq._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

n/a

Link:

https://tria.ge/reports/260106-nzr4aagk2s/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/b7d11cda9b9c4f108981c03ca3f6fdc4b67b77a374812f1e2ed9967e19dbcd91