MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c25a6ffa262a11c5d1292fa6cdbb307e5160478b07139bb1bf63609ed2a6db11. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	c25a6ffa262a11c5d1292fa6cdbb307e5160478b07139bb1bf63609ed2a6db11
SHA3-384 hash:	08a4bea7decaae8709a3dfb20a31077113218ed20783483edaa220fe65426f096906cb71853c476ee937af7d9981ab22
SHA1 hash:	a54abca6ba7c21784051cb2f0b484c1374a541b6
MD5 hash:	84eda3d69173b337138e10d558ead56c
humanhash:	stream-floor-seventeen-nineteen
File name:	c.sh
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	1'211 bytes
First seen:	2025-03-26 10:12:27 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	24:3J3DD+7UI704D+CI3D+xIkTD+NI8D+fSI/D+hIwD+aI/D+5I4D+xNIlIFD+fIGDh:VD+7t7RD+X3D+mkTD+i8D+fH/D+2wD+0
TLSH	T13521538E42A9EF019E3FDF25F856D12C654394C0E8FE6B82E55CCBA1A2DA12071447B7
Magika	batch
Reporter	abuse_ch
Tags:	sh

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

99

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Linux.Downloader-33.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

94.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67e3d348cb6d38a89f3e507blinux22vpnfull_triage

Tags:

downloader trojan agent

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/67e3d345f274bf2d8e22d4de/reports/fdba98e7-8a43-41a1-9b35-50fcad7f080f/overview

Nucleon Malprob Benign

Score:

0%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/c25a6ffa262a11c5d1292fa6cdbb307e5160478b07139bb1bf63609ed2a6db11

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c25a6ffa262a11c5d1292fa6cdbb307e5160478b07139bb1bf63609ed2a6db11/

ReversingLabs TitaniumCloud Linux.Downloader.Generic

Threat name:

Linux.Downloader.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2025-03-26 10:13:23 UTC

File Type:

Text

AV detection:

10 of 24 (41.67%)

Threat level:

  3/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=yjng76rgfii4lujjf6tm3ozqpziwar4la4jzxmn7mnqj5uvg3miq._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

discovery

Link:

https://tria.ge/reports/250326-l8994s1ybx/

Behaviour

Modifies registry class

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/c25a6ffa262a11c5d1292fa6cdbb307e5160478b07139bb1bf63609ed2a6db11