MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c80b0eb6c9290597f29338e478877edc9696accadba950360f3127f11ba33b84. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	c80b0eb6c9290597f29338e478877edc9696accadba950360f3127f11ba33b84
SHA3-384 hash:	3ff5ff671e7ee794f471daf97a8ac048db1976e71f9ada516c75175fc7116cbe01de2b7a4bf7e882aa190bf37c95c946
SHA1 hash:	aa9986b6df86f5b36f36afc45868b26950e3cbb8
MD5 hash:	22086b50a950e8c8a289b43aba5ee4a9
humanhash:	arkansas-timing-king-violet
File name:	t
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	796 bytes
First seen:	2025-12-13 08:55:27 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	12:3s6wZjYNX8jYtXNyHe05X8jYPQ8jNSYeJBV8jKpB8jYb+8j6v:3KZjfKX65AStemKpauJE
TLSH	T116012FCD125473EEC5888E0EB6934F9814544ACF5D8B1FCC7A8C5C269784E54B834B68
Magika	shell
Reporter	abuse_ch
Tags:	sh

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

46

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.Linux.Downloader-36.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

busybox expand lolbin mirai

Link:

https://www.filescan.io/uploads/693d4d9964bd958a5210eb47/reports/e7888ab9-4fa0-433c-aa9d-582c1ec73374/overview

Hybrid Analysis TrojanDownloader/Linux.Agent

Verdict:

Malicious

Labled as:

TrojanDownloader/Linux.Agent

Link:

https://www.hybrid-analysis.com/sample/c80b0eb6c9290597f29338e478877edc9696accadba950360f3127f11ba33b84

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

text

First seen:

2025-12-13T06:38:00Z UTC

Last seen:

2025-12-14T00:48:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan-Downloader.Shell.Agent.p

Link:

https://opentip.kaspersky.com/c80b0eb6c9290597f29338e478877edc9696accadba950360f3127f11ba33b84/results?tab=lookup

Kunai Sandbox

Status:

Failed

Link:

https://sandbox.kunai.rocks/analysis/98e2c61c-2990-4cfb-858e-eb44b1476a53

Nucleon Malprob Malware

Score:

93%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/c80b0eb6c9290597f29338e478877edc9696accadba950360f3127f11ba33b84

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c80b0eb6c9290597f29338e478877edc9696accadba950360f3127f11ba33b84/

Neiki Trojan-Downloader.Shell.Agent

Verdict:

Malicious

Threat:

Trojan-Downloader.Shell.Agent

Link:

https://tip.neiki.dev/file/c80b0eb6c9290597f29338e478877edc9696accadba950360f3127f11ba33b84

ReversingLabs TitaniumCloud Document-HTML.Trojan.Heuristic

Threat name:

Document-HTML.Trojan.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-12-13 08:50:27 UTC

File Type:

Text (Shell)

AV detection:

12 of 38 (31.58%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=zafq5nwjfeczp4uthdshrb363sljnlgk3ouvanqpget7cg5dhoca._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

n/a

Link:

https://tria.ge/reports/251213-nkpplsyqa1/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/c80b0eb6c9290597f29338e478877edc9696accadba950360f3127f11ba33b84