MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c87f0d4f679dbc08b09eb1155e9ff19181fd6e8a3468f3dfddf321ae76259736. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	c87f0d4f679dbc08b09eb1155e9ff19181fd6e8a3468f3dfddf321ae76259736
SHA3-384 hash:	359a4e0b748c9e5f78b176e7ca421606b6106d2938211b5da52cfcb8d3ca789bc96b00391289ac597bd0d65dd5163e28
SHA1 hash:	696b9c6c865aa63cfb7520e99c01b3e3b55fc3af
MD5 hash:	8292bf1e7d19340782d66b3cacea8467
humanhash:	robin-comet-uranus-georgia
File name:	c87f0d4f679dbc08b09eb1155e9ff19181fd6e8a3468f3dfddf321ae76259736
Download:	download sample
Signature	Prometei Alert Create hunting rule
File size:	3'022 bytes
First seen:	2026-06-08 19:26:18 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	48:yuxhu7NdoGBupThWDP9Vvup6oW8gIu15zuR5euwE4u7cEdoDupTAEWDP9cup6REg:dxchKXivm/G1ARzwEnAEJqEiliENUEDO
TLSH	T1F55128CA73B112F52ECE6A7763242410BA89609254E23FD43CDDB4EDB38DD11AE925D3
Magika	batch
Reporter	c2hunter
Tags:	Prometei sh wraith

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

7

Origin country :

US

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

Alert

Create hunting rule

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

text

First seen:

2026-06-08T17:28:00Z UTC

Last seen:

2026-06-09T04:35:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/c87f0d4f679dbc08b09eb1155e9ff19181fd6e8a3468f3dfddf321ae76259736/results?tab=lookup

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/8018ccc1-5f2c-41eb-b0ea-a2738bc6d5ef

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

95%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/c87f0d4f679dbc08b09eb1155e9ff19181fd6e8a3468f3dfddf321ae76259736

CERT.PL MWDB

Gathering data

ReversingLabs TitaniumCloud Script-Shell.Worm.Mirai

Threat name:

Script-Shell.Worm.Mirai

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-06-09 05:53:39 UTC

File Type:

Text (Shell)

AV detection:

6 of 36 (16.67%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=zb7q2t3htw6arme6wekv5h7rsga723ukgruphx656mq245rfs43a._file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/c87f0d4f679dbc08b09eb1155e9ff19181fd6e8a3468f3dfddf321ae76259736