MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cf60d99140ca4dd4ebea02896e8983a6f15b709f6102df86309a32098d0fb1d8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	cf60d99140ca4dd4ebea02896e8983a6f15b709f6102df86309a32098d0fb1d8
SHA3-384 hash:	400663b953d36cf1e3b7b464581b80109d1c14f8b2df2b811ff3aebb9cf7a6df40e429a9c2ef422f516f28e06751f071
SHA1 hash:	de4838e3e48498ed23cb24ba91aaa8840fcd4c5f
MD5 hash:	7547fa723220757831b318136abc2035
humanhash:	white-fix-magazine-lion
File name:	w.sh
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	802 bytes
First seen:	2025-06-26 10:08:57 UTC
Last seen:	2025-06-26 21:53:22 UTC
File type:	sh
MIME type:	text/plain
ssdeep	12:euDbL4mxNIl5Zif0LKcSgOxVHoagkSZFtfUfHa1Djv:X/L5NI73KPgKIafqt8P+jv
TLSH	T100019EDD64B557710548CD08E16FCA6C640A8EC022808FED6D8C1A7A79DEF207126B48
Magika	txt
Reporter	abuse_ch
Tags:	sh

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

80

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Linux.Downloader-32.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Clean

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=685d1d48b06783b9ebd7ffb3

Tags:

n/a

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/685d1c58d1f1eb5d81c6fd09/reports/9b37c98e-a7a3-458e-9ede-bf3f7e39d9eb/overview

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/7918d8b6-a948-4ec7-8779-51122b784aa1

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/cf60d99140ca4dd4ebea02896e8983a6f15b709f6102df86309a32098d0fb1d8

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/cf60d99140ca4dd4ebea02896e8983a6f15b709f6102df86309a32098d0fb1d8/

ReversingLabs TitaniumCloud Script-Shell.Worm.Mirai

Threat name:

Script-Shell.Worm.Mirai

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-06-26 10:09:30 UTC

File Type:

Text (Shell)

AV detection:

15 of 24 (62.50%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=z5qntekazjg5j27kakew5cmdu3yvw4e7mebn7brqtizatdipwhma._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

n/a

Link:

https://tria.ge/reports/250626-l61ynacn8z/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/cf60d99140ca4dd4ebea02896e8983a6f15b709f6102df86309a32098d0fb1d8