MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d002c7bdc30f530c5861afeb56d6ad69bc33cddafda93d1beca8700c68cde488. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	d002c7bdc30f530c5861afeb56d6ad69bc33cddafda93d1beca8700c68cde488
SHA3-384 hash:	27f2d4d90983f3d9bf46578d204256718b8d03ba58f24601ea1ed5d316c4d364584f7c0c89b54fc802564d1d71cf2188
SHA1 hash:	8c1e3910d6b4b08adebe99c3a0ea4fa83d9571c7
MD5 hash:	46018e1fe4256c21d28a97170532fc01
humanhash:	eight-echo-vegan-washington
File name:	wget.sh
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	790 bytes
First seen:	2025-02-24 18:36:44 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	12:YhX/NNIl5r0LK5gOFbeM5ONtjKaGZetQ2xVv:0FNI7mKCIq55+ItQ2fv
TLSH	T1EA0148EF2BE112864D48CE0C786F0F445646EEC7E6740B1A5885B43E91ED708B471F66
Magika	shell
Reporter	abuse_ch
Tags:	sh

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

39

Origin country :

Vendor Threat Intelligence

CyberFortress Malicious

Verdict:

Malicious

Score:

94.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67bcbc6028ab76d43a5ce4cflinux22vpnfull_triage

Tags:

downloader mirai agent overt

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

evasive lolbin mirai remote

Link:

https://www.filescan.io/uploads/67bcbc5e298112176da0c74d/reports/5e9c72cd-a1ac-45aa-b51c-c2a56a945e0a/overview

Nucleon Malprob Benign

Score:

0%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/d002c7bdc30f530c5861afeb56d6ad69bc33cddafda93d1beca8700c68cde488

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d002c7bdc30f530c5861afeb56d6ad69bc33cddafda93d1beca8700c68cde488/

ReversingLabs TitaniumCloud Linux.Trojan.Vigorf

Threat name:

Linux.Trojan.Vigorf

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-02-24 20:08:29 UTC

File Type:

Text (Shell)

AV detection:

15 of 24 (62.50%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=2abmppodb5jqywdbv7vvnvvnng6dhto27wut2g7mvbyay2gn4sea._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

discovery

Link:

https://tria.ge/reports/250224-w9j5esxqx3/

Behaviour

Modifies registry class

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/d002c7bdc30f530c5861afeb56d6ad69bc33cddafda93d1beca8700c68cde488