MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d201a44d067b1d5c79cebb4b1cd9fdb80e61258882186da74771cb63f89f03c0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	d201a44d067b1d5c79cebb4b1cd9fdb80e61258882186da74771cb63f89f03c0
SHA3-384 hash:	1542fc15fe7fb879c68d3c516ca9ef5a2ed1fbd2b1efd3c805650061eb4a266a9c3852f68b6ef1fbc1da07df7be3dba7
SHA1 hash:	babd68c35619b502b9ffc094d82d7c16f1ccf666
MD5 hash:	8a8793fb6467f08974dc1c15fa89dc3a
humanhash:	apart-sink-montana-edward
File name:	mbupload-nlukip49.bin
Download:	download sample
File size:	1'092 bytes
First seen:	2026-10-06 00:18:41 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	24:GPOmPPBHJTBSB6OtB6PP/B/BqZ3x1tn92zBWx7BFKHRc8:GzPDNy36PRZ659MBkBFKHRc8
TLSH	T11C1160E5329051A2CCE47FE275206904604ECAC385D4ABACAECD5C729849C51B316FD3
Magika	batch
Reporter	wristhulk
Tags:	cowrie Downloader honeypot sh

wristhulk

Captured by a Cowrie honeypot at 2026-10-05 23:31:10 UTC, downloaded from http://193.161.193.99:53112/w.sh by 135.237.130.228.

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

44

Origin country :

US

Vendor Threat Intelligence

ACCE Unknown

No detections

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

busybox downloader dropper masquerade mirai

Link:

https://www.filescan.io/uploads/6ac4872eaf5230f96680eca8/reports/68fd0ff7-877a-4a29-a45c-7e1ac3baa338/overview

Kaspersky OpenTIP Clean

Verdict:

Clean

File Type:

text

First seen:

2026-10-05T17:52:00Z UTC

Last seen:

2026-10-07T05:02:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/d201a44d067b1d5c79cebb4b1cd9fdb80e61258882186da74771cb63f89f03c0/results?tab=lookup

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/6a35e622-e158-4b91-8a7f-0e7bee192519

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

89%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/d201a44d067b1d5c79cebb4b1cd9fdb80e61258882186da74771cb63f89f03c0

CERT.PL MWDB

Gathering data

ReversingLabs TitaniumCloud Script-BAT.Downloader.Heuristic

Threat name:

Script-BAT.Downloader.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-10-05 20:58:26 UTC

File Type:

Text (Shell)

AV detection:

7 of 36 (19.44%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=2ia2itigpmovy6ooxnfrzwp5xahgcjmiqimg3j2hohfwh6e7apaa._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

execution

Link:

https://tria.ge/reports/261006-f6nqfa1drg/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Executes a command shell one-liner

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/d201a44d067b1d5c79cebb4b1cd9fdb80e61258882186da74771cb63f89f03c0