MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d787ba6994b2bb0e7e46a6b26fac5888ad9f4fecd40b0ec7c80710c03e6f8d47. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	d787ba6994b2bb0e7e46a6b26fac5888ad9f4fecd40b0ec7c80710c03e6f8d47
SHA3-384 hash:	5ef1e686bbbfe2c8d0d90431ad52601228a7a2b0f1fd5c4b1228a27bd81a38953dc7fba13e5b85c54dbd5065eb8eee35
SHA1 hash:	9313fb5f686795d57a399e180830938b5ea5d0d1
MD5 hash:	3f28a1b901ee2cf5ea6ea6169a286da7
humanhash:	bacon-enemy-may-mars
File name:	telnet.sh
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	1'779 bytes
First seen:	2025-09-22 05:52:06 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:bOx8/8wq3de5WNG9T8d4F+JruymavV+hO1ab:s9o
TLSH	T1B63189CDD3A19ED2E646CF60B872C3C4A3ADD5CA2791CB71A4CA3C21984DA80BC75716
Magika	shell
Reporter	abuse_ch
Tags:	sh

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

42

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Linux.DownLoader.683.9813.25280.UNOFFICIAL

Alert

Create hunting rule

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

unix shell

First seen:

2025-09-21T20:18:00Z UTC

Last seen:

2025-09-21T20:18:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan-Downloader.Shell.Agent.a

Link:

https://opentip.kaspersky.com/d787ba6994b2bb0e7e46a6b26fac5888ad9f4fecd40b0ec7c80710c03e6f8d47/results?tab=lookup

Kunai Sandbox

Status:

Failed

Link:

https://sandbox.kunai.rocks/analysis/7a2d7dee-1246-461d-9419-738d55b7898a

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/d787ba6994b2bb0e7e46a6b26fac5888ad9f4fecd40b0ec7c80710c03e6f8d47

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d787ba6994b2bb0e7e46a6b26fac5888ad9f4fecd40b0ec7c80710c03e6f8d47/

Neiki Document-HTML.Trojan.Vigorf

Verdict:

Malicious

Threat:

Document-HTML.Trojan.Vigorf

Link:

https://tip.neiki.dev/file/d787ba6994b2bb0e7e46a6b26fac5888ad9f4fecd40b0ec7c80710c03e6f8d47

ReversingLabs TitaniumCloud Document-HTML.Trojan.Vigorf

Threat name:

Document-HTML.Trojan.Vigorf

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-09-22 01:13:09 UTC

File Type:

Text (Shell)

AV detection:

15 of 38 (39.47%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=26d3u2muwk5q47sgu2zg7lcyrcwz6t7m2qfq5r6ia4imaptprvdq._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

antivm defense_evasion discovery linux persistence

Link:

https://tria.ge/reports/250922-gk3g5sdr41/

Behaviour

System Network Configuration Discovery

Writes file to tmp directory

Reads runtime system information

Changes its process name

Checks CPU configuration

Enumerates running processes

Modifies init.d

File and Directory Permissions Modification

Deletes itself

Executes dropped EXE

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

0.98

Link:

https://yomi.yoroi.company/submissions/d787ba6994b2bb0e7e46a6b26fac5888ad9f4fecd40b0ec7c80710c03e6f8d47