MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 da308f75a92d760aa74210eda1c8cb66f6e282905b502ed1a38a303d5e9766c8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	da308f75a92d760aa74210eda1c8cb66f6e282905b502ed1a38a303d5e9766c8
SHA3-384 hash:	b7f38efd3d0439421bba61b4a03334174d31ab01c22396c9a884fba80f3f1414fdd02d6115236886c403540903365374
SHA1 hash:	0789fe086e7d5fea31283bcc55df8d39eb8ed2d1
MD5 hash:	6295386be2f7705aa9e0e341942512c5
humanhash:	uranus-tennis-west-fifteen
File name:	da308f75a92d760aa74210eda1c8cb66f6e282905b502ed1a38a303d5e9766c8.sh
Download:	download sample
Signature	Gafgyt Alert Create hunting rule
File size:	285 bytes
First seen:	2025-11-24 09:59:06 UTC
Last seen:	2025-11-25 02:14:39 UTC
File type:	sh
MIME type:	text/x-shellscript
ssdeep	6:h7YpQ3YkDiMvgdhmVYZG2YryMvWmVYhYLcM95b:ipQoGiMvTmUOMv5muAM9h
TLSH	T1DED086AC06373804400C3869B5F74355B054D289687B4764848814FDC0CCE0C70AEE4D
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	sh

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

31

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

evasive mirai

Link:

https://www.filescan.io/uploads/69242c7cf6a4ba1793ae43e9/reports/645a71c4-969f-4a9b-9e83-2f797de26a80/overview

InQuest

Result

Gathering data

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

unix shell

First seen:

2025-11-06T04:53:00Z UTC

Last seen:

2025-11-23T19:01:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/da308f75a92d760aa74210eda1c8cb66f6e282905b502ed1a38a303d5e9766c8/results?tab=lookup

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/345f1ed2-514d-40b6-a327-099895cbf937

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/da308f75a92d760aa74210eda1c8cb66f6e282905b502ed1a38a303d5e9766c8

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/da308f75a92d760aa74210eda1c8cb66f6e282905b502ed1a38a303d5e9766c8/

ReversingLabs TitaniumCloud Document-HTML.Downloader.Heuristic

Threat name:

Document-HTML.Downloader.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-11-05 06:19:14 UTC

File Type:

Text (Shell)

AV detection:

6 of 24 (25.00%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=3iyi65njfv3avj2ccdw2dsglm33ofauqlnic5undriyd2xuxm3ea._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

defense_evasion discovery linux

Link:

https://tria.ge/reports/251124-lz9xzsxjer/

Behaviour

System Network Configuration Discovery

Writes file to tmp directory

File and Directory Permissions Modification

Executes dropped EXE

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.31

Link:

https://yomi.yoroi.company/submissions/da308f75a92d760aa74210eda1c8cb66f6e282905b502ed1a38a303d5e9766c8