MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dcbe16957595ccd61ed97cf44f07a5967788bd48bd903fc688ef3995b0132f91. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	dcbe16957595ccd61ed97cf44f07a5967788bd48bd903fc688ef3995b0132f91
SHA3-384 hash:	84405952a4e5171b651639e99011a908d35e4c47af5f9d412ac8b246b7faa8b69d4dd743772b7f619b499bf0fbdd6925
SHA1 hash:	1dc6b1bd7ada0a6053aa036da29d1784f3b4db4c
MD5 hash:	9bacb0a86f375029e9e48cfa952f6d89
humanhash:	bulldog-don-thirteen-summer
File name:	goth.sh
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	3'558 bytes
First seen:	2025-12-10 07:59:25 UTC
Last seen:	2025-12-11 00:44:02 UTC
File type:	sh
MIME type:	text/x-shellscript
ssdeep	24:wyFTZ7v7bJ7T2syIfwZ7ue7uO7msyqmIqxZ7Ku70oia7ysyH1Z7KE7toY7asyhYA:wOXNCAqi1ctyFpWhmWgWyCpI79
TLSH	T1617198CE30602A346E1FC976337498D176D649A42987DECCBCD4BCE25C9AD80B4C6BB5
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	sh

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

44

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/6939289b64bd958a520f764e/reports/22675b56-e9d1-4f90-b416-b1e029737ae8/overview

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

unix shell

First seen:

2025-12-10T00:28:00Z UTC

Last seen:

2025-12-10T07:17:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/dcbe16957595ccd61ed97cf44f07a5967788bd48bd903fc688ef3995b0132f91/results?tab=lookup

Kunai Sandbox

Status:

Failed

Link:

https://sandbox.kunai.rocks/analysis/81c14eca-5d36-44eb-ad0a-d6dafbf17739

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/dcbe16957595ccd61ed97cf44f07a5967788bd48bd903fc688ef3995b0132f91

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/dcbe16957595ccd61ed97cf44f07a5967788bd48bd903fc688ef3995b0132f91/

ReversingLabs TitaniumCloud Linux.Downloader.Morila

Threat name:

Linux.Downloader.Morila

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-12-10 07:30:04 UTC

File Type:

Text (Shell)

AV detection:

14 of 24 (58.33%)

Threat level:

  3/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=3s7bnflvsxgnmhwzpt2e6b5fsz3yrpkixwid7rui544zlmatf6iq._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  1/10

Tags:

linux

Link:

https://tria.ge/reports/251210-jv8g9awnaj/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/dcbe16957595ccd61ed97cf44f07a5967788bd48bd903fc688ef3995b0132f91