MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e7ec1e1dc20d77fc4a8059130511ca90abcb849f8473967d36f9177a4ef454c7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	e7ec1e1dc20d77fc4a8059130511ca90abcb849f8473967d36f9177a4ef454c7
SHA3-384 hash:	8ccd0cef123086c632d8bf6b8feedbe53ec1a9ce4f2e0d2c1d7f08aa54e669d2cefef035813f320a10112b1e978afec7
SHA1 hash:	a17e2fc5692cbaee770242347801cb974b65b0bc
MD5 hash:	5ecd01b270e42faeb078fc2854701c06
humanhash:	four-solar-island-minnesota
File name:	w.sh
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	830 bytes
First seen:	2025-06-12 04:09:13 UTC
Last seen:	2025-06-14 15:32:50 UTC
File type:	sh
MIME type:	text/plain
ssdeep	24:bx3WhEWYNIp7WMKlOWIWU6YWIdWuOWC8WCIWPb:V3WhEWX7WMUOWIWUBWgWuOWzWCIWD
TLSH	T13C01ADDD407152B1064C9D9DB62B98289002CDD0F7410E4CEC8C80B99DEDA9BF126F8F
Magika	txt
Reporter	abuse_ch
Tags:	sh

Intelligence

---

File Origin

# of uploads :

3

# of downloads :

82

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Linux.Downloader-32.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=684a530a8bd5d68a12e7f4c4linux22vpnfull_triage

Tags:

backdoor hype sage

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/e7ec1e1dc20d77fc4a8059130511ca90abcb849f8473967d36f9177a4ef454c7

CERT.PL MWDB

Gathering data

ReversingLabs TitaniumCloud Linux.Trojan.Alevaul

Threat name:

Linux.Trojan.Alevaul

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-06-12 09:28:49 UTC

File Type:

Text (Shell)

AV detection:

21 of 38 (55.26%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=47wb4hocbv37ysualejqkeokscv4xbe7qrzzm7jw7elxutxuktdq._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

n/a

Link:

https://tria.ge/reports/250612-erlrvsfp9v/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/e7ec1e1dc20d77fc4a8059130511ca90abcb849f8473967d36f9177a4ef454c7