MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ec0a0374513a93cd3f34e6b0ce57fc7408706dfd687bd608c385ac8da54ce047. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	ec0a0374513a93cd3f34e6b0ce57fc7408706dfd687bd608c385ac8da54ce047
SHA3-384 hash:	17d3bca12b695b02cfa981d85af6842f89e406d6251b7542c1e555ac48bed94db2a2e83153c29b1cbfeb3ed23daee36a
SHA1 hash:	22c4309c569f632e8f987878ac5c8341079f769f
MD5 hash:	1a9a145c68eda5752e3530fa44a13994
humanhash:	one-four-charlie-cold
File name:	ec0a0374513a93cd3f34e6b0ce57fc7408706dfd687bd608c385ac8da54ce047.bin
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	1'665 bytes
First seen:	2026-10-21 07:37:08 UTC
Last seen:	2026-10-22 07:44:15 UTC
File type:	sh
MIME type:	text/plain
ssdeep	48:PJSiZ7ViEYFwGuWmBgIIHsibsL8HAStgGu5yPNgAGik4IVIR:gaV1OHVkT81M8gubOylBL5IiR
TLSH	T1A0317E8D3F6123832F015E9EFA6187CD9802C9E2F57687B0ED58853D5AA770C1A5732B
Magika	shell
Reporter	Tuxxin
Tags:	script sh

Intelligence

---

File Origin

# of uploads :

35

# of downloads :

25

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.Linux.Downloader-33.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

masquerade

Link:

https://www.filescan.io/uploads/6ad87cd90ba350ee09db3134/reports/620a9393-6c4f-4928-99ab-354237bb3a3e/overview

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

text

First seen:

2026-10-21T05:31:00Z UTC

Last seen:

2026-10-22T04:01:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/ec0a0374513a93cd3f34e6b0ce57fc7408706dfd687bd608c385ac8da54ce047/results?tab=lookup

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/17ca4674-bec6-4fcc-b5a6-5ff561119032

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/ec0a0374513a93cd3f34e6b0ce57fc7408706dfd687bd608c385ac8da54ce047

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ec0a0374513a93cd3f34e6b0ce57fc7408706dfd687bd608c385ac8da54ce047/

ReversingLabs TitaniumCloud Linux.Downloader.Generic

Threat name:

Linux.Downloader.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2026-10-21 08:50:29 UTC

File Type:

Text (Shell)

AV detection:

10 of 24 (41.67%)

Threat level:

  3/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=5qfag5crhkj42pzu42ym4v74oqeha3p5nb55mcgdqwwi3jkm4bdq._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

execution

Link:

https://tria.ge/reports/261021-krss3a119k/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Executes a command shell one-liner

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/ec0a0374513a93cd3f34e6b0ce57fc7408706dfd687bd608c385ac8da54ce047