MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 eceb34f46b332440f16b83a32e61b3e302803d942b955bbee04719603f0d5edf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	eceb34f46b332440f16b83a32e61b3e302803d942b955bbee04719603f0d5edf
SHA3-384 hash:	0080d50ba2ed64d37ea31272a6dcb257b3e3c6c131ef39e0a807907fcbcb607ea5b10fa0778dea75d177b0e5442a93fb
SHA1 hash:	62bc84daad239b404caf6adb66329f32e0850069
MD5 hash:	4f3573886d8f93ae3a6608eaa4a69873
humanhash:	xray-orange-kentucky-july
File name:	w.sh
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	874 bytes
First seen:	2025-02-09 19:41:07 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	12:Pj9qrNIl5zA40LKjfOszCd/eSEXtaKAdjRiA7fAUv:P5mNI7cKDNYWntB65xv
TLSH	T13711FEDD315067A5084E9D0370AE8AC8944CEBC03254AFDD994C04BB6E98D15F599FBE
Magika	txt
Reporter	abuse_ch
Tags:	sh

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

113

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Linux.Downloader-32.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67a905b4f667f46cd182ba15linux22vpnfull_triage

Tags:

trojan miner overt

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Nucleon Malprob Benign

Score:

0%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/eceb34f46b332440f16b83a32e61b3e302803d942b955bbee04719603f0d5edf

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/eceb34f46b332440f16b83a32e61b3e302803d942b955bbee04719603f0d5edf/

ReversingLabs TitaniumCloud Script-Shell.Downloader.Mirai

Threat name:

Script-Shell.Downloader.Mirai

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-02-09 19:42:20 UTC

File Type:

Text (Shell)

AV detection:

15 of 24 (62.50%)

Threat level:

  3/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=5tvtj5dlgmseb4llqors4ynt4mbiapmufokvxpxai4mwapynl3pq._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

discovery

Link:

https://tria.ge/reports/250209-yd8h9a1jdx/

Behaviour

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Modifies registry class

Suspicious behavior: GetForegroundWindowSpam

Enumerates physical storage devices

System Location Discovery: System Language Discovery

System Network Configuration Discovery: Internet Connection Discovery

Downloads MZ/PE file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/eceb34f46b332440f16b83a32e61b3e302803d942b955bbee04719603f0d5edf