MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f11e572add7ac8ae3b34d613bf28c8a7991e33269bb7119a17d8186c8c725109. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	f11e572add7ac8ae3b34d613bf28c8a7991e33269bb7119a17d8186c8c725109
SHA3-384 hash:	47f6c91cf9bcf3490d44c531f531742bff0ddab59c12db9780686eaedc98d8f0fe0dc900d486f00f1450d1488a7ba6cf
SHA1 hash:	eb2735303c00c21f746f463ff7d5398b431d6cd9
MD5 hash:	711d730a2f1db0833a7b2403753ffedd
humanhash:	georgia-delta-double-butter
File name:	ohshit.sh
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	2'989 bytes
First seen:	2025-09-06 19:49:01 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	48:s27X7N7h2k6G2g8zP2UKW2qoU27q7o7U2fB3b2n9R2ucg2DpV28SO2Y+C2RfT2Ji:s27X7N7h2k6G2g8zP2UKW2qoU27q7o7c
TLSH	T11251C48642880D302963AF17F6B6E13C3682D19399E9BFE5DDE8FBE1025EE143181753
Magika	batch
Reporter	abuse_ch
Tags:	sh

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

35

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

no reply from clamd

Alert

Create hunting rule

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

unix shell

First seen:

2025-09-06T17:34:00Z UTC

Last seen:

2025-09-06T17:34:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/f11e572add7ac8ae3b34d613bf28c8a7991e33269bb7119a17d8186c8c725109/results?tab=lookup

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/63999ea2-0739-41a8-8c65-71d7c6cdfcf8

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/f11e572add7ac8ae3b34d613bf28c8a7991e33269bb7119a17d8186c8c725109

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f11e572add7ac8ae3b34d613bf28c8a7991e33269bb7119a17d8186c8c725109/

ReversingLabs TitaniumCloud Linux.Downloader.Medusa

Threat name:

Linux.Downloader.Medusa

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-09-06 19:50:44 UTC

File Type:

Text (Shell)

AV detection:

17 of 38 (44.74%)

Threat level:

  3/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=6epfokw5plek4ozu2yj36kgiu6mr4mzgto3rdgqx3amgzddskeeq._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

n/a

Link:

https://tria.ge/reports/250906-yjwrmsep5s/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/f11e572add7ac8ae3b34d613bf28c8a7991e33269bb7119a17d8186c8c725109