MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f6efbd95db7cf4202dcdcf473ded3bedede2c922525045c711ee3f24d886aafb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	f6efbd95db7cf4202dcdcf473ded3bedede2c922525045c711ee3f24d886aafb
SHA3-384 hash:	6c1cdc3c000765ac9122bb396f80bb0e3a18eddcbcbe573c1bcbf5542c6234ab0044bc90a1de7cf10de04e0ff9b88cfa
SHA1 hash:	f238ab5f857d945295b946dc2413aa9ff295ff3b
MD5 hash:	d57b86176a74bbadda703125b1b1b379
humanhash:	fanta-jupiter-indigo-venus
File name:	run.sh
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	2'815 bytes
First seen:	2025-11-20 08:57:43 UTC
Last seen:	2025-11-20 16:55:46 UTC
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:/gbU9ETEra/qVUrLA7V4EUAtYzJMH8gGvkmkQYt2JkP45:/gbU9EEBQe4EUAmzJMH8gGvkmkQYt2JD
TLSH	T155517FA511524F3D7CF29A2FB2AD0409B1F395AB60E7DF149CD834A6618ED743C02E5E
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	mirai sh

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

36

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

bash busybox evasive lolbin mirai

Link:

https://www.filescan.io/uploads/691ed82bd6ee29a04089452b/reports/f9f26dc7-b3e9-41ae-ae8c-888f8ad45f82/overview

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

unix shell

First seen:

2025-11-20T06:37:00Z UTC

Last seen:

2025-11-21T23:02:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/f6efbd95db7cf4202dcdcf473ded3bedede2c922525045c711ee3f24d886aafb/results?tab=lookup

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/4c1e8f22-241f-449f-9495-4ad2b2b33707

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/f6efbd95db7cf4202dcdcf473ded3bedede2c922525045c711ee3f24d886aafb

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f6efbd95db7cf4202dcdcf473ded3bedede2c922525045c711ee3f24d886aafb/

ReversingLabs TitaniumCloud Linux.Downloader.Medusa

Threat name:

Linux.Downloader.Medusa

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-11-20 08:55:20 UTC

File Type:

Text (Shell)

AV detection:

16 of 24 (66.67%)

Threat level:

  3/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=63x33fo3pt2calonz5dt33j35xw6fsjckjielryr5y7sjwegvl5q._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  1/10

Tags:

linux

Link:

https://tria.ge/reports/251120-kxa57ssmas/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/f6efbd95db7cf4202dcdcf473ded3bedede2c922525045c711ee3f24d886aafb