MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fb9c1857bd6e05545dd078a10efb52784f202b045a523b056cd16f25cd008b7f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	fb9c1857bd6e05545dd078a10efb52784f202b045a523b056cd16f25cd008b7f
SHA3-384 hash:	43532a6ad2da36d475f89f6efe7d6acd64802f010da488f31b9a8704e6c8a4187fcb68131d7db384dc95b7332c969d1b
SHA1 hash:	657d20299370e705949ab6c812e4a53b164d06ba
MD5 hash:	700b1dd6a8a269d1f1137c2ceb32c775
humanhash:	oxygen-minnesota-lamp-solar
File name:	wget.sh
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	1'089 bytes
First seen:	2025-09-27 17:21:27 UTC
Last seen:	2025-09-28 15:26:40 UTC
File type:	sh
MIME type:	text/plain
ssdeep	12:A+x+5+paL+5+JNIQQA+5+SvK2H+5+AKA+5+Q+5+M+5+n5+5+XH+5+RcA+5+t3A+5:SNIRKOShtRZdv
TLSH	T1A71147F90019910818086B10705A09396EFBF7E6A1369EF5547FE423B9CB5A07B25F3B
Magika	shell
Reporter	abuse_ch
Tags:	sh

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

52

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Shell.Downloader.Gen-1.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/68d81d1e674d5fd6aa0e772b/reports/da371a9e-eb8b-4896-9e62-aae4f04d112e/overview

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

ps1

First seen:

2025-09-27T14:27:00Z UTC

Last seen:

2025-09-27T14:27:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan-Downloader.Shell.Agent.cl HEUR:Exploit.Linux.CVE-2017-17215.a HEUR:Backdoor.Linux.Mirai.ba HEUR:Backdoor.Linux.Mirai.b HEUR:Backdoor.Linux.Mirai.au

Link:

https://opentip.kaspersky.com/fb9c1857bd6e05545dd078a10efb52784f202b045a523b056cd16f25cd008b7f/results?tab=lookup

Kunai Sandbox

Status:

Failed

Link:

https://sandbox.kunai.rocks/analysis/fac2bc29-392e-476e-88f2-18f59f50aaa9

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/fb9c1857bd6e05545dd078a10efb52784f202b045a523b056cd16f25cd008b7f

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/fb9c1857bd6e05545dd078a10efb52784f202b045a523b056cd16f25cd008b7f/

Neiki Family.MIRAI

Verdict:

Malicious

Threat:

Family.MIRAI

Link:

https://tip.neiki.dev/file/fb9c1857bd6e05545dd078a10efb52784f202b045a523b056cd16f25cd008b7f

ReversingLabs TitaniumCloud Linux.Trojan.Vigorf

Threat name:

Linux.Trojan.Vigorf

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-09-27 17:22:29 UTC

File Type:

Text (Shell)

AV detection:

16 of 24 (66.67%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7oobqv55nycvixoqpcqq562spbhsakyeljjdwblm2fxsltiarn7q._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

n/a

Link:

https://tria.ge/reports/250927-vw8p7agl7v/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/fb9c1857bd6e05545dd078a10efb52784f202b045a523b056cd16f25cd008b7f