MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ff91e55afeaf1b7de58b04519f58483413b045c20801819b60aef200452c85b6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	ff91e55afeaf1b7de58b04519f58483413b045c20801819b60aef200452c85b6
SHA3-384 hash:	53995d6ba2b2eb84252557af521287a09eb19ca5c092b5a83d37b5033c9d11028798e4c3841f5da72366009be1564fd1
SHA1 hash:	b58327a0d63e780b56c97bcc1bb148980880ded4
MD5 hash:	9abbbaf02615886bfb1011fbedb27def
humanhash:	undress-magnesium-earth-iowa
File name:	c.sh
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	768 bytes
First seen:	2025-06-21 19:31:09 UTC
Last seen:	2025-06-22 03:21:17 UTC
File type:	sh
MIME type:	text/plain
ssdeep	12:3J3FuQjQFbLqQFxNIl5zAQFif0LKjQFSgOsQFVCQFoa/QFkSEQFFtaKAQFU0jQFb:3J30Q8LNNI7nK9gMMapEtBGLaHA
TLSH	T155019BCD25B593A21A0CCE1CF16F966C7A869AC0B0708E95FC58997978DDB043064B7A
Magika	txt
Reporter	abuse_ch
Tags:	sh

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

87

Origin country :

DE

Vendor Threat Intelligence

CyberFortress Malicious

Verdict:

Malicious

Score:

93.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68570c60b06783b9ebd676dflinux22vpnfull_triage

Tags:

agent hype sage

FileScan.IO Unknown

Verdict:

Unknown

Threat level:

  2.5/10

Confidence:

100%

Tags:

lolbin remote

Link:

https://www.filescan.io/uploads/6857098c3faf8fcd7d3a1d56/reports/ab03b68a-0dad-4abb-b7eb-eba4e16b87f6/overview

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/1874f523-4519-45de-811a-7192821b4ae8

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/ff91e55afeaf1b7de58b04519f58483413b045c20801819b60aef200452c85b6

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ff91e55afeaf1b7de58b04519f58483413b045c20801819b60aef200452c85b6/

ReversingLabs TitaniumCloud Linux.Trojan.Egairtigado

Threat name:

Linux.Trojan.Egairtigado

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-06-21 19:39:20 UTC

File Type:

Text (Shell)

AV detection:

14 of 24 (58.33%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=76i6kwx6v4nx3zmlariz6wcigqj3arocbaaydg3av3zaarjmqw3a._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

n/a

Link:

https://tria.ge/reports/250621-yaszdstmz3/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/ff91e55afeaf1b7de58b04519f58483413b045c20801819b60aef200452c85b6