MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 01d1bc177f8b1f0fb43d52d1296656b87e2d0374f19f7910ea604400ab37c2f8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	01d1bc177f8b1f0fb43d52d1296656b87e2d0374f19f7910ea604400ab37c2f8
SHA3-384 hash:	4431f962138d05bd77ec101e39a5f37f350e0be736bc5b8140bc984abf5845ac57c159e247caa3340ab9144346ba8016
SHA1 hash:	aa8260aa5de3ea4824ae296e858b2e7a2dcf27e5
MD5 hash:	7314a561ed9ba0a065a5dc6c0878d255
humanhash:	november-papa-cat-item
File name:	w.sh
Download:	download sample
File size:	1'249 bytes
First seen:	2024-11-15 11:52:14 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	24:xMcLFTICkFTICkFtvnEcCkFR8NIU2+BCkFKKf/KECkFheCkFop8X7CkFkiuCkFNd:lBQ0vEf0R4WGxbeEybSN9
TLSH	T1F521BBCB12D8F40285BC7E0430D648697382EBD22C69DF5F944E01FAADA5B18F1E4D05
Magika	shell
Reporter	abuse_ch
Tags:	sh

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

65

Origin country :

DE

Vendor Threat Intelligence

CyberFortress Malicious

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6737367b6bc7caf979b2e6a3linux22vpnfull_triage

Tags:

downloader trojan mirai overt

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/67373621eb893e5fda467b70/reports/145dcd72-85a6-443a-9923-5f1d118a00d2/overview

Nucleon Malprob Benign

Score:

4%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/01d1bc177f8b1f0fb43d52d1296656b87e2d0374f19f7910ea604400ab37c2f8

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/01d1bc177f8b1f0fb43d52d1296656b87e2d0374f19f7910ea604400ab37c2f8/

ReversingLabs TitaniumCloud Linux.Downloader.Generic

Threat name:

Linux.Downloader.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2024-11-15 11:53:04 UTC

File Type:

Text (Shell)

AV detection:

13 of 38 (34.21%)

Threat level:

  3/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ahi3yf37rmpq7nb5klisszswxb7c2a3u6gpxsehkmbcabkzxyl4a._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

discovery

Link:

https://tria.ge/reports/241115-n2al1sxmap/

Behaviour

Modifies registry class

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/01d1bc177f8b1f0fb43d52d1296656b87e2d0374f19f7910ea604400ab37c2f8