MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 07b1d426ba3024b72a10fc7267675a6fb3a9a239565733f0f5166aadbb1594b1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	07b1d426ba3024b72a10fc7267675a6fb3a9a239565733f0f5166aadbb1594b1
SHA3-384 hash:	db761933b1b1150844a79bb9f6886343e3fa25e587817b78bfbcf38ce4f05c14c31e0cfbc7fab7fdef4331b9615d8d3c
SHA1 hash:	1e38a5f1d8084375113350d29262d130927f1970
MD5 hash:	341dab1506a1bb5c59f497d628a01e3d
humanhash:	high-maine-fifteen-pip
File name:	sh
Download:	download sample
File size:	2'279 bytes
First seen:	2025-08-30 06:29:06 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:vkwvpihneZZn1oBzyQyLXStonmzEvJGU6ljiPq2MTCki:vkwYheZZKQF62mzIj6K
TLSH	T1574155A9F8628F3033ADC4B874852548A347866F481B2E74F043787C3BBC35470B4795
Magika	shell
Reporter	abuse_ch
Tags:	sh

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

29

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.BV.Downloader-AEH.92376113.UNOFFICIAL

Alert

Create hunting rule

Kaspersky OpenTIP Adware

Verdict:

Adware

File Type:

unix shell

First seen:

2025-08-29T10:47:00Z UTC

Last seen:

2025-08-29T10:47:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/07b1d426ba3024b72a10fc7267675a6fb3a9a239565733f0f5166aadbb1594b1/results?tab=lookup

Kunai Sandbox

Status:

Failed

Link:

https://sandbox.kunai.rocks/analysis/93e1ccc0-ce12-4615-aaca-fedd3ca4be4c

Nucleon Malprob Susipicious

Score:

39%

Verdict:

Susipicious

File Type:

SCRIPT

Link:

https://malprob.io/report/07b1d426ba3024b72a10fc7267675a6fb3a9a239565733f0f5166aadbb1594b1

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/07b1d426ba3024b72a10fc7267675a6fb3a9a239565733f0f5166aadbb1594b1/

Neiki RiskTool.Linux.BitCoinMiner

Verdict:

Malicious

Threat:

RiskTool.Linux.BitCoinMiner

Link:

https://tip.neiki.dev/file/07b1d426ba3024b72a10fc7267675a6fb3a9a239565733f0f5166aadbb1594b1

ReversingLabs TitaniumCloud Linux.Trojan.Vigorf

Threat name:

Linux.Trojan.Vigorf

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-08-29 17:29:17 UTC

File Type:

Text (Shell)

AV detection:

9 of 24 (37.50%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=a6y5ijv2gaslokqq7rzgoz22n6z2tirzkzlth4hvczvk3oyvssyq._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  9/10

Tags:

antivm defense_evasion discovery execution linux motw persistence phishing privilege_escalation upx

Link:

https://tria.ge/reports/250830-g873javvex/

Behaviour

Enumerates kernel/hardware configuration

Reads runtime system information

Writes file to tmp directory

Changes its process name

Checks CPU configuration

Reads CPU attributes

UPX packed file

Reads AppArmor ptrace settings

Attempts to change immutable files

Checks hardware identifiers (DMI)

Creates/modifies Cron job

Enumerates running processes

Mark of the Web detected: This indicates that the page was originally saved or cloned.

Reads hardware information

Reads network interface configuration

File and Directory Permissions Modification

Creates Raw socket

Executes dropped EXE

Flushes firewall rules

Contacts a large (1362232) amount of remote hosts

Creates a large amount of network flows

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.