MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0a544f1dc2b259d9960e70b2b8a140bc2622cd66f7344c31087348609ac98f43. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0a544f1dc2b259d9960e70b2b8a140bc2622cd66f7344c31087348609ac98f43
SHA3-384 hash: aa6b4aea99aa698613f26e7fd2d882d1850ac3b7498abd05c41412cb61847443cfe90288d7cf971fc32cede83b06829f
SHA1 hash: 3943d4264c4bc1dcff12cca5550e0cea96c219a4
MD5 hash: ad7e6d767dbecea73c431c59870d969d
humanhash: yankee-salami-bakerloo-social
File name:0a544f1dc2b259d9960e70b2b8a140bc2622cd66f7344c31087348609ac98f43
Download: download sample
File size:2'199 bytes
First seen:2024-06-14 06:54:06 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 48:KkwDwLNwQwRNZwqw4gpqrQw3zwz4wcYwclE7eY1DwqTwqaHVnSwJwMmTwiwWYgfD:KkwDwLNwQwRNZwqwqQwDwz4wrwr1DwqF
TLSH T10241A3892FA210317D91B8B37F9758083480E17979DF8E54A7E939DDA498C8C7D4EA42
Reporter c0r3dump3d
Tags:bash sh

Intelligence

File Origin
# of uploads :
1
# of downloads :
85
Origin country :
US US
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=666be988a2bce47be7da3ecfwin10vpnfull_triage
Tags:
Html
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
coinminer mirai virus
Link:
https://www.filescan.io/uploads/666be94b0bf5978c0b0f3d0b/reports/24929e1f-9cfa-467f-bea9-e8e29e61a16e/overview
Result
Verdict:
MALICIOUS
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0a544f1dc2b259d9960e70b2b8a140bc2622cd66f7344c31087348609ac98f43/
Threat name:
Linux.Downloader.Medusa
Create hunting rule
Status:
Malicious
First seen:
2024-06-11 22:08:54 UTC
File Type:
Text (Shell)
AV detection:
16 of 24 (66.67%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bjke6hocwjm5tfqooczlrikaxqtcftlg642eymiionegbgwjr5bq._file
Result
Malware family:
n/a
Score:
  4/10
Tags:
linux
Link:
https://tria.ge/reports/240614-hptapsshkj/
Behaviour
Reads runtime system information
Reads CPU attributes
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.37
Link:
https://yomi.yoroi.company/submissions/0a544f1dc2b259d9960e70b2b8a140bc2622cd66f7344c31087348609ac98f43

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Linux_Shellscript_Downloader
Create hunting rule
Author:albertzsigovits
Description:Generic Approach to Shellscript downloaders

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other
  
URLhaus
https://urlhaus.abuse.ch/url/2886046/

Comments