MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0ab4ffcd0eaa3dce52af15dbf4248692dd709d8bfe97d29f03fb7a69dedbbe58. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 7

Intelligence 7 IOCs YARA 1 File information Comments

SHA256 hash:	0ab4ffcd0eaa3dce52af15dbf4248692dd709d8bfe97d29f03fb7a69dedbbe58
SHA3-384 hash:	3273d121ee0e991a3fa14bf679536597ac176509cab33b35bbb7deef5a15ac998d93d2f89a222ef592cec685552d345a
SHA1 hash:	9ef5d57834d204f9214cbf9fd78460960df44a4b
MD5 hash:	12516aefb4de89efdf688cec644177b9
humanhash:	tennessee-winter-november-arizona
File name:	c
Download:	download sample
File size:	280 bytes
First seen:	2025-04-22 15:17:44 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	6:ebgfr3w5/KjLNS7TMWk7dNMokevLNS7TM7dk7dNMokewFhFF1:3rWK/NSMWkxNJ5SM7dkxN2FhF3
TLSH	T1B6D0C2DD006C4821B002EEEDB293819985C0D0C82DD58E01741A4236F84D24E3990E5A
Magika	shell
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://82.24.200.71/vv/mips	n/a	n/a	elf gafgyt ua-wget
http://82.24.200.71/vv/mipsel	a49f50fdba0de9c330d0980f6cce815c1525d0800adeab6c3d82a7954923ef02	Mirai	elf gafgyt mirai ua-wget

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection(s):

SecuriteInfo.com.Linux.DownLoader.2324.21248.8955.UNOFFICIAL

Verdict:

Malicious

Score:

94.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6807b436a37ff28e12980c8dlinux22vpnfull_triage

Tags:

agent hype sage

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

evasive

Link:

https://www.filescan.io/uploads/6807b34790767142c3e00e12/reports/e5bd48e8-bf41-4eba-b598-03860ad4b2a4/overview

Score:

99%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/0ab4ffcd0eaa3dce52af15dbf4248692dd709d8bfe97d29f03fb7a69dedbbe58

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/0ab4ffcd0eaa3dce52af15dbf4248692dd709d8bfe97d29f03fb7a69dedbbe58/

Threat name:

Script-Shell.Trojan.MiraiB

Status:

Malicious

First seen:

2025-04-22 15:20:29 UTC

File Type:

Text (Shell)

AV detection:

6 of 24 (25.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=bk2p7tiovi644uvpcxn7ijegsloxbhml72l5fhyd7n5gtxw3xzma._file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/250422-sqz5rayzay/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/0ab4ffcd0eaa3dce52af15dbf4248692dd709d8bfe97d29f03fb7a69dedbbe58

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.