MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0f241b8952e3eee26badf4a1aec93744ac6faa26759f7cf87a3c58a2079109c0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	0f241b8952e3eee26badf4a1aec93744ac6faa26759f7cf87a3c58a2079109c0
SHA3-384 hash:	77242ec68f1b97cb85ecff7340b65534104a3c85bbfd3d84f21d504d8e11be09071ff122f3151a13e8ab2a433b4c149b
SHA1 hash:	06fbfa9f4b37ea8824aa29863f96d080c0e82690
MD5 hash:	24672c0c32b9ea6bd60ca89e9f97686e
humanhash:	alpha-may-carolina-twenty
File name:	8UsA.sh
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	2'610 bytes
First seen:	2025-04-26 13:53:28 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	24:yCiRMecCiRMTcCiRM6cCiRMZ9cCiRM9vcCiRMOcCiRMLCcCiRMDcCiRM9cCiRMsZ:JAr0b9fQLc7FsINFVgpT
TLSH	T149518F84B3EB4518D9C95106E3B9C0D673DFF04B28A3DEA6C1A728F79478D8437886D6
Magika	shell
Reporter	abuse_ch
Tags:	sh

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

69

Origin country :

DE

Vendor Threat Intelligence

CyberFortress Clean

Verdict:

Clean

Score:

82.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=680ce634cc5fb3600cc2b4dclinux22vpnfull_triage

Tags:

n/a

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

lolbin remote

Link:

https://www.filescan.io/uploads/680ce58e833df795debcae50/reports/c478864f-f586-4e62-8c1c-de87d27b98ba/overview

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/0f241b8952e3eee26badf4a1aec93744ac6faa26759f7cf87a3c58a2079109c0

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/0f241b8952e3eee26badf4a1aec93744ac6faa26759f7cf87a3c58a2079109c0/

ReversingLabs TitaniumCloud Linux.Trojan.Vigorf

Threat name:

Linux.Trojan.Vigorf

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-04-26 13:54:28 UTC

File Type:

Text (Shell)

AV detection:

13 of 24 (54.17%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=b4sbxcks4pxoe25n6sq25sjxiswg7krgowpxz6d2hrmkeb4rbhaa._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

antivm defense_evasion discovery linux upx

Link:

https://tria.ge/reports/250426-q7mvmsvsh1/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Changes its process name

Checks CPU configuration

Reads system network configuration

UPX packed file

Reads system routing table

File and Directory Permissions Modification

Executes dropped EXE

Modifies Watchdog functionality

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.16

Link:

https://yomi.yoroi.company/submissions/0f241b8952e3eee26badf4a1aec93744ac6faa26759f7cf87a3c58a2079109c0