🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1260167c2c6bf191d079fe5826f8227f502ec151e8e30d6e3406902bd70addfb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1260167c2c6bf191d079fe5826f8227f502ec151e8e30d6e3406902bd70addfb
SHA3-384 hash: 57c45d9ec38f2d880ef0a3fffac2c0f527fab63c191e57d0c56379982a6aadb293cf7135f8aebddffb5eeb74afa518f9
SHA1 hash: 8cadf2754eb8ec027efbfcc815e6721b1e958788
MD5 hash: d2873da55dd5a8b9427886f962fcb1f3
humanhash: enemy-mirror-massachusetts-king
File name:run.sh
Download: download sample
File size:513 bytes
First seen:2026-09-28 20:43:51 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 12:LVe0tfRhB879L/7hi/b4T+WP/T3L07Pi6:ImR/E9HhpV6
TLSH T18FF08B1BAE300C15302ECE1F08D48A009D894837C44E1EBEB2CA5F50E1B4E197260DAF
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter Kejult
Tags:CoinMiner sh

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
GR GR
Vendor Threat Intelligence
No detections
Verdict:
Unknown
Threat level:
  0/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/6abad19c4771168583c80c41/reports/85e84e3e-1a72-49ae-8b39-d5a2700b7bf1/overview
Verdict:
Unknown
File Type:
unix shell
Link:
https://opentip.kaspersky.com/1260167c2c6bf191d079fe5826f8227f502ec151e8e30d6e3406902bd70addfb/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/d298ca36-32ce-4d6d-b8e4-f421359536a5
Behavior Graph:
Download SVG
%3 guuid=2af55168-1800-0000-6884-4702dc090000 pid=2524 /usr/bin/sudo guuid=a686866a-1800-0000-6884-4702e3090000 pid=2531 /tmp/sample.bin guuid=2af55168-1800-0000-6884-4702dc090000 pid=2524->guuid=a686866a-1800-0000-6884-4702e3090000 pid=2531 execve guuid=ffe2c46a-1800-0000-6884-4702e4090000 pid=2532 /usr/bin/dash guuid=a686866a-1800-0000-6884-4702e3090000 pid=2531->guuid=ffe2c46a-1800-0000-6884-4702e4090000 pid=2532 clone guuid=97a13f6b-1800-0000-6884-4702e7090000 pid=2535 /usr/bin/dash guuid=a686866a-1800-0000-6884-4702e3090000 pid=2531->guuid=97a13f6b-1800-0000-6884-4702e7090000 pid=2535 clone guuid=6938e36b-1800-0000-6884-4702ec090000 pid=2540 /usr/bin/pgrep guuid=a686866a-1800-0000-6884-4702e3090000 pid=2531->guuid=6938e36b-1800-0000-6884-4702ec090000 pid=2540 execve guuid=c4f07873-1800-0000-6884-4702fe090000 pid=2558 /usr/bin/dash guuid=a686866a-1800-0000-6884-4702e3090000 pid=2531->guuid=c4f07873-1800-0000-6884-4702fe090000 pid=2558 clone guuid=feb08c73-1800-0000-6884-4702000a0000 pid=2560 /usr/bin/pgrep guuid=a686866a-1800-0000-6884-4702e3090000 pid=2531->guuid=feb08c73-1800-0000-6884-4702000a0000 pid=2560 execve guuid=14245e79-1800-0000-6884-47020a0a0000 pid=2570 /usr/bin/dash guuid=a686866a-1800-0000-6884-4702e3090000 pid=2531->guuid=14245e79-1800-0000-6884-47020a0a0000 pid=2570 clone guuid=9985d16a-1800-0000-6884-4702e5090000 pid=2533 /usr/bin/dirname guuid=ffe2c46a-1800-0000-6884-4702e4090000 pid=2532->guuid=9985d16a-1800-0000-6884-4702e5090000 pid=2533 execve guuid=02964b6b-1800-0000-6884-4702e9090000 pid=2537 /usr/bin/hostname guuid=97a13f6b-1800-0000-6884-4702e7090000 pid=2535->guuid=02964b6b-1800-0000-6884-4702e9090000 pid=2537 execve guuid=3ba6526b-1800-0000-6884-4702ea090000 pid=2538 /usr/bin/cut guuid=97a13f6b-1800-0000-6884-4702e7090000 pid=2535->guuid=3ba6526b-1800-0000-6884-4702ea090000 pid=2538 execve guuid=21558273-1800-0000-6884-4702ff090000 pid=2559 /usr/bin/nohup zombie guuid=c4f07873-1800-0000-6884-4702fe090000 pid=2558->guuid=21558273-1800-0000-6884-4702ff090000 pid=2559 execve guuid=bd8f6579-1800-0000-6884-47020b0a0000 pid=2571 /usr/bin/nohup zombie guuid=14245e79-1800-0000-6884-47020a0a0000 pid=2570->guuid=bd8f6579-1800-0000-6884-47020b0a0000 pid=2571 execve
Score:
89%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/1260167c2c6bf191d079fe5826f8227f502ec151e8e30d6e3406902bd70addfb
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1260167c2c6bf191d079fe5826f8227f502ec151e8e30d6e3406902bd70addfb/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=cjqbm7bmnpyzdudz7zmcn6bcp5ic5qkr5drq23rua2icxvyk3x5q._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/1260167c2c6bf191d079fe5826f8227f502ec151e8e30d6e3406902bd70addfb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CoinMiner_Strings
Create hunting rule
Author:Florian Roth (Nextron Systems)
Description:Detects mining pool protocol string in Executable
Reference:https://minergate.com/faq/what-pool-address
Rule name:CoinMiner_Strings_RID2DDE
Create hunting rule
Author:Florian Roth
Description:Detects mining pool protocol string in Executable
Reference:https://minergate.com/faq/what-pool-address

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Distributed via drive-by

Comments