MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1312c34b39dc8dcc8ab101a936f37e867492876a84f94ecfacf2df96c1e4db84. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 5

Intelligence 5 IOCs YARA 2 File information Comments

SHA256 hash:	1312c34b39dc8dcc8ab101a936f37e867492876a84f94ecfacf2df96c1e4db84
SHA3-384 hash:	f476089191846e692a3a75464a31c0089166836f27526d8554acf3c5bfad764c7a3d750d0b943003a7f45577fc207edb
SHA1 hash:	b74cd6fb8be77156cbe3f013f33dce84558116f8
MD5 hash:	66f0cdaabfe171ed2bd677437a16e9ad
humanhash:	crazy-pennsylvania-winter-july
File name:	1312c34b39dc8dcc8ab101a936f37e867492876a84f94ecfacf2df96c1e4db84.sh
Download:	download sample
File size:	11'053 bytes
First seen:	2026-09-25 11:31:38 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	96:cCuosht+O+v1fsn+h4+tIiKqCTyOysYtujtuHKNpUj4waHv6y7LrJ1raqvlAAbKb:cCul4hvZ5m5FG4j4HKNphvfd1+qd0
TLSH	T1AC32463B21F08B32D7C410C9A3B61A654E72A70B452614B5F4FE6736AF2D90371E7B61
Magika	xml
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://193.243.147.115/gz067%20-O-	n/a	n/a	n/a
http://45.225.187.6:81/hiddenbin/dvr1.sh	n/a	n/a	ascii bash sh ua-wget
http://updater.zzux.com/m	n/a	n/a	n/a
http://hxipzknrsojnitzv.zip/bins/bins.sh	652285d260515c08cfe146ebdd2f5a4977ec490a608c57007abcb5b6f4fd4975	Mirai	botnetdomain mirai opendir sh

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

SecuriteInfo.com.BV.Downloader-BPG.79768538.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

evasive

Link:

https://www.filescan.io/uploads/6ab65bc15572dad4ee1fe1e6/reports/d6da5f50-b633-40cc-be11-1c76fb7a443c/overview

Verdict:

Malicious

File Type:

text

First seen:

2026-09-25T10:01:00Z UTC

Last seen:

2026-09-25T10:42:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/1312c34b39dc8dcc8ab101a936f37e867492876a84f94ecfacf2df96c1e4db84/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/44c66e4d-e9c4-4a32-a3a4-74b4f06afff9

Behavior Graph:

Download SVG

Score:

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/1312c34b39dc8dcc8ab101a936f37e867492876a84f94ecfacf2df96c1e4db84

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/1312c34b39dc8dcc8ab101a936f37e867492876a84f94ecfacf2df96c1e4db84/

Threat name:

Script-BAT.Trojan.Heuristic

Status:

Malicious

First seen:

2026-09-25 11:32:29 UTC

File Type:

Text (HTML)

AV detection:

4 of 36 (11.11%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=cmjmgszz3sg4zcvragutn436qz2jfb3kqt4u5t5m6lpznqpe3oca._file

Result

Malware family:

n/a

Score:

3/10

Tags:

execution

Link:

https://tria.ge/reports/260925-nnentavcng/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Executes a command shell one-liner

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/1312c34b39dc8dcc8ab101a936f37e867492876a84f94ecfacf2df96c1e4db84

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	SCRIPT_Downloader_Unknown_AVTECH_ConfigInject Create hunting rule
Author:	Marjoriefort
Description:	Config camera/routeur (format AVTECH) avec injection downloader : wget http:// + chmod 7 + sh dans un champ Password
Reference:	Veille glissante 2026-09-17_18 / grappe 8 configs

Rule name:	SCRIPT_Sample_Unique_1a75fef9 Create hunting rule
Author:	Marjoriefort
Description:	Specimen unique (soumission Bazaar) - strings distinctifs propres au sample
Reference:	1a75fef91a93f610bd25b0587def046962456499845d188d0207976dd732492f.sh