MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1ca7c62f2d8fff65d398d1af105c2563de4b401ed4a3bc7b4a05ed04d0fa89df. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	1ca7c62f2d8fff65d398d1af105c2563de4b401ed4a3bc7b4a05ed04d0fa89df
SHA3-384 hash:	a64448a5dcee27ec7b497115d59528efbbcc5267e4f7d62568fd07f1be0a23f9205996b4e3ee88a75194f9b9c37f7481
SHA1 hash:	4ab49c7b4a8265d68591f1c6f4220e25b5bf9942
MD5 hash:	6c4b85693a73f7a71bac739621ec288f
humanhash:	jig-enemy-lithium-ten
File name:	dl20
Download:	download sample
File size:	5'050 bytes
First seen:	2025-04-30 09:06:29 UTC
Last seen:	2025-05-01 08:20:34 UTC
File type:	sh
MIME type:	text/plain
ssdeep	96:nMLi08TqWW2dHi8T+yeAN+86fYfGByR3huXs/JusxlKLwdJuQWOak2e28oMREfYJ:3VD1B4+jBsiLKfu
TLSH	T128A1D3D903D209314502730F76E1BFA0DCB586B1AE734F96BDB0DEE99870968F920A5D
Magika	shell
Reporter	abuse_ch
Tags:	sh

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

103

Origin country :

DE

Vendor Threat Intelligence

CyberFortress Malicious

Verdict:

Malicious

Score:

93.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6812031fcc5fb3600cc52672linux22vpnfull_triage

Tags:

downloader packed agent

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/6811e83a218c4a98ade90524/reports/97f237b2-027a-4a12-9e93-0ebdd1035aa5/overview

Hybrid Analysis Linux/Downloader.p

Verdict:

Malicious

Labled as:

Linux/Downloader.p

Link:

https://www.hybrid-analysis.com/sample/1ca7c62f2d8fff65d398d1af105c2563de4b401ed4a3bc7b4a05ed04d0fa89df

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/1ca7c62f2d8fff65d398d1af105c2563de4b401ed4a3bc7b4a05ed04d0fa89df

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/1ca7c62f2d8fff65d398d1af105c2563de4b401ed4a3bc7b4a05ed04d0fa89df/

ReversingLabs TitaniumCloud Linux.Trojan.Generic

Threat name:

Linux.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2025-04-30 10:26:05 UTC

File Type:

Text (Shell)

AV detection:

6 of 24 (25.00%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=dst4mlznr77wlu4y2gxraxbfmppewqa62sr3y62kaxwqjuh2rhpq._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

n/a

Link:

https://tria.ge/reports/250430-mgj5aahl2z/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/1ca7c62f2d8fff65d398d1af105c2563de4b401ed4a3bc7b4a05ed04d0fa89df