MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1cfed5e3963fd22823a63fe44ba533a014dff9528b44c9c2b620c81963d595ce. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	1cfed5e3963fd22823a63fe44ba533a014dff9528b44c9c2b620c81963d595ce
SHA3-384 hash:	e7af6b5370e8556f65307e4d27733c79482cbb4545bfba4855c54f6a7ed0ab654e3c81f33db27b491e1c002c95fcb60e
SHA1 hash:	3232310db72ddc733ffa825bfec96025b930ab49
MD5 hash:	42566c3c0ed2ead8e191f6dbffebeca1
humanhash:	may-cat-one-oxygen
File name:	rondo.dcn.sh
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	13'784 bytes
First seen:	2025-08-13 07:37:23 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	192:DUIzkLhZoC1NSNigJQKlTjPXzR1lBgMPhVVn2eB/HQ:DWX
TLSH	T12C52588914D006F391DD494BB3C3DAAC6C49A1FFB0A3BEB9E864A8BFD530944B46D744
Magika	shell
Reporter	smica83
Tags:	74-194-191-52 HUN sh

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

47

Origin country :

HU

Vendor Threat Intelligence

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/a6109f4b-0def-4454-b1c6-d93c1a8484ce

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

99%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/1cfed5e3963fd22823a63fe44ba533a014dff9528b44c9c2b620c81963d595ce

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/1cfed5e3963fd22823a63fe44ba533a014dff9528b44c9c2b620c81963d595ce/

Neiki Susipicious

Verdict:

Susipicious

Link:

https://tip.neiki.dev/file/1cfed5e3963fd22823a63fe44ba533a014dff9528b44c9c2b620c81963d595ce

ReversingLabs TitaniumCloud Script.Trojan.Multiverze

Threat name:

Script.Trojan.Multiverze

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-08-11 15:08:15 UTC

File Type:

Text (Shell)

AV detection:

6 of 24 (25.00%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=dt7nly4wh7jcqi5gh7sexjjtuakn76ksrncmtqvwedebsy6vsxha._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

antivm defense_evasion discovery linux persistence

Link:

https://tria.ge/reports/250813-jgfv3shm4w/

Behaviour

Enumerates kernel/hardware configuration

Reads runtime system information

System Network Configuration Discovery

Writes file to shm directory

Writes file to tmp directory

Checks CPU configuration

Reads CPU attributes

Deletes log files

Disables AppArmor

Disables SELinux

Enumerates running processes

Write file to user bin folder

Writes file to system bin folder

File and Directory Permissions Modification

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.29

Link:

https://yomi.yoroi.company/submissions/1cfed5e3963fd22823a63fe44ba533a014dff9528b44c9c2b620c81963d595ce