MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1ee5e7593dbbd4204c4f4dafffaaffa515a9bf9ce13316cf8703fa838c20d864. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	1ee5e7593dbbd4204c4f4dafffaaffa515a9bf9ce13316cf8703fa838c20d864
SHA3-384 hash:	be7fefb9fe1d9329a2d04d2b8848a98f8db04021bddce59b40513d8b7b31b8d573043cf4f749ee9e4d3595f365c3ec93
SHA1 hash:	8c6885ac00b2d7ce13a3ceb24484adc79c0b19c3
MD5 hash:	11ac2b8cdc8549373c8c49b8dc3d1124
humanhash:	earth-video-mountain-victor
File name:	scan.sh
Download:	download sample
File size:	505 bytes
First seen:	2025-05-02 10:36:43 UTC
Last seen:	2025-05-03 04:10:52 UTC
File type:	sh
MIME type:	text/x-shellscript
ssdeep	12:p79T+4avbQ/piOKMvzO00YAH+KN7RcLHWrexy0oo7Ch:pVbavbk/rvzt8Hxla2rhVh
TLSH	T13CF09E916735E4791E0B4334CA6627002BAC318029CCF2181BEE068AEAC1D0F61FDD33
Magika	shell
Reporter	abuse_ch
Tags:	sh

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

73

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Linux.DownLoader.2357.22399.17032.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Clean

Verdict:

Clean

Score:

89.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6814a2d44355f44aee685683linux22vpnfull_triage

Tags:

n/a

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/6814a053c7418694c8a4785e/reports/cde08d81-7bbb-4830-b1fd-6b06feb302ff/overview

Nucleon Malprob Benign

Score:

0%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/1ee5e7593dbbd4204c4f4dafffaaffa515a9bf9ce13316cf8703fa838c20d864

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/1ee5e7593dbbd4204c4f4dafffaaffa515a9bf9ce13316cf8703fa838c20d864/

ReversingLabs TitaniumCloud Linux.Network.Scanner

Threat name:

Linux.Network.Scanner

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-05-02 10:21:26 UTC

File Type:

Text (Shell)

AV detection:

5 of 24 (20.83%)

Threat level:

  3/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=d3s6owj5xpkcatcpjwx77kx7uuk2tp444ezrnt4hap5ihdba3bsa._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

antivm credential_access defense_evasion discovery execution linux persistence privilege_escalation

Link:

https://tria.ge/reports/250502-mnvvcsspy5/

Behaviour

Software Deployment Tools

Enumerates kernel/hardware configuration

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Changes its process name

Checks CPU configuration

Deletes log files

Modifies systemd

Write file to user bin folder

File and Directory Permissions Modification

OS Credential Dumping

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/1ee5e7593dbbd4204c4f4dafffaaffa515a9bf9ce13316cf8703fa838c20d864