MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1f6d442e4dad4f7525b82d012f0b13efafb4cf4ffe5b39191b7420d9a4cb90b4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1f6d442e4dad4f7525b82d012f0b13efafb4cf4ffe5b39191b7420d9a4cb90b4
SHA3-384 hash: 0ce1f6b126a8c8378a7aaf902b8814db0cfa9c5a99bc2ae0489c4ddf138da54ca30fb79e7ff065e04fa5a637c086d0c7
SHA1 hash: 4e80db00c8ff095b22c40253d2050b207cbf94f6
MD5 hash: e208292b7a24683d7f8f34361f5efda9
humanhash: seven-jersey-california-texas
File name:o.xml
Download: download sample
File size:734 bytes
First seen:2025-09-17 09:57:50 UTC
Last seen:Never
File type: sh
MIME type:text/plain
ssdeep 12:FH8ioNJAC7ukxGWi2jU30+0K5+A+GSjRQ2GDCn2GDoBjZhG+E6:FH8j/wWi2jzCmTT2lf
TLSH T19901D67DA1A8CA5209B9C5C7F2F15506C441909BA2AA57E5F38D0926AF38CDE385320D
Magika xml
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://193.32.162.27/00101010101001/morte.x86n/an/aelf ua-wget

Intelligence

File Origin
# of uploads :
1
# of downloads :
41
Origin country :
DE DE
Vendor Threat Intelligence
Verdict:
Malicious
Labled as:
TrojanDownloader/Linux.NetLoader
Link:
https://www.hybrid-analysis.com/sample/1f6d442e4dad4f7525b82d012f0b13efafb4cf4ffe5b39191b7420d9a4cb90b4
Verdict:
Clean
File Type:
text
Link:
https://opentip.kaspersky.com/1f6d442e4dad4f7525b82d012f0b13efafb4cf4ffe5b39191b7420d9a4cb90b4/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/8899c97f-f386-44b2-915b-824fae7ba4e5
Behavior Graph:
Download SVG
%3 guuid=f0d1187e-1600-0000-2b61-d449650c0000 pid=3173 /usr/bin/sudo guuid=698cfb7f-1600-0000-2b61-d4496a0c0000 pid=3178 /tmp/sample.bin guuid=f0d1187e-1600-0000-2b61-d449650c0000 pid=3173->guuid=698cfb7f-1600-0000-2b61-d4496a0c0000 pid=3178 execve guuid=9dbf3680-1600-0000-2b61-d4496b0c0000 pid=3179 /usr/bin/dash guuid=698cfb7f-1600-0000-2b61-d4496a0c0000 pid=3178->guuid=9dbf3680-1600-0000-2b61-d4496b0c0000 pid=3179 clone guuid=32093e80-1600-0000-2b61-d4496d0c0000 pid=3181 /usr/bin/dash guuid=698cfb7f-1600-0000-2b61-d4496a0c0000 pid=3178->guuid=32093e80-1600-0000-2b61-d4496d0c0000 pid=3181 clone guuid=dbe24a80-1600-0000-2b61-d4496e0c0000 pid=3182 /usr/bin/curl net guuid=698cfb7f-1600-0000-2b61-d4496a0c0000 pid=3178->guuid=dbe24a80-1600-0000-2b61-d4496e0c0000 pid=3182 execve e8c0f2c6-b2f6-5d2b-9651-534672427148 193.32.162.27:80 guuid=dbe24a80-1600-0000-2b61-d4496e0c0000 pid=3182->e8c0f2c6-b2f6-5d2b-9651-534672427148 con
Score:
0%
Verdict:
Benign
File Type:
SCRIPT
Link:
https://malprob.io/report/1f6d442e4dad4f7525b82d012f0b13efafb4cf4ffe5b39191b7420d9a4cb90b4
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1f6d442e4dad4f7525b82d012f0b13efafb4cf4ffe5b39191b7420d9a4cb90b4/
Verdict:
Malicious
Threat:
Script-JS.Downloader.Heuristic
Link:
https://tip.neiki.dev/file/1f6d442e4dad4f7525b82d012f0b13efafb4cf4ffe5b39191b7420d9a4cb90b4
Threat name:
Script-JS.Trojan.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2025-09-17 10:22:33 UTC
File Type:
Text
AV detection:
7 of 38 (18.42%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=d5wuilsnvvhxkjnyfuas6cyt56x3jt2p7zntsgi3oqqntjglsc2a._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/250917-nyr2wsdj3v/
Behaviour
Modifies registry class
Suspicious use of SetWindowsHookEx
Enumerates physical storage devices
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/1f6d442e4dad4f7525b82d012f0b13efafb4cf4ffe5b39191b7420d9a4cb90b4

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 1f6d442e4dad4f7525b82d012f0b13efafb4cf4ffe5b39191b7420d9a4cb90b4

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3614581/
  
Delivery method
Distributed via web download

Comments