MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2247ca9f614f5b7ac88581ad262d66b2feebc167d23d0f01b86393205a6d0fcf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	2247ca9f614f5b7ac88581ad262d66b2feebc167d23d0f01b86393205a6d0fcf
SHA3-384 hash:	0245ae0bcec119372621b624f9bfce64610ae0e7cbfd2208465235a2763fced818c922bfb673e865f00b1fe5d7319f57
SHA1 hash:	ea13a2fba2af765f1a7e027e56b35d0f8c115cb4
MD5 hash:	606b448425e79369ea7503156b030a95
humanhash:	enemy-sad-gee-november
File name:	scan.sh
Download:	download sample
File size:	506 bytes
First seen:	2024-11-03 12:56:10 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	12:p79T+7rAavbQ/piOKMvzO00YAH+KN7RcLHWrexy0oo7Ch:pVCUavbk/rvzt8Hxla2rhVh
TLSH	T1E8F059A16735A4754E0B4334CA6656403BAC3680298CF2181AEE068AEAC1D0F65FDD33
Magika	shell
Reporter	abuse_ch
Tags:	sh

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

78

Origin country :

DE

Vendor Threat Intelligence

CyberFortress Malicious

Verdict:

Malicious

Score:

70%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67277a688d23d90491331d37linux22vpnfull_triage

Tags:

agent hype sage

FileScan.IO Unknown

Verdict:

Unknown

Threat level:

  2.5/10

Confidence:

100%

Tags:

expand lolbin masquerade

Link:

https://www.filescan.io/uploads/6727731ef34fcc4d75993da2/reports/d4aa8074-b245-49fe-84f2-f906a021cb44/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/2247ca9f614f5b7ac88581ad262d66b2feebc167d23d0f01b86393205a6d0fcf

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Nucleon Malprob Benign

Score:

0%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/2247ca9f614f5b7ac88581ad262d66b2feebc167d23d0f01b86393205a6d0fcf

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2247ca9f614f5b7ac88581ad262d66b2feebc167d23d0f01b86393205a6d0fcf/

ReversingLabs TitaniumCloud Linux.Trojan.SAgnt

Threat name:

Linux.Trojan.SAgnt

Alert

Create hunting rule

Status:

Malicious

First seen:

2024-11-03 13:02:56 UTC

File Type:

Text (Shell)

AV detection:

1 of 24 (4.17%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ejd4vh3bj5nxvsefqgwsmllgwl7oxqlh2i6q6anymojsawtnb7hq._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

antivm credential_access defense_evasion discovery execution linux persistence privilege_escalation

Link:

https://tria.ge/reports/241103-qqm43svfnd/

Behaviour

Software Deployment Tools

Enumerates kernel/hardware configuration

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Checks CPU configuration

Deletes log files

Modifies systemd

Write file to user bin folder

File and Directory Permissions Modification

OS Credential Dumping

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.39

Link:

https://yomi.yoroi.company/submissions/2247ca9f614f5b7ac88581ad262d66b2feebc167d23d0f01b86393205a6d0fcf