MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 24230996a8769954a4ffaf5295762ac7c64f7bf2ada71e0eaeb16f59e7eafeb8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	24230996a8769954a4ffaf5295762ac7c64f7bf2ada71e0eaeb16f59e7eafeb8
SHA3-384 hash:	efeca83395c85357673199982d11e807f76a289c2077624d77c55e605846f53066b09874a15670bee6807897deb1ad5e
SHA1 hash:	95f5194b49010e6e619de206ffa9d6ab75b8c31d
MD5 hash:	f59a95615f9aef4d181ee83165879382
humanhash:	minnesota-oscar-bravo-illinois
File name:	check3.sh
Download:	download sample
Signature	CoinMiner Alert Create hunting rule
File size:	885 bytes
First seen:	2026-09-05 11:32:39 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	24:lmGWlvsgtVvJXvvWu0zYlW4FoWu+qmzYlW4FBJ:0GUvVZdv+94F6a94FBJ
TLSH	T17A114CCC7711233A16D1CF5AFF5690A59A46DEF211E85467F2052C68609104C3937FA8
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	CoinMiner sh

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

57

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

downloader

Link:

https://www.filescan.io/uploads/6a9bfe01925c0d2db2371832/reports/1f91cabf-a031-404d-aa72-019214343dbe/overview

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-08-28T00:39:00Z UTC

Last seen:

2026-09-04T21:19:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/24230996a8769954a4ffaf5295762ac7c64f7bf2ada71e0eaeb16f59e7eafeb8/results?tab=lookup

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/7ed74146-6160-4a17-a28d-6a27bb88f875

Behavior Graph:

Download SVG

Nucleon Malprob Susipicious

Score:

52%

Verdict:

Susipicious

File Type:

SCRIPT

Link:

https://malprob.io/report/24230996a8769954a4ffaf5295762ac7c64f7bf2ada71e0eaeb16f59e7eafeb8

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/24230996a8769954a4ffaf5295762ac7c64f7bf2ada71e0eaeb16f59e7eafeb8/

ReversingLabs TitaniumCloud Script-BAT.Downloader.Heuristic

Threat name:

Script-BAT.Downloader.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-08-28 04:22:17 UTC

File Type:

Text (Shell)

AV detection:

4 of 36 (11.11%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=eqrqtfvio2mvjjh7v5jjk5rky7de667svwtr4dvowfxvtz7k724a._file

Hatching Triage xmrig

Result

Malware family:

xmrig

Alert

Create hunting rule

Score:

  10/10

Tags:

family:xmrig antivm defense_evasion discovery linux miner

Link:

https://tria.ge/reports/260905-nn2tcazyfw/

Behaviour

Enumerates kernel/hardware configuration

Reads runtime system information

Writes file to tmp directory

Changes its process name

Checks CPU configuration

Reads CPU attributes

Checks hardware identifiers (DMI)

Enumerates running processes

Reads hardware information

File and Directory Permissions Modification

Executes dropped EXE

Family: xmrig

XMRig Miner payload

VMRay XMRig

Malware family:

XMRig

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/24230996a876/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.