MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2aa196f2d543ab882180de79718cd78d8b515d4db1e6513786a0a94eec0e9c21. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	2aa196f2d543ab882180de79718cd78d8b515d4db1e6513786a0a94eec0e9c21
SHA3-384 hash:	6b241d83add2e5e083944ebad65c226713905793005a8e44caf27b9791c90d8a666d42dda0bcba9332913aac543c4261
SHA1 hash:	964490697c9bdf5a74fd79bd755af4a6f6892efb
MD5 hash:	00f55d130f4ed14e68880825153d1cfc
humanhash:	harry-october-xray-north
File name:	.shell
Download:	download sample
File size:	208 bytes
First seen:	2024-12-17 07:07:15 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	3:QnQzanFCKl2X4HMiqS+9SSqReSBSLM9Kd:lOnFflHMfS+9SISkM9Kd
TLSH	T12ED0C9C9A06354F69BC0CEBD35E1B418605261959CD06B144CDCB8D0444CE0D204CA4A
Magika	shell
Reporter	abuse_ch
Tags:	sh

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

69

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Clean

Verdict:

Clean

Score:

70%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6761291e653a8698dfd88d25linux22vpnfull_triage

Tags:

shellcode mirai

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

busybox evasive

Link:

https://www.filescan.io/uploads/6761235ccdd82ec5291ab48e/reports/2f7acd0a-f62a-4b1f-8af3-16a9d27febf4/overview

Hybrid Analysis TrojanDownloader/Linux.Shell

Verdict:

Malicious

Labled as:

TrojanDownloader/Linux.Shell

Link:

https://www.hybrid-analysis.com/sample/2aa196f2d543ab882180de79718cd78d8b515d4db1e6513786a0a94eec0e9c21

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Nucleon Malprob Benign

Score:

9%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/2aa196f2d543ab882180de79718cd78d8b515d4db1e6513786a0a94eec0e9c21

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2aa196f2d543ab882180de79718cd78d8b515d4db1e6513786a0a94eec0e9c21/

ReversingLabs TitaniumCloud Script.Downloader.Heuristic

Threat name:

Script.Downloader.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2024-12-10 06:17:47 UTC

File Type:

Text (Shell)

AV detection:

3 of 24 (12.50%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=fkqzn4wviovyqima3z4xddgxrwfvcxknwhtfcn4gucuu53aotqqq._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

discovery

Link:

https://tria.ge/reports/241217-jam1tatpgt/

Behaviour

Modifies registry class

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/2aa196f2d543ab882180de79718cd78d8b515d4db1e6513786a0a94eec0e9c21