MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2ba275117bb860256cc4b739a6ad30bf972204452736dc6a182a30c5884f62e1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	2ba275117bb860256cc4b739a6ad30bf972204452736dc6a182a30c5884f62e1
SHA3-384 hash:	047b082f722193d64d598eb2f3a2c941d88c2eeb54885756f3c1b33e00379603219512681d9805a0d18519dabab351ea
SHA1 hash:	c2b1291d1edca877160ddbfc4d08a3e18b8f4e30
MD5 hash:	41d8ef9c51eb3291cfd37212a2c51f48
humanhash:	johnny-ohio-georgia-march
File name:	scan.sh
Download:	download sample
File size:	503 bytes
First seen:	2025-05-29 17:46:36 UTC
Last seen:	2025-05-30 09:20:56 UTC
File type:	sh
MIME type:	text/x-shellscript
ssdeep	12:p79T+gIavbQ/piOKMvzO00YAH+KN7RcLHWrexy0oo7Ch:pVrIavbk/rvzt8Hxla2rhVh
TLSH	T15CF059916B35F4750E0B43348A6617002BAC358029CCB2181AEE068AEAC1D0F61FDC33
Magika	shell
Reporter	abuse_ch
Tags:	sh

Intelligence

---

File Origin

# of uploads :

3

# of downloads :

74

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

Sanesecurity.Malware.31996.LX.Sh.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Clean

Verdict:

Clean

Score:

89.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68389e33acf88f5815e88d2alinux22vpnfull_triage

Tags:

n/a

Nucleon Malprob Benign

Score:

0%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/2ba275117bb860256cc4b739a6ad30bf972204452736dc6a182a30c5884f62e1

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2ba275117bb860256cc4b739a6ad30bf972204452736dc6a182a30c5884f62e1/

ReversingLabs TitaniumCloud Script.Trojan.Multiverze

Threat name:

Script.Trojan.Multiverze

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-05-29 17:47:22 UTC

File Type:

Text (Shell)

AV detection:

6 of 24 (25.00%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=forhkel3xbqck3gew442nljqx6lsebcfe43ny2qyfiymlccpmlqq._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

antivm credential_access defense_evasion discovery execution linux persistence privilege_escalation

Link:

https://tria.ge/reports/250529-wc12nsgq9w/

Behaviour

Software Deployment Tools

Enumerates kernel/hardware configuration

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Changes its process name

Checks CPU configuration

Deletes log files

Modifies systemd

Write file to user bin folder

File and Directory Permissions Modification

OS Credential Dumping

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/2ba275117bb860256cc4b739a6ad30bf972204452736dc6a182a30c5884f62e1