MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 339fde809edb16ff5050cc02d1f1b137735c33fefbd0764e7261d3d04e953812. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry



Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments

SHA256 hash: 339fde809edb16ff5050cc02d1f1b137735c33fefbd0764e7261d3d04e953812
SHA3-384 hash: 6ca9b1db77402419a4902eec874fc31d44e761ce8f4c7f99cc8f40dfe892194712aeab9c1fc067aa2e15090330deb934
SHA1 hash: 80d8befb0a04661d452a4a18a9d1874e3c30e6ae
MD5 hash: 66af8e6d3be14188d52558bafaff8643
humanhash: hot-item-washington-triple
File name:339fde809edb16ff5050cc02d1f1b137735c33fefbd0764e7261d3d04e953812.sh
Download: download sample
File size:7'508 bytes
First seen:2026-02-22 13:19:14 UTC
Last seen:Never
File type: sh
MIME type:text/plain
ssdeep 96:cCusB6n7sht+O+v1fsn+h4+tIicqbA/GsGqZ4BPOHF:cCuI6nC4hvZ5mzjHOy
TLSH T199F1D16B21F08B71D3D421C9526655A54E71A70B992A08B8F4BF973ADF2C90370E3F34
Magika xml
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://196.189.96.138:81/hiddenbin/dvr1.shn/an/an/a
http://ftp.gmail.3-a.net/httpd2n/an/an/a

Intelligence


File Origin
# of uploads :
1
# of downloads :
5
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
busybox evasive
Result
Gathering data
Status:
terminated
Behavior Graph:
%3 guuid=57d72901-2000-0000-24a2-9771bc090000 pid=2492 /usr/bin/sudo guuid=2703f203-2000-0000-24a2-9771bd090000 pid=2493 /tmp/sample.bin guuid=57d72901-2000-0000-24a2-9771bc090000 pid=2492->guuid=2703f203-2000-0000-24a2-9771bd090000 pid=2493 execve
Gathering data
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Behaviour
Modifies registry class
Suspicious use of SetWindowsHookEx
Enumerates physical storage devices
Please note that we are no longer able to provide a coverage score for Virus Total.

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 339fde809edb16ff5050cc02d1f1b137735c33fefbd0764e7261d3d04e953812

(this sample)

  
Delivery method
Distributed via web download

Comments