MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 38dc476cd15c13c312a086bd49c1ccac64ff68f208ed4a1b6d3bcb88fb450efa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	38dc476cd15c13c312a086bd49c1ccac64ff68f208ed4a1b6d3bcb88fb450efa
SHA3-384 hash:	aba79deae2370828f400b069b1d03abb81fddff028e2e66e35a79141c940ed660162e61875dfe77acffa838c67fa022c
SHA1 hash:	e0a152c2ff070019f01d82c61014d234e1cccd47
MD5 hash:	20cebdd418e69f8a4283aab807cf5e5d
humanhash:	montana-idaho-quebec-hotel
File name:	scan.sh
Download:	download sample
File size:	502 bytes
First seen:	2025-04-21 13:22:58 UTC
Last seen:	2025-04-22 06:06:16 UTC
File type:	sh
MIME type:	text/x-shellscript
ssdeep	12:p79T+8oVXnavbQ/piOKMvzO00YAH+KN7RcLHWrexy0oo7Ch:pVy9avbk/rvzt8Hxla2rhVh
TLSH	T198F09E916735E0750E4B4334CA6617002BAD318029CCF2181AEE068AEBC1D0F61FDC33
Magika	shell
Reporter	abuse_ch
Tags:	sh

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

75

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Linux.DownLoader.2357.8180.5101.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Unknown

Verdict:

Suspicious

Score:

50%

Link:

https://cyber-fortress.com/docs/result/index.php?id=680648382203b3e10cd23f5clinux22vpnfull_triage

Tags:

agent hype sage

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

expand lolbin

Link:

https://www.filescan.io/uploads/680646bd9d78794fed86df33/reports/e6887f73-ceb7-4df9-b9d0-2117d1e07b06/overview

Nucleon Malprob Benign

Score:

0%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/38dc476cd15c13c312a086bd49c1ccac64ff68f208ed4a1b6d3bcb88fb450efa

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/38dc476cd15c13c312a086bd49c1ccac64ff68f208ed4a1b6d3bcb88fb450efa/

ReversingLabs TitaniumCloud Script.Trojan.Malgent

Threat name:

Script.Trojan.Malgent

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-04-21 13:23:04 UTC

File Type:

Text (Shell)

AV detection:

8 of 38 (21.05%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=hdoeo3grlqj4gevaq26utqomvrsp62hsbdwuug3nhpfyr62fb35a._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

antivm credential_access defense_evasion discovery execution linux persistence privilege_escalation

Link:

https://tria.ge/reports/250421-qmvdzsyk19/

Behaviour

Software Deployment Tools

Enumerates kernel/hardware configuration

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Changes its process name

Checks CPU configuration

Deletes log files

Modifies systemd

Write file to user bin folder

File and Directory Permissions Modification

OS Credential Dumping

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/38dc476cd15c13c312a086bd49c1ccac64ff68f208ed4a1b6d3bcb88fb450efa