MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3d978a5821874527977413356fea630e59578b5c3f1dd13f122cbbaea3e10ab2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	3d978a5821874527977413356fea630e59578b5c3f1dd13f122cbbaea3e10ab2
SHA3-384 hash:	ffddd3274afbd88f4948a7a450904f6868641f66432f092cd92bb47e1ab59357cc3919b0a2c13b0f3ff39557932a4f65
SHA1 hash:	8e2a648cbd64a592daf5c5304147dd1ae62bcfd4
MD5 hash:	3d55f1ed8e3a0bc110b67efd081de6f0
humanhash:	romeo-crazy-beryllium-speaker
File name:	create.py
Download:	download sample
File size:	5'260 bytes
First seen:	2024-12-05 15:11:14 UTC
Last seen:	2024-12-05 21:55:39 UTC
File type:
MIME type:	text/plain
ssdeep	96:1u6d+u8Uf05OaycMSVG90Uu/b1D0VCyWgsebWa03BhB/hbgZP:BazP1D0VCydsebXEgZP
TLSH	T11DB13CAABA220BB60C71EF19F131C8197042E6C724528F1938FD70BCFDBDE54A5143A6
Magika	txt
Reporter	abuse_ch
Tags:	py

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

72

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Clean

Verdict:

Clean

Score:

84.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6751c2c3bc8c6beb3075fba3linux22vpnfull_triage

Tags:

malware

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

anti-debug expand lolbin remote

Link:

https://www.filescan.io/uploads/6751c2c9852affe966518c2e/reports/6636b479-6510-4fd3-bbbc-4a99133fb965/overview

Hybrid Analysis TrojanDownloader/Linux.Agent

Verdict:

Malicious

Labled as:

TrojanDownloader/Linux.Agent

Link:

https://www.hybrid-analysis.com/sample/3d978a5821874527977413356fea630e59578b5c3f1dd13f122cbbaea3e10ab2

Nucleon Malprob Benign

Score:

0%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/3d978a5821874527977413356fea630e59578b5c3f1dd13f122cbbaea3e10ab2

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/3d978a5821874527977413356fea630e59578b5c3f1dd13f122cbbaea3e10ab2/

ReversingLabs TitaniumCloud Win32.Trojan.Generic

Threat name:

Win32.Trojan.Generic

Alert

Create hunting rule

Status:

Malicious

First seen:

2024-12-05 15:12:09 UTC

File Type:

Text (Shell)

AV detection:

9 of 38 (23.68%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=hwlyuwbbq5cspf3ucm2w72tdbzmvpc24h4o5cpysfs525i7bbkza._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

discovery

Link:

https://tria.ge/reports/241205-sk6ekszlfv/

Behaviour

Modifies registry class

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/3d978a5821874527977413356fea630e59578b5c3f1dd13f122cbbaea3e10ab2