MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4400d31143b1d5a43a0af37d2ac7360f7cd5a0b8b8ff624774f62189069164b8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	4400d31143b1d5a43a0af37d2ac7360f7cd5a0b8b8ff624774f62189069164b8
SHA3-384 hash:	1e1670d50e84e6de9d450b1c4d1e57dca0a07a91f49fd0aaa070cb4fea6b1db52fc842783af486de4e909231934ffdb1
SHA1 hash:	497307d1bd25d9f443cbdfbcb46e5bcc2e2544c6
MD5 hash:	12b29d734c98966644231901531124b4
humanhash:	angel-jig-stairway-idaho
File name:	.shell
Download:	download sample
File size:	208 bytes
First seen:	2025-02-21 04:47:19 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	3:QnQzanFCKl2X4HMioLpJSTcZxHLpJSTcZNqRMLpJSTcZaSLM9Kd:lOnFflHMNLSTGxHLSTGFLSTGpM9Kd
TLSH	T12DD012CBD45115B2DCCC89F925E1F800A452A2BE9CC04A14CCD8FD905069F0CB05BE41
Magika	shell
Reporter	abuse_ch
Tags:	sh

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

79

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Clean

Verdict:

Clean

Score:

84.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67b82668a0fd713c335c25c3linux22vpnfull_triage

Tags:

n/a

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

busybox evasive

Link:

https://www.filescan.io/uploads/67b8058e578720f0acaad52c/reports/64615014-6c40-46cc-9426-bf2cfdcf6277/overview

Hybrid Analysis Linux/TrojanDownloader.SH

Verdict:

Malicious

Labled as:

Linux/TrojanDownloader.SH

Link:

https://www.hybrid-analysis.com/sample/4400d31143b1d5a43a0af37d2ac7360f7cd5a0b8b8ff624774f62189069164b8

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Nucleon Malprob Benign

Score:

10%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/4400d31143b1d5a43a0af37d2ac7360f7cd5a0b8b8ff624774f62189069164b8

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/4400d31143b1d5a43a0af37d2ac7360f7cd5a0b8b8ff624774f62189069164b8/

ReversingLabs TitaniumCloud Script.Trojan.Boxter

Threat name:

Script.Trojan.Boxter

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-02-21 07:05:23 UTC

File Type:

Text (Shell)

AV detection:

6 of 24 (25.00%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=iqangekdwhk2ioqk6n6svrzwb56nlifyxd7wer3u6yqysburms4a._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

discovery

Link:

https://tria.ge/reports/250221-hwmfqswncr/

Behaviour

Modifies registry class

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/4400d31143b1d5a43a0af37d2ac7360f7cd5a0b8b8ff624774f62189069164b8