MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 451b586ec9d3c997b319986a1177829653e8ae641c953c05ede6a38616f2da97. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 5

Intelligence 5 IOCs YARA 1 File information Comments

SHA256 hash:	451b586ec9d3c997b319986a1177829653e8ae641c953c05ede6a38616f2da97
SHA3-384 hash:	5d0db17ca7f541cddc6825999780bf2da8a0a76f703d4c0c71fe1ac1fd42b5cee72306784d491d9fccb58d8f40de8ce3
SHA1 hash:	d81081691c3631f3adc1a6db0ee22ab19682ef30
MD5 hash:	73adaea97f003735335505858c1c6def
humanhash:	connecticut-colorado-september-may
File name:	451b586ec9d3c997b319986a1177829653e8ae641c953c05ede6a38616f2da97
Download:	download sample
File size:	5'621 bytes
First seen:	2026-07-29 06:23:50 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	96:6Kpb4yyuDPDsTbCF+p83SWeklyjyCuVZf7kmgPFylxwARy2RZA:6KpbXyuDP8p87eay+Csx7kmgPFyj0UA
TLSH	T114C185E3F08457742259C51CAF8974044A9B053B48487E4CB96C72643FB8F25B279BFA
TrID	50.0% (.SH) Linux/UNIX shell script (7000/1) 28.5% (.PL) Perl script (4000/1/1) 21.4% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	JAMESWT_WT
Tags:	sh

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

SecuriteInfo.com.Other.Malware-gen.11983172.UNOFFICIAL

Verdict:

Malicious

File Type:

unix shell

Link:

https://opentip.kaspersky.com/451b586ec9d3c997b319986a1177829653e8ae641c953c05ede6a38616f2da97/results?tab=lookup

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/ac7d0c54-60b3-4286-bb20-80890241d259

Behavior Graph:

Download SVG

Score:

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/451b586ec9d3c997b319986a1177829653e8ae641c953c05ede6a38616f2da97

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/451b586ec9d3c997b319986a1177829653e8ae641c953c05ede6a38616f2da97/

Threat name:

Script-BAT.Trojan.Heuristic

Status:

Malicious

First seen:

2026-07-23 01:18:03 UTC

File Type:

Text (Shell)

AV detection:

9 of 24 (37.50%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=iunvq3wj2pezpmyztbvbc54cszj6rltedsktybpn42rymfxs3klq._file

Result

Malware family:

n/a

Score:

7/10

Tags:

antivm defense_evasion discovery execution linux persistence privilege_escalation

Link:

https://tria.ge/reports/260729-g6em7swgmd/

Behaviour

Command and Scripting Interpreter: JavaScript

Enumerates kernel/hardware configuration

Reads runtime system information

Writes file to tmp directory

Changes its process name

Checks CPU configuration

Reads CPU attributes

Checks hardware identifiers (DMI)

Contacts third-party web service commonly abused for C2

Enumerates running processes

Looks up external IP address via web service

Modifies systemd

Reads hardware information

Reads network interface configuration

File and Directory Permissions Modification

Executes dropped EXE

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

0.70

Link:

https://yomi.yoroi.company/submissions/451b586ec9d3c997b319986a1177829653e8ae641c953c05ede6a38616f2da97

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample