MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4b13bb42ca047939568da28acdbd8f59284528c6c72c8b48b0b347fe93bc8c40. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	4b13bb42ca047939568da28acdbd8f59284528c6c72c8b48b0b347fe93bc8c40
SHA3-384 hash:	0682cf2fd333434e4a36ed3e11d3ae293635394240a8731d60593461a1bbca0a2153d8896310dc49f1509358e3c0010e
SHA1 hash:	18805fde008abbef7b25158949f52217426828b4
MD5 hash:	a3a87bdb04b0b53556e8a1f5ed808df9
humanhash:	dakota-golf-papa-happy
File name:	dvr.sh
Download:	download sample
Signature	Gafgyt Alert Create hunting rule
File size:	1'838 bytes
First seen:	2025-06-14 14:50:11 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	24:vG+ugMtwqqeNI7JksosoiaVs6QLTgLXGLIjxq+K0:v1LVqqnJJ9oir6QLTu2Lkq+B
TLSH	T1A93165CA326209762DE5ED3775EB89143490E1CA60CA6F166CDD3CF8A4CEF083461697
Magika	shell
Reporter	abuse_ch
Tags:	gafgyt sh

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

39

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

94.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=684d8d018bd5d68a12e8a08blinux22vpnfull_triage

Tags:

agent overt remo

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/74bd6dd5-8baf-4f1f-86c5-db66d239ee99

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/4b13bb42ca047939568da28acdbd8f59284528c6c72c8b48b0b347fe93bc8c40

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/4b13bb42ca047939568da28acdbd8f59284528c6c72c8b48b0b347fe93bc8c40/

ReversingLabs TitaniumCloud Linux.Downloader.Morila

Threat name:

Linux.Downloader.Morila

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-06-13 22:40:24 UTC

File Type:

Text (Shell)

AV detection:

22 of 37 (59.46%)

Threat level:

  3/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=jmj3wqwkar4tsvunukfm3pmpleuekkggy4wiwsfqwnd75e54rraa._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  9/10

Tags:

credential_access defense_evasion discovery linux

Link:

https://tria.ge/reports/250614-sba73sgm8w/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Changes its process name

Reads system network configuration

Reads process memory

Creates a large amount of network flows

Enumerates running processes

Reads system routing table

File and Directory Permissions Modification

Executes dropped EXE

Contacts a large (4753) amount of remote hosts

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.31

Link:

https://yomi.yoroi.company/submissions/4b13bb42ca047939568da28acdbd8f59284528c6c72c8b48b0b347fe93bc8c40