MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4c49d9a071d792b855229c86fbeea02764eafcd05f7f8a6b967425290be7e19a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	4c49d9a071d792b855229c86fbeea02764eafcd05f7f8a6b967425290be7e19a
SHA3-384 hash:	0e44088d95d4e19483090971be025f45215ccbc2968d2199751d4b4092d6970370c9d7cd92dc07930e7dc2fd17d9d5d3
SHA1 hash:	f0fb7c86a40d91b74aa301c01650915d82f135ce
MD5 hash:	62a8a46e6dbf09618b53c0d640a76795
humanhash:	virginia-zulu-india-lima
File name:	scan.sh
Download:	download sample
File size:	503 bytes
First seen:	2025-03-01 10:32:04 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	12:p79T+tUavbQ/piOKMvzO00YAH+KN7RcLHWrexy0oo7Ch:pVlavbk/rvzt8Hxla2rhVh
TLSH	T1D8F095916735E0750E0B4334C66657002B6D314019CCF2181ADE0689D6C1D0F61FDC37
Magika	shell
Reporter	abuse_ch
Tags:	sh

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

72

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.BV.Scanner-AQ.5944.24385.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Unknown

Verdict:

Suspicious

Score:

50%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67c2e32b4e50050b2e6f477dlinux22vpnfull_triage

Tags:

agent hype sage

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/67c2e2304a3011c802c4b296/reports/001e65af-202e-4858-9850-b88100741b23/overview

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Nucleon Malprob Benign

Score:

0%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/4c49d9a071d792b855229c86fbeea02764eafcd05f7f8a6b967425290be7e19a

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/4c49d9a071d792b855229c86fbeea02764eafcd05f7f8a6b967425290be7e19a/

ReversingLabs TitaniumCloud Script.Network.Scanner

Threat name:

Script.Network.Scanner

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-03-01 10:32:16 UTC

File Type:

Text (Shell)

AV detection:

5 of 24 (20.83%)

Threat level:

  3/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=jre5tidr26jlqvjctsdpx3vae5sov7gql57yu24woqsssc7h4gna._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

antivm credential_access defense_evasion discovery execution linux persistence privilege_escalation

Link:

https://tria.ge/reports/250301-mk3e2aytbx/

Behaviour

Software Deployment Tools

Enumerates kernel/hardware configuration

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Changes its process name

Checks CPU configuration

Deletes log files

Modifies systemd

Write file to user bin folder

File and Directory Permissions Modification

OS Credential Dumping

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/4c49d9a071d792b855229c86fbeea02764eafcd05f7f8a6b967425290be7e19a