MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 571841fb078412dc07a0ad7bde0f7455c8d9291ee7b530b93fa5ff2d372492f0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	571841fb078412dc07a0ad7bde0f7455c8d9291ee7b530b93fa5ff2d372492f0
SHA3-384 hash:	25328cd92309217a34f7bfbca8112a7afcd06e09428f06ce5f3c9764feac315da215a7ee4df83b58d134658cef411774
SHA1 hash:	f891c1a03a92ed617f54b49d9ed75d1868a05c2e
MD5 hash:	ea428b68ad4862ab8ca2834fba04dafb
humanhash:	red-maine-yellow-echo
File name:	run-CN.sh
Download:	download sample
Signature	CoinMiner Alert Create hunting rule
File size:	7'427 bytes
First seen:	2025-09-05 14:31:04 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	192:F8XyzHWZzzDN19xDkIjkm3qadayHDPMeYqf4Mvlu:MzvLzgUbjna+u
TLSH	T157E1C806F6D09AB42588C568418A1880694F922B6D492C04F8FDF569BF3476CB1FDBEB
Magika	shell
Reporter	abuse_ch
Tags:	CoinMiner sh

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

34

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

Txt.Malware.Sustes-6779550-1

Alert

Create hunting rule

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

unix shell

First seen:

2025-09-05T16:17:00Z UTC

Last seen:

2025-09-05T16:17:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/571841fb078412dc07a0ad7bde0f7455c8d9291ee7b530b93fa5ff2d372492f0/results?tab=lookup

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/9ac7a1aa-3fef-42c3-866b-71a6d5fb0366

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

1%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/571841fb078412dc07a0ad7bde0f7455c8d9291ee7b530b93fa5ff2d372492f0

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/571841fb078412dc07a0ad7bde0f7455c8d9291ee7b530b93fa5ff2d372492f0/

ReversingLabs TitaniumCloud Script-PowerShell.Trojan.Heuristic

Threat name:

Script-PowerShell.Trojan.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-09-05 16:00:37 UTC

File Type:

Text (Shell)

AV detection:

8 of 24 (33.33%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=k4med6yhqqjnyb5avv554d3ukxenski6462tboj7ux7s2nzeslya._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  6/10

Tags:

discovery linux

Link:

https://tria.ge/reports/250905-sq37eacr8w/

Behaviour

Enumerates kernel/hardware configuration

Reads runtime system information

System Network Configuration Discovery

Reads CPU attributes

Enumerates running processes

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/571841fb078412dc07a0ad7bde0f7455c8d9291ee7b530b93fa5ff2d372492f0