MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 65665c3faba4fbfed12488e945306b10131afb9d3ad928accdcef75e0945a086. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	65665c3faba4fbfed12488e945306b10131afb9d3ad928accdcef75e0945a086
SHA3-384 hash:	d70ef25574fc5f8bab1d2a3ab8efbda1f9b659a5fcd10ebb5f252cb9cb863a0ae9320e6d7c580a4a09745b141e6f658e
SHA1 hash:	0660a175f9f155865489fd1b8cfd6d67c1bac4b7
MD5 hash:	349de8d66501b53a38beca5b331d98e5
humanhash:	jig-nevada-arizona-saturn
File name:	downx64.sh
Download:	download sample
File size:	779 bytes
First seen:	2025-09-11 06:54:20 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	24:s3CcMG4nYmNqz32v5MMG4nmtE5l75p7tadSRCTv5py:vBnYmNZNBnGED37tagCTv3y
TLSH	T12401D0777A644EF2627202905437658DEBF8015BAB75F982F070F4A2E0C33CB1026624
Magika	shell
Reporter	_O_l_i_v_e_r___
Tags:	BeaverTail ContagiousInterview sh

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

325

Origin country :

AU

Vendor Threat Intelligence

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/68c272c4c62f69962388885f/reports/c525eb45-49a7-44e9-addf-3e2f2fbe8dc7/overview

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

unix shell

First seen:

2025-09-11T18:48:00Z UTC

Last seen:

2025-09-11T18:48:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/65665c3faba4fbfed12488e945306b10131afb9d3ad928accdcef75e0945a086/results?tab=lookup

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/b09e61f1-7e6d-4d83-8120-7a6efb853454

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

23%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/65665c3faba4fbfed12488e945306b10131afb9d3ad928accdcef75e0945a086

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/65665c3faba4fbfed12488e945306b10131afb9d3ad928accdcef75e0945a086/

Neiki Clean

Verdict:

Clean

Link:

https://tip.neiki.dev/file/65665c3faba4fbfed12488e945306b10131afb9d3ad928accdcef75e0945a086

ReversingLabs TitaniumCloud Win32.Trojan.Vigorf

Threat name:

Win32.Trojan.Vigorf

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-09-11 06:58:49 UTC

File Type:

Text (Shell)

AV detection:

7 of 38 (18.42%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=mvtfyp5lut575ujerduukmdlcajrv645hlmsrlgnz33v4ckfucda._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

antivm defense_evasion discovery linux privilege_escalation

Link:

https://tria.ge/reports/250911-hp427shr2s/

Behaviour

Reads runtime system information

Checks CPU configuration

Abuse Elevation Control Mechanism: Sudo and Sudo Caching

Legitimate hosting services abused for malware hosting/C2

File and Directory Permissions Modification

Executes dropped EXE

VMRay Malicious

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/65665c3faba4/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.30

Link:

https://yomi.yoroi.company/submissions/65665c3faba4fbfed12488e945306b10131afb9d3ad928accdcef75e0945a086