MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 69dd6cc4fbc3d6f9abeaf54f07b2bb7f34963bac59b58343dfa34a4ab9092e18. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	69dd6cc4fbc3d6f9abeaf54f07b2bb7f34963bac59b58343dfa34a4ab9092e18
SHA3-384 hash:	f39776cc6b758c187ed89ab203ebe498609aa5d0657b2c2c30b55b481f3e484a6382fae7e2901ef2490e992a65426469
SHA1 hash:	66e2864240e4680796d7dcc4f6acecba8d363300
MD5 hash:	11cba098f9e140f02a5d0d537a62f49c
humanhash:	asparagus-mike-bluebird-wyoming
File name:	rondo.uzz.sh
Download:	download sample
Signature	RondoDox Alert Create hunting rule
File size:	8'441 bytes
First seen:	2025-11-28 06:07:22 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	96:xiRoLngDuyPIkcyPWtyPLCyPB2wsyPNQyPotyPi7byPNzKUKyPuRyPacBgpyPbK5:xgoLngJQ8pFbVzvtTpBgMNAe5tpq
TLSH	T15002288958C00BF260DD450772C3D67CBC49C2FE6573AEBEE8A548BEE570954B0AE784
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	RondoDox sh

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

36

Origin country :

DE

Vendor Threat Intelligence

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

busybox masquerade

Link:

https://www.filescan.io/uploads/69293c4d2cd29ea63002b366/reports/bcc7efb3-ca0a-4e53-b4c7-c102287ecc3e/overview

InQuest

Result

Gathering data

Kunai Sandbox

Status:

Failed

Link:

https://sandbox.kunai.rocks/analysis/0a296375-b595-404b-9dc0-b945f97d4307

Nucleon Malprob Malware

Score:

99%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/69dd6cc4fbc3d6f9abeaf54f07b2bb7f34963bac59b58343dfa34a4ab9092e18

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/69dd6cc4fbc3d6f9abeaf54f07b2bb7f34963bac59b58343dfa34a4ab9092e18/

ReversingLabs TitaniumCloud

Gathering data

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=nhowzrh3yplptk7k6vhqpmv3p42jmo5mlg2ygq67unfevoijfyma._file

Hatching Triage rondodox

Result

Malware family:

rondodox

Alert

Create hunting rule

Score:

  10/10

Tags:

family:rondodox botnet defense_evasion discovery linux persistence

Link:

https://tria.ge/reports/251128-gvyxpsak6w/

Behaviour

Enumerates kernel/hardware configuration

Reads runtime system information

Writes file to shm directory

Writes file to tmp directory

Reads CPU attributes

Deletes log files

Disables AppArmor

Disables SELinux

Enumerates running processes

Write file to user bin folder

Writes file to system bin folder

File and Directory Permissions Modification

Detects RondoDox Payload

RondoDox

Rondodox family

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.29

Link:

https://yomi.yoroi.company/submissions/69dd6cc4fbc3d6f9abeaf54f07b2bb7f34963bac59b58343dfa34a4ab9092e18