MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6a19f4179be29d227f24bb076c8a9378aa191d0fa00374318caf1513f0af4448. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	6a19f4179be29d227f24bb076c8a9378aa191d0fa00374318caf1513f0af4448
SHA3-384 hash:	c002852a66820912c3ec1de167be6b5ae5af50ac599173f6e8b281b943eb3dcb1c6aa060b54c6c77e1a8563e0dac1801
SHA1 hash:	c6c08d6a8e2fca3ecc3a042636a27838f5c1e9a2
MD5 hash:	2ba2e76bea6f56769e277b760c9a6c9c
humanhash:	green-vegan-five-lamp
File name:	cr.sh
Download:	download sample
File size:	4'317 bytes
First seen:	2026-01-27 12:32:50 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	96:mhiSGbe3Up3jhvBzIX0bd0NNFGcrcBc3gjXuc2a:mhiSmeEpzpi0bONNFGzJuC
TLSH	T1449110BD7159D9B1694881F8136DDC4CEDAF0C1FBA52E40E330F96A43F1A76981F8254
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	sh

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

32

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

base64 bash evasive lolbin obfuscated pup

Link:

https://www.filescan.io/uploads/6978b097a57b6af70d0ea035/reports/fd664cab-4435-4a44-80a3-97222ba6dfee/overview

InQuest

Result

Gathering data

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

unix shell

First seen:

2025-12-24T10:45:00Z UTC

Last seen:

2025-12-25T12:28:00Z UTC

Hits:

~10

Detections:

Trojan-Dropper.Shell.Agent.d

Link:

https://opentip.kaspersky.com/6a19f4179be29d227f24bb076c8a9378aa191d0fa00374318caf1513f0af4448/results?tab=lookup

Kunai Sandbox

Status:

Failed

Link:

https://sandbox.kunai.rocks/analysis/1c243504-887d-4569-ab73-dad0ebdc4eca

Nucleon Malprob Susipicious

Score:

55%

Verdict:

Susipicious

File Type:

SCRIPT

Link:

https://malprob.io/report/6a19f4179be29d227f24bb076c8a9378aa191d0fa00374318caf1513f0af4448

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/6a19f4179be29d227f24bb076c8a9378aa191d0fa00374318caf1513f0af4448/

Neiki Trojan-Dropper.Shell.Agent

Verdict:

Malicious

Threat:

Trojan-Dropper.Shell.Agent

Link:

https://tip.neiki.dev/file/6a19f4179be29d227f24bb076c8a9378aa191d0fa00374318caf1513f0af4448

ReversingLabs TitaniumCloud Win32.Trojan.Vigorf

Threat name:

Win32.Trojan.Vigorf

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-12-24 12:56:17 UTC

File Type:

Text (Shell)

AV detection:

11 of 36 (30.56%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=nim7if434kose7zexmdwzcutpcvbshipuabximmmv4krh4fpirea._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  6/10

Tags:

defense_evasion discovery linux

Link:

https://tria.ge/reports/260127-pre97aew9a/

Behaviour

Reads runtime system information

Writes file to tmp directory

Reads CPU attributes

Disables SELinux

Enumerates running processes

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.34

Link:

https://yomi.yoroi.company/submissions/6a19f4179be29d227f24bb076c8a9378aa191d0fa00374318caf1513f0af4448