MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6cc74857546bdaf04cc1e6341d0a942f2634236a6115df3b4494c004ebcd2831. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry



Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments

SHA256 hash: 6cc74857546bdaf04cc1e6341d0a942f2634236a6115df3b4494c004ebcd2831
SHA3-384 hash: b872787e0aca017961cbeff9aa703edf4e432fbb9da2baa108749460d49f39ab016f330e153e4e752e0f8cfc1fdeffa1
SHA1 hash: 40a733a4349dcb56d0192049ebe4babcdc6d2b09
MD5 hash: 40e512f5cb03a8dc68af9dda7ac95864
humanhash: october-whiskey-snake-comet
File name:6cc74857546bdaf04cc1e6341d0a942f2634236a6115df3b4494c004ebcd2831.sh
Download: download sample
File size:11'492 bytes
First seen:2026-02-22 13:18:44 UTC
Last seen:Never
File type: sh
MIME type:text/plain
ssdeep 96:cCu3k0B6VzYMPZo8zS+6+x+s6IBqHIBZIBcIBSIBrIB4IBNIBrIBFRDfBVZUdR1p:cCu0g6VjZYBe4Tm/9g/C4Q1o
TLSH T18132D67025F18D732E25AA80B3372BA69BB6D95345E3318C35DD2E265F87B12A0FF411
Magika xml
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://38.6.178.140/easy_pass.shn/an/an/a
http://204.76.203.3/wget.shn/an/an/a
http://38.6.178.140/easy.shn/an/an/a
http://38.6.178.140/easy_cloud.shn/an/an/a
http://38.6.178.140/sh/easy_av_wget.shn/an/an/a
http://154.9.25.250/rj.shn/an/aelf shellscript
http://103.145.106.96/bins/1.shn/an/abotnet iot mirai
http://124.33.173.242:880/ln/an/an/a
http://194.69.203.32:81/hiddenbin/raisecom.shn/an/ageofenced opendir sh ua-wget USA
http://194.69.203.32:81/hiddenbin/dvr1.shn/an/ageofenced opendir sh ua-wget USA

Intelligence


File Origin
# of uploads :
1
# of downloads :
5
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive mirai
Result
Gathering data
Status:
terminated
Behavior Graph:
%3 guuid=82930661-1a00-0000-4a23-c1766f0a0000 pid=2671 /usr/bin/sudo guuid=49d9a063-1a00-0000-4a23-c176760a0000 pid=2678 /tmp/sample.bin guuid=82930661-1a00-0000-4a23-c1766f0a0000 pid=2671->guuid=49d9a063-1a00-0000-4a23-c176760a0000 pid=2678 execve
Gathering data
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Behaviour
Modifies registry class
Suspicious use of SetWindowsHookEx
Enumerates physical storage devices
Please note that we are no longer able to provide a coverage score for Virus Total.

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 6cc74857546bdaf04cc1e6341d0a942f2634236a6115df3b4494c004ebcd2831

(this sample)

e5ff42390924eeb1b41e54b5d12a81211b4dbc6dfa16e157e7a83ceaa60ba0dd

  
Delivery method
Distributed via web download
  
Dropping
MD5 f506dabb2a77b76bc38cca0d2076087f
  
Dropping
SHA256 e5ff42390924eeb1b41e54b5d12a81211b4dbc6dfa16e157e7a83ceaa60ba0dd

Comments