MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 770182c8ac916900bf5e9728e8e1c5d03bf05a502adfb559dcdf5245ac88d23b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	770182c8ac916900bf5e9728e8e1c5d03bf05a502adfb559dcdf5245ac88d23b
SHA3-384 hash:	4feed2e6a7a3798be55e564e325f435cb24c9fa57974b0805ac1a3c936874265b34fb48c53976f325f99bcd8f7c2ecf4
SHA1 hash:	1804893047e12e7b71131a9350dcdf7633ccd7f9
MD5 hash:	6c3643fb0823ad9c15f53164fb719488
humanhash:	item-fanta-table-tango
File name:	mon.sh
Download:	download sample
Signature	CoinMiner Alert Create hunting rule
File size:	4'568 bytes
First seen:	2025-06-12 17:22:12 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	96:l06z0cic27rP7DTAiVjQR793jt0yjtgmu4IL1Sd6z0cd:l080c9irzDNjQ9935XvIL1Sd80cd
TLSH	T1B791764AF690CAF03C9DC5A8999B6485390601879D040D1EF82EF59D7F5479CB0F87AF
Magika	shell
Reporter	abuse_ch
Tags:	CoinMiner sh

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

163

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

Txt.Malware.Sustes-6779550-1

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=684b0d068bd5d68a12e841dblinux22vpnfull_triage

Tags:

cryptominer agent virus

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/2fc58276-8b3b-4aea-8533-c64da5fcc347

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

1%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/770182c8ac916900bf5e9728e8e1c5d03bf05a502adfb559dcdf5245ac88d23b

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/770182c8ac916900bf5e9728e8e1c5d03bf05a502adfb559dcdf5245ac88d23b/

ReversingLabs TitaniumCloud Linux.Downloader.SAgnt

Threat name:

Linux.Downloader.SAgnt

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-06-12 17:22:43 UTC

File Type:

Text (Shell)

AV detection:

8 of 38 (21.05%)

Threat level:

  3/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=o4ayfsfmsfuqbp26s4uoryof2a57awsqflp3kwo435jellei2i5q._file

Hatching Triage xmrig

Result

Malware family:

xmrig

Alert

Create hunting rule

Score:

  10/10

Tags:

family:xmrig antivm defense_evasion discovery execution linux miner persistence privilege_escalation rootkit upx

Link:

https://tria.ge/reports/250612-vzn5yshl81/

Behaviour

Enumerates kernel/hardware configuration

Process Discovery

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Checks CPU configuration

Reads CPU attributes

UPX packed file

Checks hardware identifiers (DMI)

Creates/modifies Cron job

Enumerates running processes

Looks up external IP address via web service

Reads hardware information

File and Directory Permissions Modification

Executes dropped EXE

Loads a kernel module

XMRig Miner payload

Xmrig family

xmrig

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/770182c8ac916900bf5e9728e8e1c5d03bf05a502adfb559dcdf5245ac88d23b