MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8af840ccdaa83bbd0e876a942fa01b4d3e8cb9d699b1dd9f87be7e75d1383dff. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry



Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments

SHA256 hash: 8af840ccdaa83bbd0e876a942fa01b4d3e8cb9d699b1dd9f87be7e75d1383dff
SHA3-384 hash: b680a4c3e6f688562c35c7eb381f7e6450b89c7883e92f35244f39c9dfca76bfa331608047e97c4708a8818964e3bbf5
SHA1 hash: 4f2c01519ba8bd252997214f11b1d45cd8002b22
MD5 hash: fd1bd8fb0f729a8383ee2fe4e2fbce0a
humanhash: artist-pennsylvania-quiet-bluebird
File name:8af840ccdaa83bbd0e876a942fa01b4d3e8cb9d699b1dd9f87be7e75d1383dff.sh
Download: download sample
File size:10'263 bytes
First seen:2026-02-22 13:21:30 UTC
Last seen:Never
File type: sh
MIME type:text/plain
ssdeep 96:cRr3k0B6z93aoU21+CUXp9vr0WKGThKrKSw+F9t999jIBGIBsIBbIBRk:cRr0g6z93aoe0wGTTtBH85
TLSH T17B2218B025F049332E206A40B3372BE6ABB6955349E3218C35DE1D35AF87B52B4BF415
Magika xml
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://38.6.178.140/easy_pass.shn/an/an/a
http://38.6.178.140/easy.shn/an/an/a
http://38.6.178.140/easy_cloud.shn/an/an/a
http://23.224.176.63/sh/easy_av_wget.shn/an/an/a
http://41.128.181.181:53558/ClrnnhUEDbDJlKHObFCqn/an/an/a

Intelligence


File Origin
# of uploads :
1
# of downloads :
43
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
busybox evasive soft-404
Result
Gathering data
Status:
terminated
Behavior Graph:
%3 guuid=a4f9a3e1-1900-0000-a73f-effb340a0000 pid=2612 /usr/bin/sudo guuid=774f07e4-1900-0000-a73f-effb3d0a0000 pid=2621 /tmp/sample.bin guuid=a4f9a3e1-1900-0000-a73f-effb340a0000 pid=2612->guuid=774f07e4-1900-0000-a73f-effb3d0a0000 pid=2621 execve
Gathering data
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Behaviour
Modifies registry class
Suspicious use of SetWindowsHookEx
Enumerates physical storage devices
Please note that we are no longer able to provide a coverage score for Virus Total.

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 8af840ccdaa83bbd0e876a942fa01b4d3e8cb9d699b1dd9f87be7e75d1383dff

(this sample)

1fdfc6e3ae612b736236df4579ff7a10954d47d9e7be67e6ebe8da173b0671c8

  
Delivery method
Distributed via web download
  
Dropping
MD5 bc422233b2512d7d5eb5500daf8a7822
  
Dropping
SHA256 1fdfc6e3ae612b736236df4579ff7a10954d47d9e7be67e6ebe8da173b0671c8

Comments