MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 92ea438c42c6344a676cd34c41e55c01c68a7266db528effb672379db3286928. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	92ea438c42c6344a676cd34c41e55c01c68a7266db528effb672379db3286928
SHA3-384 hash:	cb282be676a2625070381f4b19aa5a04dca3dde479de4b1503564bc26565da8cd6cf77cef8c11b40488c813315dc11f2
SHA1 hash:	c8c91305d6c19ef21113226d58f6b4349ca2c3ba
MD5 hash:	58c39e899ed9c49b44e78258b4fe6dfd
humanhash:	fourteen-july-nuts-purple
File name:	ah
Download:	download sample
File size:	470 bytes
First seen:	2024-10-27 10:47:04 UTC
Last seen:	2024-10-28 07:15:47 UTC
File type:	sh
MIME type:	text/x-shellscript
ssdeep	12:VVJ9iXhYxtEYql1dB9Esray/I0tLtzKldpS1n:b6XOvO/Zray5td6Un
TLSH	T148F05CD898E5262A609148BCC6FFD452D201B153165419047DFF357B9FACC15B650AB2
Magika	shell
Reporter	abuse_ch
Tags:	sh

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

74

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Linux.DownLoader.2277.10939.536.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

94.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=671e36715928ee28d55e5821linux22vpnfull_triage

Tags:

Agent Shell Hype

FileScan.IO Unknown

Verdict:

Unknown

Threat level:

  10/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/671e1a622734cb737d8ed20e/reports/dc119cde-764f-464e-8dfa-e18785a231d5/overview

Hybrid Analysis Trojan[Downloader]/Shell.Agent

Verdict:

Malicious

Labled as:

Trojan[Downloader]/Shell.Agent

Link:

https://www.hybrid-analysis.com/sample/92ea438c42c6344a676cd34c41e55c01c68a7266db528effb672379db3286928

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Nucleon Malprob Benign

Score:

0%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/92ea438c42c6344a676cd34c41e55c01c68a7266db528effb672379db3286928

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/92ea438c42c6344a676cd34c41e55c01c68a7266db528effb672379db3286928/

ReversingLabs TitaniumCloud Win32.Trojan.Generic

Threat name:

Win32.Trojan.Generic

Alert

Create hunting rule

Status:

Malicious

First seen:

2024-10-27 11:01:27 UTC

File Type:

Text (Shell)

AV detection:

5 of 38 (13.16%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=slvehdccyy2euz3m2ngedzk4ahdiu4tg3nji575woi3z3mzineua._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

defense_evasion discovery linux

Link:

https://tria.ge/reports/241027-pxb5qaxepg/

Behaviour

Reads runtime system information

System Network Configuration Discovery

File and Directory Permissions Modification

Executes dropped EXE

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/92ea438c42c6344a676cd34c41e55c01c68a7266db528effb672379db3286928