MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9437f638d4151d1946da0db5d0c461ad5bd235b4fd0a08c3b8f9cbe4d5a3eb14. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	9437f638d4151d1946da0db5d0c461ad5bd235b4fd0a08c3b8f9cbe4d5a3eb14
SHA3-384 hash:	721db205b342ccaeac6012caafcdf8739c81ab66dd41e66db9c26414ce0cf2f82635c831978df748004418c63e8dd1e4
SHA1 hash:	80050774b5ac28fbbff8297c96c13adf9681db94
MD5 hash:	804058fac9138c413b9e1c5ab646206d
humanhash:	oscar-yankee-don-uniform
File name:	cn
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	534 bytes
First seen:	2025-02-04 02:11:44 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	6:Lh8VCbT/XBYCDhYKGTxXgXICDhfcji/DhaGxXjJDh+NIF+KyjBFIPDhOa6qXj2P:y4Ta3drqUGYNIbWeQ
TLSH	T1D9F04F89D8533E96496CED2DF67B245EA052C7CCE10747CEBD890439C85DA55F838A84
Magika	txt
Reporter	abuse_ch
Tags:	mirai sh

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

104

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67a1b7bd51193558eb19534clinux22vpnfull_triage

Tags:

trojan mirai agent virus

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/67a1777b06d12bc30bf686c0/reports/d4ceb135-b138-4b5f-96b4-57283ef54ece/overview

Hybrid Analysis Linux/Downloader.p

Verdict:

Malicious

Labled as:

Linux/Downloader.p

Link:

https://www.hybrid-analysis.com/sample/9437f638d4151d1946da0db5d0c461ad5bd235b4fd0a08c3b8f9cbe4d5a3eb14

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Nucleon Malprob Benign

Score:

0%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/9437f638d4151d1946da0db5d0c461ad5bd235b4fd0a08c3b8f9cbe4d5a3eb14

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/9437f638d4151d1946da0db5d0c461ad5bd235b4fd0a08c3b8f9cbe4d5a3eb14/

ReversingLabs TitaniumCloud Linux.Trojan.Generic

Threat name:

Linux.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2025-02-04 03:09:27 UTC

File Type:

Text (Shell)

AV detection:

14 of 24 (58.33%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=sq37mogucuorsrw2bw25brdbvvn5ennu7ufarq5y7hf6jvnd5mka._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

discovery

Link:

https://tria.ge/reports/250204-hfvr6szpfr/

Behaviour

Modifies registry class

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/9437f638d4151d1946da0db5d0c461ad5bd235b4fd0a08c3b8f9cbe4d5a3eb14