MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 96d5a0d047608cb2ae74125fd3a6b2b13d15c1060d1224188d1aaaf0acc1391a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	96d5a0d047608cb2ae74125fd3a6b2b13d15c1060d1224188d1aaaf0acc1391a
SHA3-384 hash:	4cc7bb037e1fa2f764e780330ce613b04729f67f109c85a208f462b7d1cf5f162284f7bffaae3ae608a67c4dc187643e
SHA1 hash:	e39b965a39563bd1b762da3a2dbf50275061d6b2
MD5 hash:	15604ada53613db060c50b13ced36f70
humanhash:	colorado-triple-social-march
File name:	wget.sh
Download:	download sample
File size:	1'505 bytes
First seen:	2024-12-02 04:06:59 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	12:GLF+2IDevEDLkIDce5nuLy+ID5BLlxM+IDeRLt2ID18KLOIDp8LC+ID3LoRIDGOO:sF+kvEfztEeJAkZt0IX+IO/2fFAbwE
TLSH	T19D318DCAB1A11575AE90EC4772AFCC1D318A79CD18C58FA9A9CC30F694ACD54FC40B13
Magika	shell
Reporter	abuse_ch
Tags:	sh

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

80

Origin country :

DE

Vendor Threat Intelligence

CyberFortress Malicious

Verdict:

Malicious

Score:

90.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=674d337604c232bff3b5b345linux22vpnfull_triage

Tags:

ransomware shellcode

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-debug busybox evasive lolbin remote

Link:

https://www.filescan.io/uploads/674d3268c14b5f71b2f52741/reports/3749a04f-d625-4f0d-b518-61c89f15dde8/overview

Nucleon Malprob Malware

Score:

73%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/96d5a0d047608cb2ae74125fd3a6b2b13d15c1060d1224188d1aaaf0acc1391a

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/96d5a0d047608cb2ae74125fd3a6b2b13d15c1060d1224188d1aaaf0acc1391a/

ReversingLabs TitaniumCloud Script-Shell.Downloader.Heuristic

Threat name:

Script-Shell.Downloader.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2024-12-02 04:07:10 UTC

File Type:

Text (Shell)

AV detection:

15 of 24 (62.50%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=s3k2buchmcglfltucjp5hjvswe6rlqigbujcigendkvpblgbhena._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

discovery

Link:

https://tria.ge/reports/241202-epmldayngx/

Behaviour

Modifies registry class

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/96d5a0d047608cb2ae74125fd3a6b2b13d15c1060d1224188d1aaaf0acc1391a