MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9781861f24fb1059ded43d876e310c11948efdc43e7a64655abf76d919a7ebd0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	9781861f24fb1059ded43d876e310c11948efdc43e7a64655abf76d919a7ebd0
SHA3-384 hash:	5442d84c08256b234676235a813a86636b92b7a0bcb6d6db5d59b30db11b4cbb3f21d0a4964b44fe705e9a42c65967e1
SHA1 hash:	ced046914f12c6d9f69500c45c34b285b53fe777
MD5 hash:	579baa889d215173aece20231fa02269
humanhash:	bluebird-west-iowa-south
File name:	.shell
Download:	download sample
Signature	Xorbot Alert Create hunting rule
File size:	214 bytes
First seen:	2025-05-01 16:17:44 UTC
Last seen:	2025-05-03 06:40:41 UTC
File type:	sh
MIME type:	text/plain
ssdeep	3:QnQzanFCKl2X4HMiB3L5ZM+S3L5ZMSqR13L5ZMBSLM9Kd:lOnFflHMk3GW3M9Kd
TLSH	T1F7D0C9C990615DF4ACCBA9BD25F2B448605081A59CC14F25CED9F8D2A848E8DB458B51
Magika	shell
Reporter	abuse_ch
Tags:	sh

Intelligence

---

File Origin

# of uploads :

3

# of downloads :

75

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=68145b53d5cdbfe0eb680c88linux22vpnfull_triage

Tags:

trojandownloader shell virus

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

busybox evasive

Link:

https://www.filescan.io/uploads/68139ebf8d43c3a878f8b9d5/reports/3b4c1061-d2b5-497e-bdbb-763616c7a603/overview

Hybrid Analysis Linux/TrojanDownloader.SH

Verdict:

Malicious

Labled as:

Linux/TrojanDownloader.SH

Link:

https://www.hybrid-analysis.com/sample/9781861f24fb1059ded43d876e310c11948efdc43e7a64655abf76d919a7ebd0

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/9781861f24fb1059ded43d876e310c11948efdc43e7a64655abf76d919a7ebd0

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/9781861f24fb1059ded43d876e310c11948efdc43e7a64655abf76d919a7ebd0/

ReversingLabs TitaniumCloud Script.Trojan.Boxter

Threat name:

Script.Trojan.Boxter

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-05-01 22:44:27 UTC

File Type:

Text (Shell)

AV detection:

6 of 24 (25.00%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=s6aymhze7miftxwuhwdw4mimcgki57oehz5gizk2x53nsgnh5pia._file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/9781861f24fb1059ded43d876e310c11948efdc43e7a64655abf76d919a7ebd0