MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9a92829cb05d9539aa771272659514de94f57bd308abd83239aedb28f13961e8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	9a92829cb05d9539aa771272659514de94f57bd308abd83239aedb28f13961e8
SHA3-384 hash:	99c09ec6e059b9aa38c198a68daf508364c61b92f3ac4b6ffd022fdaa63ba27a065f16efa083988de644dc9f27a967da
SHA1 hash:	5c36929a07bc3164d23311b14fb73618d137071c
MD5 hash:	9d235d89370f5ffa16d3ee2814834403
humanhash:	grey-may-magnesium-charlie
File name:	sh
Download:	download sample
Signature	CoinMiner Alert Create hunting rule
File size:	2'081 bytes
First seen:	2025-12-13 15:51:55 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:vkwvpihneZZn1oBydXlwtonmzEvJGU6ljiPq2MTCki:vkwYheZZK8a2mzIj6K
TLSH	T1DF4124BAF8A28E3033ADC5BD7489254CA7569A6F491B2E74F043783C2BBC3247074395
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	CoinMiner sh

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

41

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.BV.Downloader-AEH.89533736.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

coinminer

Link:

https://www.filescan.io/uploads/693d8bae1eac7b9b76a8dc80/reports/c1d7c043-98d0-42c8-a09e-4530d80386ae/overview

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

unix shell

First seen:

2025-12-11T21:33:00Z UTC

Last seen:

2025-12-14T01:39:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/9a92829cb05d9539aa771272659514de94f57bd308abd83239aedb28f13961e8/results?tab=lookup

Kunai Sandbox

Status:

Failed

Link:

https://sandbox.kunai.rocks/analysis/ad789103-ffd9-49be-8b5c-c5db51439cf6

Nucleon Malprob Benign

Score:

13%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/9a92829cb05d9539aa771272659514de94f57bd308abd83239aedb28f13961e8

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/9a92829cb05d9539aa771272659514de94f57bd308abd83239aedb28f13961e8/

Neiki Susipicious

Verdict:

Susipicious

Link:

https://tip.neiki.dev/file/9a92829cb05d9539aa771272659514de94f57bd308abd83239aedb28f13961e8

ReversingLabs TitaniumCloud Win32.Trojan.Vigorf

Threat name:

Win32.Trojan.Vigorf

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-12-12 00:23:27 UTC

File Type:

Text (Shell)

AV detection:

7 of 24 (29.17%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=tkjifhfqlwkttktxcjzglfiu32kpk66tbcv5qmrzv3nsr4jzmhua._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  9/10

Tags:

antivm defense_evasion discovery execution linux persistence privilege_escalation upx

Link:

https://tria.ge/reports/251213-tbaf8awjgp/

Behaviour

Enumerates kernel/hardware configuration

Reads runtime system information

Writes file to tmp directory

Changes its process name

Checks CPU configuration

Reads CPU attributes

UPX packed file

Reads AppArmor ptrace settings

Attempts to change immutable files

Checks hardware identifiers (DMI)

Creates/modifies Cron job

Enumerates running processes

Reads hardware information

Reads network interface configuration

File and Directory Permissions Modification

Creates Raw socket

Executes dropped EXE

Flushes firewall rules

Contacts a large (638251) amount of remote hosts

Creates a large amount of network flows

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.