MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9c11f546f9768e7880cda56d532a7a7ba44b9a0669154ad83766a21af7a623ab. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	9c11f546f9768e7880cda56d532a7a7ba44b9a0669154ad83766a21af7a623ab
SHA3-384 hash:	fa0017d7a96952c59f94e57284928a70657d9059b0469ea649746c5cb0fdc8aafd940210accf1f0e005698ccab3a36c4
SHA1 hash:	39533907fe787dd023cdd03771fb7850a5d941ba
MD5 hash:	a884fe3463b3559e2014cdb407f543a4
humanhash:	five-yellow-nitrogen-december
File name:	c.sh
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	1'096 bytes
First seen:	2025-01-13 20:02:35 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	24:3J3nBQNNII+KS5TVuqaLl9f9qqQ/P1QqR:RBQJ+x5TVuqa59f9qqQ/P1Qq
TLSH	T11711DB9D22D0941A1DECCE0C72AD6418AD77C1C9B8B18B15ED70883740A92AC6FACF2D
Magika	txt
Reporter	abuse_ch
Tags:	sh

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

96

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Linux.Downloader-33.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=678571774487910100de9bcelinux22vpnfull_triage

Tags:

agent hype sage

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-debug bash lolbin remote

Link:

https://www.filescan.io/uploads/678571bce6fb6576bb30d670/reports/9bd724fb-7ff8-4570-9720-42082b778835/overview

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Nucleon Malprob Benign

Score:

0%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/9c11f546f9768e7880cda56d532a7a7ba44b9a0669154ad83766a21af7a623ab

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/9c11f546f9768e7880cda56d532a7a7ba44b9a0669154ad83766a21af7a623ab/

ReversingLabs TitaniumCloud Document-HTML.Downloader.Heuristic

Threat name:

Document-HTML.Downloader.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-01-13 20:03:04 UTC

File Type:

Text (JavaScript)

AV detection:

12 of 24 (50.00%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=tqi7krxzo2hhragnuvwvgkt2posexgqgnekuvwbxm2rbv55geovq._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

discovery

Link:

https://tria.ge/reports/250113-ysnsdsylbm/

Behaviour

Modifies registry class

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/9c11f546f9768e7880cda56d532a7a7ba44b9a0669154ad83766a21af7a623ab