MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9e01fc8382dded3729c4cd2b8e944ed14af3f5a89d346bd4364b49c32b962967. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	9e01fc8382dded3729c4cd2b8e944ed14af3f5a89d346bd4364b49c32b962967
SHA3-384 hash:	59efc280c45c69e9e48938a8373b65573d3add11da56a806e9fc4111fc0be372850be3f4a236c646ced79714c0ca2038
SHA1 hash:	65871e9a3c7b26e034757821016886e3210f1f00
MD5 hash:	ecdd2c4580c76c6b839279b277f89f7b
humanhash:	ink-missouri-west-alpha
File name:	scan.sh
Download:	download sample
File size:	507 bytes
First seen:	2025-04-14 08:32:14 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	12:p79T+3kNgnavbQ/piOKMvzO00YAH+KN7RcLHWrexy0oo7Ch:pVCMIavbk/rvzt8Hxla2rhVh
TLSH	T167F052926B35A0750E1B43348A6616402BAC358029CCF2281AEE0A8AEAC1D0F61FDC37
Magika	shell
Reporter	abuse_ch
Tags:	sh

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

129

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.BV.Scanner-AQ.8106.26241.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Clean

Verdict:

Clean

Score:

70%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67fcd57a1dba888a93d36673linux22vpnfull_triage

Tags:

n/a

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

expand lolbin

Link:

https://www.filescan.io/uploads/67fcc84551042df036d3cf8f/reports/e732e756-1540-4c2d-b8dd-2e42658006e5/overview

Nucleon Malprob Benign

Score:

0%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/9e01fc8382dded3729c4cd2b8e944ed14af3f5a89d346bd4364b49c32b962967

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/9e01fc8382dded3729c4cd2b8e944ed14af3f5a89d346bd4364b49c32b962967/

ReversingLabs TitaniumCloud Script.Network.Scanner

Threat name:

Script.Network.Scanner

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-04-14 08:33:10 UTC

File Type:

Text (Shell)

AV detection:

4 of 38 (10.53%)

Threat level:

  3/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=tya7za4c3xwtokoezuvy5fco2ffph5nitu2gxvbwjne4gk4wfftq._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

antivm credential_access defense_evasion discovery execution linux persistence privilege_escalation

Link:

https://tria.ge/reports/250414-kfxb4st1h1/

Behaviour

Software Deployment Tools

Enumerates kernel/hardware configuration

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Changes its process name

Checks CPU configuration

Deletes log files

Modifies systemd

Write file to user bin folder

File and Directory Permissions Modification

OS Credential Dumping

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/9e01fc8382dded3729c4cd2b8e944ed14af3f5a89d346bd4364b49c32b962967