MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9ece9475ed92b0c57e7499f69856122750963ff404753ab0cbaf607485f1a073. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	9ece9475ed92b0c57e7499f69856122750963ff404753ab0cbaf607485f1a073
SHA3-384 hash:	c60a6ee4aaf623719ba946925de80d63ea391ed5c6b4cadd3d2e1344f7d376f67593fad5799ece9e95a53db0e97eb22a
SHA1 hash:	4d8d8903f6a2123b5050ce683e0558fcf91812e9
MD5 hash:	952378bf02c242de5554ff3e6ff622b8
humanhash:	robin-north-winner-sweet
File name:	ftpget.sh
Download:	download sample
File size:	1'705 bytes
First seen:	2025-09-03 04:14:49 UTC
Last seen:	2025-09-03 11:12:09 UTC
File type:	sh
MIME type:	text/plain
ssdeep	24:sC7ZoJyzIyox2yfyjyXWBTH6yxa1RPJyoDwybKZylyZfJyWIopSrIyRuzlUf:VWs2xDyeWtHZaXPnDVKiKJIoYrWi
TLSH	T17F318D80A2A249B1BD6FA4D77B0E4C493107B5ED48C6CFB5649C75F3E18DE80B842343
Magika	txt
Reporter	abuse_ch
Tags:	sh

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

30

Origin country :

DE

Vendor Threat Intelligence

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

text

First seen:

2025-09-03T02:22:00Z UTC

Last seen:

2025-09-03T02:22:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/9ece9475ed92b0c57e7499f69856122750963ff404753ab0cbaf607485f1a073/results?tab=lookup

Kunai Sandbox

Status:

Failed

Link:

https://sandbox.kunai.rocks/analysis/cced0fba-054c-4930-ab41-b750ca8b1530

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/9ece9475ed92b0c57e7499f69856122750963ff404753ab0cbaf607485f1a073

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/9ece9475ed92b0c57e7499f69856122750963ff404753ab0cbaf607485f1a073/

Neiki Trojan-Downloader.Shell.Agent

Verdict:

Malicious

Threat:

Trojan-Downloader.Shell.Agent

Link:

https://tip.neiki.dev/file/9ece9475ed92b0c57e7499f69856122750963ff404753ab0cbaf607485f1a073

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=t3hji5pnskymk7tuth3jqvqse5ijmp7uar2tvmglv5qhjbprubzq._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

n/a

Link:

https://tria.ge/reports/250903-exgp4aeq71/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/9ece9475ed92b0c57e7499f69856122750963ff404753ab0cbaf607485f1a073