MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a1a45a93e224d051aeab954568b912dc518d7bb8586dc4714a1d578c9c9bbcb0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	a1a45a93e224d051aeab954568b912dc518d7bb8586dc4714a1d578c9c9bbcb0
SHA3-384 hash:	7eef3059865ae877bf7298b3662d698b1bea4b81cae6d87f67ffc9d6fb95a2b3ad0e9c98743ff73bc0521d16bdb6e5b7
SHA1 hash:	8f37b910d4470dbe3262e257331ddb2ecb0bf34c
MD5 hash:	3132d85ac38b95a03caca8ba728c787b
humanhash:	minnesota-skylark-november-may
File name:	bolts
Download:	download sample
Signature	CoinMiner Alert Create hunting rule
File size:	1'068 bytes
First seen:	2025-12-07 15:18:37 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	24:wdfGyZ1r9yHgnKTpJnHOjWIEQXi/rvsTI0jmXJ:sGc1n4H6EClyXJ
TLSH	T1AC1154CBA0A0AC30349C40BCE1465052754A9FB715E54854B80F367E3F54269F13C73B
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	CoinMiner sh

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

27

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

busybox

Link:

https://www.filescan.io/uploads/69359af0fee3f1394f73c6be/reports/ef015864-6ff5-4656-9a32-3b5118529508/overview

InQuest

Result

Gathering data

Nucleon Malprob Malware

Score:

77%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/a1a45a93e224d051aeab954568b912dc518d7bb8586dc4714a1d578c9c9bbcb0

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a1a45a93e224d051aeab954568b912dc518d7bb8586dc4714a1d578c9c9bbcb0/

ReversingLabs TitaniumCloud

Gathering data

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ugsfve7cetifdlvlsvcwrois3riy265ylbw4i4kkdvlyzhe3xsya._file

Hatching Triage xmrig

Result

Malware family:

xmrig

Alert

Create hunting rule

Score:

  10/10

Tags:

family:xmrig antivm defense_evasion discovery linux miner

Link:

https://tria.ge/reports/251207-sp9msstrcw/

Behaviour

Enumerates kernel/hardware configuration

Reads runtime system information

Writes file to tmp directory

Changes its process name

Checks CPU configuration

Reads CPU attributes

Checks hardware identifiers (DMI)

Enumerates running processes

Reads hardware information

File and Directory Permissions Modification

Executes dropped EXE

XMRig Miner payload

Xmrig family

xmrig

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.29

Link:

https://yomi.yoroi.company/submissions/a1a45a93e224d051aeab954568b912dc518d7bb8586dc4714a1d578c9c9bbcb0