MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b7004d1b9da9d453742088a02b0aba30aad672b475f37ea20cda502c7e5bdebd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	b7004d1b9da9d453742088a02b0aba30aad672b475f37ea20cda502c7e5bdebd
SHA3-384 hash:	71adca30e084d1535773c58d229f938243647347f3b145d5b34d0abc71434fc5ad1b2bc5fb1d617e6f34738387e813cd
SHA1 hash:	5949fe48ea1927e164c4fac8f78898afe8705ea5
MD5 hash:	b6801ddb860ea21c90ca4d804169cc40
humanhash:	gee-sweet-timing-vermont
File name:	sh
Download:	download sample
Signature	CoinMiner Alert Create hunting rule
File size:	1'610 bytes
First seen:	2025-03-06 20:36:42 UTC
Last seen:	2025-03-06 21:27:22 UTC
File type:	sh
MIME type:	text/x-shellscript
ssdeep	24:ldi4z2zELN4AltrM35BFRDD6n0LY83H0tfhhp5wEliodZYDYc7QW:ldlyAL9tonmzfvJlBZY6W
TLSH	T14F310D9D70228F305BBDC47CB684358C9587DAEF890B5EE4F043B46D285C36871A4EA4
Magika	shell
Reporter	abuse_ch
Tags:	CoinMiner sh

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

119

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

Sanesecurity.Malware.31068.LX.BOT.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Clean

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67ca08f7c8d04e92a4bf778elinux22vpnfull_triage

Tags:

n/a

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/67ca0774e95d0f9029e54dee/reports/89a07afc-846e-4922-a827-579d7118d8f8/overview

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Nucleon Malprob Benign

Score:

0%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/b7004d1b9da9d453742088a02b0aba30aad672b475f37ea20cda502c7e5bdebd

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b7004d1b9da9d453742088a02b0aba30aad672b475f37ea20cda502c7e5bdebd/

ReversingLabs TitaniumCloud Linux.Trojan.Multiverze

Threat name:

Linux.Trojan.Multiverze

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-03-06 20:37:13 UTC

File Type:

Text (Shell)

AV detection:

17 of 38 (44.74%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=w4ae2g45vhkfg5barcqcwcv2gcvnm4vuoxzx5iqm3jicy7s3326q._file

Hatching Triage xmrig

Result

Malware family:

xmrig

Alert

Create hunting rule

Score:

  10/10

Tags:

family:xmrig antivm defense_evasion discovery execution linux miner persistence privilege_escalation upx

Link:

https://tria.ge/reports/250306-zd6kbsxns9/

Behaviour

Enumerates kernel/hardware configuration

Reads runtime system information

Writes file to tmp directory

Changes its process name

Checks CPU configuration

Reads CPU attributes

UPX packed file

Reads AppArmor ptrace settings

Attempts to change immutable files

Checks hardware identifiers (DMI)

Creates/modifies Cron job

Enumerates running processes

Reads hardware information

Reads network interface configuration

File and Directory Permissions Modification

Creates Raw socket

Executes dropped EXE

Flushes firewall rules

Unexpected DNS network traffic destination

Contacts a large (1662917) amount of remote hosts

Creates a large amount of network flows

XMRig Miner payload

Xmrig family

xmrig

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.