MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ba991ce82dc6d5e459eed9f1ec598f1e9ed40c4a4c017ef44300404f587ccfbc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	ba991ce82dc6d5e459eed9f1ec598f1e9ed40c4a4c017ef44300404f587ccfbc
SHA3-384 hash:	625a5079c3f1a1b7a16da6e0f7a129ed80a1ca426f4a8a1d46fd9f0968013a2f54f1747db3ce0809ab1ad862258f8d90
SHA1 hash:	abec1056ce562d886d8aab294e9d5011bd9b8684
MD5 hash:	eab291864a7fc159330f1c5bef4fe8e1
humanhash:	august-robin-snake-bulldog
File name:	scan.sh
Download:	download sample
File size:	504 bytes
First seen:	2025-04-14 08:22:11 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	12:p79T+ITnavbQ/piOKMvzO00YAH+KN7RcLHWrexy0oo7Ch:pVRavbk/rvzt8Hxla2rhVh
TLSH	T1B9F09E917B35F0754E1B8334CA6657002BAC318029CCF2191AEE069AEAC1D0F61FDC33
Magika	shell
Reporter	abuse_ch
Tags:	sh

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

124

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.BV.Scanner-AQ.28921.13529.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

90.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67fccea4d6e7c3effad27c2alinux22vpnfull_triage

Tags:

scanner virus agent

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

expand lolbin

Link:

https://www.filescan.io/uploads/67fcc5eb2201d518c82a7c76/reports/df05bc54-82bd-4024-b314-12e303a5f257/overview

Nucleon Malprob Benign

Score:

0%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/ba991ce82dc6d5e459eed9f1ec598f1e9ed40c4a4c017ef44300404f587ccfbc

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ba991ce82dc6d5e459eed9f1ec598f1e9ed40c4a4c017ef44300404f587ccfbc/

ReversingLabs TitaniumCloud Script.Network.Scanner

Threat name:

Script.Network.Scanner

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-04-14 08:23:09 UTC

File Type:

Text (Shell)

AV detection:

6 of 38 (15.79%)

Threat level:

  3/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=xkmrz2bny3k6iwpo3hy6ywmpd2pnidckjqax55cdabae6wd4z66a._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

antivm credential_access defense_evasion discovery execution linux persistence privilege_escalation

Link:

https://tria.ge/reports/250414-j96l7stzdx/

Behaviour

Software Deployment Tools

Enumerates kernel/hardware configuration

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Deobfuscate/Decode Files or Information

Changes its process name

Checks CPU configuration

Deletes log files

Modifies systemd

Write file to user bin folder

File and Directory Permissions Modification

OS Credential Dumping

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.39

Link:

https://yomi.yoroi.company/submissions/ba991ce82dc6d5e459eed9f1ec598f1e9ed40c4a4c017ef44300404f587ccfbc