MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bc9eee6268cef7edc2c99d5d9fee4f4cea2cf1f4c22b5592a681ed5c94a3ca7e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	bc9eee6268cef7edc2c99d5d9fee4f4cea2cf1f4c22b5592a681ed5c94a3ca7e
SHA3-384 hash:	4cf6a9a20c3c1194a61c18986658118ab99acad7d9b6bdcddd436497969182b69e3694940ef8900f3ec3c1c0fb646cc0
SHA1 hash:	41324fb8c25f64f99fe689d57b55f4002f47c53d
MD5 hash:	ae7913cd5f67e9bce6218ad335daf3a3
humanhash:	batman-river-victor-beryllium
File name:	Ffdgsfg
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	952 bytes
First seen:	2025-12-05 18:22:50 UTC
Last seen:	2025-12-06 22:57:19 UTC
File type:	sh
MIME type:	text/plain
ssdeep	12:shdBsghaqsghJ1sgh+6JsghlOBasghn7sghO2TsghwDMsgh51sghcDRWs7:eHr73lYsnf9Pc
TLSH	T1E71163AC4572FB02802C0D2DF0BB8455713287DA6CBACA58BDC45939B2C85A4B823F62
Magika	batch
Reporter	abuse_ch
Tags:	sh

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

40

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

Hybrid Analysis TrojanDownloader/Linux.Agent

Verdict:

Malicious

Labled as:

TrojanDownloader/Linux.Agent

Link:

https://www.hybrid-analysis.com/sample/bc9eee6268cef7edc2c99d5d9fee4f4cea2cf1f4c22b5592a681ed5c94a3ca7e

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

text

First seen:

2025-12-05T16:20:00Z UTC

Last seen:

2025-12-06T14:36:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/bc9eee6268cef7edc2c99d5d9fee4f4cea2cf1f4c22b5592a681ed5c94a3ca7e/results?tab=lookup

Kunai Sandbox

Status:

Failed

Link:

https://sandbox.kunai.rocks/analysis/0007a69f-c27a-432f-91ab-b19ca9427ceb

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/bc9eee6268cef7edc2c99d5d9fee4f4cea2cf1f4c22b5592a681ed5c94a3ca7e

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/bc9eee6268cef7edc2c99d5d9fee4f4cea2cf1f4c22b5592a681ed5c94a3ca7e/

ReversingLabs TitaniumCloud Linux.Trojan.Malgent

Threat name:

Linux.Trojan.Malgent

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-12-05 18:34:19 UTC

File Type:

Text (Shell)

AV detection:

21 of 38 (55.26%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=xspo4ytiz3363qwjtvoz73spjtvcz4puyivvlevgqhwvzffdzj7a._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

n/a

Link:

https://tria.ge/reports/251205-w7x89sep4x/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/bc9eee6268cef7edc2c99d5d9fee4f4cea2cf1f4c22b5592a681ed5c94a3ca7e