MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bfbf2fb15e14356aba85da20089d290aeed48996f43c1fb715377013bb7a0beb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	bfbf2fb15e14356aba85da20089d290aeed48996f43c1fb715377013bb7a0beb
SHA3-384 hash:	554cb4bfb7153a25d9367d4dd5eb4d0af6fcfa4b78bf270b65a4ee349aed0e43491f735186884acfc24564591840c5cf
SHA1 hash:	c56c8ba414074328d220275d5664a5b5f373b96e
MD5 hash:	77fac1ae07d902c5e08f414e1bb2b863
humanhash:	minnesota-kitten-finch-hydrogen
File name:	run-CN.sh
Download:	download sample
Signature	CoinMiner Alert Create hunting rule
File size:	7'580 bytes
First seen:	2025-08-31 15:14:48 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	192:F8XyzHWZzzDN19xDkIjkm3qarbayHDPMeYqf4Mvlu:MzvLzgUNjna+u
TLSH	T135F1C806F6D0DAB42988C57841891880694F922B6D492C08F8FDF569BF3476C71FDBEB
Magika	shell
Reporter	abuse_ch
Tags:	sh

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

41

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

Txt.Malware.Sustes-6779550-1

Alert

Create hunting rule

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

unix shell

First seen:

2025-08-31T13:10:00Z UTC

Last seen:

2025-08-31T13:10:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/bfbf2fb15e14356aba85da20089d290aeed48996f43c1fb715377013bb7a0beb/results?tab=lookup

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/4e77c2b9-764c-4c7b-bba4-10b56f2c18ed

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

6%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/bfbf2fb15e14356aba85da20089d290aeed48996f43c1fb715377013bb7a0beb

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/bfbf2fb15e14356aba85da20089d290aeed48996f43c1fb715377013bb7a0beb/

ReversingLabs TitaniumCloud Script-PowerShell.Trojan.Heuristic

Threat name:

Script-PowerShell.Trojan.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-08-31 15:16:01 UTC

File Type:

Text (Shell)

AV detection:

4 of 36 (11.11%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=x67s7mk6cq2wvouf3iqarhjjblxnjcmw6q6b7nyvg5ybho32bpvq._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  6/10

Tags:

discovery linux

Link:

https://tria.ge/reports/250831-snfckazpt6/

Behaviour

Enumerates kernel/hardware configuration

Reads runtime system information

System Network Configuration Discovery

Reads CPU attributes

Enumerates running processes

VMRay XMRig

Malware family:

XMRig

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/bfbf2fb15e14/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/bfbf2fb15e14356aba85da20089d290aeed48996f43c1fb715377013bb7a0beb