MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c058b74dd6531f4eb3c48d633797d40e393b1c870d9ebe29c5165de011652d42. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	c058b74dd6531f4eb3c48d633797d40e393b1c870d9ebe29c5165de011652d42
SHA3-384 hash:	19882170785a138be7b3798a5794970243b20bc8a49a7e0203a2ce5e7570d09f3a1412fba8752c0004acd02cb22a6c56
SHA1 hash:	eab3b0127adf6443f3883b2ac3da597dbbdfb05c
MD5 hash:	f5d3d7f693532293813e4dff414fdfbf
humanhash:	queen-twenty-nitrogen-lake
File name:	create.py
Download:	download sample
File size:	5'309 bytes
First seen:	2024-12-03 15:55:35 UTC
Last seen:	Never
File type:
MIME type:	text/plain
ssdeep	96:1u6d+u8UitaOvPcFXXc165uCzLghzXYsSX9VOP:B/nXc165uCz8hzXYzX9VOP
TLSH	T103B12499BAA24F724D64DF04F32285D9B062E1870460DF1AB4FB70BCFDBAE59E604147
Magika	txt
Reporter	abuse_ch
Tags:	py

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

82

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Clean

Verdict:

Clean

Score:

84.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=674f2aefbc8c6beb30755d43linux22vpnfull_triage

Tags:

malware

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/674f2a177bae4cb482fffd00/reports/65d4283c-c485-48f8-bef0-1b704bdd5526/overview

Hybrid Analysis TrojanDownloader/Linux.Agent

Verdict:

Malicious

Labled as:

TrojanDownloader/Linux.Agent

Link:

https://www.hybrid-analysis.com/sample/c058b74dd6531f4eb3c48d633797d40e393b1c870d9ebe29c5165de011652d42

Nucleon Malprob Benign

Score:

1%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/c058b74dd6531f4eb3c48d633797d40e393b1c870d9ebe29c5165de011652d42

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c058b74dd6531f4eb3c48d633797d40e393b1c870d9ebe29c5165de011652d42/

ReversingLabs TitaniumCloud Script-Shell.Downloader.Heuristic

Threat name:

Script-Shell.Downloader.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2024-12-03 15:56:04 UTC

File Type:

Text (Shell)

AV detection:

9 of 38 (23.68%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ybmlotowkmpu5m6ervrtpf6uby4twhehbwpl4kofczo6aelffvba._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

discovery

Link:

https://tria.ge/reports/241203-tdb3tsxmfk/

Behaviour

Modifies registry class

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/c058b74dd6531f4eb3c48d633797d40e393b1c870d9ebe29c5165de011652d42