MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c0e9ea6148198b02aa848b888a54f9b32e5de803e96ba70112cd668178a2acf5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c0e9ea6148198b02aa848b888a54f9b32e5de803e96ba70112cd668178a2acf5
SHA3-384 hash: 016a32def9b3f9d14bad8878793705bfafd710142243047264d4ec7209dadb7750a26792099f75268ad4b3d12e3a6937
SHA1 hash: 8ce5bcccdf2ee280a2950f99831bc4c7a4205573
MD5 hash: 867862606c462017731422f0a7a36748
humanhash: lion-river-romeo-robin
File name:m
Download: download sample
File size:394 bytes
First seen:2025-04-23 11:32:13 UTC
Last seen:Never
File type: sh
MIME type:text/plain
ssdeep 6:ebgfr3w5/KjMheZDkXDNk7dNMoke4jhwUDkwxHDNk7dNMokewFhoJfCJv:3rWKMeZDkXDNkxNOwCkwRDNkxN2FhoAh
TLSH T113E0EDDF011989246040EAEFB5D348266581D6AC2FC68F0DAE6E1A32F5CDA1C7950F6F
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://45.135.194.45/vv/mipsn/an/aelf gafgyt ua-wget
http://45.135.194.45/vv/mipsela49f50fdba0de9c330d0980f6cce815c1525d0800adeab6c3d82a7954923ef02 Miraielf gafgyt mirai ua-wget

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
DE DE
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Linux.DownLoader.2324.6177.31274.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
90.2%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6808d186a37ff28e12988c1dlinux22vpnfull_triage
Tags:
agent hype sage
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
busybox evasive
Link:
https://www.filescan.io/uploads/6808cfd263be5be4c10f8bae/reports/800e3062-235d-45c3-b002-ceaf7013f91e/overview
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/c0e9ea6148198b02aa848b888a54f9b32e5de803e96ba70112cd668178a2acf5
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c0e9ea6148198b02aa848b888a54f9b32e5de803e96ba70112cd668178a2acf5/
Threat name:
Script-Shell.Trojan.Multiverze
Create hunting rule
Status:
Malicious
First seen:
2025-04-23 11:34:29 UTC
File Type:
Text (Shell)
AV detection:
8 of 24 (33.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ydu6uykidgfqfkueroeiuvhzwmxf32ad5fv2oaiszvtic6fcvt2q._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/250423-npk7zswxbx/
Behaviour
Modifies registry class
Suspicious use of SetWindowsHookEx
Enumerates physical storage devices
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/c0e9ea6148198b02aa848b888a54f9b32e5de803e96ba70112cd668178a2acf5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh c0e9ea6148198b02aa848b888a54f9b32e5de803e96ba70112cd668178a2acf5

(this sample)

elf 9805b83b8ba70f7c27b3de59aac8252af3811d697c77827e2860ce60798a79c6

  
URLhaus
https://urlhaus.abuse.ch/url/3522741/
  
Delivery method
Distributed via web download
  
Dropping
MD5 e0b56eeacc8021480b6c108f2399c454
  
Dropping
SHA256 9805b83b8ba70f7c27b3de59aac8252af3811d697c77827e2860ce60798a79c6

Comments