MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c11ff09814008a0c73cdcc03ad0805806102f067326bb578f94cf0370acce45a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	c11ff09814008a0c73cdcc03ad0805806102f067326bb578f94cf0370acce45a
SHA3-384 hash:	4b4945db75c7c3772eef41c0a8ad505770c762ca7ff7c04723d8acf112f16b56f799793f33993b2c3c96bdf3b6db862f
SHA1 hash:	d0390a9c902a70188a85481fcaecbc9b53290f90
MD5 hash:	fdb40926e91b1101f5fcb4ac0613cfd9
humanhash:	ceiling-fruit-hydrogen-artist
File name:	mon.sh
Download:	download sample
Signature	CoinMiner Alert Create hunting rule
File size:	5'055 bytes
First seen:	2025-08-02 11:08:21 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	96:l06z0cic27PP7DTAiVjIAmx793jt0yjtgmu4IL1qFQ2EBQa1d6z0cd:l080c9iPzDNjGd935XvIL1qFhEBr1d8z
TLSH	T12CA1944AF690C6B0389DC5A8A99B74863A06028B4E441D1DF86FF488BF5475871F83FF
Magika	shell
Reporter	abuse_ch
Tags:	CoinMiner sh

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

29

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

Txt.Malware.Sustes-6779550-1

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

fingerprint

Link:

https://www.filescan.io/uploads/688df1e1dc44c87d077aa679/reports/b69debd1-230f-46fa-a3ec-d5219b06f0b7/overview

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/a4deb922-2229-4260-b801-fcf0fe6810bc

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

1%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/c11ff09814008a0c73cdcc03ad0805806102f067326bb578f94cf0370acce45a

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c11ff09814008a0c73cdcc03ad0805806102f067326bb578f94cf0370acce45a/

Neiki HEUR:Trojan-Downloader.Shell.Agent

Verdict:

Malicious

Threat:

HEUR:Trojan-Downloader.Shell.Agent

Link:

https://tip.neiki.dev/file/c11ff09814008a0c73cdcc03ad0805806102f067326bb578f94cf0370acce45a

ReversingLabs TitaniumCloud Win32.Trojan.Vigorf

Threat name:

Win32.Trojan.Vigorf

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-08-02 11:09:22 UTC

File Type:

Text (Shell)

AV detection:

5 of 38 (13.16%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=yep7bgauacfay46nzqb22cafqbqqf4dhgjv3k6hzjtydocwm4rna._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  6/10

Tags:

antivm discovery execution linux persistence privilege_escalation

Link:

https://tria.ge/reports/250802-m888gs1qv2/

Behaviour

Enumerates kernel/hardware configuration

Reads runtime system information

Checks CPU configuration

Reads CPU attributes

Creates/modifies Cron job

Enumerates running processes

VMRay XMRig

Malware family:

XMRig

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/c11ff0981400/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.05

Link:

https://yomi.yoroi.company/submissions/c11ff09814008a0c73cdcc03ad0805806102f067326bb578f94cf0370acce45a