MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c1f6f312624cb597d0101545cf5cf6874d83bb36ce89870335371a3990dfbf05. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	c1f6f312624cb597d0101545cf5cf6874d83bb36ce89870335371a3990dfbf05
SHA3-384 hash:	894e38dd7241b83585f5d04180235a6bb53dddac66f754a38764efdc1ca60e550928518767bee88f58dc240eea618507
SHA1 hash:	5ce01ba73eb895f541931a491e466b41bdb24c4c
MD5 hash:	b13ef76e87963304c7a8af2d0ee5285c
humanhash:	ten-king-magnesium-steak
File name:	w.sh
Download:	download sample
File size:	175 bytes
First seen:	2025-01-08 17:16:19 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	3:GRFjLXbFGlRdLiVaH3FDzDLXbFGlRdLiVaiXsUIVeVaWd8oFaG1OdmMWRE1nsF/l:Sjf2nH31Df2n0szJA8PsFd
TLSH	T17DC012A6BB600ED0BF8B8AA03D13EB4244905D682DD5E23DD8C205C07878068B6A8A90
Magika	shell
Reporter	abuse_ch
Tags:	sh

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

87

Origin country :

DE

Vendor Threat Intelligence

CyberFortress Malicious

Verdict:

Malicious

Score:

81.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=677eb3f7c029bd73f28714dclinux22vpnfull_triage

Tags:

extens agent hype

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

expand lolbin

Link:

https://www.filescan.io/uploads/677eb3116602102d94f3dbf6/reports/1f8f0fc5-5d50-4ec1-b74d-da6f16928c8b/overview

Nucleon Malprob Benign

Score:

0%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/c1f6f312624cb597d0101545cf5cf6874d83bb36ce89870335371a3990dfbf05

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c1f6f312624cb597d0101545cf5cf6874d83bb36ce89870335371a3990dfbf05/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=yh3pgetcjs2zpuaqcvc46xhwq5gyhozwz2eyoazvg4ndteg7x4cq._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

discovery

Link:

https://tria.ge/reports/250108-vtn8rsyqam/

Behaviour

Modifies registry class

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/c1f6f312624cb597d0101545cf5cf6874d83bb36ce89870335371a3990dfbf05