MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 c3c5a97e9917175dcd22e388e6f9cc60ab85f90e9d4a57dc0228920e456355d7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 6
| SHA256 hash: | c3c5a97e9917175dcd22e388e6f9cc60ab85f90e9d4a57dc0228920e456355d7 |
|---|---|
| SHA3-384 hash: | 1dec125c2c96a1682e7b655a66d031115bc64baca8b8e654044df718de486c4c5dcc269ecce6364d6ce3082aee4b2587 |
| SHA1 hash: | 1ad0c2415dd4a94a8860071bb3a313d19490ab95 |
| MD5 hash: | be8e14cd2b3591f98c8e0c3600dfb5b3 |
| humanhash: | beryllium-earth-maryland-batman |
| File name: | o |
| Download: | download sample |
| File size: | 91 bytes |
| First seen: | 2025-12-21 09:31:39 UTC |
| Last seen: | Never |
| File type: | sh |
| MIME type: | text/plain |
| ssdeep | 3:L6FT7KDQNUCZXLE1aGBzSEyLTUWOevn:L6FTODWloI5v |
| TLSH | T192B0129730543300C404FC087CB71F9C1053C2C134544A1C69F90231CD681043C80D09 |
| Magika | txt |
| Reporter |  abuse_ch |
| Tags: | sh |
Shell script dropper
This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.
| URL | Malware sample (SHA256 hash) | Signature | Tags |
|---|---|---|---|
| http://45.132.180.48/mips | n/a | n/a | elf geofenced mips ua-wget USA |
Intelligence
File Origin
# of uploads :
1
# of downloads :
29
Origin country :
DEVendor Threat Intelligence
No detections
Detection(s):
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
evasive
Verdict:
Suspicious
Labled as:
TrojanDownloader/Linux.Shell
Verdict:
Malicious
File Type:
text
First seen:
2025-12-21T07:43:00Z UTC
Last seen:
2025-12-21T14:41:00Z UTC
Hits:
~10
Status:
terminated
Behavior Graph:
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Detection(s):
Suspicious file
Result
Malware family:
n/a
Score:
3/10
Tags:
n/a
Behaviour
Modifies registry class
Suspicious use of SetWindowsHookEx
Enumerates physical storage devices
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
sh c3c5a97e9917175dcd22e388e6f9cc60ab85f90e9d4a57dc0228920e456355d7
(this sample)
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.