MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c47be279811d4213298dc925ece7d87e9768a90705d4f8a3413d6e962d9fe6bc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c47be279811d4213298dc925ece7d87e9768a90705d4f8a3413d6e962d9fe6bc
SHA3-384 hash: 2660a1e2148fdb49df3344b69d3a6aee4c1cec10e4309a67c91b356108b7efed742efb8cc41537650aba3c875d2597a3
SHA1 hash: a0267324300e453a55c727e7c9e20ba419e86260
MD5 hash: 4df79f4c6a7a16d12cf7bb678635e8bf
humanhash: utah-uncle-tennessee-juliet
File name:c47be279811d4213298dc925ece7d87e9768a90705d4f8a3413d6e962d9fe6bc
Download: download sample
File size:10'070 bytes
First seen:2022-01-17 13:02:15 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 192:GIqMRuBfftcYFK6+dX13F+ce3kue6I8YJGr50TSr5Wair5nrUjAr5/M2TK6Or5x:GcRur90fw149dRMRxj
TLSH T17D22C605B2598DF4188F993842CA35062909435B88E71178FD3ECD3E2FF95785262E7B
Reporter JAMESWT_WT
Tags:Earth Lusca Operations sh

Intelligence

File Origin
# of uploads :
1
# of downloads :
289
Origin country :
n/a
Vendor Threat Intelligence
Detection(s):
SecuriteInfo.com.Trojan.Linux.Generic.220039.28804.6848.UNOFFICIAL
Create hunting rule

Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c47be279811d4213298dc925ece7d87e9768a90705d4f8a3413d6e962d9fe6bc/
Threat name:
Script-Shell.Hacktool.Mimipenguin
Create hunting rule
Status:
Malicious
First seen:
2019-11-25 18:41:16 UTC
File Type:
Text (Shell)
AV detection:
15 of 43 (34.88%)
Threat level:
  1/5
Result
Malware family:
n/a
Score:
  1/10
Tags:
n/a
Link:
https://tria.ge/reports/220117-qacneaacb4/
Behaviour
Checks processor information in registry
Suspicious use of AdjustPrivilegeToken
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.52
Link:
https://yomi.yoroi.company/submissions/c47be279811d4213298dc925ece7d87e9768a90705d4f8a3413d6e962d9fe6bc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:mimipenguin_2
Create hunting rule
Author:Florian Roth
Description:Detects Mimipenguin hack tool
Reference:https://github.com/huntergregal/mimipenguin
Rule name:mimipenguin_2_RID2C44
Create hunting rule
Author:Florian Roth
Description:Detects Mimipenguin hack tool
Reference:https://github.com/huntergregal/mimipenguin
Rule name:Mimipenguin_SH
Create hunting rule
Author:Florian Roth
Description:Detects Mimipenguin Password Extractor - Linux
Reference:https://github.com/huntergregal/mimipenguin
Rule name:Mimipenguin_SH_RID2C8D
Create hunting rule
Author:Florian Roth
Description:Detects Mimipenguin Password Extractor - Linux
Reference:https://github.com/huntergregal/mimipenguin

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments