MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cbdcbafdb2650a0b30758cf20213ce31ee97e7181ac8b3cafad20301d8463ffd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	cbdcbafdb2650a0b30758cf20213ce31ee97e7181ac8b3cafad20301d8463ffd
SHA3-384 hash:	4fa49116f24feac45410bc85aa60ad020313777787499addc772081be0f09db955afd59b637925b4f2bec8a0a87318f8
SHA1 hash:	d0bf3c211064256be2764091c3bc262dbff18a8d
MD5 hash:	ac1413dd7c518736aba1c3b9b56126e1
humanhash:	massachusetts-stream-crazy-lamp
File name:	huh
Download:	download sample
File size:	3'150 bytes
First seen:	2025-01-08 09:26:11 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	96:ncX6XecXvXQcXCX+cXiX+hcXBXwcXIXecXvXscXNXOcX2X2cXZXebRUTWIuNi8LQ:cqnfByHSOuxh4nfFd3mfpulfo
TLSH	T18851A9EA16810C762BD29D15F1E94944F644D1E229CF2EC8E4EC38F6A29DDC47580FBB
Magika	shell
Reporter	abuse_ch
Tags:	sh

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

87

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

95.7%

Link:

https://cyber-fortress.com/docs/result/index.php?id=677e7866c029bd73f286d9aalinux22vpnfull_triage

Tags:

trojandownloader downloader agent

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-debug

Link:

https://www.filescan.io/uploads/677e44e631491fc04760d5a3/reports/a5b2ecda-7900-4880-b384-176d05218eea/overview

Hybrid Analysis Linux.Medusa.C.Generic

Verdict:

Malicious

Labled as:

Linux.Medusa.C.Generic

Link:

https://www.hybrid-analysis.com/sample/cbdcbafdb2650a0b30758cf20213ce31ee97e7181ac8b3cafad20301d8463ffd

Nucleon Malprob Malware

Score:

76%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/cbdcbafdb2650a0b30758cf20213ce31ee97e7181ac8b3cafad20301d8463ffd

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/cbdcbafdb2650a0b30758cf20213ce31ee97e7181ac8b3cafad20301d8463ffd/

ReversingLabs TitaniumCloud Linux.Downloader.Medusa

Threat name:

Linux.Downloader.Medusa

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-01-08 10:05:30 UTC

File Type:

Text (Shell)

AV detection:

17 of 24 (70.83%)

Threat level:

  3/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=zpolv7nsmufawmdvrtzaee6oghxjpzyydlelhsx22ibqdwcgh76q._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

discovery

Link:

https://tria.ge/reports/250108-qab2watjfl/

Behaviour

Modifies registry class

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/cbdcbafdb2650a0b30758cf20213ce31ee97e7181ac8b3cafad20301d8463ffd