MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ccee52f06f69d32d9f2843b3dc1ee45f2a701df5851ad7a79522a7da69858d43. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	ccee52f06f69d32d9f2843b3dc1ee45f2a701df5851ad7a79522a7da69858d43
SHA3-384 hash:	29ce99fde7d1b129b259540a58cbe1fd21135e00c65cefbe3572b02bd3c29e60f19dbedbd6f001109d84e5bf9319c69e
SHA1 hash:	1beaf46b0312bb0515f8f54ed1acdcee5403a02c
MD5 hash:	1c42330804f42d609925133cd9e6bba3
humanhash:	leopard-emma-high-uranus
File name:	fyd
Download:	download sample
Signature	Gafgyt Alert Create hunting rule
File size:	1'500 bytes
First seen:	2025-02-23 11:42:08 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	24:wSB05ZkFB0GsSqButroB4A8QiB4V0B+5I7qB4J0B0X9sMBKh+QBjmfTtBE3hsB+Q:z57iH4R5+g6p83KlyECB
TLSH	T132316FCAA2E61FB68CC4C60736D2683C306C48D62E575ECCFCAE64EC7744B92B014D42
Magika	shell
Reporter	abuse_ch
Tags:	sh

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

16

Origin country :

US

Vendor Threat Intelligence

CyberFortress Malicious

Verdict:

Malicious

Score:

93.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67bb28fe28ab76d43a5c9c6elinux22vpnfull_triage

Tags:

phishing backdoor trojan overt

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

busybox evasive

Link:

https://www.filescan.io/uploads/67bb09a13afc3763bec248f1/reports/ea03d18f-4360-491f-888c-8cdfa1169ffe/overview

Hybrid Analysis Downloader/Shell.Generic

Verdict:

Malicious

Labled as:

Downloader/Shell.Generic

Link:

https://www.hybrid-analysis.com/sample/ccee52f06f69d32d9f2843b3dc1ee45f2a701df5851ad7a79522a7da69858d43

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Nucleon Malprob Malware

Score:

96%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/ccee52f06f69d32d9f2843b3dc1ee45f2a701df5851ad7a79522a7da69858d43

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/ccee52f06f69d32d9f2843b3dc1ee45f2a701df5851ad7a79522a7da69858d43/

ReversingLabs TitaniumCloud Win32.Trojan.Gafgyt

Threat name:

Win32.Trojan.Gafgyt

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-02-23 13:56:10 UTC

File Type:

Text (Shell)

AV detection:

11 of 38 (28.95%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ztxff4dpnhjs3hziioz5yhxel4vhahpvqunnpj4vekt5u2mfrvbq._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

defense_evasion discovery linux

Link:

https://tria.ge/reports/250223-q8n44a1ldq/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Changes its process name

Reads system network configuration

Enumerates active TCP sockets

File and Directory Permissions Modification

Executes dropped EXE

Unexpected DNS network traffic destination

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

0.90

Link:

https://yomi.yoroi.company/submissions/ccee52f06f69d32d9f2843b3dc1ee45f2a701df5851ad7a79522a7da69858d43