MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cdd30d23c1ec48ab87f7e187e107a102926951fce15f555c196921bf94f6875c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	cdd30d23c1ec48ab87f7e187e107a102926951fce15f555c196921bf94f6875c
SHA3-384 hash:	29598f77130afb45ba41495a700b465ebfb5c7f20ccfe8e22cd5f220706eae6849adcf619318aca086e6046a69e8bbaa
SHA1 hash:	70c2ff1cac259ebb21b248210772f6f1c67cac2c
MD5 hash:	16bdb0012eaca52e6646d51c2d3377ef
humanhash:	zebra-georgia-triple-grey
File name:	skid.sh
Download:	download sample
File size:	4'725 bytes
First seen:	2025-02-21 07:07:29 UTC
Last seen:	2025-02-22 14:47:10 UTC
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:8P9IuEK81LP9IuEK8XZP9IuEK8wP8IIPP9IuEK8GcP9IuEK8qCzlCOP9IuEK8kak:caWyCpCz8G+6V
TLSH	T10FA173D497ABD05F6B8E1D43DE08EE8E2469D73795C4F307CB98FA0E286A209C84C5C0
Magika	shell
Reporter	abuse_ch
Tags:	sh

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

64

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.JS.ScriptXE-inf.7959.3192.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

94.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67b8273128ab76d43a5c36aclinux22vpnfull_triage

Tags:

downloader mirai agent hype

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

evasive

Link:

https://www.filescan.io/uploads/67b8266352e8f36615519dca/reports/38c424b4-2386-40d7-ba6d-d8ecc2c93bac/overview

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Nucleon Malprob Benign

Score:

11%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/cdd30d23c1ec48ab87f7e187e107a102926951fce15f555c196921bf94f6875c

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/cdd30d23c1ec48ab87f7e187e107a102926951fce15f555c196921bf94f6875c/

ReversingLabs TitaniumCloud Win32.Trojan.Vigorf

Threat name:

Win32.Trojan.Vigorf

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-02-21 02:34:28 UTC

File Type:

Text (Shell)

AV detection:

7 of 24 (29.17%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=zxjq2i6b5rekxb7x4gd6cb5bakjgsup44fpvkxazneq37fhwq5oa._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

defense_evasion discovery linux

Link:

https://tria.ge/reports/250221-hx987awngp/

Behaviour

System Network Configuration Discovery

Writes file to tmp directory

Reads system network configuration

Reads system routing table

File and Directory Permissions Modification

Executes dropped EXE

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/cdd30d23c1ec48ab87f7e187e107a102926951fce15f555c196921bf94f6875c