MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d38c1a2f7cff1e5188eb3cf98f0e515a82fd368d77229bec1c1d41c899ed2b62. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	d38c1a2f7cff1e5188eb3cf98f0e515a82fd368d77229bec1c1d41c899ed2b62
SHA3-384 hash:	3e1db83d40f56f4904d87f1c05294a66b934448086cd1656223b743d78988c7ed7331bffe6d266ef47c67d8a71554cd0
SHA1 hash:	61c182782ccf095ca1c164749c917ae2f94ee3ce
MD5 hash:	ef0db40d9e29034759d5000bcc418c08
humanhash:	oranges-connecticut-undress-quebec
File name:	dvr.lilin-rep.sh
Download:	download sample
Signature	Ngioweb Alert Create hunting rule
File size:	800 bytes
First seen:	2025-11-08 07:05:42 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	12:78CtbSECwbSECHbSECpbSECX6bSEChbSEC7bUbSEC7kUb/:p2pYSz6vt4W
TLSH	T1BE01218E351316B4E118EE4079A4FB0B511D834955807BE7A0981D37C3AD7497B45E79
Magika	txt
Reporter	abuse_ch
Tags:	sh

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

38

Origin country :

DE

Vendor Threat Intelligence

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

evasive mirai

Link:

https://www.filescan.io/uploads/690eebe78938e2fe2215c1a3/reports/48300eac-f877-465b-9099-44856e44f782/overview

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

unix shell

First seen:

2025-11-08T04:41:00Z UTC

Last seen:

2025-11-08T06:37:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/d38c1a2f7cff1e5188eb3cf98f0e515a82fd368d77229bec1c1d41c899ed2b62/results?tab=lookup

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/3e544334-1989-4156-a28e-407e624514c4

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/d38c1a2f7cff1e5188eb3cf98f0e515a82fd368d77229bec1c1d41c899ed2b62

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d38c1a2f7cff1e5188eb3cf98f0e515a82fd368d77229bec1c1d41c899ed2b62/

ReversingLabs TitaniumCloud Linux.Trojan.Generic

Threat name:

Linux.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2025-11-08 07:06:16 UTC

File Type:

Text (Shell)

AV detection:

11 of 24 (45.83%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=2ogbul3474pfdchlht4y6dsrlkbp2nuno4rjx3a4dva4rgpnfnra._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

n/a

Link:

https://tria.ge/reports/251108-hw58vavjbt/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/d38c1a2f7cff1e5188eb3cf98f0e515a82fd368d77229bec1c1d41c899ed2b62