MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d77eef3f6cc6fb2c26fa27cc7360ef7c03482c672216ad960910f4b5a9c0ad4a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	d77eef3f6cc6fb2c26fa27cc7360ef7c03482c672216ad960910f4b5a9c0ad4a
SHA3-384 hash:	4494d9fd8e63ea39a2e4c4cea33e6e62d4fb879678fc89159819668844326f153bd620ea163d04ab6a947962ae0893bf
SHA1 hash:	639c4547b8ca2c2b3057952356743ac128f1f54e
MD5 hash:	75f91d565abc6c394781e85badbedf82
humanhash:	alpha-quiet-avocado-summer
File name:	l
Download:	download sample
File size:	912 bytes
First seen:	2024-12-19 09:56:14 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	12:7XOTtvmZPuXOpqXYcGFyZow4+ogbIAgEiJbmVLHeuET3VLHeuNK/VLHeu3:Twv53GFyZouvIyb+BZ+gA+M
TLSH	T14711558884663D68B0B2CCCDF2A38C06BE05D17E5D991A40BF4D947B8BAE6007054B8D
Magika	shell
Reporter	abuse_ch
Tags:	sh

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

81

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

Sanesecurity.Malware.30786.LX.BOT.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

90.2%

Link:

https://cyber-fortress.com/docs/result/index.php?id=676405648fb73f13afd1a2e7linux22vpnfull_triage

Tags:

virus

Hybrid Analysis Trojan[Downloader]/Shell.Agent

Verdict:

Malicious

Labled as:

Trojan[Downloader]/Shell.Agent

Link:

https://www.hybrid-analysis.com/sample/d77eef3f6cc6fb2c26fa27cc7360ef7c03482c672216ad960910f4b5a9c0ad4a

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Nucleon Malprob Benign

Score:

0%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/d77eef3f6cc6fb2c26fa27cc7360ef7c03482c672216ad960910f4b5a9c0ad4a

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d77eef3f6cc6fb2c26fa27cc7360ef7c03482c672216ad960910f4b5a9c0ad4a/

ReversingLabs TitaniumCloud Linux.Trojan.Vigorf

Threat name:

Linux.Trojan.Vigorf

Alert

Create hunting rule

Status:

Malicious

First seen:

2024-12-19 10:51:20 UTC

File Type:

Text (Shell)

AV detection:

12 of 23 (52.17%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=257o6p3my35syjx2e7ghgyhppqbuqldheilk3fqjcd2llkoavvfa._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

defense_evasion discovery execution linux persistence privilege_escalatio

Link:

https://tria.ge/reports/241219-nq5m1sspb1/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Changes its process name

Creates/modifies Cron job

Enumerates running processes

File and Directory Permissions Modification

Executes dropped EXE

Renames itself

Unexpected DNS network traffic destination

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/d77eef3f6cc6fb2c26fa27cc7360ef7c03482c672216ad960910f4b5a9c0ad4a