🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 df7115e69f2918abfbc986403ba2cd5b273cef69685c24d9f06ceecd9a2a2e28. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: df7115e69f2918abfbc986403ba2cd5b273cef69685c24d9f06ceecd9a2a2e28
SHA3-384 hash: 1a1f0bae2fe6410d307069c29b3977ffe610cbe4e4b8f410d67f8eec3744f7653627a790fe263b5ea549a423c327691c
SHA1 hash: 2d161634df945072d149613829b5d7578e5722f8
MD5 hash: 18446970bdd94159ee7cbe5586abb6b6
humanhash: hamper-xray-glucose-arkansas
File name:hnap
Download: download sample
File size:2'905 bytes
First seen:2024-11-10 18:42:17 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 48:vnHWoHW6HWAHWiHWu9zEHWXHWaHW9HW4HWoHWuwUfHWbHWcHZ:vn2o262A2i2AE2X2a29242o2uwUf2b2g
TLSH T1F6518E84331203702FBDABA3B9BA4234F488F19567CA4F59D1EC68FC254DF4A26917D2
Magika shell
Reporter abuse_ch
Tags:sh

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
DE DE
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL
Create hunting rule

Verdict:
Clean
Score:
84.2%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6730fef30d3694d4fc4e70f9linux22vpnfull_triage
Tags:
malware
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/6730fecab3a9c717edb07f8d/reports/569e65f5-5e9a-43d5-ba09-20ad18a35057/overview
Score:
96%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/df7115e69f2918abfbc986403ba2cd5b273cef69685c24d9f06ceecd9a2a2e28
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/df7115e69f2918abfbc986403ba2cd5b273cef69685c24d9f06ceecd9a2a2e28/
Threat name:
Linux.Downloader.Medusa
Create hunting rule
Status:
Malicious
First seen:
2024-11-10 18:43:12 UTC
File Type:
Text (Shell)
AV detection:
17 of 24 (70.83%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=35yrlzu7femkx66jqzadxiwnlmttz33jnbocjwpqntxm3grkfyua._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/241110-xcxjxsshjc/
Behaviour
Reads runtime system information
System Network Configuration Discovery
Writes file to tmp directory
Checks CPU configuration
File and Directory Permissions Modification
Executes dropped EXE
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/df7115e69f29/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.33
Link:
https://yomi.yoroi.company/submissions/df7115e69f2918abfbc986403ba2cd5b273cef69685c24d9f06ceecd9a2a2e28

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Linux_Shellscript_Downloader
Create hunting rule
Author:albertzsigovits
Description:Generic Approach to Shellscript downloaders

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh df7115e69f2918abfbc986403ba2cd5b273cef69685c24d9f06ceecd9a2a2e28

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3285360/
  
Delivery method
Distributed via web download

Comments