MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e4e170691634d841e8976ae918d2df223feb359db7f4b1c11a6669618bce648d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	e4e170691634d841e8976ae918d2df223feb359db7f4b1c11a6669618bce648d
SHA3-384 hash:	08879c4332a452997551d92c421e18c8e2e0f902ff670da74d4772b03462920a0fe158d9eacab6dcc2142f6e033dd0ae
SHA1 hash:	79e4ff489199690881a5178dcbce65ce0b5a83ec
MD5 hash:	4c7c33f3c94eb1f64d90a549c379e0ce
humanhash:	oregon-snake-freddie-table
File name:	bolts
Download:	download sample
Signature	CoinMiner Alert Create hunting rule
File size:	1'071 bytes
First seen:	2025-12-06 06:15:09 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	24:wdfGyZ1rFy/iKbpJnHOjWIEQXi/rvsTI0jpXnn:sGc1GH6ECltXn
TLSH	T1981154CAA061DC70389C40BCE2865051754A9FBB04D58854B80F367E3F54169F53C73B
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	CoinMiner sh

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

35

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

busybox

Link:

https://www.filescan.io/uploads/6933c9fbbc15eab491f5c561/reports/186c15a9-ca9d-47af-a037-dbbddc33ba43/overview

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

unix shell

First seen:

2025-12-06T06:12:00Z UTC

Last seen:

2025-12-06T06:44:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/e4e170691634d841e8976ae918d2df223feb359db7f4b1c11a6669618bce648d/results?tab=lookup

Kunai Sandbox

Status:

Failed

Link:

https://sandbox.kunai.rocks/analysis/0c989f37-dbcf-45f3-a1b8-b334b797cf22

Nucleon Malprob Susipicious

Score:

67%

Verdict:

Susipicious

File Type:

SCRIPT

Link:

https://malprob.io/report/e4e170691634d841e8976ae918d2df223feb359db7f4b1c11a6669618bce648d

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e4e170691634d841e8976ae918d2df223feb359db7f4b1c11a6669618bce648d/

ReversingLabs TitaniumCloud Win32.Trojan.Vigorf

Threat name:

Win32.Trojan.Vigorf

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-12-06 06:15:24 UTC

File Type:

Text (Shell)

AV detection:

4 of 24 (16.67%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=4tqxa2iwgtmed2exnlurruw7ei76wnm5w72ldqi2mzuwdc6omsgq._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

defense_evasion discovery linux upx

Link:

https://tria.ge/reports/251206-gz328atrdt/

Behaviour

Reads runtime system information

Writes file to tmp directory

Reads CPU attributes

UPX packed file

Enumerates running processes

File and Directory Permissions Modification

Executes dropped EXE

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/e4e170691634d841e8976ae918d2df223feb359db7f4b1c11a6669618bce648d