MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e5fc851b0e3ed667cbd7e2a1452450eccd6f6ce99e086c4a06ce7ed665944796. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	e5fc851b0e3ed667cbd7e2a1452450eccd6f6ce99e086c4a06ce7ed665944796
SHA3-384 hash:	cb42c94eddfba2bc23caebfb5062149f97222f865eceba9255484a44fd90e3d4f1e30c8083c7d4e7b414e16172d50c95
SHA1 hash:	2c93699988ef89f31624552be514c9df20cf9094
MD5 hash:	72ec6236779400f333407933ee5759e9
humanhash:	apart-mango-nebraska-equal
File name:	to
Download:	download sample
Signature	Gafgyt Alert Create hunting rule
File size:	360 bytes
First seen:	2024-12-25 11:41:20 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	6:LMFAUfNqmJoeFKVMFAUoNMbxVzKVMFAUktFaKLKi1CKVMFAUoN8ftQzKVMFAUfNe:oASE1eFKKA1NMbDmKAPtcKLKBKKA1N8Z
TLSH	T1D4E0D1D5721016D24846AE1C7227CCE5A9D3D2C8F3A00F1D78CC066EB4FC831F12DA80
Magika	shell
Reporter	abuse_ch
Tags:	sh

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

84

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Linux.Downloader-34.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

70%

Link:

https://cyber-fortress.com/docs/result/index.php?id=676bf0c075bf3268d2fe637clinux22vpnfull_triage

Tags:

mirai

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-debug

Link:

https://www.filescan.io/uploads/676befa3a561e5a2873a496b/reports/31fe3cde-8807-4376-b4c8-1cf615760f5e/overview

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Nucleon Malprob Malware

Score:

88%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/e5fc851b0e3ed667cbd7e2a1452450eccd6f6ce99e086c4a06ce7ed665944796

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e5fc851b0e3ed667cbd7e2a1452450eccd6f6ce99e086c4a06ce7ed665944796/

ReversingLabs TitaniumCloud Linux.Downloader.Generic

Threat name:

Linux.Downloader.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2024-12-25 11:47:06 UTC

File Type:

Text (Python)

AV detection:

3 of 38 (7.89%)

Threat level:

  3/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=4x6ikgyoh3lgps6x4kqukjcq5tgw63hjtyegysqgzz7nmzmui6la._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

discovery

Link:

https://tria.ge/reports/241225-nxvrdsspbk/

Behaviour

Modifies registry class

Suspicious behavior: GetForegroundWindowSpam

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/e5fc851b0e3ed667cbd7e2a1452450eccd6f6ce99e086c4a06ce7ed665944796