MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e72a398b024d8247b5950cf9326a354054b46247d24c657e360fd305b05d4ef1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	e72a398b024d8247b5950cf9326a354054b46247d24c657e360fd305b05d4ef1
SHA3-384 hash:	4784b2ae4107e7d5e316d9ea04abad87c91d93f1a1b596bac08c78253dbc596cbb4de451cef947df8c5ef9d9ca8f249c
SHA1 hash:	b290d669cf5298d14018f3ce33f04d6ae16a0f1f
MD5 hash:	9491f04760a51b88480f190724917535
humanhash:	william-wisconsin-equal-rugby
File name:	scan.sh
Download:	download sample
File size:	503 bytes
First seen:	2024-12-24 16:36:19 UTC
Last seen:	2024-12-25 14:00:17 UTC
File type:	sh
MIME type:	text/x-shellscript
ssdeep	12:p79T+5HavbQ/piOKMvzO00YAH+KN7RcLHWrexy0oo7Ch:pVeavbk/rvzt8Hxla2rhVh
TLSH	T159F059916735E0754E0B43348A6656002BAD3580298CF2181AEE069AEAC1D0F61FDD37
Magika	shell
Reporter	abuse_ch
Tags:	sh

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

93

Origin country :

DE

Vendor Threat Intelligence

CyberFortress Malicious

Verdict:

Malicious

Score:

91.7%

Link:

https://cyber-fortress.com/docs/result/index.php?id=676ae32f75bf3268d2fe435blinux22vpnfull_triage

Tags:

agent hype sage

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

expand lolbin

Link:

https://www.filescan.io/uploads/676ae33b8134167603979e87/reports/27060738-9878-4b60-bbf0-78bde3e7d9f2/overview

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Nucleon Malprob Benign

Score:

0%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/e72a398b024d8247b5950cf9326a354054b46247d24c657e360fd305b05d4ef1

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e72a398b024d8247b5950cf9326a354054b46247d24c657e360fd305b05d4ef1/

ReversingLabs TitaniumCloud Text.Network.Scanner

Threat name:

Text.Network.Scanner

Alert

Create hunting rule

Status:

Malicious

First seen:

2024-12-24 16:37:04 UTC

File Type:

Text (Shell)

AV detection:

1 of 38 (2.63%)

Threat level:

  3/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=44vdtcycjwbepnmvbt4te2rvibkliysh2jggk7rwb7jqlmc5j3yq._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

antivm credential_access defense_evasion discovery execution linux persistence privilege_escalation

Link:

https://tria.ge/reports/241224-t4ss9sslcp/

Behaviour

Software Deployment Tools

Enumerates kernel/hardware configuration

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Checks CPU configuration

Deletes log files

Modifies systemd

Write file to user bin folder

File and Directory Permissions Modification

OS Credential Dumping

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/e72a398b024d8247b5950cf9326a354054b46247d24c657e360fd305b05d4ef1