MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 eccb81440eb3aa2940c53c582bb0f6156ac0b697bf1312b6e7b0d145331d36dc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	eccb81440eb3aa2940c53c582bb0f6156ac0b697bf1312b6e7b0d145331d36dc
SHA3-384 hash:	22735761be2b75a96018ffaae55c640683529e4079f91522d4112291dce5e21da44b23f23ff1898015c734cb0a8eba75
SHA1 hash:	fa90a5775f7ccd42687d95bbf386813e6d0ee35c
MD5 hash:	8ea1846c9bb78f058941b4c5aa52671e
humanhash:	tennis-network-march-april
File name:	sex.sh
Download:	download sample
Signature	CoinMiner Alert Create hunting rule
File size:	1'621 bytes
First seen:	2025-12-10 15:34:36 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:rycTBQfio8SqH3g6uCO8R+nTNbt8S8gEapvnL:QqHQ68MwT1t8SdPpD
TLSH	T112314212E6E054F46E4F4178ADAA3300383A604B9D49FB5530FC21615FF85134737EB6
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	CoinMiner sh

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

60

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.not-a-virus.HEUR.Downloader.Shell.Miner.a.3404.9520.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

miner monero xmrig

Link:

https://www.filescan.io/uploads/6939934e07486fde6751b97c/reports/ce77e81c-6175-42e9-a479-71d9af618d5c/overview

Kaspersky OpenTIP Adware

Verdict:

Adware

File Type:

unix shell

First seen:

2025-12-05T06:51:00Z UTC

Last seen:

2025-12-07T07:15:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/eccb81440eb3aa2940c53c582bb0f6156ac0b697bf1312b6e7b0d145331d36dc/results?tab=lookup

Kunai Sandbox

Status:

Failed

Link:

https://sandbox.kunai.rocks/analysis/1a24b1a3-9cf3-4f31-9246-bd92b0152510

Nucleon Malprob Benign

Score:

7%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/eccb81440eb3aa2940c53c582bb0f6156ac0b697bf1312b6e7b0d145331d36dc

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/eccb81440eb3aa2940c53c582bb0f6156ac0b697bf1312b6e7b0d145331d36dc/

ReversingLabs TitaniumCloud Script-Shell.Coinminer.XMRig

Threat name:

Script-Shell.Coinminer.XMRig

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-12-07 02:12:59 UTC

File Type:

Text (Shell)

AV detection:

6 of 24 (25.00%)

Threat level:

  4/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=5tfycraowovcsqgfhrmcxmhwcvvmbnuxx4jrfnxhwdiukmy5g3oa._file

Hatching Triage xmrig_linux

Result

Malware family:

xmrig_linux

Alert

Create hunting rule

Score:

  10/10

Tags:

family:xmrig family:xmrig_linux antivm defense_evasion discovery linux miner persistence privilege_escalation

Link:

https://tria.ge/reports/251210-s1k4ksynal/

Behaviour

Enumerates kernel/hardware configuration

Reads runtime system information

Writes file to tmp directory

Checks CPU configuration

Modifies systemd

File and Directory Permissions Modification

Executes dropped EXE

XMRig Miner payload

Xmrig family

Xmrig_linux family

xmrig

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.10

Link:

https://yomi.yoroi.company/submissions/eccb81440eb3aa2940c53c582bb0f6156ac0b697bf1312b6e7b0d145331d36dc