MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 eece9cdbc73eb1580c67ece7a9ef15da0bb6d087746ea7d602b6fa928f5dedd5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	eece9cdbc73eb1580c67ece7a9ef15da0bb6d087746ea7d602b6fa928f5dedd5
SHA3-384 hash:	8d18b0e1cd79ae7569f85ec5f6a67719a71279de58a0dbc964f1f01f17266bb849cff97476550189d11a49c3b4a36b0c
SHA1 hash:	97db7e55d8e39803fa9534204594a595529eca73
MD5 hash:	25a7814863dd354a01cfd6baf43b95ff
humanhash:	lemon-utah-maine-early
File name:	bins.sh
Download:	download sample
Signature	Xorbot Alert Create hunting rule
File size:	10'578 bytes
First seen:	2025-01-04 13:21:45 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	192:/919DjWKEU3nHNB1nm+bNmvWh619DjWKrB1nm+1a:/ZEU3nHZkvWh6M
TLSH	T10E2242CB33D19335D1D18A952AB2D1C4E102E9C6F9C72FCED8CBAEE46584F967858E10
Magika	shell
Reporter	abuse_ch
Tags:	sh Xorbot

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

93

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL

Alert

Create hunting rule

Sanesecurity.Malware.30787.LX.BOT.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

93.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=677936cc74a2bd296e26984alinux22vpnfull_triage

Tags:

mirai virus shell

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

anti-debug busybox evasive lolbin remote

Link:

https://www.filescan.io/uploads/6779360777ce8aa8aed701b4/reports/6de1328a-3998-4d71-bb0b-0c3fbe5e67a2/overview

InQuest UNKNOWN

Result

Verdict:

UNKNOWN

Nucleon Malprob Benign

Score:

0%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/eece9cdbc73eb1580c67ece7a9ef15da0bb6d087746ea7d602b6fa928f5dedd5

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/eece9cdbc73eb1580c67ece7a9ef15da0bb6d087746ea7d602b6fa928f5dedd5/

ReversingLabs TitaniumCloud Win32.Trojan.Mirai

Threat name:

Win32.Trojan.Mirai

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-01-04 13:22:11 UTC

File Type:

Text (Shell)

AV detection:

14 of 38 (36.84%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=53hjzw6hh2yvqddh5tt2t3yv3if3nuehorxkpvqcw35jfd255xkq._file

Hatching Triage xorbot

Result

Malware family:

xorbot

Alert

Create hunting rule

Score:

  10/10

Tags:

family:xorbot antivm botnet defense_evasion discovery execution linux persistence privilege_escalatio trojan

Link:

https://tria.ge/reports/250104-ql8j8a1lbw/

Behaviour

Reads runtime system information

Writes file to tmp directory

Checks CPU configuration

Creates/modifies Cron job

Enumerates running processes

File and Directory Permissions Modification

Executes dropped EXE

Renames itself

Contacts a large (2111) amount of remote hosts

Creates a large amount of network flows

Detects Xorbot

Xorbot

Xorbot family

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/eece9cdbc73eb1580c67ece7a9ef15da0bb6d087746ea7d602b6fa928f5dedd5