MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f1ddd8063122975e6e69703d7f0c6b195045809f574c3302d1e31fe9c0380fd2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	f1ddd8063122975e6e69703d7f0c6b195045809f574c3302d1e31fe9c0380fd2
SHA3-384 hash:	01c4e3ffb1bda9235c283af50ed12ce606845e8543033e187157d29993941fed85780d21e749afe0b7509bf3ed1a5e16
SHA1 hash:	e62698dcc5078d8b21b93f12ba6d25fcf387f8b1
MD5 hash:	c89aec39fe2d834458b85196e37e2361
humanhash:	cola-football-cardinal-triple
File name:	nop
Download:	download sample
Signature	Mirai Alert Create hunting rule
File size:	368 bytes
First seen:	2025-03-24 15:07:31 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	6:hQtIIXbWU3AFFW84MvUFJXbWU3AQF884MvUFJXbWU3ATFW84MvUFJXbWU3AV84Mz:CtIkP3A/WDMvUFFP3AQ8DMvUFFP3ATM/
TLSH	T107E01AFE115229DC440E781AA3DE4404D2D0C28E2293EB18BDEF2E758A8E6817813FCC
Magika	shell
Reporter	abuse_ch
Tags:	sh

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

84

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Linux.Downloader-36.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

96.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67e18654bb84e066269e7cb8linux22vpnfull_triage

Tags:

mirai agent virus hype

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

evasive

Link:

https://www.filescan.io/uploads/67e17567a08e28b31da191a1/reports/0597ba2a-a605-4de3-a685-ecc955d4746b/overview

Hybrid Analysis HTML/ExpKit.Gen2

Verdict:

Malicious

Labled as:

HTML/ExpKit.Gen2

Link:

https://www.hybrid-analysis.com/sample/f1ddd8063122975e6e69703d7f0c6b195045809f574c3302d1e31fe9c0380fd2

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Nucleon Malprob Benign

Score:

0%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/f1ddd8063122975e6e69703d7f0c6b195045809f574c3302d1e31fe9c0380fd2

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f1ddd8063122975e6e69703d7f0c6b195045809f574c3302d1e31fe9c0380fd2/

ReversingLabs TitaniumCloud Document-HTML.Downloader.Heuristic

Threat name:

Document-HTML.Downloader.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-03-24 16:06:34 UTC

AV detection:

7 of 24 (29.17%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=6ho5qbrreklv43tjoa6x6ddldfielae7k5gdgawr4mp6tqbyb7ja._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  9/10

Tags:

credential_access defense_evasion discovery linux

Link:

https://tria.ge/reports/250324-tnh9wswlx4/

Behaviour

Reads runtime system information

Writes file to tmp directory

Changes its process name

Reads process memory

Enumerates running processes

File and Directory Permissions Modification

Executes dropped EXE

Renames itself

Contacts a large (31709) amount of remote hosts

Creates a large amount of network flows

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/f1ddd8063122975e6e69703d7f0c6b195045809f574c3302d1e31fe9c0380fd2