MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fc32a8db17841a08dd3ebccc23681f3fa47e0b9a1ac18ce2eb9bfd8ba4d9aca6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	fc32a8db17841a08dd3ebccc23681f3fa47e0b9a1ac18ce2eb9bfd8ba4d9aca6
SHA3-384 hash:	e35d36a320f99573f95edb94b668f64a7d0b27f16f8c833889c447126d64b24d11b7e99ecdac8e9fd9523d170a8b67b4
SHA1 hash:	fc771a582495538588c7b7ea5e6efec8e8013556
MD5 hash:	154ca9614aba4a99d038f230802ed484
humanhash:	eighteen-wisconsin-zebra-kilo
File name:	ol.sh
Download:	download sample
Signature	CoinMiner Alert Create hunting rule
File size:	191 bytes
First seen:	2026-11-06 19:20:20 UTC
Last seen:	2026-11-06 19:20:24 UTC
File type:	sh
MIME type:	text/x-shellscript
ssdeep	3:TKH4vGQXLIKFdabUX9K8SdTTbNpAkrAFcANqZzYbUX9KMDFP1d38ebUX9KNDSKbn:hP73Fd/4ZTHACdAyR4Q904ND5bn
TLSH	T11AC0126B1729DF322855CD08F17A7C37E19881D2578FE026F2A29812816C9417A463A1
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	Jerry1113
Tags:	CoinMiner cowrie honeypot sh

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

69

Origin country :

US

Vendor Threat Intelligence

ACCE Unknown

No detections

FileScan.io

Gathering data

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/3f652133-1d2b-45ab-8bd8-f3ee9f9821c9

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/fc32a8db17841a08dd3ebccc23681f3fa47e0b9a1ac18ce2eb9bfd8ba4d9aca6/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7qzkrwyxqqnarxj6xtgcg2a7h6sh4c42dlayzyxltp6yxjgzvsta._file

Hatching Triage xmrig_linux

Result

Malware family:

xmrig_linux

Alert

Create hunting rule

Score:

  10/10

Tags:

family:xmrig_linux antivm defense_evasion discovery linux miner

Link:

https://tria.ge/reports/261106-x2ny3s1t7q/

Behaviour

GoLang User-Agent

Enumerates kernel/hardware configuration

Reads runtime system information

Writes file to tmp directory

Checks CPU configuration

Reads CPU attributes

Checks hardware identifiers (DMI)

Reads hardware information

File and Directory Permissions Modification

Executes dropped EXE

Runs EXE from memory

Family: xmrig

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.39

Link:

https://yomi.yoroi.company/submissions/fc32a8db17841a08dd3ebccc23681f3fa47e0b9a1ac18ce2eb9bfd8ba4d9aca6