MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 03d0cfae6ac54701c201673ecbdef024176f54536e38fc773a2ff7fbe7ea071a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 3

Intelligence 3 IOCs YARA 1 File information Comments

SHA256 hash:	03d0cfae6ac54701c201673ecbdef024176f54536e38fc773a2ff7fbe7ea071a
SHA3-384 hash:	f49b90293461317e3a52f06d9248015b7aea8fd23d3147c68f523ae0b24f4403401bf371f81cfd00584ce6893e616f2d
SHA1 hash:	f85e15f78974309df1d18bbfb2ec47db357d2e97
MD5 hash:	0ccf8c0fc7b4f81d3c7e7d3046c65d2f
humanhash:	hawaii-hawaii-ohio-arkansas
File name:	run.sh
Download:	download sample
File size:	748 bytes
First seen:	2026-10-27 08:35:44 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	12:Izzfsx80+aLLeHt4LZ/uPfFFHsFQzBct7j3FAVkVFhx:o5TaOHt4LUnF1GQzqt7phx
TLSH	T14B0194AB65B0AC3068A9CA3CFE9786B0104B142768042909709F6E04EF2CE4CF2A2656
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	BlinkzSec

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

SecuriteInfo.com.Linux.DownLoader.2650.23332.15826.UNOFFICIAL

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/67e50e7d-92c9-40f5-8e90-f793dd3f10db

Behavior Graph:

Download SVG

Score:

94%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/03d0cfae6ac54701c201673ecbdef024176f54536e38fc773a2ff7fbe7ea071a

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/03d0cfae6ac54701c201673ecbdef024176f54536e38fc773a2ff7fbe7ea071a/

Gathering data

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=apim7ltkyvdqdqqbm47mxxxqeqlw6vctny4py5z2f737xz7ka4na._file

Result

Malware family:

n/a

Score:

7/10

Tags:

defense_evasion discovery linux

Link:

https://tria.ge/reports/261027-khpp2scw9p/

Behaviour

System Network Configuration Discovery

Writes file to tmp directory

File and Directory Permissions Modification

Executes dropped EXE

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.36

Link:

https://yomi.yoroi.company/submissions/03d0cfae6ac54701c201673ecbdef024176f54536e38fc773a2ff7fbe7ea071a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	LIN_Sample_Unique_c0082a64 Create hunting rule
Author:	Marjoriefort
Description:	Specimen unique (soumission Bazaar) - strings distinctifs propres au sample
Reference:	c0082a64f364cb6dc9be6a9f8ff2f6313a0377e3a87d864d9e5dbe40003acb59.sh

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample