MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 04f5fcefc87a68013bf72af04c69f5dfc4944df9d2e990191ea06dcea0ae8ee2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	04f5fcefc87a68013bf72af04c69f5dfc4944df9d2e990191ea06dcea0ae8ee2
SHA3-384 hash:	39636902666a7988ee3bfdcdc84ab1132ec49f200ad356c5bd7299367151b8b49cec4010c59b851023c472ada51136ad
SHA1 hash:	ae33ab6307af165a3eb1fe2db35b5956903c3f28
MD5 hash:	452939c3e11fc95c6e64b41762e66a98
humanhash:	echo-bluebird-green-magazine
File name:	tftp.sh
Download:	download sample
File size:	561 bytes
First seen:	2026-03-25 03:57:36 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	6:eJKbFbXNgzWzXazizXbmTaGaXd6agaX1LKiev:eJKbFbXNgzWzX4gX+aGaXdDVX1LKVv
TLSH	T145F03C773BA02A324744D85AD301C9FA7E67E0A08A2388C1259506F7BD714C4ECE4ABD
Magika	txt
Reporter	abuse_ch
Tags:	sh

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

51

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.BV.Downloader-AEH.12342983.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

busybox

Link:

https://www.filescan.io/uploads/69c35d5a5229aae88c84f0d7/reports/5899e662-2e71-49bf-aaf5-b4c50889374f/overview

Kaspersky OpenTIP Clean

Verdict:

Clean

File Type:

text

Link:

https://opentip.kaspersky.com/04f5fcefc87a68013bf72af04c69f5dfc4944df9d2e990191ea06dcea0ae8ee2/results?tab=lookup

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/ea3771f6-54c7-4210-b7be-43055666c322

Behavior Graph:

Download SVG

Nucleon Malprob Susipicious

Score:

33%

Verdict:

Susipicious

File Type:

SCRIPT

Link:

https://malprob.io/report/04f5fcefc87a68013bf72af04c69f5dfc4944df9d2e990191ea06dcea0ae8ee2

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/04f5fcefc87a68013bf72af04c69f5dfc4944df9d2e990191ea06dcea0ae8ee2/

Neiki Clean

Verdict:

Clean

Link:

https://tip.neiki.dev/file/04f5fcefc87a68013bf72af04c69f5dfc4944df9d2e990191ea06dcea0ae8ee2

ReversingLabs TitaniumCloud Text.Browser.Generic

Threat name:

Text.Browser.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2026-03-25 03:58:25 UTC

File Type:

Text (Shell)

AV detection:

1 of 36 (2.78%)

Threat level:

  4/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=at27z36ipjuaco7xflyey2pv37cjitpz2luzagi6ubw45ifor3ra._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

n/a

Link:

https://tria.ge/reports/260325-ejmzysez9r/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/04f5fcefc87a68013bf72af04c69f5dfc4944df9d2e990191ea06dcea0ae8ee2