MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 06273f12407f806c9225b90e0191839a7dcbb48aa5d84d320fbbad41e084941a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 5
| SHA256 hash: | 06273f12407f806c9225b90e0191839a7dcbb48aa5d84d320fbbad41e084941a |
|---|---|
| SHA3-384 hash: | 6c0c81fa680c8f8e262b7b3500b03d19618d0d3ba957d1175c949722842473d1d6b779900ab20b5e1dec42ffc89abf0f |
| SHA1 hash: | 75006ec1abe0b87d3d5f58057026069527f72b01 |
| MD5 hash: | bbed1c30c275fc80941d109fb26000fe |
| humanhash: | three-michigan-mike-potato |
| File name: | o.xml |
| Download: | download sample |
| File size: | 738 bytes |
| First seen: | 2025-09-17 21:17:34 UTC |
| Last seen: | Never |
| File type: | sh |
| MIME type: | text/plain |
| ssdeep | 12:FH8ioNJAC7ukxGWi2jU30+0K5+A+MjRQ2GDCn2GDoBjZhG+E6:FH8j/wWi2jz8TT2lf |
| TLSH | T18601D67DA1A88A5209B9C5C7F2F15506C441909BA2AA57E5F78D0926AF38CDE385320D |
| Magika | xml |
| Reporter |  abuse_ch |
| Tags: | sh |
Shell script dropper
This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.
| URL | Malware sample (SHA256 hash) | Signature | Tags |
|---|---|---|---|
| http://193.32.162.27/00101010101001/morte.x86 | n/a | n/a | elf ua-wget |
Intelligence
File Origin
# of uploads :
1
# of downloads :
50
Origin country :
DEVendor Threat Intelligence
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
evasive masquerade opendir
Verdict:
Malicious
Labled as:
TrojanDownloader/Linux.NetLoader
Verdict:
Unknown
File Type:
text
Status:
terminated
Behavior Graph:
Score:
0%
Verdict:
Benign
File Type:
SCRIPT
Threat name:
Script-JS.Trojan.Heuristic
Status:
Malicious
First seen:
2025-09-17 22:16:27 UTC
File Type:
Text
AV detection:
6 of 38 (15.79%)
Threat level:
2/5
Detection(s):
Suspicious file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
sh 06273f12407f806c9225b90e0191839a7dcbb48aa5d84d320fbbad41e084941a
(this sample)
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.