MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0791f456de3f04a13cef7ab34156edee9bea3736087fc047513973d29eecac7c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0791f456de3f04a13cef7ab34156edee9bea3736087fc047513973d29eecac7c
SHA3-384 hash: 75aeabed568efc03c0dcb2622eab122eb47507dd9d1b43c84f8a61787b4377afd7f1c4b450917373cbd3079083bcc344
SHA1 hash: 70f18f58df3ebdccf9fcadaab5625ff1052cbf04
MD5 hash: 5ec5596e606e28f8e412414a5276f6e8
humanhash: kentucky-autumn-magnesium-johnny
File name:test.sh
Download: download sample
File size:123 bytes
First seen:2026-08-03 13:45:15 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 3:TKH/vzg3LcLVc/tvvjYuRebM3PjIWFW3lw2NNin:AzGc+/3RrjrFWwb
TLSH T160B02BE720061C00EFC8985974610170042378B304040AC8101700A43C282C0372A110
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Unknown
Threat level:
  0/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/6a709b7c2d4ff8fd0db013f4/reports/59311433-18ef-49e6-baa5-4f3594778807/overview
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/dc754b0e-e014-494f-aff3-53fef38464fa
Behavior Graph:
Download SVG
%3 guuid=e1c230de-1800-0000-8b52-1b87860a0000 pid=2694 /usr/bin/sudo guuid=fa675be0-1800-0000-8b52-1b87870a0000 pid=2695 /tmp/sample.bin guuid=e1c230de-1800-0000-8b52-1b87860a0000 pid=2694->guuid=fa675be0-1800-0000-8b52-1b87870a0000 pid=2695 execve guuid=112c01e1-1800-0000-8b52-1b87890a0000 pid=2697 /usr/bin/curl net guuid=fa675be0-1800-0000-8b52-1b87870a0000 pid=2695->guuid=112c01e1-1800-0000-8b52-1b87890a0000 pid=2697 execve e976bf79-fb8d-550d-a1fe-adb4c9a8e850 77.0.42.76:8000 guuid=112c01e1-1800-0000-8b52-1b87890a0000 pid=2697->e976bf79-fb8d-550d-a1fe-adb4c9a8e850 con
Score:
39%
Verdict:
Susipicious
File Type:
SCRIPT
Link:
https://malprob.io/report/0791f456de3f04a13cef7ab34156edee9bea3736087fc047513973d29eecac7c
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0791f456de3f04a13cef7ab34156edee9bea3736087fc047513973d29eecac7c/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=a6i7ivw6h4ckcphppkzucvxn52n6unzwbb74ar2rhfz5fhxmvr6a._file
Result
Malware family:
n/a
Score:
  4/10
Tags:
antivm discovery linux
Link:
https://tria.ge/reports/260803-raz95scq6z/
Behaviour
Reads runtime system information
Checks CPU configuration
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/0791f456de3f04a13cef7ab34156edee9bea3736087fc047513973d29eecac7c

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 0791f456de3f04a13cef7ab34156edee9bea3736087fc047513973d29eecac7c

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3896281/
  
Delivery method
Distributed via web download

Comments