MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 09a7115362e2a98454b8c8fa4b077a27f6f87e73e8875d40f9f90bbd5a360117. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	09a7115362e2a98454b8c8fa4b077a27f6f87e73e8875d40f9f90bbd5a360117
SHA3-384 hash:	64690769d0bb6f0782c376585a4300b654eaf93e67d209b75916d3dc047772e42af4421f35e2c4c657e423f6b3313dab
SHA1 hash:	88204890567b12f8debe5bc7d8f44743050ea526
MD5 hash:	a604fc3a49f221090d0855a56ce80fc7
humanhash:	failed-south-kilo-social
File name:	run.sh
Download:	download sample
File size:	916 bytes
First seen:	2026-05-24 18:35:04 UTC
Last seen:	2026-05-25 06:57:31 UTC
File type:	sh
MIME type:	text/x-shellscript
ssdeep	24:JMxMlaCLGVIMitMFYM4V+M4zLM/bIF8FMKMNWNZBN1htAza5:JMxqaCL6I7toYp+tLCzFw4dviza5
TLSH	T15A11E94BB823D067B00A653DDF5EF22476D720AF0260F984B84E5935AF2C129BC75797
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	BlinkzSec

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

55

Origin country :

US

Vendor Threat Intelligence

ACCE Unknown

No detections

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-05-24T15:51:00Z UTC

Last seen:

2026-05-26T01:30:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/09a7115362e2a98454b8c8fa4b077a27f6f87e73e8875d40f9f90bbd5a360117/results?tab=lookup

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/e5c5055c-91f2-4271-a19a-fde79059585e

Behavior Graph:

Download SVG

Nucleon Malprob Susipicious

Score:

69%

Verdict:

Susipicious

File Type:

SCRIPT

Link:

https://malprob.io/report/09a7115362e2a98454b8c8fa4b077a27f6f87e73e8875d40f9f90bbd5a360117

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/09a7115362e2a98454b8c8fa4b077a27f6f87e73e8875d40f9f90bbd5a360117/

Neiki Susipicious

Verdict:

Susipicious

Link:

https://tip.neiki.dev/file/09a7115362e2a98454b8c8fa4b077a27f6f87e73e8875d40f9f90bbd5a360117

ReversingLabs TitaniumCloud Win32.Trojan.Vigorf

Threat name:

Win32.Trojan.Vigorf

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-05-24 18:34:26 UTC

File Type:

Text (Shell)

AV detection:

5 of 38 (13.16%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=bgtrcu3c4kuyivfyzd5ewb32e73pq7tt5cdv2qhz7ef32wrwaelq._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

credential_access defense_evasion discovery linux

Link:

https://tria.ge/reports/260524-w8qktagx81/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Reads process memory

Enumerates running processes

File and Directory Permissions Modification

Executes dropped EXE

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.28

Link:

https://yomi.yoroi.company/submissions/09a7115362e2a98454b8c8fa4b077a27f6f87e73e8875d40f9f90bbd5a360117