MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0d7fd4d7f637e1f8c492fd41a675b03cce3fa1f7601bf4e9fc8703cce1da259f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	0d7fd4d7f637e1f8c492fd41a675b03cce3fa1f7601bf4e9fc8703cce1da259f
SHA3-384 hash:	56ce90e7aa79ceda8d7d303c319cab346c6d031b300244a5925af706f67535e2d8883ae4a5dad1e9fe9087afa2eb5894
SHA1 hash:	7f92c229ef7e8bba3f75b54b8932085861d589f7
MD5 hash:	7c2194e9b4b3f5b3ac96d19a484f0dd6
humanhash:	oven-quebec-september-double
File name:	0d7fd4d7f637e1f8c492fd41a675b03cce3fa1f7601bf4e9fc8703cce1da259f
Download:	download sample
Signature	Prometei Alert Create hunting rule
File size:	573 bytes
First seen:	2026-07-26 12:35:36 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	6:hgfIRVFUYihyAl3a061AslIk0oHkcYuZ9IWoNbKY3FPLa240QFhRSqWq7v/F58rP:MIIhyy3w1vlI7/H2/NdMI8n8aLl6pE
TLSH	T173F081C1E03408349A926131914275D8ADA558AB742091686CFF8970F57E5143AD7AE4
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	c2hunter
Tags:	Prometei sh wraith

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

63

Origin country :

US

Vendor Threat Intelligence

ACCE Unknown

No detections

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

busybox

Link:

https://www.filescan.io/uploads/6a65ff221a6feb388570ba76/reports/7e8404c3-ba1d-498f-ad2c-c19b7a665161/overview

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-07-25T21:45:00Z UTC

Last seen:

2026-07-26T08:23:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/0d7fd4d7f637e1f8c492fd41a675b03cce3fa1f7601bf4e9fc8703cce1da259f/results?tab=lookup

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/06d791db-85dd-4cf9-8834-349240dd5a1c

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

14%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/0d7fd4d7f637e1f8c492fd41a675b03cce3fa1f7601bf4e9fc8703cce1da259f

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/0d7fd4d7f637e1f8c492fd41a675b03cce3fa1f7601bf4e9fc8703cce1da259f/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=bv75jv7wg7q7rres7va2m5nqhthd7ipxman7j2p4q4b4zyo2ewpq._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

defense_evasion discovery linux

Link:

https://tria.ge/reports/260726-psrplsgm21/

Behaviour

System Network Configuration Discovery

Writes file to tmp directory

File and Directory Permissions Modification

Executes dropped EXE

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.31

Link:

https://yomi.yoroi.company/submissions/0d7fd4d7f637e1f8c492fd41a675b03cce3fa1f7601bf4e9fc8703cce1da259f