🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 10fc2abebb54ae640f29cefc6c4bbfce1345a1f8aa4dd2c264f9ded0743d08f9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 2


Intelligence 2 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 10fc2abebb54ae640f29cefc6c4bbfce1345a1f8aa4dd2c264f9ded0743d08f9
SHA3-384 hash: 18247ce75d201d3c21d3cb9a99f63d25d97e46f04e8bcb6dda6303f41aae953daf4a8e19153716cadde89fc82bca33b0
SHA1 hash: 737aad6f3c72c0d330d97a731b1006d4beb8d75a
MD5 hash: 7e90120af167cb54a80cc2e7c2ee7629
humanhash: high-fanta-wisconsin-comet
File name:run.sh
Download: download sample
File size:444 bytes
First seen:2026-11-14 06:50:53 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 12:ibGGMalcGEOmAzqXjjInBHjbmvbZYoWn2ciHvX4aWnux:ibGel0OnzqXWbiHvXL
TLSH T1DFF0AB915031F974C9A6880A398B4330D5B7A5CAE5C0375DF3AF2792ED0830AF218F0C
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter Latin

Intelligence

File Origin
# of uploads :
1
# of downloads :
9
Origin country :
US US
Vendor Threat Intelligence
No detections
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/bad66f17-5bb2-4583-9990-e0a591117858
Behavior Graph:
Download SVG
%3 guuid=b90fe192-2200-0000-42fb-3dba900b0000 pid=2960 /usr/bin/sudo guuid=25cd8c96-2200-0000-42fb-3dba960b0000 pid=2966 /tmp/sample.bin guuid=b90fe192-2200-0000-42fb-3dba900b0000 pid=2960->guuid=25cd8c96-2200-0000-42fb-3dba960b0000 pid=2966 execve guuid=0d031197-2200-0000-42fb-3dba980b0000 pid=2968 /usr/bin/timeout guuid=25cd8c96-2200-0000-42fb-3dba960b0000 pid=2966->guuid=0d031197-2200-0000-42fb-3dba980b0000 pid=2968 execve guuid=43e4c197-2200-0000-42fb-3dba9c0b0000 pid=2972 /usr/bin/timeout guuid=25cd8c96-2200-0000-42fb-3dba960b0000 pid=2966->guuid=43e4c197-2200-0000-42fb-3dba9c0b0000 pid=2972 execve guuid=3d1f9297-2200-0000-42fb-3dba9b0b0000 pid=2971 /usr/bin/timeout guuid=0d031197-2200-0000-42fb-3dba980b0000 pid=2968->guuid=3d1f9297-2200-0000-42fb-3dba9b0b0000 pid=2971 clone guuid=cecdfb97-2200-0000-42fb-3dba9e0b0000 pid=2974 /usr/bin/timeout guuid=43e4c197-2200-0000-42fb-3dba9c0b0000 pid=2972->guuid=cecdfb97-2200-0000-42fb-3dba9e0b0000 pid=2974 clone
Score:
16%
Verdict:
Benign
File Type:
SCRIPT
Link:
https://malprob.io/report/10fc2abebb54ae640f29cefc6c4bbfce1345a1f8aa4dd2c264f9ded0743d08f9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/10fc2abebb54ae640f29cefc6c4bbfce1345a1f8aa4dd2c264f9ded0743d08f9/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=cd6cvpv3ksxgidzjz36gys57zyjulipyvjg5fqte7hpna5b5bd4q._file
Result
Malware family:
n/a
Score:
  1/10
Tags:
linux
Link:
https://tria.ge/reports/261114-hml4lsdz4y/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Detect_Remcos_RAT
Create hunting rule
Author:daniyyell
Description:Detects Remcos RAT payloads and commands

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments