MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 1a62f6ae3a54ae13e206c8b0b9a333bbefdaa1462de784fb233077c4f0bde12f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 5
| SHA256 hash: | 1a62f6ae3a54ae13e206c8b0b9a333bbefdaa1462de784fb233077c4f0bde12f |
|---|---|
| SHA3-384 hash: | 41fc59f1336cfb889fa2681310793ceae33c58cb02b4b9254fed153e9edb5b06505f1429a51e0bb05572f4b09718e937 |
| SHA1 hash: | 479ee424ea2d050839e4028f9de6b5bd5f22c5a1 |
| MD5 hash: | fc0fa8cf054f8dc4d8025a1d25c5d75e |
| humanhash: | whiskey-autumn-island-cat |
| File name: | c.sh |
| Download: | download sample |
| File size: | 83 bytes |
| First seen: | 2026-05-23 07:59:48 UTC |
| Last seen: | 2026-05-24 00:38:49 UTC |
| File type: | sh |
| MIME type: | text/plain |
| ssdeep | 3:AjOh5gXVRL/L8ApHKJGNIaoLKJ4Kv:VSP/np0ax4KJp |
| TLSH | T1FFA0126802F51902150CC81121D000291214E0C034D0C133D0187A5120825093841549 |
| Magika | shell |
| Reporter | |
| Tags: | sh |
Shell script dropper
This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.
| URL | Malware sample (SHA256 hash) | Signature | Tags |
|---|---|---|---|
| http://85.204.125.76/attack_bot | n/a | n/a | elf ua-wget |
Intelligence
File Origin
# of uploads :
3
# of downloads :
51
Origin country :
DEVendor Threat Intelligence
No detections
Verdict:
Suspicious
Threat level:
5/10
Confidence:
100%
Verdict:
Clean
File Type:
text
Status:
terminated
Behavior Graph:
Score:
87%
Verdict:
Malware
File Type:
SCRIPT
Threat name:
Script.Trojan.SAgnt
Status:
Malicious
First seen:
2026-05-23 08:00:51 UTC
File Type:
Text (Shell)
AV detection:
1 of 23 (4.35%)
Threat level:
5/5
Detection(s):
Suspicious file
Result
Malware family:
n/a
Score:
3/10
Tags:
n/a
Behaviour
Modifies registry class
Suspicious use of SetWindowsHookEx
Enumerates physical storage devices
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
sh 1a62f6ae3a54ae13e206c8b0b9a333bbefdaa1462de784fb233077c4f0bde12f
(this sample)
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.