🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1d169b388d018d22a5f727fef5027722273cd0d75182a2186facfb58a6ef6ef8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1d169b388d018d22a5f727fef5027722273cd0d75182a2186facfb58a6ef6ef8
SHA3-384 hash: faf74ce76f1f83a0bdc049e21784cfb4273bacc6558ba6da4f84e95f2883eb51632f0cf035048c0410c7816402dac486
SHA1 hash: 6eb7b54beef44b5ab3bb1435ee6ac1662edc2595
MD5 hash: b15fd6b4e69476589f31adf643951b4f
humanhash: minnesota-cold-lake-salami
File name:1d169b388d018d22a5f727fef5027722273cd0d75182a2186facfb58a6ef6ef8
Download: download sample
File size:3'097 bytes
First seen:2026-10-19 16:05:43 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 48:Siv2bDqWhUEhcicHJOv6v/mGcbI2D1mSNOjhixeji5ofa5J6vK0C/0Ckd/f0CMYk:V2KpXJOy39P2D56ixeiqayvKn/nO3n3k
TLSH T11351B9F3F6B6D638369C54646ADE85D2E547863309243801F0CD64247F2C8A8B1F5B6B
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter Rocketguy
Tags:honeypot sh


Avatar
Rocketguy
Captured by a RocketCore internet honeypot; not present in MalwareBazaar at capture time.

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
US US
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.BV.Downloader-BXM.59276922.UNOFFICIAL
Create hunting rule

Gathering data
Verdict:
Adware
File Type:
unix shell
First seen:
2026-10-06T09:01:00Z UTC
Last seen:
2026-10-20T18:35:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/1d169b388d018d22a5f727fef5027722273cd0d75182a2186facfb58a6ef6ef8/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/69ffe5e9-e1bc-4a4e-9361-fc67a79134c4
Behavior Graph:
Download SVG
%3 guuid=77bcb663-1a00-0000-e60c-eec03d030000 pid=829 /usr/bin/sudo guuid=9c609467-1a00-0000-e60c-eec03e030000 pid=830 /tmp/sample.bin guuid=77bcb663-1a00-0000-e60c-eec03d030000 pid=829->guuid=9c609467-1a00-0000-e60c-eec03e030000 pid=830 execve guuid=22040268-1a00-0000-e60c-eec03f030000 pid=831 /usr/bin/wget guuid=9c609467-1a00-0000-e60c-eec03e030000 pid=830->guuid=22040268-1a00-0000-e60c-eec03f030000 pid=831 execve
Score:
2%
Verdict:
Benign
File Type:
SCRIPT
Link:
https://malprob.io/report/1d169b388d018d22a5f727fef5027722273cd0d75182a2186facfb58a6ef6ef8
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1d169b388d018d22a5f727fef5027722273cd0d75182a2186facfb58a6ef6ef8/
Threat name:
Script-BAT.Downloader.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2026-10-06 15:11:44 UTC
File Type:
Text (Shell)
AV detection:
5 of 36 (13.89%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=duljwoenaggsfjpxe77pkatxeittzugxkgbkegdpvt5vrjxpn34a._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
linux
Link:
https://tria.ge/reports/261019-tka44sbt9l/
Behaviour
Writes file to tmp directory
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.37
Link:
https://yomi.yoroi.company/submissions/1d169b388d018d22a5f727fef5027722273cd0d75182a2186facfb58a6ef6ef8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Linux_Telegram_Agent_Installer
Create hunting rule
Author:KSI Digital
Description:agent_i.sh shell installer that stages the Go Telegram agent
Reference:https://github.com/ksi-digital/threat-research/tree/main/telegram-go-agent

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 1d169b388d018d22a5f727fef5027722273cd0d75182a2186facfb58a6ef6ef8

(this sample)

  
Delivery method
Distributed via web download

Comments