MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1eb2d667642518243b790f55f61971ad769cad620f434bb8320d62118415d79f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	1eb2d667642518243b790f55f61971ad769cad620f434bb8320d62118415d79f
SHA3-384 hash:	893504e93d35166241f2c9f23b4b1afad7390bc13db32c72e6dc06e1df419917245b2ec90112bc05d3c6429a133dc2d4
SHA1 hash:	0dba3d457e0bbc64a11b5178dc8f36b8f8533ed3
MD5 hash:	13f6d78a4839f8a4c98ce359bfcf5dd2
humanhash:	hydrogen-comet-nevada-muppet
File name:	toto
Download:	download sample
Signature	Gafgyt Alert Create hunting rule
File size:	343 bytes
First seen:	2025-07-28 20:22:09 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	6:5DBlvmxqSK5l6mPalLLIPly/gaOlV8iAKu:5jMqPf6W+vIdyoa6V+Ku
TLSH	T1E2E04FDD51D3E0FE88294D40B3619636D505F5D02170AFCDEA4974B1CCD9641312CF47
Magika	shell
Reporter	abuse_ch
Tags:	gafgyt sh

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

33

Origin country :

DE

Vendor Threat Intelligence

Hybrid Analysis TrojanDownloader/Linux.Agent

Verdict:

Malicious

Labled as:

TrojanDownloader/Linux.Agent

Link:

https://www.hybrid-analysis.com/sample/1eb2d667642518243b790f55f61971ad769cad620f434bb8320d62118415d79f

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/b029e0c0-28b3-4b1e-ba8d-7d3aac8d39fa

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/1eb2d667642518243b790f55f61971ad769cad620f434bb8320d62118415d79f

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/1eb2d667642518243b790f55f61971ad769cad620f434bb8320d62118415d79f/

ReversingLabs TitaniumCloud Script.Trojan.Malgent

Threat name:

Script.Trojan.Malgent

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-07-28 21:48:30 UTC

File Type:

Text (Shell)

AV detection:

9 of 24 (37.50%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=d2znmz3eeumcio3zb5k7mglrvv3jzllcb5buxobsbvrbdbav26pq._file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/1eb2d667642518243b790f55f61971ad769cad620f434bb8320d62118415d79f