MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 20600b576b3f8cbc2cc95eb68f84e4e9d51227e036c3a2f4db2a6a2868576fb8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	20600b576b3f8cbc2cc95eb68f84e4e9d51227e036c3a2f4db2a6a2868576fb8
SHA3-384 hash:	974cb12e4a4dd2c6c6774b14d696c81289c2a7484f2f08b8e4cdd16f686189d80c94f9133e49bf534e84097adcd96d98
SHA1 hash:	df13d6e6c76a75250bab2e851e39621feec4e4bf
MD5 hash:	31f68407627b5671e7ef0efb3ff9acab
humanhash:	leopard-asparagus-oklahoma-hawaii
File name:	load
Download:	download sample
File size:	2'846 bytes
First seen:	2026-10-18 20:17:23 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:vTE8bCug0FH9IqTdT8zUQyhpyh4ShnuvCuvTGYUoghxfmsxpPBEltCeP1romblHh:vxB9+AFKYU5zQCehxH
TLSH	T1DA5131E5D9E0A133F069C81D7E8EE040C69568EF26DCBE54EDC7BC52BC5C4147069760
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	adliwahid

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

76

Origin country :

NL

Vendor Threat Intelligence

ACCE Unknown

No detections

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-10-18T18:33:00Z UTC

Last seen:

2026-10-18T18:52:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/20600b576b3f8cbc2cc95eb68f84e4e9d51227e036c3a2f4db2a6a2868576fb8/results?tab=lookup

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/f3df092f-7d9f-48ea-af47-fca98e95dcd2

Behavior Graph:

Download SVG

Nucleon Malprob Susipicious

Score:

69%

Verdict:

Susipicious

File Type:

SCRIPT

Link:

https://malprob.io/report/20600b576b3f8cbc2cc95eb68f84e4e9d51227e036c3a2f4db2a6a2868576fb8

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/20600b576b3f8cbc2cc95eb68f84e4e9d51227e036c3a2f4db2a6a2868576fb8/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ebqawv3lh6glylgjl23i7bhe5hkrej7ag3b2f5g3fjvcq2cxn64a._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

antivm defense_evasion discovery execution linux persistence privilege_escalation

Link:

https://tria.ge/reports/261018-y3c4msce44/

Behaviour

Enumerates kernel/hardware configuration

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Checks CPU configuration

Creates/modifies Cron job

Modifies init.d

Modifies systemd

File and Directory Permissions Modification

Executes dropped EXE

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/20600b576b3f8cbc2cc95eb68f84e4e9d51227e036c3a2f4db2a6a2868576fb8