MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 209c6a891db3c3e1e36366e060e4b3e8e1b14eac024d379f0db99a80d81c7e68. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	209c6a891db3c3e1e36366e060e4b3e8e1b14eac024d379f0db99a80d81c7e68
SHA3-384 hash:	11d25110442121c9cd1e750e5a4357846b70e04ef2fd9704fdb1d41bae3a2b8b726f839d5acff59e57b7178bdc9e1fdf
SHA1 hash:	f86171bdb7d70fd2e89bdcc51e7f6cd3599ea8e0
MD5 hash:	f523c804a6767dea7c8cc058b14961a1
humanhash:	stairway-tango-golf-london
File name:	loader.sh
Download:	download sample
File size:	1'602 bytes
First seen:	2026-07-03 11:18:02 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:u9B8xM0qyhZ7iLnjDpIYranhlUc7rs6vlwxsTXSqm8cG8K5f55:u9B8S0dnirvWZhikQI7SgJdz
TLSH	T129319E0AB41234F1BBAED469D35B71521586C0C38075AF9433CCA35A5FEE310B5DB6CA
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	adliwahid

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

46

Origin country :

NL

Vendor Threat Intelligence

ACCE Unknown

No detections

Kaspersky OpenTIP Clean

Verdict:

Clean

File Type:

unix shell

First seen:

2026-06-30T06:12:00Z UTC

Last seen:

2026-07-05T09:27:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/209c6a891db3c3e1e36366e060e4b3e8e1b14eac024d379f0db99a80d81c7e68/results?tab=lookup

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/886006a7-f077-46b2-9304-dcc2df409817

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

78%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/209c6a891db3c3e1e36366e060e4b3e8e1b14eac024d379f0db99a80d81c7e68

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/209c6a891db3c3e1e36366e060e4b3e8e1b14eac024d379f0db99a80d81c7e68/

Neiki Trojan-Downloader.Shell.Agent

Verdict:

Malicious

Threat:

Trojan-Downloader.Shell.Agent

Link:

https://tip.neiki.dev/file/209c6a891db3c3e1e36366e060e4b3e8e1b14eac024d379f0db99a80d81c7e68

ReversingLabs TitaniumCloud Text.Trojan.Generic

Threat name:

Text.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2026-07-01 03:09:38 UTC

File Type:

Text (Shell)

AV detection:

5 of 23 (21.74%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ecogvci5wpb6dy3dm3qgbzft5dq3ctvmajgtphynxgnibwa4pzua._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  1/10

Tags:

linux

Link:

https://tria.ge/reports/260703-nektgacz2m/

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/209c6a891db3c3e1e36366e060e4b3e8e1b14eac024d379f0db99a80d81c7e68