MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 247fdba5fbfd076d9c530d937406aa097d6794b9af26bfc64bf6ea765ed51a50. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	247fdba5fbfd076d9c530d937406aa097d6794b9af26bfc64bf6ea765ed51a50
SHA3-384 hash:	4d9d9ba830991487bf6fdf590859c8a2c8abda515f0ac0d8301a2e138b6ed4750ca0a8ab3af33b4a9fec512fa2754ddb
SHA1 hash:	7117c6f2d664947a961a38d289b3df42d3722252
MD5 hash:	59d1152449a503665f552cba0455f02d
humanhash:	floor-magnesium-sink-timing
File name:	preinstall
Download:	download sample
File size:	404 bytes
First seen:	2025-09-11 06:59:42 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	12:HjVX/5Q1TibsLrheyK4SdedMG4n0bnnoWdK4SnoGiK4Sj:p4r1oMMG4n0DGYY
TLSH	T156E061A931625DB0B1D203A5A264424859E347FDA140DD6DC4B6F4BC79452C1B52F365
Magika	shell
Reporter	_O_l_i_v_e_r___
Tags:	BeaverTail ContagiousInterview sh

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

327

Origin country :

AU

Vendor Threat Intelligence

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/68c27401732879482926703e/reports/d15abd89-af5c-4b31-9150-73a1b32ec37c/overview

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

unix shell

First seen:

2025-09-11T18:25:00Z UTC

Last seen:

2025-09-11T18:25:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/247fdba5fbfd076d9c530d937406aa097d6794b9af26bfc64bf6ea765ed51a50/results?tab=lookup

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/d6024979-3bcf-448f-a453-c8e86de49fe1

Behavior Graph:

Download SVG

Nucleon Malprob Susipicious

Score:

59%

Verdict:

Susipicious

File Type:

SCRIPT

Link:

https://malprob.io/report/247fdba5fbfd076d9c530d937406aa097d6794b9af26bfc64bf6ea765ed51a50

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/247fdba5fbfd076d9c530d937406aa097d6794b9af26bfc64bf6ea765ed51a50/

Neiki Clean

Verdict:

Clean

Link:

https://tip.neiki.dev/file/247fdba5fbfd076d9c530d937406aa097d6794b9af26bfc64bf6ea765ed51a50

ReversingLabs TitaniumCloud MacOS.Trojan.SAgnt

Threat name:

MacOS.Trojan.SAgnt

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-09-11 07:04:46 UTC

File Type:

Text (Shell)

AV detection:

4 of 38 (10.53%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=er75xjp37udw3hctbwjxibvkbf6wpffzv4tl7rsl63vhmxwvdjia._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

antivm defense_evasion discovery linux privilege_escalation

Link:

https://tria.ge/reports/250911-hthprshr5y/

Behaviour

Reads runtime system information

Checks CPU configuration

Abuse Elevation Control Mechanism: Sudo and Sudo Caching

Legitimate hosting services abused for malware hosting/C2

File and Directory Permissions Modification

Executes dropped EXE

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.