MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2adef03b50757bb20636e68a28b29ca5619b02fb634577b603d4cbb7cfb69aad. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	2adef03b50757bb20636e68a28b29ca5619b02fb634577b603d4cbb7cfb69aad
SHA3-384 hash:	fb8653e270bb7c639e4f5fd19f19b518bfeb69063c8338a786e78cc3b6fe967c3fb2ef63931512fab0137f0e0de69630
SHA1 hash:	495f3d1b028dcf71424d688a0e25b08acb7bc0c7
MD5 hash:	19e9aafa24b59ed51eba44ed750275f2
humanhash:	stairway-zulu-two-uncle
File name:	bot.sh
Download:	download sample
File size:	1'247 bytes
First seen:	2026-11-04 03:46:50 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	24:364AZrY3EAFt6Go+Xmw8/oDWcL78BN5wO3y/:K4A9GEcTNDWcLoBNjC/
TLSH	T19A214525F03417F379A9D864694B278C928D13634AB63C0DF4363DB3AB38E76B5E4225
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	BlinkzSec

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

88

Origin country :

IN

Vendor Threat Intelligence

ACCE Unknown

No detections

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-11-04T01:25:00Z UTC

Last seen:

2026-11-04T01:48:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/2adef03b50757bb20636e68a28b29ca5619b02fb634577b603d4cbb7cfb69aad/results?tab=lookup

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/244c2758-de5e-4373-9c04-684d8aa466d3

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

24%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/2adef03b50757bb20636e68a28b29ca5619b02fb634577b603d4cbb7cfb69aad

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/2adef03b50757bb20636e68a28b29ca5619b02fb634577b603d4cbb7cfb69aad/

ReversingLabs TitaniumCloud Linux.Trojan.Generic

Threat name:

Linux.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2026-11-04 03:46:17 UTC

File Type:

Text (Shell)

AV detection:

5 of 24 (20.83%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=flppao2qov53ebrw42fcrmu4uvqzwax3mncxpnqd2tf3pt5wtkwq._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

defense_evasion discovery execution linux persistence privilege_escalation upx

Link:

https://tria.ge/reports/261104-ecdgyasv4m/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Changes its process name

Reads system network configuration

UPX packed file

Creates/modifies Cron job

Enumerates active TCP sockets

Enumerates running processes

Modifies rc script

Modifies systemd

Write file to user bin folder

File and Directory Permissions Modification

Executes dropped EXE

Modifies Watchdog functionality

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.47

Link:

https://yomi.yoroi.company/submissions/2adef03b50757bb20636e68a28b29ca5619b02fb634577b603d4cbb7cfb69aad