MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2d346ff21036b3759dae6270ad98d895da68b1b083c533727d66c4be3c6121f6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2d346ff21036b3759dae6270ad98d895da68b1b083c533727d66c4be3c6121f6
SHA3-384 hash: a9613937ae97bea19800c34b81d88b5c734cb2f0e36d90df64f3cf6c55c896ab458012074724c87b483559b41804685e
SHA1 hash: be0ac992a8c60b01ce14f6ef3d0f8235c95896fe
MD5 hash: 57fc7c5fc000cebeee565e7d1c095bf7
humanhash: indigo-happy-purple-venus
File name:run.sh
Download: download sample
File size:2'310 bytes
First seen:2025-09-29 04:53:17 UTC
Last seen:2025-09-29 22:00:41 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 48:SodKouZnwKhxK9TK9xKR6KRieKihM3zUKJPKdNKtGKdJK/:SodKouZnwKhxK9TK9xKR6KRxK1UKJPKV
TLSH T1E341E98205459B7AA6C2404EF3E4327C6A0FF0821FEBCA0EFDE0856D5EC5D4CA6C5C84
Magika shell
Reporter abuse_ch
Tags:sh

Intelligence

File Origin
# of uploads :
2
# of downloads :
55
Origin country :
DE DE
Vendor Threat Intelligence
Verdict:
Malicious
File Type:
unix shell
First seen:
2025-09-29T00:51:00Z UTC
Last seen:
2025-09-29T00:51:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan-Downloader.Shell.Agent.a HEUR:Trojan-Downloader.Shell.Agent.gen
Link:
https://opentip.kaspersky.com/2d346ff21036b3759dae6270ad98d895da68b1b083c533727d66c4be3c6121f6/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/5aa36c8a-2700-4def-89d9-cc8742869143
Behavior Graph:
Download SVG
%3 guuid=17c88c01-1800-0000-d782-c2ce390c0000 pid=3129 /usr/bin/sudo guuid=48299e03-1800-0000-d782-c2ce3e0c0000 pid=3134 /tmp/sample.bin guuid=17c88c01-1800-0000-d782-c2ce390c0000 pid=3129->guuid=48299e03-1800-0000-d782-c2ce3e0c0000 pid=3134 execve guuid=61c27904-1800-0000-d782-c2ce400c0000 pid=3136 /usr/bin/wget guuid=48299e03-1800-0000-d782-c2ce3e0c0000 pid=3134->guuid=61c27904-1800-0000-d782-c2ce400c0000 pid=3136 execve
Score:
32%
Verdict:
Susipicious
File Type:
SCRIPT
Link:
https://malprob.io/report/2d346ff21036b3759dae6270ad98d895da68b1b083c533727d66c4be3c6121f6
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2d346ff21036b3759dae6270ad98d895da68b1b083c533727d66c4be3c6121f6/
Verdict:
Malicious
Threat:
Trojan-Downloader.Shell.Agent
Link:
https://tip.neiki.dev/file/2d346ff21036b3759dae6270ad98d895da68b1b083c533727d66c4be3c6121f6
Threat name:
Script-Shell.Downloader.ShellAgnt
Create hunting rule
Status:
Malicious
First seen:
2025-09-29 04:54:17 UTC
File Type:
Text (Shell)
AV detection:
10 of 38 (26.32%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fu2g74qqg2zxlhnomjyk3ggysxngrmnqqpctg4t5m3cl4pdbeh3a._file
Result
Malware family:
n/a
Score:
  1/10
Tags:
linux
Link:
https://tria.ge/reports/250929-fjn3pav1bw/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.39
Link:
https://yomi.yoroi.company/submissions/2d346ff21036b3759dae6270ad98d895da68b1b083c533727d66c4be3c6121f6

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 2d346ff21036b3759dae6270ad98d895da68b1b083c533727d66c4be3c6121f6

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3633573/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3633640/

Comments