MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 32cf939376dbe70f9a30dc868f88f5c67765a64ce3ee73d14354f99f06fbf0ff. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	32cf939376dbe70f9a30dc868f88f5c67765a64ce3ee73d14354f99f06fbf0ff
SHA3-384 hash:	8f11688ceb4866fbef2da63d98fca8940b0fef5d595e53c3d50ec2503c24229bb0bb9489781bdd6d256e6dee24411d95
SHA1 hash:	4cffbbeb8de5f01dcd41d1e26b93b31dbd940643
MD5 hash:	3991c72823bb107da3cdb20851f13c37
humanhash:	red-shade-grey-march
File name:	xz.sh
Download:	download sample
File size:	277 bytes
First seen:	2026-05-15 15:06:52 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	6:LH+jCysh6F2J/+3Fd5H/a8ytEBLh8ytvT6vNpvbNn:LH+jCP8F2J65C8ytE1h8ydTEzbNn
TLSH	T1B2D05EEA601200375B988AEB79510EC0E34DB9D9D256823D35E992260D39CD5B39056B
Magika	shell
Reporter	abuse_ch
Tags:	sh

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

37

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.Linux.DownLoader.2650.21341.11061.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/6a0736b7056ea44c45313052/reports/652df62b-fe8f-4fc7-9eb5-858e92526654/overview

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

ps1

First seen:

2026-05-15T12:13:00Z UTC

Last seen:

2026-05-16T02:04:00Z UTC

Hits:

~10

Detections:

Trojan-Downloader.Shell.Agent.bi

Link:

https://opentip.kaspersky.com/32cf939376dbe70f9a30dc868f88f5c67765a64ce3ee73d14354f99f06fbf0ff/results?tab=lookup

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/d0e17a70-cec5-4739-8505-4ebe0fe741b9

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

97%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/32cf939376dbe70f9a30dc868f88f5c67765a64ce3ee73d14354f99f06fbf0ff

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/32cf939376dbe70f9a30dc868f88f5c67765a64ce3ee73d14354f99f06fbf0ff/

Neiki Trojan-Downloader.Shell.Agent

Verdict:

Malicious

Threat:

Trojan-Downloader.Shell.Agent

Link:

https://tip.neiki.dev/file/32cf939376dbe70f9a30dc868f88f5c67765a64ce3ee73d14354f99f06fbf0ff

ReversingLabs TitaniumCloud Script-Shell.Trojan.Multiverze

Threat name:

Script-Shell.Trojan.Multiverze

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-05-15 15:07:40 UTC

File Type:

Text (Shell)

AV detection:

9 of 24 (37.50%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=glhzhe3w3ptq7grq3sdi7chvyz3wljsm4pxhhukdkt4z6bx36d7q._file

Hatching Triage

Gathering data

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/32cf939376dbe70f9a30dc868f88f5c67765a64ce3ee73d14354f99f06fbf0ff