MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 35defc2e10b35fd686a376ed4568eef8009e79ea70ec73fcc970bcfd3c9dfe17. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	35defc2e10b35fd686a376ed4568eef8009e79ea70ec73fcc970bcfd3c9dfe17
SHA3-384 hash:	a76c02c5fc8581fc935f1b39a208992ce061625fa7068f018639194dd1230c0024999d4db830c34bf8f265a18596b997
SHA1 hash:	2ae7c45a7431bc96e4b8401af67932b85563b228
MD5 hash:	5365ede16870137cc0fdc393cc29fa9b
humanhash:	beer-maryland-california-pizza
File name:	35defc2e10b35fd686a376ed4568eef8009e79ea70ec73fcc970bcfd3c9dfe17
Download:	download sample
Signature	Prometei Alert Create hunting rule
File size:	1'459 bytes
First seen:	2026-07-16 04:06:28 UTC
Last seen:	2026-07-16 17:55:56 UTC
File type:	sh
MIME type:	text/x-shellscript
ssdeep	24:vP/iqghBgaU0dQtFw2AALFRYksYplmYlsYusYjsYwl2GY2sYtlDsY+lsK6YEllu4:vLCBC0dQb9AALf5sAlmGsPsqs1lpXsit
TLSH	T1CB31258F0B59C6B14B5E98EBD74582D79B070453004CD915B7DC8659BF36058F1A53C7
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	c2hunter
Tags:	Prometei sh wraith

Intelligence

---

File Origin

# of uploads :

4

# of downloads :

71

Origin country :

US

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.Linux.DownLoader.2650.7111.29099.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

evasive zero-day

Link:

https://www.filescan.io/uploads/6a5858ce7b55df8a7b7409fd/reports/b575978e-58d9-46b0-95df-08037b8080f5/overview

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/294ba90d-e781-4e86-8865-3226e85be5f3

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

96%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/35defc2e10b35fd686a376ed4568eef8009e79ea70ec73fcc970bcfd3c9dfe17

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/35defc2e10b35fd686a376ed4568eef8009e79ea70ec73fcc970bcfd3c9dfe17/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=gxppylqqwnp5nbvdo3wuk2ho7aaj46pkodwhh7gjoc6p2pe57ylq._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

defense_evasion discovery execution linux persistence privilege_escalation

Link:

https://tria.ge/reports/260716-epdngacx5j/

Behaviour

Reads runtime system information

Writes file to tmp directory

Changes its process name

Modifies Bash startup script

Creates/modifies Cron job

Creates/modifies environment variables

Enumerates running processes

File and Directory Permissions Modification

Deletes itself

Executes dropped EXE

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.11

Link:

https://yomi.yoroi.company/submissions/35defc2e10b35fd686a376ed4568eef8009e79ea70ec73fcc970bcfd3c9dfe17