🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3c62d901a5674faccac8119f5f2afc5ef229d5d23b737fff09bfe8e1fe4a6aa4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry



Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA File information Comments

SHA256 hash: 3c62d901a5674faccac8119f5f2afc5ef229d5d23b737fff09bfe8e1fe4a6aa4
SHA3-384 hash: 69ef743b70854f50ea6a4a0e9a46574590dc0f4174f34477df3c74c52d0abfbe7dba05c2dceaa0c11b30217e3557c39d
SHA1 hash: 3dd8c0818c2f6aa771cfd5638e5523f1fd6d583f
MD5 hash: 7f5846dfc0305a363ba7fb00e2b0680b
humanhash: oregon-hawaii-berlin-sierra
File name:3c62d901a5674faccac8119f5f2afc5ef229d5d23b737fff09bfe8e1fe4a6aa4
Download: download sample
File size:2'776 bytes
First seen:2026-09-26 17:11:24 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 48:USUUU/Q/wLI/lu6l90MjGr3Nme5WlWsHDYd/gkgR0B2QNQq:UYNX/lXCj5Rs2WR0EUZ
TLSH T1F15186B7A95842F0129E819DDACEEB584056427B0AD23514B4CDF8243F354B6A36AFE3
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter Anonymous
Tags:sh

Intelligence


File Origin
# of uploads :
1
# of downloads :
66
Origin country :
EG EG
Vendor Threat Intelligence
No detections
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-08-11T06:38:00Z UTC
Last seen:
2026-09-28T07:20:00Z UTC
Hits:
~10
Status:
terminated
Behavior Graph:
%3 guuid=fe848a81-1d00-0000-69c5-e71260080000 pid=2144 /usr/bin/sudo guuid=6813fe87-1d00-0000-69c5-e71269080000 pid=2153 /tmp/sample.bin write-file guuid=fe848a81-1d00-0000-69c5-e71260080000 pid=2144->guuid=6813fe87-1d00-0000-69c5-e71269080000 pid=2153 execve guuid=8cbe9688-1d00-0000-69c5-e7126b080000 pid=2155 /usr/bin/dash guuid=6813fe87-1d00-0000-69c5-e71269080000 pid=2153->guuid=8cbe9688-1d00-0000-69c5-e7126b080000 pid=2155 clone guuid=4ed64a8a-1d00-0000-69c5-e7126d080000 pid=2157 /usr/bin/dash guuid=6813fe87-1d00-0000-69c5-e71269080000 pid=2153->guuid=4ed64a8a-1d00-0000-69c5-e7126d080000 pid=2157 clone guuid=edb0048d-1d00-0000-69c5-e71270080000 pid=2160 /usr/bin/curl net send-data write-file guuid=6813fe87-1d00-0000-69c5-e71269080000 pid=2153->guuid=edb0048d-1d00-0000-69c5-e71270080000 pid=2160 execve guuid=4e444ec5-1d00-0000-69c5-e712a8080000 pid=2216 /usr/bin/chmod guuid=6813fe87-1d00-0000-69c5-e71269080000 pid=2153->guuid=4e444ec5-1d00-0000-69c5-e712a8080000 pid=2216 execve guuid=fea8fbc5-1d00-0000-69c5-e712a9080000 pid=2217 /tmp/run-command.sh zombie guuid=6813fe87-1d00-0000-69c5-e71269080000 pid=2153->guuid=fea8fbc5-1d00-0000-69c5-e712a9080000 pid=2217 execve guuid=58ab708a-1d00-0000-69c5-e7126e080000 pid=2158 /usr/bin/uname guuid=4ed64a8a-1d00-0000-69c5-e7126d080000 pid=2157->guuid=58ab708a-1d00-0000-69c5-e7126e080000 pid=2158 execve 3d36a2a1-d9c8-5f0c-b017-24200768ae07 brightlaunch-ext75642.vercel.app:443 guuid=edb0048d-1d00-0000-69c5-e71270080000 pid=2160->3d36a2a1-d9c8-5f0c-b017-24200768ae07 send: 778B guuid=edb0048d-1d00-0000-69c5-e71270080000 pid=2185 /usr/bin/curl dns net send-data guuid=edb0048d-1d00-0000-69c5-e71270080000 pid=2160->guuid=edb0048d-1d00-0000-69c5-e71270080000 pid=2185 clone guuid=edb0048d-1d00-0000-69c5-e71270080000 pid=2185->3d36a2a1-d9c8-5f0c-b017-24200768ae07 con 4f6baed0-9587-596c-82b3-fd721afe4cc1 10.0.2.3:53 guuid=edb0048d-1d00-0000-69c5-e71270080000 pid=2185->4f6baed0-9587-596c-82b3-fd721afe4cc1 send: 100B guuid=89017fc6-1d00-0000-69c5-e712aa080000 pid=2218 /usr/bin/mkdir guuid=fea8fbc5-1d00-0000-69c5-e712a9080000 pid=2217->guuid=89017fc6-1d00-0000-69c5-e712aa080000 pid=2218 execve guuid=b2bc1bc7-1d00-0000-69c5-e712ab080000 pid=2219 /usr/bin/clear guuid=fea8fbc5-1d00-0000-69c5-e712a9080000 pid=2217->guuid=b2bc1bc7-1d00-0000-69c5-e712ab080000 pid=2219 execve
Threat name:
Text.Trojan.Generic
Status:
Suspicious
First seen:
2026-08-04 02:47:39 UTC
File Type:
Text (Shell)
AV detection:
4 of 23 (17.39%)
Threat level:
  5/5
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Behaviour
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Comments