MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 407d806eaa8b298a82b47be263844f5cf460a9543c59b2d48485d017df46229e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 5
| SHA256 hash: | 407d806eaa8b298a82b47be263844f5cf460a9543c59b2d48485d017df46229e |
|---|---|
| SHA3-384 hash: | b259f70fea023180de1912b0ef35d73ff5e22700c3b6674a6f352e6cb1e9dab0870c25a9aee56939c3196d7cfa543367 |
| SHA1 hash: | c2979dc2fb5b034b69c83281c1fb7d022b2afab7 |
| MD5 hash: | d9d9298e105cacafb2fab86a8710b1e8 |
| humanhash: | fruit-hawaii-jig-twenty |
| File name: | v2 |
| Download: | download sample |
| File size: | 1'099 bytes |
| First seen: | 2026-10-19 21:19:59 UTC |
| Last seen: | Never |
| File type: | sh |
| MIME type: | text/x-shellscript |
| ssdeep | 24:URm1e7/Al8IIyVlzm+2I1nA0l10AMZdERW22Rvpyy:U8E7/AhlZFVD+hHj |
| TLSH | T1CC118B55BA2163188423E91BA3105B46579453E6BC8CA53EA4E216D61FBCCC376CAF82 |
| TrID | 70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1) |
| Magika | shell |
| Reporter |  abuse_ch |
| Tags: | sh |
Shell script dropper
This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.
| URL | Malware sample (SHA256 hash) | Signature | Tags |
|---|---|---|---|
| http://api.recapcha.fun/task/tokenlinux | n/a | n/a | n/a |
| http://api.recapcha.fun/auth/ls | n/a | n/a | n/a |
| http://api.recapcha.fun/auth/le | n/a | n/a | n/a |
Intelligence
File Origin
# of uploads :
1
# of downloads :
84
Origin country :
DEVendor Threat Intelligence
No detections
Detection(s):
Verdict:
Unknown
Threat level:
0/10
Confidence:
100%
Tags:
base64 bash lolbin obfuscated
Verdict:
Adware
File Type:
unix shell
Status:
Failed
Score:
37%
Verdict:
Susipicious
File Type:
SCRIPT
Threat name:
Script-BAT.Downloader.Heuristic
Status:
Malicious
First seen:
2026-10-19 21:20:25 UTC
File Type:
Text (Shell)
AV detection:
6 of 24 (25.00%)
Threat level:
2/5
Detection(s):
Suspicious file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.28
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
sh 407d806eaa8b298a82b47be263844f5cf460a9543c59b2d48485d017df46229e
(this sample)
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.