MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 424b1beaea68c353b10c7d5ef22a950be13c75a5417176ecd995c5aa71bb38af. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	424b1beaea68c353b10c7d5ef22a950be13c75a5417176ecd995c5aa71bb38af
SHA3-384 hash:	844e876b601f089cc2d3d04205f453bcd81ae827e32cf3095ab1a228a3088d801392d474b1b6f1fac565e1f3240a99e4
SHA1 hash:	568f47a33a9557a6724a650f59f9d07ebd56f7d2
MD5 hash:	1e0ac4e2a61f799c74a4d8f8ac9ee399
humanhash:	vegan-table-oregon-low
File name:	loader.sh
Download:	download sample
File size:	9'582 bytes
First seen:	2026-05-02 17:27:11 UTC
Last seen:	2026-05-03 09:48:49 UTC
File type:	sh
MIME type:	text/x-shellscript
ssdeep	96:mla21T1IVoF6mdiydTdI9E1q2xW2lTlIFI2aZ2aO26nC52JE2JT2pYd02Y/2Yk2r:e
TLSH	T1081216E9B3E5143BA1617F4CF140C449E8716CACC053BD06A9219B5E9F8C738B36EE99
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	sh

Intelligence

---

File Origin

# of uploads :

3

# of downloads :

38

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

Kaspersky OpenTIP Clean

Verdict:

Clean

File Type:

unix shell

Link:

https://opentip.kaspersky.com/424b1beaea68c353b10c7d5ef22a950be13c75a5417176ecd995c5aa71bb38af/results?tab=lookup

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/c8467448-158b-487e-b9f7-3fe2f44e7bfe

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

98%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/424b1beaea68c353b10c7d5ef22a950be13c75a5417176ecd995c5aa71bb38af

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/424b1beaea68c353b10c7d5ef22a950be13c75a5417176ecd995c5aa71bb38af/

Neiki Malicious

Verdict:

Malicious

Link:

https://tip.neiki.dev/file/424b1beaea68c353b10c7d5ef22a950be13c75a5417176ecd995c5aa71bb38af

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ijfrx2xkndbvhmimpvppekuvbpqty5nfifyxn3gzsxc2u4n3hcxq._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

antivm defense_evasion discovery linux

Link:

https://tria.ge/reports/260502-v1rbpsgx4m/

Behaviour

GoLang User-Agent

Enumerates kernel/hardware configuration

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Checks CPU configuration

File and Directory Permissions Modification

Executes dropped EXE

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.31

Link:

https://yomi.yoroi.company/submissions/424b1beaea68c353b10c7d5ef22a950be13c75a5417176ecd995c5aa71bb38af