🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 442e897c78532dd4e36fa1c7fd791c4bcf19b230d9aab3d5d12ade2d98b84a83. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry



Threat unknown


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments

SHA256 hash: 442e897c78532dd4e36fa1c7fd791c4bcf19b230d9aab3d5d12ade2d98b84a83
SHA3-384 hash: 3460c343916ebefe8bbeede9233d758d68c86da2f71f48054fc8aa55600f53d2a55b293af95b4047b5b0bc6815d450a6
SHA1 hash: 29ded7c69c93262842b8793d3a99868d8118364e
MD5 hash: ed583c5e843c91d8fd0752e56ccacbde
humanhash: fourteen-echo-failed-triple
File name:442e897c78532dd4e36fa1c7fd791c4bcf19b230d9aab3d5d12ade2d98b84a83
Download: download sample
File size:419 bytes
First seen:2026-11-12 13:55:56 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 6:sv+9C6AGBUcMr3jhCE9MWjZx9SqARwiRO/uMQHvUVNsjKuE8l/8H+LRudHLPiTn:sWVZXehHHleqARwzbQHsv8tg+LqjM
TLSH T1FCE0559CB908E830AB070478C12D86A42D1A602706F1AC183A0AE2902F4F378F2E9245
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter beserko
Tags:sh

Intelligence


File Origin
# of uploads :
1
# of downloads :
59
Origin country :
US US
Vendor Threat Intelligence
No detections
Status:
terminated
Behavior Graph:
%3 guuid=1a694f78-1c00-0000-2a74-71234a0b0000 pid=2890 /usr/bin/sudo guuid=f116fb79-1c00-0000-2a74-71234f0b0000 pid=2895 /tmp/sample.bin guuid=1a694f78-1c00-0000-2a74-71234a0b0000 pid=2890->guuid=f116fb79-1c00-0000-2a74-71234f0b0000 pid=2895 execve guuid=3dbf4d7a-1c00-0000-2a74-7123510b0000 pid=2897 /usr/bin/date guuid=f116fb79-1c00-0000-2a74-71234f0b0000 pid=2895->guuid=3dbf4d7a-1c00-0000-2a74-7123510b0000 pid=2897 execve guuid=4efb907a-1c00-0000-2a74-7123520b0000 pid=2898 /usr/bin/bash guuid=f116fb79-1c00-0000-2a74-71234f0b0000 pid=2895->guuid=4efb907a-1c00-0000-2a74-7123520b0000 pid=2898 clone guuid=b7aed07c-1c00-0000-2a74-71235f0b0000 pid=2911 /usr/bin/sleep guuid=f116fb79-1c00-0000-2a74-71234f0b0000 pid=2895->guuid=b7aed07c-1c00-0000-2a74-71235f0b0000 pid=2911 execve guuid=cbbe9c7a-1c00-0000-2a74-7123540b0000 pid=2900 /usr/bin/grep guuid=4efb907a-1c00-0000-2a74-7123520b0000 pid=2898->guuid=cbbe9c7a-1c00-0000-2a74-7123540b0000 pid=2900 execve guuid=04aea17a-1c00-0000-2a74-7123550b0000 pid=2901 /usr/bin/grep guuid=4efb907a-1c00-0000-2a74-7123520b0000 pid=2898->guuid=04aea17a-1c00-0000-2a74-7123550b0000 pid=2901 execve guuid=59e8a77a-1c00-0000-2a74-7123560b0000 pid=2902 /usr/bin/mawk guuid=4efb907a-1c00-0000-2a74-7123520b0000 pid=2898->guuid=59e8a77a-1c00-0000-2a74-7123560b0000 pid=2902 execve guuid=dbd5ac7a-1c00-0000-2a74-7123570b0000 pid=2903 /usr/bin/sort guuid=4efb907a-1c00-0000-2a74-7123520b0000 pid=2898->guuid=dbd5ac7a-1c00-0000-2a74-7123570b0000 pid=2903 execve guuid=6dcbb57a-1c00-0000-2a74-7123580b0000 pid=2904 /usr/bin/uniq guuid=4efb907a-1c00-0000-2a74-7123520b0000 pid=2898->guuid=6dcbb57a-1c00-0000-2a74-7123580b0000 pid=2904 execve guuid=b3acba7a-1c00-0000-2a74-7123590b0000 pid=2905 /usr/bin/mawk guuid=4efb907a-1c00-0000-2a74-7123520b0000 pid=2898->guuid=b3acba7a-1c00-0000-2a74-7123590b0000 pid=2905 execve
Result
Malware family:
n/a
Score:
  3/10
Tags:
discovery linux
Behaviour
Reads runtime system information
Please note that we are no longer able to provide a coverage score for Virus Total.

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Comments