MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5071bccbf4febcda396f6c588f9ff03155225300a6286a1b9700bcfa547d6e7c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	5071bccbf4febcda396f6c588f9ff03155225300a6286a1b9700bcfa547d6e7c
SHA3-384 hash:	f9db9f636c46d7db844c3176128b5ad2a4d0bd3ab615067a08020de0b8c2589afa14985003e89e6eb56c98a8277a77c3
SHA1 hash:	f9c4f5c49737c84b35dcc2ddcb09bad1829fba57
MD5 hash:	9d62c5b8b6fcced04421e77138992ee6
humanhash:	edward-princess-tennessee-vegan
File name:	5071bccbf4febcda396f6c588f9ff03155225300a6286a1b9700bcfa547d6e7c.sh
Download:	download sample
File size:	743 bytes
First seen:	2026-04-01 18:04:03 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	12:SPh897dG3BCFrCR5VZFHYfDlKpFeixnLQmT/adGXhG1ugykYP9RcADB73O9y:1xdGxCFmX1EDlgNjTidGXhGIBFVR989y
TLSH	T11C0110FE743234B26F4385EA9D5350D60976D36F0BD06DAC2CE58B3414AE050A12222E
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	JAMESWT_WT
Tags:	datasphere-us-com sh

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

60

Origin country :

IT

Vendor Threat Intelligence

ACCE

Gathering data

ClamAV Detected

Detection(s):

SecuriteInfo.com.MacOS.Stealer-HG.44341774.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

evasive stealer

Link:

https://www.filescan.io/uploads/69cd5e232346b9da57b7829f/reports/6ed7cd70-b788-4465-b0e3-611b1ba0fb02/overview

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-03-26T14:30:00Z UTC

Last seen:

2026-03-26T20:40:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan-Downloader.Shell.Agent.dv not-a-virus:HEUR:Downloader.OSX.Agent.ad

Link:

https://opentip.kaspersky.com/5071bccbf4febcda396f6c588f9ff03155225300a6286a1b9700bcfa547d6e7c/results?tab=lookup

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/82dc64f5-a6b0-43cf-a6d1-7f0d2eb70f95

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

16%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/5071bccbf4febcda396f6c588f9ff03155225300a6286a1b9700bcfa547d6e7c

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/5071bccbf4febcda396f6c588f9ff03155225300a6286a1b9700bcfa547d6e7c/

Neiki Downloader.OSX.Agent

Verdict:

Malicious

Threat:

Downloader.OSX.Agent

Link:

https://tip.neiki.dev/file/5071bccbf4febcda396f6c588f9ff03155225300a6286a1b9700bcfa547d6e7c

ReversingLabs TitaniumCloud MacOS.Trojan.SuspMalScript

Threat name:

MacOS.Trojan.SuspMalScript

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-03-26 21:56:28 UTC

File Type:

Text (Shell)

AV detection:

12 of 36 (33.33%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=kby3zs7u726nuolpnrmi7h7qgfkseuyauyugug4xac6puvd5nz6a._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  6/10

Tags:

antivm discovery linux

Link:

https://tria.ge/reports/260401-wnrx5sey6l/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Checks CPU configuration

Looks up external IP address via web service

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.05

Link:

https://yomi.yoroi.company/submissions/5071bccbf4febcda396f6c588f9ff03155225300a6286a1b9700bcfa547d6e7c