MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5486a8ff6e41a7c383aa88eed922b79361344fd0d41b8302c929ebd9600a7531. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	5486a8ff6e41a7c383aa88eed922b79361344fd0d41b8302c929ebd9600a7531
SHA3-384 hash:	a7f1bb02a6f8927d8737669076a2e7b46db059f51e0c222d757015d4c9abbbb1a49c9e10d0e2cdaac2c1113b4b4dd606
SHA1 hash:	22e8d4f1c8139d93c94fc266ee4ce71f37ef272a
MD5 hash:	700a8b7e8ddbaf6e41ca3f2fd40f6289
humanhash:	solar-mockingbird-mars-yankee
File name:	5486a8ff6e41a7c383aa88eed922b79361344fd0d41b8302c929ebd9600a7531
Download:	download sample
Signature	Prometei Alert Create hunting rule
File size:	1'973 bytes
First seen:	2026-07-25 21:06:02 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:nN4YAKdjO5f8XVyOWyBZu6Y5oAl4KxY5oAlXKG:nqYACO8XVyOjBZu6z9KxzdG
TLSH	T17E410FE0F479CC38B688E039A48F11683C96546F58997E18BDDEB83C5B5C50C20BE3B9
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	c2hunter
Tags:	Prometei sh wraith

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

82

Origin country :

US

Vendor Threat Intelligence

ACCE Unknown

No detections

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

busybox

Link:

https://www.filescan.io/uploads/6a6525615af95b68a85d2f19/reports/cbfdff18-b0ca-4843-a407-e0362b1dab5f/overview

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-07-25T17:42:00Z UTC

Last seen:

2026-07-27T00:33:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/5486a8ff6e41a7c383aa88eed922b79361344fd0d41b8302c929ebd9600a7531/results?tab=lookup

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/231f790b-3f32-4a65-bcd9-a94468588e03

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

14%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/5486a8ff6e41a7c383aa88eed922b79361344fd0d41b8302c929ebd9600a7531

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/5486a8ff6e41a7c383aa88eed922b79361344fd0d41b8302c929ebd9600a7531/

ReversingLabs TitaniumCloud Text.Trojan.Generic

Threat name:

Text.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2026-07-25 21:06:40 UTC

File Type:

Text (Shell)

AV detection:

5 of 24 (20.83%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ksdkr73oigt4ha5krdxnsivxsnqtit6q2qnygawjfhv5syakouyq._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

defense_evasion discovery execution linux persistence privilege_escalation

Link:

https://tria.ge/reports/260725-zx3msathna/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Changes its process name

Reads CPU attributes

Reads system network configuration

Creates/modifies Cron job

Enumerates active TCP sockets

Enumerates running processes

Modifies init.d

Modifies rc script

File and Directory Permissions Modification

Executes dropped EXE

Modifies Watchdog functionality

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.19

Link:

https://yomi.yoroi.company/submissions/5486a8ff6e41a7c383aa88eed922b79361344fd0d41b8302c929ebd9600a7531