MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5affc8fc3a0071b201282bbea31d654065518e75292e10e685c0a01eaf4dda79. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	5affc8fc3a0071b201282bbea31d654065518e75292e10e685c0a01eaf4dda79
SHA3-384 hash:	aa5e65e357449ed13c835f58ead8048da824d5b8d0c86e517e2cd5188160474b706a7fc9b6754cb8718cfb3a14310219
SHA1 hash:	3e900e3afc6fb289e315a050273f004a547be733
MD5 hash:	6e6ef4b53663b00a035e19cfcc3c4fc5
humanhash:	item-coffee-emma-robert
File name:	payload.sh
Download:	download sample
File size:	337 bytes
First seen:	2026-10-03 16:56:50 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	6:hFNqFhv3FhvWNFFVygxpUVWRWRnCNrmGJxpUVWRs2ma0mjrqDtKKytVcSEhcyDFz:hFuhvVhvWr3ySUVWRxxUVWRsmr2I3cSi
TLSH	T15BE086D51540F631FA298FBC71BB05355261AAF6F23125ACA1EB47B50B0A2117222F17
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	sh

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

65

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/6ac13413950162c437138615/reports/605581a7-53ef-4789-bb86-1cd0f885b4db/overview

Kaspersky OpenTIP Adware

Verdict:

Adware

File Type:

unix shell

First seen:

2026-10-03T13:57:00Z UTC

Last seen:

2026-10-05T06:30:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/5affc8fc3a0071b201282bbea31d654065518e75292e10e685c0a01eaf4dda79/results?tab=lookup

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/b1eb49b3-d414-4425-99d3-7d20baff7d9c

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

12%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/5affc8fc3a0071b201282bbea31d654065518e75292e10e685c0a01eaf4dda79

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/5affc8fc3a0071b201282bbea31d654065518e75292e10e685c0a01eaf4dda79/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ll74r7b2aby3eajifo7kghlfibsvddtvfexbbzufycqb5l2n3j4q._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

antivm credential_access defense_evasion discovery execution linux persistence

Link:

https://tria.ge/reports/261003-vgm5yashjf/

Behaviour

Software Deployment Tools

Command and Scripting Interpreter: Python

Command and Scripting Interpreter: Unix Shell

Enumerates kernel/hardware configuration

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Changes its process name

Checks CPU configuration

Deletes log files

Write file to user bin folder

Executes dropped EXE

OS Credential Dumping

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.34

Link:

https://yomi.yoroi.company/submissions/5affc8fc3a0071b201282bbea31d654065518e75292e10e685c0a01eaf4dda79