MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5fde1a8ba0bdfbbbe4a6cb2085fc195c3d745854c2776a757e4cc2d040185db2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	5fde1a8ba0bdfbbbe4a6cb2085fc195c3d745854c2776a757e4cc2d040185db2
SHA3-384 hash:	472ab23a63ae0012662d5f24173d551bbdc1cd7791ecff54843271700510d38045df3f86eb9fec5b2b4f9a64e508526e
SHA1 hash:	a6e304f88d06c121396d21096486aefa2f02e015
MD5 hash:	3340a4e9b69366a45df986c4b45083d0
humanhash:	fourteen-muppet-violet-nebraska
File name:	x
Download:	download sample
File size:	14'694 bytes
First seen:	2026-07-22 12:23:35 UTC
Last seen:	2026-07-23 06:39:48 UTC
File type:	sh
MIME type:	text/x-shellscript
ssdeep	192:11gsb1gjix8Sj1VAEBUADGP/6B0i1gh4BuWKTT5GqkgA:zSiWqA4UADAZdhQuW5r
TLSH	T10C6271F1F96D98363BCCB478F29D980CAAC31C3F1AAA3620501BAD65041D769631DB7D
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	sh

Intelligence

---

File Origin

# of uploads :

3

# of downloads :

71

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

{HEX}php.generic.globals.503.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

base64 bash downloader evasive lolbin obfuscated obfuscated

Link:

https://www.filescan.io/uploads/6a60b683dbe11f7f434a49df/reports/f329543e-a3f5-4fea-8b96-9cb43623a87a/overview

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-07-22T10:58:00Z UTC

Last seen:

2026-07-23T22:18:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/5fde1a8ba0bdfbbbe4a6cb2085fc195c3d745854c2776a757e4cc2d040185db2/results?tab=lookup

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/d1f08832-8d8a-4f9c-8167-68c868f7b1e3

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

98%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/5fde1a8ba0bdfbbbe4a6cb2085fc195c3d745854c2776a757e4cc2d040185db2

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/5fde1a8ba0bdfbbbe4a6cb2085fc195c3d745854c2776a757e4cc2d040185db2/

ReversingLabs TitaniumCloud Script-BAT.Downloader.Heuristic

Threat name:

Script-BAT.Downloader.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-07-22 12:26:42 UTC

File Type:

Text (Shell)

AV detection:

9 of 24 (37.50%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=l7pbvc5axx53xzfgzmqil7azlq6xiwcuyj3wu5l6jtbnaqaylwza._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

credential_access defense_evasion discovery execution linux persistence privilege_escalation

Link:

https://tria.ge/reports/260722-plcxwahn4t/

Behaviour

Enumerates kernel/hardware configuration

Reads runtime system information

Writes file to tmp directory

Deobfuscate/Decode Files or Information

Creates .desktop file

Modifies Bash startup script

Adds a user to the system

Creates/modifies Cron job

Creates/modifies environment variables

Deletes log files

Enumerates running processes

Modifies rc script

Deletes Audit logs

Deletes system logs

OS Credential Dumping

Modifies password files for system users/ groups

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.