MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 601b3a1706d6a7e40008edf407e468fa4dbd8701718b40252ecd14ddc53dd1d2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	601b3a1706d6a7e40008edf407e468fa4dbd8701718b40252ecd14ddc53dd1d2
SHA3-384 hash:	d2e87d3bcaffb94f84f7aac84a68cb7985be1ff69d002938e03d5050f2a72d64bfb71b06545c10fc922a2206da2d4b82
SHA1 hash:	ada99f3c24c3165933f4e348c1efa15b89d80b78
MD5 hash:	1eba58d4c74886a8620ba24653cdc403
humanhash:	sierra-hydrogen-utah-speaker
File name:	run.sh
Download:	download sample
File size:	623 bytes
First seen:	2026-10-27 05:25:03 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	12:Zx80LzJa33LeHt4ayzKuPfFFHshByuFNkjXfahx:g0a3CHt4aIpnF1/ihx
TLSH	T1E3F0ACB766B0DD313964CA2EE9AB81F01007282328252509704FBF01BF2CA8CF285655
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	BlinkzSec

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

54

Origin country :

US

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.Linux.DownLoader.2650.1100.8114.UNOFFICIAL

Alert

Create hunting rule

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-10-26T06:37:00Z UTC

Last seen:

2026-10-26T07:08:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/601b3a1706d6a7e40008edf407e468fa4dbd8701718b40252ecd14ddc53dd1d2/results?tab=lookup

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/cfe8ff7f-68bc-443c-b9db-8335a33e2117

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

97%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/601b3a1706d6a7e40008edf407e468fa4dbd8701718b40252ecd14ddc53dd1d2

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/601b3a1706d6a7e40008edf407e468fa4dbd8701718b40252ecd14ddc53dd1d2/

ReversingLabs TitaniumCloud Script-BAT.Downloader.Heuristic

Threat name:

Script-BAT.Downloader.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-10-27 04:51:00 UTC

File Type:

Text (Shell)

AV detection:

6 of 36 (16.67%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=mantufyg22t6iaai5x2apzdi7jg33bybogfuajjozukn3rj52hja._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

defense_evasion discovery linux

Link:

https://tria.ge/reports/261027-f4g5wabw8r/

Behaviour

System Network Configuration Discovery

Writes file to tmp directory

File and Directory Permissions Modification

Executes dropped EXE

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.