MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 6497f4d0c65e56b12ea4dfd170bfac891cf8b4612fa4e8fa4825cb59a8b96ea8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 3
| SHA256 hash: | 6497f4d0c65e56b12ea4dfd170bfac891cf8b4612fa4e8fa4825cb59a8b96ea8 |
|---|---|
| SHA3-384 hash: | a8b87f45bf41efc8290f040e934ae23100a3077c97f89ecd15e70113a382ef4df095689d16bfb420de15c36401c8424b |
| SHA1 hash: | c3a2beda3998b6e0ce1fcae63f7f25c4fe12e39b |
| MD5 hash: | 224443c8b8cfca5467c5fcc94f913025 |
| humanhash: | oscar-jupiter-oscar-cola |
| File name: | 302l |
| Download: | download sample |
| File size: | 293 bytes |
| First seen: | 2026-09-30 18:11:44 UTC |
| Last seen: | Never |
| File type: | sh |
| MIME type: | text/x-shellscript |
| ssdeep | 6:UqLqhR47DcKULt1cK8MNIiAz+MNIcK8MNQkYcK8MN25FTEX3:UquhRADEt1VAgVIVsQ |
| TLSH | T147E08C50E6A13E142675E90A83D4930A927557B0B94CBA6D94D986E20AA44C2358DF94 |
| TrID | 70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1) |
| Magika | shell |
| Reporter |  arados |
| Tags: | sh |
Shell script dropper
This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.
| URL | Malware sample (SHA256 hash) | Signature | Tags |
|---|---|---|---|
| http://84.200.33.163/302/tokenlinux.sh | n/a | n/a | DPRK git-hook js NodeJS sh XCTDH ContagiousInterview |
Intelligence
File Origin
# of uploads :
1
# of downloads :
26
Origin country :
HRVendor Threat Intelligence
No detections
Verdict:
Unknown
Threat level:
2.5/10
Confidence:
100%
Tags:
bash lolbin
Status:
terminated
Behavior Graph:
Score:
24%
Verdict:
Benign
File Type:
SCRIPT
Detection(s):
Suspicious file
Result
Malware family:
n/a
Score:
3/10
Tags:
discovery linux
Behaviour
Reads runtime system information
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Tron
Score:
1.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
sh 6497f4d0c65e56b12ea4dfd170bfac891cf8b4612fa4e8fa4825cb59a8b96ea8
(this sample)
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.