MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 68746fc30c09671a367a3c6ed4fdfec7e9caeb919390391f77084c832c0af740. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	68746fc30c09671a367a3c6ed4fdfec7e9caeb919390391f77084c832c0af740
SHA3-384 hash:	68258a8b93d14f385e06899f97816f10fe7206da31f56e02b12f4103589e64d9e740ef5f4d0915dd49535d43169c406b
SHA1 hash:	46ac0720ee46f16ce9fd0e5f9e50f82461075dd0
MD5 hash:	1839048de4489995c31f7200039cd8c4
humanhash:	six-autumn-london-carolina
File name:	p.sh
Download:	download sample
Signature	XorDDoS Alert Create hunting rule
File size:	1'243 bytes
First seen:	2025-08-14 21:06:32 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	24:fN7Pvj3RqpZ5lFTKGtypIGo39L6mvkRexV5O:V7DhcZbFTFty5s9L1vkReVM
TLSH	T17121299955FA289075CD893F90AD9E8C8FCB2D964458120C63DFFFA8D0B856879C8334
Magika	shell
Reporter	abuse_ch
Tags:	sh

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

27

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Linux.DownLoader.37.8705.31135.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/689e507f9ef4d2ff7cfdd15b/reports/4e3791b0-2c98-4007-9694-423339389369/overview

Nucleon Malprob Susipicious

Score:

56%

Verdict:

Susipicious

File Type:

SCRIPT

Link:

https://malprob.io/report/68746fc30c09671a367a3c6ed4fdfec7e9caeb919390391f77084c832c0af740

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/68746fc30c09671a367a3c6ed4fdfec7e9caeb919390391f77084c832c0af740/

Neiki Clean

Verdict:

Clean

Link:

https://tip.neiki.dev/file/68746fc30c09671a367a3c6ed4fdfec7e9caeb919390391f77084c832c0af740

ReversingLabs TitaniumCloud Linux.Downloader.Generic

Threat name:

Linux.Downloader.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2025-08-14 21:09:35 UTC

File Type:

Text (Shell)

AV detection:

6 of 24 (25.00%)

Threat level:

  3/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=nb2g7qymbftrunt2hrxnj7p6y7u4v24rsoidsh3xbbgiglak65aa._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

n/a

Link:

https://tria.ge/reports/250814-zzhqds1tbt/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/68746fc30c09671a367a3c6ed4fdfec7e9caeb919390391f77084c832c0af740