MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6b94e16e486df4ae0960c0cf0ce0e0425a5b9a4b98ea18503468d4cdde93409e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	6b94e16e486df4ae0960c0cf0ce0e0425a5b9a4b98ea18503468d4cdde93409e
SHA3-384 hash:	3a1cd20c70ed7f9a60311ad61b131f0f16201426afe3ab17b607099647363ae1b3ca5e2bb66cf6b51a6ddb552f284b76
SHA1 hash:	f1990fadb8b67c52859474dfde448462e9ebb60e
MD5 hash:	6a8bb543b3d7e2e193e472161f7740ae
humanhash:	avocado-cola-vegan-summer
File name:	6b94e16e486df4ae0960c0cf0ce0e0425a5b9a4b98ea18503468d4cdde93409e
Download:	download sample
File size:	745 bytes
First seen:	2026-04-01 10:29:02 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	12:Sjly97dG3BCFrCR5Va7hFHYfDlKpFeixnLQmT/adGXhG1ugykYP9RcADB73O9y:OUxdGxCFmkt1EDlgNjTidGXhGIBFVR9l
TLSH	T1380110FE783234B25F43C5EA9D5394970976D36F5FD02DAC28E6873414AE010A13222D
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	JAMESWT_WT
Tags:	pilautfile-com sh

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

46

Origin country :

IT

Vendor Threat Intelligence

ACCE

Gathering data

ClamAV Detected

Detection(s):

SecuriteInfo.com.MacOS.Stealer-HG.83242592.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

evasive stealer

Link:

https://www.filescan.io/uploads/69ccf37d00ad3636940995ed/reports/5950fbb0-45ce-4c64-b23e-d43aabc3cda6/overview

InQuest

Result

Gathering data

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-03-29T07:03:00Z UTC

Last seen:

2026-03-29T12:43:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/6b94e16e486df4ae0960c0cf0ce0e0425a5b9a4b98ea18503468d4cdde93409e/results?tab=lookup

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/0b01668d-1bde-4d02-a349-62670d9ae2a7

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

17%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/6b94e16e486df4ae0960c0cf0ce0e0425a5b9a4b98ea18503468d4cdde93409e

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/6b94e16e486df4ae0960c0cf0ce0e0425a5b9a4b98ea18503468d4cdde93409e/

Neiki Downloader.OSX.Agent

Verdict:

Malicious

Threat:

Downloader.OSX.Agent

Link:

https://tip.neiki.dev/file/6b94e16e486df4ae0960c0cf0ce0e0425a5b9a4b98ea18503468d4cdde93409e

ReversingLabs TitaniumCloud MacOS.Trojan.SuspMalScript

Threat name:

MacOS.Trojan.SuspMalScript

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-03-29 11:58:01 UTC

File Type:

Text (Shell)

AV detection:

10 of 36 (27.78%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=nokoc3sinx2k4claydhqzyhaijnfxgsltdvbqubundkm3xuticpa._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  6/10

Tags:

antivm discovery linux

Link:

https://tria.ge/reports/260401-mjdehset2v/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Checks CPU configuration

Looks up external IP address via web service

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.05

Link:

https://yomi.yoroi.company/submissions/6b94e16e486df4ae0960c0cf0ce0e0425a5b9a4b98ea18503468d4cdde93409e