MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6ce6b4ebd1a25b971fcc9e1b8ef8ff00d2aed3b5117b3799bd1943c4400f9fbd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	6ce6b4ebd1a25b971fcc9e1b8ef8ff00d2aed3b5117b3799bd1943c4400f9fbd
SHA3-384 hash:	8e3eda3c7e3fd336215d9d55e9e58c3fc0681103c5c97a097f9aba15bb51ab2595a121faf4f2c61f63cf3ae03e2d8fd3
SHA1 hash:	7f5ce872fc798b1c46ce72125f40c75d60297c21
MD5 hash:	04a17846ab2e9305ad06095dc9586540
humanhash:	jig-three-thirteen-foxtrot
File name:	Nx_7508.sh
Download:	download sample
File size:	3'539 bytes
First seen:	2026-10-02 04:09:56 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	96:tuVxr4t7fMNoNrjwNynyIaxBxIs1r1Isr8rr8IQ/Is0r0iSHk0pg0r6r1T0yU6:R7Ei5wCyL/dJIUT/8AN6
TLSH	T12271DFACA4979DD93EEA4E36F12EC0102C87DE9B64797EE04643B4FD805D2C62464AA1
Magika	shell
Reporter	boredchilada2
Tags:	citrix-netscaler cve-2026-88771 sh shell-script webshell

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

67

Origin country :

CA

Vendor Threat Intelligence

ACCE Unknown

No detections

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/6abf2eac1ee8857d71629b4d/reports/ce0b13af-89f7-4135-a880-9cac887416c6/overview

Kaspersky OpenTIP Unknown

Verdict:

Unknown

File Type:

text

Link:

https://opentip.kaspersky.com/6ce6b4ebd1a25b971fcc9e1b8ef8ff00d2aed3b5117b3799bd1943c4400f9fbd/results?tab=lookup

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/4fb2e668-3f1a-44cb-8a2c-a93f9d8559b3

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

4%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/6ce6b4ebd1a25b971fcc9e1b8ef8ff00d2aed3b5117b3799bd1943c4400f9fbd

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/6ce6b4ebd1a25b971fcc9e1b8ef8ff00d2aed3b5117b3799bd1943c4400f9fbd/

ReversingLabs TitaniumCloud Linux.Trojan.Generic

Threat name:

Linux.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2026-10-02 04:10:29 UTC

File Type:

Text (Shell)

AV detection:

5 of 24 (20.83%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=nttlj26rujnzoh6mtyny56h7adjk5u5vcf5tpgn5dfb4iqapt66q._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

execution

Link:

https://tria.ge/reports/261002-erh1zateqc/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Executes a command shell one-liner

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/6ce6b4ebd1a25b971fcc9e1b8ef8ff00d2aed3b5117b3799bd1943c4400f9fbd