MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6f8b55ba7a28deafa7b37b55651261d73bf91ce4cda3ff919d8fb0da0ab846c2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	6f8b55ba7a28deafa7b37b55651261d73bf91ce4cda3ff919d8fb0da0ab846c2
SHA3-384 hash:	dbc916e1aa66f8a58054df05be7da770b16fd646548e95956c37683831676341de8bff4e5bd73adb02a9c2be94c49fc5
SHA1 hash:	e36a93efc28fa8f10578124dd6c6e65a00cbeaf2
MD5 hash:	4468b06ac21707fa8eea8e88293f17a7
humanhash:	cola-xray-edward-foxtrot
File name:	zed
Download:	download sample
File size:	27'812 bytes
First seen:	2026-09-11 18:10:32 UTC
Last seen:	Never
File type:
MIME type:	text/x-perl
ssdeep	384:p0st+HD4MDp2fLLnlr8JZNHJsajfdv3+yZ1h3le:estaD4MDp2fLzlr8JbJskGyLh3A
TLSH	T1F7C2934918E38A52A3B7F07A1BDED4197B5BC1974B0DDE107DAD42D6AF50038D2F8AC8
TrID	50.0% (.) Unix-like shebang (var.1) (gen) (7000/1) 28.5% (.PL) Perl script (4000/1/1) 21.4% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	perl
Reporter	JasperB
Tags:	pl

JasperB

Targets a vulnerability in (old, unpatched) Zimbra and is 'delivered' through SMTP

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

12

Origin country :

NL

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

Legacy.Trojan.Agent-1388651

Alert

Create hunting rule

Win.Trojan.Perl-35

Alert

Create hunting rule

Win.Trojan.Perl-38

Alert

Create hunting rule

Win.Trojan.Perl-44

Alert

Create hunting rule

{HEX}perl.backdoor.shellbot.UNOFFICIAL

Alert

Create hunting rule

{HEX}perl.botclient.Arabhack.195.UNOFFICIAL

Alert

Create hunting rule

{HEX}perl.botclient.karawan.264.UNOFFICIAL

Alert

Create hunting rule

{HEX}perl.botclient.KcB.218.UNOFFICIAL

Alert

Create hunting rule

{HEX}perl.botclient.oldwolf.269.UNOFFICIAL

Alert

Create hunting rule

{HEX}perl.botclient.pitbull.279.UNOFFICIAL

Alert

Create hunting rule

{HEX}perl.botclient.putr4XtReme.282.UNOFFICIAL

Alert

Create hunting rule

{HEX}perl.botclient.stealth.305.UNOFFICIAL

Alert

Create hunting rule

{HEX}perl.botclient.xdh.306.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ac9ad1bb34bfb31c9066700linux22vpnfull_triage

Tags:

shellbot virus

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-09-11T15:15:00Z UTC

Last seen:

2026-09-12T20:06:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/6f8b55ba7a28deafa7b37b55651261d73bf91ce4cda3ff919d8fb0da0ab846c2/results?tab=lookup

Nucleon Malprob Malware

Score:

99%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/6f8b55ba7a28deafa7b37b55651261d73bf91ce4cda3ff919d8fb0da0ab846c2

CERT.PL MWDB

Gathering data

ReversingLabs TitaniumCloud Script-Perl.Backdoor.ShellBot

Threat name:

Script-Perl.Backdoor.ShellBot

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-09-12 03:07:28 UTC

File Type:

Text (Perl)

AV detection:

28 of 38 (73.68%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=n6fvlot2fdpk7j5tpnkwketb2457shhezwr77em5r6ynucvyi3ba._file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.