MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7157b2f01595b417f3f36c5c18c3bf9794ebb9a00345ef3d5f4f6a28849e22f6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7157b2f01595b417f3f36c5c18c3bf9794ebb9a00345ef3d5f4f6a28849e22f6
SHA3-384 hash: 63ee1552cb88e20a3ccea934718245528af5bf9aa7a024751d867a8cef9368bb2430d3fe88b65e09835b7e39501dc101
SHA1 hash: 6a4e78c28bb2ea58ec5f2b9c9cdb3854fc5d3f3e
MD5 hash: c0850d4046aba816584a7921cf150378
humanhash: five-seventeen-west-nineteen
File name:tftp.sh
Download: download sample
File size:564 bytes
First seen:2026-02-18 04:11:00 UTC
Last seen:2026-02-18 04:48:13 UTC
File type: sh
MIME type:text/plain
ssdeep 6:bocPcdbdlhcehci0dFhcqhcrWitPQcGQcNhFd1QcgQclLKiD7:bgbj/1TEXhFKLK27
TLSH T174F01D786AB229778661AF08B411D8B9F8A7909C0DB78AC4953D01FCC567605FE70D3C
Magika shell
Reporter abuse_ch
Tags:sh

Intelligence

File Origin
# of uploads :
2
# of downloads :
71
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.BV.Downloader-AEH.11549137.UNOFFICIAL
Create hunting rule

Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
busybox
Link:
https://www.filescan.io/uploads/69953be497feb4afd649363b/reports/6cb0ec0b-725d-448d-80ba-bfa8a28ec4d1/overview
Result
Gathering data
Verdict:
Unknown
File Type:
Link:
https://opentip.kaspersky.com/7157b2f01595b417f3f36c5c18c3bf9794ebb9a00345ef3d5f4f6a28849e22f6/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/ec8ac338-02e0-4053-9d84-98d40e6ed2df
Behavior Graph:
Download SVG
%3 guuid=cedaf375-1600-0000-b85b-9f096e0c0000 pid=3182 /usr/bin/sudo guuid=1a700f78-1600-0000-b85b-9f09740c0000 pid=3188 /tmp/sample.bin guuid=cedaf375-1600-0000-b85b-9f096e0c0000 pid=3182->guuid=1a700f78-1600-0000-b85b-9f09740c0000 pid=3188 execve guuid=7e5e4d78-1600-0000-b85b-9f09760c0000 pid=3190 /usr/bin/rm delete-file guuid=1a700f78-1600-0000-b85b-9f09740c0000 pid=3188->guuid=7e5e4d78-1600-0000-b85b-9f09760c0000 pid=3190 execve guuid=fd52e978-1600-0000-b85b-9f09780c0000 pid=3192 /usr/bin/busybox send-data guuid=1a700f78-1600-0000-b85b-9f09740c0000 pid=3188->guuid=fd52e978-1600-0000-b85b-9f09780c0000 pid=3192 execve guuid=77d7257c-1900-0000-b85b-9f0987130000 pid=4999 /usr/bin/chmod guuid=1a700f78-1600-0000-b85b-9f09740c0000 pid=3188->guuid=77d7257c-1900-0000-b85b-9f0987130000 pid=4999 execve guuid=da82c07c-1900-0000-b85b-9f098a130000 pid=5002 /usr/bin/dash guuid=1a700f78-1600-0000-b85b-9f09740c0000 pid=3188->guuid=da82c07c-1900-0000-b85b-9f098a130000 pid=5002 clone guuid=eb41ee7c-1900-0000-b85b-9f098c130000 pid=5004 /usr/bin/busybox send-data guuid=1a700f78-1600-0000-b85b-9f09740c0000 pid=3188->guuid=eb41ee7c-1900-0000-b85b-9f098c130000 pid=5004 execve guuid=32faff80-1c00-0000-b85b-9f0989140000 pid=5257 /usr/bin/chmod guuid=1a700f78-1600-0000-b85b-9f09740c0000 pid=3188->guuid=32faff80-1c00-0000-b85b-9f0989140000 pid=5257 execve guuid=c6358281-1c00-0000-b85b-9f098a140000 pid=5258 /usr/bin/dash guuid=1a700f78-1600-0000-b85b-9f09740c0000 pid=3188->guuid=c6358281-1c00-0000-b85b-9f098a140000 pid=5258 clone guuid=c005a181-1c00-0000-b85b-9f098b140000 pid=5259 /usr/bin/busybox send-data guuid=1a700f78-1600-0000-b85b-9f09740c0000 pid=3188->guuid=c005a181-1c00-0000-b85b-9f098b140000 pid=5259 execve guuid=16722b85-1f00-0000-b85b-9f098c140000 pid=5260 /usr/bin/chmod guuid=1a700f78-1600-0000-b85b-9f09740c0000 pid=3188->guuid=16722b85-1f00-0000-b85b-9f098c140000 pid=5260 execve guuid=a939bf85-1f00-0000-b85b-9f098d140000 pid=5261 /usr/bin/dash guuid=1a700f78-1600-0000-b85b-9f09740c0000 pid=3188->guuid=a939bf85-1f00-0000-b85b-9f098d140000 pid=5261 clone guuid=8a2edd85-1f00-0000-b85b-9f098e140000 pid=5262 /usr/bin/busybox send-data guuid=1a700f78-1600-0000-b85b-9f09740c0000 pid=3188->guuid=8a2edd85-1f00-0000-b85b-9f098e140000 pid=5262 execve guuid=7dc14c89-2200-0000-b85b-9f098f140000 pid=5263 /usr/bin/chmod guuid=1a700f78-1600-0000-b85b-9f09740c0000 pid=3188->guuid=7dc14c89-2200-0000-b85b-9f098f140000 pid=5263 execve guuid=3ff69189-2200-0000-b85b-9f0990140000 pid=5264 /usr/bin/dash guuid=1a700f78-1600-0000-b85b-9f09740c0000 pid=3188->guuid=3ff69189-2200-0000-b85b-9f0990140000 pid=5264 clone guuid=0814a489-2200-0000-b85b-9f0991140000 pid=5265 /usr/bin/busybox send-data guuid=1a700f78-1600-0000-b85b-9f09740c0000 pid=3188->guuid=0814a489-2200-0000-b85b-9f0991140000 pid=5265 execve 2e3d310b-f930-56a5-aaab-4481d28a209a 158.94.208.69:69 guuid=fd52e978-1600-0000-b85b-9f09780c0000 pid=3192->2e3d310b-f930-56a5-aaab-4481d28a209a send: 252B guuid=eb41ee7c-1900-0000-b85b-9f098c130000 pid=5004->2e3d310b-f930-56a5-aaab-4481d28a209a send: 252B guuid=c005a181-1c00-0000-b85b-9f098b140000 pid=5259->2e3d310b-f930-56a5-aaab-4481d28a209a send: 252B guuid=8a2edd85-1f00-0000-b85b-9f098e140000 pid=5262->2e3d310b-f930-56a5-aaab-4481d28a209a send: 252B guuid=0814a489-2200-0000-b85b-9f0991140000 pid=5265->2e3d310b-f930-56a5-aaab-4481d28a209a send: 210B
Score:
37%
Verdict:
Susipicious
File Type:
SCRIPT
Link:
https://malprob.io/report/7157b2f01595b417f3f36c5c18c3bf9794ebb9a00345ef3d5f4f6a28849e22f6
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7157b2f01595b417f3f36c5c18c3bf9794ebb9a00345ef3d5f4f6a28849e22f6/
Verdict:
Clean
Link:
https://tip.neiki.dev/file/7157b2f01595b417f3f36c5c18c3bf9794ebb9a00345ef3d5f4f6a28849e22f6
Gathering data
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ofl3f4avsw2bp47tnrobrq57s6koxonaanc66pk7j5vcrbe6el3a._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/260218-er3elshs5a/
Behaviour
Modifies registry class
Suspicious use of SetWindowsHookEx
Enumerates physical storage devices
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/7157b2f01595b417f3f36c5c18c3bf9794ebb9a00345ef3d5f4f6a28849e22f6

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 7157b2f01595b417f3f36c5c18c3bf9794ebb9a00345ef3d5f4f6a28849e22f6

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3718746/
  
Delivery method
Distributed via web download

Comments