MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 72f79d17e8b3fddef6800b134bddb0e26b2ceb47dc34a9ce006cdf2a476c16a0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 5
| SHA256 hash: | 72f79d17e8b3fddef6800b134bddb0e26b2ceb47dc34a9ce006cdf2a476c16a0 |
|---|---|
| SHA3-384 hash: | 64ebac805a0d5fed85e0e99e876c169e30b9ad78665064240b8bc36726505bf473ccc6ad1a23fe711c867fabef6ecc4c |
| SHA1 hash: | 4f225f6d903f180d62f6246ac773c60742afb0be |
| MD5 hash: | d27b618b9b12910706cba840c1b624e2 |
| humanhash: | lemon-oxygen-indigo-alpha |
| File name: | 2dfc3df264e5fdd440df3a7466922a7228001af837832252e15bfd17b5343c68.sh |
| Download: | download sample |
| File size: | 1'448 bytes |
| First seen: | 2026-06-25 14:57:26 UTC |
| Last seen: | Never |
| File type: | sh |
| MIME type: | text/x-shellscript |
| ssdeep | 24:3XtpR0vE9ubjmYBtgE3yHO6LwK9QlQWFhJte+ShG6TvKBvenSTkO:3N0vGITngE3r6L99QlQWFlJSQeKBvaSH |
| TLSH | T1B331C928B24D7336F89765E432C83E913742DF49B4B8B98DF55A937C809D2196219D30 |
| TrID | 70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1) |
| Magika | shell |
| Reporter | Anonymous |
| Tags: | ClickFix sh |
Intelligence
File Origin
# of uploads :
1
# of downloads :
52
Origin country :
AUVendor Threat Intelligence
No detections
Verdict:
Likely Malicious
Threat level:
7.5/10
Confidence:
100%
Tags:
stealer
Status:
terminated
Behavior Graph:
Score:
0%
Verdict:
Benign
File Type:
SCRIPT
Verdict:
Malicious
Threat:
Trojan.Shell.Agent
Threat name:
MacOS.Trojan.MacSyncStealer
Status:
Malicious
First seen:
2026-06-25 15:01:11 UTC
File Type:
Text (Shell)
AV detection:
16 of 36 (44.44%)
Threat level:
5/5
Detection(s):
Suspicious file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
sh 72f79d17e8b3fddef6800b134bddb0e26b2ceb47dc34a9ce006cdf2a476c16a0
(this sample)
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.