MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 752894233bc3d36b1638d8bcc66eb31f1ca240bf7b2e7390b63f360b3ccdf4d3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry



Threat unknown


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments

SHA256 hash: 752894233bc3d36b1638d8bcc66eb31f1ca240bf7b2e7390b63f360b3ccdf4d3
SHA3-384 hash: 177fb0353d4bffeb498090630eb2b79da2da2b118847ba354b272839bd995b38ece06e82a02ca117c8b603fcc5c802e1
SHA1 hash: 5f07676a1ba5eb798ee0d0048bffcbbe2920ac80
MD5 hash: b153009b1d6c0a6b5a951c2ec0534248
humanhash: oxygen-foxtrot-winter-illinois
File name:s
Download: download sample
File size:357 bytes
First seen:2026-07-14 10:05:04 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 6:h4wCW6VwNrX0rZG1fa0NLGwWmDe9+einysDfC0RX6un4Gonwgf+mVmq:s6lLyABDa0Aunhgf+m1
TLSH T199E026A2B2C055B12C4ACD321A4B64F7825B89520EE35FE0B0C91934620CBFAF44985A
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter BlinkzSec

Intelligence


File Origin
# of uploads :
1
# of downloads :
55
Origin country :
DK DK
Vendor Threat Intelligence
No detections
Verdict:
Unknown
File Type:
unix shell
First seen:
2026-07-14T07:47:00Z UTC
Last seen:
2026-07-14T08:12:00Z UTC
Hits:
~10
Status:
terminated
Behavior Graph:
%3 guuid=30734f37-1f00-0000-2ab2-cb6f43140000 pid=5187 /usr/bin/sudo guuid=ebd76a3b-1f00-0000-2ab2-cb6f46140000 pid=5190 /tmp/sample.bin write-file guuid=30734f37-1f00-0000-2ab2-cb6f43140000 pid=5187->guuid=ebd76a3b-1f00-0000-2ab2-cb6f46140000 pid=5190 execve guuid=2694cf3b-1f00-0000-2ab2-cb6f47140000 pid=5191 /usr/bin/mount guuid=ebd76a3b-1f00-0000-2ab2-cb6f46140000 pid=5190->guuid=2694cf3b-1f00-0000-2ab2-cb6f47140000 pid=5191 execve guuid=a8b4923c-1f00-0000-2ab2-cb6f48140000 pid=5192 /usr/bin/mount guuid=ebd76a3b-1f00-0000-2ab2-cb6f46140000 pid=5190->guuid=a8b4923c-1f00-0000-2ab2-cb6f48140000 pid=5192 execve guuid=3f9d323d-1f00-0000-2ab2-cb6f49140000 pid=5193 /usr/bin/rm guuid=ebd76a3b-1f00-0000-2ab2-cb6f46140000 pid=5190->guuid=3f9d323d-1f00-0000-2ab2-cb6f49140000 pid=5193 execve guuid=e3097b3d-1f00-0000-2ab2-cb6f4a140000 pid=5194 /usr/bin/mkfifo guuid=ebd76a3b-1f00-0000-2ab2-cb6f46140000 pid=5190->guuid=e3097b3d-1f00-0000-2ab2-cb6f4a140000 pid=5194 execve guuid=b924113e-1f00-0000-2ab2-cb6f4b140000 pid=5195 /usr/bin/dash guuid=ebd76a3b-1f00-0000-2ab2-cb6f46140000 pid=5190->guuid=b924113e-1f00-0000-2ab2-cb6f4b140000 pid=5195 execve guuid=19631c3e-1f00-0000-2ab2-cb6f4c140000 pid=5196 /usr/bin/busybox net guuid=ebd76a3b-1f00-0000-2ab2-cb6f46140000 pid=5190->guuid=19631c3e-1f00-0000-2ab2-cb6f4c140000 pid=5196 execve guuid=5f2d2c3e-1f00-0000-2ab2-cb6f4d140000 pid=5197 /usr/bin/sleep guuid=ebd76a3b-1f00-0000-2ab2-cb6f46140000 pid=5190->guuid=5f2d2c3e-1f00-0000-2ab2-cb6f4d140000 pid=5197 execve 2a2a9f86-ed70-5e45-837f-4ee7cbdd5d74 209.38.118.65:4444 guuid=19631c3e-1f00-0000-2ab2-cb6f4c140000 pid=5196->2a2a9f86-ed70-5e45-837f-4ee7cbdd5d74 con
Result
Malware family:
n/a
Score:
  3/10
Tags:
discovery linux
Behaviour
Reads runtime system information
Writes file to tmp directory
Please note that we are no longer able to provide a coverage score for Virus Total.

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Comments