MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7786c999ab43a02a2c39f2e3bcc82e7b41bdbf62c0877a309ed7b9ba6ac67c8a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	7786c999ab43a02a2c39f2e3bcc82e7b41bdbf62c0877a309ed7b9ba6ac67c8a
SHA3-384 hash:	7ce7e0b2acdc5dba2d1e4c372dce01c54c550ac33c3fa3b0101e7ac69968891e4686b5432d4e991e8ffe7919e859ce15
SHA1 hash:	fb5874e495c72a3ea81886087d33b90d48fc5e0b
MD5 hash:	983c788acc941b7adaa82d28848ea307
humanhash:	seventeen-charlie-connecticut-bacon
File name:	mbupload-htw_ikl5.bin
Download:	download sample
File size:	1'792 bytes
First seen:	2026-10-10 19:01:07 UTC
Last seen:	2026-10-11 12:59:55 UTC
File type:	sh
MIME type:	text/x-shellscript
ssdeep	24:cFYQIlawq7SmlLmFexZpiM/OAk53KszwG4uRNKdug2rzXRvGJLP+nHRh:cFulawq7Smxz//5kws04XR+J7+nHj
TLSH	T195317BEC7520D062FC9CE676FF8EAF665CC7676A072D290DACC30850B25C859209982C
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	wristhulk
Tags:	cowrie Downloader honeypot sh

wristhulk

Captured by a Cowrie honeypot at 2026-10-10 19:00:37 UTC, downloaded from http://176.65.139.231:8080/u/x7k9m2/wget.sh by 176.65.139.231.

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

83

Origin country :

NL

Vendor Threat Intelligence

ACCE Unknown

No detections

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

busybox masquerade

Link:

https://www.filescan.io/uploads/6aca8b881b8dd08584b47dba/reports/de8f55ed-6b2c-451e-b3d9-a45c03e90cb4/overview

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-10-10T16:02:00Z UTC

Last seen:

2026-10-12T14:02:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/7786c999ab43a02a2c39f2e3bcc82e7b41bdbf62c0877a309ed7b9ba6ac67c8a/results?tab=lookup

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/b5dd16f0-c409-494c-87db-caa5504cd278

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

1%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/7786c999ab43a02a2c39f2e3bcc82e7b41bdbf62c0877a309ed7b9ba6ac67c8a

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/7786c999ab43a02a2c39f2e3bcc82e7b41bdbf62c0877a309ed7b9ba6ac67c8a/

ReversingLabs TitaniumCloud Script-Shell.Trojan.Heuristic

Threat name:

Script-Shell.Trojan.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-10-10 19:01:26 UTC

File Type:

Text (Shell)

AV detection:

5 of 24 (20.83%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=o6dmtgnlioqculbz6lr3zsbopna33p3cycdxume62643u2wgpsfa._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

antivm defense_evasion discovery execution linux persistence privilege_escalation

Link:

https://tria.ge/reports/261010-xpdycah13z/

Behaviour

Command and Scripting Interpreter: Unix Shell

Enumerates kernel/hardware configuration

Reads runtime system information

Writes file to shm directory

Changes its process name

Checks CPU configuration

Creates/modifies Cron job

Enumerates running processes

Modifies systemd

Reads network interface configuration

Write file to user bin folder

File and Directory Permissions Modification

Executes dropped EXE

Modifies Watchdog functionality

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.