MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7948d3c2d350fdde560231c5c9b40f6ff51f1547a5dedc2cc53b59db9792b0c7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	7948d3c2d350fdde560231c5c9b40f6ff51f1547a5dedc2cc53b59db9792b0c7
SHA3-384 hash:	34e5ac87e02d2b6bd37ddd9a78f943079afa9d769df4db6994b90e81f01be2b2b670d839f3dd1004fc396d13c113c194
SHA1 hash:	c5e675842dfe0f36241911abd245c8db69208162
MD5 hash:	ee730424ae61b79066238ca2c7ae3c23
humanhash:	magnesium-rugby-diet-autumn
File name:	check.sh
Download:	download sample
File size:	847 bytes
First seen:	2026-06-08 05:07:47 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	12:oEkDJFFHR1OuZU4CcxK9twF9Y4raEU6CRM1qvT4cDjhEgOk4Moq1bo2Q:oE+H1mBDMK9CF9YhEUXMM/hE4H1b2
TLSH	T1C601ABDAA2206D303D8981AE33E7845C5242015F08CB7FD0BCCD64A01F1C548B051B39
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	BlinkzSec

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

48

Origin country :

CH

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

URLhaus.3860875.UNOFFICIAL

Alert

Create hunting rule

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-06-08T02:11:00Z UTC

Last seen:

2026-06-08T12:59:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan-Downloader.Shell.Agent.cw

Link:

https://opentip.kaspersky.com/7948d3c2d350fdde560231c5c9b40f6ff51f1547a5dedc2cc53b59db9792b0c7/results?tab=lookup

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/c1512eef-5a22-4534-8f71-ac64cd61f6df

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

78%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/7948d3c2d350fdde560231c5c9b40f6ff51f1547a5dedc2cc53b59db9792b0c7

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/7948d3c2d350fdde560231c5c9b40f6ff51f1547a5dedc2cc53b59db9792b0c7/

Neiki Trojan-Downloader.Shell.Agent

Verdict:

Malicious

Threat:

Trojan-Downloader.Shell.Agent

Link:

https://tip.neiki.dev/file/7948d3c2d350fdde560231c5c9b40f6ff51f1547a5dedc2cc53b59db9792b0c7

ReversingLabs TitaniumCloud Linux.Trojan.Generic

Threat name:

Linux.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2026-06-08 05:07:45 UTC

File Type:

Text (Shell)

AV detection:

9 of 24 (37.50%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=pfenhqwtkd654vqcghc4tnapn72r6fkhuxpnylgfhnm5xf4swddq._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  6/10

Tags:

antivm discovery execution linux persistence privilege_escalation

Link:

https://tria.ge/reports/260608-fsrvyagy3k/

Behaviour

Reads runtime system information

Checks CPU configuration

Reads CPU attributes

Creates/modifies Cron job

Enumerates running processes

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/7948d3c2d350fdde560231c5c9b40f6ff51f1547a5dedc2cc53b59db9792b0c7