MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 7bda06e6a8b04ad89ca8214a3fda4bce593b8bf3606b54ed2a0279413ac124d1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 4
| SHA256 hash: | 7bda06e6a8b04ad89ca8214a3fda4bce593b8bf3606b54ed2a0279413ac124d1 |
|---|---|
| SHA3-384 hash: | 9d396c9bcccefd97e32200be6dec56e2f377ed9b21dae4c63f8b143731531a3ff57b6d90f1385eb0908d6c357ce7e183 |
| SHA1 hash: | f86dbde74c1de87f24b2287098899557413e1b5b |
| MD5 hash: | 2a5a293c79804d977be9ec14533da033 |
| humanhash: | snake-enemy-oscar-california |
| File name: | rt.sh |
| Download: | download sample |
| File size: | 295 bytes |
| First seen: | 2026-10-27 04:42:48 UTC |
| Last seen: | Never |
| File type: | sh |
| MIME type: | text/x-shellscript |
| ssdeep | 6:h/7eL+RHutASNkYBLQ5qLQk0D8+pzH7k62B5PKAD8OpzH4o:57dtutAWzB4qdpkzH7hh1UzH4o |
| TLSH | T131E0CDE6E1625C6030CDEE3CA2BD8B74D8CF05231414A37870537DA5A41C94DB244FD5 |
| TrID | 70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1) |
| Magika | shell |
| Reporter |  BlinkzSec |
Shell script dropper
This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.
| URL | Malware sample (SHA256 hash) | Signature | Tags |
|---|---|---|---|
| http://31.56.209.86/t_r | n/a | n/a | elf ua-wget |
Intelligence
File Origin
# of uploads :
1
# of downloads :
45
Origin country :
ATVendor Threat Intelligence
No detections
Verdict:
Adware
File Type:
unix shell
First seen:
2026-10-19T00:44:00Z UTC
Last seen:
2026-10-25T17:23:00Z UTC
Hits:
~10
Status:
terminated
Behavior Graph:
Score:
33%
Verdict:
Susipicious
File Type:
SCRIPT
Gathering data
Detection(s):
Suspicious file
Result
Malware family:
n/a
Score:
3/10
Tags:
linux
Behaviour
Writes file to tmp directory
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
sh 7bda06e6a8b04ad89ca8214a3fda4bce593b8bf3606b54ed2a0279413ac124d1
(this sample)
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.