MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7f0c6678d94bed94ddd2369bb5d59ead44fb2777dbb1ca27d86143f3cf73e1b8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	7f0c6678d94bed94ddd2369bb5d59ead44fb2777dbb1ca27d86143f3cf73e1b8
SHA3-384 hash:	17481438717b8932a5fcf58807939b7af788ef96028a442750d9b8a2461cce0fc0bc30dc3d59628f63a07e53e2b0d4b0
SHA1 hash:	aaa21ed14f41c2fc9981c92f7e32cf6d2dca92cb
MD5 hash:	073cef07cce6c05352b4ff4ab66dfd40
humanhash:	massachusetts-washington-item-vermont
File name:	Nx_8507.sh
Download:	download sample
File size:	3'229 bytes
First seen:	2026-10-02 04:09:44 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	96:tuVlrqPWweuaXurwJa9MsrI3srarwYpDS9S0rur0r0ri6:dWBNXs6
TLSH	T15B612EACA067EDD93EFA4E39F32E40001847DE5F64B53EA4564BF8BD806C2C40624BE1
Magika	shell
Reporter	boredchilada2
Tags:	citrix-netscaler cve-2026-88771 sh shell-script webshell

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

70

Origin country :

CA

Vendor Threat Intelligence

ACCE Unknown

No detections

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/6abf2eae02712c34dfc35040/reports/d8b8c40f-b56f-4b44-878c-e82c7139a5d2/overview

Kaspersky OpenTIP Unknown

Verdict:

Unknown

File Type:

unix shell

Link:

https://opentip.kaspersky.com/7f0c6678d94bed94ddd2369bb5d59ead44fb2777dbb1ca27d86143f3cf73e1b8/results?tab=lookup

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/e92fa5c6-19b5-4574-9c18-c3cfe79a8736

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

3%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/7f0c6678d94bed94ddd2369bb5d59ead44fb2777dbb1ca27d86143f3cf73e1b8

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/7f0c6678d94bed94ddd2369bb5d59ead44fb2777dbb1ca27d86143f3cf73e1b8/

ReversingLabs TitaniumCloud Linux.Trojan.Generic

Threat name:

Linux.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2026-10-02 04:10:27 UTC

File Type:

Text (Shell)

AV detection:

5 of 23 (21.74%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=p4ggm6gzjpwzjxosg2n3lvm6vvcpwj3x3oy4uj6ymfb7ht3t4g4a._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

execution

Link:

https://tria.ge/reports/261002-erh1zateqa/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Executes a command shell one-liner

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/7f0c6678d94bed94ddd2369bb5d59ead44fb2777dbb1ca27d86143f3cf73e1b8