MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 83b36b3a80677d6ef4a165cbbc808b4889c76d194f976eab37a8dfe5c8eabae1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	83b36b3a80677d6ef4a165cbbc808b4889c76d194f976eab37a8dfe5c8eabae1
SHA3-384 hash:	578a01bedc0e4db14cc0ece48a3b46b22f27a38be52a7723a10aca49b16fb9a2a7f18ad17db33dd31a0ffbce251d452d
SHA1 hash:	28761d64d60ba0fabc09ad85f54a978ccbaa1da7
MD5 hash:	0d81e06af1f21c6d886c02849a8d115d
humanhash:	muppet-alpha-coffee-tennis
File name:	83b36b3a80677d6ef4a165cbbc808b4889c76d194f976eab37a8dfe5c8eabae1
Download:	download sample
File size:	697 bytes
First seen:	2026-10-01 20:38:56 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	12:5/KSmF7MYbbeMfTfNFSML1NRMW5M1NGM25m2MpMMk6+MPgOMVsoN/MMm1MYiuhmY:5/KR7MYbSMfB0ML1rMW5M1NGM2rMpMM7
TLSH	T1F801C2423492B0E3C18BEA39EF1FF1086522F083C530E944F45E69362F87225BAD6A50
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	spydisec
Tags:	cowrie dropper honeypot sh

spydisec

Captured by an SSH/Telnet honeypot (cowrie). Downloaded from http://45.207.157.28/backdoor.sh; attacker IP(s): 45.144.52.239; first seen 2026-10-01T20:17:10Z.

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

81

Origin country :

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.Linux.DownLoader.2650.11369.22674.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Unknown

Verdict:

Unknown

Threat level:

  0/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/6abec4f9a8d83a90e7424324/reports/71516968-105f-4524-b08a-d6b67fa699d0/overview

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-09-30T22:22:00Z UTC

Last seen:

2026-10-02T04:30:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/83b36b3a80677d6ef4a165cbbc808b4889c76d194f976eab37a8dfe5c8eabae1/results?tab=lookup

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/c0880347-9682-4ada-98d7-381f328a0235

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

26%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/83b36b3a80677d6ef4a165cbbc808b4889c76d194f976eab37a8dfe5c8eabae1

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/83b36b3a80677d6ef4a165cbbc808b4889c76d194f976eab37a8dfe5c8eabae1/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=qozwwouam56w55fbmxf3zaeljce4o3izj6lw5kzxvdp6lshkxlqq._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

defense_evasion discovery linux

Link:

https://tria.ge/reports/261001-zfejmayx7k/

Behaviour

System Network Configuration Discovery

Writes file to tmp directory

File and Directory Permissions Modification

Executes dropped EXE

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.36

Link:

https://yomi.yoroi.company/submissions/83b36b3a80677d6ef4a165cbbc808b4889c76d194f976eab37a8dfe5c8eabae1