MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 8448e3fd5748e618814b8531e9339473991a18afd4f70cd109489a54ccc3fcaf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 6
| SHA256 hash: | 8448e3fd5748e618814b8531e9339473991a18afd4f70cd109489a54ccc3fcaf |
|---|---|
| SHA3-384 hash: | 185f51ab403b25fc13646d9c043742365029caebf3914562f175b17a077e61a16ed655a3b171d211bd29d1c11f6fec70 |
| SHA1 hash: | af6367a5c352ef086d2fea8245a286b9f7e0b776 |
| MD5 hash: | 8e58d9bb5a794a825d9a25d59ee279e1 |
| humanhash: | diet-fifteen-skylark-stairway |
| File name: | b |
| Download: | download sample |
| File size: | 203 bytes |
| First seen: | 2026-02-18 19:05:58 UTC |
| Last seen: | Never |
| File type: | sh |
| MIME type: | text/x-shellscript |
| ssdeep | 3:TKH4vWbDdQFRsfdQF5aS8dQFnvdIBFfQF5/u5dBdQFxvZzMNGTOtIWYpDeB+aKv7:hObaIuOA9yDB2/vuLrp2Nl |
| TLSH | T108D012C510D7A5E031FC44B331B6D91551C98A8ECE408D28DCDA35B3545DF0470D3965 |
| TrID | 70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1) |
| Magika | shell |
| Reporter | |
| Tags: | sh |
Shell script dropper
This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.
| URL | Malware sample (SHA256 hash) | Signature | Tags |
|---|---|---|---|
| http://103.251.236.118/multi/wget.sh | n/a | n/a | mirai opendir |
Intelligence
File Origin
# of uploads :
1
# of downloads :
119
Origin country :
DEVendor Threat Intelligence
No detections
Verdict:
Malicious
File Type:
unix shell
Detections:
HEUR:Trojan-Downloader.Shell.Agent.p
Status:
terminated
Behavior Graph:
Score:
77%
Verdict:
Malware
File Type:
SCRIPT
Verdict:
Malicious
Threat:
Family.MIRAI
Threat name:
Linux.Downloader.Malgent
Status:
Malicious
First seen:
2026-02-18 19:11:00 UTC
AV detection:
1 of 24 (4.17%)
Threat level:
3/5
Detection(s):
Suspicious file
Please note that we are no longer able to provide a coverage score for Virus Total.
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
sh 8448e3fd5748e618814b8531e9339473991a18afd4f70cd109489a54ccc3fcaf
(this sample)
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.