MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8b45f0f93f8c6a367bfcd7602e1a02ecfe886b5ed865c2a27cbc708ea1af5693. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry



Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments

SHA256 hash: 8b45f0f93f8c6a367bfcd7602e1a02ecfe886b5ed865c2a27cbc708ea1af5693
SHA3-384 hash: a374972430a62a797090adbaf78f86ecdc96a21fc1ad92fe401754286b24c9f5e7e1e7ec396e040be77f914194b72a63
SHA1 hash: 4949d134003c90c07caf6cc9a6e22188254715c2
MD5 hash: a2988a6b4e32edc35f6e2c5e686f3124
humanhash: cola-vegan-north-william
File name:traffaarch
Download: download sample
File size:245 bytes
First seen:2026-08-11 11:56:47 UTC
Last seen:2026-08-11 12:39:22 UTC
File type: sh
MIME type:text/plain
ssdeep 6:QOSB15fW8Y5copfW8Y5c8a2h2wRwCQmf0VO6hOWdGFfR:gVfA+sfA+5Q2kh0V5h5dk
TLSH T1A1D0A75B8062A96259F5D6803A395509854025C703DA2D0DF5DCE6E06F88C4DB251B20
Magika txt
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://176.65.139.211/cliaarchn/an/acensys elf ua-wget

Intelligence


File Origin
# of uploads :
12
# of downloads :
14
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
base64 expand lolbin
Status:
terminated
Behavior Graph:
%3 guuid=ffaffec1-1800-0000-45c8-5658f40b0000 pid=3060 /usr/bin/sudo guuid=d5e199c6-1800-0000-45c8-5658fc0b0000 pid=3068 /tmp/sample.bin guuid=ffaffec1-1800-0000-45c8-5658f40b0000 pid=3060->guuid=d5e199c6-1800-0000-45c8-5658fc0b0000 pid=3068 execve guuid=fa033ec7-1800-0000-45c8-5658ff0b0000 pid=3071 /usr/bin/curl net send-data write-file guuid=d5e199c6-1800-0000-45c8-5658fc0b0000 pid=3068->guuid=fa033ec7-1800-0000-45c8-5658ff0b0000 pid=3071 execve guuid=6a3e4442-1900-0000-45c8-56586d0c0000 pid=3181 /usr/bin/wget net send-data write-file guuid=d5e199c6-1800-0000-45c8-5658fc0b0000 pid=3068->guuid=6a3e4442-1900-0000-45c8-56586d0c0000 pid=3181 execve guuid=7de5268f-1900-0000-45c8-5658cb0c0000 pid=3275 /usr/bin/chmod guuid=d5e199c6-1800-0000-45c8-5658fc0b0000 pid=3068->guuid=7de5268f-1900-0000-45c8-5658cb0c0000 pid=3275 execve guuid=0701808f-1900-0000-45c8-5658cd0c0000 pid=3277 /usr/bin/dash zombie guuid=d5e199c6-1800-0000-45c8-5658fc0b0000 pid=3068->guuid=0701808f-1900-0000-45c8-5658cd0c0000 pid=3277 clone 0eae001c-4ad4-599c-ab6a-77d3fac12203 176.65.139.211:80 guuid=fa033ec7-1800-0000-45c8-5658ff0b0000 pid=3071->0eae001c-4ad4-599c-ab6a-77d3fac12203 send: 86B guuid=6a3e4442-1900-0000-45c8-56586d0c0000 pid=3181->0eae001c-4ad4-599c-ab6a-77d3fac12203 send: 137B
Result
Malware family:
n/a
Score:
  3/10
Tags:
execution
Behaviour
Modifies registry class
Suspicious use of SetWindowsHookEx
Enumerates physical storage devices
Executes a command shell one-liner
Please note that we are no longer able to provide a coverage score for Virus Total.

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 8b45f0f93f8c6a367bfcd7602e1a02ecfe886b5ed865c2a27cbc708ea1af5693

(this sample)

  
Delivery method
Distributed via web download

Comments