MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 8b45f0f93f8c6a367bfcd7602e1a02ecfe886b5ed865c2a27cbc708ea1af5693. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 4
| SHA256 hash: | 8b45f0f93f8c6a367bfcd7602e1a02ecfe886b5ed865c2a27cbc708ea1af5693 |
|---|---|
| SHA3-384 hash: | a374972430a62a797090adbaf78f86ecdc96a21fc1ad92fe401754286b24c9f5e7e1e7ec396e040be77f914194b72a63 |
| SHA1 hash: | 4949d134003c90c07caf6cc9a6e22188254715c2 |
| MD5 hash: | a2988a6b4e32edc35f6e2c5e686f3124 |
| humanhash: | cola-vegan-north-william |
| File name: | traffaarch |
| Download: | download sample |
| File size: | 245 bytes |
| First seen: | 2026-08-11 11:56:47 UTC |
| Last seen: | 2026-08-11 12:39:22 UTC |
| File type: | sh |
| MIME type: | text/plain |
| ssdeep | 6:QOSB15fW8Y5copfW8Y5c8a2h2wRwCQmf0VO6hOWdGFfR:gVfA+sfA+5Q2kh0V5h5dk |
| TLSH | T1A1D0A75B8062A96259F5D6803A395509854025C703DA2D0DF5DCE6E06F88C4DB251B20 |
| Magika | txt |
| Reporter |  abuse_ch |
| Tags: | sh |
Shell script dropper
This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.
| URL | Malware sample (SHA256 hash) | Signature | Tags |
|---|---|---|---|
| http://176.65.139.211/cliaarch | n/a | n/a | censys elf ua-wget |
Intelligence
File Origin
# of uploads :
12
# of downloads :
16
Origin country :
DEVendor Threat Intelligence
No detections
Detection(s):
Verdict:
Likely Malicious
Threat level:
7.5/10
Confidence:
100%
Tags:
base64 expand lolbin
Verdict:
Unknown
File Type:
text
Status:
terminated
Behavior Graph:
Score:
91%
Verdict:
Malware
File Type:
SCRIPT
Detection(s):
Suspicious file
Result
Malware family:
n/a
Score:
3/10
Tags:
execution
Behaviour
Modifies registry class
Suspicious use of SetWindowsHookEx
Enumerates physical storage devices
Executes a command shell one-liner
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
sh 8b45f0f93f8c6a367bfcd7602e1a02ecfe886b5ed865c2a27cbc708ea1af5693
(this sample)
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.