MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8cd37b3de2d4e175cde202ef3bd2c51ab1f48053c46701efa470a250ff300e5a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	8cd37b3de2d4e175cde202ef3bd2c51ab1f48053c46701efa470a250ff300e5a
SHA3-384 hash:	fa6debd4f6dd61b6911f5d70dde530b3a0e082f0c02e07c0c079be6de115531c65e29c6a6f0e9cce872354ee82a99c39
SHA1 hash:	c266e040d5fe129921af22d0e0df75eeb2d49482
MD5 hash:	ff991b0932ec2910a1551808febb3801
humanhash:	robin-white-tennessee-rugby
File name:	8cd37b3de2d4e175cde202ef3bd2c51ab1f48053c46701efa470a250ff300e5a_from_78.27.235.70_redis_set.bin
Download:	download sample
File size:	930 bytes
First seen:	2026-07-31 10:44:45 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	24:Buu36Ow6o4u36Ow0o0Tor8Y+hLx1vc0BvBysfGxE:oum4ukb4YW1ETE
TLSH	T1A411BAB1B628CA24B44C50AD6D0CA3B5ECDE583F1A07AD0155105D36CA4FF8DA12C63C
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	nullblue67
Tags:	hexstrike kill-rivals sh shell ssh-backdoor takeover

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

59

Origin country :

ES

Vendor Threat Intelligence

ACCE Unknown

No detections

FileScan.IO Unknown

Verdict:

Unknown

Threat level:

  0/10

Confidence:

100%

Tags:

masquerade

Link:

https://www.filescan.io/uploads/6a6c7cd26949965037553824/reports/dfcb96ea-cb0f-45b6-b395-0206f5a94587/overview

Kaspersky OpenTIP Unknown

Verdict:

Unknown

File Type:

unix shell

Link:

https://opentip.kaspersky.com/8cd37b3de2d4e175cde202ef3bd2c51ab1f48053c46701efa470a250ff300e5a/results?tab=lookup

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/1a58b049-8ad8-4f5c-bd12-7e41c46f919f

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

3%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/8cd37b3de2d4e175cde202ef3bd2c51ab1f48053c46701efa470a250ff300e5a

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/8cd37b3de2d4e175cde202ef3bd2c51ab1f48053c46701efa470a250ff300e5a/

ReversingLabs TitaniumCloud Text.Trojan.Generic

Threat name:

Text.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2026-07-31 10:45:51 UTC

File Type:

Text (Shell)

AV detection:

4 of 24 (16.67%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=rtjxwppc2tqxltpcalxtxuwfdky7jactyrtqd35eocrfb7zqbzna._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

discovery linux persistence privilege_escalation

Link:

https://tria.ge/reports/260731-mtpwasgh87/

Behaviour

Reads runtime system information

Writes file to tmp directory

Modifies the /etc/hosts DNS resolution file

Adds new SSH keys

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/8cd37b3de2d4e175cde202ef3bd2c51ab1f48053c46701efa470a250ff300e5a