🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8d445c842a912640c1a545ed78f06fb3b3f4e5a4be369b7f8bbd47e5eb9f82f5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry



Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments

SHA256 hash: 8d445c842a912640c1a545ed78f06fb3b3f4e5a4be369b7f8bbd47e5eb9f82f5
SHA3-384 hash: 5d9a3782333e1c4d989d46572f3bcb92ee4cd75f34687a05979d12a1e09a0e6e94e409538d34bb626d369c7c60fcbf30
SHA1 hash: 10cd064502d14eec97b7ccc2557236c4a9f752a4
MD5 hash: 89c9eeeb1410d2e82479bff41bbe8c6e
humanhash: social-neptune-jig-nebraska
File name:c10b.sh
Download: download sample
File size:440 bytes
First seen:2026-11-14 06:59:30 UTC
Last seen:Never
File type: sh
MIME type:text/plain
ssdeep 6:vbeuIT81KVA7cFqNRE8X+XFbV7zcZZBAKgi0+07dAYydy8hn:TeuRoA7cORE8E9IZDNgiJydUd3n
TLSH T156F0158BA7B009688263F8FC3624899031ECE10EACB0033FB878B0708482D217212FC3
Magika shell
Reporter Latin

Intelligence


File Origin
# of uploads :
1
# of downloads :
57
Origin country :
US US
Vendor Threat Intelligence
No detections
Status:
terminated
Behavior Graph:
%3 guuid=eb1fc8f9-1c00-0000-78bb-ac6ce1080000 pid=2273 /usr/bin/sudo guuid=4aea27fc-1c00-0000-78bb-ac6ce7080000 pid=2279 /tmp/sample.bin guuid=eb1fc8f9-1c00-0000-78bb-ac6ce1080000 pid=2273->guuid=4aea27fc-1c00-0000-78bb-ac6ce7080000 pid=2279 execve guuid=a01d61fc-1c00-0000-78bb-ac6ce9080000 pid=2281 /usr/bin/rm guuid=4aea27fc-1c00-0000-78bb-ac6ce7080000 pid=2279->guuid=a01d61fc-1c00-0000-78bb-ac6ce9080000 pid=2281 execve guuid=bba839fd-1c00-0000-78bb-ac6cea080000 pid=2282 /usr/bin/wget net send-data write-file guuid=4aea27fc-1c00-0000-78bb-ac6ce7080000 pid=2279->guuid=bba839fd-1c00-0000-78bb-ac6cea080000 pid=2282 execve guuid=f13b0034-1d00-0000-78bb-ac6c50090000 pid=2384 /usr/bin/chmod guuid=4aea27fc-1c00-0000-78bb-ac6ce7080000 pid=2279->guuid=f13b0034-1d00-0000-78bb-ac6c50090000 pid=2384 execve guuid=4b533b34-1d00-0000-78bb-ac6c52090000 pid=2386 /usr/bin/dash guuid=4aea27fc-1c00-0000-78bb-ac6ce7080000 pid=2279->guuid=4b533b34-1d00-0000-78bb-ac6c52090000 pid=2386 clone guuid=f2bcbc34-1d00-0000-78bb-ac6c55090000 pid=2389 /usr/bin/wget net send-data write-file guuid=4aea27fc-1c00-0000-78bb-ac6ce7080000 pid=2279->guuid=f2bcbc34-1d00-0000-78bb-ac6c55090000 pid=2389 execve guuid=02d1bd5e-1d00-0000-78bb-ac6cac090000 pid=2476 /usr/bin/chmod guuid=4aea27fc-1c00-0000-78bb-ac6ce7080000 pid=2279->guuid=02d1bd5e-1d00-0000-78bb-ac6cac090000 pid=2476 execve guuid=1ba1fb5e-1d00-0000-78bb-ac6cae090000 pid=2478 /usr/bin/dash guuid=4aea27fc-1c00-0000-78bb-ac6ce7080000 pid=2279->guuid=1ba1fb5e-1d00-0000-78bb-ac6cae090000 pid=2478 clone guuid=d6b0bd60-1d00-0000-78bb-ac6cb4090000 pid=2484 /usr/bin/wget net send-data write-file guuid=4aea27fc-1c00-0000-78bb-ac6ce7080000 pid=2279->guuid=d6b0bd60-1d00-0000-78bb-ac6cb4090000 pid=2484 execve guuid=1cbd488b-1d00-0000-78bb-ac6c210a0000 pid=2593 /usr/bin/chmod guuid=4aea27fc-1c00-0000-78bb-ac6ce7080000 pid=2279->guuid=1cbd488b-1d00-0000-78bb-ac6c210a0000 pid=2593 execve guuid=17b9aa8b-1d00-0000-78bb-ac6c230a0000 pid=2595 /usr/bin/dash guuid=4aea27fc-1c00-0000-78bb-ac6ce7080000 pid=2279->guuid=17b9aa8b-1d00-0000-78bb-ac6c230a0000 pid=2595 clone guuid=3d956b8c-1d00-0000-78bb-ac6c260a0000 pid=2598 /usr/bin/wget net send-data write-file guuid=4aea27fc-1c00-0000-78bb-ac6ce7080000 pid=2279->guuid=3d956b8c-1d00-0000-78bb-ac6c260a0000 pid=2598 execve guuid=9ece1dc0-1d00-0000-78bb-ac6c6b0a0000 pid=2667 /usr/bin/chmod guuid=4aea27fc-1c00-0000-78bb-ac6ce7080000 pid=2279->guuid=9ece1dc0-1d00-0000-78bb-ac6c6b0a0000 pid=2667 execve guuid=e57f7cc0-1d00-0000-78bb-ac6c6c0a0000 pid=2668 /usr/bin/dash guuid=4aea27fc-1c00-0000-78bb-ac6ce7080000 pid=2279->guuid=e57f7cc0-1d00-0000-78bb-ac6c6c0a0000 pid=2668 clone guuid=ebbb1fc1-1d00-0000-78bb-ac6c6e0a0000 pid=2670 /usr/bin/wget net send-data write-file guuid=4aea27fc-1c00-0000-78bb-ac6ce7080000 pid=2279->guuid=ebbb1fc1-1d00-0000-78bb-ac6c6e0a0000 pid=2670 execve guuid=40d55ae9-1d00-0000-78bb-ac6c9c0a0000 pid=2716 /usr/bin/chmod guuid=4aea27fc-1c00-0000-78bb-ac6ce7080000 pid=2279->guuid=40d55ae9-1d00-0000-78bb-ac6c9c0a0000 pid=2716 execve guuid=d60875ea-1d00-0000-78bb-ac6ca10a0000 pid=2721 /usr/bin/dash guuid=4aea27fc-1c00-0000-78bb-ac6ce7080000 pid=2279->guuid=d60875ea-1d00-0000-78bb-ac6ca10a0000 pid=2721 clone guuid=b0f431ec-1d00-0000-78bb-ac6ca60a0000 pid=2726 /usr/bin/wget net send-data write-file guuid=4aea27fc-1c00-0000-78bb-ac6ce7080000 pid=2279->guuid=b0f431ec-1d00-0000-78bb-ac6ca60a0000 pid=2726 execve guuid=cdd41919-1e00-0000-78bb-ac6ced0a0000 pid=2797 /usr/bin/chmod guuid=4aea27fc-1c00-0000-78bb-ac6ce7080000 pid=2279->guuid=cdd41919-1e00-0000-78bb-ac6ced0a0000 pid=2797 execve guuid=7bb88019-1e00-0000-78bb-ac6cee0a0000 pid=2798 /var/tmp/n6 net send-data guuid=4aea27fc-1c00-0000-78bb-ac6ce7080000 pid=2279->guuid=7bb88019-1e00-0000-78bb-ac6cee0a0000 pid=2798 execve 9e6aff35-36a5-5fe2-bbed-48bccf7d1fae 185.34.144.137:8888 guuid=bba839fd-1c00-0000-78bb-ac6cea080000 pid=2282->9e6aff35-36a5-5fe2-bbed-48bccf7d1fae send: 143B guuid=f2bcbc34-1d00-0000-78bb-ac6c55090000 pid=2389->9e6aff35-36a5-5fe2-bbed-48bccf7d1fae send: 142B guuid=d6b0bd60-1d00-0000-78bb-ac6cb4090000 pid=2484->9e6aff35-36a5-5fe2-bbed-48bccf7d1fae send: 142B guuid=3d956b8c-1d00-0000-78bb-ac6c260a0000 pid=2598->9e6aff35-36a5-5fe2-bbed-48bccf7d1fae send: 141B guuid=ebbb1fc1-1d00-0000-78bb-ac6c6e0a0000 pid=2670->9e6aff35-36a5-5fe2-bbed-48bccf7d1fae send: 144B guuid=b0f431ec-1d00-0000-78bb-ac6ca60a0000 pid=2726->9e6aff35-36a5-5fe2-bbed-48bccf7d1fae send: 141B guuid=7bb88019-1e00-0000-78bb-ac6cee0a0000 pid=2798->9e6aff35-36a5-5fe2-bbed-48bccf7d1fae send: 82B 525a0022-98da-5bfa-a694-3969c7914a1e 185.34.144.137:23004 guuid=7bb88019-1e00-0000-78bb-ac6cee0a0000 pid=2798->525a0022-98da-5bfa-a694-3969c7914a1e send: 288B
Result
Malware family:
n/a
Score:
  3/10
Tags:
execution
Behaviour
Modifies registry class
Suspicious use of SetWindowsHookEx
Enumerates physical storage devices
Executes a command shell one-liner
Please note that we are no longer able to provide a coverage score for Virus Total.

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Comments