MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 90e72cb310525972af1e9d97cd837d48aaf87a429930b507f56befddff1ff713. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	90e72cb310525972af1e9d97cd837d48aaf87a429930b507f56befddff1ff713
SHA3-384 hash:	2ecf5f5902c3804d111cdc2f1666df95f66e05bafd7910ea316d3137279456bbcc86e59cbe133fbbd357f14b98844c09
SHA1 hash:	3c11433b0e5a3354dab55eea7b535074e3c11103
MD5 hash:	27c926823687337fe491a0578dcee3bf
humanhash:	maine-saturn-kilo-oscar
File name:	wget.sh
Download:	download sample
Signature	Gafgyt Alert Create hunting rule
File size:	4'172 bytes
First seen:	2026-07-08 02:04:27 UTC
Last seen:	2026-07-08 14:37:45 UTC
File type:	sh
MIME type:	text/x-shellscript
ssdeep	24:j96f0fs+L+Jmgs+LJlSlLxs+L5M7ldls+L0fxf2Us+LuifibVs+Lcmfm0GCGs+Le:ev5F7Fh
TLSH	T12B8171E6F834A522304DFAFCF217A7848746CEB990BB3601A046AD7301CF558B54DBB1
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	sh

Intelligence

---

File Origin

# of uploads :

3

# of downloads :

93

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

busybox downloader evasive

Link:

https://www.filescan.io/uploads/6a4db03084fca90021cbf604/reports/269596e0-6008-48a7-b5a8-c38bb3470a01/overview

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-07-07T20:05:00Z UTC

Last seen:

2026-07-09T17:19:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan-Downloader.Shell.Agent.p

Link:

https://opentip.kaspersky.com/90e72cb310525972af1e9d97cd837d48aaf87a429930b507f56befddff1ff713/results?tab=lookup

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/0f6922d3-1948-49f6-b2b4-1ee2a0a9f0db

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

99%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/90e72cb310525972af1e9d97cd837d48aaf87a429930b507f56befddff1ff713

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/90e72cb310525972af1e9d97cd837d48aaf87a429930b507f56befddff1ff713/

Neiki Trojan-Downloader.Shell.Agent

Verdict:

Malicious

Threat:

Trojan-Downloader.Shell.Agent

Link:

https://tip.neiki.dev/file/90e72cb310525972af1e9d97cd837d48aaf87a429930b507f56befddff1ff713

ReversingLabs TitaniumCloud Script.Trojan.Malgent

Threat name:

Script.Trojan.Malgent

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-07-07 23:07:36 UTC

AV detection:

8 of 24 (33.33%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=sdtszmyqkjmxfly6twl43a35jcvpq6scteylkb7vnpx537y764jq._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

antivm defense_evasion discovery execution linux persistence privilege_escalation

Link:

https://tria.ge/reports/260708-chk3vshz9q/

Behaviour

Enumerates kernel/hardware configuration

Reads runtime system information

Writes file to tmp directory

Changes its process name

Checks CPU configuration

Reads system network configuration

Creates/modifies Cron job

Enumerates active TCP sockets

Enumerates running processes

Modifies systemd

Reads MAC address of network interface

File and Directory Permissions Modification

Deletes itself

Executes dropped EXE

Modifies Watchdog functionality

VMRay Mirai

Malware family:

Mirai

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/90e72cb31052/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.31

Link:

https://yomi.yoroi.company/submissions/90e72cb310525972af1e9d97cd837d48aaf87a429930b507f56befddff1ff713