MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 918b9337232affb041f3c28276de48ec6203aa2eac320d4c56e87da0ee209e1b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	918b9337232affb041f3c28276de48ec6203aa2eac320d4c56e87da0ee209e1b
SHA3-384 hash:	bb383d18a5214d55bb5f548059d6ea72dbec16254c29ca604342ffa682ffdb2dea88b5a6abc8f339d36363210241445c
SHA1 hash:	19e4a4bad2a98bc0854c385513e44a9206d63063
MD5 hash:	036319f1302bec544041a3390c0da711
humanhash:	wisconsin-zebra-edward-cola
File name:	snypetcp.sh
Download:	download sample
File size:	6'621 bytes
First seen:	2026-10-13 09:17:19 UTC
Last seen:	2026-10-13 10:31:34 UTC
File type:	sh
MIME type:	text/x-shellscript
ssdeep	96:C29bCLeyMbJwg+t7CXTLJz4SJ7SPe0qneS56sqhWYI7UDJyJtZAF8OnxCu:DByMbGgTTLJz4SJWPelV5JAOwyJtWp1
TLSH	T1EAD15083B84BA673BACE507C67D5B0012187192B9735EC18B45FA8207F707A5F4FAB15
TrID	50.0% (.SH) Linux/UNIX shell script (7000/1) 28.5% (.PL) Perl script (4000/1/1) 21.4% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	adliwahid

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

71

Origin country :

NL

Vendor Threat Intelligence

ACCE Unknown

No detections

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-10-13T01:56:00Z UTC

Last seen:

2026-10-13T15:13:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/918b9337232affb041f3c28276de48ec6203aa2eac320d4c56e87da0ee209e1b/results?tab=lookup

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/eb184794-cf48-4e93-a828-183486eeb04a

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

15%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/918b9337232affb041f3c28276de48ec6203aa2eac320d4c56e87da0ee209e1b

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/918b9337232affb041f3c28276de48ec6203aa2eac320d4c56e87da0ee209e1b/

ReversingLabs TitaniumCloud Linux.Trojan.Generic

Threat name:

Linux.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2026-10-13 05:17:55 UTC

File Type:

Text (Shell)

AV detection:

4 of 23 (17.39%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=sgfzgnzdfl73aqptykbhnxsi5rrahkrovqza2tcw5b62b3ratynq._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

defense_evasion discovery linux

Link:

https://tria.ge/reports/261013-k9pt5avsh1/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

File and Directory Permissions Modification

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/918b9337232affb041f3c28276de48ec6203aa2eac320d4c56e87da0ee209e1b