MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 92a0c2ba517f33e7fd5ad7e177e4cb8cff7318a6648bf43c7cecc63e7f74d568. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 3
| SHA256 hash: | 92a0c2ba517f33e7fd5ad7e177e4cb8cff7318a6648bf43c7cecc63e7f74d568 |
|---|---|
| SHA3-384 hash: | d6e17ef21a3a96cd144d7da2d6174cf41811b7c321d365f5d4feae9cfea91163a8cd16f0e9948815011b6284f835bf32 |
| SHA1 hash: | 75bc4bdbf703c72391a0688014f5d3d897bc1fd8 |
| MD5 hash: | cdb39da6d0d5796e06cbacf9e3ad6ab4 |
| humanhash: | pizza-finch-beryllium-thirteen |
| File name: | bot.sh |
| Download: | download sample |
| File size: | 727 bytes |
| First seen: | 2026-01-24 05:39:42 UTC |
| Last seen: | Never |
| File type: | sh |
| MIME type: | text/x-shellscript |
| ssdeep | 12:gHoo8tE9TcsqGDnH0lqU6WRoUIqp6U7IZZUlX70f5YeNUzHTf5DqA04s1KKFG2Ke:+oqICIWf/oU5jNUP5DqRN1VzbNfiE |
| TLSH | T13C01F9A1B9A0C4A3D334D06D370FC349FD47A297168D7C1008559DF48C59E9D340A53B |
| TrID | 70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1) |
| Magika | shell |
| Reporter | |
| Tags: | sh |
Shell script dropper
This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.
| URL | Malware sample (SHA256 hash) | Signature | Tags |
|---|---|---|---|
| http://176.65.132.231/bot. | n/a | n/a | elf ua-wget |
Intelligence
File Origin
# of uploads :
1
# of downloads :
43
Origin country :
DEVendor Threat Intelligence
No detections
Result
Gathering data
Status:
terminated
Behavior Graph:
Score:
97%
Verdict:
Malware
File Type:
SCRIPT
Detection(s):
Suspicious file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
sh 92a0c2ba517f33e7fd5ad7e177e4cb8cff7318a6648bf43c7cecc63e7f74d568
(this sample)
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.