MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9452febf9f9538a7d9e34b029d34f6c09497e6f49e2df12ac27f29c8e22ca4da. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Threat unknown

Vendor detections: 4

Intelligence 4 IOCs YARA 3 File information Comments

SHA256 hash:	9452febf9f9538a7d9e34b029d34f6c09497e6f49e2df12ac27f29c8e22ca4da
SHA3-384 hash:	468d42b7f76f6fb38d1464d10d455bd7b02201e40dd22af4de7324b1873d049f7c5379d43d17c205fdb44410de8bcd53
SHA1 hash:	4aff0ceb93cbd66546f0428a1f875ec9cc27aa87
MD5 hash:	3ccd7ab36f349ead67533c63574425c5
humanhash:	batman-vermont-lima-vermont
File name:	ohshit.sh
Download:	download sample
File size:	890 bytes
First seen:	2026-03-23 22:48:50 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	24:ICl3wINj1z3RAYDrJ6aXUtyWMKOhClpClKCl2:IC5wyhznDN6aX+DMRCfC0C0
TLSH	T17A11DCAA31453AB2EA40D39D3ED1C23053C8C6D6ED2B55FC11BE40DC47DD0513E65271
Magika	txt
Reporter	abuse_ch
Tags:	sh

Shell script dropper

This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.

URL	Malware sample (SHA256 hash)	Signature	Tags
http://87.120.191.32/nuclear.x86	c04d526eb0f7c7660a19871d1675383c8eaf5336651b255c15f4da4708835eb7	Mirai	elf mirai

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection(s):

YARA.SIGNATURE_BASE_EXPL_RCE_React_Server_CVE_2025_55182_POC_Dec25.UNOFFICIAL

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/69c1c3674ec2f522cc549478/reports/13e7485c-e932-4513-9368-58e6947bc1d3/overview

Result

Gathering data

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/340a70a2-8590-4cd0-8ec9-917603b06828

Behavior Graph:

Download SVG

Score:

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/9452febf9f9538a7d9e34b029d34f6c09497e6f49e2df12ac27f29c8e22ca4da

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/9452febf9f9538a7d9e34b029d34f6c09497e6f49e2df12ac27f29c8e22ca4da/

Verdict:

Malicious

Threat:

Trojan-Downloader.Shell.Agent

Link:

https://tip.neiki.dev/file/9452febf9f9538a7d9e34b029d34f6c09497e6f49e2df12ac27f29c8e22ca4da

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=srjp5p47su4kpwpdjmbj2nhwyckjpzxutyw7ckwcp4u4ryrmutna._file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/260323-2rqgdaax7l/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/9452febf9f9538a7d9e34b029d34f6c09497e6f49e2df12ac27f29c8e22ca4da

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	ach_202412_suspect_bash_script Create hunting rule
Author:	abuse.ch
Description:	Detects suspicious Linux bash scripts

Rule name:	EXPL_RCE_React_Server_CVE_2025_55182_POC_Dec25 Create hunting rule
Author:	Florian Roth
Description:	Detects RCE indicators related to the proof-of-concept code for the React Server Remote Code Execution Vulnerability (CVE-2025-55182)
Reference:	https://www.youtube.com/watch?v=MmdwakT-Ve8

Rule name:	MAL_Linux_IoT_MultiArch_BotnetLoader_Generic Create hunting rule
Author:	Anish Bogati
Description:	Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:	MalwareBazaar sample lilin.sh