🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9f31fd8d4594aee286c5970ecd89358bba96f987324d0ba500a4f630d74cf789. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9f31fd8d4594aee286c5970ecd89358bba96f987324d0ba500a4f630d74cf789
SHA3-384 hash: b95b2b03985e2383ccff9034a55ad8c8ca9dfc529eb3876ba1600ab4cfa2cb8eaf4c017fbdbaf498e6563b2282c0acea
SHA1 hash: 172145cf99a44bd3bdc97796338955858f4b5863
MD5 hash: a343433171ef7d6fcb76ca61373332a2
humanhash: fifteen-cardinal-march-may
File name:loader.sh
Download: download sample
File size:1'615 bytes
First seen:2026-09-07 19:20:36 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 48:8+kepNcIpEojTlzVl58VBjHvtroEj1nu7GyLyrKFX4y:bBwZwTlh
TLSH T1843190473CD5751187CB1079579AA241A8E20A3BFE21CE8D740F59354F6EFC6392DA84
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter BlinkzSec

Intelligence

File Origin
# of uploads :
1
# of downloads :
36
Origin country :
AE AE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-09-07T17:59:00Z UTC
Last seen:
2026-09-07T18:40:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/9f31fd8d4594aee286c5970ecd89358bba96f987324d0ba500a4f630d74cf789/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/9842f5c6-5f65-418d-a999-9942487b9df6
Behavior Graph:
Download SVG
%3 guuid=e683d42f-1800-0000-0731-5fca060a0000 pid=2566 /usr/bin/sudo guuid=a588e133-1800-0000-0731-5fca130a0000 pid=2579 /tmp/sample.bin guuid=e683d42f-1800-0000-0731-5fca060a0000 pid=2566->guuid=a588e133-1800-0000-0731-5fca130a0000 pid=2579 execve guuid=8cfb8f34-1800-0000-0731-5fca160a0000 pid=2582 /usr/bin/bash guuid=a588e133-1800-0000-0731-5fca130a0000 pid=2579->guuid=8cfb8f34-1800-0000-0731-5fca160a0000 pid=2582 clone guuid=04bb9c35-1800-0000-0731-5fca1d0a0000 pid=2589 /usr/bin/mkdir guuid=a588e133-1800-0000-0731-5fca130a0000 pid=2579->guuid=04bb9c35-1800-0000-0731-5fca1d0a0000 pid=2589 execve guuid=516ffe35-1800-0000-0731-5fca1f0a0000 pid=2591 /usr/bin/bash guuid=a588e133-1800-0000-0731-5fca130a0000 pid=2579->guuid=516ffe35-1800-0000-0731-5fca1f0a0000 pid=2591 clone guuid=e9657536-1800-0000-0731-5fca220a0000 pid=2594 /usr/bin/wget net guuid=a588e133-1800-0000-0731-5fca130a0000 pid=2579->guuid=e9657536-1800-0000-0731-5fca220a0000 pid=2594 execve guuid=50b89039-1800-0000-0731-5fca290a0000 pid=2601 /usr/bin/curl net guuid=a588e133-1800-0000-0731-5fca130a0000 pid=2579->guuid=50b89039-1800-0000-0731-5fca290a0000 pid=2601 execve guuid=bddbec41-1800-0000-0731-5fca440a0000 pid=2628 /usr/bin/wget net guuid=a588e133-1800-0000-0731-5fca130a0000 pid=2579->guuid=bddbec41-1800-0000-0731-5fca440a0000 pid=2628 execve guuid=e9b62b44-1800-0000-0731-5fca4b0a0000 pid=2635 /usr/bin/curl net guuid=a588e133-1800-0000-0731-5fca130a0000 pid=2579->guuid=e9b62b44-1800-0000-0731-5fca4b0a0000 pid=2635 execve guuid=4213c534-1800-0000-0731-5fca170a0000 pid=2583 /usr/bin/date guuid=8cfb8f34-1800-0000-0731-5fca160a0000 pid=2582->guuid=4213c534-1800-0000-0731-5fca170a0000 pid=2583 execve guuid=6e6aca34-1800-0000-0731-5fca180a0000 pid=2584 /usr/bin/sha256sum guuid=8cfb8f34-1800-0000-0731-5fca160a0000 pid=2582->guuid=6e6aca34-1800-0000-0731-5fca180a0000 pid=2584 execve guuid=b25dd534-1800-0000-0731-5fca1a0a0000 pid=2586 /usr/bin/head guuid=8cfb8f34-1800-0000-0731-5fca160a0000 pid=2582->guuid=b25dd534-1800-0000-0731-5fca1a0a0000 pid=2586 execve guuid=c4cc0f36-1800-0000-0731-5fca200a0000 pid=2592 /usr/bin/uname guuid=516ffe35-1800-0000-0731-5fca1f0a0000 pid=2591->guuid=c4cc0f36-1800-0000-0731-5fca200a0000 pid=2592 execve fe26f427-538c-5707-ac13-a31600d7b93f 94.154.43.227:8080 guuid=e9657536-1800-0000-0731-5fca220a0000 pid=2594->fe26f427-538c-5707-ac13-a31600d7b93f con guuid=50b89039-1800-0000-0731-5fca290a0000 pid=2601->fe26f427-538c-5707-ac13-a31600d7b93f con guuid=bddbec41-1800-0000-0731-5fca440a0000 pid=2628->fe26f427-538c-5707-ac13-a31600d7b93f con guuid=e9b62b44-1800-0000-0731-5fca4b0a0000 pid=2635->fe26f427-538c-5707-ac13-a31600d7b93f con
Score:
10%
Verdict:
Benign
File Type:
SCRIPT
Link:
https://malprob.io/report/9f31fd8d4594aee286c5970ecd89358bba96f987324d0ba500a4f630d74cf789
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9f31fd8d4594aee286c5970ecd89358bba96f987324d0ba500a4f630d74cf789/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=t4y73dkfssxofbwfs4hm3cjvro5jn6mhgjgqxjiaut3dbv2m66eq._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
discovery linux
Link:
https://tria.ge/reports/260907-x2rd7stgjb/
Behaviour
Reads runtime system information
System Network Configuration Discovery
Writes file to tmp directory
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.11
Link:
https://yomi.yoroi.company/submissions/9f31fd8d4594aee286c5970ecd89358bba96f987324d0ba500a4f630d74cf789

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments