MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a1ec3e5dc2ae13818feef7470c9b0475ce4052d121eaf28629a38cf4abab9812. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	a1ec3e5dc2ae13818feef7470c9b0475ce4052d121eaf28629a38cf4abab9812
SHA3-384 hash:	395c382785e432a0f866c83fe7ff9c9041af234f4f4f60459fa921b8e684e5a0f5ed6fb616a6b71483ea38a60c24a2d9
SHA1 hash:	37262851a0b6948150bcb8ae6849419ffb856e18
MD5 hash:	0b999b5afef6de20a34d932e40e36bcc
humanhash:	spaghetti-earth-potato-leopard
File name:	l.sh
Download:	download sample
File size:	537 bytes
First seen:	2026-08-03 05:48:03 UTC
Last seen:	2026-08-03 18:10:40 UTC
File type:	sh
MIME type:	text/plain
ssdeep	12:Psna0cIMcTiYQkiuy4ghsesFrFBEGghgu+hYuTyisJF8EpASeyiiuyw:J01/XZrTBEGCnuoLpvY
TLSH	T105F0591DF88584BEA47FC9DABBE63E8D000FA101594B2E2E93BC6C06F4B9C084081477
Magika	shell
Reporter	abuse_ch
Tags:	sh

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

61

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.Linux.DownLoader.2243.15546.30319.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

downloader

Link:

https://www.filescan.io/uploads/6a702ba87a24f2690e5dacf3/reports/a168c0cf-e2e5-4743-b53e-f55d075580af/overview

Kaspersky OpenTIP Unknown

Verdict:

Unknown

File Type:

ps1

First seen:

2026-07-31T21:58:00Z UTC

Last seen:

2026-08-04T05:50:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/a1ec3e5dc2ae13818feef7470c9b0475ce4052d121eaf28629a38cf4abab9812/results?tab=lookup

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/6f23501e-0b3e-40c1-a8b0-b2ea73d38722

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

97%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/a1ec3e5dc2ae13818feef7470c9b0475ce4052d121eaf28629a38cf4abab9812

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a1ec3e5dc2ae13818feef7470c9b0475ce4052d121eaf28629a38cf4abab9812/

ReversingLabs TitaniumCloud Script-Shell.Trojan.Geninst

Threat name:

Script-Shell.Trojan.Geninst

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-08-03 04:36:03 UTC

File Type:

Text (Shell)

AV detection:

12 of 24 (50.00%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=uhwd4xocvyjydd7o65dqzgyeoxheauwrehvpfbrjuogpjk5ltaja._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

execution

Link:

https://tria.ge/reports/260803-ghmznscp2x/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

Executes a command shell one-liner

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/a1ec3e5dc2ae13818feef7470c9b0475ce4052d121eaf28629a38cf4abab9812