MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a59aede38be720ea96b927c9a8580ee7509d0d9f187dc6995be9e972a6030aa6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	a59aede38be720ea96b927c9a8580ee7509d0d9f187dc6995be9e972a6030aa6
SHA3-384 hash:	b466e374fd3d985713eb57c47914a40a30da69605e70348842969d7af18f2fe6956bf15c3cbded1cc4d8ed81aa035f7b
SHA1 hash:	c7932618fccccfe3217572db2a7a37eb48f093e4
MD5 hash:	ce679f171e380683951d59bb80316407
humanhash:	nebraska-table-ink-cardinal
File name:	loader.sh
Download:	download sample
File size:	1'964 bytes
First seen:	2026-04-16 01:19:53 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:zVdxxzGG1eCFeZdzVKN5Q1f/neHuDmmlBFInKIYgQAul4N7vGxQ:RdnIu2mQlGaL2nKI3QaTGC
TLSH	T1E241BDCA7AA3D97197C7C4381FDAE101E35624430996A998B08EBC303F69160FCB1E56
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	BastianHein
Tags:	sh

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

35

Origin country :

CL

Vendor Threat Intelligence

ACCE Unknown

No detections

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

opendir

Link:

https://www.filescan.io/uploads/69e0396f3a506932d7c18843/reports/8446bdef-7449-4414-be87-8c064ea47271/overview

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-04-15T22:13:00Z UTC

Last seen:

2026-04-16T14:01:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/a59aede38be720ea96b927c9a8580ee7509d0d9f187dc6995be9e972a6030aa6/results?tab=lookup

Nucleon Malprob Benign

Score:

9%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/a59aede38be720ea96b927c9a8580ee7509d0d9f187dc6995be9e972a6030aa6

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a59aede38be720ea96b927c9a8580ee7509d0d9f187dc6995be9e972a6030aa6/

Neiki Trojan-Downloader.Wget.HTTP

Verdict:

Malicious

Threat:

Trojan-Downloader.Wget.HTTP

Link:

https://tip.neiki.dev/file/a59aede38be720ea96b927c9a8580ee7509d0d9f187dc6995be9e972a6030aa6

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=uwno3y4l44qovfvze7e2qwao45ij2dm7db64ngk35huxfjqdbkta._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

defense_evasion discovery linux

Link:

https://tria.ge/reports/260416-bqf87sgx8y/

Behaviour

GoLang User-Agent

Enumerates kernel/hardware configuration

Reads runtime system information

Writes file to shm directory

Writes file to tmp directory

Enumerates running processes

File and Directory Permissions Modification

Executes dropped EXE

Unexpected DNS network traffic destination

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.11

Link:

https://yomi.yoroi.company/submissions/a59aede38be720ea96b927c9a8580ee7509d0d9f187dc6995be9e972a6030aa6