MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a7134d1fc413ee698703fd269a950902fd2b27ab46cc6fe795f81a0247763184. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a7134d1fc413ee698703fd269a950902fd2b27ab46cc6fe795f81a0247763184
SHA3-384 hash: c554aa853e289977bf8c021c2a879164f0056fc29cc4c1403bac4e96a7c506f8c7b6c2a046b431c672afbc38907cb970
SHA1 hash: 25eb29f8815d479fa661bb23b77de531ec8912c5
MD5 hash: b2cc1a1de4175d533abeaf4e5937e8c6
humanhash: queen-hawaii-hamper-washington
File name:run.sh
Download: download sample
File size:2'881 bytes
First seen:2026-06-04 10:02:23 UTC
Last seen:2026-06-05 01:44:01 UTC
File type: sh
MIME type:text/plain
ssdeep 24:jQ2JMfVbiBHWuZ2E3EnE2EhEGFzbwCjJUfWzhM3m:jQ2JMfVbiBHWuZ22cvyPzbwizhM3m
TLSH T1CD516D9B02004F3297088B5FB7F0B5B4A60AF8DA6ADBC604FD50086C0FCAD9C3395E51
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://45.153.34.230/bins/xnxnxnxnxnxnxnxnaarch64xnxnn/an/acensys elf ua-wget
http://45.153.34.230/bins/xnxnxnxnxnxnxnxni386xnxnn/an/acensys elf ua-wget
http://45.153.34.230/bins/xnxnxnxnxnxnxnxnloongarch64xnxnn/an/acensys elf ua-wget
http://45.153.34.230/bins/xnxnxnxnxnxnxnxnm68kxnxnn/an/acensys elf ua-wget
http://45.153.34.230/bins/xnxnxnxnxnxnxnxnmicroblazexnxnn/an/acensys elf ua-wget
http://45.153.34.230/bins/xnxnxnxnxnxnxnxnmipsxnxnn/an/acensys elf ua-wget
http://45.153.34.230/bins/xnxnxnxnxnxnxnxnor1kxnxnn/an/acensys elf ua-wget
http://45.153.34.230/bins/xnxnxnxnxnxnxnxnpowerpcxnxnn/an/acensys elf ua-wget
http://45.153.34.230/bins/xnxnxnxnxnxnxnxnriscv32xnxnn/an/acensys elf ua-wget
http://45.153.34.230/bins/xnxnxnxnxnxnxnxnriscv64xnxnn/an/acensys elf ua-wget
http://45.153.34.230/bins/xnxnxnxnxnxnxnxnsh2xnxnn/an/acensys elf ua-wget
http://45.153.34.230/bins/xnxnxnxnxnxnxnxnsh4xnxnn/an/acensys elf ua-wget
http://45.153.34.230/bins/xnxnxnxnxnxnxnxnx86_64xnxnn/an/acensys elf ua-wget

Intelligence

File Origin
# of uploads :
3
# of downloads :
51
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive
Link:
https://www.filescan.io/uploads/6a214d724bb6e36d180af2a9/reports/97429311-a6e6-4da6-828f-5ad99d836931/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-06-04T07:20:00Z UTC
Last seen:
2026-06-06T05:49:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan-Downloader.Shell.Agent.gen HEUR:Trojan-Downloader.Shell.Agent.a
Link:
https://opentip.kaspersky.com/a7134d1fc413ee698703fd269a950902fd2b27ab46cc6fe795f81a0247763184/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/364886f5-8958-4763-a2c0-bf2383bf228e
Behavior Graph:
Download SVG
%3 guuid=4d3847b1-1900-0000-edb6-c64994070000 pid=1940 /usr/bin/sudo guuid=addcabb3-1900-0000-edb6-c64996070000 pid=1942 /tmp/sample.bin guuid=4d3847b1-1900-0000-edb6-c64994070000 pid=1940->guuid=addcabb3-1900-0000-edb6-c64996070000 pid=1942 execve guuid=9eebe5b3-1900-0000-edb6-c64998070000 pid=1944 /usr/bin/wget guuid=addcabb3-1900-0000-edb6-c64996070000 pid=1942->guuid=9eebe5b3-1900-0000-edb6-c64998070000 pid=1944 execve
Score:
98%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/a7134d1fc413ee698703fd269a950902fd2b27ab46cc6fe795f81a0247763184
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a7134d1fc413ee698703fd269a950902fd2b27ab46cc6fe795f81a0247763184/
Verdict:
Malicious
Threat:
Trojan-Downloader.Shell.Agent
Link:
https://tip.neiki.dev/file/a7134d1fc413ee698703fd269a950902fd2b27ab46cc6fe795f81a0247763184
Threat name:
Script-BAT.Downloader.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2026-06-04 10:03:22 UTC
File Type:
Text (Shell)
AV detection:
9 of 24 (37.50%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=u4ju2h6ecpxgtbyd7utjvfijal6swj5li3gg7z4v7anaer3wggca._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/260604-l3hb5sds6j/
Behaviour
Modifies registry class
Suspicious use of SetWindowsHookEx
Enumerates physical storage devices
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/a7134d1fc413ee698703fd269a950902fd2b27ab46cc6fe795f81a0247763184

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh a7134d1fc413ee698703fd269a950902fd2b27ab46cc6fe795f81a0247763184

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3858511/
  
Delivery method
Distributed via web download

Comments