MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a76252fb3847bc1eec8ade602e18dce1a8d7fdd46d43ac60d2fb17f0a9c91d9b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	a76252fb3847bc1eec8ade602e18dce1a8d7fdd46d43ac60d2fb17f0a9c91d9b
SHA3-384 hash:	ee25884fc88bcbedf1b0dccbeb63cfa846368d547b848bd2d55bfbeb85840ee505a17b06cbec3ceaa6f35a18b50bd11b
SHA1 hash:	e60b6db81fb4da2705ea2f6fcd650575b54c8a74
MD5 hash:	5d6b1f910815ab128fc6625a1dc92826
humanhash:	pluto-stairway-purple-cola
File name:	a76252fb3847bc1eec8ade602e18dce1a8d7fdd46d43ac60d2fb17f0a9c91d9b.sh
Download:	download sample
File size:	12'848 bytes
First seen:	2026-02-22 13:19:50 UTC
Last seen:	2026-02-23 11:05:38 UTC
File type:	sh
MIME type:	text/plain
ssdeep	96:cRrqB6uL/7pydbpleU1eUGpE9pNZeUF/eU6inFdLeUndpZdNdVdtdWddd1uPuFum:cRrO6XeweOeke4eF
TLSH	T1F342D4B435F14C731E611A40B23727B56BB7945749E3218C39DD2F39AFA6B02A4FE421
Magika	xml
Reporter	abuse_ch
Tags:	sh

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

40

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

busybox evasive

Link:

https://www.filescan.io/uploads/699b03f697feb4afd651dadf/reports/ca857193-6eaa-4d2a-9379-7b3c0e91dd9a/overview

Kaspersky OpenTIP Clean

Verdict:

Clean

File Type:

text

Link:

https://opentip.kaspersky.com/a76252fb3847bc1eec8ade602e18dce1a8d7fdd46d43ac60d2fb17f0a9c91d9b/results?tab=lookup

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/c3a02a61-e2a2-4112-82da-b9a09d02cb79

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

0%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/a76252fb3847bc1eec8ade602e18dce1a8d7fdd46d43ac60d2fb17f0a9c91d9b

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a76252fb3847bc1eec8ade602e18dce1a8d7fdd46d43ac60d2fb17f0a9c91d9b/

Neiki Clean

Verdict:

Clean

Link:

https://tip.neiki.dev/file/a76252fb3847bc1eec8ade602e18dce1a8d7fdd46d43ac60d2fb17f0a9c91d9b

ReversingLabs TitaniumCloud Text.Trojan.Generic

Threat name:

Text.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2026-02-22 13:26:31 UTC

File Type:

Text (HTML)

AV detection:

5 of 24 (20.83%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=u5rff6zyi66b53ek3zqc4gg44gunp7ounvb2yygs7ml7bkojdwnq._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

n/a

Link:

https://tria.ge/reports/260222-ql544adv4f/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/a76252fb3847bc1eec8ade602e18dce1a8d7fdd46d43ac60d2fb17f0a9c91d9b