MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a8b2ba8d93319a60f3f581021d48e0412c7aea3f6ed7124daf5993dfb17ce264. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	a8b2ba8d93319a60f3f581021d48e0412c7aea3f6ed7124daf5993dfb17ce264
SHA3-384 hash:	fca5f528d61b52c13eb36c3690d2faacc7cc6935cfc73155d5bfedfccdae9ecabc447948669b0badb8e11f2a6246d285
SHA1 hash:	740bebe9e866c77a5b11b399cc2ed0ac33f0fa4b
MD5 hash:	3ebf6e5773e041718a6116f9c43b8ed1
humanhash:	lake-kilo-ink-washington
File name:	b.sh
Download:	download sample
File size:	5'727 bytes
First seen:	2026-04-12 22:50:42 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	96:xowMCySUq9djioY0MpY0RAkoBGKRtdLRQ56b6CrWJ5YBDjagJBhsvCPLfhtI6sHr:ySUq9dWoY0MpY0RAkoBGs5rWPmqABOC8
TLSH	T1C7C143D4FDFCF9327C6DB334B2C8918ABAEA7B6E853338087562569E146D448310A935
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	sh

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

40

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/69dc21ec799d5bf325f9ef33/reports/e17027cf-edea-4654-b0c6-c741e19d5842/overview

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-04-12T19:56:00Z UTC

Last seen:

2026-04-12T20:18:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/a8b2ba8d93319a60f3f581021d48e0412c7aea3f6ed7124daf5993dfb17ce264/results?tab=lookup

Kunai Sandbox

Status:

Failed

Link:

https://sandbox.kunai.rocks/analysis/4ff4cb21-57fb-4df9-8029-c0f682cf56a0

Nucleon Malprob Benign

Score:

25%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/a8b2ba8d93319a60f3f581021d48e0412c7aea3f6ed7124daf5993dfb17ce264

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a8b2ba8d93319a60f3f581021d48e0412c7aea3f6ed7124daf5993dfb17ce264/

Neiki Trojan-Spy.Win32.HTTP

Verdict:

Malicious

Threat:

Trojan-Spy.Win32.HTTP

Link:

https://tip.neiki.dev/file/a8b2ba8d93319a60f3f581021d48e0412c7aea3f6ed7124daf5993dfb17ce264

ReversingLabs TitaniumCloud Text.Trojan.Generic

Threat name:

Text.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2026-04-12 22:51:32 UTC

File Type:

Text (Shell)

AV detection:

6 of 24 (25.00%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=vczlvdmtggngb47vqebb2shaiewhv2r7n3lretnplgj57ml44jsa._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

antivm credential_access defense_evasion discovery linux persistence privilege_escalation

Link:

https://tria.ge/reports/260412-2s1nqsh12w/

Behaviour

Enumerates kernel/hardware configuration

Process Discovery

Reads runtime system information

System Network Configuration Discovery

Checks CPU configuration

Reads CPU attributes

Virtualization/Sandbox Evasion: Time Based Evasion

Enumerates running processes

Looks up external IP address via web service

Reads Bash history

Adds new SSH keys

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.37

Link:

https://yomi.yoroi.company/submissions/a8b2ba8d93319a60f3f581021d48e0412c7aea3f6ed7124daf5993dfb17ce264