🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ac4b600243dfd90ab8ceeea89a947d8a035ed740c9cd692696c2a46b378f2c15. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ac4b600243dfd90ab8ceeea89a947d8a035ed740c9cd692696c2a46b378f2c15
SHA3-384 hash: 187decb43c16523b86b3f851b248629c193c185ef90fc3c3acfad323c045a17291e236f9d0f854c0fa7c0da7522c54c7
SHA1 hash: 9c1a9b9d2bcc5f97403db55392bcf31c5b1bfc06
MD5 hash: f79243d6f8fc0ae79b35bcf5bb185b88
humanhash: skylark-sixteen-maine-bravo
File name:ac4b600243dfd90ab8ceeea89a947d8a035ed740c9cd692696c2a46b378f2c15_from_161.97.85.253_redis_set.bin
Download: download sample
File size:2'846 bytes
First seen:2026-11-14 20:06:30 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 48:FQMk+m4FH74SvvyQDJKI3wUeazVTPpu3M2eMNbb5yEc/r5Xefxze3:GS74IVe+pHtebbU5dYI
TLSH T1425186F1A6786C35778855FEF912E6D49CAAA93E07B13828B4F91C5C903C0D11525BE4
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter nullblue67
Tags:backdoor dropper Nezha RAT redis sh

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
ES ES
Vendor Threat Intelligence
No detections
Verdict:
Unknown
Threat level:
  0/10
Confidence:
100%
Tags:
masquerade
Link:
https://www.filescan.io/uploads/6af8bf73eb5f5b5f8ebe650b/reports/0c61faa7-b88a-4f18-8726-2a130cb7123c/overview
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/232e5d5b-657d-405b-88ad-5b35fc4a56bb
Behavior Graph:
Download SVG
%3 guuid=a53b56d5-1a00-0000-6b06-4954300a0000 pid=2608 /usr/bin/sudo guuid=96d419d7-1a00-0000-6b06-4954340a0000 pid=2612 /tmp/sample.bin guuid=a53b56d5-1a00-0000-6b06-4954300a0000 pid=2608->guuid=96d419d7-1a00-0000-6b06-4954340a0000 pid=2612 execve guuid=32fd54d7-1a00-0000-6b06-4954360a0000 pid=2614 /usr/bin/mkdir guuid=96d419d7-1a00-0000-6b06-4954340a0000 pid=2612->guuid=32fd54d7-1a00-0000-6b06-4954360a0000 pid=2614 execve guuid=3abc35d8-1a00-0000-6b06-4954390a0000 pid=2617 /usr/bin/dash guuid=96d419d7-1a00-0000-6b06-4954340a0000 pid=2612->guuid=3abc35d8-1a00-0000-6b06-4954390a0000 pid=2617 clone guuid=6267abd8-1a00-0000-6b06-49543d0a0000 pid=2621 /usr/bin/cat guuid=96d419d7-1a00-0000-6b06-4954340a0000 pid=2612->guuid=6267abd8-1a00-0000-6b06-49543d0a0000 pid=2621 execve guuid=d63515d9-1a00-0000-6b06-4954400a0000 pid=2624 /usr/bin/uname guuid=96d419d7-1a00-0000-6b06-4954340a0000 pid=2612->guuid=d63515d9-1a00-0000-6b06-4954400a0000 pid=2624 execve guuid=827288d9-1a00-0000-6b06-4954410a0000 pid=2625 /usr/bin/curl net guuid=96d419d7-1a00-0000-6b06-4954340a0000 pid=2612->guuid=827288d9-1a00-0000-6b06-4954410a0000 pid=2625 execve guuid=b16fa2f1-1a00-0000-6b06-4954580a0000 pid=2648 /usr/bin/curl net guuid=96d419d7-1a00-0000-6b06-4954340a0000 pid=2612->guuid=b16fa2f1-1a00-0000-6b06-4954580a0000 pid=2648 execve guuid=0bfa0af9-1a00-0000-6b06-4954620a0000 pid=2658 /usr/bin/rm guuid=96d419d7-1a00-0000-6b06-4954340a0000 pid=2612->guuid=0bfa0af9-1a00-0000-6b06-4954620a0000 pid=2658 execve guuid=d93b59f9-1a00-0000-6b06-4954630a0000 pid=2659 /usr/bin/chmod guuid=96d419d7-1a00-0000-6b06-4954340a0000 pid=2612->guuid=d93b59f9-1a00-0000-6b06-4954630a0000 pid=2659 execve guuid=b3afa1f9-1a00-0000-6b06-4954640a0000 pid=2660 /usr/bin/hostname guuid=96d419d7-1a00-0000-6b06-4954340a0000 pid=2612->guuid=b3afa1f9-1a00-0000-6b06-4954640a0000 pid=2660 execve guuid=e4c6d6f9-1a00-0000-6b06-4954660a0000 pid=2662 /usr/bin/curl net guuid=96d419d7-1a00-0000-6b06-4954340a0000 pid=2612->guuid=e4c6d6f9-1a00-0000-6b06-4954660a0000 pid=2662 execve guuid=2f1144d8-1a00-0000-6b06-49543b0a0000 pid=2619 /usr/bin/cat write-file guuid=3abc35d8-1a00-0000-6b06-4954390a0000 pid=2617->guuid=2f1144d8-1a00-0000-6b06-49543b0a0000 pid=2619 execve 48e4b58e-93b1-59d9-8e65-8c69a29c54ef messenger.emailrockets.com:443 guuid=827288d9-1a00-0000-6b06-4954410a0000 pid=2625->48e4b58e-93b1-59d9-8e65-8c69a29c54ef con guuid=827288d9-1a00-0000-6b06-4954410a0000 pid=2641 /usr/bin/curl dns net send-data guuid=827288d9-1a00-0000-6b06-4954410a0000 pid=2625->guuid=827288d9-1a00-0000-6b06-4954410a0000 pid=2641 clone 4f6baed0-9587-596c-82b3-fd721afe4cc1 10.0.2.3:53 guuid=827288d9-1a00-0000-6b06-4954410a0000 pid=2641->4f6baed0-9587-596c-82b3-fd721afe4cc1 send: 88B guuid=b16fa2f1-1a00-0000-6b06-4954580a0000 pid=2648->48e4b58e-93b1-59d9-8e65-8c69a29c54ef con guuid=b16fa2f1-1a00-0000-6b06-4954580a0000 pid=2652 /usr/bin/curl dns net send-data guuid=b16fa2f1-1a00-0000-6b06-4954580a0000 pid=2648->guuid=b16fa2f1-1a00-0000-6b06-4954580a0000 pid=2652 clone guuid=b16fa2f1-1a00-0000-6b06-4954580a0000 pid=2652->4f6baed0-9587-596c-82b3-fd721afe4cc1 send: 88B guuid=e4c6d6f9-1a00-0000-6b06-4954660a0000 pid=2662->48e4b58e-93b1-59d9-8e65-8c69a29c54ef con guuid=e4c6d6f9-1a00-0000-6b06-4954660a0000 pid=2669 /usr/bin/curl dns net send-data guuid=e4c6d6f9-1a00-0000-6b06-4954660a0000 pid=2662->guuid=e4c6d6f9-1a00-0000-6b06-4954660a0000 pid=2669 clone guuid=e4c6d6f9-1a00-0000-6b06-4954660a0000 pid=2669->4f6baed0-9587-596c-82b3-fd721afe4cc1 send: 88B
Score:
2%
Verdict:
Benign
File Type:
SCRIPT
Link:
https://malprob.io/report/ac4b600243dfd90ab8ceeea89a947d8a035ed740c9cd692696c2a46b378f2c15
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ac4b600243dfd90ab8ceeea89a947d8a035ed740c9cd692696c2a46b378f2c15/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vrfwaasd37mqvogo52ujvfd5ribv5v2azhgwsjuwyksgwn4pfqkq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/261114-yv2f9sgv4q/
Behaviour
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
File and Directory Permissions Modification
Please note that we are no longer able to provide a coverage score for Virus Total.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments