MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 aebd9ba42ede86bd173b5b645ed1877e5a9e92fa830eab213249faf8b09cfa42. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	aebd9ba42ede86bd173b5b645ed1877e5a9e92fa830eab213249faf8b09cfa42
SHA3-384 hash:	24b4385e9f265b2e7a4caac4935ce6a5ec35a7dfc3fd09b1964c881093210601edeeda45265e4ec67fc3491852e38066
SHA1 hash:	ddf60c04444828c7bae17ee6f84cf86db7291e9e
MD5 hash:	9dfbb8be172982fe03c7f8d33fc5ea37
humanhash:	uniform-ink-papa-victor
File name:	zed
Download:	download sample
File size:	27'994 bytes
First seen:	2026-06-01 09:14:12 UTC
Last seen:	Never
File type:
MIME type:	text/x-perl
ssdeep	384:QssSHe4XDp2fv6Mf8JSN6WWabfd43+yZzB3l5:QssGe4XDp2fv5f8J7WWARy1B3D
TLSH	T15EC2844919E34952A3B7F0761BDED4187A5BC1974B0DDE207DAC42DABF90039D2F8AC8
TrID	50.0% (.) Unix-like shebang (var.1) (gen) (7000/1) 28.5% (.PL) Perl script (4000/1/1) 21.4% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	perl
Reporter	Blackdome
Tags:	pl

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

7

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

{HEX}perl.botclient.oldwolf.270.UNOFFICIAL

Alert

Create hunting rule

{HEX}perl.bkdr.ircbot.oldpack.187.UNOFFICIAL

Alert

Create hunting rule

{HEX}perl.botclient.Arabhack.195.UNOFFICIAL

Alert

Create hunting rule

{HEX}perl.botclient.oldwolf.269.UNOFFICIAL

Alert

Create hunting rule

{HEX}perl.botclient.stealth.305.UNOFFICIAL

Alert

Create hunting rule

{HEX}perl.botclient.karawan.264.UNOFFICIAL

Alert

Create hunting rule

{HEX}perl.botclient.xdh.306.UNOFFICIAL

Alert

Create hunting rule

{HEX}perl.botclient.putr4XtReme.282.UNOFFICIAL

Alert

Create hunting rule

{HEX}perl.botclient.pitbull.279.UNOFFICIAL

Alert

Create hunting rule

{HEX}perl.botclient.KcB.218.UNOFFICIAL

Alert

Create hunting rule

Win.Trojan.Perl-35

Alert

Create hunting rule

Legacy.Trojan.Agent-1388651

Alert

Create hunting rule

Win.Trojan.Perl-44

Alert

Create hunting rule

Win.Trojan.Perl-38

Alert

Create hunting rule

{HEX}perl.backdoor.shellbot.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

99.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a1d646fa22676d7bfe4b0b5linux22vpnfull_triage

Tags:

shellbot virus

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/6a1d646b099ef368af12d6ce/reports/8a77918d-92e4-40f5-be10-7ac0c7cbdd5d/overview

Hybrid Analysis Backdoor.Perl.Shellbot

Verdict:

Malicious

Labled as:

Backdoor.Perl.Shellbot

Link:

https://www.hybrid-analysis.com/sample/aebd9ba42ede86bd173b5b645ed1877e5a9e92fa830eab213249faf8b09cfa42

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-06-01T09:40:00Z UTC

Last seen:

2026-06-01T22:59:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/aebd9ba42ede86bd173b5b645ed1877e5a9e92fa830eab213249faf8b09cfa42/results?tab=lookup

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/aebd9ba42ede86bd173b5b645ed1877e5a9e92fa830eab213249faf8b09cfa42

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/aebd9ba42ede86bd173b5b645ed1877e5a9e92fa830eab213249faf8b09cfa42/

ReversingLabs TitaniumCloud Script-Perl.Backdoor.ShellBot

Threat name:

Script-Perl.Backdoor.ShellBot

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-06-01 10:53:12 UTC

File Type:

Text (Perl)

AV detection:

22 of 36 (61.11%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=v26zxjbo32dl2fz3lnsf5umhpznj5ex2qmhkwijsjh5prme47jba._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  4/10

Tags:

linux

Link:

https://tria.ge/reports/260601-mylz7sbw6k/

Behaviour

Changes its process name

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

0.95

Link:

https://yomi.yoroi.company/submissions/aebd9ba42ede86bd173b5b645ed1877e5a9e92fa830eab213249faf8b09cfa42