MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b2aea974ca63dc88aea853ea4b4353fa54f066f7b034dae7408faa3b9f8fc82b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	b2aea974ca63dc88aea853ea4b4353fa54f066f7b034dae7408faa3b9f8fc82b
SHA3-384 hash:	b5bbd37071ab24fd0c5a2c157cae2121ce0ce239d8169f7d4a7226b3a436a0ee4f36d91d4cf24151de7c1ba1e415b38e
SHA1 hash:	3b131c3a6064c1a457e7b8384ce8b541edf7209e
MD5 hash:	d4bdb3a3f621a1830546419e1980a381
humanhash:	eighteen-california-mirror-pasta
File name:	b2aea974ca63dc88aea853ea4b4353fa54f066f7b034dae7408faa3b9f8fc82b.bin
Download:	download sample
File size:	3'869'982 bytes
First seen:	2026-08-15 06:35:04 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	98304:1mBzF2zK+m1nDjnukH2L7mDhiJlJpAgIqnmbO5w:kIK+GDjukH2el0AcnW
TLSH	T1E506338A40763610E9E1F2BC91AE676FDAD758E13175F93F0969F4000E7A89A5B30337
Magika	zip
Reporter	whack_sh
Tags:	exe whack.sh zip

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

192

Origin country :

US

Vendor Threat Intelligence

ACCE Zip_Archive

Details

Link:

https://research.acce.ciphertechsolutions.com/results/886ac472-573f-4487-bf5f-4acfcfd29c3e/

ClamAV Detected

Detection(s):

Sanesecurity.Malware.32567.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.PHP.BanBot-13.UNOFFICIAL

Alert

Create hunting rule

sigs.InterServer.net.HEX.Topline.antibot.ip.block.66.135.200.593.UNOFFICIAL

Alert

Create hunting rule

SecuriteInfo.com.PHP.Agent-148.UNOFFICIAL

Alert

Create hunting rule

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/b2aea974ca63dc88aea853ea4b4353fa54f066f7b034dae7408faa3b9f8fc82b

Kaspersky OpenTIP Unknown

Verdict:

Unknown

File Type:

zip

First seen:

2026-08-12T03:21:00Z UTC

Last seen:

2026-08-12T05:00:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/b2aea974ca63dc88aea853ea4b4353fa54f066f7b034dae7408faa3b9f8fc82b/results?tab=lookup

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

ARCHIVE

Link:

https://malprob.io/report/b2aea974ca63dc88aea853ea4b4353fa54f066f7b034dae7408faa3b9f8fc82b

Malva.RE inconclusive

Verdict:

inconclusive

YARA:

2 match(es)

Tags:

SVG Zip Archive

Link:

https://app.malva.re/file/d4bdb3a3f621a1830546419e1980a381

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b2aea974ca63dc88aea853ea4b4353fa54f066f7b034dae7408faa3b9f8fc82b/

ReversingLabs TitaniumCloud Script-PHP.Trojan.Cloaker

Threat name:

Script-PHP.Trojan.Cloaker

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-08-12 08:07:20 UTC

File Type:

Binary (Archive)

Extracted files:

184

AV detection:

7 of 36 (19.44%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=wkxks5gkmpoirlvikpvewq2t7jkpazxxwa2nvz2ar6vdxh4pzavq._file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.67

Link:

https://yomi.yoroi.company/submissions/b2aea974ca63dc88aea853ea4b4353fa54f066f7b034dae7408faa3b9f8fc82b