🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b54a9f76aaa20aff72fd978bca433b67ca210e9466db9ddb32d448204beb705b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b54a9f76aaa20aff72fd978bca433b67ca210e9466db9ddb32d448204beb705b
SHA3-384 hash: 83b642a021a13599f8d3556b850091fd85de7b7b1f951c8c9f789c7df76bbaf1e5f84e82873235e21e53ec5de2fe3b76
SHA1 hash: b2daeb6259693db56e8717fd8f849c33296dbf4d
MD5 hash: 971cd8cd2581d7832efdd0b7bb84ceb8
humanhash: venus-fish-mike-angel
File name:rev.sh
Download: download sample
File size:1'185 bytes
First seen:2026-09-13 03:29:46 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 24:w1NLSDe/BBB5or+SrNvNSL5lOKob0TGz5lOKob0TGP:wTqj6SuOKK0TGGKK0TGP
TLSH T15921ACB2F1F169753F70C49C6106E13037EA3B5A9B8C5EE2987C5AA13617565F0A0F11
TrID 50.0% (.SH) Linux/UNIX shell script (7000/1)
28.5% (.PL) Perl script (4000/1/1)
21.4% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh

Intelligence

File Origin
# of uploads :
1
# of downloads :
58
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Unknown
Threat level:
  0/10
Confidence:
100%
Tags:
bash evasive lolbin
Link:
https://www.filescan.io/uploads/6aa618cdff9d82bb1c9659e7/reports/c0eaeefe-123a-4994-81b9-f7be03a18123/overview
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/4a8af9dd-e2f9-4751-90a9-772bd32fda82
Behavior Graph:
Download SVG
%3 guuid=e6d25722-1700-0000-4cb8-76b4b00f0000 pid=4016 /usr/bin/sudo guuid=acfb6024-1700-0000-4cb8-76b4bb0f0000 pid=4027 /tmp/sample.bin guuid=e6d25722-1700-0000-4cb8-76b4b00f0000 pid=4016->guuid=acfb6024-1700-0000-4cb8-76b4bb0f0000 pid=4027 execve guuid=c2401b25-1700-0000-4cb8-76b4bd0f0000 pid=4029 /usr/bin/bash net guuid=acfb6024-1700-0000-4cb8-76b4bb0f0000 pid=4027->guuid=c2401b25-1700-0000-4cb8-76b4bd0f0000 pid=4029 clone guuid=0dda0026-1700-0000-4cb8-76b4c20f0000 pid=4034 /usr/bin/bash net guuid=acfb6024-1700-0000-4cb8-76b4bb0f0000 pid=4027->guuid=0dda0026-1700-0000-4cb8-76b4c20f0000 pid=4034 clone guuid=1ed0ea26-1700-0000-4cb8-76b4c60f0000 pid=4038 /usr/bin/perl net guuid=acfb6024-1700-0000-4cb8-76b4bb0f0000 pid=4027->guuid=1ed0ea26-1700-0000-4cb8-76b4c60f0000 pid=4038 execve guuid=5b82a12a-1700-0000-4cb8-76b4d70f0000 pid=4055 /usr/bin/python3.11 net guuid=acfb6024-1700-0000-4cb8-76b4bb0f0000 pid=4027->guuid=5b82a12a-1700-0000-4cb8-76b4d70f0000 pid=4055 execve e10ffb59-84fe-530a-b71b-e8f4d1841020 164.90.165.233:5656 guuid=c2401b25-1700-0000-4cb8-76b4bd0f0000 pid=4029->e10ffb59-84fe-530a-b71b-e8f4d1841020 con guuid=0dda0026-1700-0000-4cb8-76b4c20f0000 pid=4034->e10ffb59-84fe-530a-b71b-e8f4d1841020 con guuid=1ed0ea26-1700-0000-4cb8-76b4c60f0000 pid=4038->e10ffb59-84fe-530a-b71b-e8f4d1841020 con guuid=5b82a12a-1700-0000-4cb8-76b4d70f0000 pid=4055->e10ffb59-84fe-530a-b71b-e8f4d1841020 con
Score:
5%
Verdict:
Benign
File Type:
SCRIPT
Link:
https://malprob.io/report/b54a9f76aaa20aff72fd978bca433b67ca210e9466db9ddb32d448204beb705b
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b54a9f76aaa20aff72fd978bca433b67ca210e9466db9ddb32d448204beb705b/
Threat name:
Script-Python.Trojan.ReverseShell
Create hunting rule
Status:
Malicious
First seen:
2026-09-13 03:31:02 UTC
File Type:
Text (Shell)
AV detection:
5 of 36 (13.89%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wvfj65vkuifp64x5s6f4uqz3m7fccduum3nz3wzs2recas7lobnq._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
discovery linux
Link:
https://tria.ge/reports/260913-d2qywsee74/
Behaviour
Reads runtime system information
Writes file to tmp directory
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.06
Link:
https://yomi.yoroi.company/submissions/b54a9f76aaa20aff72fd978bca433b67ca210e9466db9ddb32d448204beb705b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SUSP_shellpop_Bash
Create hunting rule
Author:Tobias Michalski
Description:Detects susupicious bash command
Reference:https://github.com/0x00-0x00/ShellPop

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh b54a9f76aaa20aff72fd978bca433b67ca210e9466db9ddb32d448204beb705b

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3878283/
  
Delivery method
Distributed via web download

Comments