MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b78899437b963811fcdb7807a1c8e4416fa13ec681023896df3b8d76fcb6dbcf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	b78899437b963811fcdb7807a1c8e4416fa13ec681023896df3b8d76fcb6dbcf
SHA3-384 hash:	527ac234f56ebc205a5824a8051833093f29890ff0eb49e83e61d57f86426c1bc60152232b5beffc8a9e07497c90f2ac
SHA1 hash:	1f4ee83ebd9065629d4dddb721dc08eceddafbd6
MD5 hash:	b88602a0db0f6700a3a4d62e1c7f964c
humanhash:	carolina-mountain-bulldog-failed
File name:	all.sh
Download:	download sample
File size:	736 bytes
First seen:	2026-01-21 22:31:10 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	12:YkF1kcClZF70TGAf/HFKf/HFTf/HFWjLlRBFSrL8+FM5gFiLEjLlRBFSVL8+FMD1:ZDkH/FlK/HFs/HFL/HFWj5F6hFM5gFiK
TLSH	T1C301B194313461B075BEDCE64E72AC1831C990D63DC67FB97C67B0DAA5A5D00B8A20B9
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	sh

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

35

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

busybox

Link:

https://www.filescan.io/uploads/697153fb55805a763fee6cf9/reports/e481bc2f-9a10-46a8-8939-f41455dd8385/overview

InQuest

Result

Gathering data

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-01-21T13:17:00Z UTC

Last seen:

2026-01-21T17:05:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/b78899437b963811fcdb7807a1c8e4416fa13ec681023896df3b8d76fcb6dbcf/results?tab=lookup

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/a6259aab-02a8-4c01-8590-f3995f980675

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

98%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/b78899437b963811fcdb7807a1c8e4416fa13ec681023896df3b8d76fcb6dbcf

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b78899437b963811fcdb7807a1c8e4416fa13ec681023896df3b8d76fcb6dbcf/

Neiki Trojan-Downloader.Shell.Agent

Verdict:

Malicious

Threat:

Trojan-Downloader.Shell.Agent

Link:

https://tip.neiki.dev/file/b78899437b963811fcdb7807a1c8e4416fa13ec681023896df3b8d76fcb6dbcf

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=w6ejsq33sy4bd7g3pad2dsheifx2cpwgqebdrfw7hogxn7fw3phq._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

antivm defense_evasion discovery linux

Link:

https://tria.ge/reports/260121-2fqm1acw7h/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Checks CPU configuration

File and Directory Permissions Modification

Executes dropped EXE

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.37

Link:

https://yomi.yoroi.company/submissions/b78899437b963811fcdb7807a1c8e4416fa13ec681023896df3b8d76fcb6dbcf