MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b98e554dd386c73ed7b2cc37f9f2bc96d293a6193da3f83ca5194b48b14be2f1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	b98e554dd386c73ed7b2cc37f9f2bc96d293a6193da3f83ca5194b48b14be2f1
SHA3-384 hash:	e0efc0402a6222d13c5919f4fb4dd85a5e99cce1cf4b815c16e9221da17711d06a0f2b85b6ea3cf17fe7268d85c00f41
SHA1 hash:	c264a54849d184e255cfd7c78c527a0c02771450
MD5 hash:	bd9eadbf1fc9010c94a9941f41094647
humanhash:	march-salami-one-green
File name:	run.sh
Download:	download sample
File size:	3'141 bytes
First seen:	2026-01-20 19:13:50 UTC
Last seen:	Never
File type:	sh
MIME type:	text/plain
ssdeep	24:Cb2JMqsbiBKjuZFEUEnE2EhEGUObwLOJUf92hM3e:Cb2JMqsbiBKjuZFFcvyiObwb2hM3e
TLSH	T1B15188B6023F86B27208924DB3FD3639A28770936BEE4A01AD603C1D2EC5D0C63D4F80
Magika	shell
Reporter	abuse_ch
Tags:	sh

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

36

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

text

First seen:

2026-01-20T16:21:00Z UTC

Last seen:

2026-01-20T16:45:00Z UTC

Hits:

~10

Detections:

HEUR:Trojan-Downloader.Shell.Agent.a

Link:

https://opentip.kaspersky.com/b98e554dd386c73ed7b2cc37f9f2bc96d293a6193da3f83ca5194b48b14be2f1/results?tab=lookup

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/be22a2ce-a39c-40c3-bc67-6c9da44d6c6b

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

96%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/b98e554dd386c73ed7b2cc37f9f2bc96d293a6193da3f83ca5194b48b14be2f1

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/b98e554dd386c73ed7b2cc37f9f2bc96d293a6193da3f83ca5194b48b14be2f1/

Neiki Trojan-Downloader.Shell.Agent

Verdict:

Malicious

Threat:

Trojan-Downloader.Shell.Agent

Link:

https://tip.neiki.dev/file/b98e554dd386c73ed7b2cc37f9f2bc96d293a6193da3f83ca5194b48b14be2f1

ReversingLabs TitaniumCloud Text.Trojan.Generic

Threat name:

Text.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2026-01-20 19:16:07 UTC

File Type:

Text (Shell)

AV detection:

5 of 24 (20.83%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=xghfktotq3dt5v5szq37t4v4s3jjhjqzhwr7qpffdffurmkl4lyq._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

n/a

Link:

https://tria.ge/reports/260120-xx2dlsgw8g/

Behaviour

Modifies registry class

Suspicious use of SetWindowsHookEx

Enumerates physical storage devices

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/b98e554dd386c73ed7b2cc37f9f2bc96d293a6193da3f83ca5194b48b14be2f1