MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b98f565f960397b76fc2a93f82f8479dc24991cd24c5b7d41b74ec6c81f11caf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b98f565f960397b76fc2a93f82f8479dc24991cd24c5b7d41b74ec6c81f11caf
SHA3-384 hash: 08b5ae51b63f8bcd1f1a18aac5e59732999e4a77d6c37d743aa834c21eefd9dc7b0ad61e287886e2091529511137e044
SHA1 hash: 1c591f32b1352a9d688452f096688537ab287ba9
MD5 hash: 0b9d1b987d6624d9c4cceaeb2e75fe02
humanhash: mike-nine-golf-connecticut
File name:rev.sh
Download: download sample
File size:1'179 bytes
First seen:2026-08-08 08:36:39 UTC
Last seen:2026-08-08 18:35:35 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 24:w1NLUje/nZn8Pr+SrNvNSL5lOKvO0TGz5lOKvO0TGP:wTKTP6SuOKvO0TGGKvO0TGP
TLSH T11E219AB1F2F169753B348458A106916037DA2B42CBCC6CE2897CEAB23623584E090B20
TrID 50.0% (.SH) Linux/UNIX shell script (7000/1)
28.5% (.PL) Perl script (4000/1/1)
21.4% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh

Intelligence

File Origin
# of uploads :
3
# of downloads :
51
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.BV.Agent-CDE.77193373.UNOFFICIAL
Create hunting rule

Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
bash evasive lolbin
Link:
https://www.filescan.io/uploads/6a76eac4f4796cd2a7b7bde0/reports/90c6963b-c888-42d1-b5f7-f24eccdb4a91/overview
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/0a6ac6a9-f880-4a15-b78f-8140db33ac86
Behavior Graph:
Download SVG
%3 guuid=7cfe12d0-1600-0000-1ce2-9678fe0c0000 pid=3326 /usr/bin/sudo guuid=cb9174d2-1600-0000-1ce2-9678090d0000 pid=3337 /tmp/sample.bin guuid=7cfe12d0-1600-0000-1ce2-9678fe0c0000 pid=3326->guuid=cb9174d2-1600-0000-1ce2-9678090d0000 pid=3337 execve guuid=4479e6d2-1600-0000-1ce2-96780c0d0000 pid=3340 /usr/bin/bash net guuid=cb9174d2-1600-0000-1ce2-9678090d0000 pid=3337->guuid=4479e6d2-1600-0000-1ce2-96780c0d0000 pid=3340 clone guuid=4c00f4d7-1600-0000-1ce2-9678220d0000 pid=3362 /usr/bin/bash net guuid=cb9174d2-1600-0000-1ce2-9678090d0000 pid=3337->guuid=4c00f4d7-1600-0000-1ce2-9678220d0000 pid=3362 clone guuid=0fa644dd-1600-0000-1ce2-96782d0d0000 pid=3373 /usr/bin/perl net guuid=cb9174d2-1600-0000-1ce2-9678090d0000 pid=3337->guuid=0fa644dd-1600-0000-1ce2-96782d0d0000 pid=3373 execve guuid=19abf0e7-1600-0000-1ce2-9678420d0000 pid=3394 /usr/bin/python3.11 net guuid=cb9174d2-1600-0000-1ce2-9678090d0000 pid=3337->guuid=19abf0e7-1600-0000-1ce2-9678420d0000 pid=3394 execve c566150a-7f2a-59d7-8da7-672f70a179f0 198.199.79.50:5656 guuid=4479e6d2-1600-0000-1ce2-96780c0d0000 pid=3340->c566150a-7f2a-59d7-8da7-672f70a179f0 con guuid=4c00f4d7-1600-0000-1ce2-9678220d0000 pid=3362->c566150a-7f2a-59d7-8da7-672f70a179f0 con guuid=0fa644dd-1600-0000-1ce2-96782d0d0000 pid=3373->c566150a-7f2a-59d7-8da7-672f70a179f0 con guuid=19abf0e7-1600-0000-1ce2-9678420d0000 pid=3394->c566150a-7f2a-59d7-8da7-672f70a179f0 con
Score:
6%
Verdict:
Benign
File Type:
SCRIPT
Link:
https://malprob.io/report/b98f565f960397b76fc2a93f82f8479dc24991cd24c5b7d41b74ec6c81f11caf
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b98f565f960397b76fc2a93f82f8479dc24991cd24c5b7d41b74ec6c81f11caf/
Gathering data
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xghvmx4waol3o36cve7yf6chtxbeteonetc3pva3otwgzaprdsxq._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
discovery linux
Link:
https://tria.ge/reports/260808-kjb6cacj8z/
Behaviour
Reads runtime system information
Writes file to tmp directory
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SUSP_shellpop_Bash
Create hunting rule
Author:Tobias Michalski
Description:Detects susupicious bash command
Reference:https://github.com/0x00-0x00/ShellPop

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh b98f565f960397b76fc2a93f82f8479dc24991cd24c5b7d41b74ec6c81f11caf

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3878283/
  
Delivery method
Distributed via web download

Comments