MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bdde7805820e3ba5101df7f9a6de339dfd32c368d3128346ecdccdc5f9c09474. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	bdde7805820e3ba5101df7f9a6de339dfd32c368d3128346ecdccdc5f9c09474
SHA3-384 hash:	6c6f44416196869504f4c099bfcb123d380fb8ddc20ceeed0265fd8a76ed4f8753a33c58a2c3b70d73d69d88f9a09cd0
SHA1 hash:	234531cb7c65e51f9e1e26934e4581c996448212
MD5 hash:	bb0a2bb7304992e73886b92269022727
humanhash:	aspen-stream-hydrogen-triple
File name:	wget.sh
Download:	download sample
File size:	530 bytes
First seen:	2026-07-27 06:35:07 UTC
Last seen:	2026-07-27 11:02:28 UTC
File type:	sh
MIME type:	text/x-shellscript
ssdeep	12:KSs6wZ5ANyHe0f5A+sw5AequSYeJB/5AAWzpk:KSKZb/sweIpk
TLSH	T174F090CD41523F6D45CDC90F7653894C904693CE568F97CA3C9D0826A5C5BB8F858E6C
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	sh

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

63

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.Linux.Downloader-36.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Tags:

busybox

Link:

https://www.filescan.io/uploads/6a66fc45a1abe6dc00160b06/reports/185c6588-210a-4a27-bf0e-c7c43da3b561/overview

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/fcda0a34-50b8-4c04-8979-654ad4d7a003

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

82%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/bdde7805820e3ba5101df7f9a6de339dfd32c368d3128346ecdccdc5f9c09474

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/bdde7805820e3ba5101df7f9a6de339dfd32c368d3128346ecdccdc5f9c09474/

ReversingLabs TitaniumCloud

Gathering data

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=xxphqbmcby52kea56742nxrttx6tfq3i2mjigrxm3tg4l6oasr2a._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  9/10

Tags:

defense_evasion discovery linux

Link:

https://tria.ge/reports/260727-hcteyaxcna/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Changes its process name

Reads system network configuration

Enumerates active TCP sockets

Enumerates running processes

Reads system routing table

File and Directory Permissions Modification

Executes dropped EXE

Unexpected DNS network traffic destination

Contacts a large (61297) amount of remote hosts

Creates a large amount of network flows

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.06

Link:

https://yomi.yoroi.company/submissions/bdde7805820e3ba5101df7f9a6de339dfd32c368d3128346ecdccdc5f9c09474