MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bddea9e6c5c9e8542b4d38cd67ad4a4eed14d605cd84608ec983e0e7811aa96e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	bddea9e6c5c9e8542b4d38cd67ad4a4eed14d605cd84608ec983e0e7811aa96e
SHA3-384 hash:	fd2fc8d378c90ba572093ecdcdda9bbd940981eb3a41bc29bba3912237c9043fa4e9b28d46c2ef43e43455cb0eb359f2
SHA1 hash:	d9f83fee80e8e6405e72f0111d3b9758f87e1e28
MD5 hash:	ad4d82616bef2805d1987d36c226415f
humanhash:	nineteen-high-mississippi-bakerloo
File name:	check3.sh
Download:	download sample
File size:	706 bytes
First seen:	2026-08-31 17:40:46 UTC
Last seen:	2026-09-01 01:56:57 UTC
File type:	sh
MIME type:	text/x-shellscript
ssdeep	12:+Cm+OuyLCEUavx7PYroEpdUHoWu+4k/uoPYroEpdUHRJ:lmGWlv9YCHoWu+qcYCHRJ
TLSH	T1E201F2ED73106F7A12C58FAEB79590A4F91A6FF3A2685979F00418EC2481E0C3537E69
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	BlinkzSec

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

57

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

URLhaus.3910598.UNOFFICIAL

Alert

Create hunting rule

URLhaus.3910600.UNOFFICIAL

Alert

Create hunting rule

Kaspersky OpenTIP Adware

Verdict:

Adware

File Type:

unix shell

First seen:

2026-08-31T15:26:00Z UTC

Last seen:

2026-09-01T18:16:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/bddea9e6c5c9e8542b4d38cd67ad4a4eed14d605cd84608ec983e0e7811aa96e/results?tab=lookup

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/5b81bc2b-5222-4603-bc38-6ebe5242f33e

Behavior Graph:

Download SVG

Nucleon Malprob Susipicious

Score:

48%

Verdict:

Susipicious

File Type:

SCRIPT

Link:

https://malprob.io/report/bddea9e6c5c9e8542b4d38cd67ad4a4eed14d605cd84608ec983e0e7811aa96e

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/bddea9e6c5c9e8542b4d38cd67ad4a4eed14d605cd84608ec983e0e7811aa96e/

ReversingLabs TitaniumCloud Win32.Trojan.Qwexlafiba

Threat name:

Win32.Trojan.Qwexlafiba

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-08-31 17:40:07 UTC

File Type:

Text (Shell)

AV detection:

8 of 24 (33.33%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=xxpktzwfzhufik2nhdgwplkkj3wrjvqfzwcgbdwjqpqopai2vfxa._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

antivm defense_evasion discovery linux

Link:

https://tria.ge/reports/260831-v9qrjazwbt/

Behaviour

Reads runtime system information

Checks CPU configuration

Reads CPU attributes

Enumerates running processes

File and Directory Permissions Modification

VMRay XMRig

Malware family:

XMRig

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/bddea9e6c5c9/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

0.70

Link:

https://yomi.yoroi.company/submissions/bddea9e6c5c9e8542b4d38cd67ad4a4eed14d605cd84608ec983e0e7811aa96e