MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bfad48c674265fcc40a9cb6e410a702c609dc689fb71e7e34b721c0bdd49aefd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	bfad48c674265fcc40a9cb6e410a702c609dc689fb71e7e34b721c0bdd49aefd
SHA3-384 hash:	701f1604c2bb5d4320990119cdff47e31e16455809d44bbaeb57ec665b93f3103072fee3768d3dc8553b01f0a9fbf015
SHA1 hash:	fdf7f6c3ff116b1076564fc498475ba91d1c82f7
MD5 hash:	1d7f4dc3bb0f1c1402bded5c627cf3cc
humanhash:	high-hawaii-eighteen-utah
File name:	888.sh
Download:	download sample
File size:	1'172 bytes
First seen:	2026-07-29 13:50:19 UTC
Last seen:	2026-07-29 14:51:35 UTC
File type:	sh
MIME type:	text/x-shellscript
ssdeep	24:j4ZCXI575ZkRhyLjb29bCCwm2VOkNbC35QYGkpGh1r2cnO3:ji752RwTM1KZNbO5QYbp41H+
TLSH	T1162121D6B0207E70298FD92820FE281C7282112F2F9D6D6CB0CB446576FC586787CE2C
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	sh

Intelligence

---

File Origin

# of uploads :

2

# of downloads :

62

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

Kaspersky OpenTIP Adware

Verdict:

Adware

File Type:

unix shell

First seen:

2026-07-29T13:51:00Z UTC

Last seen:

2026-07-30T04:35:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/bfad48c674265fcc40a9cb6e410a702c609dc689fb71e7e34b721c0bdd49aefd/results?tab=lookup

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/7dd74485-eabc-485f-b927-20d36b7adf67

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

1%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/bfad48c674265fcc40a9cb6e410a702c609dc689fb71e7e34b721c0bdd49aefd

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/bfad48c674265fcc40a9cb6e410a702c609dc689fb71e7e34b721c0bdd49aefd/

ReversingLabs TitaniumCloud Linux.Trojan.Generic

Threat name:

Linux.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2026-07-29 13:51:35 UTC

File Type:

Text (Shell)

AV detection:

5 of 38 (13.16%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=x6wurrtuezp4yqfjznxecctqfrqj3ruj7ny6py2loioaxxkjv36q._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

defense_evasion discovery execution linux persistence privilege_escalation

Link:

https://tria.ge/reports/260729-q5papavhlf/

Behaviour

Reads runtime system information

Reads CPU attributes

Creates/modifies Cron job

Enumerates running processes

Write file to user bin folder

File and Directory Permissions Modification

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.39

Link:

https://yomi.yoroi.company/submissions/bfad48c674265fcc40a9cb6e410a702c609dc689fb71e7e34b721c0bdd49aefd