MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 c762e76a878329177113d991e1d1bceca046cc101f5f7429fc098f8009828b12. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 5
| SHA256 hash: | c762e76a878329177113d991e1d1bceca046cc101f5f7429fc098f8009828b12 |
|---|---|
| SHA3-384 hash: | 0907661f95513633a906e13f494a424f9bc31a0dc04cf2689b959d7e563995197d9113bd2b8f0af105494ff725114664 |
| SHA1 hash: | a05d22b2d19dad87682192cc1e78481108a30fd5 |
| MD5 hash: | 9158a62d6c28e88c011519bffc1dac27 |
| humanhash: | batman-florida-coffee-uranus |
| File name: | tbk |
| Download: | download sample |
| File size: | 645 bytes |
| First seen: | 2026-06-24 22:09:22 UTC |
| Last seen: | 2026-06-25 03:19:28 UTC |
| File type: | sh |
| MIME type: | text/plain |
| ssdeep | 12:BtjBnFjFF+jlewzjlOWNn+0HjBnviQjYjlewtnjlZt+JGy:rX/ulBXHJglBxs |
| TLSH | T16DF031DA132729B6F910EE2570B1548A53DFAFD625D823ACF8684DB3404AC70B806F99 |
| Magika | txt |
| Reporter | |
| Tags: | sh |
Shell script dropper
This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.
| URL | Malware sample (SHA256 hash) | Signature | Tags |
|---|---|---|---|
| http://51.81.96.73/n2/armv5l | ec41a35c7df2a684c7a97da730d93c63a15dc34f619474e8cc03fd7afe063ef4 | Mirai | elf mirai ua-wget |
Intelligence
File Origin
# of uploads :
269
# of downloads :
13
Origin country :
DEVendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
busybox evasive
Status:
terminated
Behavior Graph:
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Gathering data
Threat name:
Script-BAT.Downloader.Heuristic
Status:
Malicious
First seen:
2026-06-24 23:25:12 UTC
File Type:
Text (Shell)
AV detection:
5 of 36 (13.89%)
Threat level:
2/5
Detection(s):
Suspicious file
Result
Malware family:
n/a
Score:
3/10
Tags:
n/a
Behaviour
Modifies registry class
Suspicious use of SetWindowsHookEx
Enumerates physical storage devices
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
sh c762e76a878329177113d991e1d1bceca046cc101f5f7429fc098f8009828b12
(this sample)
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.