MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d15349b786248de8e9d076348a71d86d6a2b5af8b3156afcfedeec3cf3ce9511. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d15349b786248de8e9d076348a71d86d6a2b5af8b3156afcfedeec3cf3ce9511
SHA3-384 hash: 893296d9849a38797a8974b78cca2c080ccfeb9c43948053728bada4821c8041bbeadb4b035ad4e0e06e217f30052604
SHA1 hash: b80934f043975ce14e47db6da39b903c0001b8c7
MD5 hash: 6a3b35f3c9fc9bc3d593f6f21c4c8b4a
humanhash: robin-double-stairway-floor
File name:bak.sh
Download: download sample
File size:2'745 bytes
First seen:2026-06-22 15:48:00 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 48:iR4peKyylhR4pOEqyl/87bT+xxZVxjHxZeYkwosieV7MSvpQVodaZfjkwosboaEv:iREeKyKhREXqKYbSxxDxjHxZepeWSvpv
TLSH T1DB51531AA49DC1B22BE7C1E88FC68DD5215A4107CC54C828F3791BEFAFBC85CF1A6518
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter BlinkzSec

Intelligence

File Origin
# of uploads :
1
# of downloads :
49
Origin country :
FR FR
Vendor Threat Intelligence
No detections
Verdict:
Clean
File Type:
unix shell
First seen:
2026-06-22T13:03:00Z UTC
Last seen:
2026-06-22T14:35:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/d15349b786248de8e9d076348a71d86d6a2b5af8b3156afcfedeec3cf3ce9511/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/6bdc9600-068d-4135-8596-f9b34312ba3a
Behavior Graph:
Download SVG
%3 guuid=13b96f82-1900-0000-8672-23a12c140000 pid=5164 /usr/bin/sudo guuid=fa8f3a85-1900-0000-8672-23a12d140000 pid=5165 /tmp/sample.bin write-file guuid=13b96f82-1900-0000-8672-23a12c140000 pid=5164->guuid=fa8f3a85-1900-0000-8672-23a12d140000 pid=5165 execve guuid=5b2b7e85-1900-0000-8672-23a12e140000 pid=5166 /usr/bin/date guuid=fa8f3a85-1900-0000-8672-23a12d140000 pid=5165->guuid=5b2b7e85-1900-0000-8672-23a12e140000 pid=5166 execve guuid=b2496586-1900-0000-8672-23a12f140000 pid=5167 /usr/bin/date guuid=fa8f3a85-1900-0000-8672-23a12d140000 pid=5165->guuid=b2496586-1900-0000-8672-23a12f140000 pid=5167 execve guuid=9266b386-1900-0000-8672-23a130140000 pid=5168 /usr/bin/mkdir guuid=fa8f3a85-1900-0000-8672-23a12d140000 pid=5165->guuid=9266b386-1900-0000-8672-23a130140000 pid=5168 execve guuid=733a2b87-1900-0000-8672-23a131140000 pid=5169 /usr/bin/sort guuid=fa8f3a85-1900-0000-8672-23a12d140000 pid=5165->guuid=733a2b87-1900-0000-8672-23a131140000 pid=5169 execve guuid=16467087-1900-0000-8672-23a132140000 pid=5170 /usr/bin/rm delete-file guuid=fa8f3a85-1900-0000-8672-23a12d140000 pid=5165->guuid=16467087-1900-0000-8672-23a132140000 pid=5170 execve guuid=d784b687-1900-0000-8672-23a133140000 pid=5171 /usr/bin/curl guuid=fa8f3a85-1900-0000-8672-23a12d140000 pid=5165->guuid=d784b687-1900-0000-8672-23a133140000 pid=5171 execve guuid=cefd2438-1e00-0000-8672-23a15c140000 pid=5212 /usr/bin/rm delete-file guuid=fa8f3a85-1900-0000-8672-23a12d140000 pid=5165->guuid=cefd2438-1e00-0000-8672-23a15c140000 pid=5212 execve guuid=5edacd38-1e00-0000-8672-23a15d140000 pid=5213 /usr/bin/sort guuid=fa8f3a85-1900-0000-8672-23a12d140000 pid=5165->guuid=5edacd38-1e00-0000-8672-23a15d140000 pid=5213 execve guuid=f5884f39-1e00-0000-8672-23a15e140000 pid=5214 /usr/bin/rm delete-file guuid=fa8f3a85-1900-0000-8672-23a12d140000 pid=5165->guuid=f5884f39-1e00-0000-8672-23a15e140000 pid=5214 execve guuid=11ffd739-1e00-0000-8672-23a15f140000 pid=5215 /usr/bin/curl guuid=fa8f3a85-1900-0000-8672-23a12d140000 pid=5165->guuid=11ffd739-1e00-0000-8672-23a15f140000 pid=5215 execve guuid=c552e1e6-2200-0000-8672-23a161140000 pid=5217 /usr/bin/rm delete-file guuid=fa8f3a85-1900-0000-8672-23a12d140000 pid=5165->guuid=c552e1e6-2200-0000-8672-23a161140000 pid=5217 execve guuid=d784b687-1900-0000-8672-23a133140000 pid=5172 /usr/bin/curl net send-data guuid=d784b687-1900-0000-8672-23a133140000 pid=5171->guuid=d784b687-1900-0000-8672-23a133140000 pid=5172 clone 4f6baed0-9587-596c-82b3-fd721afe4cc1 10.0.2.3:53 guuid=d784b687-1900-0000-8672-23a133140000 pid=5172->4f6baed0-9587-596c-82b3-fd721afe4cc1 send: 272B guuid=11ffd739-1e00-0000-8672-23a15f140000 pid=5216 /usr/bin/curl net send-data guuid=11ffd739-1e00-0000-8672-23a15f140000 pid=5215->guuid=11ffd739-1e00-0000-8672-23a15f140000 pid=5216 clone guuid=11ffd739-1e00-0000-8672-23a15f140000 pid=5216->4f6baed0-9587-596c-82b3-fd721afe4cc1 send: 272B
Score:
36%
Verdict:
Susipicious
File Type:
SCRIPT
Link:
https://malprob.io/report/d15349b786248de8e9d076348a71d86d6a2b5af8b3156afcfedeec3cf3ce9511
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d15349b786248de8e9d076348a71d86d6a2b5af8b3156afcfedeec3cf3ce9511/
Verdict:
Clean
Link:
https://tip.neiki.dev/file/d15349b786248de8e9d076348a71d86d6a2b5af8b3156afcfedeec3cf3ce9511
Threat name:
Text.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-06-22 15:41:40 UTC
File Type:
Text (Shell)
AV detection:
4 of 24 (16.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2fjutn4gesg6r2oqoy2iu4oynvvcwwxywmkwv7h633wdz46osuiq._file
Result
Malware family:
n/a
Score:
  4/10
Tags:
antivm discovery linux
Link:
https://tria.ge/reports/260622-s83zcsdz8m/
Behaviour
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.05
Link:
https://yomi.yoroi.company/submissions/d15349b786248de8e9d076348a71d86d6a2b5af8b3156afcfedeec3cf3ce9511

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb
Rule name:telegram_bot_api
Create hunting rule
Author:rectifyq
Description:Detects file containing Telegram Bot API

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments