MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d3a27819ddd81b7d916a8e2830c4dcf3cb9111b74daa9640ba32c2fddebe9564. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	d3a27819ddd81b7d916a8e2830c4dcf3cb9111b74daa9640ba32c2fddebe9564
SHA3-384 hash:	9b58b85beb830902fe6f221b08503c07a2308d7d4e5d3d1cfacb813a13bfae4d818010530797853b7321d5dc35a77f64
SHA1 hash:	f9a4309d2811bfa50eac1d4d98221645af05e62d
MD5 hash:	b06eeb1c4f4105ec64ddf254cfdfef2d
humanhash:	kitten-massachusetts-sodium-chicken
File name:	d3a27819ddd81b7d916a8e2830c4dcf3cb9111b74daa9640ba32c2fddebe9564
Download:	download sample
File size:	1'322 bytes
First seen:	2026-10-27 09:17:07 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	24:sfDNQtGqjJppbNWowzVj1IBe0FvJtw/m4IzlX7Wg/Qg2rx:IqHjXpYlzVj18eovJtw/m4IzlXSg/Qgq
TLSH	T15E217DE2F9B12972778E857CAA5C10582987193F44257C84B2DF7C307F2864C75D8B32
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	thinngo
Tags:	honeypot sh

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

67

Origin country :

GB

Vendor Threat Intelligence

ACCE Unknown

No detections

FileScan.io

Gathering data

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-10-27T07:14:00Z UTC

Last seen:

2026-10-27T16:16:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/d3a27819ddd81b7d916a8e2830c4dcf3cb9111b74daa9640ba32c2fddebe9564/results?tab=lookup

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/112efa86-ceee-42e2-a9ea-ae39f448f9f2

Behavior Graph:

Download SVG

Nucleon Malprob Susipicious

Score:

43%

Verdict:

Susipicious

File Type:

SCRIPT

Link:

https://malprob.io/report/d3a27819ddd81b7d916a8e2830c4dcf3cb9111b74daa9640ba32c2fddebe9564

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d3a27819ddd81b7d916a8e2830c4dcf3cb9111b74daa9640ba32c2fddebe9564/

ReversingLabs TitaniumCloud Win32.Trojan.Vigorf

Threat name:

Win32.Trojan.Vigorf

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-10-27 10:13:43 UTC

AV detection:

5 of 24 (20.83%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=2orhqgo53anx3elkryudbrg46pfzcenxjwvjmqf2glbp3xv6svsa._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

defense_evasion discovery linux

Link:

https://tria.ge/reports/261027-k855qaby6y/

Behaviour

Enumerates kernel/hardware configuration

System Network Configuration Discovery

Writes file to tmp directory

File and Directory Permissions Modification

Executes dropped EXE

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.16

Link:

https://yomi.yoroi.company/submissions/d3a27819ddd81b7d916a8e2830c4dcf3cb9111b74daa9640ba32c2fddebe9564