MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d6773d443e2b1c2cf5deb71e874fb2287e74b534ee1674948a3cd870eb6246ad. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d6773d443e2b1c2cf5deb71e874fb2287e74b534ee1674948a3cd870eb6246ad
SHA3-384 hash: 2ebe3dafeb2767d056f919703d9c64d7c678e2aa8a6b0ca50e2f501483d58f3ff3502153502c6b40b8f44c63f631b57b
SHA1 hash: e9627518f53ba25754a32671db25923254d9302a
MD5 hash: 663f8e1087e5896ea0aed17b8b9977b4
humanhash: yellow-spaghetti-moon-london
File name:m
Download: download sample
File size:554 bytes
First seen:2026-03-02 07:37:15 UTC
Last seen:2026-03-02 16:13:52 UTC
File type: sh
MIME type:text/plain
ssdeep 12:MquhRnFxvhsOV6FZIcOpO7qilauv66s/kTFmKI5YHj6X:MfnnDhzV7c0GfssFmKIWD6X
TLSH T1B1F0E15094E07C7027F8894D9490424CA171337763A67E2062D08DF60B96010736B797
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://ext-checkdin.vercel.app/api/tokenln/an/an/a

Intelligence

File Origin
# of uploads :
2
# of downloads :
64
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
base64 bash lolbin obfuscated
Link:
https://www.filescan.io/uploads/69a54f8897feb4afd663eb08/reports/93349e09-88e9-46a0-b3e0-48fda3c7fcfd/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/d6773d443e2b1c2cf5deb71e874fb2287e74b534ee1674948a3cd870eb6246ad
Result
Gathering data
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/3dbdd6d9-6c62-48aa-8eec-0307621be0af
Behavior Graph:
Download SVG
%3 guuid=9a9e9444-1a00-0000-0672-654b210a0000 pid=2593 /usr/bin/sudo guuid=f34af746-1a00-0000-0672-654b270a0000 pid=2599 /tmp/sample.bin guuid=9a9e9444-1a00-0000-0672-654b210a0000 pid=2593->guuid=f34af746-1a00-0000-0672-654b270a0000 pid=2599 execve guuid=a6cd5f47-1a00-0000-0672-654b290a0000 pid=2601 /usr/bin/mkdir guuid=f34af746-1a00-0000-0672-654b270a0000 pid=2599->guuid=a6cd5f47-1a00-0000-0672-654b290a0000 pid=2601 execve guuid=ef33da47-1a00-0000-0672-654b2c0a0000 pid=2604 /usr/bin/clear guuid=f34af746-1a00-0000-0672-654b270a0000 pid=2599->guuid=ef33da47-1a00-0000-0672-654b2c0a0000 pid=2604 execve
Score:
20%
Verdict:
Benign
File Type:
SCRIPT
Link:
https://malprob.io/report/d6773d443e2b1c2cf5deb71e874fb2287e74b534ee1674948a3cd870eb6246ad
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d6773d443e2b1c2cf5deb71e874fb2287e74b534ee1674948a3cd870eb6246ad/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2z3t2rb6fmocz5o6w4piot5sfb7hjnju5ylhjfekhtmhb23ci2wq._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/260302-ksanwaev7a/
Behaviour
Modifies registry class
Suspicious use of SetWindowsHookEx
Enumerates physical storage devices
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/d6773d443e2b1c2cf5deb71e874fb2287e74b534ee1674948a3cd870eb6246ad

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh d6773d443e2b1c2cf5deb71e874fb2287e74b534ee1674948a3cd870eb6246ad

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3787692/
  
Delivery method
Distributed via web download

Comments