MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d70e0da019565d30fafbab8ca25009287d506746cb4672f04fb768c34870aee7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	d70e0da019565d30fafbab8ca25009287d506746cb4672f04fb768c34870aee7
SHA3-384 hash:	d30e33ab19d1c7ae2814aaf05aa23672b6c1e78b6008049e0d26ff348b8dd13bd98821cce65b5688fd418b7aaaab01ee
SHA1 hash:	6db886573eb5797fb35b538d8a60f769785f37b4
MD5 hash:	f8019ca9e9537fb84f0b6954b01450d6
humanhash:	green-william-alaska-carpet
File name:	deploy_linux.sh
Download:	download sample
File size:	3'342 bytes
First seen:	2026-11-07 07:52:15 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	48:LZF1dkPsEzApKUb+eK2HmwxvCaHhUzWmJ6Mi12fBMsln5TPqyx/nKMDnC1q:LYs+Ap+ebdx6a+dvwVM5TPxt
TLSH	T10F6131B0A620E13876C5D4FED3960310156630EB35687E2C74E5B8154BED9AF6138A7A
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	sh

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

71

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

bash lolbin

Link:

https://www.filescan.io/uploads/6aeed8eafe4a05d61f707397/reports/08b32db5-cede-4dc6-904f-a89dc0ecaec6/overview

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

unix shell

Link:

https://opentip.kaspersky.com/d70e0da019565d30fafbab8ca25009287d506746cb4672f04fb768c34870aee7/results?tab=lookup

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/a32bcd84-9668-4d7d-8573-7cdbc8ee417d

Behavior Graph:

Download SVG

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/d70e0da019565d30fafbab8ca25009287d506746cb4672f04fb768c34870aee7/

ReversingLabs TitaniumCloud Text.Trojan.Generic

Threat name:

Text.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2026-11-07 07:53:26 UTC

File Type:

Text (Shell)

AV detection:

4 of 38 (10.53%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=24ha3iazkzotb6x3vogkeuajfb6vaz2gzndhf4cpw5umgsdqv3tq._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  6/10

Tags:

antivm discovery linux persistence privilege_escalation

Link:

https://tria.ge/reports/261107-jq25nsaw3z/

Behaviour

Enumerates kernel/hardware configuration

Reads runtime system information

Writes file to tmp directory

Checks CPU configuration

Reads CPU attributes

Enumerates running processes

Modifies systemd

VirusSign Malicious

Malware Family:

n/a

Malicious:

True

Tags:

debugger-check self-delete shell

Link:

https://intel.virussign.com/intelligence/file/d70e0da019565d30fafbab8ca25009287d506746cb4672f04fb768c34870aee7

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.37

Link:

https://yomi.yoroi.company/submissions/d70e0da019565d30fafbab8ca25009287d506746cb4672f04fb768c34870aee7