MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 d80b949b4c3d67a31503c8f9ebceaae6d00c5b3a73c3a248c29db6cc43d91a35. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 5
| SHA256 hash: | d80b949b4c3d67a31503c8f9ebceaae6d00c5b3a73c3a248c29db6cc43d91a35 |
|---|---|
| SHA3-384 hash: | 924e0978105b11ea5082991261e2ffbd6a87fb59b8ae32c04fa87687688df80843ae19b647308ddbeee4e4a33b92b3d1 |
| SHA1 hash: | 6451418dfc1b74fcd7c68987d58bc1d137ae2f40 |
| MD5 hash: | 7501dafc7ddd1767dfed9470ae4a8a34 |
| humanhash: | jersey-foxtrot-uniform-mockingbird |
| File name: | d80b949b4c3d67a31503c8f9ebceaae6d00c5b3a73c3a248c29db6cc43d91a35 |
| Download: | download sample |
| File size: | 10'452 bytes |
| First seen: | 2026-09-25 01:53:01 UTC |
| Last seen: | Never |
| File type: | sh |
| MIME type: | text/x-shellscript |
| ssdeep | 192:GdF41PIJSGExDxbQBTOu0DW+JLexPldpLrfl0bAmugc8xfvCNMOjlDU1v2RiNcKH:GdWFeabqTOu0mdxeAiKlDU1uRiGf/TSN |
| TLSH | T11022A5B1BA4233F1613C40B079DA5144B39C255F27A93DB9F0AAB5B4312C3C95DFE16A |
| TrID | 70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1) |
| Magika | shell |
| Reporter |  theodore_brucker |
| Tags: | cowrie honeypot sh ssh |
theodore_brucker
Captured by an SSH honeypot, first seen 2026-09-25 UTC, fetched from a URL (wget/curl) inside the session.Shell script dropper
This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.
| URL | Malware sample (SHA256 hash) | Signature | Tags |
|---|---|---|---|
| https://raw.githubusercontent.com/C3Pool/xmrig_setup/master/xmrig.tar.gz | n/a | n/a | n/a |
| https://github.com/xmrig/xmrig/releases/latest | n/a | n/a | n/a |
Intelligence
File Origin
# of uploads :
1
# of downloads :
77
Origin country :
USVendor Threat Intelligence
No detections
Detection(s):
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
downloader dropper hacktool
Verdict:
Adware
File Type:
unix shell
First seen:
2025-09-05T13:48:00Z UTC
Last seen:
2026-09-26T22:10:00Z UTC
Hits:
~10
Status:
terminated
Behavior Graph:
Score:
0%
Verdict:
Benign
File Type:
SCRIPT
Threat name:
Linux.Coinminer.Generic
Status:
Malicious
First seen:
2025-09-06 10:01:34 UTC
File Type:
Text (Shell)
AV detection:
21 of 36 (58.33%)
Threat level:
4/5
Detection(s):
Suspicious file
Result
Malware family:
n/a
Score:
3/10
Tags:
discovery linux
Behaviour
Reads runtime system information
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
sh d80b949b4c3d67a31503c8f9ebceaae6d00c5b3a73c3a248c29db6cc43d91a35
(this sample)
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.