MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d8f4dcaa026c262ee2f03e790fbc6c0eb2f60f9063bcac41d5b71dce24ef694b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d8f4dcaa026c262ee2f03e790fbc6c0eb2f60f9063bcac41d5b71dce24ef694b
SHA3-384 hash: 1bb487b73fb00ef9e5f5cf825df7d0eadcd269d7168bede8e2363ce58906a305226f1f935d36b9736e67a19322b04175
SHA1 hash: 667ccbf45d5740d6ac4fad8cbaa176cd3fec8c8c
MD5 hash: d07469fe2763ff32ef3eb0b757e16892
humanhash: eighteen-mars-utah-hamper
File name:_up.bin
Download: download sample
File size:13'826 bytes
First seen:2026-07-13 15:01:46 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 192:2875r4j74COKyAVF1mBt6e4egQq1GZ0HRit4Nmn5PH03/BNGBggGQd:T5tT4LyMiXn5PUQ
TLSH T1E052A672BA65D57638ACC22C998E9110392B3AEB36183458B4AD76043FFC31D51F277A
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter nullblue67
Tags:bash dropper PERSISTENCE sh softwaretech WatchDog
URLMalware sample (SHA256 hash)SignatureTags
http://45.225.135.18:6262/dockern/an/an/a

Intelligence

File Origin
# of uploads :
1
# of downloads :
111
Origin country :
ES ES
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
bash lolbin masquerade
Link:
https://www.filescan.io/uploads/6a54fe0f1aaf2ae4952bac52/reports/542b6d01-5368-4d08-bce7-7de5b25a1647/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-07-13T11:50:00Z UTC
Last seen:
2026-07-14T00:53:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/d8f4dcaa026c262ee2f03e790fbc6c0eb2f60f9063bcac41d5b71dce24ef694b/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/71491d73-a374-4e68-870f-006084f27763
Behavior Graph:
Download SVG
%3 guuid=400fa56e-1900-0000-45d0-d837820e0000 pid=3714 /usr/bin/sudo guuid=1a075c70-1900-0000-45d0-d8378b0e0000 pid=3723 /tmp/sample.bin write-file guuid=400fa56e-1900-0000-45d0-d837820e0000 pid=3714->guuid=1a075c70-1900-0000-45d0-d8378b0e0000 pid=3723 execve guuid=09c12471-1900-0000-45d0-d837900e0000 pid=3728 /usr/bin/curl net guuid=1a075c70-1900-0000-45d0-d8378b0e0000 pid=3723->guuid=09c12471-1900-0000-45d0-d837900e0000 pid=3728 execve guuid=bf1a7e79-1900-0000-45d0-d837b10e0000 pid=3761 /usr/bin/mkdir guuid=1a075c70-1900-0000-45d0-d8378b0e0000 pid=3723->guuid=bf1a7e79-1900-0000-45d0-d837b10e0000 pid=3761 execve guuid=f370287a-1900-0000-45d0-d837b20e0000 pid=3762 /usr/bin/date guuid=1a075c70-1900-0000-45d0-d8378b0e0000 pid=3723->guuid=f370287a-1900-0000-45d0-d837b20e0000 pid=3762 execve guuid=eed82e7b-1900-0000-45d0-d837b30e0000 pid=3763 /usr/bin/bash guuid=1a075c70-1900-0000-45d0-d8378b0e0000 pid=3723->guuid=eed82e7b-1900-0000-45d0-d837b30e0000 pid=3763 clone guuid=0539117c-1900-0000-45d0-d837b50e0000 pid=3765 /usr/bin/date guuid=1a075c70-1900-0000-45d0-d8378b0e0000 pid=3723->guuid=0539117c-1900-0000-45d0-d837b50e0000 pid=3765 execve guuid=b9657b7c-1900-0000-45d0-d837b80e0000 pid=3768 /usr/bin/date guuid=1a075c70-1900-0000-45d0-d8378b0e0000 pid=3723->guuid=b9657b7c-1900-0000-45d0-d837b80e0000 pid=3768 execve guuid=4174ea7c-1900-0000-45d0-d837ba0e0000 pid=3770 /usr/bin/date guuid=1a075c70-1900-0000-45d0-d8378b0e0000 pid=3723->guuid=4174ea7c-1900-0000-45d0-d837ba0e0000 pid=3770 execve guuid=ec98577d-1900-0000-45d0-d837bd0e0000 pid=3773 /usr/bin/date guuid=1a075c70-1900-0000-45d0-d8378b0e0000 pid=3723->guuid=ec98577d-1900-0000-45d0-d837bd0e0000 pid=3773 execve guuid=1546a27d-1900-0000-45d0-d837bf0e0000 pid=3775 /usr/bin/mkdir guuid=1a075c70-1900-0000-45d0-d8378b0e0000 pid=3723->guuid=1546a27d-1900-0000-45d0-d837bf0e0000 pid=3775 execve guuid=09c1f37d-1900-0000-45d0-d837c20e0000 pid=3778 /usr/bin/date guuid=1a075c70-1900-0000-45d0-d8378b0e0000 pid=3723->guuid=09c1f37d-1900-0000-45d0-d837c20e0000 pid=3778 execve guuid=428e487e-1900-0000-45d0-d837c40e0000 pid=3780 /usr/bin/curl net guuid=1a075c70-1900-0000-45d0-d8378b0e0000 pid=3723->guuid=428e487e-1900-0000-45d0-d837c40e0000 pid=3780 execve guuid=b4853483-1900-0000-45d0-d837d50e0000 pid=3797 /usr/bin/date guuid=1a075c70-1900-0000-45d0-d8378b0e0000 pid=3723->guuid=b4853483-1900-0000-45d0-d837d50e0000 pid=3797 execve 138f30fa-03dc-5fbc-8358-f187ad2cc4b3 45.225.135.18:6262 guuid=09c12471-1900-0000-45d0-d837900e0000 pid=3728->138f30fa-03dc-5fbc-8358-f187ad2cc4b3 con guuid=17496f7b-1900-0000-45d0-d837b40e0000 pid=3764 /usr/bin/hostname guuid=eed82e7b-1900-0000-45d0-d837b30e0000 pid=3763->guuid=17496f7b-1900-0000-45d0-d837b40e0000 pid=3764 execve 1f0d3453-b684-5b82-8cdf-422603bdf140 45.225.135.18:80 guuid=428e487e-1900-0000-45d0-d837c40e0000 pid=3780->1f0d3453-b684-5b82-8cdf-422603bdf140 con
Score:
0%
Verdict:
Benign
File Type:
SCRIPT
Link:
https://malprob.io/report/d8f4dcaa026c262ee2f03e790fbc6c0eb2f60f9063bcac41d5b71dce24ef694b
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d8f4dcaa026c262ee2f03e790fbc6c0eb2f60f9063bcac41d5b71dce24ef694b/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3d2nzkqcnqtc5yxqhz4q7pdmb2zpmd4qmo6kyqovw4o44jhpnffq._file
Result
Malware family:
n/a
Score:
  4/10
Tags:
antivm discovery linux
Link:
https://tria.ge/reports/260713-serdgaa17p/
Behaviour
Reads runtime system information
Checks CPU configuration
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.05
Link:
https://yomi.yoroi.company/submissions/d8f4dcaa026c262ee2f03e790fbc6c0eb2f60f9063bcac41d5b71dce24ef694b

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments