MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 db2ac05bf12741d2ad2aed3e695f0797a82aebaaa5cecb334a23d49582fea582. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	db2ac05bf12741d2ad2aed3e695f0797a82aebaaa5cecb334a23d49582fea582
SHA3-384 hash:	bef99981376ed534e5f8aa7c62607735f2be635525cb6882f282bca9c51e075ac8ec77c4823b80ae28b69be66c56ef14
SHA1 hash:	4aaa37bf609a35c50c5eb942122a1ba9fbe7ed5c
MD5 hash:	ab075525cae0cf1e14b4ed8cc671720f
humanhash:	dakota-west-friend-kitten
File name:	run.sh
Download:	download sample
File size:	622 bytes
First seen:	2026-06-07 19:04:47 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	12:Zx80LXalokLeHt4ayzKuPfFFHshByuFNkjXfahx:gAal2Ht4aIpnF1/ihx
TLSH	T1D0F0ACE711B0DC3175B4C92DFD9782E0104B18272829250A709F7E00BB2C98CF286655
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	BlinkzSec

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

35

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.BV.Downloader-BTF.53266934.UNOFFICIAL

Alert

Create hunting rule

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-06-07T13:36:00Z UTC

Last seen:

2026-06-07T14:21:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/db2ac05bf12741d2ad2aed3e695f0797a82aebaaa5cecb334a23d49582fea582/results?tab=lookup

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/86e5eaed-6c52-4010-86e6-15260a8c4cd8

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

97%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/db2ac05bf12741d2ad2aed3e695f0797a82aebaaa5cecb334a23d49582fea582

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/db2ac05bf12741d2ad2aed3e695f0797a82aebaaa5cecb334a23d49582fea582/

Neiki Family.MIRAI

Verdict:

Malicious

Threat:

Family.MIRAI

Link:

https://tip.neiki.dev/file/db2ac05bf12741d2ad2aed3e695f0797a82aebaaa5cecb334a23d49582fea582

ReversingLabs TitaniumCloud Script-BAT.Downloader.Heuristic

Threat name:

Script-BAT.Downloader.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-06-07 16:13:30 UTC

File Type:

Text (Shell)

AV detection:

4 of 36 (11.11%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=3mvmaw7re5a5fljk5u7gsxyhs6ucv25kuxhmwm2kepkjlax6uwba._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

credential_access defense_evasion discovery execution linux persistence privilege_escalation

Link:

https://tria.ge/reports/260607-xrwk6sh19n/

Behaviour

Enumerates kernel/hardware configuration

Reads runtime system information

System Network Configuration Discovery

Writes file to shm directory

Writes file to tmp directory

Modifies Bash startup script

Reads process memory

Creates/modifies Cron job

Creates/modifies environment variables

Enumerates running processes

Modifies init.d

Modifies systemd

File and Directory Permissions Modification

Executes dropped EXE

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.16

Link:

https://yomi.yoroi.company/submissions/db2ac05bf12741d2ad2aed3e695f0797a82aebaaa5cecb334a23d49582fea582