MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dea71964a02aba8a687179bb98d7e348231dec8b8a6977ab91a64677a2fbc055. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	dea71964a02aba8a687179bb98d7e348231dec8b8a6977ab91a64677a2fbc055
SHA3-384 hash:	6f651aac082f6bdddbec87c6bef7f8ccd1e395389635283d1ad1c75ed738bb66ea5fa5d9b10dc6a335274fe328ac1f47
SHA1 hash:	e912401852ca4b28ca1e87b6dd869e1b7f147b11
MD5 hash:	2bfe7d5fcc557bf4920afa33c6125fd3
humanhash:	sad-enemy-iowa-skylark
File name:	w.sh
Download:	download sample
File size:	6'390 bytes
First seen:	2026-07-31 17:38:35 UTC
Last seen:	2026-08-01 03:10:47 UTC
File type:	sh
MIME type:	text/x-shellscript
ssdeep	192:PTPchZZwNWB9mqNRWD7JQPBm/kYuewXgRbRHCVT:PTPc3Z0AqkVXgRQ
TLSH	T195D13FE2B836EA303A5E803D619DA5D4FE4B592F00527C04708FA9657B9E60DB03D776
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	sh

Intelligence

---

File Origin

# of uploads :

3

# of downloads :

80

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.Trojan.GenericKD.81005880.23096.9542.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

busybox evasive

Link:

https://www.filescan.io/uploads/6a6cddd0f8f01e7dda72aab8/reports/a876aef2-9127-4085-944a-017250b55905/overview

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-07-31T15:07:00Z UTC

Last seen:

2026-08-02T01:44:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/dea71964a02aba8a687179bb98d7e348231dec8b8a6977ab91a64677a2fbc055/results?tab=lookup

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/34303aae-4d58-48f5-9399-7bb30da75930

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

1%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/dea71964a02aba8a687179bb98d7e348231dec8b8a6977ab91a64677a2fbc055

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/dea71964a02aba8a687179bb98d7e348231dec8b8a6977ab91a64677a2fbc055/

ReversingLabs TitaniumCloud Script-Shell.Trojan.Heuristic

Threat name:

Script-Shell.Trojan.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-07-27 23:11:16 UTC

File Type:

Text (Shell)

AV detection:

5 of 24 (20.83%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=32trszfafk5iu2drpg5zrv7djarr33elrjuxpk4ruzdhpix3ybkq._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

defense_evasion discovery execution linux persistence privilege_escalation

Link:

https://tria.ge/reports/260731-v8gggadj4v/

Behaviour

Enumerates kernel/hardware configuration

Reads runtime system information

Writes file to tmp directory

Changes its process name

Reads CPU attributes

Creates/modifies Cron job

Enumerates running processes

Modifies init.d

Modifies rc script

Modifies systemd

File and Directory Permissions Modification

Deletes itself

Executes dropped EXE

Modifies Watchdog functionality

VMRay Mirai

Malware family:

Mirai

Alert

Create hunting rule

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/dea71964a02a/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/dea71964a02aba8a687179bb98d7e348231dec8b8a6977ab91a64677a2fbc055