MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 debaf394b5a4dbc06ca03ae271fc59f6800ee261511239100120561cbc1d1200. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	debaf394b5a4dbc06ca03ae271fc59f6800ee261511239100120561cbc1d1200
SHA3-384 hash:	524a9c7d64881231024aa90dcfae9cecec86a469c4da2824db715b8907ca8eb43389d5d17c36cd0a0708d3488a40741b
SHA1 hash:	4ff8491aac50bd998a5ff0b003130b034c879715
MD5 hash:	1c181d293749213c71da70d763fbf381
humanhash:	arkansas-early-island-table
File name:	debaf394b5a4dbc06ca03ae271fc59f6800ee261511239100120561cbc1d1200
Download:	download sample
File size:	743 bytes
First seen:	2026-04-01 10:28:52 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	12:Sjly97dG3BCFrCR5V3FHYfDlKpFeixnLQmT/adGXhG1ugykYP9RcADB73O9y:OUxdGxCFm51EDlgNjTidGXhGIBFVR98c
TLSH	T14C0110FE783234B25F5385EA9D5355970976D37F4FD02DAC28E9873414AD010A13222D
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	JAMESWT_WT
Tags:	pilautfile-com sh

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

48

Origin country :

IT

Vendor Threat Intelligence

ACCE

Gathering data

ClamAV Detected

Detection(s):

SecuriteInfo.com.MacOS.Stealer-HG.47578658.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

evasive stealer threat unknown

Link:

https://www.filescan.io/uploads/69ccf37f2346b9da57b67b2e/reports/08550f6f-c983-44d1-b46a-4da404129e91/overview

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-03-27T09:15:00Z UTC

Last seen:

2026-04-01T09:38:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/debaf394b5a4dbc06ca03ae271fc59f6800ee261511239100120561cbc1d1200/results?tab=lookup

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/93731851-05c0-46e7-aa0e-3fe165307231

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

17%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/debaf394b5a4dbc06ca03ae271fc59f6800ee261511239100120561cbc1d1200

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/debaf394b5a4dbc06ca03ae271fc59f6800ee261511239100120561cbc1d1200/

ReversingLabs TitaniumCloud MacOS.Trojan.SuspMalScript

Threat name:

MacOS.Trojan.SuspMalScript

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-03-27 14:24:56 UTC

File Type:

Text (Shell)

AV detection:

12 of 36 (33.33%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=325phffvutn4a3fahlrhd7cz62aa5ytbkejdseabeblbzpa5ciaa._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  6/10

Tags:

antivm discovery linux

Link:

https://tria.ge/reports/260401-mjc4raet2t/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Checks CPU configuration

Looks up external IP address via web service

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.05

Link:

https://yomi.yoroi.company/submissions/debaf394b5a4dbc06ca03ae271fc59f6800ee261511239100120561cbc1d1200