MalwareBazaar Database
You are currently viewing the MalwareBazaar entry for SHA256 e2931cd3783674b767fd7b1702ff61f9e44658b35b22b1605e426947e9fe5e92. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
Database Entry
Threat unknown
Vendor detections: 4
| SHA256 hash: | e2931cd3783674b767fd7b1702ff61f9e44658b35b22b1605e426947e9fe5e92 |
|---|---|
| SHA3-384 hash: | 27e95c92daa87e2632d67bbaa323b7429345caea6179971ee777513775271cddd99028e6eac21e7c8240116bfd59447e |
| SHA1 hash: | c41e77345da2b336b7856a1e707b8d4785fd765e |
| MD5 hash: | dcad624aa955b271ba29f0a9bce63834 |
| humanhash: | diet-moon-triple-utah |
| File name: | l |
| Download: | download sample |
| File size: | 609 bytes |
| First seen: | 2026-03-01 20:20:11 UTC |
| Last seen: | Never |
| File type: | sh |
| MIME type: | text/plain |
| ssdeep | 12:8q0HsOt1VvhsqNxtzYFcOpsGLSUtwOkYV0VyVIVs6X:8RHsOt1xhVtzYFfnGOJmYCS6X |
| TLSH | T198F0DD16A9797D066330CC1E83A46A0E433143F1F98CAD1BD1E29AD32E6C4C63157E50 |
| Magika | shell |
| Reporter |  abuse_ch |
| Tags: | sh |
Shell script dropper
This file seems to be a shell script dropper, using wget, ftpget and/or curl. More information about the corresponding payload URLs are shown below.
| URL | Malware sample (SHA256 hash) | Signature | Tags |
|---|---|---|---|
| http://ext-checkdin.vercel.app/api/tokenl | n/a | n/a | n/a |
Intelligence
File Origin
# of uploads :
1
# of downloads :
85
Origin country :
DEVendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
10/10
Confidence:
100%
Tags:
base64 bash lolbin obfuscated
Result
Gathering data
Score:
30%
Verdict:
Susipicious
File Type:
SCRIPT
Detection(s):
Suspicious file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
File information
The table below shows additional information about this malware sample such as delivery method and external references.
Web download
sh e2931cd3783674b767fd7b1702ff61f9e44658b35b22b1605e426947e9fe5e92
(this sample)
Delivery method
Distributed via web download
Comments
Login required
You need to login to in order to write a comment. Login with your abuse.ch account.