MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e80b2272b86a5dfcef82f5c74f69a5cb6184dc0ad48a1d7cce90acb1941d46b7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	e80b2272b86a5dfcef82f5c74f69a5cb6184dc0ad48a1d7cce90acb1941d46b7
SHA3-384 hash:	6a2508b571470d4245d9ba2254f292a7aa2fbd7f2ecd8d2d43e5f4a6f6c5197e678c0c53f4c34dc0754e2c474d2c5b9c
SHA1 hash:	c9e15739ab6597e94350bdc808a77815fc38ad1c
MD5 hash:	84b296c314df7954e8a829ec3599f69a
humanhash:	saturn-blossom-aspen-eight
File name:	e80b2272b86a5dfcef82f5c74f69a5cb6184dc0ad48a1d7cce90acb1941d46b7
Download:	download sample
Signature	Prometei Alert Create hunting rule
File size:	3'121 bytes
First seen:	2026-06-27 15:06:32 UTC
Last seen:	2026-06-27 17:36:41 UTC
File type:	sh
MIME type:	text/x-shellscript
ssdeep	96:HsKBiqTamDhDCkxwq05GiG2YnELncPFkrTJnY7m9mncTp:HsJRh39Tp
TLSH	T19451F28BD4915522AD3A6C35AB9DF5418A4601930239CD4DF92F2C443FF9900BE17F6A
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	c2hunter
Tags:	Prometei sh wraith

Intelligence

---

File Origin

# of uploads :

3

# of downloads :

62

Origin country :

US

Vendor Threat Intelligence

ACCE Unknown

No detections

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

downloader

Link:

https://www.filescan.io/uploads/6a3fe6fc80183391af219319/reports/a0a5637c-a438-4574-80a2-ca2c5d02474e/overview

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-06-27T12:15:00Z UTC

Last seen:

2026-06-28T12:58:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/e80b2272b86a5dfcef82f5c74f69a5cb6184dc0ad48a1d7cce90acb1941d46b7/results?tab=lookup

Kunai Sandbox

Status:

Failed

Link:

https://sandbox.kunai.rocks/analysis/4ab975ea-eef1-4b8f-920b-f1fbb25a02f4

Nucleon Malprob Malware

Score:

98%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/e80b2272b86a5dfcef82f5c74f69a5cb6184dc0ad48a1d7cce90acb1941d46b7

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e80b2272b86a5dfcef82f5c74f69a5cb6184dc0ad48a1d7cce90acb1941d46b7/

Neiki NetTool.Wget.HTTP

Verdict:

Malicious

Threat:

NetTool.Wget.HTTP

Link:

https://tip.neiki.dev/file/e80b2272b86a5dfcef82f5c74f69a5cb6184dc0ad48a1d7cce90acb1941d46b7

ReversingLabs TitaniumCloud Script-Shell.Trojan.SAgnt

Threat name:

Script-Shell.Trojan.SAgnt

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-06-27 15:08:15 UTC

File Type:

Text (Shell)

AV detection:

9 of 24 (37.50%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=5afse4vynjo7z34c6xdu62nfznqyjxak2sfb27goscwldfa5i23q._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

credential_access defense_evasion discovery linux

Link:

https://tria.ge/reports/260627-sg28rabt9y/

Behaviour

Reads runtime system information

Writes file to tmp directory

Changes its process name

Reads system network configuration

Reads process memory

Deletes log files

Enumerates active TCP sockets

Enumerates running processes

File and Directory Permissions Modification

Deletes Audit logs

Deletes system logs

Executes dropped EXE

Traces itself

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Suspicious File

Threat name:

Suspicious File

Score:

0.36

Link:

https://yomi.yoroi.company/submissions/e80b2272b86a5dfcef82f5c74f69a5cb6184dc0ad48a1d7cce90acb1941d46b7