MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ea39ec004c131f1b66e178b7c3474e9ec73e277157d8fa81e42cc1b0bf59ec91. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ea39ec004c131f1b66e178b7c3474e9ec73e277157d8fa81e42cc1b0bf59ec91
SHA3-384 hash: 410bb1c9ce868abbbe41e0ed8cd5693b6a07ad42c35221cd80a9c6f8587e9d7a538f1b414401528fe86c78e16d2c077b
SHA1 hash: c6d2eac67d1323854d9252445003608de9368c2b
MD5 hash: 9ee6f7758c5e684ce42625b09141f9c9
humanhash: indigo-burger-hawaii-carpet
File name:1
Download: download sample
File size:318 bytes
First seen:2026-08-06 19:36:35 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 6:OtL/vmmy3pFq/kxiA2+mSYvD8ez1IvD8NIaKVvfxA8JOEVKSUH04cn:O9K2kkA2IEAcxKVvW88EVKSkRcn
TLSH T105E07DC8C070AD750F0ECB083524C5F5E503229A98934DCC94860F11149FF09FD4EE24
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter BlinkzSec
URLMalware sample (SHA256 hash)SignatureTags
http://94.154.43.103/sshdn/an/an/a

Intelligence

File Origin
# of uploads :
1
# of downloads :
45
Origin country :
CH CH
Vendor Threat Intelligence
No detections
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/92778929-0ca9-4bb8-a515-ced1753a0ef5
Behavior Graph:
Download SVG
%3 guuid=c9053539-1a00-0000-258d-3d4087090000 pid=2439 /usr/bin/sudo guuid=0ed7233d-1a00-0000-258d-3d408e090000 pid=2446 /tmp/sample.bin guuid=c9053539-1a00-0000-258d-3d4087090000 pid=2439->guuid=0ed7233d-1a00-0000-258d-3d408e090000 pid=2446 execve guuid=3277c63d-1a00-0000-258d-3d4090090000 pid=2448 /usr/bin/hostname guuid=0ed7233d-1a00-0000-258d-3d408e090000 pid=2446->guuid=3277c63d-1a00-0000-258d-3d4090090000 pid=2448 execve guuid=9a77213e-1a00-0000-258d-3d4092090000 pid=2450 /usr/bin/date guuid=0ed7233d-1a00-0000-258d-3d408e090000 pid=2446->guuid=9a77213e-1a00-0000-258d-3d4092090000 pid=2450 execve guuid=c6359e3e-1a00-0000-258d-3d4094090000 pid=2452 /usr/bin/wget net send-data guuid=0ed7233d-1a00-0000-258d-3d408e090000 pid=2446->guuid=c6359e3e-1a00-0000-258d-3d4094090000 pid=2452 execve guuid=06917343-1a00-0000-258d-3d409f090000 pid=2463 /usr/bin/bash guuid=0ed7233d-1a00-0000-258d-3d408e090000 pid=2446->guuid=06917343-1a00-0000-258d-3d409f090000 pid=2463 clone d362df78-f26c-5d9d-8fb2-3e6aab20268a 94.154.43.103:80 guuid=c6359e3e-1a00-0000-258d-3d4094090000 pid=2452->d362df78-f26c-5d9d-8fb2-3e6aab20268a send: 132B
Score:
91%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/ea39ec004c131f1b66e178b7c3474e9ec73e277157d8fa81e42cc1b0bf59ec91
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ea39ec004c131f1b66e178b7c3474e9ec73e277157d8fa81e42cc1b0bf59ec91/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5i46yacmcmprwzxbpc34gr2ot3dt4j3rk7mpvapefta3bp2z5siq._file
Result
Malware family:
n/a
Score:
  1/10
Tags:
linux
Link:
https://tria.ge/reports/260806-yb4saaca25/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.31
Link:
https://yomi.yoroi.company/submissions/ea39ec004c131f1b66e178b7c3474e9ec73e277157d8fa81e42cc1b0bf59ec91

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh ea39ec004c131f1b66e178b7c3474e9ec73e277157d8fa81e42cc1b0bf59ec91

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3898128/
  
Delivery method
Distributed via web download

Comments