🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f18e20f45648f6c70c2237dc5ffeb2d58a257ebcce1a911d309bbf7a77ec1406. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry



Threat unknown


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments

SHA256 hash: f18e20f45648f6c70c2237dc5ffeb2d58a257ebcce1a911d309bbf7a77ec1406
SHA3-384 hash: d00be9d008e6746732adf9b11b39ab27ef1df2cadde981cf5866c192648ec8e35cff999afd804a0e8ff754d87269a91d
SHA1 hash: 2d163f82229b0e9c7c2640ecdc2946e0a8cab4fa
MD5 hash: 100f452fe8bbb2982db7b313b13714ec
humanhash: mars-alaska-double-uniform
File name:setup.sh
Download: download sample
File size:9'660 bytes
First seen:2026-11-15 15:12:58 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 192:0t1oeiVCgsLbLPLFLPbNLXLQAPU9M9nz7FxCgIk1EDgNJB3OEJcFRxOv0qkEWyXf:+oeiIgsPj5bbNbNFbtc/IvXkEJE6Rz
TLSH T15A12C946ED8AC972204CD0A56FD6D801F65902170578B9A0F90DB254BF2CBBCF43E79B
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter BlinkzSec

Intelligence


File Origin
# of uploads :
1
# of downloads :
57
Origin country :
SK SK
Vendor Threat Intelligence
No detections
Status:
terminated
Behavior Graph:
%3 guuid=63126785-1b00-0000-f4bf-f22ed70a0000 pid=2775 /usr/bin/sudo guuid=31838488-1b00-0000-f4bf-f22ed80a0000 pid=2776 /tmp/sample.bin write-file guuid=63126785-1b00-0000-f4bf-f22ed70a0000 pid=2775->guuid=31838488-1b00-0000-f4bf-f22ed80a0000 pid=2776 execve guuid=b7c96689-1b00-0000-f4bf-f22ed90a0000 pid=2777 /usr/bin/dash guuid=31838488-1b00-0000-f4bf-f22ed80a0000 pid=2776->guuid=b7c96689-1b00-0000-f4bf-f22ed90a0000 pid=2777 clone guuid=e1158d8a-1b00-0000-f4bf-f22edd0a0000 pid=2781 /usr/bin/dash guuid=31838488-1b00-0000-f4bf-f22ed80a0000 pid=2776->guuid=e1158d8a-1b00-0000-f4bf-f22edd0a0000 pid=2781 clone guuid=c8c9328b-1b00-0000-f4bf-f22ee00a0000 pid=2784 /usr/bin/dash guuid=31838488-1b00-0000-f4bf-f22ed80a0000 pid=2776->guuid=c8c9328b-1b00-0000-f4bf-f22ee00a0000 pid=2784 clone guuid=363fca8b-1b00-0000-f4bf-f22ee30a0000 pid=2787 /usr/bin/mkdir guuid=31838488-1b00-0000-f4bf-f22ed80a0000 pid=2776->guuid=363fca8b-1b00-0000-f4bf-f22ee30a0000 pid=2787 execve guuid=0f407b8e-1b00-0000-f4bf-f22ee60a0000 pid=2790 /usr/bin/dash guuid=31838488-1b00-0000-f4bf-f22ed80a0000 pid=2776->guuid=0f407b8e-1b00-0000-f4bf-f22ee60a0000 pid=2790 clone guuid=ce46e38f-1b00-0000-f4bf-f22eea0a0000 pid=2794 /usr/bin/curl net guuid=31838488-1b00-0000-f4bf-f22ed80a0000 pid=2776->guuid=ce46e38f-1b00-0000-f4bf-f22eea0a0000 pid=2794 execve guuid=f8299c89-1b00-0000-f4bf-f22edb0a0000 pid=2779 /usr/bin/date guuid=b7c96689-1b00-0000-f4bf-f22ed90a0000 pid=2777->guuid=f8299c89-1b00-0000-f4bf-f22edb0a0000 pid=2779 execve guuid=971a988a-1b00-0000-f4bf-f22ede0a0000 pid=2782 /usr/bin/uname guuid=e1158d8a-1b00-0000-f4bf-f22edd0a0000 pid=2781->guuid=971a988a-1b00-0000-f4bf-f22ede0a0000 pid=2782 execve guuid=b41b438b-1b00-0000-f4bf-f22ee10a0000 pid=2785 /usr/bin/uname guuid=c8c9328b-1b00-0000-f4bf-f22ee00a0000 pid=2784->guuid=b41b438b-1b00-0000-f4bf-f22ee10a0000 pid=2785 execve guuid=03ae8c8e-1b00-0000-f4bf-f22ee70a0000 pid=2791 /usr/bin/dash guuid=0f407b8e-1b00-0000-f4bf-f22ee60a0000 pid=2790->guuid=03ae8c8e-1b00-0000-f4bf-f22ee70a0000 pid=2791 clone guuid=61bfa88e-1b00-0000-f4bf-f22ee80a0000 pid=2792 /usr/bin/dirname guuid=03ae8c8e-1b00-0000-f4bf-f22ee70a0000 pid=2791->guuid=61bfa88e-1b00-0000-f4bf-f22ee80a0000 pid=2792 execve 7addd2d2-0187-50be-9291-ea309647dca3 176.65.149.195:80 guuid=ce46e38f-1b00-0000-f4bf-f22eea0a0000 pid=2794->7addd2d2-0187-50be-9291-ea309647dca3 con
Result
Malware family:
n/a
Score:
  3/10
Tags:
discovery linux
Behaviour
Reads runtime system information
Please note that we are no longer able to provide a coverage score for Virus Total.

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Comments