MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f79f81089f28cb3cf9c9508295d4c5ee7261e6b337286fc25e5af20a078ed0aa. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	f79f81089f28cb3cf9c9508295d4c5ee7261e6b337286fc25e5af20a078ed0aa
SHA3-384 hash:	192c9f986815939719a5bc6b75a617944adf57257b5e2c56fafe12865ff034fcc7a7a450a273c832b1436728bced8496
SHA1 hash:	feb007bf1dc16be9579508119a9edbb6347d578a
MD5 hash:	58181e8b583ecf2fdf5af206b28f5982
humanhash:	october-mexico-white-avocado
File name:	f79f81089f28cb3cf9c9508295d4c5ee7261e6b337286fc25e5af20a078ed0aa
Download:	download sample
File size:	1'431 bytes
First seen:	2026-10-03 09:23:36 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	24:VmEiwaUS5rRLhK9n0ZLsKBu/iswrTWyvCD+LZFm6JZ7+9pQOJr0gtR:VDNaUS5rRLhuneLsSuKswrbMOXm6JZ7M
TLSH	T183217B2B36A234B2A35E08AE477E21165497012B04347E98B2EE17356FBDA367C79B11
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	spydisec
Tags:	cowrie dropper honeypot sh

spydisec

Captured by an SSH/Telnet honeypot (cowrie). Downloaded from http://2.27.248.149/lotus.sh; attacker IP(s): 82.25.63.191; first seen 2026-10-03T09:05:37Z.

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

68

Origin country :

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.Linux.DownLoader.2650.31466.22845.UNOFFICIAL

Alert

Create hunting rule

FileScan.io

Gathering data

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-09-24T18:26:00Z UTC

Last seen:

2026-09-30T12:39:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/f79f81089f28cb3cf9c9508295d4c5ee7261e6b337286fc25e5af20a078ed0aa/results?tab=lookup

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/9d063a26-50ac-4b89-ba3c-449068607d2a

Behavior Graph:

Download SVG

Nucleon Malprob Benign

Score:

11%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/f79f81089f28cb3cf9c9508295d4c5ee7261e6b337286fc25e5af20a078ed0aa

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/f79f81089f28cb3cf9c9508295d4c5ee7261e6b337286fc25e5af20a078ed0aa/

ReversingLabs TitaniumCloud Script-BAT.Trojan.Heuristic

Threat name:

Script-BAT.Trojan.Heuristic

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-09-25 05:47:00 UTC

File Type:

Text (Shell)

AV detection:

8 of 23 (34.78%)

Threat level:

  2/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=66pycce7fdftz6ojkcbjlvgf5zzgdzvtg4ug7qs6llzaub4o2cva._file

Hatching Triage Suspicious

Result

Malware family:

n/a

Score:

  7/10

Tags:

defense_evasion discovery linux upx

Link:

https://tria.ge/reports/261003-lc5pravgla/

Behaviour

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

UPX packed file

File and Directory Permissions Modification

Executes dropped EXE

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.11

Link:

https://yomi.yoroi.company/submissions/f79f81089f28cb3cf9c9508295d4c5ee7261e6b337286fc25e5af20a078ed0aa