🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fb3a0612cac76db0c46463cd7310e23099c1b7bf124654ef8cd2a5cc02e7bc91. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry



Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments

SHA256 hash: fb3a0612cac76db0c46463cd7310e23099c1b7bf124654ef8cd2a5cc02e7bc91
SHA3-384 hash: 1d2d902e9669503062a085988b3a15114a6311a02f6e789e7e468a424ede23dabfa834ca2030b6f58ade9cad34e515e0
SHA1 hash: 6c565f3414e63c6464ee8b139368d3a7109946f1
MD5 hash: 32344b4b5100bb87793cda86c5ef47ff
humanhash: angel-salami-salami-zulu
File name:fb3a0612cac76db0c46463cd7310e23099c1b7bf124654ef8cd2a5cc02e7bc91
Download: download sample
File size:2'960 bytes
First seen:2026-10-19 21:24:46 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 48:cbQ1pKwZD7ADxFxjKjadfXPZERsKzi34U2mWawqKeHHow6K0Sa3INvX4t0G4v:cbaKUDgPxuWre44NeBMHIfz
TLSH T16C51F8F1F8B89A78B8099438720E21A1CF435C3B99923884908BED70719C2ACF03DF31
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter Anonymous
Tags:cowrie dropper honeypot sh

Intelligence


File Origin
# of uploads :
1
# of downloads :
21
Origin country :
US US
Vendor Threat Intelligence
No detections
Gathering data
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-10-19T20:09:00Z UTC
Last seen:
2026-10-20T18:35:00Z UTC
Hits:
~10
Status:
terminated
Behavior Graph:
%3 guuid=6eeb06dc-1900-0000-e427-18bf0c0a0000 pid=2572 /usr/bin/sudo guuid=30cb3cde-1900-0000-e427-18bf140a0000 pid=2580 /tmp/sample.bin guuid=6eeb06dc-1900-0000-e427-18bf0c0a0000 pid=2572->guuid=30cb3cde-1900-0000-e427-18bf140a0000 pid=2580 execve guuid=0f8ee1e0-1900-0000-e427-18bf1b0a0000 pid=2587 /usr/bin/wget guuid=30cb3cde-1900-0000-e427-18bf140a0000 pid=2580->guuid=0f8ee1e0-1900-0000-e427-18bf1b0a0000 pid=2587 execve
Gathering data
Please note that we are no longer able to provide a coverage score for Virus Total.

File information


The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments