MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fdd1b1e07b75c332526ca0ffc9463ad1b6ddcfa09fa2aefe69d8afdf60759104. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	fdd1b1e07b75c332526ca0ffc9463ad1b6ddcfa09fa2aefe69d8afdf60759104
SHA3-384 hash:	c6bae76d37b4cb9acc02ae06b1dfd3d1b7bd0bb316e3cb551a9ee8805cfe72e0be14b6a8e1aeae806cdb129d49b4dd1d
SHA1 hash:	5d3042ffc005a7acce70e15f82890e0be3c500ba
MD5 hash:	f5d20533e82028319e35ac3991c9049e
humanhash:	mango-angel-jersey-failed
File name:	k.php
Download:	download sample
File size:	50'059 bytes
First seen:	2026-09-02 03:14:40 UTC
Last seen:	Never
File type:	sh
MIME type:	text/x-shellscript
ssdeep	768:fXRWNGxVqx9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnS:ZlxU6cr
TLSH	T136236D651A857C24AA98C4371D7E2F0CBDAD43E6324492DE7FCA3CF28C5AA9DD10871D
TrID	70.0% (.SH) Linux/UNIX shell script (7000/1) 30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika	shell
Reporter	abuse_ch
Tags:	sh

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

78

Origin country :

DE

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.Linux.BackDoor.Siggen.759-3.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

base64 bash evasive lolbin masquerade obfuscated

Link:

https://www.filescan.io/uploads/6a9794cf225cbf911f4de8fa/reports/d04c9568-11de-4ab4-86bc-b635900619f0/overview

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-09-02T01:22:00Z UTC

Last seen:

2026-09-02T01:36:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/fdd1b1e07b75c332526ca0ffc9463ad1b6ddcfa09fa2aefe69d8afdf60759104/results?tab=lookup

Kunai Sandbox

Status:

terminated

Link:

https://sandbox.kunai.rocks/analysis/1772cd8a-2d11-41fb-88d1-f1ca3c8d8a8d

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

93%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/fdd1b1e07b75c332526ca0ffc9463ad1b6ddcfa09fa2aefe69d8afdf60759104

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/fdd1b1e07b75c332526ca0ffc9463ad1b6ddcfa09fa2aefe69d8afdf60759104/

ReversingLabs TitaniumCloud Linux.Trojan.Generic

Threat name:

Linux.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2026-09-02 03:15:33 UTC

File Type:

Text (Shell)

AV detection:

11 of 36 (30.56%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=7xi3dyd3oxbteutmud74srr22g3n3t5at6rk57tj3cx56ydvseca._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

antivm credential_access defense_evasion discovery execution linux persistence privilege_escalation

Link:

https://tria.ge/reports/260902-dr5paswyds/

Behaviour

Enumerates kernel/hardware configuration

Reads runtime system information

System Network Configuration Discovery

Writes file to tmp directory

Deobfuscate/Decode Files or Information

Checks CPU configuration

Creates a desktop entry file

Modifies Bash startup script

Creates/modifies environment variables

Deletes log files

Enumerates running processes

Modifies rc script

Adds a user to the system

Creates/modifies Cron job

File and Directory Permissions Modification

Deletes Audit logs

Deletes system logs

Flushes firewall rules

OS Credential Dumping

Modifies password files for system users/ groups

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.19

Link:

https://yomi.yoroi.company/submissions/fdd1b1e07b75c332526ca0ffc9463ad1b6ddcfa09fa2aefe69d8afdf60759104