MalwareTips
File verdict·Decided by the MT AI Engine
Our call

Malicious

This file is confirmed confirmed malware — abuse.ch researchers uploaded this exact sample to MalwareBazaar as known malware. Delete it and scan your system.

confirmed malware
Trust score3Critical
MT AI confidence · 99%
clean
1.1 KB
7fe68248774d7a8635…5eee0f2326
Antivirus engines
17 of 75 flagged
Code signing
Unsigned
Age
First seen 7 days ago
MT AI Engine · our arbiter

The verdict, reasoned out.

Not a rules engine. The MT AI Engine reads every signal we collected, weighs them against history, and commits to an answer.

99%Confidence
Very high
Reasoning

This file is confirmed confirmed malware — abuse.ch researchers uploaded this exact sample to MalwareBazaar as known malware. Delete it and scan your system. MalwareBazaar is a researcher-curated malware repository; hits there are ground-truth positives.

Key signals · 3

Each signal cites a concrete token from the evidence the arbiter saw — engine name, MITRE technique, signer string, or an exact count.

  1. MalwareBazaar: confirmed malware

  2. (no named signature)

  3. First catalogued: 2026-06-18 20:44:47

Points against
  • MalwareBazaar confirmed family: confirmed malware
  • Researcher-uploaded malware sample
What to do

Delete this file and run a full-system antivirus scan.

Threat family attribution

multiverze corroborated by 2 sources

  • VT (75 engines)
    multiverze
  • MT AI Engine
    confirmed malware
Runtime behaviour

What this file did when executed

This file was detonated in 1 sandbox and its runtime behaviour was observed.

MITRE ATT&CK
14

Adversary techniques mapped to the MITRE ATT&CK framework.

T1003T1053T1059T1064T1070T1070.004T1071T1082T1222T1518.001T1543.002T1562.001T1564.001T1573
Spawned processes
15
$(unnamed)
xterm -hold -e /bin/bash /tmp/8774d7a86354a5abc7fdd822d2b5114a06479e6466a7ac05eee0f2326.sh
$(unnamed)
/bin/bash /tmp/8774d7a86354a5abc7fdd822d2b5114a06479e6466a7ac05eee0f2326.sh
$(unnamed)
(fork)
$(unnamed)
which node
$(unnamed)
dirname /usr/bin/node
$(unnamed)
dirname /usr/bin
$(unnamed)
dirname /usr
$(unnamed)
head -n 1
+7 more processes captured.
Network activity
24
IP addresses20
  • 185.125.188.60
  • 185.125.188.57
  • 8.8.8.8
  • 23.56.109.73
  • 172.64.149.23
  • 255.255.255.255
  • 67.195.228.56
  • 23.66.134.21
  • 17.253.26.115
  • 17.57.144.100
+10 more
URLs4
  • http://ocsp.usertrust.com/MFYwVKADAgEAME0wSzBJMAkGBSsOAwIaBQAEFM0w0kw0OoKrHwVwFYrXoQd2KZLpBBRTeb9aqitKz1SA4dibwJ3ysgNmywIQXfq7lXfPq2cfx93%2B0c8gWw%3D%3D
  • http://ocsp.comodoca.com/MFcwVaADAgEAME4wTDBKMAkGBSsOAwIaBQAEFOsl2JD%2BJyD0HX1qwV7vds9iz6t4BBR1cacZSBm8nZ3qQUfflMRId5nTeQIRAJjBcnaqg2kI3NxbTvi9QXQ%3D
  • http://ocsp.usertrust.com/MFYwVKADAgEAME0wSzBJMAkGBSsOAwIaBQAEFM0w0kw0OoKrHwVwFYrXoQd2KZLpBBRTeb9aqitKz1SA4dibwJ3ysgNmywIQXfq7lXfPq2cfx93+0c8gWw==
  • http://ocsp.comodoca.com/MFcwVaADAgEAME4wTDBKMAkGBSsOAwIaBQAEFOsl2JD+JyD0HX1qwV7vds9iz6t4BBR1cacZSBm8nZ3qQUfflMRId5nTeQIRAJjBcnaqg2kI3NxbTvi9QXQ=
Filesystem & mutexes
24
Files written9
  • /dev/tty
  • /dev/ptmx
  • /dev/pts/0
  • /dev/null
  • /tmp/clean_crontab
+4 more
Files deleted15
  • /dev/shm/mono.3413
  • /var/tmp/systemd-private-d58a0b2a23db424e987061a5375cc99f-ModemManager.service-vzCuxi
  • /var/tmp/systemd-private-d58a0b2a23db424e987061a5375cc99f-ModemManager.service-vzCuxi/tmp
  • /var/tmp/systemd-private-d58a0b2a23db424e987061a5375cc99f-colord.service-Cq8TVe
  • /var/tmp/systemd-private-d58a0b2a23db424e987061a5375cc99f-colord.service-Cq8TVe/tmp
+10 more
Dropped payload

Files this sample writes at runtime

This file drops 10 children at runtime. None are currently flagged malicious in our cache.

10 unseen
  • e3ff960a5627d01eb1cb…a5877fNever scanned
    never seen before
  • c89e326841c3aa0350ad…186616Never scanned
    never seen before
  • 3494e2d3ce0fb77633d0…eb2c13Never scanned
    never seen before
  • 41cf8673477b94bdc8e5…a8500cNever scanned
    never seen before
  • ea254602baea8c46c988…2a4b65Never scanned
    never seen before
  • 9f2fdd4b4e7706dda74e…177c35Never scanned
    never seen before
  • 6b0e518bbf6f8726b29a…c4b405Never scanned
    never seen before
  • c7176676bc1be3474199…4928f7Never scanned
    never seen before
  • 12b36ff7068d3932f428…cd875fNever scanned
    never seen before
  • c2fdc653e1313b189fe1…e51955Never scanned
    never seen before
External threat intelligence

1 corroborating signal from researcher-curated sources

MalwareBazaar HIT·abuse.ch confirmed sampleView on MalwareBazaar
· sh· first seen 6/18/2026, 8:44:47 PM
sh
Cross-referenced against MalwareBazaar (abuse.ch), YARAify, and the CIRCL hashlookup reference DB.
Signature matches

YARA + heuristic rules that fired

One or more medium-severity heuristic rules matched. Not definitive, but the patterns match known malware behaviour.

2 synthesis
MITRE ATT&CK profile
Cred access× 1C2× 1
MalwareTips synthesis rules
Our heuristics on VT data + sandbox behaviour
  • CredentialDumper
    T1003T1003.001
    medium

    MITRE T1003 (OS Credential Dumping) mapped by at least one sandbox run.

  • DirectIpC2
    T1071
    medium

    Sample contacted 19 external IP address(es) and zero domains. Benign software virtually always uses DNS; no-DNS direct-IP C2 is a strong malware indicator because it bypasses reputation systems and dodges domain-based blocklists.

    Evidence
    185.125.188.60 · 185.125.188.57 · 8.8.8.8
Antivirus engine breakdown

17 detections across 75 engines

17 malicious0 suspicious58 clean
Tier-117 engines
6flag
Top commercial AVs (low FP rate)
Tier-238 engines
9flag
Mainstream engines with mixed FP rates
Low-trust20 engines
2flag
Heuristic / generic-AI engines (high FP rate)
alibabacloud
malicious
Trojan:Unknow/Multiverze.Gen
ALYac
malicious
Trojan.GenericKD.80581812
Arcabit
malicious
Trojan.Generic.D4CD94B4
BitDefender
malicious
Trojan.GenericKD.80581812
CTX
malicious
shell.trojan.multiverze
Emsisoft
malicious
Trojan.GenericKD.80581812 (B)
GData
malicious
Trojan.GenericKD.80581812
Google
malicious
Detected
Ikarus
malicious
Trojan.Script.Multiverze
Lionic
malicious
Trojan.UKP.Generic.4!c
McAfeeD
malicious
ti!7FE68248774D
Microsoft
malicious
Trojan:Script/Multiverze!rfn
MicroWorld-eScan
malicious
Trojan.GenericKD.80581812
Sophos
malicious
Linux/Dldr-XB
Varist
malicious
ABTrojan.XBYA-
VIPRE
malicious
Trojan.GenericKD.80581812
ZoneAlarm
malicious
Linux/Dldr-XB
Hash 7fe68248774d… cross-referenced against 75 AV engines via our AV network.
Prevalence

How often this file shows up in the wild

Barely seen in the wild and first surfaced recently. This is the footprint of targeted malware the AV industry hasn't signatured yet — extra scrutiny is warranted.

Rare & new
Unique uploaders
3
Very few people have ever uploaded this — rare.
Total submissions
3
Includes repeat uploads by the same source.
First seen by VT
6d ago
Jun 18, 2026
Prevalence quadrant
here
Rare · New
Targeted malware lives here
Common · New
Just-released software
Rare · Old
Niche or internal tooling
Common · Old
Trusted legitimate binaries
File identity

Forensic fingerprint

File biography
First seen (VT)
6/18/2026, 4:46:41 PM
First seen (MalwareBazaar)
6/18/2026, 8:44:47 PM
Last analysis (VT)
6/25/2026, 7:02:02 AM
Scanned here
6/25/2026, 7:04:46 AM
File name
clean
Size
1.1 KB
MIME type
(unknown)
Detected type
Shell script
SHA-256
7fe68248774d7a86354a5abc7fdd822d2b5114a06479e6466a7ac05eee0f2326
MD5
9e50f2adbf3111e59ff08d0efa520840
SHA-1
483066f467c7b54844d041812cfa9866ae33f154
First seen (VT)
6/18/2026, 4:46:41 PM
Last analysis (VT)
6/25/2026, 7:02:02 AM
First scan (MalwareTips)
6/25/2026, 7:04:26 AM
Last scan (MalwareTips)
6/25/2026, 7:04:46 AM
Behavior tags
shellpersistencedetect-debug-environment
Community classification

Reviews & malware reports(0)

Tell the community what you saw. Tag the sample — Trojan, Adware, False Positive — and share what the file did on your system. Your report helps confirm or dispute the AV verdict.

Loading…
Loading reports…
Scanned by
harlan4096Staff
Scan another
Check a different file
URL instead?
Check if a link is safe
Files are processed in a streaming pass-through — MalwareTips never stores the binary on its servers. Only the scan result (hash, detections, verdict) is retained so the next person who scans the same file gets an instant answer. If you ran this file on your computer and are worried, scan your system with an up-to-date antivirus and change critical passwords from a different device.