MB-3de040df634251cd6244247d87d80ebeebf3018e220e6ee9618d070ca3eb3371
high
📛 Threat Title
Unknown: run.sh
Description
File type: sh. Size: 748 bytes. Reporter: BlinkzSec. First seen: 2026-05-14 17:00:11.
Indicators of Compromise (4)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
run.sh
VT: VT base fetch failed: ConnectTimeout: HTTPSConnectionPool(host='www.virustotal.com', port=443): Max retries exceeded with url: /api/v3/domains/run.sh (Caused by ConnectTimeoutError(<HTTPSConnection(host='www.virustotal.com', port=443) at 0x7f05088b2fd0>, 'Connection to www.virustotal.com timed out. (connect timeout=30)'))
UrlVoid 0 / 35
IOC database
- Type
- domain
- Value
run.sh- First seen
- Last seen
- Attached to this threat
- Appears in
- 3 threats
- Description
- Extracted from Threat MB-3de040df634251cd6244247d87d80ebeebf3018e220e6ee9618d070ca3eb3371
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: ConnectTimeout: HTTPSConnectionPool(host='www.virustotal.com', port=443): Max retries exceeded with url: /api/v3/domains/run.sh (Caused by ConnectTimeoutError(<HTTPSConnection(host='www.virustotal.com', port=443) at 0x7f05088b2fd0>, 'Connection to www.virustotal.com timed out. (connect timeout=30)'))
hash_sha256
3de040df634251cd6244247d87d80ebeebf3018e220e6ee9618d070ca3eb3371
1 feed
IOC database
- Type
- hash_sha256
- Value
3de040df634251cd6244247d87d80ebeebf3018e220e6ee9618d070ca3eb3371- First seen
- Last seen
- Attached to this threat
- Appears in
- 2 threats
- Description
- Unknown
Threat Hunt — feed corroboration
Listed by 1 threat-intel feed vendor: Abuse.ch. Open in Threat Hunt →
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_sha1
ea7a1433c6930570d6c9ddd830ce2720775ebfb9
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/files/ea7a1433c6930570d6c9ddd830ce2720775ebfb9
1 feed
IOC database
- Type
- hash_sha1
- Value
ea7a1433c6930570d6c9ddd830ce2720775ebfb9- First seen
- Last seen
- Attached to this threat
- Appears in
- 2 threats
Threat Hunt — feed corroboration
Listed by 1 threat-intel feed vendor: Abuse.ch. Open in Threat Hunt →
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/files/ea7a1433c6930570d6c9ddd830ce2720775ebfb9
hash_md5
587d0ad299fbdd43ff8808080f41a73e
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/files/587d0ad299fbdd43ff8808080f41a73e
2 feeds
IOC database
- Type
- hash_md5
- Value
587d0ad299fbdd43ff8808080f41a73e- First seen
- Last seen
- Attached to this threat
- Appears in
- 2 threats
Threat Hunt — feed corroboration
Listed by 2 threat-intel feed vendors: Abuse.ch, threatview.io. Open in Threat Hunt →
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/files/587d0ad299fbdd43ff8808080f41a73e
References (1)
-
MalwareBazaar sample page
Abuse.ch
File type: sh. Size: 748 bytes. Reporter: BlinkzSec. First seen: 2026-05-14 17:00:11.
Remediations (10)
-
web:github.com
Ready-to-use Microsoft Intune Endpoint Analytics Proactive Remediation detection and remediation scripts. - JayRHa/EndpointAnalyticsRemediationScripts
-
web:learn.microsoft.com
The run remediation action in Microsoft Intune allows IT administrators to proactively detect and resolve support issues on managed devices. This action triggers a remediation script that checks for specific conditions and applies a fix if needed—without requiring user interaction. Use this action to address common problems such as configuration drift, missing settings, or compliance gaps ...
-
web:learn.microsoft.com
Learn more about Remediations in Microsoft Intune, including what Remediations are and view any prerequisites and licensing requirements. Also, learn how to deploy built-in and custom remediation scripts, and learn how to monitor your scripts.
-
web:mobile-jon.com
The post discusses the author's experience with Intune Remediations , highlighting the importance of well-crafted remediation scripts and thorough logging. Key topics include proper script writing, local log reviews, and log monitoring within the Intune Console. The author emphasizes an iterative testing approach to enhance script efficacy and reduce troubleshooting efforts.
-
web:scloud.work
When a proactive remediation script fails to work as expected, it's much faster to test it locally than wait for the next sync from Intune. In this post, I'll show you how I troubleshoot Intune remediation scripts directly on a Windows device. This includes script locations, relevant logs, and registry entries that help verify what […]
-
web:stackoverflow.com
Failed remediation script in Intune while "run script 64-bit PowerShell" option is turned on Ask Question Asked 1 year, 10 months ago Modified 1 year, 10 months ago
-
web:sysmansquad.com
What is Proactive Remediation ? Proactive remediations are a pair of scripts used to detect and remediate a problem on a machine. The first script runs a query on your endpoints that returns an exit code of success or failure. We call this first script the detection script. On a successful exit code it is reported as "Without issue" in the Intune portal and nothing else is executed. On a ...
-
web:www.reddit.com
Right now, you're flagging errors and needs remediation the same way, so you have no idea which machines are non compliant due to failures vs which ones are actually non compliant based on your criteria. Should report back the failure to the PR logs.
-
web:www.systanddeploy.com
In this post I will show you how to run Remediation script on demand on a specific device using PowerShell and MS Graph.
-
web:www.systemcenterdudes.com
In this post, we will describe how to use Intune Remediation script with an example to uninstall an application based on detection script.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.