MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 055dda2c016ea4f08850208cd67103f602cbd627d6574f6ee669af07b1b2f6c0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 055dda2c016ea4f08850208cd67103f602cbd627d6574f6ee669af07b1b2f6c0
SHA3-384 hash: 28572ebd27bb508c6b2a8099d4c9e9f31dfbbf5a4a5bf4ecdcb8b4bc9f48d2a43aa90b074bb3a428879992ef604a6919
SHA1 hash: 45be9d3edc35c2130023e389da3bd1ab587ce731
MD5 hash: 3642e43fd382d8aaadb0831972b44c93
humanhash: muppet-chicken-neptune-batman
File name:dick.sh
Download: download sample
File size:2'007 bytes
First seen:2026-02-13 20:11:25 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 48:vbUyanbUpbUNbUJbUhbUgKbUVbUtbUTlbUAR9R4RFBrbUtbUZbUC:vQyanQpQNQJQhQgKQVQtQJQA/C/BrQty
TLSH T1064160E615914A342CDD985FB3BA940430D4E0965BC95F8F1ADC3CE80D8EDC5B8C9BD6
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh

Intelligence

File Origin
# of uploads :
1
# of downloads :
39
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive medusa mirai obfuscated
Link:
https://www.filescan.io/uploads/698f8578981ff1d38a5543d9/reports/ff508e63-c676-4779-97e4-8481d92a9cac/overview
Result
Gathering data
Verdict:
Malicious
File Type:
unix shell
Detections:
HEUR:Trojan-Downloader.Shell.Agent.p HEUR:Trojan-Downloader.Shell.Agent.a
Link:
https://opentip.kaspersky.com/055dda2c016ea4f08850208cd67103f602cbd627d6574f6ee669af07b1b2f6c0/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/35b479fd-ea7a-4027-a392-8e783de4f181
Behavior Graph:
Download SVG
%3 guuid=7a45eca7-1a00-0000-c10d-40840e0b0000 pid=2830 /usr/bin/sudo guuid=1b1940ab-1a00-0000-c10d-4084120b0000 pid=2834 /tmp/sample.bin guuid=7a45eca7-1a00-0000-c10d-40840e0b0000 pid=2830->guuid=1b1940ab-1a00-0000-c10d-4084120b0000 pid=2834 execve guuid=3dd4e6ab-1a00-0000-c10d-4084150b0000 pid=2837 /usr/bin/wget net send-data write-file guuid=1b1940ab-1a00-0000-c10d-4084120b0000 pid=2834->guuid=3dd4e6ab-1a00-0000-c10d-4084150b0000 pid=2837 execve guuid=14ab3fbb-1a00-0000-c10d-4084370b0000 pid=2871 /usr/bin/chmod guuid=1b1940ab-1a00-0000-c10d-4084120b0000 pid=2834->guuid=14ab3fbb-1a00-0000-c10d-4084370b0000 pid=2871 execve guuid=2e5dc0bb-1a00-0000-c10d-4084390b0000 pid=2873 /usr/bin/bash guuid=1b1940ab-1a00-0000-c10d-4084120b0000 pid=2834->guuid=2e5dc0bb-1a00-0000-c10d-4084390b0000 pid=2873 clone guuid=067e0ec2-1a00-0000-c10d-40844c0b0000 pid=2892 /usr/bin/rm delete-file guuid=1b1940ab-1a00-0000-c10d-4084120b0000 pid=2834->guuid=067e0ec2-1a00-0000-c10d-40844c0b0000 pid=2892 execve guuid=f9beabc2-1a00-0000-c10d-40844e0b0000 pid=2894 /usr/bin/wget net send-data write-file guuid=1b1940ab-1a00-0000-c10d-4084120b0000 pid=2834->guuid=f9beabc2-1a00-0000-c10d-40844e0b0000 pid=2894 execve guuid=29c42fd0-1a00-0000-c10d-40846d0b0000 pid=2925 /usr/bin/chmod guuid=1b1940ab-1a00-0000-c10d-4084120b0000 pid=2834->guuid=29c42fd0-1a00-0000-c10d-40846d0b0000 pid=2925 execve guuid=499f7bd0-1a00-0000-c10d-40846e0b0000 pid=2926 /usr/bin/bash guuid=1b1940ab-1a00-0000-c10d-4084120b0000 pid=2834->guuid=499f7bd0-1a00-0000-c10d-40846e0b0000 pid=2926 clone guuid=b7839dd1-1a00-0000-c10d-4084700b0000 pid=2928 /usr/bin/rm delete-file guuid=1b1940ab-1a00-0000-c10d-4084120b0000 pid=2834->guuid=b7839dd1-1a00-0000-c10d-4084700b0000 pid=2928 execve guuid=3b060ed2-1a00-0000-c10d-4084710b0000 pid=2929 /usr/bin/wget net send-data write-file guuid=1b1940ab-1a00-0000-c10d-4084120b0000 pid=2834->guuid=3b060ed2-1a00-0000-c10d-4084710b0000 pid=2929 execve guuid=bd1a4ade-1a00-0000-c10d-40847e0b0000 pid=2942 /usr/bin/chmod guuid=1b1940ab-1a00-0000-c10d-4084120b0000 pid=2834->guuid=bd1a4ade-1a00-0000-c10d-40847e0b0000 pid=2942 execve guuid=90eaa4de-1a00-0000-c10d-40847f0b0000 pid=2943 /usr/bin/bash guuid=1b1940ab-1a00-0000-c10d-4084120b0000 pid=2834->guuid=90eaa4de-1a00-0000-c10d-40847f0b0000 pid=2943 clone guuid=f14b51df-1a00-0000-c10d-4084830b0000 pid=2947 /usr/bin/rm delete-file guuid=1b1940ab-1a00-0000-c10d-4084120b0000 pid=2834->guuid=f14b51df-1a00-0000-c10d-4084830b0000 pid=2947 execve guuid=a53ca4df-1a00-0000-c10d-4084840b0000 pid=2948 /usr/bin/wget net send-data write-file guuid=1b1940ab-1a00-0000-c10d-4084120b0000 pid=2834->guuid=a53ca4df-1a00-0000-c10d-4084840b0000 pid=2948 execve guuid=ca1ee4e9-1a00-0000-c10d-4084970b0000 pid=2967 /usr/bin/chmod guuid=1b1940ab-1a00-0000-c10d-4084120b0000 pid=2834->guuid=ca1ee4e9-1a00-0000-c10d-4084970b0000 pid=2967 execve guuid=86f53aea-1a00-0000-c10d-4084990b0000 pid=2969 /tmp/x-8.6-.dick guuid=1b1940ab-1a00-0000-c10d-4084120b0000 pid=2834->guuid=86f53aea-1a00-0000-c10d-4084990b0000 pid=2969 execve guuid=0cd35fea-1a00-0000-c10d-40849b0b0000 pid=2971 /usr/bin/rm delete-file guuid=1b1940ab-1a00-0000-c10d-4084120b0000 pid=2834->guuid=0cd35fea-1a00-0000-c10d-40849b0b0000 pid=2971 execve guuid=bfbac9ea-1a00-0000-c10d-40849c0b0000 pid=2972 /usr/bin/wget net send-data write-file guuid=1b1940ab-1a00-0000-c10d-4084120b0000 pid=2834->guuid=bfbac9ea-1a00-0000-c10d-40849c0b0000 pid=2972 execve guuid=21b394f6-1a00-0000-c10d-4084b40b0000 pid=2996 /usr/bin/chmod guuid=1b1940ab-1a00-0000-c10d-4084120b0000 pid=2834->guuid=21b394f6-1a00-0000-c10d-4084b40b0000 pid=2996 execve guuid=5303dbf6-1a00-0000-c10d-4084b60b0000 pid=2998 /usr/bin/bash guuid=1b1940ab-1a00-0000-c10d-4084120b0000 pid=2834->guuid=5303dbf6-1a00-0000-c10d-4084b60b0000 pid=2998 clone guuid=0375c5f7-1a00-0000-c10d-4084ba0b0000 pid=3002 /usr/bin/rm delete-file guuid=1b1940ab-1a00-0000-c10d-4084120b0000 pid=2834->guuid=0375c5f7-1a00-0000-c10d-4084ba0b0000 pid=3002 execve guuid=fb9e23f8-1a00-0000-c10d-4084bb0b0000 pid=3003 /usr/bin/wget net send-data write-file guuid=1b1940ab-1a00-0000-c10d-4084120b0000 pid=2834->guuid=fb9e23f8-1a00-0000-c10d-4084bb0b0000 pid=3003 execve guuid=5df9d103-1b00-0000-c10d-4084d20b0000 pid=3026 /usr/bin/chmod guuid=1b1940ab-1a00-0000-c10d-4084120b0000 pid=2834->guuid=5df9d103-1b00-0000-c10d-4084d20b0000 pid=3026 execve guuid=06f14204-1b00-0000-c10d-4084d40b0000 pid=3028 /tmp/x-3.2-.dick guuid=1b1940ab-1a00-0000-c10d-4084120b0000 pid=2834->guuid=06f14204-1b00-0000-c10d-4084d40b0000 pid=3028 execve guuid=f1a18304-1b00-0000-c10d-4084d70b0000 pid=3031 /usr/bin/rm delete-file guuid=1b1940ab-1a00-0000-c10d-4084120b0000 pid=2834->guuid=f1a18304-1b00-0000-c10d-4084d70b0000 pid=3031 execve guuid=dc7beb04-1b00-0000-c10d-4084d90b0000 pid=3033 /usr/bin/wget net send-data write-file guuid=1b1940ab-1a00-0000-c10d-4084120b0000 pid=2834->guuid=dc7beb04-1b00-0000-c10d-4084d90b0000 pid=3033 execve guuid=98c80d11-1b00-0000-c10d-4084f50b0000 pid=3061 /usr/bin/chmod guuid=1b1940ab-1a00-0000-c10d-4084120b0000 pid=2834->guuid=98c80d11-1b00-0000-c10d-4084f50b0000 pid=3061 execve guuid=335d4b11-1b00-0000-c10d-4084f70b0000 pid=3063 /usr/bin/bash guuid=1b1940ab-1a00-0000-c10d-4084120b0000 pid=2834->guuid=335d4b11-1b00-0000-c10d-4084f70b0000 pid=3063 clone guuid=4008df11-1b00-0000-c10d-4084fb0b0000 pid=3067 /usr/bin/rm delete-file guuid=1b1940ab-1a00-0000-c10d-4084120b0000 pid=2834->guuid=4008df11-1b00-0000-c10d-4084fb0b0000 pid=3067 execve guuid=5bc83312-1b00-0000-c10d-4084fd0b0000 pid=3069 /usr/bin/wget net send-data write-file guuid=1b1940ab-1a00-0000-c10d-4084120b0000 pid=2834->guuid=5bc83312-1b00-0000-c10d-4084fd0b0000 pid=3069 execve guuid=8ec0a31c-1b00-0000-c10d-4084190c0000 pid=3097 /usr/bin/chmod guuid=1b1940ab-1a00-0000-c10d-4084120b0000 pid=2834->guuid=8ec0a31c-1b00-0000-c10d-4084190c0000 pid=3097 execve guuid=6c4cee1c-1b00-0000-c10d-40841b0c0000 pid=3099 /usr/bin/bash guuid=1b1940ab-1a00-0000-c10d-4084120b0000 pid=2834->guuid=6c4cee1c-1b00-0000-c10d-40841b0c0000 pid=3099 clone guuid=48d48e1d-1b00-0000-c10d-40841f0c0000 pid=3103 /usr/bin/rm delete-file guuid=1b1940ab-1a00-0000-c10d-4084120b0000 pid=2834->guuid=48d48e1d-1b00-0000-c10d-40841f0c0000 pid=3103 execve guuid=a024031e-1b00-0000-c10d-4084210c0000 pid=3105 /usr/bin/wget net send-data write-file guuid=1b1940ab-1a00-0000-c10d-4084120b0000 pid=2834->guuid=a024031e-1b00-0000-c10d-4084210c0000 pid=3105 execve guuid=e5529929-1b00-0000-c10d-4084420c0000 pid=3138 /usr/bin/chmod guuid=1b1940ab-1a00-0000-c10d-4084120b0000 pid=2834->guuid=e5529929-1b00-0000-c10d-4084420c0000 pid=3138 execve guuid=ed2fd729-1b00-0000-c10d-4084440c0000 pid=3140 /usr/bin/bash guuid=1b1940ab-1a00-0000-c10d-4084120b0000 pid=2834->guuid=ed2fd729-1b00-0000-c10d-4084440c0000 pid=3140 clone guuid=f97dd52a-1b00-0000-c10d-4084490c0000 pid=3145 /usr/bin/rm delete-file guuid=1b1940ab-1a00-0000-c10d-4084120b0000 pid=2834->guuid=f97dd52a-1b00-0000-c10d-4084490c0000 pid=3145 execve guuid=2a82202b-1b00-0000-c10d-40844b0c0000 pid=3147 /usr/bin/wget net send-data write-file guuid=1b1940ab-1a00-0000-c10d-4084120b0000 pid=2834->guuid=2a82202b-1b00-0000-c10d-40844b0c0000 pid=3147 execve guuid=b0455637-1b00-0000-c10d-40846a0c0000 pid=3178 /usr/bin/chmod guuid=1b1940ab-1a00-0000-c10d-4084120b0000 pid=2834->guuid=b0455637-1b00-0000-c10d-40846a0c0000 pid=3178 execve guuid=8ce1a437-1b00-0000-c10d-40846c0c0000 pid=3180 /usr/bin/bash guuid=1b1940ab-1a00-0000-c10d-4084120b0000 pid=2834->guuid=8ce1a437-1b00-0000-c10d-40846c0c0000 pid=3180 clone guuid=a4803638-1b00-0000-c10d-4084700c0000 pid=3184 /usr/bin/rm delete-file guuid=1b1940ab-1a00-0000-c10d-4084120b0000 pid=2834->guuid=a4803638-1b00-0000-c10d-4084700c0000 pid=3184 execve guuid=dedbaf38-1b00-0000-c10d-4084710c0000 pid=3185 /usr/bin/wget net send-data write-file guuid=1b1940ab-1a00-0000-c10d-4084120b0000 pid=2834->guuid=dedbaf38-1b00-0000-c10d-4084710c0000 pid=3185 execve guuid=f274c744-1b00-0000-c10d-4084910c0000 pid=3217 /usr/bin/chmod guuid=1b1940ab-1a00-0000-c10d-4084120b0000 pid=2834->guuid=f274c744-1b00-0000-c10d-4084910c0000 pid=3217 execve guuid=b89e2a45-1b00-0000-c10d-4084920c0000 pid=3218 /usr/bin/bash guuid=1b1940ab-1a00-0000-c10d-4084120b0000 pid=2834->guuid=b89e2a45-1b00-0000-c10d-4084920c0000 pid=3218 clone guuid=ff4fd845-1b00-0000-c10d-4084950c0000 pid=3221 /usr/bin/rm delete-file guuid=1b1940ab-1a00-0000-c10d-4084120b0000 pid=2834->guuid=ff4fd845-1b00-0000-c10d-4084950c0000 pid=3221 execve guuid=36435b46-1b00-0000-c10d-4084960c0000 pid=3222 /usr/bin/wget net send-data write-file guuid=1b1940ab-1a00-0000-c10d-4084120b0000 pid=2834->guuid=36435b46-1b00-0000-c10d-4084960c0000 pid=3222 execve guuid=d0f7db50-1b00-0000-c10d-4084aa0c0000 pid=3242 /usr/bin/chmod guuid=1b1940ab-1a00-0000-c10d-4084120b0000 pid=2834->guuid=d0f7db50-1b00-0000-c10d-4084aa0c0000 pid=3242 execve guuid=50ca7251-1b00-0000-c10d-4084ac0c0000 pid=3244 /usr/bin/bash guuid=1b1940ab-1a00-0000-c10d-4084120b0000 pid=2834->guuid=50ca7251-1b00-0000-c10d-4084ac0c0000 pid=3244 clone guuid=71814752-1b00-0000-c10d-4084ae0c0000 pid=3246 /usr/bin/rm delete-file guuid=1b1940ab-1a00-0000-c10d-4084120b0000 pid=2834->guuid=71814752-1b00-0000-c10d-4084ae0c0000 pid=3246 execve guuid=d78be352-1b00-0000-c10d-4084af0c0000 pid=3247 /usr/bin/wget net send-data write-file guuid=1b1940ab-1a00-0000-c10d-4084120b0000 pid=2834->guuid=d78be352-1b00-0000-c10d-4084af0c0000 pid=3247 execve guuid=deb3b65f-1b00-0000-c10d-4084b00c0000 pid=3248 /usr/bin/chmod guuid=1b1940ab-1a00-0000-c10d-4084120b0000 pid=2834->guuid=deb3b65f-1b00-0000-c10d-4084b00c0000 pid=3248 execve guuid=02431860-1b00-0000-c10d-4084b10c0000 pid=3249 /usr/bin/bash guuid=1b1940ab-1a00-0000-c10d-4084120b0000 pid=2834->guuid=02431860-1b00-0000-c10d-4084b10c0000 pid=3249 clone guuid=7a480161-1b00-0000-c10d-4084b30c0000 pid=3251 /usr/bin/rm delete-file guuid=1b1940ab-1a00-0000-c10d-4084120b0000 pid=2834->guuid=7a480161-1b00-0000-c10d-4084b30c0000 pid=3251 execve 0432ed36-8c5c-5b1d-ba98-bfcebe69a61b 16.171.140.194:80 guuid=3dd4e6ab-1a00-0000-c10d-4084150b0000 pid=2837->0432ed36-8c5c-5b1d-ba98-bfcebe69a61b send: 141B guuid=f9beabc2-1a00-0000-c10d-40844e0b0000 pid=2894->0432ed36-8c5c-5b1d-ba98-bfcebe69a61b send: 141B guuid=3b060ed2-1a00-0000-c10d-4084710b0000 pid=2929->0432ed36-8c5c-5b1d-ba98-bfcebe69a61b send: 140B guuid=a53ca4df-1a00-0000-c10d-4084840b0000 pid=2948->0432ed36-8c5c-5b1d-ba98-bfcebe69a61b send: 140B guuid=8f2e51ea-1a00-0000-c10d-40849a0b0000 pid=2970 /tmp/x-8.6-.dick net send-data zombie guuid=86f53aea-1a00-0000-c10d-4084990b0000 pid=2969->guuid=8f2e51ea-1a00-0000-c10d-40849a0b0000 pid=2970 clone e505aa03-71d8-5663-a790-c888f99fadba 16.171.140.194:4912 guuid=8f2e51ea-1a00-0000-c10d-40849a0b0000 pid=2970->e505aa03-71d8-5663-a790-c888f99fadba send: 252B 8b0a01dc-0728-52c1-8024-c4ba7801b8d6 8.8.8.8:53 guuid=8f2e51ea-1a00-0000-c10d-40849a0b0000 pid=2970->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 send: 1512B guuid=bfbac9ea-1a00-0000-c10d-40849c0b0000 pid=2972->0432ed36-8c5c-5b1d-ba98-bfcebe69a61b send: 141B guuid=fb9e23f8-1a00-0000-c10d-4084bb0b0000 pid=3003->0432ed36-8c5c-5b1d-ba98-bfcebe69a61b send: 140B guuid=7e6a7804-1b00-0000-c10d-4084d60b0000 pid=3030 /tmp/x-3.2-.dick net send-data zombie guuid=06f14204-1b00-0000-c10d-4084d40b0000 pid=3028->guuid=7e6a7804-1b00-0000-c10d-4084d60b0000 pid=3030 clone guuid=7e6a7804-1b00-0000-c10d-4084d60b0000 pid=3030->e505aa03-71d8-5663-a790-c888f99fadba send: 198B guuid=7e6a7804-1b00-0000-c10d-4084d60b0000 pid=3030->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 send: 1188B guuid=dc7beb04-1b00-0000-c10d-4084d90b0000 pid=3033->0432ed36-8c5c-5b1d-ba98-bfcebe69a61b send: 141B guuid=5bc83312-1b00-0000-c10d-4084fd0b0000 pid=3069->0432ed36-8c5c-5b1d-ba98-bfcebe69a61b send: 140B guuid=a024031e-1b00-0000-c10d-4084210c0000 pid=3105->0432ed36-8c5c-5b1d-ba98-bfcebe69a61b send: 141B guuid=2a82202b-1b00-0000-c10d-40844b0c0000 pid=3147->0432ed36-8c5c-5b1d-ba98-bfcebe69a61b send: 141B guuid=dedbaf38-1b00-0000-c10d-4084710c0000 pid=3185->0432ed36-8c5c-5b1d-ba98-bfcebe69a61b send: 140B guuid=36435b46-1b00-0000-c10d-4084960c0000 pid=3222->0432ed36-8c5c-5b1d-ba98-bfcebe69a61b send: 141B guuid=d78be352-1b00-0000-c10d-4084af0c0000 pid=3247->0432ed36-8c5c-5b1d-ba98-bfcebe69a61b send: 141B
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/055dda2c016ea4f08850208cd67103f602cbd627d6574f6ee669af07b1b2f6c0
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/055dda2c016ea4f08850208cd67103f602cbd627d6574f6ee669af07b1b2f6c0/
Verdict:
Malicious
Threat:
Trojan-Downloader.Shell.Agent
Link:
https://tip.neiki.dev/file/055dda2c016ea4f08850208cd67103f602cbd627d6574f6ee669af07b1b2f6c0
Threat name:
Linux.Downloader.Morila
Create hunting rule
Status:
Malicious
First seen:
2026-02-13 20:12:24 UTC
File Type:
Text (Shell)
AV detection:
23 of 36 (63.89%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=avo5ulabn2spbccqecgnm4id6ybmxvrh2zlu63xgngxqpmns63aa._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
defense_evasion linux
Link:
https://tria.ge/reports/260213-yyn1caez3d/
Behaviour
Writes file to tmp directory
Changes its process name
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 055dda2c016ea4f08850208cd67103f602cbd627d6574f6ee669af07b1b2f6c0

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3777402/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3777406/

Comments