MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 07bc0e03a2e94c4ff9efd9700d543c3bc04141a6696f31c683ff54b65544e81b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 07bc0e03a2e94c4ff9efd9700d543c3bc04141a6696f31c683ff54b65544e81b
SHA3-384 hash: 4ac3ff8574f198b751fa7a1fc7170061d4ac9975be9d7d80d8f1dde9177ca96bb0080bd2179e85687bb03fdca296ffe6
SHA1 hash: 50b22df66a155618002aa19ec0f9a7c8f22a06c3
MD5 hash: ead521cd1a408b04c76f1a0380ad9a02
humanhash: zebra-triple-nebraska-london
File name:p
Download: download sample
File size:835 bytes
First seen:2026-08-08 08:18:40 UTC
Last seen:2026-08-09 08:02:14 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkanCiu5FCl6AYjCUFMCiPjoCxauD:kXCKysE2hi0ziQvZohan7gFV/j29P0W7
TLSH T15601C2D64200AA50801DEA2E22AB51D0B451C3CF154B0BA87FDC4D3DFBDC924B066F48
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://129.121.114.124/5S4n/an/aua-wget
http://129.121.114.124/xzOQn/an/aua-wget
http://129.121.114.124/TXAn/an/aua-wget
http://129.121.114.124/Mxxn/an/aua-wget
http://129.121.114.124/Hxqhn/an/aua-wget

Intelligence

File Origin
# of uploads :
2
# of downloads :
54
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive mirai
Link:
https://www.filescan.io/uploads/6a76e68c4ce87a86708ee161/reports/2b1c276d-d23b-4ba0-b5b4-b3e780ecb612/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-08-08T06:22:00Z UTC
Last seen:
2026-08-10T03:37:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/07bc0e03a2e94c4ff9efd9700d543c3bc04141a6696f31c683ff54b65544e81b/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/86642ff0-14d4-4a83-9fbc-7eeb70213757
Behavior Graph:
Download SVG
%3 guuid=f33c8ec6-1800-0000-c1fb-49bdb40b0000 pid=2996 /usr/bin/sudo guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007 /tmp/sample.bin write-file guuid=f33c8ec6-1800-0000-c1fb-49bdb40b0000 pid=2996->guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007 execve guuid=374920cd-1800-0000-c1fb-49bdc50b0000 pid=3013 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=374920cd-1800-0000-c1fb-49bdc50b0000 pid=3013 execve guuid=f479f4cd-1800-0000-c1fb-49bdc70b0000 pid=3015 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=f479f4cd-1800-0000-c1fb-49bdc70b0000 pid=3015 execve guuid=01ec96ce-1800-0000-c1fb-49bdc90b0000 pid=3017 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=01ec96ce-1800-0000-c1fb-49bdc90b0000 pid=3017 execve guuid=e34e2ecf-1800-0000-c1fb-49bdcc0b0000 pid=3020 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=e34e2ecf-1800-0000-c1fb-49bdcc0b0000 pid=3020 execve guuid=6a9dd1cf-1800-0000-c1fb-49bdce0b0000 pid=3022 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=6a9dd1cf-1800-0000-c1fb-49bdce0b0000 pid=3022 execve guuid=0ac34fd0-1800-0000-c1fb-49bdd00b0000 pid=3024 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=0ac34fd0-1800-0000-c1fb-49bdd00b0000 pid=3024 execve guuid=4d69a8d0-1800-0000-c1fb-49bdd10b0000 pid=3025 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=4d69a8d0-1800-0000-c1fb-49bdd10b0000 pid=3025 execve guuid=6fd600d1-1800-0000-c1fb-49bdd30b0000 pid=3027 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=6fd600d1-1800-0000-c1fb-49bdd30b0000 pid=3027 execve guuid=e09a56d1-1800-0000-c1fb-49bdd50b0000 pid=3029 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=e09a56d1-1800-0000-c1fb-49bdd50b0000 pid=3029 execve guuid=0c1dafd1-1800-0000-c1fb-49bdd60b0000 pid=3030 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=0c1dafd1-1800-0000-c1fb-49bdd60b0000 pid=3030 execve guuid=fdc204d2-1800-0000-c1fb-49bdd80b0000 pid=3032 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=fdc204d2-1800-0000-c1fb-49bdd80b0000 pid=3032 execve guuid=a3eb67d2-1800-0000-c1fb-49bdda0b0000 pid=3034 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=a3eb67d2-1800-0000-c1fb-49bdda0b0000 pid=3034 execve guuid=4747c3d2-1800-0000-c1fb-49bddb0b0000 pid=3035 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=4747c3d2-1800-0000-c1fb-49bddb0b0000 pid=3035 execve guuid=421f21d3-1800-0000-c1fb-49bddd0b0000 pid=3037 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=421f21d3-1800-0000-c1fb-49bddd0b0000 pid=3037 execve guuid=29d373d3-1800-0000-c1fb-49bde10b0000 pid=3041 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=29d373d3-1800-0000-c1fb-49bde10b0000 pid=3041 execve guuid=434ad1d3-1800-0000-c1fb-49bde20b0000 pid=3042 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=434ad1d3-1800-0000-c1fb-49bde20b0000 pid=3042 execve guuid=d08a2ad4-1800-0000-c1fb-49bde30b0000 pid=3043 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=d08a2ad4-1800-0000-c1fb-49bde30b0000 pid=3043 execve guuid=2cbc9ad4-1800-0000-c1fb-49bde40b0000 pid=3044 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=2cbc9ad4-1800-0000-c1fb-49bde40b0000 pid=3044 execve guuid=fae701d5-1800-0000-c1fb-49bde50b0000 pid=3045 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=fae701d5-1800-0000-c1fb-49bde50b0000 pid=3045 execve guuid=2381f6d5-1800-0000-c1fb-49bde90b0000 pid=3049 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=2381f6d5-1800-0000-c1fb-49bde90b0000 pid=3049 execve guuid=d4ee69d6-1800-0000-c1fb-49bdec0b0000 pid=3052 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=d4ee69d6-1800-0000-c1fb-49bdec0b0000 pid=3052 execve guuid=4d50c8d6-1800-0000-c1fb-49bdef0b0000 pid=3055 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=4d50c8d6-1800-0000-c1fb-49bdef0b0000 pid=3055 execve guuid=22fb31d7-1800-0000-c1fb-49bdf10b0000 pid=3057 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=22fb31d7-1800-0000-c1fb-49bdf10b0000 pid=3057 execve guuid=d8e7b7d7-1800-0000-c1fb-49bdf40b0000 pid=3060 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=d8e7b7d7-1800-0000-c1fb-49bdf40b0000 pid=3060 execve guuid=d0d074d8-1800-0000-c1fb-49bdf50b0000 pid=3061 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=d0d074d8-1800-0000-c1fb-49bdf50b0000 pid=3061 execve guuid=9e893fd9-1800-0000-c1fb-49bdf70b0000 pid=3063 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=9e893fd9-1800-0000-c1fb-49bdf70b0000 pid=3063 execve guuid=ebf803da-1800-0000-c1fb-49bdf80b0000 pid=3064 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=ebf803da-1800-0000-c1fb-49bdf80b0000 pid=3064 execve guuid=12eab6da-1800-0000-c1fb-49bdf90b0000 pid=3065 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=12eab6da-1800-0000-c1fb-49bdf90b0000 pid=3065 execve guuid=13d324db-1800-0000-c1fb-49bdfb0b0000 pid=3067 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=13d324db-1800-0000-c1fb-49bdfb0b0000 pid=3067 execve guuid=abb6b7db-1800-0000-c1fb-49bdfe0b0000 pid=3070 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=abb6b7db-1800-0000-c1fb-49bdfe0b0000 pid=3070 execve guuid=c16d72dc-1800-0000-c1fb-49bd020c0000 pid=3074 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=c16d72dc-1800-0000-c1fb-49bd020c0000 pid=3074 execve guuid=62cb3ddd-1800-0000-c1fb-49bd040c0000 pid=3076 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=62cb3ddd-1800-0000-c1fb-49bd040c0000 pid=3076 execve guuid=5cc369de-1800-0000-c1fb-49bd060c0000 pid=3078 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=5cc369de-1800-0000-c1fb-49bd060c0000 pid=3078 execve guuid=93dc3ddf-1800-0000-c1fb-49bd0b0c0000 pid=3083 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=93dc3ddf-1800-0000-c1fb-49bd0b0c0000 pid=3083 execve guuid=53e813e0-1800-0000-c1fb-49bd0e0c0000 pid=3086 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=53e813e0-1800-0000-c1fb-49bd0e0c0000 pid=3086 execve guuid=c86cece0-1800-0000-c1fb-49bd100c0000 pid=3088 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=c86cece0-1800-0000-c1fb-49bd100c0000 pid=3088 execve guuid=1b56d4e1-1800-0000-c1fb-49bd140c0000 pid=3092 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=1b56d4e1-1800-0000-c1fb-49bd140c0000 pid=3092 execve guuid=e5ecaae2-1800-0000-c1fb-49bd170c0000 pid=3095 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=e5ecaae2-1800-0000-c1fb-49bd170c0000 pid=3095 execve guuid=33cd73e3-1800-0000-c1fb-49bd180c0000 pid=3096 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=33cd73e3-1800-0000-c1fb-49bd180c0000 pid=3096 execve guuid=077ff9e3-1800-0000-c1fb-49bd190c0000 pid=3097 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=077ff9e3-1800-0000-c1fb-49bd190c0000 pid=3097 execve guuid=bfe27ee4-1800-0000-c1fb-49bd1a0c0000 pid=3098 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=bfe27ee4-1800-0000-c1fb-49bd1a0c0000 pid=3098 execve guuid=643412e5-1800-0000-c1fb-49bd1b0c0000 pid=3099 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=643412e5-1800-0000-c1fb-49bd1b0c0000 pid=3099 execve guuid=580dcbe5-1800-0000-c1fb-49bd1c0c0000 pid=3100 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=580dcbe5-1800-0000-c1fb-49bd1c0c0000 pid=3100 execve guuid=416fa7e6-1800-0000-c1fb-49bd1d0c0000 pid=3101 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=416fa7e6-1800-0000-c1fb-49bd1d0c0000 pid=3101 execve guuid=a8454fe7-1800-0000-c1fb-49bd1e0c0000 pid=3102 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=a8454fe7-1800-0000-c1fb-49bd1e0c0000 pid=3102 execve guuid=352800e8-1800-0000-c1fb-49bd1f0c0000 pid=3103 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=352800e8-1800-0000-c1fb-49bd1f0c0000 pid=3103 execve guuid=23f8c8e8-1800-0000-c1fb-49bd200c0000 pid=3104 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=23f8c8e8-1800-0000-c1fb-49bd200c0000 pid=3104 execve guuid=52d4aae9-1800-0000-c1fb-49bd210c0000 pid=3105 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=52d4aae9-1800-0000-c1fb-49bd210c0000 pid=3105 execve guuid=b4c080ea-1800-0000-c1fb-49bd220c0000 pid=3106 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=b4c080ea-1800-0000-c1fb-49bd220c0000 pid=3106 execve guuid=34d712eb-1800-0000-c1fb-49bd230c0000 pid=3107 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=34d712eb-1800-0000-c1fb-49bd230c0000 pid=3107 execve guuid=fb57a4eb-1800-0000-c1fb-49bd240c0000 pid=3108 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=fb57a4eb-1800-0000-c1fb-49bd240c0000 pid=3108 execve guuid=e7393eec-1800-0000-c1fb-49bd250c0000 pid=3109 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=e7393eec-1800-0000-c1fb-49bd250c0000 pid=3109 execve guuid=e27cf7ec-1800-0000-c1fb-49bd260c0000 pid=3110 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=e27cf7ec-1800-0000-c1fb-49bd260c0000 pid=3110 execve guuid=e930a5ed-1800-0000-c1fb-49bd270c0000 pid=3111 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=e930a5ed-1800-0000-c1fb-49bd270c0000 pid=3111 execve guuid=756134ee-1800-0000-c1fb-49bd280c0000 pid=3112 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=756134ee-1800-0000-c1fb-49bd280c0000 pid=3112 execve guuid=c21a1def-1800-0000-c1fb-49bd290c0000 pid=3113 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=c21a1def-1800-0000-c1fb-49bd290c0000 pid=3113 execve guuid=69daebef-1800-0000-c1fb-49bd2a0c0000 pid=3114 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=69daebef-1800-0000-c1fb-49bd2a0c0000 pid=3114 execve guuid=b64185f0-1800-0000-c1fb-49bd2b0c0000 pid=3115 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=b64185f0-1800-0000-c1fb-49bd2b0c0000 pid=3115 execve guuid=7bf120f1-1800-0000-c1fb-49bd2c0c0000 pid=3116 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=7bf120f1-1800-0000-c1fb-49bd2c0c0000 pid=3116 execve guuid=e334dbf1-1800-0000-c1fb-49bd2d0c0000 pid=3117 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=e334dbf1-1800-0000-c1fb-49bd2d0c0000 pid=3117 execve guuid=c31875f2-1800-0000-c1fb-49bd2e0c0000 pid=3118 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=c31875f2-1800-0000-c1fb-49bd2e0c0000 pid=3118 execve guuid=c8ee0bf3-1800-0000-c1fb-49bd2f0c0000 pid=3119 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=c8ee0bf3-1800-0000-c1fb-49bd2f0c0000 pid=3119 execve guuid=5a8a05f4-1800-0000-c1fb-49bd300c0000 pid=3120 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=5a8a05f4-1800-0000-c1fb-49bd300c0000 pid=3120 execve guuid=6adc32f5-1800-0000-c1fb-49bd320c0000 pid=3122 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=6adc32f5-1800-0000-c1fb-49bd320c0000 pid=3122 execve guuid=d74e2ef6-1800-0000-c1fb-49bd350c0000 pid=3125 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=d74e2ef6-1800-0000-c1fb-49bd350c0000 pid=3125 execve guuid=895014f7-1800-0000-c1fb-49bd380c0000 pid=3128 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=895014f7-1800-0000-c1fb-49bd380c0000 pid=3128 execve guuid=b4caeff7-1800-0000-c1fb-49bd3b0c0000 pid=3131 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=b4caeff7-1800-0000-c1fb-49bd3b0c0000 pid=3131 execve guuid=1ed7c3f8-1800-0000-c1fb-49bd3e0c0000 pid=3134 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=1ed7c3f8-1800-0000-c1fb-49bd3e0c0000 pid=3134 execve guuid=d0e8b4f9-1800-0000-c1fb-49bd400c0000 pid=3136 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=d0e8b4f9-1800-0000-c1fb-49bd400c0000 pid=3136 execve guuid=9f9f88fa-1800-0000-c1fb-49bd440c0000 pid=3140 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=9f9f88fa-1800-0000-c1fb-49bd440c0000 pid=3140 execve guuid=ca39eafa-1800-0000-c1fb-49bd470c0000 pid=3143 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=ca39eafa-1800-0000-c1fb-49bd470c0000 pid=3143 execve guuid=977841fb-1800-0000-c1fb-49bd490c0000 pid=3145 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=977841fb-1800-0000-c1fb-49bd490c0000 pid=3145 execve guuid=bfc6a8fb-1800-0000-c1fb-49bd4c0c0000 pid=3148 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=bfc6a8fb-1800-0000-c1fb-49bd4c0c0000 pid=3148 execve guuid=b28223fc-1800-0000-c1fb-49bd4e0c0000 pid=3150 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=b28223fc-1800-0000-c1fb-49bd4e0c0000 pid=3150 execve guuid=ec1399fc-1800-0000-c1fb-49bd500c0000 pid=3152 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=ec1399fc-1800-0000-c1fb-49bd500c0000 pid=3152 execve guuid=2b84f2fc-1800-0000-c1fb-49bd520c0000 pid=3154 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=2b84f2fc-1800-0000-c1fb-49bd520c0000 pid=3154 execve guuid=0dea5efd-1800-0000-c1fb-49bd550c0000 pid=3157 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=0dea5efd-1800-0000-c1fb-49bd550c0000 pid=3157 execve guuid=2410bffd-1800-0000-c1fb-49bd570c0000 pid=3159 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=2410bffd-1800-0000-c1fb-49bd570c0000 pid=3159 execve guuid=acd014fe-1800-0000-c1fb-49bd590c0000 pid=3161 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=acd014fe-1800-0000-c1fb-49bd590c0000 pid=3161 execve guuid=6c1a83fe-1800-0000-c1fb-49bd5a0c0000 pid=3162 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=6c1a83fe-1800-0000-c1fb-49bd5a0c0000 pid=3162 execve guuid=bad209ff-1800-0000-c1fb-49bd5b0c0000 pid=3163 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=bad209ff-1800-0000-c1fb-49bd5b0c0000 pid=3163 execve guuid=13fa7cff-1800-0000-c1fb-49bd5c0c0000 pid=3164 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=13fa7cff-1800-0000-c1fb-49bd5c0c0000 pid=3164 execve guuid=1fecf7ff-1800-0000-c1fb-49bd5e0c0000 pid=3166 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=1fecf7ff-1800-0000-c1fb-49bd5e0c0000 pid=3166 execve guuid=69d8ab00-1900-0000-c1fb-49bd5f0c0000 pid=3167 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=69d8ab00-1900-0000-c1fb-49bd5f0c0000 pid=3167 execve guuid=cc9b4901-1900-0000-c1fb-49bd610c0000 pid=3169 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=cc9b4901-1900-0000-c1fb-49bd610c0000 pid=3169 execve guuid=56d4bf01-1900-0000-c1fb-49bd640c0000 pid=3172 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=56d4bf01-1900-0000-c1fb-49bd640c0000 pid=3172 execve guuid=74362002-1900-0000-c1fb-49bd660c0000 pid=3174 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=74362002-1900-0000-c1fb-49bd660c0000 pid=3174 execve guuid=e26c7a02-1900-0000-c1fb-49bd680c0000 pid=3176 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=e26c7a02-1900-0000-c1fb-49bd680c0000 pid=3176 execve guuid=41eae102-1900-0000-c1fb-49bd6b0c0000 pid=3179 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=41eae102-1900-0000-c1fb-49bd6b0c0000 pid=3179 execve guuid=72864003-1900-0000-c1fb-49bd6d0c0000 pid=3181 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=72864003-1900-0000-c1fb-49bd6d0c0000 pid=3181 execve guuid=f9a89c03-1900-0000-c1fb-49bd700c0000 pid=3184 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=f9a89c03-1900-0000-c1fb-49bd700c0000 pid=3184 execve guuid=5298fb03-1900-0000-c1fb-49bd710c0000 pid=3185 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=5298fb03-1900-0000-c1fb-49bd710c0000 pid=3185 execve guuid=c13f8304-1900-0000-c1fb-49bd720c0000 pid=3186 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=c13f8304-1900-0000-c1fb-49bd720c0000 pid=3186 execve guuid=7a8c0405-1900-0000-c1fb-49bd730c0000 pid=3187 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=7a8c0405-1900-0000-c1fb-49bd730c0000 pid=3187 execve guuid=b2438805-1900-0000-c1fb-49bd740c0000 pid=3188 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=b2438805-1900-0000-c1fb-49bd740c0000 pid=3188 execve guuid=76c02d06-1900-0000-c1fb-49bd750c0000 pid=3189 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=76c02d06-1900-0000-c1fb-49bd750c0000 pid=3189 execve guuid=bb904d07-1900-0000-c1fb-49bd760c0000 pid=3190 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=bb904d07-1900-0000-c1fb-49bd760c0000 pid=3190 execve guuid=eee4e407-1900-0000-c1fb-49bd770c0000 pid=3191 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=eee4e407-1900-0000-c1fb-49bd770c0000 pid=3191 execve guuid=bcfab608-1900-0000-c1fb-49bd780c0000 pid=3192 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=bcfab608-1900-0000-c1fb-49bd780c0000 pid=3192 execve guuid=8e1b9f09-1900-0000-c1fb-49bd790c0000 pid=3193 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=8e1b9f09-1900-0000-c1fb-49bd790c0000 pid=3193 execve guuid=c0ea580a-1900-0000-c1fb-49bd7a0c0000 pid=3194 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=c0ea580a-1900-0000-c1fb-49bd7a0c0000 pid=3194 execve guuid=8e99ff0a-1900-0000-c1fb-49bd7b0c0000 pid=3195 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=8e99ff0a-1900-0000-c1fb-49bd7b0c0000 pid=3195 execve guuid=50dcf80b-1900-0000-c1fb-49bd7c0c0000 pid=3196 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=50dcf80b-1900-0000-c1fb-49bd7c0c0000 pid=3196 execve guuid=fbadf60c-1900-0000-c1fb-49bd7d0c0000 pid=3197 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=fbadf60c-1900-0000-c1fb-49bd7d0c0000 pid=3197 execve guuid=71fd6f0d-1900-0000-c1fb-49bd7e0c0000 pid=3198 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=71fd6f0d-1900-0000-c1fb-49bd7e0c0000 pid=3198 execve guuid=8464060e-1900-0000-c1fb-49bd7f0c0000 pid=3199 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=8464060e-1900-0000-c1fb-49bd7f0c0000 pid=3199 execve guuid=8681d70e-1900-0000-c1fb-49bd800c0000 pid=3200 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=8681d70e-1900-0000-c1fb-49bd800c0000 pid=3200 execve guuid=e3e8840f-1900-0000-c1fb-49bd810c0000 pid=3201 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=e3e8840f-1900-0000-c1fb-49bd810c0000 pid=3201 execve guuid=51aa0b10-1900-0000-c1fb-49bd820c0000 pid=3202 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=51aa0b10-1900-0000-c1fb-49bd820c0000 pid=3202 execve guuid=341d0511-1900-0000-c1fb-49bd830c0000 pid=3203 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=341d0511-1900-0000-c1fb-49bd830c0000 pid=3203 execve guuid=2121c611-1900-0000-c1fb-49bd840c0000 pid=3204 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=2121c611-1900-0000-c1fb-49bd840c0000 pid=3204 execve guuid=d31f6712-1900-0000-c1fb-49bd850c0000 pid=3205 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=d31f6712-1900-0000-c1fb-49bd850c0000 pid=3205 execve guuid=28cb6813-1900-0000-c1fb-49bd860c0000 pid=3206 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=28cb6813-1900-0000-c1fb-49bd860c0000 pid=3206 execve guuid=da3c5414-1900-0000-c1fb-49bd870c0000 pid=3207 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=da3c5414-1900-0000-c1fb-49bd870c0000 pid=3207 execve guuid=2e803515-1900-0000-c1fb-49bd880c0000 pid=3208 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=2e803515-1900-0000-c1fb-49bd880c0000 pid=3208 execve guuid=79432616-1900-0000-c1fb-49bd890c0000 pid=3209 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=79432616-1900-0000-c1fb-49bd890c0000 pid=3209 execve guuid=af820e17-1900-0000-c1fb-49bd8a0c0000 pid=3210 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=af820e17-1900-0000-c1fb-49bd8a0c0000 pid=3210 execve guuid=fc0aff17-1900-0000-c1fb-49bd8b0c0000 pid=3211 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=fc0aff17-1900-0000-c1fb-49bd8b0c0000 pid=3211 execve guuid=552c8e18-1900-0000-c1fb-49bd8c0c0000 pid=3212 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=552c8e18-1900-0000-c1fb-49bd8c0c0000 pid=3212 execve guuid=00a1ff18-1900-0000-c1fb-49bd8d0c0000 pid=3213 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=00a1ff18-1900-0000-c1fb-49bd8d0c0000 pid=3213 execve guuid=93c67f19-1900-0000-c1fb-49bd8e0c0000 pid=3214 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=93c67f19-1900-0000-c1fb-49bd8e0c0000 pid=3214 execve guuid=e0cdf819-1900-0000-c1fb-49bd8f0c0000 pid=3215 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=e0cdf819-1900-0000-c1fb-49bd8f0c0000 pid=3215 execve guuid=d596731a-1900-0000-c1fb-49bd900c0000 pid=3216 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=d596731a-1900-0000-c1fb-49bd900c0000 pid=3216 execve guuid=dbb6fa1a-1900-0000-c1fb-49bd920c0000 pid=3218 /usr/bin/ls guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=dbb6fa1a-1900-0000-c1fb-49bd920c0000 pid=3218 execve guuid=794a5a1b-1900-0000-c1fb-49bd950c0000 pid=3221 /usr/bin/rm guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=794a5a1b-1900-0000-c1fb-49bd950c0000 pid=3221 execve guuid=464fbe1b-1900-0000-c1fb-49bd970c0000 pid=3223 /usr/bin/wget net send-data write-file guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=464fbe1b-1900-0000-c1fb-49bd970c0000 pid=3223 execve guuid=5f44cd3c-1900-0000-c1fb-49bdbf0c0000 pid=3263 /usr/bin/chmod guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=5f44cd3c-1900-0000-c1fb-49bdbf0c0000 pid=3263 execve guuid=77011d3d-1900-0000-c1fb-49bdc00c0000 pid=3264 /usr/bin/dash guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=77011d3d-1900-0000-c1fb-49bdc00c0000 pid=3264 clone guuid=786bc13d-1900-0000-c1fb-49bdc20c0000 pid=3266 /usr/bin/rm guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=786bc13d-1900-0000-c1fb-49bdc20c0000 pid=3266 execve guuid=f6fc083e-1900-0000-c1fb-49bdc30c0000 pid=3267 /usr/bin/wget net send-data write-file guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=f6fc083e-1900-0000-c1fb-49bdc30c0000 pid=3267 execve guuid=89fd8558-1900-0000-c1fb-49bd0a0d0000 pid=3338 /usr/bin/chmod guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=89fd8558-1900-0000-c1fb-49bd0a0d0000 pid=3338 execve guuid=00f25159-1900-0000-c1fb-49bd0b0d0000 pid=3339 /usr/bin/dash guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=00f25159-1900-0000-c1fb-49bd0b0d0000 pid=3339 clone guuid=8db3005b-1900-0000-c1fb-49bd0d0d0000 pid=3341 /usr/bin/rm guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=8db3005b-1900-0000-c1fb-49bd0d0d0000 pid=3341 execve guuid=bb6bca5b-1900-0000-c1fb-49bd0e0d0000 pid=3342 /usr/bin/wget net send-data write-file guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=bb6bca5b-1900-0000-c1fb-49bd0e0d0000 pid=3342 execve guuid=442d3176-1900-0000-c1fb-49bd390d0000 pid=3385 /usr/bin/chmod guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=442d3176-1900-0000-c1fb-49bd390d0000 pid=3385 execve guuid=ee68c476-1900-0000-c1fb-49bd3b0d0000 pid=3387 /usr/bin/dash guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=ee68c476-1900-0000-c1fb-49bd3b0d0000 pid=3387 clone guuid=0936a877-1900-0000-c1fb-49bd3f0d0000 pid=3391 /usr/bin/rm guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=0936a877-1900-0000-c1fb-49bd3f0d0000 pid=3391 execve guuid=2c6efc77-1900-0000-c1fb-49bd400d0000 pid=3392 /usr/bin/wget net send-data write-file guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=2c6efc77-1900-0000-c1fb-49bd400d0000 pid=3392 execve guuid=d7d2eb94-1900-0000-c1fb-49bd830d0000 pid=3459 /usr/bin/chmod guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=d7d2eb94-1900-0000-c1fb-49bd830d0000 pid=3459 execve guuid=73b95195-1900-0000-c1fb-49bd860d0000 pid=3462 /usr/bin/dash guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=73b95195-1900-0000-c1fb-49bd860d0000 pid=3462 clone guuid=a1663296-1900-0000-c1fb-49bd8b0d0000 pid=3467 /usr/bin/rm guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=a1663296-1900-0000-c1fb-49bd8b0d0000 pid=3467 execve guuid=10609a96-1900-0000-c1fb-49bd8d0d0000 pid=3469 /usr/bin/wget net send-data write-file guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=10609a96-1900-0000-c1fb-49bd8d0d0000 pid=3469 execve guuid=bce1d1b3-1900-0000-c1fb-49bdbc0d0000 pid=3516 /usr/bin/chmod guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=bce1d1b3-1900-0000-c1fb-49bdbc0d0000 pid=3516 execve guuid=9d1310b4-1900-0000-c1fb-49bdbd0d0000 pid=3517 /usr/bin/dash guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=9d1310b4-1900-0000-c1fb-49bdbd0d0000 pid=3517 clone guuid=453491b4-1900-0000-c1fb-49bdbf0d0000 pid=3519 /usr/bin/rm delete-file guuid=05dac2ca-1800-0000-c1fb-49bdbf0b0000 pid=3007->guuid=453491b4-1900-0000-c1fb-49bdbf0d0000 pid=3519 execve 801186e6-5fe8-5959-a7b4-832d8d66e7aa 129.121.114.124:80 guuid=464fbe1b-1900-0000-c1fb-49bd970c0000 pid=3223->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 133B guuid=f6fc083e-1900-0000-c1fb-49bdc30c0000 pid=3267->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 134B guuid=bb6bca5b-1900-0000-c1fb-49bd0e0d0000 pid=3342->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 133B guuid=2c6efc77-1900-0000-c1fb-49bd400d0000 pid=3392->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 133B guuid=10609a96-1900-0000-c1fb-49bd8d0d0000 pid=3469->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 134B
Score:
98%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/07bc0e03a2e94c4ff9efd9700d543c3bc04141a6696f31c683ff54b65544e81b
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/07bc0e03a2e94c4ff9efd9700d543c3bc04141a6696f31c683ff54b65544e81b/
Threat name:
Document-HTML.Trojan.Bash
Create hunting rule
Status:
Malicious
First seen:
2026-08-08 08:19:28 UTC
File Type:
Text (Shell)
AV detection:
12 of 24 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=a66a4a5c5fge76pp3fya2vb4hpaecqngnfxtdrud75klmvke5anq._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
discovery linux
Link:
https://tria.ge/reports/260808-j72kgawyev/
Behaviour
Reads runtime system information
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.29
Link:
https://yomi.yoroi.company/submissions/07bc0e03a2e94c4ff9efd9700d543c3bc04141a6696f31c683ff54b65544e81b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 07bc0e03a2e94c4ff9efd9700d543c3bc04141a6696f31c683ff54b65544e81b

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3866369/
  
Delivery method
Distributed via web download

Comments