MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 08cf985017ffcc3f31151685dd4738fa99ac203cab7f17787ed46365eb87cdd6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 08cf985017ffcc3f31151685dd4738fa99ac203cab7f17787ed46365eb87cdd6
SHA3-384 hash: 7eb5210915e98e0af2d225e50f77805ada17de4bf11eed46143dd1eb4a81a511ef7e332e2c7dc4526d75ca5722b66680
SHA1 hash: 55ca1f4333a31d3c8c39875ef5fc941e0b6d8ec7
MD5 hash: 1ba03929c1e1d71e17b9a342a6a0ad4a
humanhash: berlin-violet-montana-tennessee
File name:ok
Download: download sample
File size:1'608 bytes
First seen:2026-08-21 09:47:17 UTC
Last seen:2026-08-21 14:13:13 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 12:UlI6lWll+vZ8/6V/nB86BheTx6TO0Xm6PK86KKJDFLx6FLUh2NgaNz6Nd9xd6Cy1:nlsvZZ/BNhHgv6S9bZxref3U36TNT
TLSH T1583184DE05505A711103CA5DB3A33489B69EE2FB2C9FCBE4D8480EE992487CCF265B48
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://5.182.210.174/829f73n/an/aua-wget
http://5.182.210.174/0eede3n/an/aua-wget
http://5.182.210.174/005679n/an/aua-wget
http://5.182.210.174/e0207dn/an/aua-wget
http://5.182.210.174/70504fn/an/aua-wget
http://5.182.210.174/197001n/an/aua-wget
http://5.182.210.174/98fab6n/an/aua-wget
http://5.182.210.174/c02601n/an/aua-wget
http://5.182.210.174/61e952n/an/aua-wget
http://5.182.210.174/d81575n/an/aua-wget
http://5.182.210.174/14f97an/an/aua-wget
http://5.182.210.174/2cd0c9n/an/aua-wget

Intelligence

File Origin
# of uploads :
2
# of downloads :
41
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive mirai
Link:
https://www.filescan.io/uploads/6a881edd6304c65efd5ab1e2/reports/115e50c1-a616-44e2-9fc5-1a529f01c32a/overview
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/64a78b8a-777f-4127-8019-ebc4a855e254
Behavior Graph:
Download SVG
%3 guuid=f913c4ce-1700-0000-21e3-164bcd090000 pid=2509 /usr/bin/sudo guuid=7cd849d3-1700-0000-21e3-164bd8090000 pid=2520 /tmp/sample.bin guuid=f913c4ce-1700-0000-21e3-164bcd090000 pid=2509->guuid=7cd849d3-1700-0000-21e3-164bd8090000 pid=2520 execve guuid=847967d4-1700-0000-21e3-164bdb090000 pid=2523 /usr/bin/wget net send-data guuid=7cd849d3-1700-0000-21e3-164bd8090000 pid=2520->guuid=847967d4-1700-0000-21e3-164bdb090000 pid=2523 execve guuid=d80d84db-1700-0000-21e3-164be6090000 pid=2534 /usr/bin/curl net send-data write-file guuid=7cd849d3-1700-0000-21e3-164bd8090000 pid=2520->guuid=d80d84db-1700-0000-21e3-164be6090000 pid=2534 execve guuid=ecb3b2e8-1700-0000-21e3-164bfb090000 pid=2555 /usr/bin/chmod guuid=7cd849d3-1700-0000-21e3-164bd8090000 pid=2520->guuid=ecb3b2e8-1700-0000-21e3-164bfb090000 pid=2555 execve guuid=f36602e9-1700-0000-21e3-164bfd090000 pid=2557 /usr/bin/bash guuid=7cd849d3-1700-0000-21e3-164bd8090000 pid=2520->guuid=f36602e9-1700-0000-21e3-164bfd090000 pid=2557 clone guuid=462c54e9-1700-0000-21e3-164b000a0000 pid=2560 /usr/bin/rm delete-file guuid=7cd849d3-1700-0000-21e3-164bd8090000 pid=2520->guuid=462c54e9-1700-0000-21e3-164b000a0000 pid=2560 execve guuid=f924b3e9-1700-0000-21e3-164b020a0000 pid=2562 /usr/bin/rm guuid=7cd849d3-1700-0000-21e3-164bd8090000 pid=2520->guuid=f924b3e9-1700-0000-21e3-164b020a0000 pid=2562 execve guuid=d77b00ea-1700-0000-21e3-164b030a0000 pid=2563 /usr/bin/wget net send-data guuid=7cd849d3-1700-0000-21e3-164bd8090000 pid=2520->guuid=d77b00ea-1700-0000-21e3-164b030a0000 pid=2563 execve guuid=d6451aed-1700-0000-21e3-164b0b0a0000 pid=2571 /usr/bin/curl net send-data write-file guuid=7cd849d3-1700-0000-21e3-164bd8090000 pid=2520->guuid=d6451aed-1700-0000-21e3-164b0b0a0000 pid=2571 execve guuid=ea7120f2-1700-0000-21e3-164b1b0a0000 pid=2587 /usr/bin/chmod guuid=7cd849d3-1700-0000-21e3-164bd8090000 pid=2520->guuid=ea7120f2-1700-0000-21e3-164b1b0a0000 pid=2587 execve guuid=834f6df2-1700-0000-21e3-164b1d0a0000 pid=2589 /usr/bin/bash guuid=7cd849d3-1700-0000-21e3-164bd8090000 pid=2520->guuid=834f6df2-1700-0000-21e3-164b1d0a0000 pid=2589 clone guuid=e3d6dff2-1700-0000-21e3-164b200a0000 pid=2592 /usr/bin/rm delete-file guuid=7cd849d3-1700-0000-21e3-164bd8090000 pid=2520->guuid=e3d6dff2-1700-0000-21e3-164b200a0000 pid=2592 execve guuid=4ddd29f3-1700-0000-21e3-164b220a0000 pid=2594 /usr/bin/rm guuid=7cd849d3-1700-0000-21e3-164bd8090000 pid=2520->guuid=4ddd29f3-1700-0000-21e3-164b220a0000 pid=2594 execve guuid=fb5870f3-1700-0000-21e3-164b240a0000 pid=2596 /usr/bin/wget net send-data guuid=7cd849d3-1700-0000-21e3-164bd8090000 pid=2520->guuid=fb5870f3-1700-0000-21e3-164b240a0000 pid=2596 execve guuid=8231e7f5-1700-0000-21e3-164b2e0a0000 pid=2606 /usr/bin/curl net send-data write-file guuid=7cd849d3-1700-0000-21e3-164bd8090000 pid=2520->guuid=8231e7f5-1700-0000-21e3-164b2e0a0000 pid=2606 execve guuid=02480efa-1700-0000-21e3-164b3c0a0000 pid=2620 /usr/bin/chmod guuid=7cd849d3-1700-0000-21e3-164bd8090000 pid=2520->guuid=02480efa-1700-0000-21e3-164b3c0a0000 pid=2620 execve guuid=220588fa-1700-0000-21e3-164b3e0a0000 pid=2622 /usr/bin/bash guuid=7cd849d3-1700-0000-21e3-164bd8090000 pid=2520->guuid=220588fa-1700-0000-21e3-164b3e0a0000 pid=2622 clone guuid=e077e0fa-1700-0000-21e3-164b400a0000 pid=2624 /usr/bin/rm delete-file guuid=7cd849d3-1700-0000-21e3-164bd8090000 pid=2520->guuid=e077e0fa-1700-0000-21e3-164b400a0000 pid=2624 execve guuid=956b35fb-1700-0000-21e3-164b410a0000 pid=2625 /usr/bin/rm guuid=7cd849d3-1700-0000-21e3-164bd8090000 pid=2520->guuid=956b35fb-1700-0000-21e3-164b410a0000 pid=2625 execve guuid=4ef58dfb-1700-0000-21e3-164b440a0000 pid=2628 /usr/bin/wget net send-data guuid=7cd849d3-1700-0000-21e3-164bd8090000 pid=2520->guuid=4ef58dfb-1700-0000-21e3-164b440a0000 pid=2628 execve guuid=17e83c00-1800-0000-21e3-164b490a0000 pid=2633 /usr/bin/curl net send-data write-file guuid=7cd849d3-1700-0000-21e3-164bd8090000 pid=2520->guuid=17e83c00-1800-0000-21e3-164b490a0000 pid=2633 execve guuid=77d27c07-1800-0000-21e3-164b580a0000 pid=2648 /usr/bin/chmod guuid=7cd849d3-1700-0000-21e3-164bd8090000 pid=2520->guuid=77d27c07-1800-0000-21e3-164b580a0000 pid=2648 execve guuid=ff51cb07-1800-0000-21e3-164b590a0000 pid=2649 /usr/bin/bash guuid=7cd849d3-1700-0000-21e3-164bd8090000 pid=2520->guuid=ff51cb07-1800-0000-21e3-164b590a0000 pid=2649 clone guuid=a9f32208-1800-0000-21e3-164b5b0a0000 pid=2651 /usr/bin/rm delete-file guuid=7cd849d3-1700-0000-21e3-164bd8090000 pid=2520->guuid=a9f32208-1800-0000-21e3-164b5b0a0000 pid=2651 execve guuid=04b27d08-1800-0000-21e3-164b5d0a0000 pid=2653 /usr/bin/rm guuid=7cd849d3-1700-0000-21e3-164bd8090000 pid=2520->guuid=04b27d08-1800-0000-21e3-164b5d0a0000 pid=2653 execve guuid=723aca08-1800-0000-21e3-164b5e0a0000 pid=2654 /usr/bin/wget net send-data guuid=7cd849d3-1700-0000-21e3-164bd8090000 pid=2520->guuid=723aca08-1800-0000-21e3-164b5e0a0000 pid=2654 execve guuid=d590d30b-1800-0000-21e3-164b650a0000 pid=2661 /usr/bin/curl net send-data write-file guuid=7cd849d3-1700-0000-21e3-164bd8090000 pid=2520->guuid=d590d30b-1800-0000-21e3-164b650a0000 pid=2661 execve guuid=87eb8111-1800-0000-21e3-164b6d0a0000 pid=2669 /usr/bin/chmod guuid=7cd849d3-1700-0000-21e3-164bd8090000 pid=2520->guuid=87eb8111-1800-0000-21e3-164b6d0a0000 pid=2669 execve guuid=0e25c711-1800-0000-21e3-164b6f0a0000 pid=2671 /usr/bin/bash guuid=7cd849d3-1700-0000-21e3-164bd8090000 pid=2520->guuid=0e25c711-1800-0000-21e3-164b6f0a0000 pid=2671 clone guuid=316a0b12-1800-0000-21e3-164b710a0000 pid=2673 /usr/bin/rm delete-file guuid=7cd849d3-1700-0000-21e3-164bd8090000 pid=2520->guuid=316a0b12-1800-0000-21e3-164b710a0000 pid=2673 execve guuid=2c216712-1800-0000-21e3-164b720a0000 pid=2674 /usr/bin/rm guuid=7cd849d3-1700-0000-21e3-164bd8090000 pid=2520->guuid=2c216712-1800-0000-21e3-164b720a0000 pid=2674 execve guuid=a75fa912-1800-0000-21e3-164b730a0000 pid=2675 /usr/bin/wget net send-data guuid=7cd849d3-1700-0000-21e3-164bd8090000 pid=2520->guuid=a75fa912-1800-0000-21e3-164b730a0000 pid=2675 execve guuid=62927115-1800-0000-21e3-164b780a0000 pid=2680 /usr/bin/curl net send-data write-file guuid=7cd849d3-1700-0000-21e3-164bd8090000 pid=2520->guuid=62927115-1800-0000-21e3-164b780a0000 pid=2680 execve guuid=dbd1f71b-1800-0000-21e3-164b830a0000 pid=2691 /usr/bin/chmod guuid=7cd849d3-1700-0000-21e3-164bd8090000 pid=2520->guuid=dbd1f71b-1800-0000-21e3-164b830a0000 pid=2691 execve guuid=bc40d71c-1800-0000-21e3-164b850a0000 pid=2693 /usr/bin/bash guuid=7cd849d3-1700-0000-21e3-164bd8090000 pid=2520->guuid=bc40d71c-1800-0000-21e3-164b850a0000 pid=2693 clone guuid=e3f5131d-1800-0000-21e3-164b880a0000 pid=2696 /usr/bin/rm delete-file guuid=7cd849d3-1700-0000-21e3-164bd8090000 pid=2520->guuid=e3f5131d-1800-0000-21e3-164b880a0000 pid=2696 execve guuid=1893551d-1800-0000-21e3-164b890a0000 pid=2697 /usr/bin/rm guuid=7cd849d3-1700-0000-21e3-164bd8090000 pid=2520->guuid=1893551d-1800-0000-21e3-164b890a0000 pid=2697 execve guuid=a6e49b1d-1800-0000-21e3-164b8b0a0000 pid=2699 /usr/bin/wget net send-data guuid=7cd849d3-1700-0000-21e3-164bd8090000 pid=2520->guuid=a6e49b1d-1800-0000-21e3-164b8b0a0000 pid=2699 execve guuid=e8d82e21-1800-0000-21e3-164b900a0000 pid=2704 /usr/bin/curl net send-data write-file guuid=7cd849d3-1700-0000-21e3-164bd8090000 pid=2520->guuid=e8d82e21-1800-0000-21e3-164b900a0000 pid=2704 execve guuid=e4116627-1800-0000-21e3-164ba20a0000 pid=2722 /usr/bin/chmod guuid=7cd849d3-1700-0000-21e3-164bd8090000 pid=2520->guuid=e4116627-1800-0000-21e3-164ba20a0000 pid=2722 execve guuid=a3b2b927-1800-0000-21e3-164ba30a0000 pid=2723 /usr/bin/bash guuid=7cd849d3-1700-0000-21e3-164bd8090000 pid=2520->guuid=a3b2b927-1800-0000-21e3-164ba30a0000 pid=2723 clone guuid=91f0f527-1800-0000-21e3-164ba60a0000 pid=2726 /usr/bin/rm delete-file guuid=7cd849d3-1700-0000-21e3-164bd8090000 pid=2520->guuid=91f0f527-1800-0000-21e3-164ba60a0000 pid=2726 execve guuid=2a385028-1800-0000-21e3-164ba70a0000 pid=2727 /usr/bin/rm guuid=7cd849d3-1700-0000-21e3-164bd8090000 pid=2520->guuid=2a385028-1800-0000-21e3-164ba70a0000 pid=2727 execve guuid=54dfa428-1800-0000-21e3-164ba80a0000 pid=2728 /usr/bin/wget net send-data guuid=7cd849d3-1700-0000-21e3-164bd8090000 pid=2520->guuid=54dfa428-1800-0000-21e3-164ba80a0000 pid=2728 execve guuid=90a6b62b-1800-0000-21e3-164bb00a0000 pid=2736 /usr/bin/curl net send-data write-file guuid=7cd849d3-1700-0000-21e3-164bd8090000 pid=2520->guuid=90a6b62b-1800-0000-21e3-164bb00a0000 pid=2736 execve guuid=3ecdf032-1800-0000-21e3-164bbb0a0000 pid=2747 /usr/bin/chmod guuid=7cd849d3-1700-0000-21e3-164bd8090000 pid=2520->guuid=3ecdf032-1800-0000-21e3-164bbb0a0000 pid=2747 execve guuid=cb709f33-1800-0000-21e3-164bbe0a0000 pid=2750 /usr/bin/bash guuid=7cd849d3-1700-0000-21e3-164bd8090000 pid=2520->guuid=cb709f33-1800-0000-21e3-164bbe0a0000 pid=2750 clone guuid=e0982234-1800-0000-21e3-164bc10a0000 pid=2753 /usr/bin/rm delete-file guuid=7cd849d3-1700-0000-21e3-164bd8090000 pid=2520->guuid=e0982234-1800-0000-21e3-164bc10a0000 pid=2753 execve guuid=d5c2b034-1800-0000-21e3-164bc30a0000 pid=2755 /usr/bin/rm guuid=7cd849d3-1700-0000-21e3-164bd8090000 pid=2520->guuid=d5c2b034-1800-0000-21e3-164bc30a0000 pid=2755 execve guuid=96024b35-1800-0000-21e3-164bc50a0000 pid=2757 /usr/bin/wget net send-data guuid=7cd849d3-1700-0000-21e3-164bd8090000 pid=2520->guuid=96024b35-1800-0000-21e3-164bc50a0000 pid=2757 execve guuid=630e8739-1800-0000-21e3-164bcc0a0000 pid=2764 /usr/bin/curl net send-data write-file guuid=7cd849d3-1700-0000-21e3-164bd8090000 pid=2520->guuid=630e8739-1800-0000-21e3-164bcc0a0000 pid=2764 execve guuid=96147a41-1800-0000-21e3-164bdc0a0000 pid=2780 /usr/bin/chmod guuid=7cd849d3-1700-0000-21e3-164bd8090000 pid=2520->guuid=96147a41-1800-0000-21e3-164bdc0a0000 pid=2780 execve guuid=33adf641-1800-0000-21e3-164bdd0a0000 pid=2781 /usr/bin/bash guuid=7cd849d3-1700-0000-21e3-164bd8090000 pid=2520->guuid=33adf641-1800-0000-21e3-164bdd0a0000 pid=2781 clone guuid=a2fd4142-1800-0000-21e3-164bdf0a0000 pid=2783 /usr/bin/rm delete-file guuid=7cd849d3-1700-0000-21e3-164bd8090000 pid=2520->guuid=a2fd4142-1800-0000-21e3-164bdf0a0000 pid=2783 execve guuid=9a6a9845-1800-0000-21e3-164be00a0000 pid=2784 /usr/bin/rm guuid=7cd849d3-1700-0000-21e3-164bd8090000 pid=2520->guuid=9a6a9845-1800-0000-21e3-164be00a0000 pid=2784 execve guuid=3378fb45-1800-0000-21e3-164be10a0000 pid=2785 /usr/bin/wget net send-data guuid=7cd849d3-1700-0000-21e3-164bd8090000 pid=2520->guuid=3378fb45-1800-0000-21e3-164be10a0000 pid=2785 execve guuid=b9375c49-1800-0000-21e3-164be70a0000 pid=2791 /usr/bin/curl net send-data write-file guuid=7cd849d3-1700-0000-21e3-164bd8090000 pid=2520->guuid=b9375c49-1800-0000-21e3-164be70a0000 pid=2791 execve guuid=efc5c34e-1800-0000-21e3-164bf30a0000 pid=2803 /usr/bin/chmod guuid=7cd849d3-1700-0000-21e3-164bd8090000 pid=2520->guuid=efc5c34e-1800-0000-21e3-164bf30a0000 pid=2803 execve guuid=98602c4f-1800-0000-21e3-164bf50a0000 pid=2805 /usr/bin/bash guuid=7cd849d3-1700-0000-21e3-164bd8090000 pid=2520->guuid=98602c4f-1800-0000-21e3-164bf50a0000 pid=2805 clone guuid=dc2b7d4f-1800-0000-21e3-164bf70a0000 pid=2807 /usr/bin/rm delete-file guuid=7cd849d3-1700-0000-21e3-164bd8090000 pid=2520->guuid=dc2b7d4f-1800-0000-21e3-164bf70a0000 pid=2807 execve guuid=b9a5dd4f-1800-0000-21e3-164bf90a0000 pid=2809 /usr/bin/rm guuid=7cd849d3-1700-0000-21e3-164bd8090000 pid=2520->guuid=b9a5dd4f-1800-0000-21e3-164bf90a0000 pid=2809 execve guuid=388b4250-1800-0000-21e3-164bfc0a0000 pid=2812 /usr/bin/wget net send-data guuid=7cd849d3-1700-0000-21e3-164bd8090000 pid=2520->guuid=388b4250-1800-0000-21e3-164bfc0a0000 pid=2812 execve guuid=61b72753-1800-0000-21e3-164b050b0000 pid=2821 /usr/bin/curl net send-data write-file guuid=7cd849d3-1700-0000-21e3-164bd8090000 pid=2520->guuid=61b72753-1800-0000-21e3-164b050b0000 pid=2821 execve guuid=c2398657-1800-0000-21e3-164b110b0000 pid=2833 /usr/bin/chmod guuid=7cd849d3-1700-0000-21e3-164bd8090000 pid=2520->guuid=c2398657-1800-0000-21e3-164b110b0000 pid=2833 execve guuid=fc79de57-1800-0000-21e3-164b130b0000 pid=2835 /usr/bin/bash guuid=7cd849d3-1700-0000-21e3-164bd8090000 pid=2520->guuid=fc79de57-1800-0000-21e3-164b130b0000 pid=2835 clone guuid=27cc1658-1800-0000-21e3-164b150b0000 pid=2837 /usr/bin/rm delete-file guuid=7cd849d3-1700-0000-21e3-164bd8090000 pid=2520->guuid=27cc1658-1800-0000-21e3-164b150b0000 pid=2837 execve guuid=a3c95c58-1800-0000-21e3-164b170b0000 pid=2839 /usr/bin/rm guuid=7cd849d3-1700-0000-21e3-164bd8090000 pid=2520->guuid=a3c95c58-1800-0000-21e3-164b170b0000 pid=2839 execve guuid=6a449c58-1800-0000-21e3-164b180b0000 pid=2840 /usr/bin/wget net send-data guuid=7cd849d3-1700-0000-21e3-164bd8090000 pid=2520->guuid=6a449c58-1800-0000-21e3-164b180b0000 pid=2840 execve guuid=91ab235b-1800-0000-21e3-164b210b0000 pid=2849 /usr/bin/curl net send-data write-file guuid=7cd849d3-1700-0000-21e3-164bd8090000 pid=2520->guuid=91ab235b-1800-0000-21e3-164b210b0000 pid=2849 execve guuid=ed64675f-1800-0000-21e3-164b2d0b0000 pid=2861 /usr/bin/chmod guuid=7cd849d3-1700-0000-21e3-164bd8090000 pid=2520->guuid=ed64675f-1800-0000-21e3-164b2d0b0000 pid=2861 execve guuid=cef9af5f-1800-0000-21e3-164b2e0b0000 pid=2862 /usr/bin/bash guuid=7cd849d3-1700-0000-21e3-164bd8090000 pid=2520->guuid=cef9af5f-1800-0000-21e3-164b2e0b0000 pid=2862 clone guuid=262b0060-1800-0000-21e3-164b310b0000 pid=2865 /usr/bin/rm delete-file guuid=7cd849d3-1700-0000-21e3-164bd8090000 pid=2520->guuid=262b0060-1800-0000-21e3-164b310b0000 pid=2865 execve guuid=4ac64360-1800-0000-21e3-164b320b0000 pid=2866 /usr/bin/rm guuid=7cd849d3-1700-0000-21e3-164bd8090000 pid=2520->guuid=4ac64360-1800-0000-21e3-164b320b0000 pid=2866 execve 5b654972-c9e1-50d8-b372-2dc2a5b9ad66 5.182.210.174:80 guuid=847967d4-1700-0000-21e3-164bdb090000 pid=2523->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=d80d84db-1700-0000-21e3-164be6090000 pid=2534->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=23051fe9-1700-0000-21e3-164bfe090000 pid=2558 /usr/bin/bash guuid=f36602e9-1700-0000-21e3-164bfd090000 pid=2557->guuid=23051fe9-1700-0000-21e3-164bfe090000 pid=2558 clone guuid=d77b00ea-1700-0000-21e3-164b030a0000 pid=2563->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=d6451aed-1700-0000-21e3-164b0b0a0000 pid=2571->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=4b798ef2-1700-0000-21e3-164b1e0a0000 pid=2590 /usr/bin/bash guuid=834f6df2-1700-0000-21e3-164b1d0a0000 pid=2589->guuid=4b798ef2-1700-0000-21e3-164b1e0a0000 pid=2590 clone guuid=fb5870f3-1700-0000-21e3-164b240a0000 pid=2596->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=8231e7f5-1700-0000-21e3-164b2e0a0000 pid=2606->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=2b72adfa-1700-0000-21e3-164b3f0a0000 pid=2623 /usr/bin/bash guuid=220588fa-1700-0000-21e3-164b3e0a0000 pid=2622->guuid=2b72adfa-1700-0000-21e3-164b3f0a0000 pid=2623 clone guuid=4ef58dfb-1700-0000-21e3-164b440a0000 pid=2628->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=17e83c00-1800-0000-21e3-164b490a0000 pid=2633->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=be8ae607-1800-0000-21e3-164b5a0a0000 pid=2650 /usr/bin/bash guuid=ff51cb07-1800-0000-21e3-164b590a0000 pid=2649->guuid=be8ae607-1800-0000-21e3-164b5a0a0000 pid=2650 clone guuid=723aca08-1800-0000-21e3-164b5e0a0000 pid=2654->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=d590d30b-1800-0000-21e3-164b650a0000 pid=2661->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=0f7bdf11-1800-0000-21e3-164b700a0000 pid=2672 /usr/bin/bash guuid=0e25c711-1800-0000-21e3-164b6f0a0000 pid=2671->guuid=0f7bdf11-1800-0000-21e3-164b700a0000 pid=2672 clone guuid=a75fa912-1800-0000-21e3-164b730a0000 pid=2675->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=62927115-1800-0000-21e3-164b780a0000 pid=2680->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=7732f61c-1800-0000-21e3-164b860a0000 pid=2694 /usr/bin/bash guuid=bc40d71c-1800-0000-21e3-164b850a0000 pid=2693->guuid=7732f61c-1800-0000-21e3-164b860a0000 pid=2694 clone guuid=a6e49b1d-1800-0000-21e3-164b8b0a0000 pid=2699->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=e8d82e21-1800-0000-21e3-164b900a0000 pid=2704->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=796fd627-1800-0000-21e3-164ba40a0000 pid=2724 /usr/bin/bash guuid=a3b2b927-1800-0000-21e3-164ba30a0000 pid=2723->guuid=796fd627-1800-0000-21e3-164ba40a0000 pid=2724 clone guuid=54dfa428-1800-0000-21e3-164ba80a0000 pid=2728->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=90a6b62b-1800-0000-21e3-164bb00a0000 pid=2736->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=67a5d033-1800-0000-21e3-164bbf0a0000 pid=2751 /usr/bin/bash guuid=cb709f33-1800-0000-21e3-164bbe0a0000 pid=2750->guuid=67a5d033-1800-0000-21e3-164bbf0a0000 pid=2751 clone guuid=96024b35-1800-0000-21e3-164bc50a0000 pid=2757->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=630e8739-1800-0000-21e3-164bcc0a0000 pid=2764->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=b3751342-1800-0000-21e3-164bde0a0000 pid=2782 /usr/bin/bash guuid=33adf641-1800-0000-21e3-164bdd0a0000 pid=2781->guuid=b3751342-1800-0000-21e3-164bde0a0000 pid=2782 clone guuid=3378fb45-1800-0000-21e3-164be10a0000 pid=2785->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=b9375c49-1800-0000-21e3-164be70a0000 pid=2791->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=883f504f-1800-0000-21e3-164bf60a0000 pid=2806 /usr/bin/bash guuid=98602c4f-1800-0000-21e3-164bf50a0000 pid=2805->guuid=883f504f-1800-0000-21e3-164bf60a0000 pid=2806 clone guuid=388b4250-1800-0000-21e3-164bfc0a0000 pid=2812->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=61b72753-1800-0000-21e3-164b050b0000 pid=2821->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=8b01f457-1800-0000-21e3-164b140b0000 pid=2836 /usr/bin/bash guuid=fc79de57-1800-0000-21e3-164b130b0000 pid=2835->guuid=8b01f457-1800-0000-21e3-164b140b0000 pid=2836 clone guuid=6a449c58-1800-0000-21e3-164b180b0000 pid=2840->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=91ab235b-1800-0000-21e3-164b210b0000 pid=2849->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=be26c55f-1800-0000-21e3-164b2f0b0000 pid=2863 /usr/bin/bash guuid=cef9af5f-1800-0000-21e3-164b2e0b0000 pid=2862->guuid=be26c55f-1800-0000-21e3-164b2f0b0000 pid=2863 clone
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/08cf985017ffcc3f31151685dd4738fa99ac203cab7f17787ed46365eb87cdd6
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/08cf985017ffcc3f31151685dd4738fa99ac203cab7f17787ed46365eb87cdd6/
Threat name:
Linux.Downloader.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-08-21 09:48:21 UTC
File Type:
Text (Shell)
AV detection:
13 of 36 (36.11%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bdhzquax77gd6mivc2c52rzy7km2yib4vn7ro6d62rrwl24hzxla._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260821-lsvvgs1zes/
Behaviour
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.11
Link:
https://yomi.yoroi.company/submissions/08cf985017ffcc3f31151685dd4738fa99ac203cab7f17787ed46365eb87cdd6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 08cf985017ffcc3f31151685dd4738fa99ac203cab7f17787ed46365eb87cdd6

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3897671/
  
Delivery method
Distributed via web download

Comments