MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0bc48fac258a22005d50c4ec4e241c7eab82b4953a7452d0fa91af6fb7c738bc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0bc48fac258a22005d50c4ec4e241c7eab82b4953a7452d0fa91af6fb7c738bc
SHA3-384 hash: 6866957934a44581b3e4d3bfaf8427e1b3e5c87790b5644998a6b011f0ac89b63f5266ce2172d1f36746ff929334494a
SHA1 hash: d8cef72f44350edbe9e5ea946f376f0556bdb003
MD5 hash: d6dc1d7159e6ea6a8b744f057c38b3fc
humanhash: idaho-crazy-shade-hotel
File name:ok
Download: download sample
File size:1'608 bytes
First seen:2026-09-02 09:22:05 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 24:aIL6uyS/ERsJy8J6wXyQaN6fE5x5dc952K1G:beuyS/E+0wid5bWZG
TLSH T1DF3196CB10451A331143D99E77A3794C724DA1FB284FDBE4DC481DAA824978CF269F28
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://5.182.210.174/79c793n/an/an/a
http://5.182.210.174/e358fdn/an/an/a
http://5.182.210.174/9a0095n/an/an/a
http://5.182.210.174/36d77dn/an/an/a
http://5.182.210.174/51ab96n/an/an/a
http://5.182.210.174/b39307n/an/an/a
http://5.182.210.174/f69393n/an/an/a
http://5.182.210.174/05452fn/an/an/a
http://5.182.210.174/d7013fn/an/an/a
http://5.182.210.174/c9ef3en/an/an/a
http://5.182.210.174/0317c4n/an/an/a
http://5.182.210.174/ddaffen/an/an/a

Intelligence

File Origin
# of uploads :
1
# of downloads :
46
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Gathering data
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive mirai
Link:
https://www.filescan.io/uploads/6a97eac763dd4cf20d2a1910/reports/20a4db90-dc7b-4801-8cbc-9408effea2c9/overview
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/aae7acf5-b807-4403-b986-5eaf79a646d1
Behavior Graph:
Download SVG
%3 guuid=f95bdaa1-1800-0000-da0d-e8f8a40b0000 pid=2980 /usr/bin/sudo guuid=7c2c62a5-1800-0000-da0d-e8f8a70b0000 pid=2983 /tmp/sample.bin guuid=f95bdaa1-1800-0000-da0d-e8f8a40b0000 pid=2980->guuid=7c2c62a5-1800-0000-da0d-e8f8a70b0000 pid=2983 execve guuid=ef51f8a9-1800-0000-da0d-e8f8ac0b0000 pid=2988 /usr/bin/wget net send-data guuid=7c2c62a5-1800-0000-da0d-e8f8a70b0000 pid=2983->guuid=ef51f8a9-1800-0000-da0d-e8f8ac0b0000 pid=2988 execve guuid=a82ee7b4-1800-0000-da0d-e8f8b70b0000 pid=2999 /usr/bin/curl net send-data write-file guuid=7c2c62a5-1800-0000-da0d-e8f8a70b0000 pid=2983->guuid=a82ee7b4-1800-0000-da0d-e8f8b70b0000 pid=2999 execve guuid=e3681bc3-1800-0000-da0d-e8f8d00b0000 pid=3024 /usr/bin/chmod guuid=7c2c62a5-1800-0000-da0d-e8f8a70b0000 pid=2983->guuid=e3681bc3-1800-0000-da0d-e8f8d00b0000 pid=3024 execve guuid=80197ec3-1800-0000-da0d-e8f8d20b0000 pid=3026 /usr/bin/bash guuid=7c2c62a5-1800-0000-da0d-e8f8a70b0000 pid=2983->guuid=80197ec3-1800-0000-da0d-e8f8d20b0000 pid=3026 clone guuid=c7a1edc3-1800-0000-da0d-e8f8d50b0000 pid=3029 /usr/bin/rm delete-file guuid=7c2c62a5-1800-0000-da0d-e8f8a70b0000 pid=2983->guuid=c7a1edc3-1800-0000-da0d-e8f8d50b0000 pid=3029 execve guuid=112465c4-1800-0000-da0d-e8f8d70b0000 pid=3031 /usr/bin/rm guuid=7c2c62a5-1800-0000-da0d-e8f8a70b0000 pid=2983->guuid=112465c4-1800-0000-da0d-e8f8d70b0000 pid=3031 execve guuid=0305bdc4-1800-0000-da0d-e8f8db0b0000 pid=3035 /usr/bin/wget net send-data guuid=7c2c62a5-1800-0000-da0d-e8f8a70b0000 pid=2983->guuid=0305bdc4-1800-0000-da0d-e8f8db0b0000 pid=3035 execve guuid=19a6f8c8-1800-0000-da0d-e8f8de0b0000 pid=3038 /usr/bin/curl net send-data write-file guuid=7c2c62a5-1800-0000-da0d-e8f8a70b0000 pid=2983->guuid=19a6f8c8-1800-0000-da0d-e8f8de0b0000 pid=3038 execve guuid=a0123dd2-1800-0000-da0d-e8f8e80b0000 pid=3048 /usr/bin/chmod guuid=7c2c62a5-1800-0000-da0d-e8f8a70b0000 pid=2983->guuid=a0123dd2-1800-0000-da0d-e8f8e80b0000 pid=3048 execve guuid=bf6e90d2-1800-0000-da0d-e8f8e90b0000 pid=3049 /usr/bin/bash guuid=7c2c62a5-1800-0000-da0d-e8f8a70b0000 pid=2983->guuid=bf6e90d2-1800-0000-da0d-e8f8e90b0000 pid=3049 clone guuid=9cecfed2-1800-0000-da0d-e8f8eb0b0000 pid=3051 /usr/bin/rm delete-file guuid=7c2c62a5-1800-0000-da0d-e8f8a70b0000 pid=2983->guuid=9cecfed2-1800-0000-da0d-e8f8eb0b0000 pid=3051 execve guuid=cf28bcd3-1800-0000-da0d-e8f8ec0b0000 pid=3052 /usr/bin/rm guuid=7c2c62a5-1800-0000-da0d-e8f8a70b0000 pid=2983->guuid=cf28bcd3-1800-0000-da0d-e8f8ec0b0000 pid=3052 execve guuid=71434bd4-1800-0000-da0d-e8f8ed0b0000 pid=3053 /usr/bin/wget net send-data guuid=7c2c62a5-1800-0000-da0d-e8f8a70b0000 pid=2983->guuid=71434bd4-1800-0000-da0d-e8f8ed0b0000 pid=3053 execve guuid=814c72d7-1800-0000-da0d-e8f8f40b0000 pid=3060 /usr/bin/curl net send-data write-file guuid=7c2c62a5-1800-0000-da0d-e8f8a70b0000 pid=2983->guuid=814c72d7-1800-0000-da0d-e8f8f40b0000 pid=3060 execve guuid=33c0b8dc-1800-0000-da0d-e8f8fd0b0000 pid=3069 /usr/bin/chmod guuid=7c2c62a5-1800-0000-da0d-e8f8a70b0000 pid=2983->guuid=33c0b8dc-1800-0000-da0d-e8f8fd0b0000 pid=3069 execve guuid=419204dd-1800-0000-da0d-e8f8ff0b0000 pid=3071 /usr/bin/bash guuid=7c2c62a5-1800-0000-da0d-e8f8a70b0000 pid=2983->guuid=419204dd-1800-0000-da0d-e8f8ff0b0000 pid=3071 clone guuid=94ff3ddd-1800-0000-da0d-e8f8020c0000 pid=3074 /usr/bin/rm delete-file guuid=7c2c62a5-1800-0000-da0d-e8f8a70b0000 pid=2983->guuid=94ff3ddd-1800-0000-da0d-e8f8020c0000 pid=3074 execve guuid=ce3e80dd-1800-0000-da0d-e8f8040c0000 pid=3076 /usr/bin/rm guuid=7c2c62a5-1800-0000-da0d-e8f8a70b0000 pid=2983->guuid=ce3e80dd-1800-0000-da0d-e8f8040c0000 pid=3076 execve guuid=ad4ecfdd-1800-0000-da0d-e8f8060c0000 pid=3078 /usr/bin/wget net send-data guuid=7c2c62a5-1800-0000-da0d-e8f8a70b0000 pid=2983->guuid=ad4ecfdd-1800-0000-da0d-e8f8060c0000 pid=3078 execve guuid=0fa3b3e0-1800-0000-da0d-e8f8090c0000 pid=3081 /usr/bin/curl net send-data write-file guuid=7c2c62a5-1800-0000-da0d-e8f8a70b0000 pid=2983->guuid=0fa3b3e0-1800-0000-da0d-e8f8090c0000 pid=3081 execve guuid=2141c0e4-1800-0000-da0d-e8f80a0c0000 pid=3082 /usr/bin/chmod guuid=7c2c62a5-1800-0000-da0d-e8f8a70b0000 pid=2983->guuid=2141c0e4-1800-0000-da0d-e8f80a0c0000 pid=3082 execve guuid=b1081ce5-1800-0000-da0d-e8f80b0c0000 pid=3083 /usr/bin/bash guuid=7c2c62a5-1800-0000-da0d-e8f8a70b0000 pid=2983->guuid=b1081ce5-1800-0000-da0d-e8f80b0c0000 pid=3083 clone guuid=97c55be5-1800-0000-da0d-e8f80d0c0000 pid=3085 /usr/bin/rm delete-file guuid=7c2c62a5-1800-0000-da0d-e8f8a70b0000 pid=2983->guuid=97c55be5-1800-0000-da0d-e8f80d0c0000 pid=3085 execve guuid=eda0b1e5-1800-0000-da0d-e8f80e0c0000 pid=3086 /usr/bin/rm guuid=7c2c62a5-1800-0000-da0d-e8f8a70b0000 pid=2983->guuid=eda0b1e5-1800-0000-da0d-e8f80e0c0000 pid=3086 execve guuid=7bdf3ce6-1800-0000-da0d-e8f80f0c0000 pid=3087 /usr/bin/wget net send-data guuid=7c2c62a5-1800-0000-da0d-e8f8a70b0000 pid=2983->guuid=7bdf3ce6-1800-0000-da0d-e8f80f0c0000 pid=3087 execve guuid=c6136ee9-1800-0000-da0d-e8f8100c0000 pid=3088 /usr/bin/curl net send-data write-file guuid=7c2c62a5-1800-0000-da0d-e8f8a70b0000 pid=2983->guuid=c6136ee9-1800-0000-da0d-e8f8100c0000 pid=3088 execve guuid=5141f0ee-1800-0000-da0d-e8f8110c0000 pid=3089 /usr/bin/chmod guuid=7c2c62a5-1800-0000-da0d-e8f8a70b0000 pid=2983->guuid=5141f0ee-1800-0000-da0d-e8f8110c0000 pid=3089 execve guuid=1c3686ef-1800-0000-da0d-e8f8120c0000 pid=3090 /usr/bin/bash guuid=7c2c62a5-1800-0000-da0d-e8f8a70b0000 pid=2983->guuid=1c3686ef-1800-0000-da0d-e8f8120c0000 pid=3090 clone guuid=d879faef-1800-0000-da0d-e8f8140c0000 pid=3092 /usr/bin/rm delete-file guuid=7c2c62a5-1800-0000-da0d-e8f8a70b0000 pid=2983->guuid=d879faef-1800-0000-da0d-e8f8140c0000 pid=3092 execve guuid=aaa292f0-1800-0000-da0d-e8f8150c0000 pid=3093 /usr/bin/rm guuid=7c2c62a5-1800-0000-da0d-e8f8a70b0000 pid=2983->guuid=aaa292f0-1800-0000-da0d-e8f8150c0000 pid=3093 execve guuid=0cc122f1-1800-0000-da0d-e8f8160c0000 pid=3094 /usr/bin/wget net send-data guuid=7c2c62a5-1800-0000-da0d-e8f8a70b0000 pid=2983->guuid=0cc122f1-1800-0000-da0d-e8f8160c0000 pid=3094 execve guuid=19adeff3-1800-0000-da0d-e8f8180c0000 pid=3096 /usr/bin/curl net send-data write-file guuid=7c2c62a5-1800-0000-da0d-e8f8a70b0000 pid=2983->guuid=19adeff3-1800-0000-da0d-e8f8180c0000 pid=3096 execve guuid=8527aaf9-1800-0000-da0d-e8f8220c0000 pid=3106 /usr/bin/chmod guuid=7c2c62a5-1800-0000-da0d-e8f8a70b0000 pid=2983->guuid=8527aaf9-1800-0000-da0d-e8f8220c0000 pid=3106 execve guuid=219420fa-1800-0000-da0d-e8f8230c0000 pid=3107 /usr/bin/bash guuid=7c2c62a5-1800-0000-da0d-e8f8a70b0000 pid=2983->guuid=219420fa-1800-0000-da0d-e8f8230c0000 pid=3107 clone guuid=fbed5bfa-1800-0000-da0d-e8f8250c0000 pid=3109 /usr/bin/rm delete-file guuid=7c2c62a5-1800-0000-da0d-e8f8a70b0000 pid=2983->guuid=fbed5bfa-1800-0000-da0d-e8f8250c0000 pid=3109 execve guuid=0a9b9dfa-1800-0000-da0d-e8f8260c0000 pid=3110 /usr/bin/rm guuid=7c2c62a5-1800-0000-da0d-e8f8a70b0000 pid=2983->guuid=0a9b9dfa-1800-0000-da0d-e8f8260c0000 pid=3110 execve guuid=7f6ae7fa-1800-0000-da0d-e8f8270c0000 pid=3111 /usr/bin/wget net send-data guuid=7c2c62a5-1800-0000-da0d-e8f8a70b0000 pid=2983->guuid=7f6ae7fa-1800-0000-da0d-e8f8270c0000 pid=3111 execve guuid=6d1571fd-1800-0000-da0d-e8f82f0c0000 pid=3119 /usr/bin/curl net send-data write-file guuid=7c2c62a5-1800-0000-da0d-e8f8a70b0000 pid=2983->guuid=6d1571fd-1800-0000-da0d-e8f82f0c0000 pid=3119 execve guuid=06446002-1900-0000-da0d-e8f83c0c0000 pid=3132 /usr/bin/chmod guuid=7c2c62a5-1800-0000-da0d-e8f8a70b0000 pid=2983->guuid=06446002-1900-0000-da0d-e8f83c0c0000 pid=3132 execve guuid=eafdce02-1900-0000-da0d-e8f83e0c0000 pid=3134 /usr/bin/bash guuid=7c2c62a5-1800-0000-da0d-e8f8a70b0000 pid=2983->guuid=eafdce02-1900-0000-da0d-e8f83e0c0000 pid=3134 clone guuid=ae073e03-1900-0000-da0d-e8f8400c0000 pid=3136 /usr/bin/rm delete-file guuid=7c2c62a5-1800-0000-da0d-e8f8a70b0000 pid=2983->guuid=ae073e03-1900-0000-da0d-e8f8400c0000 pid=3136 execve guuid=f90b9003-1900-0000-da0d-e8f8430c0000 pid=3139 /usr/bin/rm guuid=7c2c62a5-1800-0000-da0d-e8f8a70b0000 pid=2983->guuid=f90b9003-1900-0000-da0d-e8f8430c0000 pid=3139 execve guuid=c47cdc03-1900-0000-da0d-e8f8450c0000 pid=3141 /usr/bin/wget net send-data guuid=7c2c62a5-1800-0000-da0d-e8f8a70b0000 pid=2983->guuid=c47cdc03-1900-0000-da0d-e8f8450c0000 pid=3141 execve guuid=a05a7206-1900-0000-da0d-e8f8490c0000 pid=3145 /usr/bin/curl net send-data write-file guuid=7c2c62a5-1800-0000-da0d-e8f8a70b0000 pid=2983->guuid=a05a7206-1900-0000-da0d-e8f8490c0000 pid=3145 execve guuid=623b040b-1900-0000-da0d-e8f84a0c0000 pid=3146 /usr/bin/chmod guuid=7c2c62a5-1800-0000-da0d-e8f8a70b0000 pid=2983->guuid=623b040b-1900-0000-da0d-e8f84a0c0000 pid=3146 execve guuid=fcf45c0b-1900-0000-da0d-e8f84b0c0000 pid=3147 /usr/bin/bash guuid=7c2c62a5-1800-0000-da0d-e8f8a70b0000 pid=2983->guuid=fcf45c0b-1900-0000-da0d-e8f84b0c0000 pid=3147 clone guuid=fbafa90b-1900-0000-da0d-e8f84d0c0000 pid=3149 /usr/bin/rm delete-file guuid=7c2c62a5-1800-0000-da0d-e8f8a70b0000 pid=2983->guuid=fbafa90b-1900-0000-da0d-e8f84d0c0000 pid=3149 execve guuid=7cd0020c-1900-0000-da0d-e8f84e0c0000 pid=3150 /usr/bin/rm guuid=7c2c62a5-1800-0000-da0d-e8f8a70b0000 pid=2983->guuid=7cd0020c-1900-0000-da0d-e8f84e0c0000 pid=3150 execve guuid=79be7d0c-1900-0000-da0d-e8f84f0c0000 pid=3151 /usr/bin/wget net send-data guuid=7c2c62a5-1800-0000-da0d-e8f8a70b0000 pid=2983->guuid=79be7d0c-1900-0000-da0d-e8f84f0c0000 pid=3151 execve guuid=478cc30f-1900-0000-da0d-e8f8500c0000 pid=3152 /usr/bin/curl net send-data write-file guuid=7c2c62a5-1800-0000-da0d-e8f8a70b0000 pid=2983->guuid=478cc30f-1900-0000-da0d-e8f8500c0000 pid=3152 execve guuid=087c4514-1900-0000-da0d-e8f8510c0000 pid=3153 /usr/bin/chmod guuid=7c2c62a5-1800-0000-da0d-e8f8a70b0000 pid=2983->guuid=087c4514-1900-0000-da0d-e8f8510c0000 pid=3153 execve guuid=37189014-1900-0000-da0d-e8f8520c0000 pid=3154 /usr/bin/bash guuid=7c2c62a5-1800-0000-da0d-e8f8a70b0000 pid=2983->guuid=37189014-1900-0000-da0d-e8f8520c0000 pid=3154 clone guuid=c878ca14-1900-0000-da0d-e8f8540c0000 pid=3156 /usr/bin/rm delete-file guuid=7c2c62a5-1800-0000-da0d-e8f8a70b0000 pid=2983->guuid=c878ca14-1900-0000-da0d-e8f8540c0000 pid=3156 execve guuid=1c421c15-1900-0000-da0d-e8f8550c0000 pid=3157 /usr/bin/rm guuid=7c2c62a5-1800-0000-da0d-e8f8a70b0000 pid=2983->guuid=1c421c15-1900-0000-da0d-e8f8550c0000 pid=3157 execve guuid=7c2a6f15-1900-0000-da0d-e8f8560c0000 pid=3158 /usr/bin/wget net send-data guuid=7c2c62a5-1800-0000-da0d-e8f8a70b0000 pid=2983->guuid=7c2a6f15-1900-0000-da0d-e8f8560c0000 pid=3158 execve guuid=62732b18-1900-0000-da0d-e8f8570c0000 pid=3159 /usr/bin/curl net send-data write-file guuid=7c2c62a5-1800-0000-da0d-e8f8a70b0000 pid=2983->guuid=62732b18-1900-0000-da0d-e8f8570c0000 pid=3159 execve guuid=de6f761c-1900-0000-da0d-e8f8580c0000 pid=3160 /usr/bin/chmod guuid=7c2c62a5-1800-0000-da0d-e8f8a70b0000 pid=2983->guuid=de6f761c-1900-0000-da0d-e8f8580c0000 pid=3160 execve guuid=29a4141d-1900-0000-da0d-e8f8590c0000 pid=3161 /usr/bin/bash guuid=7c2c62a5-1800-0000-da0d-e8f8a70b0000 pid=2983->guuid=29a4141d-1900-0000-da0d-e8f8590c0000 pid=3161 clone guuid=a2df6b1d-1900-0000-da0d-e8f85b0c0000 pid=3163 /usr/bin/rm delete-file guuid=7c2c62a5-1800-0000-da0d-e8f8a70b0000 pid=2983->guuid=a2df6b1d-1900-0000-da0d-e8f85b0c0000 pid=3163 execve guuid=89bfc51d-1900-0000-da0d-e8f85c0c0000 pid=3164 /usr/bin/rm guuid=7c2c62a5-1800-0000-da0d-e8f8a70b0000 pid=2983->guuid=89bfc51d-1900-0000-da0d-e8f85c0c0000 pid=3164 execve guuid=c68c201e-1900-0000-da0d-e8f85d0c0000 pid=3165 /usr/bin/wget net send-data guuid=7c2c62a5-1800-0000-da0d-e8f8a70b0000 pid=2983->guuid=c68c201e-1900-0000-da0d-e8f85d0c0000 pid=3165 execve guuid=4180f520-1900-0000-da0d-e8f85e0c0000 pid=3166 /usr/bin/curl net send-data write-file guuid=7c2c62a5-1800-0000-da0d-e8f8a70b0000 pid=2983->guuid=4180f520-1900-0000-da0d-e8f85e0c0000 pid=3166 execve guuid=c4f8ca26-1900-0000-da0d-e8f8670c0000 pid=3175 /usr/bin/chmod guuid=7c2c62a5-1800-0000-da0d-e8f8a70b0000 pid=2983->guuid=c4f8ca26-1900-0000-da0d-e8f8670c0000 pid=3175 execve guuid=2e992027-1900-0000-da0d-e8f8680c0000 pid=3176 /usr/bin/bash guuid=7c2c62a5-1800-0000-da0d-e8f8a70b0000 pid=2983->guuid=2e992027-1900-0000-da0d-e8f8680c0000 pid=3176 clone guuid=bfb95327-1900-0000-da0d-e8f86b0c0000 pid=3179 /usr/bin/rm delete-file guuid=7c2c62a5-1800-0000-da0d-e8f8a70b0000 pid=2983->guuid=bfb95327-1900-0000-da0d-e8f86b0c0000 pid=3179 execve guuid=24379427-1900-0000-da0d-e8f86d0c0000 pid=3181 /usr/bin/rm guuid=7c2c62a5-1800-0000-da0d-e8f8a70b0000 pid=2983->guuid=24379427-1900-0000-da0d-e8f86d0c0000 pid=3181 execve guuid=7a8dd227-1900-0000-da0d-e8f86f0c0000 pid=3183 /usr/bin/wget net send-data guuid=7c2c62a5-1800-0000-da0d-e8f8a70b0000 pid=2983->guuid=7a8dd227-1900-0000-da0d-e8f86f0c0000 pid=3183 execve guuid=6a96ee2a-1900-0000-da0d-e8f8770c0000 pid=3191 /usr/bin/curl net send-data write-file guuid=7c2c62a5-1800-0000-da0d-e8f8a70b0000 pid=2983->guuid=6a96ee2a-1900-0000-da0d-e8f8770c0000 pid=3191 execve guuid=7426ee2f-1900-0000-da0d-e8f87b0c0000 pid=3195 /usr/bin/chmod guuid=7c2c62a5-1800-0000-da0d-e8f8a70b0000 pid=2983->guuid=7426ee2f-1900-0000-da0d-e8f87b0c0000 pid=3195 execve guuid=76b38e30-1900-0000-da0d-e8f87c0c0000 pid=3196 /usr/bin/bash guuid=7c2c62a5-1800-0000-da0d-e8f8a70b0000 pid=2983->guuid=76b38e30-1900-0000-da0d-e8f87c0c0000 pid=3196 clone guuid=d6e5f930-1900-0000-da0d-e8f87e0c0000 pid=3198 /usr/bin/rm delete-file guuid=7c2c62a5-1800-0000-da0d-e8f8a70b0000 pid=2983->guuid=d6e5f930-1900-0000-da0d-e8f87e0c0000 pid=3198 execve guuid=19c05c31-1900-0000-da0d-e8f87f0c0000 pid=3199 /usr/bin/rm guuid=7c2c62a5-1800-0000-da0d-e8f8a70b0000 pid=2983->guuid=19c05c31-1900-0000-da0d-e8f87f0c0000 pid=3199 execve 5b654972-c9e1-50d8-b372-2dc2a5b9ad66 5.182.210.174:80 guuid=ef51f8a9-1800-0000-da0d-e8f8ac0b0000 pid=2988->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=a82ee7b4-1800-0000-da0d-e8f8b70b0000 pid=2999->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=0f209ec3-1800-0000-da0d-e8f8d40b0000 pid=3028 /usr/bin/bash guuid=80197ec3-1800-0000-da0d-e8f8d20b0000 pid=3026->guuid=0f209ec3-1800-0000-da0d-e8f8d40b0000 pid=3028 clone guuid=0305bdc4-1800-0000-da0d-e8f8db0b0000 pid=3035->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=19a6f8c8-1800-0000-da0d-e8f8de0b0000 pid=3038->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=c4b9c6d2-1800-0000-da0d-e8f8ea0b0000 pid=3050 /usr/bin/bash guuid=bf6e90d2-1800-0000-da0d-e8f8e90b0000 pid=3049->guuid=c4b9c6d2-1800-0000-da0d-e8f8ea0b0000 pid=3050 clone guuid=71434bd4-1800-0000-da0d-e8f8ed0b0000 pid=3053->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=814c72d7-1800-0000-da0d-e8f8f40b0000 pid=3060->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=49271cdd-1800-0000-da0d-e8f8010c0000 pid=3073 /usr/bin/bash guuid=419204dd-1800-0000-da0d-e8f8ff0b0000 pid=3071->guuid=49271cdd-1800-0000-da0d-e8f8010c0000 pid=3073 clone guuid=ad4ecfdd-1800-0000-da0d-e8f8060c0000 pid=3078->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=0fa3b3e0-1800-0000-da0d-e8f8090c0000 pid=3081->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=19903be5-1800-0000-da0d-e8f80c0c0000 pid=3084 /usr/bin/bash guuid=b1081ce5-1800-0000-da0d-e8f80b0c0000 pid=3083->guuid=19903be5-1800-0000-da0d-e8f80c0c0000 pid=3084 clone guuid=7bdf3ce6-1800-0000-da0d-e8f80f0c0000 pid=3087->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=c6136ee9-1800-0000-da0d-e8f8100c0000 pid=3088->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=e18faeef-1800-0000-da0d-e8f8130c0000 pid=3091 /usr/bin/bash guuid=1c3686ef-1800-0000-da0d-e8f8120c0000 pid=3090->guuid=e18faeef-1800-0000-da0d-e8f8130c0000 pid=3091 clone guuid=0cc122f1-1800-0000-da0d-e8f8160c0000 pid=3094->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=19adeff3-1800-0000-da0d-e8f8180c0000 pid=3096->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=0aca3cfa-1800-0000-da0d-e8f8240c0000 pid=3108 /usr/bin/bash guuid=219420fa-1800-0000-da0d-e8f8230c0000 pid=3107->guuid=0aca3cfa-1800-0000-da0d-e8f8240c0000 pid=3108 clone guuid=7f6ae7fa-1800-0000-da0d-e8f8270c0000 pid=3111->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=6d1571fd-1800-0000-da0d-e8f82f0c0000 pid=3119->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=f100e802-1900-0000-da0d-e8f83f0c0000 pid=3135 /usr/bin/bash guuid=eafdce02-1900-0000-da0d-e8f83e0c0000 pid=3134->guuid=f100e802-1900-0000-da0d-e8f83f0c0000 pid=3135 clone guuid=c47cdc03-1900-0000-da0d-e8f8450c0000 pid=3141->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=a05a7206-1900-0000-da0d-e8f8490c0000 pid=3145->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=0bef820b-1900-0000-da0d-e8f84c0c0000 pid=3148 /usr/bin/bash guuid=fcf45c0b-1900-0000-da0d-e8f84b0c0000 pid=3147->guuid=0bef820b-1900-0000-da0d-e8f84c0c0000 pid=3148 clone guuid=79be7d0c-1900-0000-da0d-e8f84f0c0000 pid=3151->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=478cc30f-1900-0000-da0d-e8f8500c0000 pid=3152->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=e209ae14-1900-0000-da0d-e8f8530c0000 pid=3155 /usr/bin/bash guuid=37189014-1900-0000-da0d-e8f8520c0000 pid=3154->guuid=e209ae14-1900-0000-da0d-e8f8530c0000 pid=3155 clone guuid=7c2a6f15-1900-0000-da0d-e8f8560c0000 pid=3158->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=62732b18-1900-0000-da0d-e8f8570c0000 pid=3159->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=5d0c3c1d-1900-0000-da0d-e8f85a0c0000 pid=3162 /usr/bin/bash guuid=29a4141d-1900-0000-da0d-e8f8590c0000 pid=3161->guuid=5d0c3c1d-1900-0000-da0d-e8f85a0c0000 pid=3162 clone guuid=c68c201e-1900-0000-da0d-e8f85d0c0000 pid=3165->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=4180f520-1900-0000-da0d-e8f85e0c0000 pid=3166->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=93923327-1900-0000-da0d-e8f8690c0000 pid=3177 /usr/bin/bash guuid=2e992027-1900-0000-da0d-e8f8680c0000 pid=3176->guuid=93923327-1900-0000-da0d-e8f8690c0000 pid=3177 clone guuid=7a8dd227-1900-0000-da0d-e8f86f0c0000 pid=3183->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=6a96ee2a-1900-0000-da0d-e8f8770c0000 pid=3191->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=f009c830-1900-0000-da0d-e8f87d0c0000 pid=3197 /usr/bin/bash guuid=76b38e30-1900-0000-da0d-e8f87c0c0000 pid=3196->guuid=f009c830-1900-0000-da0d-e8f87d0c0000 pid=3197 clone
Score:
99%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/0bc48fac258a22005d50c4ec4e241c7eab82b4953a7452d0fa91af6fb7c738bc
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0bc48fac258a22005d50c4ec4e241c7eab82b4953a7452d0fa91af6fb7c738bc/
Threat name:
Linux.Downloader.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-09-02 09:22:25 UTC
File Type:
Text (Shell)
AV detection:
13 of 36 (36.11%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bpci7lbfriraaxkqytwe4ja4p2vyfnevhj2ffuh2sgxw7n6hhc6a._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260902-lb2ayaydrg/
Behaviour
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.11
Link:
https://yomi.yoroi.company/submissions/0bc48fac258a22005d50c4ec4e241c7eab82b4953a7452d0fa91af6fb7c738bc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 0bc48fac258a22005d50c4ec4e241c7eab82b4953a7452d0fa91af6fb7c738bc

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3897671/
  
Delivery method
Distributed via web download

Comments