🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 109b72cf81f70a1cc5b4fd9e12edb91cab9ed41871d2bf0233f455385e0cecd2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry



Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments

SHA256 hash: 109b72cf81f70a1cc5b4fd9e12edb91cab9ed41871d2bf0233f455385e0cecd2
SHA3-384 hash: aabb31338ca2af709f1e1c5c3a6fc935b8565bab96789f128f9de10fd6d59e783209b6931948f55660994e7dc7dac15c
SHA1 hash: e7d35503ae8d6fdab66e35a3e9d4fabcd068db45
MD5 hash: 625a13d19ba1481461a8cc2de9f02db6
humanhash: green-fix-uniform-single
File name:bins.sh
Download: download sample
File size:1'316 bytes
First seen:2026-11-15 15:12:58 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 24:4jvV6qp6B0Z3DzqxM6hRq05M9m5ip6TfpaQxxQ+G4n166rM:4jvZp6iNzqxLhQF9m5ip6TfDxKM16wM
TLSH T1352170E6F8318171349F803AED4E55C09883087A02283512228FED19B1BC9A8B36E7F6
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter BlinkzSec

Intelligence


File Origin
# of uploads :
1
# of downloads :
57
Origin country :
US US
Vendor Threat Intelligence
No detections
Status:
terminated
Behavior Graph:
%3 guuid=5275493a-1a00-0000-860f-d82f86080000 pid=2182 /usr/bin/sudo guuid=3756113c-1a00-0000-860f-d82f87080000 pid=2183 /tmp/sample.bin guuid=5275493a-1a00-0000-860f-d82f86080000 pid=2182->guuid=3756113c-1a00-0000-860f-d82f87080000 pid=2183 execve guuid=f923703c-1a00-0000-860f-d82f88080000 pid=2184 /usr/bin/mkdir guuid=3756113c-1a00-0000-860f-d82f87080000 pid=2183->guuid=f923703c-1a00-0000-860f-d82f88080000 pid=2184 execve guuid=76efd83c-1a00-0000-860f-d82f89080000 pid=2185 /usr/bin/touch guuid=3756113c-1a00-0000-860f-d82f87080000 pid=2183->guuid=76efd83c-1a00-0000-860f-d82f89080000 pid=2185 execve guuid=9109323d-1a00-0000-860f-d82f8a080000 pid=2186 /usr/bin/rm delete-file guuid=3756113c-1a00-0000-860f-d82f87080000 pid=2183->guuid=9109323d-1a00-0000-860f-d82f8a080000 pid=2186 execve guuid=9d129b3d-1a00-0000-860f-d82f8b080000 pid=2187 /usr/bin/rm guuid=3756113c-1a00-0000-860f-d82f87080000 pid=2183->guuid=9d129b3d-1a00-0000-860f-d82f8b080000 pid=2187 execve guuid=a806f73d-1a00-0000-860f-d82f8c080000 pid=2188 /usr/bin/wget dns net send-data guuid=3756113c-1a00-0000-860f-d82f87080000 pid=2183->guuid=a806f73d-1a00-0000-860f-d82f8c080000 pid=2188 execve guuid=d187c944-1a00-0000-860f-d82f95080000 pid=2197 /usr/bin/busybox dns net send-data guuid=3756113c-1a00-0000-860f-d82f87080000 pid=2183->guuid=d187c944-1a00-0000-860f-d82f95080000 pid=2197 execve guuid=f437ff47-1a00-0000-860f-d82f9d080000 pid=2205 /usr/bin/curl guuid=3756113c-1a00-0000-860f-d82f87080000 pid=2183->guuid=f437ff47-1a00-0000-860f-d82f9d080000 pid=2205 execve guuid=14dcba52-1a00-0000-860f-d82fae080000 pid=2222 /usr/bin/rm guuid=3756113c-1a00-0000-860f-d82f87080000 pid=2183->guuid=14dcba52-1a00-0000-860f-d82fae080000 pid=2222 execve guuid=52a8f552-1a00-0000-860f-d82faf080000 pid=2223 /usr/bin/wget dns net send-data guuid=3756113c-1a00-0000-860f-d82f87080000 pid=2183->guuid=52a8f552-1a00-0000-860f-d82faf080000 pid=2223 execve guuid=f70b3d56-1a00-0000-860f-d82fb9080000 pid=2233 /usr/bin/busybox dns net send-data guuid=3756113c-1a00-0000-860f-d82f87080000 pid=2183->guuid=f70b3d56-1a00-0000-860f-d82fb9080000 pid=2233 execve guuid=0ea63f59-1a00-0000-860f-d82fc2080000 pid=2242 /usr/bin/curl guuid=3756113c-1a00-0000-860f-d82f87080000 pid=2183->guuid=0ea63f59-1a00-0000-860f-d82fc2080000 pid=2242 execve guuid=843a4960-1a00-0000-860f-d82fd0080000 pid=2256 /usr/bin/rm guuid=3756113c-1a00-0000-860f-d82f87080000 pid=2183->guuid=843a4960-1a00-0000-860f-d82fd0080000 pid=2256 execve guuid=e630b360-1a00-0000-860f-d82fd3080000 pid=2259 /usr/bin/wget dns net send-data guuid=3756113c-1a00-0000-860f-d82f87080000 pid=2183->guuid=e630b360-1a00-0000-860f-d82fd3080000 pid=2259 execve guuid=af10e665-1a00-0000-860f-d82fdf080000 pid=2271 /usr/bin/busybox dns net send-data guuid=3756113c-1a00-0000-860f-d82f87080000 pid=2183->guuid=af10e665-1a00-0000-860f-d82fdf080000 pid=2271 execve guuid=25c93869-1a00-0000-860f-d82fe4080000 pid=2276 /usr/bin/curl guuid=3756113c-1a00-0000-860f-d82f87080000 pid=2183->guuid=25c93869-1a00-0000-860f-d82fe4080000 pid=2276 execve guuid=9c165f72-1a00-0000-860f-d82ff1080000 pid=2289 /usr/bin/rm guuid=3756113c-1a00-0000-860f-d82f87080000 pid=2183->guuid=9c165f72-1a00-0000-860f-d82ff1080000 pid=2289 execve guuid=c906d072-1a00-0000-860f-d82ff3080000 pid=2291 /usr/bin/wget dns net send-data guuid=3756113c-1a00-0000-860f-d82f87080000 pid=2183->guuid=c906d072-1a00-0000-860f-d82ff3080000 pid=2291 execve guuid=b532bb76-1a00-0000-860f-d82ffd080000 pid=2301 /usr/bin/busybox dns net send-data guuid=3756113c-1a00-0000-860f-d82f87080000 pid=2183->guuid=b532bb76-1a00-0000-860f-d82ffd080000 pid=2301 execve guuid=e74d947a-1a00-0000-860f-d82f04090000 pid=2308 /usr/bin/curl guuid=3756113c-1a00-0000-860f-d82f87080000 pid=2183->guuid=e74d947a-1a00-0000-860f-d82f04090000 pid=2308 execve guuid=f5f02f80-1a00-0000-860f-d82f14090000 pid=2324 /usr/bin/rm guuid=3756113c-1a00-0000-860f-d82f87080000 pid=2183->guuid=f5f02f80-1a00-0000-860f-d82f14090000 pid=2324 execve guuid=404d7880-1a00-0000-860f-d82f16090000 pid=2326 /usr/bin/wget dns net send-data guuid=3756113c-1a00-0000-860f-d82f87080000 pid=2183->guuid=404d7880-1a00-0000-860f-d82f16090000 pid=2326 execve guuid=e442e383-1a00-0000-860f-d82f1e090000 pid=2334 /usr/bin/busybox dns net send-data guuid=3756113c-1a00-0000-860f-d82f87080000 pid=2183->guuid=e442e383-1a00-0000-860f-d82f1e090000 pid=2334 execve guuid=93bb2487-1a00-0000-860f-d82f24090000 pid=2340 /usr/bin/curl guuid=3756113c-1a00-0000-860f-d82f87080000 pid=2183->guuid=93bb2487-1a00-0000-860f-d82f24090000 pid=2340 execve guuid=1e1a108d-1a00-0000-860f-d82f36090000 pid=2358 /usr/bin/rm guuid=3756113c-1a00-0000-860f-d82f87080000 pid=2183->guuid=1e1a108d-1a00-0000-860f-d82f36090000 pid=2358 execve guuid=43278b8d-1a00-0000-860f-d82f38090000 pid=2360 /usr/bin/wget dns net send-data guuid=3756113c-1a00-0000-860f-d82f87080000 pid=2183->guuid=43278b8d-1a00-0000-860f-d82f38090000 pid=2360 execve guuid=15406691-1a00-0000-860f-d82f42090000 pid=2370 /usr/bin/busybox dns net send-data guuid=3756113c-1a00-0000-860f-d82f87080000 pid=2183->guuid=15406691-1a00-0000-860f-d82f42090000 pid=2370 execve guuid=faa32c94-1a00-0000-860f-d82f48090000 pid=2376 /usr/bin/curl guuid=3756113c-1a00-0000-860f-d82f87080000 pid=2183->guuid=faa32c94-1a00-0000-860f-d82f48090000 pid=2376 execve guuid=59ab0a9b-1a00-0000-860f-d82f5c090000 pid=2396 /usr/bin/rm guuid=3756113c-1a00-0000-860f-d82f87080000 pid=2183->guuid=59ab0a9b-1a00-0000-860f-d82f5c090000 pid=2396 execve guuid=4a86679b-1a00-0000-860f-d82f5d090000 pid=2397 /usr/bin/wget dns net send-data guuid=3756113c-1a00-0000-860f-d82f87080000 pid=2183->guuid=4a86679b-1a00-0000-860f-d82f5d090000 pid=2397 execve guuid=3929669f-1a00-0000-860f-d82f60090000 pid=2400 /usr/bin/busybox dns net send-data guuid=3756113c-1a00-0000-860f-d82f87080000 pid=2183->guuid=3929669f-1a00-0000-860f-d82f60090000 pid=2400 execve guuid=d87999a3-1a00-0000-860f-d82f66090000 pid=2406 /usr/bin/curl guuid=3756113c-1a00-0000-860f-d82f87080000 pid=2183->guuid=d87999a3-1a00-0000-860f-d82f66090000 pid=2406 execve guuid=150de7ac-1a00-0000-860f-d82f79090000 pid=2425 /usr/bin/rm guuid=3756113c-1a00-0000-860f-d82f87080000 pid=2183->guuid=150de7ac-1a00-0000-860f-d82f79090000 pid=2425 execve guuid=e6a1d2ad-1a00-0000-860f-d82f7a090000 pid=2426 /usr/bin/wget dns net send-data guuid=3756113c-1a00-0000-860f-d82f87080000 pid=2183->guuid=e6a1d2ad-1a00-0000-860f-d82f7a090000 pid=2426 execve guuid=e9f834b3-1a00-0000-860f-d82f81090000 pid=2433 /usr/bin/busybox dns net send-data guuid=3756113c-1a00-0000-860f-d82f87080000 pid=2183->guuid=e9f834b3-1a00-0000-860f-d82f81090000 pid=2433 execve guuid=7dfca2b6-1a00-0000-860f-d82f86090000 pid=2438 /usr/bin/curl guuid=3756113c-1a00-0000-860f-d82f87080000 pid=2183->guuid=7dfca2b6-1a00-0000-860f-d82f86090000 pid=2438 execve guuid=1da54fbb-1a00-0000-860f-d82f8d090000 pid=2445 /usr/bin/rm guuid=3756113c-1a00-0000-860f-d82f87080000 pid=2183->guuid=1da54fbb-1a00-0000-860f-d82f8d090000 pid=2445 execve guuid=bd9fdbbb-1a00-0000-860f-d82f8f090000 pid=2447 /usr/bin/wget dns net send-data guuid=3756113c-1a00-0000-860f-d82f87080000 pid=2183->guuid=bd9fdbbb-1a00-0000-860f-d82f8f090000 pid=2447 execve guuid=f95d9bc0-1a00-0000-860f-d82f97090000 pid=2455 /usr/bin/busybox dns net send-data guuid=3756113c-1a00-0000-860f-d82f87080000 pid=2183->guuid=f95d9bc0-1a00-0000-860f-d82f97090000 pid=2455 execve guuid=3d5f97c7-1a00-0000-860f-d82fa2090000 pid=2466 /usr/bin/curl guuid=3756113c-1a00-0000-860f-d82f87080000 pid=2183->guuid=3d5f97c7-1a00-0000-860f-d82fa2090000 pid=2466 execve 4f6baed0-9587-596c-82b3-fd721afe4cc1 10.0.2.3:53 guuid=a806f73d-1a00-0000-860f-d82f8c080000 pid=2188->4f6baed0-9587-596c-82b3-fd721afe4cc1 send: 128B guuid=d187c944-1a00-0000-860f-d82f95080000 pid=2197->4f6baed0-9587-596c-82b3-fd721afe4cc1 send: 128B guuid=f437ff47-1a00-0000-860f-d82f9d080000 pid=2217 /usr/bin/curl dns net send-data guuid=f437ff47-1a00-0000-860f-d82f9d080000 pid=2205->guuid=f437ff47-1a00-0000-860f-d82f9d080000 pid=2217 clone guuid=f437ff47-1a00-0000-860f-d82f9d080000 pid=2217->4f6baed0-9587-596c-82b3-fd721afe4cc1 send: 128B guuid=52a8f552-1a00-0000-860f-d82faf080000 pid=2223->4f6baed0-9587-596c-82b3-fd721afe4cc1 send: 128B guuid=f70b3d56-1a00-0000-860f-d82fb9080000 pid=2233->4f6baed0-9587-596c-82b3-fd721afe4cc1 send: 128B guuid=0ea63f59-1a00-0000-860f-d82fc2080000 pid=2248 /usr/bin/curl dns net send-data guuid=0ea63f59-1a00-0000-860f-d82fc2080000 pid=2242->guuid=0ea63f59-1a00-0000-860f-d82fc2080000 pid=2248 clone guuid=0ea63f59-1a00-0000-860f-d82fc2080000 pid=2248->4f6baed0-9587-596c-82b3-fd721afe4cc1 send: 128B guuid=e630b360-1a00-0000-860f-d82fd3080000 pid=2259->4f6baed0-9587-596c-82b3-fd721afe4cc1 send: 128B guuid=af10e665-1a00-0000-860f-d82fdf080000 pid=2271->4f6baed0-9587-596c-82b3-fd721afe4cc1 send: 128B guuid=25c93869-1a00-0000-860f-d82fe4080000 pid=2287 /usr/bin/curl dns net send-data guuid=25c93869-1a00-0000-860f-d82fe4080000 pid=2276->guuid=25c93869-1a00-0000-860f-d82fe4080000 pid=2287 clone guuid=25c93869-1a00-0000-860f-d82fe4080000 pid=2287->4f6baed0-9587-596c-82b3-fd721afe4cc1 send: 128B guuid=c906d072-1a00-0000-860f-d82ff3080000 pid=2291->4f6baed0-9587-596c-82b3-fd721afe4cc1 send: 128B guuid=b532bb76-1a00-0000-860f-d82ffd080000 pid=2301->4f6baed0-9587-596c-82b3-fd721afe4cc1 send: 128B guuid=e74d947a-1a00-0000-860f-d82f04090000 pid=2315 /usr/bin/curl dns net send-data guuid=e74d947a-1a00-0000-860f-d82f04090000 pid=2308->guuid=e74d947a-1a00-0000-860f-d82f04090000 pid=2315 clone guuid=e74d947a-1a00-0000-860f-d82f04090000 pid=2315->4f6baed0-9587-596c-82b3-fd721afe4cc1 send: 128B guuid=404d7880-1a00-0000-860f-d82f16090000 pid=2326->4f6baed0-9587-596c-82b3-fd721afe4cc1 send: 128B guuid=e442e383-1a00-0000-860f-d82f1e090000 pid=2334->4f6baed0-9587-596c-82b3-fd721afe4cc1 send: 128B guuid=93bb2487-1a00-0000-860f-d82f24090000 pid=2350 /usr/bin/curl dns net send-data guuid=93bb2487-1a00-0000-860f-d82f24090000 pid=2340->guuid=93bb2487-1a00-0000-860f-d82f24090000 pid=2350 clone guuid=93bb2487-1a00-0000-860f-d82f24090000 pid=2350->4f6baed0-9587-596c-82b3-fd721afe4cc1 send: 128B guuid=43278b8d-1a00-0000-860f-d82f38090000 pid=2360->4f6baed0-9587-596c-82b3-fd721afe4cc1 send: 128B guuid=15406691-1a00-0000-860f-d82f42090000 pid=2370->4f6baed0-9587-596c-82b3-fd721afe4cc1 send: 128B guuid=faa32c94-1a00-0000-860f-d82f48090000 pid=2386 /usr/bin/curl dns net send-data guuid=faa32c94-1a00-0000-860f-d82f48090000 pid=2376->guuid=faa32c94-1a00-0000-860f-d82f48090000 pid=2386 clone guuid=faa32c94-1a00-0000-860f-d82f48090000 pid=2386->4f6baed0-9587-596c-82b3-fd721afe4cc1 send: 128B guuid=4a86679b-1a00-0000-860f-d82f5d090000 pid=2397->4f6baed0-9587-596c-82b3-fd721afe4cc1 send: 128B guuid=3929669f-1a00-0000-860f-d82f60090000 pid=2400->4f6baed0-9587-596c-82b3-fd721afe4cc1 send: 128B guuid=d87999a3-1a00-0000-860f-d82f66090000 pid=2417 /usr/bin/curl dns net send-data guuid=d87999a3-1a00-0000-860f-d82f66090000 pid=2406->guuid=d87999a3-1a00-0000-860f-d82f66090000 pid=2417 clone guuid=d87999a3-1a00-0000-860f-d82f66090000 pid=2417->4f6baed0-9587-596c-82b3-fd721afe4cc1 send: 128B guuid=e6a1d2ad-1a00-0000-860f-d82f7a090000 pid=2426->4f6baed0-9587-596c-82b3-fd721afe4cc1 send: 128B guuid=e9f834b3-1a00-0000-860f-d82f81090000 pid=2433->4f6baed0-9587-596c-82b3-fd721afe4cc1 send: 128B guuid=7dfca2b6-1a00-0000-860f-d82f86090000 pid=2441 /usr/bin/curl dns net send-data guuid=7dfca2b6-1a00-0000-860f-d82f86090000 pid=2438->guuid=7dfca2b6-1a00-0000-860f-d82f86090000 pid=2441 clone guuid=7dfca2b6-1a00-0000-860f-d82f86090000 pid=2441->4f6baed0-9587-596c-82b3-fd721afe4cc1 send: 128B guuid=bd9fdbbb-1a00-0000-860f-d82f8f090000 pid=2447->4f6baed0-9587-596c-82b3-fd721afe4cc1 send: 128B guuid=f95d9bc0-1a00-0000-860f-d82f97090000 pid=2455->4f6baed0-9587-596c-82b3-fd721afe4cc1 send: 128B guuid=3d5f97c7-1a00-0000-860f-d82fa2090000 pid=2470 /usr/bin/curl dns net send-data guuid=3d5f97c7-1a00-0000-860f-d82fa2090000 pid=2466->guuid=3d5f97c7-1a00-0000-860f-d82fa2090000 pid=2470 clone guuid=3d5f97c7-1a00-0000-860f-d82fa2090000 pid=2470->4f6baed0-9587-596c-82b3-fd721afe4cc1 send: 128B
Result
Malware family:
n/a
Score:
  4/10
Tags:
antivm discovery linux
Behaviour
Reads runtime system information
System Network Configuration Discovery
Writes file to tmp directory
Checks CPU configuration
Please note that we are no longer able to provide a coverage score for Virus Total.

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Comments