🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1469a7931d3da0258753eb7e758e08126895ccdb942d5e2dd3ed7a5e0889faf1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1469a7931d3da0258753eb7e758e08126895ccdb942d5e2dd3ed7a5e0889faf1
SHA3-384 hash: 3e16c8c166a491c0f2cf11b94ab4a64d7d7cea30bc72fa0e9560d253086322083546eb159352932d9dfe49aab4eef130
SHA1 hash: 58724066706c9c83364c286b1c12cc66555d4674
MD5 hash: bb17a9892cff44d80c98630133c5a335
humanhash: vermont-nuts-cardinal-mockingbird
File name:ok
Download: download sample
File size:1'608 bytes
First seen:2026-08-28 04:30:33 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 24:GDQDSNw4Ss0Jo39jNk9cIhFvPN2VSUp8NfraLb+RM:Gkkj39jNJILJ4+RM
TLSH T1043130DE541169311102CE8F73A3364CB19EB2FB2C4FD7E099590EA986883DCF162B5D
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://5.182.210.174/a2b412n/an/an/a
http://5.182.210.174/cc6fbfn/an/an/a
http://5.182.210.174/3776c6n/an/an/a
http://5.182.210.174/4e8b0dn/an/an/a
http://5.182.210.174/d4681fn/an/an/a
http://5.182.210.174/b553c7n/an/an/a
http://5.182.210.174/d1d1a3n/an/an/a
http://5.182.210.174/a68e38n/an/an/a
http://5.182.210.174/c16ea7n/an/an/a
http://5.182.210.174/057ea5n/an/an/a
http://5.182.210.174/ea6cf7n/an/an/a
http://5.182.210.174/da830cn/an/an/a

Intelligence

File Origin
# of uploads :
1
# of downloads :
82
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive mirai
Link:
https://www.filescan.io/uploads/6a910f11c570c6ac8b0adf5f/reports/09df821a-4ce8-4c59-b360-0102061b6728/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-08-28T02:12:00Z UTC
Last seen:
2026-08-29T20:13:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/1469a7931d3da0258753eb7e758e08126895ccdb942d5e2dd3ed7a5e0889faf1/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/a94dcf6d-8773-461a-94ff-f5b7341a7bce
Behavior Graph:
Download SVG
%3 guuid=83ed8329-1700-0000-aec3-6233d40d0000 pid=3540 /usr/bin/sudo guuid=1ea3392d-1700-0000-aec3-6233d50d0000 pid=3541 /tmp/sample.bin guuid=83ed8329-1700-0000-aec3-6233d40d0000 pid=3540->guuid=1ea3392d-1700-0000-aec3-6233d50d0000 pid=3541 execve guuid=6339422f-1700-0000-aec3-6233d90d0000 pid=3545 /usr/bin/wget net send-data guuid=1ea3392d-1700-0000-aec3-6233d50d0000 pid=3541->guuid=6339422f-1700-0000-aec3-6233d90d0000 pid=3545 execve guuid=2fc76835-1700-0000-aec3-6233e30d0000 pid=3555 /usr/bin/curl net send-data write-file guuid=1ea3392d-1700-0000-aec3-6233d50d0000 pid=3541->guuid=2fc76835-1700-0000-aec3-6233e30d0000 pid=3555 execve guuid=27e8453e-1700-0000-aec3-6233fb0d0000 pid=3579 /usr/bin/chmod guuid=1ea3392d-1700-0000-aec3-6233d50d0000 pid=3541->guuid=27e8453e-1700-0000-aec3-6233fb0d0000 pid=3579 execve guuid=0d51e23e-1700-0000-aec3-6233fe0d0000 pid=3582 /usr/bin/bash guuid=1ea3392d-1700-0000-aec3-6233d50d0000 pid=3541->guuid=0d51e23e-1700-0000-aec3-6233fe0d0000 pid=3582 clone guuid=44f12e3f-1700-0000-aec3-6233010e0000 pid=3585 /usr/bin/rm delete-file guuid=1ea3392d-1700-0000-aec3-6233d50d0000 pid=3541->guuid=44f12e3f-1700-0000-aec3-6233010e0000 pid=3585 execve guuid=0ff4723f-1700-0000-aec3-6233030e0000 pid=3587 /usr/bin/rm guuid=1ea3392d-1700-0000-aec3-6233d50d0000 pid=3541->guuid=0ff4723f-1700-0000-aec3-6233030e0000 pid=3587 execve guuid=fd73b63f-1700-0000-aec3-6233060e0000 pid=3590 /usr/bin/wget net send-data guuid=1ea3392d-1700-0000-aec3-6233d50d0000 pid=3541->guuid=fd73b63f-1700-0000-aec3-6233060e0000 pid=3590 execve guuid=fce76442-1700-0000-aec3-62330f0e0000 pid=3599 /usr/bin/curl net send-data write-file guuid=1ea3392d-1700-0000-aec3-6233d50d0000 pid=3541->guuid=fce76442-1700-0000-aec3-62330f0e0000 pid=3599 execve guuid=04435c46-1700-0000-aec3-62331e0e0000 pid=3614 /usr/bin/chmod guuid=1ea3392d-1700-0000-aec3-6233d50d0000 pid=3541->guuid=04435c46-1700-0000-aec3-62331e0e0000 pid=3614 execve guuid=eb78a846-1700-0000-aec3-6233200e0000 pid=3616 /usr/bin/bash guuid=1ea3392d-1700-0000-aec3-6233d50d0000 pid=3541->guuid=eb78a846-1700-0000-aec3-6233200e0000 pid=3616 clone guuid=9565f146-1700-0000-aec3-6233230e0000 pid=3619 /usr/bin/rm delete-file guuid=1ea3392d-1700-0000-aec3-6233d50d0000 pid=3541->guuid=9565f146-1700-0000-aec3-6233230e0000 pid=3619 execve guuid=b4005047-1700-0000-aec3-6233270e0000 pid=3623 /usr/bin/rm guuid=1ea3392d-1700-0000-aec3-6233d50d0000 pid=3541->guuid=b4005047-1700-0000-aec3-6233270e0000 pid=3623 execve guuid=a9a89647-1700-0000-aec3-62332b0e0000 pid=3627 /usr/bin/wget net send-data guuid=1ea3392d-1700-0000-aec3-6233d50d0000 pid=3541->guuid=a9a89647-1700-0000-aec3-62332b0e0000 pid=3627 execve guuid=15f61a4b-1700-0000-aec3-62333a0e0000 pid=3642 /usr/bin/curl net send-data write-file guuid=1ea3392d-1700-0000-aec3-6233d50d0000 pid=3541->guuid=15f61a4b-1700-0000-aec3-62333a0e0000 pid=3642 execve guuid=70ade54f-1700-0000-aec3-62334b0e0000 pid=3659 /usr/bin/chmod guuid=1ea3392d-1700-0000-aec3-6233d50d0000 pid=3541->guuid=70ade54f-1700-0000-aec3-62334b0e0000 pid=3659 execve guuid=3b5f2250-1700-0000-aec3-62334d0e0000 pid=3661 /usr/bin/bash guuid=1ea3392d-1700-0000-aec3-6233d50d0000 pid=3541->guuid=3b5f2250-1700-0000-aec3-62334d0e0000 pid=3661 clone guuid=86c34d50-1700-0000-aec3-62334f0e0000 pid=3663 /usr/bin/rm delete-file guuid=1ea3392d-1700-0000-aec3-6233d50d0000 pid=3541->guuid=86c34d50-1700-0000-aec3-62334f0e0000 pid=3663 execve guuid=1e459150-1700-0000-aec3-6233520e0000 pid=3666 /usr/bin/rm guuid=1ea3392d-1700-0000-aec3-6233d50d0000 pid=3541->guuid=1e459150-1700-0000-aec3-6233520e0000 pid=3666 execve guuid=ea41cb50-1700-0000-aec3-6233540e0000 pid=3668 /usr/bin/wget net send-data guuid=1ea3392d-1700-0000-aec3-6233d50d0000 pid=3541->guuid=ea41cb50-1700-0000-aec3-6233540e0000 pid=3668 execve guuid=92a22e53-1700-0000-aec3-6233640e0000 pid=3684 /usr/bin/curl net send-data write-file guuid=1ea3392d-1700-0000-aec3-6233d50d0000 pid=3541->guuid=92a22e53-1700-0000-aec3-6233640e0000 pid=3684 execve guuid=64335657-1700-0000-aec3-62337b0e0000 pid=3707 /usr/bin/chmod guuid=1ea3392d-1700-0000-aec3-6233d50d0000 pid=3541->guuid=64335657-1700-0000-aec3-62337b0e0000 pid=3707 execve guuid=58a3aa57-1700-0000-aec3-62337e0e0000 pid=3710 /usr/bin/bash guuid=1ea3392d-1700-0000-aec3-6233d50d0000 pid=3541->guuid=58a3aa57-1700-0000-aec3-62337e0e0000 pid=3710 clone guuid=90ff0958-1700-0000-aec3-6233820e0000 pid=3714 /usr/bin/rm delete-file guuid=1ea3392d-1700-0000-aec3-6233d50d0000 pid=3541->guuid=90ff0958-1700-0000-aec3-6233820e0000 pid=3714 execve guuid=24217058-1700-0000-aec3-6233850e0000 pid=3717 /usr/bin/rm guuid=1ea3392d-1700-0000-aec3-6233d50d0000 pid=3541->guuid=24217058-1700-0000-aec3-6233850e0000 pid=3717 execve guuid=9f40d958-1700-0000-aec3-6233870e0000 pid=3719 /usr/bin/wget net send-data guuid=1ea3392d-1700-0000-aec3-6233d50d0000 pid=3541->guuid=9f40d958-1700-0000-aec3-6233870e0000 pid=3719 execve guuid=41bce75b-1700-0000-aec3-6233930e0000 pid=3731 /usr/bin/curl net send-data write-file guuid=1ea3392d-1700-0000-aec3-6233d50d0000 pid=3541->guuid=41bce75b-1700-0000-aec3-6233930e0000 pid=3731 execve guuid=939ac462-1700-0000-aec3-6233ac0e0000 pid=3756 /usr/bin/chmod guuid=1ea3392d-1700-0000-aec3-6233d50d0000 pid=3541->guuid=939ac462-1700-0000-aec3-6233ac0e0000 pid=3756 execve guuid=02560e63-1700-0000-aec3-6233ae0e0000 pid=3758 /usr/bin/bash guuid=1ea3392d-1700-0000-aec3-6233d50d0000 pid=3541->guuid=02560e63-1700-0000-aec3-6233ae0e0000 pid=3758 clone guuid=1b1f5463-1700-0000-aec3-6233b10e0000 pid=3761 /usr/bin/rm delete-file guuid=1ea3392d-1700-0000-aec3-6233d50d0000 pid=3541->guuid=1b1f5463-1700-0000-aec3-6233b10e0000 pid=3761 execve guuid=ec6fbd63-1700-0000-aec3-6233b30e0000 pid=3763 /usr/bin/rm guuid=1ea3392d-1700-0000-aec3-6233d50d0000 pid=3541->guuid=ec6fbd63-1700-0000-aec3-6233b30e0000 pid=3763 execve guuid=04ec1264-1700-0000-aec3-6233b50e0000 pid=3765 /usr/bin/wget net send-data guuid=1ea3392d-1700-0000-aec3-6233d50d0000 pid=3541->guuid=04ec1264-1700-0000-aec3-6233b50e0000 pid=3765 execve guuid=27637e66-1700-0000-aec3-6233c10e0000 pid=3777 /usr/bin/curl net send-data write-file guuid=1ea3392d-1700-0000-aec3-6233d50d0000 pid=3541->guuid=27637e66-1700-0000-aec3-6233c10e0000 pid=3777 execve guuid=6660056a-1700-0000-aec3-6233cd0e0000 pid=3789 /usr/bin/chmod guuid=1ea3392d-1700-0000-aec3-6233d50d0000 pid=3541->guuid=6660056a-1700-0000-aec3-6233cd0e0000 pid=3789 execve guuid=d7743e6a-1700-0000-aec3-6233ce0e0000 pid=3790 /usr/bin/bash guuid=1ea3392d-1700-0000-aec3-6233d50d0000 pid=3541->guuid=d7743e6a-1700-0000-aec3-6233ce0e0000 pid=3790 clone guuid=5973c16a-1700-0000-aec3-6233d30e0000 pid=3795 /usr/bin/rm delete-file guuid=1ea3392d-1700-0000-aec3-6233d50d0000 pid=3541->guuid=5973c16a-1700-0000-aec3-6233d30e0000 pid=3795 execve guuid=3e72fc6a-1700-0000-aec3-6233d40e0000 pid=3796 /usr/bin/rm guuid=1ea3392d-1700-0000-aec3-6233d50d0000 pid=3541->guuid=3e72fc6a-1700-0000-aec3-6233d40e0000 pid=3796 execve guuid=da7e366b-1700-0000-aec3-6233d60e0000 pid=3798 /usr/bin/wget net send-data guuid=1ea3392d-1700-0000-aec3-6233d50d0000 pid=3541->guuid=da7e366b-1700-0000-aec3-6233d60e0000 pid=3798 execve guuid=74f8336f-1700-0000-aec3-6233de0e0000 pid=3806 /usr/bin/curl net send-data write-file guuid=1ea3392d-1700-0000-aec3-6233d50d0000 pid=3541->guuid=74f8336f-1700-0000-aec3-6233de0e0000 pid=3806 execve guuid=bea29174-1700-0000-aec3-6233e90e0000 pid=3817 /usr/bin/chmod guuid=1ea3392d-1700-0000-aec3-6233d50d0000 pid=3541->guuid=bea29174-1700-0000-aec3-6233e90e0000 pid=3817 execve guuid=9177ff74-1700-0000-aec3-6233ec0e0000 pid=3820 /usr/bin/bash guuid=1ea3392d-1700-0000-aec3-6233d50d0000 pid=3541->guuid=9177ff74-1700-0000-aec3-6233ec0e0000 pid=3820 clone guuid=7f792a76-1700-0000-aec3-6233f10e0000 pid=3825 /usr/bin/rm delete-file guuid=1ea3392d-1700-0000-aec3-6233d50d0000 pid=3541->guuid=7f792a76-1700-0000-aec3-6233f10e0000 pid=3825 execve guuid=19656e76-1700-0000-aec3-6233f30e0000 pid=3827 /usr/bin/rm guuid=1ea3392d-1700-0000-aec3-6233d50d0000 pid=3541->guuid=19656e76-1700-0000-aec3-6233f30e0000 pid=3827 execve guuid=138db176-1700-0000-aec3-6233f50e0000 pid=3829 /usr/bin/wget net send-data guuid=1ea3392d-1700-0000-aec3-6233d50d0000 pid=3541->guuid=138db176-1700-0000-aec3-6233f50e0000 pid=3829 execve guuid=4c776c7c-1700-0000-aec3-6233000f0000 pid=3840 /usr/bin/curl net send-data write-file guuid=1ea3392d-1700-0000-aec3-6233d50d0000 pid=3541->guuid=4c776c7c-1700-0000-aec3-6233000f0000 pid=3840 execve guuid=a70b6684-1700-0000-aec3-6233210f0000 pid=3873 /usr/bin/chmod guuid=1ea3392d-1700-0000-aec3-6233d50d0000 pid=3541->guuid=a70b6684-1700-0000-aec3-6233210f0000 pid=3873 execve guuid=bc0adb84-1700-0000-aec3-6233240f0000 pid=3876 /usr/bin/bash guuid=1ea3392d-1700-0000-aec3-6233d50d0000 pid=3541->guuid=bc0adb84-1700-0000-aec3-6233240f0000 pid=3876 clone guuid=12e53685-1700-0000-aec3-6233280f0000 pid=3880 /usr/bin/rm delete-file guuid=1ea3392d-1700-0000-aec3-6233d50d0000 pid=3541->guuid=12e53685-1700-0000-aec3-6233280f0000 pid=3880 execve guuid=5cfb9685-1700-0000-aec3-62332a0f0000 pid=3882 /usr/bin/rm guuid=1ea3392d-1700-0000-aec3-6233d50d0000 pid=3541->guuid=5cfb9685-1700-0000-aec3-62332a0f0000 pid=3882 execve guuid=2d73da85-1700-0000-aec3-62332d0f0000 pid=3885 /usr/bin/wget net send-data guuid=1ea3392d-1700-0000-aec3-6233d50d0000 pid=3541->guuid=2d73da85-1700-0000-aec3-62332d0f0000 pid=3885 execve guuid=b52ac789-1700-0000-aec3-6233400f0000 pid=3904 /usr/bin/curl net send-data write-file guuid=1ea3392d-1700-0000-aec3-6233d50d0000 pid=3541->guuid=b52ac789-1700-0000-aec3-6233400f0000 pid=3904 execve guuid=004c828e-1700-0000-aec3-6233580f0000 pid=3928 /usr/bin/chmod guuid=1ea3392d-1700-0000-aec3-6233d50d0000 pid=3541->guuid=004c828e-1700-0000-aec3-6233580f0000 pid=3928 execve guuid=08acbb8e-1700-0000-aec3-62335a0f0000 pid=3930 /usr/bin/bash guuid=1ea3392d-1700-0000-aec3-6233d50d0000 pid=3541->guuid=08acbb8e-1700-0000-aec3-62335a0f0000 pid=3930 clone guuid=4a10f78e-1700-0000-aec3-62335f0f0000 pid=3935 /usr/bin/rm delete-file guuid=1ea3392d-1700-0000-aec3-6233d50d0000 pid=3541->guuid=4a10f78e-1700-0000-aec3-62335f0f0000 pid=3935 execve guuid=0fe7378f-1700-0000-aec3-6233600f0000 pid=3936 /usr/bin/rm guuid=1ea3392d-1700-0000-aec3-6233d50d0000 pid=3541->guuid=0fe7378f-1700-0000-aec3-6233600f0000 pid=3936 execve guuid=dba0768f-1700-0000-aec3-6233610f0000 pid=3937 /usr/bin/wget net send-data guuid=1ea3392d-1700-0000-aec3-6233d50d0000 pid=3541->guuid=dba0768f-1700-0000-aec3-6233610f0000 pid=3937 execve guuid=f0cfd891-1700-0000-aec3-62336c0f0000 pid=3948 /usr/bin/curl net send-data write-file guuid=1ea3392d-1700-0000-aec3-6233d50d0000 pid=3541->guuid=f0cfd891-1700-0000-aec3-62336c0f0000 pid=3948 execve guuid=5abcf298-1700-0000-aec3-6233830f0000 pid=3971 /usr/bin/chmod guuid=1ea3392d-1700-0000-aec3-6233d50d0000 pid=3541->guuid=5abcf298-1700-0000-aec3-6233830f0000 pid=3971 execve guuid=f64e4499-1700-0000-aec3-6233850f0000 pid=3973 /usr/bin/bash guuid=1ea3392d-1700-0000-aec3-6233d50d0000 pid=3541->guuid=f64e4499-1700-0000-aec3-6233850f0000 pid=3973 clone guuid=4e389599-1700-0000-aec3-6233890f0000 pid=3977 /usr/bin/rm delete-file guuid=1ea3392d-1700-0000-aec3-6233d50d0000 pid=3541->guuid=4e389599-1700-0000-aec3-6233890f0000 pid=3977 execve guuid=e8f5dd99-1700-0000-aec3-62338b0f0000 pid=3979 /usr/bin/rm guuid=1ea3392d-1700-0000-aec3-6233d50d0000 pid=3541->guuid=e8f5dd99-1700-0000-aec3-62338b0f0000 pid=3979 execve guuid=bc73419a-1700-0000-aec3-62338f0f0000 pid=3983 /usr/bin/wget net send-data guuid=1ea3392d-1700-0000-aec3-6233d50d0000 pid=3541->guuid=bc73419a-1700-0000-aec3-62338f0f0000 pid=3983 execve guuid=4b6a689d-1700-0000-aec3-6233980f0000 pid=3992 /usr/bin/curl net send-data write-file guuid=1ea3392d-1700-0000-aec3-6233d50d0000 pid=3541->guuid=4b6a689d-1700-0000-aec3-6233980f0000 pid=3992 execve guuid=a2e17ba1-1700-0000-aec3-6233a90f0000 pid=4009 /usr/bin/chmod guuid=1ea3392d-1700-0000-aec3-6233d50d0000 pid=3541->guuid=a2e17ba1-1700-0000-aec3-6233a90f0000 pid=4009 execve guuid=00dfe9a1-1700-0000-aec3-6233aa0f0000 pid=4010 /usr/bin/bash guuid=1ea3392d-1700-0000-aec3-6233d50d0000 pid=3541->guuid=00dfe9a1-1700-0000-aec3-6233aa0f0000 pid=4010 clone guuid=303936a2-1700-0000-aec3-6233ad0f0000 pid=4013 /usr/bin/rm delete-file guuid=1ea3392d-1700-0000-aec3-6233d50d0000 pid=3541->guuid=303936a2-1700-0000-aec3-6233ad0f0000 pid=4013 execve guuid=832286a2-1700-0000-aec3-6233af0f0000 pid=4015 /usr/bin/rm guuid=1ea3392d-1700-0000-aec3-6233d50d0000 pid=3541->guuid=832286a2-1700-0000-aec3-6233af0f0000 pid=4015 execve guuid=e286d2a2-1700-0000-aec3-6233b10f0000 pid=4017 /usr/bin/wget net send-data guuid=1ea3392d-1700-0000-aec3-6233d50d0000 pid=3541->guuid=e286d2a2-1700-0000-aec3-6233b10f0000 pid=4017 execve guuid=5dd791a5-1700-0000-aec3-6233bd0f0000 pid=4029 /usr/bin/curl net send-data write-file guuid=1ea3392d-1700-0000-aec3-6233d50d0000 pid=3541->guuid=5dd791a5-1700-0000-aec3-6233bd0f0000 pid=4029 execve guuid=299a8daa-1700-0000-aec3-6233cc0f0000 pid=4044 /usr/bin/chmod guuid=1ea3392d-1700-0000-aec3-6233d50d0000 pid=3541->guuid=299a8daa-1700-0000-aec3-6233cc0f0000 pid=4044 execve guuid=0473e2aa-1700-0000-aec3-6233cd0f0000 pid=4045 /usr/bin/bash guuid=1ea3392d-1700-0000-aec3-6233d50d0000 pid=3541->guuid=0473e2aa-1700-0000-aec3-6233cd0f0000 pid=4045 clone guuid=6fba23ab-1700-0000-aec3-6233d00f0000 pid=4048 /usr/bin/rm delete-file guuid=1ea3392d-1700-0000-aec3-6233d50d0000 pid=3541->guuid=6fba23ab-1700-0000-aec3-6233d00f0000 pid=4048 execve guuid=dfbb75ab-1700-0000-aec3-6233d20f0000 pid=4050 /usr/bin/rm guuid=1ea3392d-1700-0000-aec3-6233d50d0000 pid=3541->guuid=dfbb75ab-1700-0000-aec3-6233d20f0000 pid=4050 execve 5b654972-c9e1-50d8-b372-2dc2a5b9ad66 5.182.210.174:80 guuid=6339422f-1700-0000-aec3-6233d90d0000 pid=3545->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=2fc76835-1700-0000-aec3-6233e30d0000 pid=3555->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=b21d013f-1700-0000-aec3-6233ff0d0000 pid=3583 /usr/bin/bash guuid=0d51e23e-1700-0000-aec3-6233fe0d0000 pid=3582->guuid=b21d013f-1700-0000-aec3-6233ff0d0000 pid=3583 clone guuid=fd73b63f-1700-0000-aec3-6233060e0000 pid=3590->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=fce76442-1700-0000-aec3-62330f0e0000 pid=3599->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=24fdc246-1700-0000-aec3-6233210e0000 pid=3617 /usr/bin/bash guuid=eb78a846-1700-0000-aec3-6233200e0000 pid=3616->guuid=24fdc246-1700-0000-aec3-6233210e0000 pid=3617 clone guuid=a9a89647-1700-0000-aec3-62332b0e0000 pid=3627->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=15f61a4b-1700-0000-aec3-62333a0e0000 pid=3642->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=df793550-1700-0000-aec3-62334e0e0000 pid=3662 /usr/bin/bash guuid=3b5f2250-1700-0000-aec3-62334d0e0000 pid=3661->guuid=df793550-1700-0000-aec3-62334e0e0000 pid=3662 clone guuid=ea41cb50-1700-0000-aec3-6233540e0000 pid=3668->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=92a22e53-1700-0000-aec3-6233640e0000 pid=3684->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=d70bd057-1700-0000-aec3-62337f0e0000 pid=3711 /usr/bin/bash guuid=58a3aa57-1700-0000-aec3-62337e0e0000 pid=3710->guuid=d70bd057-1700-0000-aec3-62337f0e0000 pid=3711 clone guuid=9f40d958-1700-0000-aec3-6233870e0000 pid=3719->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=41bce75b-1700-0000-aec3-6233930e0000 pid=3731->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=aa782a63-1700-0000-aec3-6233b00e0000 pid=3760 /usr/bin/bash guuid=02560e63-1700-0000-aec3-6233ae0e0000 pid=3758->guuid=aa782a63-1700-0000-aec3-6233b00e0000 pid=3760 clone guuid=04ec1264-1700-0000-aec3-6233b50e0000 pid=3765->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=27637e66-1700-0000-aec3-6233c10e0000 pid=3777->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=6fcb686a-1700-0000-aec3-6233d20e0000 pid=3794 /usr/bin/bash guuid=d7743e6a-1700-0000-aec3-6233ce0e0000 pid=3790->guuid=6fcb686a-1700-0000-aec3-6233d20e0000 pid=3794 clone guuid=da7e366b-1700-0000-aec3-6233d60e0000 pid=3798->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=74f8336f-1700-0000-aec3-6233de0e0000 pid=3806->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=e7250a76-1700-0000-aec3-6233f00e0000 pid=3824 /usr/bin/bash guuid=9177ff74-1700-0000-aec3-6233ec0e0000 pid=3820->guuid=e7250a76-1700-0000-aec3-6233f00e0000 pid=3824 clone guuid=138db176-1700-0000-aec3-6233f50e0000 pid=3829->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=4c776c7c-1700-0000-aec3-6233000f0000 pid=3840->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=80cd0b85-1700-0000-aec3-6233260f0000 pid=3878 /usr/bin/bash guuid=bc0adb84-1700-0000-aec3-6233240f0000 pid=3876->guuid=80cd0b85-1700-0000-aec3-6233260f0000 pid=3878 clone guuid=2d73da85-1700-0000-aec3-62332d0f0000 pid=3885->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=b52ac789-1700-0000-aec3-6233400f0000 pid=3904->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=919cd48e-1700-0000-aec3-62335d0f0000 pid=3933 /usr/bin/bash guuid=08acbb8e-1700-0000-aec3-62335a0f0000 pid=3930->guuid=919cd48e-1700-0000-aec3-62335d0f0000 pid=3933 clone guuid=dba0768f-1700-0000-aec3-6233610f0000 pid=3937->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=f0cfd891-1700-0000-aec3-62336c0f0000 pid=3948->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=eb446299-1700-0000-aec3-6233860f0000 pid=3974 /usr/bin/bash guuid=f64e4499-1700-0000-aec3-6233850f0000 pid=3973->guuid=eb446299-1700-0000-aec3-6233860f0000 pid=3974 clone guuid=bc73419a-1700-0000-aec3-62338f0f0000 pid=3983->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=4b6a689d-1700-0000-aec3-6233980f0000 pid=3992->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=9bae06a2-1700-0000-aec3-6233ac0f0000 pid=4012 /usr/bin/bash guuid=00dfe9a1-1700-0000-aec3-6233aa0f0000 pid=4010->guuid=9bae06a2-1700-0000-aec3-6233ac0f0000 pid=4012 clone guuid=e286d2a2-1700-0000-aec3-6233b10f0000 pid=4017->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=5dd791a5-1700-0000-aec3-6233bd0f0000 pid=4029->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=2337ffaa-1700-0000-aec3-6233cf0f0000 pid=4047 /usr/bin/bash guuid=0473e2aa-1700-0000-aec3-6233cd0f0000 pid=4045->guuid=2337ffaa-1700-0000-aec3-6233cf0f0000 pid=4047 clone
Score:
99%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/1469a7931d3da0258753eb7e758e08126895ccdb942d5e2dd3ed7a5e0889faf1
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1469a7931d3da0258753eb7e758e08126895ccdb942d5e2dd3ed7a5e0889faf1/
Threat name:
Linux.Trojan.Multiverze
Create hunting rule
Status:
Malicious
First seen:
2026-08-28 04:31:18 UTC
File Type:
Text (Shell)
AV detection:
12 of 23 (52.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=cru2pey5hwqclb2t5n7hldqicjujltg3sqwv4lot5v5f4cej7lyq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260828-e5g1tssyes/
Behaviour
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.11
Link:
https://yomi.yoroi.company/submissions/1469a7931d3da0258753eb7e758e08126895ccdb942d5e2dd3ed7a5e0889faf1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 1469a7931d3da0258753eb7e758e08126895ccdb942d5e2dd3ed7a5e0889faf1

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3897671/
  
Delivery method
Distributed via web download

Comments