🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 14a0c3c28384e040fcf9317dacd5400b9cecd9bdde92fff5f242671fab246a98. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 14a0c3c28384e040fcf9317dacd5400b9cecd9bdde92fff5f242671fab246a98
SHA3-384 hash: 81a0f644e546a1f56e513ba2a9b1a29b5f6cc475c53236b2c1c5fe3a7b443b18f42b523b6bc4a6bfaf3abe785d2b679e
SHA1 hash: 7462a5ce8de9b2f2180f1711c0a2e3842240612b
MD5 hash: 2970988d94b0a67f2d1934939f84e321
humanhash: batman-lithium-gee-quebec
File name:p
Download: download sample
File size:835 bytes
First seen:2026-08-09 02:09:58 UTC
Last seen:2026-08-09 19:16:26 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 24:kXCKysE2hi0ziQvZoha5vqj/Q80FRzMvmU7:e9Qp+Ms5v+/QFS+U7
TLSH T188016BC6E3209910406A985E26E66690B470C3C7094A0B7C7FDCD53DBB88E14B13AF84
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://129.121.110.105/86Dn/an/aua-wget
http://129.121.110.105/aWGn/an/aua-wget
http://129.121.110.105/tbWn/an/aua-wget
http://129.121.110.105/VFgin/an/aua-wget
http://129.121.110.105/OLE5n/an/aua-wget

Intelligence

File Origin
# of uploads :
3
# of downloads :
65
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive mirai
Link:
https://www.filescan.io/uploads/6a77e19e9f3e9247f17b4f41/reports/9e47a792-bb6d-49c5-8ea2-90cc62b4f2cf/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-08-09T00:21:00Z UTC
Last seen:
2026-08-10T21:22:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/14a0c3c28384e040fcf9317dacd5400b9cecd9bdde92fff5f242671fab246a98/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/f0b2abab-6428-40ba-91e6-07fb51f8ed4a
Behavior Graph:
Download SVG
%3 guuid=f18a05f9-1600-0000-7d5a-3ecd3a0c0000 pid=3130 /usr/bin/sudo guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135 /tmp/sample.bin write-file guuid=f18a05f9-1600-0000-7d5a-3ecd3a0c0000 pid=3130->guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135 execve guuid=7c5eeffc-1600-0000-7d5a-3ecd400c0000 pid=3136 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=7c5eeffc-1600-0000-7d5a-3ecd400c0000 pid=3136 execve guuid=3e3ea7fd-1600-0000-7d5a-3ecd410c0000 pid=3137 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=3e3ea7fd-1600-0000-7d5a-3ecd410c0000 pid=3137 execve guuid=913720fe-1600-0000-7d5a-3ecd420c0000 pid=3138 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=913720fe-1600-0000-7d5a-3ecd420c0000 pid=3138 execve guuid=b19a98fe-1600-0000-7d5a-3ecd430c0000 pid=3139 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=b19a98fe-1600-0000-7d5a-3ecd430c0000 pid=3139 execve guuid=f02408ff-1600-0000-7d5a-3ecd440c0000 pid=3140 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=f02408ff-1600-0000-7d5a-3ecd440c0000 pid=3140 execve guuid=747077ff-1600-0000-7d5a-3ecd450c0000 pid=3141 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=747077ff-1600-0000-7d5a-3ecd450c0000 pid=3141 execve guuid=bdf6f3ff-1600-0000-7d5a-3ecd460c0000 pid=3142 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=bdf6f3ff-1600-0000-7d5a-3ecd460c0000 pid=3142 execve guuid=fca86a00-1700-0000-7d5a-3ecd470c0000 pid=3143 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=fca86a00-1700-0000-7d5a-3ecd470c0000 pid=3143 execve guuid=204ada00-1700-0000-7d5a-3ecd480c0000 pid=3144 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=204ada00-1700-0000-7d5a-3ecd480c0000 pid=3144 execve guuid=3e804701-1700-0000-7d5a-3ecd490c0000 pid=3145 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=3e804701-1700-0000-7d5a-3ecd490c0000 pid=3145 execve guuid=8870b801-1700-0000-7d5a-3ecd4a0c0000 pid=3146 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=8870b801-1700-0000-7d5a-3ecd4a0c0000 pid=3146 execve guuid=4fcd2d02-1700-0000-7d5a-3ecd4b0c0000 pid=3147 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=4fcd2d02-1700-0000-7d5a-3ecd4b0c0000 pid=3147 execve guuid=3ee6b502-1700-0000-7d5a-3ecd4d0c0000 pid=3149 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=3ee6b502-1700-0000-7d5a-3ecd4d0c0000 pid=3149 execve guuid=4aca3303-1700-0000-7d5a-3ecd4e0c0000 pid=3150 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=4aca3303-1700-0000-7d5a-3ecd4e0c0000 pid=3150 execve guuid=c2daa403-1700-0000-7d5a-3ecd4f0c0000 pid=3151 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=c2daa403-1700-0000-7d5a-3ecd4f0c0000 pid=3151 execve guuid=e7216204-1700-0000-7d5a-3ecd500c0000 pid=3152 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=e7216204-1700-0000-7d5a-3ecd500c0000 pid=3152 execve guuid=d977dc04-1700-0000-7d5a-3ecd530c0000 pid=3155 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=d977dc04-1700-0000-7d5a-3ecd530c0000 pid=3155 execve guuid=87785105-1700-0000-7d5a-3ecd550c0000 pid=3157 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=87785105-1700-0000-7d5a-3ecd550c0000 pid=3157 execve guuid=d092b005-1700-0000-7d5a-3ecd580c0000 pid=3160 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=d092b005-1700-0000-7d5a-3ecd580c0000 pid=3160 execve guuid=98c01106-1700-0000-7d5a-3ecd5b0c0000 pid=3163 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=98c01106-1700-0000-7d5a-3ecd5b0c0000 pid=3163 execve guuid=4bba6806-1700-0000-7d5a-3ecd5d0c0000 pid=3165 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=4bba6806-1700-0000-7d5a-3ecd5d0c0000 pid=3165 execve guuid=54cfc906-1700-0000-7d5a-3ecd600c0000 pid=3168 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=54cfc906-1700-0000-7d5a-3ecd600c0000 pid=3168 execve guuid=73092b07-1700-0000-7d5a-3ecd620c0000 pid=3170 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=73092b07-1700-0000-7d5a-3ecd620c0000 pid=3170 execve guuid=3894d307-1700-0000-7d5a-3ecd660c0000 pid=3174 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=3894d307-1700-0000-7d5a-3ecd660c0000 pid=3174 execve guuid=8f403c08-1700-0000-7d5a-3ecd690c0000 pid=3177 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=8f403c08-1700-0000-7d5a-3ecd690c0000 pid=3177 execve guuid=b3200709-1700-0000-7d5a-3ecd6c0c0000 pid=3180 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=b3200709-1700-0000-7d5a-3ecd6c0c0000 pid=3180 execve guuid=cffa7309-1700-0000-7d5a-3ecd6e0c0000 pid=3182 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=cffa7309-1700-0000-7d5a-3ecd6e0c0000 pid=3182 execve guuid=ec58e809-1700-0000-7d5a-3ecd6f0c0000 pid=3183 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=ec58e809-1700-0000-7d5a-3ecd6f0c0000 pid=3183 execve guuid=7793760a-1700-0000-7d5a-3ecd700c0000 pid=3184 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=7793760a-1700-0000-7d5a-3ecd700c0000 pid=3184 execve guuid=070d010b-1700-0000-7d5a-3ecd710c0000 pid=3185 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=070d010b-1700-0000-7d5a-3ecd710c0000 pid=3185 execve guuid=dacc740b-1700-0000-7d5a-3ecd730c0000 pid=3187 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=dacc740b-1700-0000-7d5a-3ecd730c0000 pid=3187 execve guuid=dbc0da0b-1700-0000-7d5a-3ecd750c0000 pid=3189 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=dbc0da0b-1700-0000-7d5a-3ecd750c0000 pid=3189 execve guuid=7cdc420c-1700-0000-7d5a-3ecd780c0000 pid=3192 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=7cdc420c-1700-0000-7d5a-3ecd780c0000 pid=3192 execve guuid=b2abbf0c-1700-0000-7d5a-3ecd7a0c0000 pid=3194 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=b2abbf0c-1700-0000-7d5a-3ecd7a0c0000 pid=3194 execve guuid=1ef5df0d-1700-0000-7d5a-3ecd7f0c0000 pid=3199 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=1ef5df0d-1700-0000-7d5a-3ecd7f0c0000 pid=3199 execve guuid=f8fc890e-1700-0000-7d5a-3ecd820c0000 pid=3202 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=f8fc890e-1700-0000-7d5a-3ecd820c0000 pid=3202 execve guuid=a9fe220f-1700-0000-7d5a-3ecd840c0000 pid=3204 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=a9fe220f-1700-0000-7d5a-3ecd840c0000 pid=3204 execve guuid=cbcab30f-1700-0000-7d5a-3ecd870c0000 pid=3207 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=cbcab30f-1700-0000-7d5a-3ecd870c0000 pid=3207 execve guuid=50604610-1700-0000-7d5a-3ecd8a0c0000 pid=3210 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=50604610-1700-0000-7d5a-3ecd8a0c0000 pid=3210 execve guuid=2289dc10-1700-0000-7d5a-3ecd8c0c0000 pid=3212 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=2289dc10-1700-0000-7d5a-3ecd8c0c0000 pid=3212 execve guuid=cf108511-1700-0000-7d5a-3ecd8e0c0000 pid=3214 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=cf108511-1700-0000-7d5a-3ecd8e0c0000 pid=3214 execve guuid=6f192012-1700-0000-7d5a-3ecd8f0c0000 pid=3215 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=6f192012-1700-0000-7d5a-3ecd8f0c0000 pid=3215 execve guuid=c2139212-1700-0000-7d5a-3ecd900c0000 pid=3216 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=c2139212-1700-0000-7d5a-3ecd900c0000 pid=3216 execve guuid=4b55fd12-1700-0000-7d5a-3ecd910c0000 pid=3217 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=4b55fd12-1700-0000-7d5a-3ecd910c0000 pid=3217 execve guuid=7d2a6613-1700-0000-7d5a-3ecd920c0000 pid=3218 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=7d2a6613-1700-0000-7d5a-3ecd920c0000 pid=3218 execve guuid=7814c413-1700-0000-7d5a-3ecd930c0000 pid=3219 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=7814c413-1700-0000-7d5a-3ecd930c0000 pid=3219 execve guuid=b3af4514-1700-0000-7d5a-3ecd950c0000 pid=3221 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=b3af4514-1700-0000-7d5a-3ecd950c0000 pid=3221 execve guuid=2255f214-1700-0000-7d5a-3ecd960c0000 pid=3222 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=2255f214-1700-0000-7d5a-3ecd960c0000 pid=3222 execve guuid=72057015-1700-0000-7d5a-3ecd970c0000 pid=3223 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=72057015-1700-0000-7d5a-3ecd970c0000 pid=3223 execve guuid=2bbdcf15-1700-0000-7d5a-3ecd990c0000 pid=3225 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=2bbdcf15-1700-0000-7d5a-3ecd990c0000 pid=3225 execve guuid=794b2f16-1700-0000-7d5a-3ecd9c0c0000 pid=3228 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=794b2f16-1700-0000-7d5a-3ecd9c0c0000 pid=3228 execve guuid=97238516-1700-0000-7d5a-3ecd9e0c0000 pid=3230 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=97238516-1700-0000-7d5a-3ecd9e0c0000 pid=3230 execve guuid=e85ae616-1700-0000-7d5a-3ecda10c0000 pid=3233 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=e85ae616-1700-0000-7d5a-3ecda10c0000 pid=3233 execve guuid=80a04217-1700-0000-7d5a-3ecda20c0000 pid=3234 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=80a04217-1700-0000-7d5a-3ecda20c0000 pid=3234 execve guuid=6a15a617-1700-0000-7d5a-3ecda40c0000 pid=3236 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=6a15a617-1700-0000-7d5a-3ecda40c0000 pid=3236 execve guuid=f7451718-1700-0000-7d5a-3ecda50c0000 pid=3237 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=f7451718-1700-0000-7d5a-3ecda50c0000 pid=3237 execve guuid=b5258618-1700-0000-7d5a-3ecda60c0000 pid=3238 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=b5258618-1700-0000-7d5a-3ecda60c0000 pid=3238 execve guuid=99f9ea18-1700-0000-7d5a-3ecda80c0000 pid=3240 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=99f9ea18-1700-0000-7d5a-3ecda80c0000 pid=3240 execve guuid=1ff35219-1700-0000-7d5a-3ecdaa0c0000 pid=3242 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=1ff35219-1700-0000-7d5a-3ecdaa0c0000 pid=3242 execve guuid=5b45b819-1700-0000-7d5a-3ecdad0c0000 pid=3245 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=5b45b819-1700-0000-7d5a-3ecdad0c0000 pid=3245 execve guuid=afb7101a-1700-0000-7d5a-3ecdb00c0000 pid=3248 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=afb7101a-1700-0000-7d5a-3ecdb00c0000 pid=3248 execve guuid=4c466b1a-1700-0000-7d5a-3ecdb20c0000 pid=3250 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=4c466b1a-1700-0000-7d5a-3ecdb20c0000 pid=3250 execve guuid=b9c3ce1a-1700-0000-7d5a-3ecdb50c0000 pid=3253 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=b9c3ce1a-1700-0000-7d5a-3ecdb50c0000 pid=3253 execve guuid=e608301b-1700-0000-7d5a-3ecdb80c0000 pid=3256 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=e608301b-1700-0000-7d5a-3ecdb80c0000 pid=3256 execve guuid=bc73861b-1700-0000-7d5a-3ecdba0c0000 pid=3258 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=bc73861b-1700-0000-7d5a-3ecdba0c0000 pid=3258 execve guuid=7ac0df1b-1700-0000-7d5a-3ecdbd0c0000 pid=3261 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=7ac0df1b-1700-0000-7d5a-3ecdbd0c0000 pid=3261 execve guuid=faca3b1c-1700-0000-7d5a-3ecdbf0c0000 pid=3263 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=faca3b1c-1700-0000-7d5a-3ecdbf0c0000 pid=3263 execve guuid=ea61961c-1700-0000-7d5a-3ecdc10c0000 pid=3265 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=ea61961c-1700-0000-7d5a-3ecdc10c0000 pid=3265 execve guuid=1a16f21c-1700-0000-7d5a-3ecdc40c0000 pid=3268 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=1a16f21c-1700-0000-7d5a-3ecdc40c0000 pid=3268 execve guuid=3770541d-1700-0000-7d5a-3ecdc60c0000 pid=3270 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=3770541d-1700-0000-7d5a-3ecdc60c0000 pid=3270 execve guuid=e599ad1d-1700-0000-7d5a-3ecdc70c0000 pid=3271 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=e599ad1d-1700-0000-7d5a-3ecdc70c0000 pid=3271 execve guuid=0c0e0a1e-1700-0000-7d5a-3ecdc90c0000 pid=3273 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=0c0e0a1e-1700-0000-7d5a-3ecdc90c0000 pid=3273 execve guuid=6bab921e-1700-0000-7d5a-3ecdcb0c0000 pid=3275 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=6bab921e-1700-0000-7d5a-3ecdcb0c0000 pid=3275 execve guuid=2f701a1f-1700-0000-7d5a-3ecdcd0c0000 pid=3277 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=2f701a1f-1700-0000-7d5a-3ecdcd0c0000 pid=3277 execve guuid=f0aaa81f-1700-0000-7d5a-3ecdcf0c0000 pid=3279 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=f0aaa81f-1700-0000-7d5a-3ecdcf0c0000 pid=3279 execve guuid=e2f13a20-1700-0000-7d5a-3ecdd10c0000 pid=3281 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=e2f13a20-1700-0000-7d5a-3ecdd10c0000 pid=3281 execve guuid=a11ac620-1700-0000-7d5a-3ecdd30c0000 pid=3283 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=a11ac620-1700-0000-7d5a-3ecdd30c0000 pid=3283 execve guuid=c8a84c21-1700-0000-7d5a-3ecdd40c0000 pid=3284 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=c8a84c21-1700-0000-7d5a-3ecdd40c0000 pid=3284 execve guuid=02b4b821-1700-0000-7d5a-3ecdd50c0000 pid=3285 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=02b4b821-1700-0000-7d5a-3ecdd50c0000 pid=3285 execve guuid=64e53822-1700-0000-7d5a-3ecdd60c0000 pid=3286 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=64e53822-1700-0000-7d5a-3ecdd60c0000 pid=3286 execve guuid=da20ba22-1700-0000-7d5a-3ecdd70c0000 pid=3287 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=da20ba22-1700-0000-7d5a-3ecdd70c0000 pid=3287 execve guuid=e03e3d23-1700-0000-7d5a-3ecdd80c0000 pid=3288 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=e03e3d23-1700-0000-7d5a-3ecdd80c0000 pid=3288 execve guuid=f51fdf23-1700-0000-7d5a-3ecdd90c0000 pid=3289 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=f51fdf23-1700-0000-7d5a-3ecdd90c0000 pid=3289 execve guuid=0e168224-1700-0000-7d5a-3ecdda0c0000 pid=3290 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=0e168224-1700-0000-7d5a-3ecdda0c0000 pid=3290 execve guuid=cd31f524-1700-0000-7d5a-3ecddb0c0000 pid=3291 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=cd31f524-1700-0000-7d5a-3ecddb0c0000 pid=3291 execve guuid=40078125-1700-0000-7d5a-3ecddc0c0000 pid=3292 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=40078125-1700-0000-7d5a-3ecddc0c0000 pid=3292 execve guuid=1f77f525-1700-0000-7d5a-3ecddd0c0000 pid=3293 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=1f77f525-1700-0000-7d5a-3ecddd0c0000 pid=3293 execve guuid=3f545e26-1700-0000-7d5a-3ecdde0c0000 pid=3294 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=3f545e26-1700-0000-7d5a-3ecdde0c0000 pid=3294 execve guuid=b43fe726-1700-0000-7d5a-3ecddf0c0000 pid=3295 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=b43fe726-1700-0000-7d5a-3ecddf0c0000 pid=3295 execve guuid=ede25627-1700-0000-7d5a-3ecde00c0000 pid=3296 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=ede25627-1700-0000-7d5a-3ecde00c0000 pid=3296 execve guuid=2d55bc27-1700-0000-7d5a-3ecde10c0000 pid=3297 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=2d55bc27-1700-0000-7d5a-3ecde10c0000 pid=3297 execve guuid=ec175128-1700-0000-7d5a-3ecde20c0000 pid=3298 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=ec175128-1700-0000-7d5a-3ecde20c0000 pid=3298 execve guuid=5af8de28-1700-0000-7d5a-3ecde30c0000 pid=3299 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=5af8de28-1700-0000-7d5a-3ecde30c0000 pid=3299 execve guuid=15e95e29-1700-0000-7d5a-3ecde40c0000 pid=3300 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=15e95e29-1700-0000-7d5a-3ecde40c0000 pid=3300 execve guuid=146afd29-1700-0000-7d5a-3ecde50c0000 pid=3301 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=146afd29-1700-0000-7d5a-3ecde50c0000 pid=3301 execve guuid=9d337a2a-1700-0000-7d5a-3ecde60c0000 pid=3302 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=9d337a2a-1700-0000-7d5a-3ecde60c0000 pid=3302 execve guuid=ed2a062b-1700-0000-7d5a-3ecde70c0000 pid=3303 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=ed2a062b-1700-0000-7d5a-3ecde70c0000 pid=3303 execve guuid=e9d5912b-1700-0000-7d5a-3ecde80c0000 pid=3304 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=e9d5912b-1700-0000-7d5a-3ecde80c0000 pid=3304 execve guuid=2fb0f72b-1700-0000-7d5a-3ecde90c0000 pid=3305 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=2fb0f72b-1700-0000-7d5a-3ecde90c0000 pid=3305 execve guuid=7e164f2c-1700-0000-7d5a-3ecdeb0c0000 pid=3307 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=7e164f2c-1700-0000-7d5a-3ecdeb0c0000 pid=3307 execve guuid=e6e9ae2c-1700-0000-7d5a-3ecdec0c0000 pid=3308 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=e6e9ae2c-1700-0000-7d5a-3ecdec0c0000 pid=3308 execve guuid=caff1d2d-1700-0000-7d5a-3ecded0c0000 pid=3309 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=caff1d2d-1700-0000-7d5a-3ecded0c0000 pid=3309 execve guuid=689f842d-1700-0000-7d5a-3ecdee0c0000 pid=3310 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=689f842d-1700-0000-7d5a-3ecdee0c0000 pid=3310 execve guuid=82f1e12d-1700-0000-7d5a-3ecdef0c0000 pid=3311 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=82f1e12d-1700-0000-7d5a-3ecdef0c0000 pid=3311 execve guuid=547b412e-1700-0000-7d5a-3ecdf00c0000 pid=3312 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=547b412e-1700-0000-7d5a-3ecdf00c0000 pid=3312 execve guuid=8fb9a82e-1700-0000-7d5a-3ecdf10c0000 pid=3313 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=8fb9a82e-1700-0000-7d5a-3ecdf10c0000 pid=3313 execve guuid=44f7072f-1700-0000-7d5a-3ecdf40c0000 pid=3316 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=44f7072f-1700-0000-7d5a-3ecdf40c0000 pid=3316 execve guuid=7d776e2f-1700-0000-7d5a-3ecdf60c0000 pid=3318 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=7d776e2f-1700-0000-7d5a-3ecdf60c0000 pid=3318 execve guuid=884bcb2f-1700-0000-7d5a-3ecdf90c0000 pid=3321 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=884bcb2f-1700-0000-7d5a-3ecdf90c0000 pid=3321 execve guuid=e1572c30-1700-0000-7d5a-3ecdfb0c0000 pid=3323 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=e1572c30-1700-0000-7d5a-3ecdfb0c0000 pid=3323 execve guuid=80378b30-1700-0000-7d5a-3ecdfd0c0000 pid=3325 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=80378b30-1700-0000-7d5a-3ecdfd0c0000 pid=3325 execve guuid=04eaeb30-1700-0000-7d5a-3ecd000d0000 pid=3328 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=04eaeb30-1700-0000-7d5a-3ecd000d0000 pid=3328 execve guuid=63fa4b31-1700-0000-7d5a-3ecd020d0000 pid=3330 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=63fa4b31-1700-0000-7d5a-3ecd020d0000 pid=3330 execve guuid=987bb531-1700-0000-7d5a-3ecd040d0000 pid=3332 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=987bb531-1700-0000-7d5a-3ecd040d0000 pid=3332 execve guuid=06c72d32-1700-0000-7d5a-3ecd050d0000 pid=3333 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=06c72d32-1700-0000-7d5a-3ecd050d0000 pid=3333 execve guuid=10b89332-1700-0000-7d5a-3ecd070d0000 pid=3335 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=10b89332-1700-0000-7d5a-3ecd070d0000 pid=3335 execve guuid=b480f632-1700-0000-7d5a-3ecd0a0d0000 pid=3338 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=b480f632-1700-0000-7d5a-3ecd0a0d0000 pid=3338 execve guuid=681a5933-1700-0000-7d5a-3ecd0c0d0000 pid=3340 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=681a5933-1700-0000-7d5a-3ecd0c0d0000 pid=3340 execve guuid=9e0ab933-1700-0000-7d5a-3ecd0f0d0000 pid=3343 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=9e0ab933-1700-0000-7d5a-3ecd0f0d0000 pid=3343 execve guuid=dc322334-1700-0000-7d5a-3ecd110d0000 pid=3345 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=dc322334-1700-0000-7d5a-3ecd110d0000 pid=3345 execve guuid=1867cf34-1700-0000-7d5a-3ecd130d0000 pid=3347 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=1867cf34-1700-0000-7d5a-3ecd130d0000 pid=3347 execve guuid=d1cc6835-1700-0000-7d5a-3ecd160d0000 pid=3350 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=d1cc6835-1700-0000-7d5a-3ecd160d0000 pid=3350 execve guuid=6ce7fe35-1700-0000-7d5a-3ecd1a0d0000 pid=3354 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=6ce7fe35-1700-0000-7d5a-3ecd1a0d0000 pid=3354 execve guuid=ab237a36-1700-0000-7d5a-3ecd1b0d0000 pid=3355 /usr/bin/ls guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=ab237a36-1700-0000-7d5a-3ecd1b0d0000 pid=3355 execve guuid=69c70337-1700-0000-7d5a-3ecd1d0d0000 pid=3357 /usr/bin/rm guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=69c70337-1700-0000-7d5a-3ecd1d0d0000 pid=3357 execve guuid=0fa85c37-1700-0000-7d5a-3ecd1e0d0000 pid=3358 /usr/bin/wget net send-data write-file guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=0fa85c37-1700-0000-7d5a-3ecd1e0d0000 pid=3358 execve guuid=a9bd333c-1700-0000-7d5a-3ecd2d0d0000 pid=3373 /usr/bin/chmod guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=a9bd333c-1700-0000-7d5a-3ecd2d0d0000 pid=3373 execve guuid=ae126b3c-1700-0000-7d5a-3ecd2f0d0000 pid=3375 /usr/bin/dash guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=ae126b3c-1700-0000-7d5a-3ecd2f0d0000 pid=3375 clone guuid=2104b93d-1700-0000-7d5a-3ecd350d0000 pid=3381 /usr/bin/rm guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=2104b93d-1700-0000-7d5a-3ecd350d0000 pid=3381 execve guuid=9dd2f13d-1700-0000-7d5a-3ecd360d0000 pid=3382 /usr/bin/wget net send-data write-file guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=9dd2f13d-1700-0000-7d5a-3ecd360d0000 pid=3382 execve guuid=7733dc41-1700-0000-7d5a-3ecd430d0000 pid=3395 /usr/bin/chmod guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=7733dc41-1700-0000-7d5a-3ecd430d0000 pid=3395 execve guuid=f3371442-1700-0000-7d5a-3ecd450d0000 pid=3397 /usr/bin/dash guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=f3371442-1700-0000-7d5a-3ecd450d0000 pid=3397 clone guuid=b016a942-1700-0000-7d5a-3ecd490d0000 pid=3401 /usr/bin/rm guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=b016a942-1700-0000-7d5a-3ecd490d0000 pid=3401 execve guuid=187ceb42-1700-0000-7d5a-3ecd4b0d0000 pid=3403 /usr/bin/wget net send-data write-file guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=187ceb42-1700-0000-7d5a-3ecd4b0d0000 pid=3403 execve guuid=8de8bb46-1700-0000-7d5a-3ecd580d0000 pid=3416 /usr/bin/chmod guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=8de8bb46-1700-0000-7d5a-3ecd580d0000 pid=3416 execve guuid=eff6f846-1700-0000-7d5a-3ecd5a0d0000 pid=3418 /usr/bin/dash guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=eff6f846-1700-0000-7d5a-3ecd5a0d0000 pid=3418 clone guuid=cde77a47-1700-0000-7d5a-3ecd5d0d0000 pid=3421 /usr/bin/rm guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=cde77a47-1700-0000-7d5a-3ecd5d0d0000 pid=3421 execve guuid=a347b247-1700-0000-7d5a-3ecd5f0d0000 pid=3423 /usr/bin/wget net send-data write-file guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=a347b247-1700-0000-7d5a-3ecd5f0d0000 pid=3423 execve guuid=a154154c-1700-0000-7d5a-3ecd6d0d0000 pid=3437 /usr/bin/chmod guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=a154154c-1700-0000-7d5a-3ecd6d0d0000 pid=3437 execve guuid=217c5a4c-1700-0000-7d5a-3ecd6f0d0000 pid=3439 /usr/bin/dash guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=217c5a4c-1700-0000-7d5a-3ecd6f0d0000 pid=3439 clone guuid=abe0e54d-1700-0000-7d5a-3ecd750d0000 pid=3445 /usr/bin/rm guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=abe0e54d-1700-0000-7d5a-3ecd750d0000 pid=3445 execve guuid=1df6714e-1700-0000-7d5a-3ecd780d0000 pid=3448 /usr/bin/wget net send-data write-file guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=1df6714e-1700-0000-7d5a-3ecd780d0000 pid=3448 execve guuid=ad9a6c54-1700-0000-7d5a-3ecd840d0000 pid=3460 /usr/bin/chmod guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=ad9a6c54-1700-0000-7d5a-3ecd840d0000 pid=3460 execve guuid=1a3cb554-1700-0000-7d5a-3ecd850d0000 pid=3461 /usr/bin/dash guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=1a3cb554-1700-0000-7d5a-3ecd850d0000 pid=3461 clone guuid=2fb85d55-1700-0000-7d5a-3ecd890d0000 pid=3465 /usr/bin/rm delete-file guuid=4a9d91fc-1600-0000-7d5a-3ecd3f0c0000 pid=3135->guuid=2fb85d55-1700-0000-7d5a-3ecd890d0000 pid=3465 execve 0b1ba66e-2f8f-542f-9f7c-00dd01da057c 129.121.110.105:80 guuid=0fa85c37-1700-0000-7d5a-3ecd1e0d0000 pid=3358->0b1ba66e-2f8f-542f-9f7c-00dd01da057c send: 133B guuid=9dd2f13d-1700-0000-7d5a-3ecd360d0000 pid=3382->0b1ba66e-2f8f-542f-9f7c-00dd01da057c send: 133B guuid=187ceb42-1700-0000-7d5a-3ecd4b0d0000 pid=3403->0b1ba66e-2f8f-542f-9f7c-00dd01da057c send: 133B guuid=a347b247-1700-0000-7d5a-3ecd5f0d0000 pid=3423->0b1ba66e-2f8f-542f-9f7c-00dd01da057c send: 134B guuid=1df6714e-1700-0000-7d5a-3ecd780d0000 pid=3448->0b1ba66e-2f8f-542f-9f7c-00dd01da057c send: 134B
Score:
99%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/14a0c3c28384e040fcf9317dacd5400b9cecd9bdde92fff5f242671fab246a98
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/14a0c3c28384e040fcf9317dacd5400b9cecd9bdde92fff5f242671fab246a98/
Threat name:
Document-HTML.Trojan.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2026-08-09 05:16:03 UTC
AV detection:
11 of 24 (45.83%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=csqmhqudqtqeb7hzgf62zvkabooozwn532jp75psijtr7kzenkma._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
defense_evasion discovery execution linux persistence privilege_escalation
Link:
https://tria.ge/reports/260809-cl3gbagk3t/
Behaviour
Enumerates kernel/hardware configuration
Reads runtime system information
Writes file to tmp directory
Creates/modifies Cron job
Enumerates running processes
Modifies rc script
Modifies systemd
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.26
Link:
https://yomi.yoroi.company/submissions/14a0c3c28384e040fcf9317dacd5400b9cecd9bdde92fff5f242671fab246a98

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 14a0c3c28384e040fcf9317dacd5400b9cecd9bdde92fff5f242671fab246a98

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3887342/
  
Delivery method
Distributed via web download

Comments