MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 15f53ef454897cb60b0331189d7251dfb2e097dab446ce0dc3e392a988146ed8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 15f53ef454897cb60b0331189d7251dfb2e097dab446ce0dc3e392a988146ed8
SHA3-384 hash: a72d635fd38ee1e6831501f65bcd8cece25eed077257eeda81dd4d480fe88eefdaf766e6a07b8c3f49e500e86d869a63
SHA1 hash: 1f8ee7090daa0e9e76fd1e635b28347064b0d326
MD5 hash: 0381adafe0e511afd966cda6d54047f6
humanhash: eleven-equal-cup-delaware
File name:ok
Download: download sample
File size:1'608 bytes
First seen:2026-08-11 03:27:04 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 12:UAi6AokczumNSi6NSN0wc7dA6Y0srZRF6j0+qUNNd6NE6OIDm629R/ZB6Zpl76PD:Tyozujwc752ZSzqgbfrk2y2UP74/T
TLSH T1D53141AE40151E310107CECE32B2394CB2CDA9FB189FD7C5DD080ED9868879CF261B59
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://5.182.210.174/b73206n/an/aua-wget
http://5.182.210.174/968defn/an/aua-wget
http://5.182.210.174/05f7c6n/an/aua-wget
http://5.182.210.174/63ab9cn/an/aua-wget
http://5.182.210.174/9aaf74n/an/aua-wget
http://5.182.210.174/bf39afn/an/aua-wget
http://5.182.210.174/81ee8an/an/aua-wget
http://5.182.210.174/cf3066n/an/aua-wget
http://5.182.210.174/e748fan/an/aua-wget
http://5.182.210.174/2020ben/an/aua-wget
http://5.182.210.174/30e00cn/an/aua-wget
http://5.182.210.174/ac8c9fn/an/aua-wget

Intelligence

File Origin
# of uploads :
1
# of downloads :
43
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive mirai
Link:
https://www.filescan.io/uploads/6a7a969daa03d9c3ad4344f7/reports/1453b547-8e77-4fe8-979b-1a3f66d181d1/overview
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/e648d772-c163-4d8b-94f5-76a934c4ef70
Behavior Graph:
Download SVG
%3 guuid=913697db-1800-0000-d7ad-adf56f0d0000 pid=3439 /usr/bin/sudo guuid=e0a40ae2-1800-0000-d7ad-adf5760d0000 pid=3446 /tmp/sample.bin guuid=913697db-1800-0000-d7ad-adf56f0d0000 pid=3439->guuid=e0a40ae2-1800-0000-d7ad-adf5760d0000 pid=3446 execve guuid=937e4be3-1800-0000-d7ad-adf5780d0000 pid=3448 /usr/bin/wget net send-data guuid=e0a40ae2-1800-0000-d7ad-adf5760d0000 pid=3446->guuid=937e4be3-1800-0000-d7ad-adf5780d0000 pid=3448 execve guuid=85bf5fea-1800-0000-d7ad-adf5810d0000 pid=3457 /usr/bin/curl net send-data write-file guuid=e0a40ae2-1800-0000-d7ad-adf5760d0000 pid=3446->guuid=85bf5fea-1800-0000-d7ad-adf5810d0000 pid=3457 execve guuid=d3cbe5f5-1800-0000-d7ad-adf5950d0000 pid=3477 /usr/bin/chmod guuid=e0a40ae2-1800-0000-d7ad-adf5760d0000 pid=3446->guuid=d3cbe5f5-1800-0000-d7ad-adf5950d0000 pid=3477 execve guuid=0b44f8f6-1800-0000-d7ad-adf5980d0000 pid=3480 /usr/bin/bash guuid=e0a40ae2-1800-0000-d7ad-adf5760d0000 pid=3446->guuid=0b44f8f6-1800-0000-d7ad-adf5980d0000 pid=3480 clone guuid=262e9bf7-1800-0000-d7ad-adf59b0d0000 pid=3483 /usr/bin/rm delete-file guuid=e0a40ae2-1800-0000-d7ad-adf5760d0000 pid=3446->guuid=262e9bf7-1800-0000-d7ad-adf59b0d0000 pid=3483 execve guuid=453489f8-1800-0000-d7ad-adf59d0d0000 pid=3485 /usr/bin/rm guuid=e0a40ae2-1800-0000-d7ad-adf5760d0000 pid=3446->guuid=453489f8-1800-0000-d7ad-adf59d0d0000 pid=3485 execve guuid=f1c12af9-1800-0000-d7ad-adf59f0d0000 pid=3487 /usr/bin/wget net send-data guuid=e0a40ae2-1800-0000-d7ad-adf5760d0000 pid=3446->guuid=f1c12af9-1800-0000-d7ad-adf59f0d0000 pid=3487 execve guuid=7ed798fc-1800-0000-d7ad-adf5a20d0000 pid=3490 /usr/bin/curl net send-data write-file guuid=e0a40ae2-1800-0000-d7ad-adf5760d0000 pid=3446->guuid=7ed798fc-1800-0000-d7ad-adf5a20d0000 pid=3490 execve guuid=9cf02006-1900-0000-d7ad-adf5b60d0000 pid=3510 /usr/bin/chmod guuid=e0a40ae2-1800-0000-d7ad-adf5760d0000 pid=3446->guuid=9cf02006-1900-0000-d7ad-adf5b60d0000 pid=3510 execve guuid=c2428606-1900-0000-d7ad-adf5ba0d0000 pid=3514 /usr/bin/bash guuid=e0a40ae2-1800-0000-d7ad-adf5760d0000 pid=3446->guuid=c2428606-1900-0000-d7ad-adf5ba0d0000 pid=3514 clone guuid=fbead106-1900-0000-d7ad-adf5bf0d0000 pid=3519 /usr/bin/rm delete-file guuid=e0a40ae2-1800-0000-d7ad-adf5760d0000 pid=3446->guuid=fbead106-1900-0000-d7ad-adf5bf0d0000 pid=3519 execve guuid=17932f07-1900-0000-d7ad-adf5c00d0000 pid=3520 /usr/bin/rm guuid=e0a40ae2-1800-0000-d7ad-adf5760d0000 pid=3446->guuid=17932f07-1900-0000-d7ad-adf5c00d0000 pid=3520 execve guuid=d6568a07-1900-0000-d7ad-adf5c20d0000 pid=3522 /usr/bin/wget net send-data guuid=e0a40ae2-1800-0000-d7ad-adf5760d0000 pid=3446->guuid=d6568a07-1900-0000-d7ad-adf5c20d0000 pid=3522 execve guuid=c92e640a-1900-0000-d7ad-adf5c90d0000 pid=3529 /usr/bin/curl net send-data write-file guuid=e0a40ae2-1800-0000-d7ad-adf5760d0000 pid=3446->guuid=c92e640a-1900-0000-d7ad-adf5c90d0000 pid=3529 execve guuid=2d8f8d11-1900-0000-d7ad-adf5d90d0000 pid=3545 /usr/bin/chmod guuid=e0a40ae2-1800-0000-d7ad-adf5760d0000 pid=3446->guuid=2d8f8d11-1900-0000-d7ad-adf5d90d0000 pid=3545 execve guuid=ebb6f311-1900-0000-d7ad-adf5da0d0000 pid=3546 /usr/bin/bash guuid=e0a40ae2-1800-0000-d7ad-adf5760d0000 pid=3446->guuid=ebb6f311-1900-0000-d7ad-adf5da0d0000 pid=3546 clone guuid=51c35012-1900-0000-d7ad-adf5df0d0000 pid=3551 /usr/bin/rm delete-file guuid=e0a40ae2-1800-0000-d7ad-adf5760d0000 pid=3446->guuid=51c35012-1900-0000-d7ad-adf5df0d0000 pid=3551 execve guuid=ee609c12-1900-0000-d7ad-adf5e00d0000 pid=3552 /usr/bin/rm guuid=e0a40ae2-1800-0000-d7ad-adf5760d0000 pid=3446->guuid=ee609c12-1900-0000-d7ad-adf5e00d0000 pid=3552 execve guuid=78d2ec12-1900-0000-d7ad-adf5e40d0000 pid=3556 /usr/bin/wget net send-data guuid=e0a40ae2-1800-0000-d7ad-adf5760d0000 pid=3446->guuid=78d2ec12-1900-0000-d7ad-adf5e40d0000 pid=3556 execve guuid=2f03a615-1900-0000-d7ad-adf5ea0d0000 pid=3562 /usr/bin/curl net send-data write-file guuid=e0a40ae2-1800-0000-d7ad-adf5760d0000 pid=3446->guuid=2f03a615-1900-0000-d7ad-adf5ea0d0000 pid=3562 execve guuid=915da927-1900-0000-d7ad-adf5ec0d0000 pid=3564 /usr/bin/chmod guuid=e0a40ae2-1800-0000-d7ad-adf5760d0000 pid=3446->guuid=915da927-1900-0000-d7ad-adf5ec0d0000 pid=3564 execve guuid=9e2d6028-1900-0000-d7ad-adf5ed0d0000 pid=3565 /usr/bin/bash guuid=e0a40ae2-1800-0000-d7ad-adf5760d0000 pid=3446->guuid=9e2d6028-1900-0000-d7ad-adf5ed0d0000 pid=3565 clone guuid=b61e0529-1900-0000-d7ad-adf5ef0d0000 pid=3567 /usr/bin/rm delete-file guuid=e0a40ae2-1800-0000-d7ad-adf5760d0000 pid=3446->guuid=b61e0529-1900-0000-d7ad-adf5ef0d0000 pid=3567 execve guuid=d73c8429-1900-0000-d7ad-adf5f30d0000 pid=3571 /usr/bin/rm guuid=e0a40ae2-1800-0000-d7ad-adf5760d0000 pid=3446->guuid=d73c8429-1900-0000-d7ad-adf5f30d0000 pid=3571 execve guuid=e953162a-1900-0000-d7ad-adf5f40d0000 pid=3572 /usr/bin/wget net send-data guuid=e0a40ae2-1800-0000-d7ad-adf5760d0000 pid=3446->guuid=e953162a-1900-0000-d7ad-adf5f40d0000 pid=3572 execve guuid=d4a2de2e-1900-0000-d7ad-adf5fe0d0000 pid=3582 /usr/bin/curl net send-data write-file guuid=e0a40ae2-1800-0000-d7ad-adf5760d0000 pid=3446->guuid=d4a2de2e-1900-0000-d7ad-adf5fe0d0000 pid=3582 execve guuid=8799f3c2-1900-0000-d7ad-adf5060e0000 pid=3590 /usr/bin/chmod guuid=e0a40ae2-1800-0000-d7ad-adf5760d0000 pid=3446->guuid=8799f3c2-1900-0000-d7ad-adf5060e0000 pid=3590 execve guuid=72ac4fc3-1900-0000-d7ad-adf5080e0000 pid=3592 /usr/bin/bash guuid=e0a40ae2-1800-0000-d7ad-adf5760d0000 pid=3446->guuid=72ac4fc3-1900-0000-d7ad-adf5080e0000 pid=3592 clone guuid=3e15a5c3-1900-0000-d7ad-adf50b0e0000 pid=3595 /usr/bin/rm delete-file guuid=e0a40ae2-1800-0000-d7ad-adf5760d0000 pid=3446->guuid=3e15a5c3-1900-0000-d7ad-adf50b0e0000 pid=3595 execve guuid=843821c4-1900-0000-d7ad-adf50d0e0000 pid=3597 /usr/bin/rm guuid=e0a40ae2-1800-0000-d7ad-adf5760d0000 pid=3446->guuid=843821c4-1900-0000-d7ad-adf50d0e0000 pid=3597 execve guuid=985c98c4-1900-0000-d7ad-adf50f0e0000 pid=3599 /usr/bin/wget net send-data guuid=e0a40ae2-1800-0000-d7ad-adf5760d0000 pid=3446->guuid=985c98c4-1900-0000-d7ad-adf50f0e0000 pid=3599 execve guuid=2b9572c7-1900-0000-d7ad-adf5170e0000 pid=3607 /usr/bin/curl net send-data write-file guuid=e0a40ae2-1800-0000-d7ad-adf5760d0000 pid=3446->guuid=2b9572c7-1900-0000-d7ad-adf5170e0000 pid=3607 execve guuid=1e3bd4ca-1900-0000-d7ad-adf5290e0000 pid=3625 /usr/bin/chmod guuid=e0a40ae2-1800-0000-d7ad-adf5760d0000 pid=3446->guuid=1e3bd4ca-1900-0000-d7ad-adf5290e0000 pid=3625 execve guuid=41ba14cb-1900-0000-d7ad-adf52b0e0000 pid=3627 /usr/bin/bash guuid=e0a40ae2-1800-0000-d7ad-adf5760d0000 pid=3446->guuid=41ba14cb-1900-0000-d7ad-adf52b0e0000 pid=3627 clone guuid=7eea4acb-1900-0000-d7ad-adf52e0e0000 pid=3630 /usr/bin/rm delete-file guuid=e0a40ae2-1800-0000-d7ad-adf5760d0000 pid=3446->guuid=7eea4acb-1900-0000-d7ad-adf52e0e0000 pid=3630 execve guuid=13ef90cb-1900-0000-d7ad-adf5320e0000 pid=3634 /usr/bin/rm guuid=e0a40ae2-1800-0000-d7ad-adf5760d0000 pid=3446->guuid=13ef90cb-1900-0000-d7ad-adf5320e0000 pid=3634 execve guuid=86fed5cb-1900-0000-d7ad-adf5340e0000 pid=3636 /usr/bin/wget net send-data guuid=e0a40ae2-1800-0000-d7ad-adf5760d0000 pid=3446->guuid=86fed5cb-1900-0000-d7ad-adf5340e0000 pid=3636 execve guuid=a9d930cf-1900-0000-d7ad-adf5440e0000 pid=3652 /usr/bin/curl net send-data write-file guuid=e0a40ae2-1800-0000-d7ad-adf5760d0000 pid=3446->guuid=a9d930cf-1900-0000-d7ad-adf5440e0000 pid=3652 execve guuid=8d019ed2-1900-0000-d7ad-adf5530e0000 pid=3667 /usr/bin/chmod guuid=e0a40ae2-1800-0000-d7ad-adf5760d0000 pid=3446->guuid=8d019ed2-1900-0000-d7ad-adf5530e0000 pid=3667 execve guuid=400301d3-1900-0000-d7ad-adf5550e0000 pid=3669 /usr/bin/bash guuid=e0a40ae2-1800-0000-d7ad-adf5760d0000 pid=3446->guuid=400301d3-1900-0000-d7ad-adf5550e0000 pid=3669 clone guuid=083f4ed3-1900-0000-d7ad-adf5570e0000 pid=3671 /usr/bin/rm delete-file guuid=e0a40ae2-1800-0000-d7ad-adf5760d0000 pid=3446->guuid=083f4ed3-1900-0000-d7ad-adf5570e0000 pid=3671 execve guuid=0ed4a2d3-1900-0000-d7ad-adf5590e0000 pid=3673 /usr/bin/rm guuid=e0a40ae2-1800-0000-d7ad-adf5760d0000 pid=3446->guuid=0ed4a2d3-1900-0000-d7ad-adf5590e0000 pid=3673 execve guuid=53dbefd3-1900-0000-d7ad-adf55c0e0000 pid=3676 /usr/bin/wget net send-data guuid=e0a40ae2-1800-0000-d7ad-adf5760d0000 pid=3446->guuid=53dbefd3-1900-0000-d7ad-adf55c0e0000 pid=3676 execve guuid=41cf02d8-1900-0000-d7ad-adf5680e0000 pid=3688 /usr/bin/curl net send-data write-file guuid=e0a40ae2-1800-0000-d7ad-adf5760d0000 pid=3446->guuid=41cf02d8-1900-0000-d7ad-adf5680e0000 pid=3688 execve guuid=48cf10dc-1900-0000-d7ad-adf5760e0000 pid=3702 /usr/bin/chmod guuid=e0a40ae2-1800-0000-d7ad-adf5760d0000 pid=3446->guuid=48cf10dc-1900-0000-d7ad-adf5760e0000 pid=3702 execve guuid=47a557dc-1900-0000-d7ad-adf5770e0000 pid=3703 /usr/bin/bash guuid=e0a40ae2-1800-0000-d7ad-adf5760d0000 pid=3446->guuid=47a557dc-1900-0000-d7ad-adf5770e0000 pid=3703 clone guuid=dfee92dc-1900-0000-d7ad-adf5790e0000 pid=3705 /usr/bin/rm delete-file guuid=e0a40ae2-1800-0000-d7ad-adf5760d0000 pid=3446->guuid=dfee92dc-1900-0000-d7ad-adf5790e0000 pid=3705 execve guuid=a665e8dc-1900-0000-d7ad-adf57a0e0000 pid=3706 /usr/bin/rm guuid=e0a40ae2-1800-0000-d7ad-adf5760d0000 pid=3446->guuid=a665e8dc-1900-0000-d7ad-adf57a0e0000 pid=3706 execve guuid=77c336dd-1900-0000-d7ad-adf57b0e0000 pid=3707 /usr/bin/wget net send-data guuid=e0a40ae2-1800-0000-d7ad-adf5760d0000 pid=3446->guuid=77c336dd-1900-0000-d7ad-adf57b0e0000 pid=3707 execve guuid=b7fb5ce0-1900-0000-d7ad-adf57c0e0000 pid=3708 /usr/bin/curl net send-data write-file guuid=e0a40ae2-1800-0000-d7ad-adf5760d0000 pid=3446->guuid=b7fb5ce0-1900-0000-d7ad-adf57c0e0000 pid=3708 execve guuid=476064e5-1900-0000-d7ad-adf57d0e0000 pid=3709 /usr/bin/chmod guuid=e0a40ae2-1800-0000-d7ad-adf5760d0000 pid=3446->guuid=476064e5-1900-0000-d7ad-adf57d0e0000 pid=3709 execve guuid=599bbde5-1900-0000-d7ad-adf57e0e0000 pid=3710 /usr/bin/bash guuid=e0a40ae2-1800-0000-d7ad-adf5760d0000 pid=3446->guuid=599bbde5-1900-0000-d7ad-adf57e0e0000 pid=3710 clone guuid=8dbefee5-1900-0000-d7ad-adf5800e0000 pid=3712 /usr/bin/rm delete-file guuid=e0a40ae2-1800-0000-d7ad-adf5760d0000 pid=3446->guuid=8dbefee5-1900-0000-d7ad-adf5800e0000 pid=3712 execve guuid=13f156e6-1900-0000-d7ad-adf5810e0000 pid=3713 /usr/bin/rm guuid=e0a40ae2-1800-0000-d7ad-adf5760d0000 pid=3446->guuid=13f156e6-1900-0000-d7ad-adf5810e0000 pid=3713 execve guuid=2fd2a5e6-1900-0000-d7ad-adf5820e0000 pid=3714 /usr/bin/wget net send-data guuid=e0a40ae2-1800-0000-d7ad-adf5760d0000 pid=3446->guuid=2fd2a5e6-1900-0000-d7ad-adf5820e0000 pid=3714 execve guuid=a9c12fe9-1900-0000-d7ad-adf5830e0000 pid=3715 /usr/bin/curl net send-data write-file guuid=e0a40ae2-1800-0000-d7ad-adf5760d0000 pid=3446->guuid=a9c12fe9-1900-0000-d7ad-adf5830e0000 pid=3715 execve guuid=34d45ced-1900-0000-d7ad-adf5840e0000 pid=3716 /usr/bin/chmod guuid=e0a40ae2-1800-0000-d7ad-adf5760d0000 pid=3446->guuid=34d45ced-1900-0000-d7ad-adf5840e0000 pid=3716 execve guuid=e2aaa0ed-1900-0000-d7ad-adf5850e0000 pid=3717 /usr/bin/bash guuid=e0a40ae2-1800-0000-d7ad-adf5760d0000 pid=3446->guuid=e2aaa0ed-1900-0000-d7ad-adf5850e0000 pid=3717 clone guuid=f36fdeed-1900-0000-d7ad-adf5870e0000 pid=3719 /usr/bin/rm delete-file guuid=e0a40ae2-1800-0000-d7ad-adf5760d0000 pid=3446->guuid=f36fdeed-1900-0000-d7ad-adf5870e0000 pid=3719 execve guuid=f0432fee-1900-0000-d7ad-adf5880e0000 pid=3720 /usr/bin/rm guuid=e0a40ae2-1800-0000-d7ad-adf5760d0000 pid=3446->guuid=f0432fee-1900-0000-d7ad-adf5880e0000 pid=3720 execve guuid=1c3870ee-1900-0000-d7ad-adf5890e0000 pid=3721 /usr/bin/wget net send-data guuid=e0a40ae2-1800-0000-d7ad-adf5760d0000 pid=3446->guuid=1c3870ee-1900-0000-d7ad-adf5890e0000 pid=3721 execve guuid=db71e4f0-1900-0000-d7ad-adf58a0e0000 pid=3722 /usr/bin/curl net send-data write-file guuid=e0a40ae2-1800-0000-d7ad-adf5760d0000 pid=3446->guuid=db71e4f0-1900-0000-d7ad-adf58a0e0000 pid=3722 execve guuid=5060c8f4-1900-0000-d7ad-adf58b0e0000 pid=3723 /usr/bin/chmod guuid=e0a40ae2-1800-0000-d7ad-adf5760d0000 pid=3446->guuid=5060c8f4-1900-0000-d7ad-adf58b0e0000 pid=3723 execve guuid=2eedd6f5-1900-0000-d7ad-adf58c0e0000 pid=3724 /usr/bin/bash guuid=e0a40ae2-1800-0000-d7ad-adf5760d0000 pid=3446->guuid=2eedd6f5-1900-0000-d7ad-adf58c0e0000 pid=3724 clone guuid=84a221f6-1900-0000-d7ad-adf58e0e0000 pid=3726 /usr/bin/rm delete-file guuid=e0a40ae2-1800-0000-d7ad-adf5760d0000 pid=3446->guuid=84a221f6-1900-0000-d7ad-adf58e0e0000 pid=3726 execve guuid=246a97f6-1900-0000-d7ad-adf58f0e0000 pid=3727 /usr/bin/rm guuid=e0a40ae2-1800-0000-d7ad-adf5760d0000 pid=3446->guuid=246a97f6-1900-0000-d7ad-adf58f0e0000 pid=3727 execve guuid=d31809f7-1900-0000-d7ad-adf5900e0000 pid=3728 /usr/bin/wget net send-data guuid=e0a40ae2-1800-0000-d7ad-adf5760d0000 pid=3446->guuid=d31809f7-1900-0000-d7ad-adf5900e0000 pid=3728 execve guuid=d423c5f9-1900-0000-d7ad-adf5910e0000 pid=3729 /usr/bin/curl net send-data write-file guuid=e0a40ae2-1800-0000-d7ad-adf5760d0000 pid=3446->guuid=d423c5f9-1900-0000-d7ad-adf5910e0000 pid=3729 execve guuid=01253afe-1900-0000-d7ad-adf5920e0000 pid=3730 /usr/bin/chmod guuid=e0a40ae2-1800-0000-d7ad-adf5760d0000 pid=3446->guuid=01253afe-1900-0000-d7ad-adf5920e0000 pid=3730 execve guuid=b5609ffe-1900-0000-d7ad-adf5930e0000 pid=3731 /usr/bin/bash guuid=e0a40ae2-1800-0000-d7ad-adf5760d0000 pid=3446->guuid=b5609ffe-1900-0000-d7ad-adf5930e0000 pid=3731 clone guuid=8176e0fe-1900-0000-d7ad-adf5950e0000 pid=3733 /usr/bin/rm delete-file guuid=e0a40ae2-1800-0000-d7ad-adf5760d0000 pid=3446->guuid=8176e0fe-1900-0000-d7ad-adf5950e0000 pid=3733 execve guuid=52c843ff-1900-0000-d7ad-adf5960e0000 pid=3734 /usr/bin/rm guuid=e0a40ae2-1800-0000-d7ad-adf5760d0000 pid=3446->guuid=52c843ff-1900-0000-d7ad-adf5960e0000 pid=3734 execve 5b654972-c9e1-50d8-b372-2dc2a5b9ad66 5.182.210.174:80 guuid=937e4be3-1800-0000-d7ad-adf5780d0000 pid=3448->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=85bf5fea-1800-0000-d7ad-adf5810d0000 pid=3457->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=e07d23f7-1800-0000-d7ad-adf5990d0000 pid=3481 /usr/bin/bash guuid=0b44f8f6-1800-0000-d7ad-adf5980d0000 pid=3480->guuid=e07d23f7-1800-0000-d7ad-adf5990d0000 pid=3481 clone guuid=f1c12af9-1800-0000-d7ad-adf59f0d0000 pid=3487->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=7ed798fc-1800-0000-d7ad-adf5a20d0000 pid=3490->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=cef8a706-1900-0000-d7ad-adf5bb0d0000 pid=3515 /usr/bin/bash guuid=c2428606-1900-0000-d7ad-adf5ba0d0000 pid=3514->guuid=cef8a706-1900-0000-d7ad-adf5bb0d0000 pid=3515 clone guuid=d6568a07-1900-0000-d7ad-adf5c20d0000 pid=3522->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=c92e640a-1900-0000-d7ad-adf5c90d0000 pid=3529->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=d2ee1612-1900-0000-d7ad-adf5db0d0000 pid=3547 /usr/bin/bash guuid=ebb6f311-1900-0000-d7ad-adf5da0d0000 pid=3546->guuid=d2ee1612-1900-0000-d7ad-adf5db0d0000 pid=3547 clone guuid=78d2ec12-1900-0000-d7ad-adf5e40d0000 pid=3556->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=2f03a615-1900-0000-d7ad-adf5ea0d0000 pid=3562->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=f42fb528-1900-0000-d7ad-adf5ee0d0000 pid=3566 /usr/bin/bash guuid=9e2d6028-1900-0000-d7ad-adf5ed0d0000 pid=3565->guuid=f42fb528-1900-0000-d7ad-adf5ee0d0000 pid=3566 clone guuid=e953162a-1900-0000-d7ad-adf5f40d0000 pid=3572->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=d4a2de2e-1900-0000-d7ad-adf5fe0d0000 pid=3582->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=24d96fc3-1900-0000-d7ad-adf5090e0000 pid=3593 /usr/bin/bash guuid=72ac4fc3-1900-0000-d7ad-adf5080e0000 pid=3592->guuid=24d96fc3-1900-0000-d7ad-adf5090e0000 pid=3593 clone guuid=985c98c4-1900-0000-d7ad-adf50f0e0000 pid=3599->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=2b9572c7-1900-0000-d7ad-adf5170e0000 pid=3607->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=0c452ccb-1900-0000-d7ad-adf52d0e0000 pid=3629 /usr/bin/bash guuid=41ba14cb-1900-0000-d7ad-adf52b0e0000 pid=3627->guuid=0c452ccb-1900-0000-d7ad-adf52d0e0000 pid=3629 clone guuid=86fed5cb-1900-0000-d7ad-adf5340e0000 pid=3636->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=a9d930cf-1900-0000-d7ad-adf5440e0000 pid=3652->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=b28227d3-1900-0000-d7ad-adf5560e0000 pid=3670 /usr/bin/bash guuid=400301d3-1900-0000-d7ad-adf5550e0000 pid=3669->guuid=b28227d3-1900-0000-d7ad-adf5560e0000 pid=3670 clone guuid=53dbefd3-1900-0000-d7ad-adf55c0e0000 pid=3676->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=41cf02d8-1900-0000-d7ad-adf5680e0000 pid=3688->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=8eac73dc-1900-0000-d7ad-adf5780e0000 pid=3704 /usr/bin/bash guuid=47a557dc-1900-0000-d7ad-adf5770e0000 pid=3703->guuid=8eac73dc-1900-0000-d7ad-adf5780e0000 pid=3704 clone guuid=77c336dd-1900-0000-d7ad-adf57b0e0000 pid=3707->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=b7fb5ce0-1900-0000-d7ad-adf57c0e0000 pid=3708->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=7ce6d9e5-1900-0000-d7ad-adf57f0e0000 pid=3711 /usr/bin/bash guuid=599bbde5-1900-0000-d7ad-adf57e0e0000 pid=3710->guuid=7ce6d9e5-1900-0000-d7ad-adf57f0e0000 pid=3711 clone guuid=2fd2a5e6-1900-0000-d7ad-adf5820e0000 pid=3714->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=a9c12fe9-1900-0000-d7ad-adf5830e0000 pid=3715->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=9d94b7ed-1900-0000-d7ad-adf5860e0000 pid=3718 /usr/bin/bash guuid=e2aaa0ed-1900-0000-d7ad-adf5850e0000 pid=3717->guuid=9d94b7ed-1900-0000-d7ad-adf5860e0000 pid=3718 clone guuid=1c3870ee-1900-0000-d7ad-adf5890e0000 pid=3721->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=db71e4f0-1900-0000-d7ad-adf58a0e0000 pid=3722->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=6eb8f5f5-1900-0000-d7ad-adf58d0e0000 pid=3725 /usr/bin/bash guuid=2eedd6f5-1900-0000-d7ad-adf58c0e0000 pid=3724->guuid=6eb8f5f5-1900-0000-d7ad-adf58d0e0000 pid=3725 clone guuid=d31809f7-1900-0000-d7ad-adf5900e0000 pid=3728->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=d423c5f9-1900-0000-d7ad-adf5910e0000 pid=3729->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=95bfbbfe-1900-0000-d7ad-adf5940e0000 pid=3732 /usr/bin/bash guuid=b5609ffe-1900-0000-d7ad-adf5930e0000 pid=3731->guuid=95bfbbfe-1900-0000-d7ad-adf5940e0000 pid=3732 clone
Score:
99%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/15f53ef454897cb60b0331189d7251dfb2e097dab446ce0dc3e392a988146ed8
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/15f53ef454897cb60b0331189d7251dfb2e097dab446ce0dc3e392a988146ed8/
Gathering data
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=cx2t55curf6lmcydgemj24sr36zobf62wrdm4dod4ojktcaun3ma._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260811-dzzg9afk2x/
Behaviour
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 15f53ef454897cb60b0331189d7251dfb2e097dab446ce0dc3e392a988146ed8

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3897671/
  
Delivery method
Distributed via web download

Comments