🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 215a01dc972b5c0e601549e012da44b00e12ca07906d19731c51998e1ecd7512. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 215a01dc972b5c0e601549e012da44b00e12ca07906d19731c51998e1ecd7512
SHA3-384 hash: c2f98b325a4ef45d54de758f1429444e1697b5b5ae09b39f8724cf1170085347f6b023faf735f689e67d63153fe1f214
SHA1 hash: 33f752e0bc1e72c056d2d1e4576ee539df82d618
MD5 hash: 7fdad84e568672ed0a73ca9f65b7914d
humanhash: fix-timing-fish-video
File name:1.sh
Download: download sample
File size:3'284 bytes
First seen:2025-07-09 08:51:24 UTC
Last seen:2025-07-09 22:46:47 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 24:ItGz4ZsGIVbhGRykG4FlfGKTmsG+vTGP9PGgJGfc6GO/nLGh9hNIpKksGA9MEGMC:iyHIjll4p1KRLaJjdg4lBgJs1k
TLSH T149611CFB1346063B6CE69AD372A94404F180909B94CF5F79AFEC68F54E8DEC93C4164A
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://45.138.16.35/00101010101001/morte.x86n/an/aelf ua-wget
http://45.138.16.35/00101010101001/morte.mipsn/an/aelf ua-wget
http://45.138.16.35/00101010101001/morte.arcn/an/aelf ua-wget
http://45.138.16.35/00101010101001/morte.i468n/an/aelf ua-wget
http://45.138.16.35/00101010101001/morte.i686n/an/aelf ua-wget
http://45.138.16.35/00101010101001/morte.x86_64n/an/aelf ua-wget
http://45.138.16.35/00101010101001/morte.mpsln/an/aelf ua-wget
http://45.138.16.35/00101010101001/morte.armn/an/aelf ua-wget
http://45.138.16.35/00101010101001/morte.arm5n/an/aelf ua-wget
http://45.138.16.35/00101010101001/morte.arm6n/an/aelf ua-wget
http://45.138.16.35/00101010101001/morte.arm7n/an/aelf ua-wget
http://45.138.16.35/00101010101001/morte.ppcn/an/aelf ua-wget
http://45.138.16.35/00101010101001/morte.spcn/an/aelf ua-wget
http://45.138.16.35/00101010101001/morte.m68kn/an/aelf ua-wget
http://45.138.16.35/00101010101001/morte.sh4n/an/aelf ua-wget

Intelligence

File Origin
# of uploads :
2
# of downloads :
28
Origin country :
DE DE
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=686e2e24900df8e7f868ef77linux22vpnfull_triage
Tags:
trojan agent hype
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/205e8b1c-3e48-4a3f-8f8d-0dd605f291d3
Behavior Graph:
Download SVG
%3 guuid=4afb4c40-1a00-0000-30c8-81bcea0a0000 pid=2794 /usr/bin/sudo guuid=98891143-1a00-0000-30c8-81bceb0a0000 pid=2795 /tmp/sample.bin guuid=4afb4c40-1a00-0000-30c8-81bcea0a0000 pid=2794->guuid=98891143-1a00-0000-30c8-81bceb0a0000 pid=2795 execve guuid=7c5d8443-1a00-0000-30c8-81bcec0a0000 pid=2796 /usr/bin/cp guuid=98891143-1a00-0000-30c8-81bceb0a0000 pid=2795->guuid=7c5d8443-1a00-0000-30c8-81bcec0a0000 pid=2796 execve guuid=978a8049-1a00-0000-30c8-81bcf70a0000 pid=2807 /usr/bin/wget net send-data guuid=98891143-1a00-0000-30c8-81bceb0a0000 pid=2795->guuid=978a8049-1a00-0000-30c8-81bcf70a0000 pid=2807 execve guuid=c321158c-1a00-0000-30c8-81bc700b0000 pid=2928 /usr/bin/curl net send-data write-file guuid=98891143-1a00-0000-30c8-81bceb0a0000 pid=2795->guuid=c321158c-1a00-0000-30c8-81bc700b0000 pid=2928 execve guuid=0caa0095-1a00-0000-30c8-81bc7f0b0000 pid=2943 /usr/bin/chmod guuid=98891143-1a00-0000-30c8-81bceb0a0000 pid=2795->guuid=0caa0095-1a00-0000-30c8-81bc7f0b0000 pid=2943 execve guuid=89194c95-1a00-0000-30c8-81bc810b0000 pid=2945 /usr/bin/bash guuid=98891143-1a00-0000-30c8-81bceb0a0000 pid=2795->guuid=89194c95-1a00-0000-30c8-81bc810b0000 pid=2945 clone guuid=a6707095-1a00-0000-30c8-81bc820b0000 pid=2946 /usr/bin/rm delete-file guuid=98891143-1a00-0000-30c8-81bceb0a0000 pid=2795->guuid=a6707095-1a00-0000-30c8-81bc820b0000 pid=2946 execve guuid=8977b895-1a00-0000-30c8-81bc840b0000 pid=2948 /usr/bin/wget net send-data guuid=98891143-1a00-0000-30c8-81bceb0a0000 pid=2795->guuid=8977b895-1a00-0000-30c8-81bc840b0000 pid=2948 execve guuid=84530d9a-1a00-0000-30c8-81bc8e0b0000 pid=2958 /usr/bin/curl net send-data write-file guuid=98891143-1a00-0000-30c8-81bceb0a0000 pid=2795->guuid=84530d9a-1a00-0000-30c8-81bc8e0b0000 pid=2958 execve guuid=c7c783a1-1a00-0000-30c8-81bc9f0b0000 pid=2975 /usr/bin/chmod guuid=98891143-1a00-0000-30c8-81bceb0a0000 pid=2795->guuid=c7c783a1-1a00-0000-30c8-81bc9f0b0000 pid=2975 execve guuid=892ceba1-1a00-0000-30c8-81bca00b0000 pid=2976 /usr/bin/bash guuid=98891143-1a00-0000-30c8-81bceb0a0000 pid=2795->guuid=892ceba1-1a00-0000-30c8-81bca00b0000 pid=2976 clone guuid=d64c22a2-1a00-0000-30c8-81bca10b0000 pid=2977 /usr/bin/rm delete-file guuid=98891143-1a00-0000-30c8-81bceb0a0000 pid=2795->guuid=d64c22a2-1a00-0000-30c8-81bca10b0000 pid=2977 execve guuid=89287da2-1a00-0000-30c8-81bca20b0000 pid=2978 /usr/bin/wget net send-data guuid=98891143-1a00-0000-30c8-81bceb0a0000 pid=2795->guuid=89287da2-1a00-0000-30c8-81bca20b0000 pid=2978 execve guuid=9fc11ca7-1a00-0000-30c8-81bcad0b0000 pid=2989 /usr/bin/curl net send-data write-file guuid=98891143-1a00-0000-30c8-81bceb0a0000 pid=2795->guuid=9fc11ca7-1a00-0000-30c8-81bcad0b0000 pid=2989 execve guuid=782f65b2-1a00-0000-30c8-81bcb60b0000 pid=2998 /usr/bin/chmod guuid=98891143-1a00-0000-30c8-81bceb0a0000 pid=2795->guuid=782f65b2-1a00-0000-30c8-81bcb60b0000 pid=2998 execve guuid=c35bddb2-1a00-0000-30c8-81bcb70b0000 pid=2999 /usr/bin/bash guuid=98891143-1a00-0000-30c8-81bceb0a0000 pid=2795->guuid=c35bddb2-1a00-0000-30c8-81bcb70b0000 pid=2999 clone guuid=080e1cb3-1a00-0000-30c8-81bcb80b0000 pid=3000 /usr/bin/rm delete-file guuid=98891143-1a00-0000-30c8-81bceb0a0000 pid=2795->guuid=080e1cb3-1a00-0000-30c8-81bcb80b0000 pid=3000 execve guuid=db8669b3-1a00-0000-30c8-81bcb90b0000 pid=3001 /usr/bin/wget net send-data guuid=98891143-1a00-0000-30c8-81bceb0a0000 pid=2795->guuid=db8669b3-1a00-0000-30c8-81bcb90b0000 pid=3001 execve guuid=53e859b8-1a00-0000-30c8-81bcc20b0000 pid=3010 /usr/bin/curl net send-data write-file guuid=98891143-1a00-0000-30c8-81bceb0a0000 pid=2795->guuid=53e859b8-1a00-0000-30c8-81bcc20b0000 pid=3010 execve guuid=9f6a95bf-1a00-0000-30c8-81bcc60b0000 pid=3014 /usr/bin/chmod guuid=98891143-1a00-0000-30c8-81bceb0a0000 pid=2795->guuid=9f6a95bf-1a00-0000-30c8-81bcc60b0000 pid=3014 execve guuid=205c17c0-1a00-0000-30c8-81bcc70b0000 pid=3015 /usr/bin/bash guuid=98891143-1a00-0000-30c8-81bceb0a0000 pid=2795->guuid=205c17c0-1a00-0000-30c8-81bcc70b0000 pid=3015 clone guuid=a4d851c0-1a00-0000-30c8-81bcc80b0000 pid=3016 /usr/bin/rm delete-file guuid=98891143-1a00-0000-30c8-81bceb0a0000 pid=2795->guuid=a4d851c0-1a00-0000-30c8-81bcc80b0000 pid=3016 execve guuid=37adfdc0-1a00-0000-30c8-81bcc90b0000 pid=3017 /usr/bin/wget net send-data guuid=98891143-1a00-0000-30c8-81bceb0a0000 pid=2795->guuid=37adfdc0-1a00-0000-30c8-81bcc90b0000 pid=3017 execve guuid=16d849c6-1a00-0000-30c8-81bcca0b0000 pid=3018 /usr/bin/curl net send-data write-file guuid=98891143-1a00-0000-30c8-81bceb0a0000 pid=2795->guuid=16d849c6-1a00-0000-30c8-81bcca0b0000 pid=3018 execve guuid=39f31ecc-1a00-0000-30c8-81bcd70b0000 pid=3031 /usr/bin/chmod guuid=98891143-1a00-0000-30c8-81bceb0a0000 pid=2795->guuid=39f31ecc-1a00-0000-30c8-81bcd70b0000 pid=3031 execve guuid=57326dcc-1a00-0000-30c8-81bcd90b0000 pid=3033 /usr/bin/bash guuid=98891143-1a00-0000-30c8-81bceb0a0000 pid=2795->guuid=57326dcc-1a00-0000-30c8-81bcd90b0000 pid=3033 clone guuid=3914a3cc-1a00-0000-30c8-81bcda0b0000 pid=3034 /usr/bin/rm delete-file guuid=98891143-1a00-0000-30c8-81bceb0a0000 pid=2795->guuid=3914a3cc-1a00-0000-30c8-81bcda0b0000 pid=3034 execve guuid=24eb14cd-1a00-0000-30c8-81bcdd0b0000 pid=3037 /usr/bin/wget net send-data guuid=98891143-1a00-0000-30c8-81bceb0a0000 pid=2795->guuid=24eb14cd-1a00-0000-30c8-81bcdd0b0000 pid=3037 execve guuid=461e4ed1-1a00-0000-30c8-81bce90b0000 pid=3049 /usr/bin/curl net send-data write-file guuid=98891143-1a00-0000-30c8-81bceb0a0000 pid=2795->guuid=461e4ed1-1a00-0000-30c8-81bce90b0000 pid=3049 execve guuid=d4edbcd6-1a00-0000-30c8-81bcf80b0000 pid=3064 /usr/bin/chmod guuid=98891143-1a00-0000-30c8-81bceb0a0000 pid=2795->guuid=d4edbcd6-1a00-0000-30c8-81bcf80b0000 pid=3064 execve guuid=070f01d7-1a00-0000-30c8-81bcf90b0000 pid=3065 /usr/bin/bash guuid=98891143-1a00-0000-30c8-81bceb0a0000 pid=2795->guuid=070f01d7-1a00-0000-30c8-81bcf90b0000 pid=3065 clone guuid=ff5733d7-1a00-0000-30c8-81bcfb0b0000 pid=3067 /usr/bin/rm delete-file guuid=98891143-1a00-0000-30c8-81bceb0a0000 pid=2795->guuid=ff5733d7-1a00-0000-30c8-81bcfb0b0000 pid=3067 execve guuid=1b1a97d7-1a00-0000-30c8-81bcfd0b0000 pid=3069 /usr/bin/wget net send-data guuid=98891143-1a00-0000-30c8-81bceb0a0000 pid=2795->guuid=1b1a97d7-1a00-0000-30c8-81bcfd0b0000 pid=3069 execve guuid=51a1c4db-1a00-0000-30c8-81bc0b0c0000 pid=3083 /usr/bin/curl net send-data write-file guuid=98891143-1a00-0000-30c8-81bceb0a0000 pid=2795->guuid=51a1c4db-1a00-0000-30c8-81bc0b0c0000 pid=3083 execve guuid=0d0aa7e1-1a00-0000-30c8-81bc1d0c0000 pid=3101 /usr/bin/chmod guuid=98891143-1a00-0000-30c8-81bceb0a0000 pid=2795->guuid=0d0aa7e1-1a00-0000-30c8-81bc1d0c0000 pid=3101 execve guuid=b4c337e2-1a00-0000-30c8-81bc200c0000 pid=3104 /usr/bin/bash guuid=98891143-1a00-0000-30c8-81bceb0a0000 pid=2795->guuid=b4c337e2-1a00-0000-30c8-81bc200c0000 pid=3104 clone guuid=127a61e2-1a00-0000-30c8-81bc210c0000 pid=3105 /usr/bin/rm delete-file guuid=98891143-1a00-0000-30c8-81bceb0a0000 pid=2795->guuid=127a61e2-1a00-0000-30c8-81bc210c0000 pid=3105 execve guuid=d53ec1e2-1a00-0000-30c8-81bc230c0000 pid=3107 /usr/bin/wget net send-data guuid=98891143-1a00-0000-30c8-81bceb0a0000 pid=2795->guuid=d53ec1e2-1a00-0000-30c8-81bc230c0000 pid=3107 execve guuid=9b5e36e7-1a00-0000-30c8-81bc310c0000 pid=3121 /usr/bin/curl net send-data write-file guuid=98891143-1a00-0000-30c8-81bceb0a0000 pid=2795->guuid=9b5e36e7-1a00-0000-30c8-81bc310c0000 pid=3121 execve guuid=f3af55ec-1a00-0000-30c8-81bc3e0c0000 pid=3134 /usr/bin/chmod guuid=98891143-1a00-0000-30c8-81bceb0a0000 pid=2795->guuid=f3af55ec-1a00-0000-30c8-81bc3e0c0000 pid=3134 execve guuid=0438a6ec-1a00-0000-30c8-81bc3f0c0000 pid=3135 /usr/bin/bash guuid=98891143-1a00-0000-30c8-81bceb0a0000 pid=2795->guuid=0438a6ec-1a00-0000-30c8-81bc3f0c0000 pid=3135 clone guuid=8b19d4ec-1a00-0000-30c8-81bc410c0000 pid=3137 /usr/bin/rm delete-file guuid=98891143-1a00-0000-30c8-81bceb0a0000 pid=2795->guuid=8b19d4ec-1a00-0000-30c8-81bc410c0000 pid=3137 execve guuid=67d220ed-1a00-0000-30c8-81bc430c0000 pid=3139 /usr/bin/wget net send-data guuid=98891143-1a00-0000-30c8-81bceb0a0000 pid=2795->guuid=67d220ed-1a00-0000-30c8-81bc430c0000 pid=3139 execve guuid=defe70f1-1a00-0000-30c8-81bc500c0000 pid=3152 /usr/bin/curl net send-data write-file guuid=98891143-1a00-0000-30c8-81bceb0a0000 pid=2795->guuid=defe70f1-1a00-0000-30c8-81bc500c0000 pid=3152 execve guuid=22ff94f6-1a00-0000-30c8-81bc5f0c0000 pid=3167 /usr/bin/chmod guuid=98891143-1a00-0000-30c8-81bceb0a0000 pid=2795->guuid=22ff94f6-1a00-0000-30c8-81bc5f0c0000 pid=3167 execve guuid=059eecf6-1a00-0000-30c8-81bc610c0000 pid=3169 /usr/bin/bash guuid=98891143-1a00-0000-30c8-81bceb0a0000 pid=2795->guuid=059eecf6-1a00-0000-30c8-81bc610c0000 pid=3169 clone guuid=77301ef7-1a00-0000-30c8-81bc630c0000 pid=3171 /usr/bin/rm delete-file guuid=98891143-1a00-0000-30c8-81bceb0a0000 pid=2795->guuid=77301ef7-1a00-0000-30c8-81bc630c0000 pid=3171 execve guuid=eac388f7-1a00-0000-30c8-81bc650c0000 pid=3173 /usr/bin/wget net send-data guuid=98891143-1a00-0000-30c8-81bceb0a0000 pid=2795->guuid=eac388f7-1a00-0000-30c8-81bc650c0000 pid=3173 execve guuid=17fcb1fc-1a00-0000-30c8-81bc730c0000 pid=3187 /usr/bin/curl net send-data write-file guuid=98891143-1a00-0000-30c8-81bceb0a0000 pid=2795->guuid=17fcb1fc-1a00-0000-30c8-81bc730c0000 pid=3187 execve guuid=cb516a05-1b00-0000-30c8-81bc850c0000 pid=3205 /usr/bin/chmod guuid=98891143-1a00-0000-30c8-81bceb0a0000 pid=2795->guuid=cb516a05-1b00-0000-30c8-81bc850c0000 pid=3205 execve guuid=7431d205-1b00-0000-30c8-81bc870c0000 pid=3207 /usr/bin/bash guuid=98891143-1a00-0000-30c8-81bceb0a0000 pid=2795->guuid=7431d205-1b00-0000-30c8-81bc870c0000 pid=3207 clone guuid=84220306-1b00-0000-30c8-81bc890c0000 pid=3209 /usr/bin/rm delete-file guuid=98891143-1a00-0000-30c8-81bceb0a0000 pid=2795->guuid=84220306-1b00-0000-30c8-81bc890c0000 pid=3209 execve guuid=9c345e06-1b00-0000-30c8-81bc8a0c0000 pid=3210 /usr/bin/wget net send-data guuid=98891143-1a00-0000-30c8-81bceb0a0000 pid=2795->guuid=9c345e06-1b00-0000-30c8-81bc8a0c0000 pid=3210 execve guuid=6959ff0a-1b00-0000-30c8-81bc950c0000 pid=3221 /usr/bin/curl net send-data write-file guuid=98891143-1a00-0000-30c8-81bceb0a0000 pid=2795->guuid=6959ff0a-1b00-0000-30c8-81bc950c0000 pid=3221 execve guuid=77e1c310-1b00-0000-30c8-81bc9c0c0000 pid=3228 /usr/bin/chmod guuid=98891143-1a00-0000-30c8-81bceb0a0000 pid=2795->guuid=77e1c310-1b00-0000-30c8-81bc9c0c0000 pid=3228 execve guuid=20092911-1b00-0000-30c8-81bc9d0c0000 pid=3229 /usr/bin/bash guuid=98891143-1a00-0000-30c8-81bceb0a0000 pid=2795->guuid=20092911-1b00-0000-30c8-81bc9d0c0000 pid=3229 clone guuid=a3de5411-1b00-0000-30c8-81bc9e0c0000 pid=3230 /usr/bin/rm delete-file guuid=98891143-1a00-0000-30c8-81bceb0a0000 pid=2795->guuid=a3de5411-1b00-0000-30c8-81bc9e0c0000 pid=3230 execve guuid=2d05cd11-1b00-0000-30c8-81bc9f0c0000 pid=3231 /usr/bin/wget net send-data guuid=98891143-1a00-0000-30c8-81bceb0a0000 pid=2795->guuid=2d05cd11-1b00-0000-30c8-81bc9f0c0000 pid=3231 execve guuid=2c3f0117-1b00-0000-30c8-81bca00c0000 pid=3232 /usr/bin/curl net send-data write-file guuid=98891143-1a00-0000-30c8-81bceb0a0000 pid=2795->guuid=2c3f0117-1b00-0000-30c8-81bca00c0000 pid=3232 execve guuid=c768501d-1b00-0000-30c8-81bca50c0000 pid=3237 /usr/bin/chmod guuid=98891143-1a00-0000-30c8-81bceb0a0000 pid=2795->guuid=c768501d-1b00-0000-30c8-81bca50c0000 pid=3237 execve guuid=748f9b1d-1b00-0000-30c8-81bca60c0000 pid=3238 /usr/bin/bash guuid=98891143-1a00-0000-30c8-81bceb0a0000 pid=2795->guuid=748f9b1d-1b00-0000-30c8-81bca60c0000 pid=3238 clone guuid=aff3bc1d-1b00-0000-30c8-81bca80c0000 pid=3240 /usr/bin/rm delete-file guuid=98891143-1a00-0000-30c8-81bceb0a0000 pid=2795->guuid=aff3bc1d-1b00-0000-30c8-81bca80c0000 pid=3240 execve guuid=2ea61a1e-1b00-0000-30c8-81bcaa0c0000 pid=3242 /usr/bin/wget net send-data guuid=98891143-1a00-0000-30c8-81bceb0a0000 pid=2795->guuid=2ea61a1e-1b00-0000-30c8-81bcaa0c0000 pid=3242 execve guuid=9d408e22-1b00-0000-30c8-81bcb50c0000 pid=3253 /usr/bin/curl net send-data write-file guuid=98891143-1a00-0000-30c8-81bceb0a0000 pid=2795->guuid=9d408e22-1b00-0000-30c8-81bcb50c0000 pid=3253 execve guuid=9cc93628-1b00-0000-30c8-81bcc00c0000 pid=3264 /usr/bin/chmod guuid=98891143-1a00-0000-30c8-81bceb0a0000 pid=2795->guuid=9cc93628-1b00-0000-30c8-81bcc00c0000 pid=3264 execve guuid=23cfa128-1b00-0000-30c8-81bcc20c0000 pid=3266 /usr/bin/bash guuid=98891143-1a00-0000-30c8-81bceb0a0000 pid=2795->guuid=23cfa128-1b00-0000-30c8-81bcc20c0000 pid=3266 clone guuid=d873e828-1b00-0000-30c8-81bcc40c0000 pid=3268 /usr/bin/rm delete-file guuid=98891143-1a00-0000-30c8-81bceb0a0000 pid=2795->guuid=d873e828-1b00-0000-30c8-81bcc40c0000 pid=3268 execve guuid=02514e29-1b00-0000-30c8-81bcc50c0000 pid=3269 /usr/bin/wget net send-data guuid=98891143-1a00-0000-30c8-81bceb0a0000 pid=2795->guuid=02514e29-1b00-0000-30c8-81bcc50c0000 pid=3269 execve guuid=08e8d92d-1b00-0000-30c8-81bcce0c0000 pid=3278 /usr/bin/curl net send-data write-file guuid=98891143-1a00-0000-30c8-81bceb0a0000 pid=2795->guuid=08e8d92d-1b00-0000-30c8-81bcce0c0000 pid=3278 execve guuid=22952836-1b00-0000-30c8-81bccf0c0000 pid=3279 /usr/bin/chmod guuid=98891143-1a00-0000-30c8-81bceb0a0000 pid=2795->guuid=22952836-1b00-0000-30c8-81bccf0c0000 pid=3279 execve guuid=e3e9ac36-1b00-0000-30c8-81bcd00c0000 pid=3280 /usr/bin/bash guuid=98891143-1a00-0000-30c8-81bceb0a0000 pid=2795->guuid=e3e9ac36-1b00-0000-30c8-81bcd00c0000 pid=3280 clone guuid=b9fffa36-1b00-0000-30c8-81bcd10c0000 pid=3281 /usr/bin/rm delete-file guuid=98891143-1a00-0000-30c8-81bceb0a0000 pid=2795->guuid=b9fffa36-1b00-0000-30c8-81bcd10c0000 pid=3281 execve guuid=a2019637-1b00-0000-30c8-81bcd20c0000 pid=3282 /usr/bin/wget net send-data guuid=98891143-1a00-0000-30c8-81bceb0a0000 pid=2795->guuid=a2019637-1b00-0000-30c8-81bcd20c0000 pid=3282 execve guuid=4598033c-1b00-0000-30c8-81bcd30c0000 pid=3283 /usr/bin/curl net send-data write-file guuid=98891143-1a00-0000-30c8-81bceb0a0000 pid=2795->guuid=4598033c-1b00-0000-30c8-81bcd30c0000 pid=3283 execve guuid=a29c1942-1b00-0000-30c8-81bcd90c0000 pid=3289 /usr/bin/chmod guuid=98891143-1a00-0000-30c8-81bceb0a0000 pid=2795->guuid=a29c1942-1b00-0000-30c8-81bcd90c0000 pid=3289 execve guuid=45b46442-1b00-0000-30c8-81bcdb0c0000 pid=3291 /usr/bin/bash guuid=98891143-1a00-0000-30c8-81bceb0a0000 pid=2795->guuid=45b46442-1b00-0000-30c8-81bcdb0c0000 pid=3291 clone guuid=39499242-1b00-0000-30c8-81bcdd0c0000 pid=3293 /usr/bin/rm delete-file guuid=98891143-1a00-0000-30c8-81bceb0a0000 pid=2795->guuid=39499242-1b00-0000-30c8-81bcdd0c0000 pid=3293 execve e4e03298-99ea-5528-be32-6d1c712fc916 45.138.16.35:80 guuid=978a8049-1a00-0000-30c8-81bcf70a0000 pid=2807->e4e03298-99ea-5528-be32-6d1c712fc916 send: 151B guuid=c321158c-1a00-0000-30c8-81bc700b0000 pid=2928->e4e03298-99ea-5528-be32-6d1c712fc916 send: 100B guuid=8977b895-1a00-0000-30c8-81bc840b0000 pid=2948->e4e03298-99ea-5528-be32-6d1c712fc916 send: 152B guuid=84530d9a-1a00-0000-30c8-81bc8e0b0000 pid=2958->e4e03298-99ea-5528-be32-6d1c712fc916 send: 101B guuid=89287da2-1a00-0000-30c8-81bca20b0000 pid=2978->e4e03298-99ea-5528-be32-6d1c712fc916 send: 151B guuid=9fc11ca7-1a00-0000-30c8-81bcad0b0000 pid=2989->e4e03298-99ea-5528-be32-6d1c712fc916 send: 100B guuid=db8669b3-1a00-0000-30c8-81bcb90b0000 pid=3001->e4e03298-99ea-5528-be32-6d1c712fc916 send: 152B guuid=53e859b8-1a00-0000-30c8-81bcc20b0000 pid=3010->e4e03298-99ea-5528-be32-6d1c712fc916 send: 101B guuid=37adfdc0-1a00-0000-30c8-81bcc90b0000 pid=3017->e4e03298-99ea-5528-be32-6d1c712fc916 send: 152B guuid=16d849c6-1a00-0000-30c8-81bcca0b0000 pid=3018->e4e03298-99ea-5528-be32-6d1c712fc916 send: 101B guuid=24eb14cd-1a00-0000-30c8-81bcdd0b0000 pid=3037->e4e03298-99ea-5528-be32-6d1c712fc916 send: 154B guuid=461e4ed1-1a00-0000-30c8-81bce90b0000 pid=3049->e4e03298-99ea-5528-be32-6d1c712fc916 send: 103B guuid=1b1a97d7-1a00-0000-30c8-81bcfd0b0000 pid=3069->e4e03298-99ea-5528-be32-6d1c712fc916 send: 152B guuid=51a1c4db-1a00-0000-30c8-81bc0b0c0000 pid=3083->e4e03298-99ea-5528-be32-6d1c712fc916 send: 101B guuid=d53ec1e2-1a00-0000-30c8-81bc230c0000 pid=3107->e4e03298-99ea-5528-be32-6d1c712fc916 send: 151B guuid=9b5e36e7-1a00-0000-30c8-81bc310c0000 pid=3121->e4e03298-99ea-5528-be32-6d1c712fc916 send: 100B guuid=67d220ed-1a00-0000-30c8-81bc430c0000 pid=3139->e4e03298-99ea-5528-be32-6d1c712fc916 send: 152B guuid=defe70f1-1a00-0000-30c8-81bc500c0000 pid=3152->e4e03298-99ea-5528-be32-6d1c712fc916 send: 101B guuid=eac388f7-1a00-0000-30c8-81bc650c0000 pid=3173->e4e03298-99ea-5528-be32-6d1c712fc916 send: 152B guuid=17fcb1fc-1a00-0000-30c8-81bc730c0000 pid=3187->e4e03298-99ea-5528-be32-6d1c712fc916 send: 101B guuid=9c345e06-1b00-0000-30c8-81bc8a0c0000 pid=3210->e4e03298-99ea-5528-be32-6d1c712fc916 send: 152B guuid=6959ff0a-1b00-0000-30c8-81bc950c0000 pid=3221->e4e03298-99ea-5528-be32-6d1c712fc916 send: 101B guuid=2d05cd11-1b00-0000-30c8-81bc9f0c0000 pid=3231->e4e03298-99ea-5528-be32-6d1c712fc916 send: 151B guuid=2c3f0117-1b00-0000-30c8-81bca00c0000 pid=3232->e4e03298-99ea-5528-be32-6d1c712fc916 send: 100B guuid=2ea61a1e-1b00-0000-30c8-81bcaa0c0000 pid=3242->e4e03298-99ea-5528-be32-6d1c712fc916 send: 151B guuid=9d408e22-1b00-0000-30c8-81bcb50c0000 pid=3253->e4e03298-99ea-5528-be32-6d1c712fc916 send: 100B guuid=02514e29-1b00-0000-30c8-81bcc50c0000 pid=3269->e4e03298-99ea-5528-be32-6d1c712fc916 send: 152B guuid=08e8d92d-1b00-0000-30c8-81bcce0c0000 pid=3278->e4e03298-99ea-5528-be32-6d1c712fc916 send: 101B guuid=a2019637-1b00-0000-30c8-81bcd20c0000 pid=3282->e4e03298-99ea-5528-be32-6d1c712fc916 send: 151B guuid=4598033c-1b00-0000-30c8-81bcd30c0000 pid=3283->e4e03298-99ea-5528-be32-6d1c712fc916 send: 100B
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/215a01dc972b5c0e601549e012da44b00e12ca07906d19731c51998e1ecd7512
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/215a01dc972b5c0e601549e012da44b00e12ca07906d19731c51998e1ecd7512/
Threat name:
Linux.Downloader.Medusa
Create hunting rule
Status:
Malicious
First seen:
2025-07-09 08:52:52 UTC
File Type:
Text (Shell)
AV detection:
22 of 37 (59.46%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=efnadxexfnoa4yavjhqbfwsewahbfsqhsbwrs4y4kgmy4hwnouja._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/250709-kszb8swqw4/
Behaviour
Reads runtime system information
System Network Configuration Discovery
Writes file to tmp directory
Checks CPU configuration
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.80
Link:
https://yomi.yoroi.company/submissions/215a01dc972b5c0e601549e012da44b00e12ca07906d19731c51998e1ecd7512

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Linux_Shellscript_Downloader
Create hunting rule
Author:albertzsigovits
Description:Generic Approach to Shellscript downloaders

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 215a01dc972b5c0e601549e012da44b00e12ca07906d19731c51998e1ecd7512

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3579575/
  
Delivery method
Distributed via web download

Comments