🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 275cc121d809a2e655dbf140ead34e243c11e7f11277d356abe406c21a5f8f6e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 275cc121d809a2e655dbf140ead34e243c11e7f11277d356abe406c21a5f8f6e
SHA3-384 hash: f4b1f46497e7cead0f7e84944ecd2c1c618e86a08b8c229fdab4390e5728f3b4d32b732132661b00770397e4c905936f
SHA1 hash: 849b5c5d767c066612d2d624c3f7c8b1bd7a241f
MD5 hash: d7113bcaed406137cc78bd9d2bffab6b
humanhash: autumn-juliet-tennessee-dakota
File name:ok
Download: download sample
File size:1'608 bytes
First seen:2026-08-26 15:35:20 UTC
Last seen:2026-08-26 19:21:21 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 12:Ud6V1so5Qex6QeKLgWfGXlWr6Uswtr6ish6KKwn65B16BlVDgI6gLUo4Nc660moM:z11C4VsojwKrasQ4K2vakhQExZde
TLSH T1973182CB012009311502FE4E76F2344C668DA2EB3DAFC3E4DD4D1DAA938939CF224B49
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://5.182.210.174/4b48e5n/an/an/a
http://5.182.210.174/e655f5n/an/an/a
http://5.182.210.174/888461n/an/an/a
http://5.182.210.174/e7d18an/an/an/a
http://5.182.210.174/08b94an/an/an/a
http://5.182.210.174/59fffbn/an/an/a
http://5.182.210.174/70e301n/an/an/a
http://5.182.210.174/62d2c4n/an/an/a
http://5.182.210.174/10aa88n/an/an/a
http://5.182.210.174/e08a65n/an/an/a
http://5.182.210.174/f955b6n/an/an/a
http://5.182.210.174/0d13d5n/an/an/a

Intelligence

File Origin
# of uploads :
3
# of downloads :
77
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive mirai
Link:
https://www.filescan.io/uploads/6a8f07ee0feffa38c0c13388/reports/f7b681dc-d7b8-4a99-b76f-8d6a12ac8dcc/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-08-26T13:16:00Z UTC
Last seen:
2026-08-27T18:07:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/275cc121d809a2e655dbf140ead34e243c11e7f11277d356abe406c21a5f8f6e/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/ccf0ceee-a60e-487b-87bf-ec5e14f13419
Behavior Graph:
Download SVG
%3 guuid=f57da78c-1a00-0000-ebed-81d07e080000 pid=2174 /usr/bin/sudo guuid=65059b8f-1a00-0000-ebed-81d085080000 pid=2181 /tmp/sample.bin guuid=f57da78c-1a00-0000-ebed-81d07e080000 pid=2174->guuid=65059b8f-1a00-0000-ebed-81d085080000 pid=2181 execve guuid=2d209390-1a00-0000-ebed-81d087080000 pid=2183 /usr/bin/wget net send-data guuid=65059b8f-1a00-0000-ebed-81d085080000 pid=2181->guuid=2d209390-1a00-0000-ebed-81d087080000 pid=2183 execve guuid=7d7a8097-1a00-0000-ebed-81d090080000 pid=2192 /usr/bin/curl net send-data write-file guuid=65059b8f-1a00-0000-ebed-81d085080000 pid=2181->guuid=7d7a8097-1a00-0000-ebed-81d090080000 pid=2192 execve guuid=28c520a3-1a00-0000-ebed-81d0a0080000 pid=2208 /usr/bin/chmod guuid=65059b8f-1a00-0000-ebed-81d085080000 pid=2181->guuid=28c520a3-1a00-0000-ebed-81d0a0080000 pid=2208 execve guuid=ddd777a3-1a00-0000-ebed-81d0a2080000 pid=2210 /usr/bin/bash guuid=65059b8f-1a00-0000-ebed-81d085080000 pid=2181->guuid=ddd777a3-1a00-0000-ebed-81d0a2080000 pid=2210 clone guuid=71f4bea3-1a00-0000-ebed-81d0a4080000 pid=2212 /usr/bin/rm delete-file guuid=65059b8f-1a00-0000-ebed-81d085080000 pid=2181->guuid=71f4bea3-1a00-0000-ebed-81d0a4080000 pid=2212 execve guuid=680a44a4-1a00-0000-ebed-81d0a5080000 pid=2213 /usr/bin/rm guuid=65059b8f-1a00-0000-ebed-81d085080000 pid=2181->guuid=680a44a4-1a00-0000-ebed-81d0a5080000 pid=2213 execve guuid=9521dca4-1a00-0000-ebed-81d0a6080000 pid=2214 /usr/bin/wget net send-data guuid=65059b8f-1a00-0000-ebed-81d085080000 pid=2181->guuid=9521dca4-1a00-0000-ebed-81d0a6080000 pid=2214 execve guuid=695439a8-1a00-0000-ebed-81d0a8080000 pid=2216 /usr/bin/curl net send-data write-file guuid=65059b8f-1a00-0000-ebed-81d085080000 pid=2181->guuid=695439a8-1a00-0000-ebed-81d0a8080000 pid=2216 execve guuid=4abbc9ae-1a00-0000-ebed-81d0b7080000 pid=2231 /usr/bin/chmod guuid=65059b8f-1a00-0000-ebed-81d085080000 pid=2181->guuid=4abbc9ae-1a00-0000-ebed-81d0b7080000 pid=2231 execve guuid=40cd08af-1a00-0000-ebed-81d0b9080000 pid=2233 /usr/bin/bash guuid=65059b8f-1a00-0000-ebed-81d085080000 pid=2181->guuid=40cd08af-1a00-0000-ebed-81d0b9080000 pid=2233 clone guuid=fa093faf-1a00-0000-ebed-81d0bc080000 pid=2236 /usr/bin/rm delete-file guuid=65059b8f-1a00-0000-ebed-81d085080000 pid=2181->guuid=fa093faf-1a00-0000-ebed-81d0bc080000 pid=2236 execve guuid=9bdc99af-1a00-0000-ebed-81d0be080000 pid=2238 /usr/bin/rm guuid=65059b8f-1a00-0000-ebed-81d085080000 pid=2181->guuid=9bdc99af-1a00-0000-ebed-81d0be080000 pid=2238 execve guuid=90c6f2af-1a00-0000-ebed-81d0c0080000 pid=2240 /usr/bin/wget net send-data guuid=65059b8f-1a00-0000-ebed-81d085080000 pid=2181->guuid=90c6f2af-1a00-0000-ebed-81d0c0080000 pid=2240 execve guuid=42e9bdb3-1a00-0000-ebed-81d0c6080000 pid=2246 /usr/bin/curl net send-data write-file guuid=65059b8f-1a00-0000-ebed-81d085080000 pid=2181->guuid=42e9bdb3-1a00-0000-ebed-81d0c6080000 pid=2246 execve guuid=5e4dc8b8-1a00-0000-ebed-81d0d1080000 pid=2257 /usr/bin/chmod guuid=65059b8f-1a00-0000-ebed-81d085080000 pid=2181->guuid=5e4dc8b8-1a00-0000-ebed-81d0d1080000 pid=2257 execve guuid=e3b928b9-1a00-0000-ebed-81d0d3080000 pid=2259 /usr/bin/bash guuid=65059b8f-1a00-0000-ebed-81d085080000 pid=2181->guuid=e3b928b9-1a00-0000-ebed-81d0d3080000 pid=2259 clone guuid=c76f7bb9-1a00-0000-ebed-81d0d6080000 pid=2262 /usr/bin/rm delete-file guuid=65059b8f-1a00-0000-ebed-81d085080000 pid=2181->guuid=c76f7bb9-1a00-0000-ebed-81d0d6080000 pid=2262 execve guuid=c24cf0b9-1a00-0000-ebed-81d0d8080000 pid=2264 /usr/bin/rm guuid=65059b8f-1a00-0000-ebed-81d085080000 pid=2181->guuid=c24cf0b9-1a00-0000-ebed-81d0d8080000 pid=2264 execve guuid=9d6554ba-1a00-0000-ebed-81d0da080000 pid=2266 /usr/bin/wget net send-data guuid=65059b8f-1a00-0000-ebed-81d085080000 pid=2181->guuid=9d6554ba-1a00-0000-ebed-81d0da080000 pid=2266 execve guuid=ec065cbd-1a00-0000-ebed-81d0df080000 pid=2271 /usr/bin/curl net send-data write-file guuid=65059b8f-1a00-0000-ebed-81d085080000 pid=2181->guuid=ec065cbd-1a00-0000-ebed-81d0df080000 pid=2271 execve guuid=f0c948c3-1a00-0000-ebed-81d0e9080000 pid=2281 /usr/bin/chmod guuid=65059b8f-1a00-0000-ebed-81d085080000 pid=2181->guuid=f0c948c3-1a00-0000-ebed-81d0e9080000 pid=2281 execve guuid=ee641fc4-1a00-0000-ebed-81d0ea080000 pid=2282 /usr/bin/bash guuid=65059b8f-1a00-0000-ebed-81d085080000 pid=2181->guuid=ee641fc4-1a00-0000-ebed-81d0ea080000 pid=2282 clone guuid=5a1e9ec4-1a00-0000-ebed-81d0ec080000 pid=2284 /usr/bin/rm delete-file guuid=65059b8f-1a00-0000-ebed-81d085080000 pid=2181->guuid=5a1e9ec4-1a00-0000-ebed-81d0ec080000 pid=2284 execve guuid=45a229c5-1a00-0000-ebed-81d0ed080000 pid=2285 /usr/bin/rm guuid=65059b8f-1a00-0000-ebed-81d085080000 pid=2181->guuid=45a229c5-1a00-0000-ebed-81d0ed080000 pid=2285 execve guuid=de327cc5-1a00-0000-ebed-81d0f0080000 pid=2288 /usr/bin/wget net send-data guuid=65059b8f-1a00-0000-ebed-81d085080000 pid=2181->guuid=de327cc5-1a00-0000-ebed-81d0f0080000 pid=2288 execve guuid=d6180bc8-1a00-0000-ebed-81d0f9080000 pid=2297 /usr/bin/curl net send-data write-file guuid=65059b8f-1a00-0000-ebed-81d085080000 pid=2181->guuid=d6180bc8-1a00-0000-ebed-81d0f9080000 pid=2297 execve guuid=a9c052cc-1a00-0000-ebed-81d002090000 pid=2306 /usr/bin/chmod guuid=65059b8f-1a00-0000-ebed-81d085080000 pid=2181->guuid=a9c052cc-1a00-0000-ebed-81d002090000 pid=2306 execve guuid=3781abcc-1a00-0000-ebed-81d004090000 pid=2308 /usr/bin/bash guuid=65059b8f-1a00-0000-ebed-81d085080000 pid=2181->guuid=3781abcc-1a00-0000-ebed-81d004090000 pid=2308 clone guuid=858703cd-1a00-0000-ebed-81d006090000 pid=2310 /usr/bin/rm delete-file guuid=65059b8f-1a00-0000-ebed-81d085080000 pid=2181->guuid=858703cd-1a00-0000-ebed-81d006090000 pid=2310 execve guuid=68696ecd-1a00-0000-ebed-81d009090000 pid=2313 /usr/bin/rm guuid=65059b8f-1a00-0000-ebed-81d085080000 pid=2181->guuid=68696ecd-1a00-0000-ebed-81d009090000 pid=2313 execve guuid=9ebc04ce-1a00-0000-ebed-81d00a090000 pid=2314 /usr/bin/wget net send-data guuid=65059b8f-1a00-0000-ebed-81d085080000 pid=2181->guuid=9ebc04ce-1a00-0000-ebed-81d00a090000 pid=2314 execve guuid=44a769d2-1a00-0000-ebed-81d010090000 pid=2320 /usr/bin/curl net send-data write-file guuid=65059b8f-1a00-0000-ebed-81d085080000 pid=2181->guuid=44a769d2-1a00-0000-ebed-81d010090000 pid=2320 execve guuid=c4539fd9-1a00-0000-ebed-81d01f090000 pid=2335 /usr/bin/chmod guuid=65059b8f-1a00-0000-ebed-81d085080000 pid=2181->guuid=c4539fd9-1a00-0000-ebed-81d01f090000 pid=2335 execve guuid=52c3f2d9-1a00-0000-ebed-81d021090000 pid=2337 /usr/bin/bash guuid=65059b8f-1a00-0000-ebed-81d085080000 pid=2181->guuid=52c3f2d9-1a00-0000-ebed-81d021090000 pid=2337 clone guuid=097a29da-1a00-0000-ebed-81d023090000 pid=2339 /usr/bin/rm delete-file guuid=65059b8f-1a00-0000-ebed-81d085080000 pid=2181->guuid=097a29da-1a00-0000-ebed-81d023090000 pid=2339 execve guuid=d9768fda-1a00-0000-ebed-81d024090000 pid=2340 /usr/bin/rm guuid=65059b8f-1a00-0000-ebed-81d085080000 pid=2181->guuid=d9768fda-1a00-0000-ebed-81d024090000 pid=2340 execve guuid=2739e3da-1a00-0000-ebed-81d025090000 pid=2341 /usr/bin/wget net send-data guuid=65059b8f-1a00-0000-ebed-81d085080000 pid=2181->guuid=2739e3da-1a00-0000-ebed-81d025090000 pid=2341 execve guuid=192a02de-1a00-0000-ebed-81d028090000 pid=2344 /usr/bin/curl net send-data write-file guuid=65059b8f-1a00-0000-ebed-81d085080000 pid=2181->guuid=192a02de-1a00-0000-ebed-81d028090000 pid=2344 execve guuid=c2ffffe2-1a00-0000-ebed-81d032090000 pid=2354 /usr/bin/chmod guuid=65059b8f-1a00-0000-ebed-81d085080000 pid=2181->guuid=c2ffffe2-1a00-0000-ebed-81d032090000 pid=2354 execve guuid=30fc38e4-1a00-0000-ebed-81d036090000 pid=2358 /usr/bin/bash guuid=65059b8f-1a00-0000-ebed-81d085080000 pid=2181->guuid=30fc38e4-1a00-0000-ebed-81d036090000 pid=2358 clone guuid=9035e0e4-1a00-0000-ebed-81d039090000 pid=2361 /usr/bin/rm delete-file guuid=65059b8f-1a00-0000-ebed-81d085080000 pid=2181->guuid=9035e0e4-1a00-0000-ebed-81d039090000 pid=2361 execve guuid=d0cfd9e5-1a00-0000-ebed-81d03c090000 pid=2364 /usr/bin/rm guuid=65059b8f-1a00-0000-ebed-81d085080000 pid=2181->guuid=d0cfd9e5-1a00-0000-ebed-81d03c090000 pid=2364 execve guuid=bcf3d1e6-1a00-0000-ebed-81d040090000 pid=2368 /usr/bin/wget net send-data guuid=65059b8f-1a00-0000-ebed-81d085080000 pid=2181->guuid=bcf3d1e6-1a00-0000-ebed-81d040090000 pid=2368 execve guuid=7aa0fdeb-1a00-0000-ebed-81d04a090000 pid=2378 /usr/bin/curl net send-data write-file guuid=65059b8f-1a00-0000-ebed-81d085080000 pid=2181->guuid=7aa0fdeb-1a00-0000-ebed-81d04a090000 pid=2378 execve guuid=06ecfef6-1a00-0000-ebed-81d05f090000 pid=2399 /usr/bin/chmod guuid=65059b8f-1a00-0000-ebed-81d085080000 pid=2181->guuid=06ecfef6-1a00-0000-ebed-81d05f090000 pid=2399 execve guuid=b65d43f7-1a00-0000-ebed-81d061090000 pid=2401 /usr/bin/bash guuid=65059b8f-1a00-0000-ebed-81d085080000 pid=2181->guuid=b65d43f7-1a00-0000-ebed-81d061090000 pid=2401 clone guuid=f54d81f7-1a00-0000-ebed-81d063090000 pid=2403 /usr/bin/rm delete-file guuid=65059b8f-1a00-0000-ebed-81d085080000 pid=2181->guuid=f54d81f7-1a00-0000-ebed-81d063090000 pid=2403 execve guuid=7135bef7-1a00-0000-ebed-81d065090000 pid=2405 /usr/bin/rm guuid=65059b8f-1a00-0000-ebed-81d085080000 pid=2181->guuid=7135bef7-1a00-0000-ebed-81d065090000 pid=2405 execve guuid=a7f9faf7-1a00-0000-ebed-81d067090000 pid=2407 /usr/bin/wget net send-data guuid=65059b8f-1a00-0000-ebed-81d085080000 pid=2181->guuid=a7f9faf7-1a00-0000-ebed-81d067090000 pid=2407 execve guuid=a8846ffa-1a00-0000-ebed-81d06a090000 pid=2410 /usr/bin/curl net send-data write-file guuid=65059b8f-1a00-0000-ebed-81d085080000 pid=2181->guuid=a8846ffa-1a00-0000-ebed-81d06a090000 pid=2410 execve guuid=c61168ff-1a00-0000-ebed-81d073090000 pid=2419 /usr/bin/chmod guuid=65059b8f-1a00-0000-ebed-81d085080000 pid=2181->guuid=c61168ff-1a00-0000-ebed-81d073090000 pid=2419 execve guuid=beadd9ff-1a00-0000-ebed-81d074090000 pid=2420 /usr/bin/bash guuid=65059b8f-1a00-0000-ebed-81d085080000 pid=2181->guuid=beadd9ff-1a00-0000-ebed-81d074090000 pid=2420 clone guuid=52c93900-1b00-0000-ebed-81d077090000 pid=2423 /usr/bin/rm delete-file guuid=65059b8f-1a00-0000-ebed-81d085080000 pid=2181->guuid=52c93900-1b00-0000-ebed-81d077090000 pid=2423 execve guuid=03887500-1b00-0000-ebed-81d078090000 pid=2424 /usr/bin/rm guuid=65059b8f-1a00-0000-ebed-81d085080000 pid=2181->guuid=03887500-1b00-0000-ebed-81d078090000 pid=2424 execve guuid=ff80ae00-1b00-0000-ebed-81d079090000 pid=2425 /usr/bin/wget net send-data guuid=65059b8f-1a00-0000-ebed-81d085080000 pid=2181->guuid=ff80ae00-1b00-0000-ebed-81d079090000 pid=2425 execve guuid=af8a2103-1b00-0000-ebed-81d080090000 pid=2432 /usr/bin/curl net send-data write-file guuid=65059b8f-1a00-0000-ebed-81d085080000 pid=2181->guuid=af8a2103-1b00-0000-ebed-81d080090000 pid=2432 execve guuid=115c4b07-1b00-0000-ebed-81d08c090000 pid=2444 /usr/bin/chmod guuid=65059b8f-1a00-0000-ebed-81d085080000 pid=2181->guuid=115c4b07-1b00-0000-ebed-81d08c090000 pid=2444 execve guuid=3fdfae07-1b00-0000-ebed-81d08e090000 pid=2446 /usr/bin/bash guuid=65059b8f-1a00-0000-ebed-81d085080000 pid=2181->guuid=3fdfae07-1b00-0000-ebed-81d08e090000 pid=2446 clone guuid=3ab0f207-1b00-0000-ebed-81d091090000 pid=2449 /usr/bin/rm delete-file guuid=65059b8f-1a00-0000-ebed-81d085080000 pid=2181->guuid=3ab0f207-1b00-0000-ebed-81d091090000 pid=2449 execve guuid=c3a04f08-1b00-0000-ebed-81d093090000 pid=2451 /usr/bin/rm guuid=65059b8f-1a00-0000-ebed-81d085080000 pid=2181->guuid=c3a04f08-1b00-0000-ebed-81d093090000 pid=2451 execve guuid=6b439208-1b00-0000-ebed-81d095090000 pid=2453 /usr/bin/wget net send-data guuid=65059b8f-1a00-0000-ebed-81d085080000 pid=2181->guuid=6b439208-1b00-0000-ebed-81d095090000 pid=2453 execve guuid=3b3faa0b-1b00-0000-ebed-81d09c090000 pid=2460 /usr/bin/curl net send-data write-file guuid=65059b8f-1a00-0000-ebed-81d085080000 pid=2181->guuid=3b3faa0b-1b00-0000-ebed-81d09c090000 pid=2460 execve guuid=61d2c910-1b00-0000-ebed-81d0a5090000 pid=2469 /usr/bin/chmod guuid=65059b8f-1a00-0000-ebed-81d085080000 pid=2181->guuid=61d2c910-1b00-0000-ebed-81d0a5090000 pid=2469 execve guuid=d56d3611-1b00-0000-ebed-81d0a7090000 pid=2471 /usr/bin/bash guuid=65059b8f-1a00-0000-ebed-81d085080000 pid=2181->guuid=d56d3611-1b00-0000-ebed-81d0a7090000 pid=2471 clone guuid=80687f11-1b00-0000-ebed-81d0aa090000 pid=2474 /usr/bin/rm delete-file guuid=65059b8f-1a00-0000-ebed-81d085080000 pid=2181->guuid=80687f11-1b00-0000-ebed-81d0aa090000 pid=2474 execve guuid=151eda11-1b00-0000-ebed-81d0ac090000 pid=2476 /usr/bin/rm guuid=65059b8f-1a00-0000-ebed-81d085080000 pid=2181->guuid=151eda11-1b00-0000-ebed-81d0ac090000 pid=2476 execve guuid=6c982812-1b00-0000-ebed-81d0ad090000 pid=2477 /usr/bin/wget net send-data guuid=65059b8f-1a00-0000-ebed-81d085080000 pid=2181->guuid=6c982812-1b00-0000-ebed-81d0ad090000 pid=2477 execve guuid=d4fa5115-1b00-0000-ebed-81d0b5090000 pid=2485 /usr/bin/curl net send-data write-file guuid=65059b8f-1a00-0000-ebed-81d085080000 pid=2181->guuid=d4fa5115-1b00-0000-ebed-81d0b5090000 pid=2485 execve guuid=918dc01b-1b00-0000-ebed-81d0c0090000 pid=2496 /usr/bin/chmod guuid=65059b8f-1a00-0000-ebed-81d085080000 pid=2181->guuid=918dc01b-1b00-0000-ebed-81d0c0090000 pid=2496 execve guuid=1c742c1c-1b00-0000-ebed-81d0c2090000 pid=2498 /usr/bin/bash guuid=65059b8f-1a00-0000-ebed-81d085080000 pid=2181->guuid=1c742c1c-1b00-0000-ebed-81d0c2090000 pid=2498 clone guuid=c7647b1c-1b00-0000-ebed-81d0c4090000 pid=2500 /usr/bin/rm delete-file guuid=65059b8f-1a00-0000-ebed-81d085080000 pid=2181->guuid=c7647b1c-1b00-0000-ebed-81d0c4090000 pid=2500 execve guuid=187e0d1d-1b00-0000-ebed-81d0c5090000 pid=2501 /usr/bin/rm guuid=65059b8f-1a00-0000-ebed-81d085080000 pid=2181->guuid=187e0d1d-1b00-0000-ebed-81d0c5090000 pid=2501 execve 5b654972-c9e1-50d8-b372-2dc2a5b9ad66 5.182.210.174:80 guuid=2d209390-1a00-0000-ebed-81d087080000 pid=2183->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=7d7a8097-1a00-0000-ebed-81d090080000 pid=2192->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=6a5b97a3-1a00-0000-ebed-81d0a3080000 pid=2211 /usr/bin/bash guuid=ddd777a3-1a00-0000-ebed-81d0a2080000 pid=2210->guuid=6a5b97a3-1a00-0000-ebed-81d0a3080000 pid=2211 clone guuid=9521dca4-1a00-0000-ebed-81d0a6080000 pid=2214->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=695439a8-1a00-0000-ebed-81d0a8080000 pid=2216->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=d6dc1faf-1a00-0000-ebed-81d0ba080000 pid=2234 /usr/bin/bash guuid=40cd08af-1a00-0000-ebed-81d0b9080000 pid=2233->guuid=d6dc1faf-1a00-0000-ebed-81d0ba080000 pid=2234 clone guuid=90c6f2af-1a00-0000-ebed-81d0c0080000 pid=2240->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=42e9bdb3-1a00-0000-ebed-81d0c6080000 pid=2246->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=0b0d4db9-1a00-0000-ebed-81d0d4080000 pid=2260 /usr/bin/bash guuid=e3b928b9-1a00-0000-ebed-81d0d3080000 pid=2259->guuid=0b0d4db9-1a00-0000-ebed-81d0d4080000 pid=2260 clone guuid=9d6554ba-1a00-0000-ebed-81d0da080000 pid=2266->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=ec065cbd-1a00-0000-ebed-81d0df080000 pid=2271->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=b70d63c4-1a00-0000-ebed-81d0eb080000 pid=2283 /usr/bin/bash guuid=ee641fc4-1a00-0000-ebed-81d0ea080000 pid=2282->guuid=b70d63c4-1a00-0000-ebed-81d0eb080000 pid=2283 clone guuid=de327cc5-1a00-0000-ebed-81d0f0080000 pid=2288->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=d6180bc8-1a00-0000-ebed-81d0f9080000 pid=2297->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=8a8dd4cc-1a00-0000-ebed-81d005090000 pid=2309 /usr/bin/bash guuid=3781abcc-1a00-0000-ebed-81d004090000 pid=2308->guuid=8a8dd4cc-1a00-0000-ebed-81d005090000 pid=2309 clone guuid=9ebc04ce-1a00-0000-ebed-81d00a090000 pid=2314->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=44a769d2-1a00-0000-ebed-81d010090000 pid=2320->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=ac7a09da-1a00-0000-ebed-81d022090000 pid=2338 /usr/bin/bash guuid=52c3f2d9-1a00-0000-ebed-81d021090000 pid=2337->guuid=ac7a09da-1a00-0000-ebed-81d022090000 pid=2338 clone guuid=2739e3da-1a00-0000-ebed-81d025090000 pid=2341->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=192a02de-1a00-0000-ebed-81d028090000 pid=2344->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=ea807fe4-1a00-0000-ebed-81d037090000 pid=2359 /usr/bin/bash guuid=30fc38e4-1a00-0000-ebed-81d036090000 pid=2358->guuid=ea807fe4-1a00-0000-ebed-81d037090000 pid=2359 clone guuid=bcf3d1e6-1a00-0000-ebed-81d040090000 pid=2368->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=7aa0fdeb-1a00-0000-ebed-81d04a090000 pid=2378->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=b03158f7-1a00-0000-ebed-81d062090000 pid=2402 /usr/bin/bash guuid=b65d43f7-1a00-0000-ebed-81d061090000 pid=2401->guuid=b03158f7-1a00-0000-ebed-81d062090000 pid=2402 clone guuid=a7f9faf7-1a00-0000-ebed-81d067090000 pid=2407->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=a8846ffa-1a00-0000-ebed-81d06a090000 pid=2410->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=d2230e00-1b00-0000-ebed-81d076090000 pid=2422 /usr/bin/bash guuid=beadd9ff-1a00-0000-ebed-81d074090000 pid=2420->guuid=d2230e00-1b00-0000-ebed-81d076090000 pid=2422 clone guuid=ff80ae00-1b00-0000-ebed-81d079090000 pid=2425->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=af8a2103-1b00-0000-ebed-81d080090000 pid=2432->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=d3eecc07-1b00-0000-ebed-81d08f090000 pid=2447 /usr/bin/bash guuid=3fdfae07-1b00-0000-ebed-81d08e090000 pid=2446->guuid=d3eecc07-1b00-0000-ebed-81d08f090000 pid=2447 clone guuid=6b439208-1b00-0000-ebed-81d095090000 pid=2453->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=3b3faa0b-1b00-0000-ebed-81d09c090000 pid=2460->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=03645511-1b00-0000-ebed-81d0a9090000 pid=2473 /usr/bin/bash guuid=d56d3611-1b00-0000-ebed-81d0a7090000 pid=2471->guuid=03645511-1b00-0000-ebed-81d0a9090000 pid=2473 clone guuid=6c982812-1b00-0000-ebed-81d0ad090000 pid=2477->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=d4fa5115-1b00-0000-ebed-81d0b5090000 pid=2485->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=b172471c-1b00-0000-ebed-81d0c3090000 pid=2499 /usr/bin/bash guuid=1c742c1c-1b00-0000-ebed-81d0c2090000 pid=2498->guuid=b172471c-1b00-0000-ebed-81d0c3090000 pid=2499 clone
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/275cc121d809a2e655dbf140ead34e243c11e7f11277d356abe406c21a5f8f6e
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/275cc121d809a2e655dbf140ead34e243c11e7f11277d356abe406c21a5f8f6e/
Threat name:
Linux.Trojan.Egairtigado
Create hunting rule
Status:
Malicious
First seen:
2026-08-26 15:36:18 UTC
File Type:
Text (Shell)
AV detection:
18 of 37 (48.65%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=e5omcioybgromvo36faovu2oeq6bdz7rcj35gvvl4qdmegs7r5xa._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260826-s1zxqs1gkh/
Behaviour
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.11
Link:
https://yomi.yoroi.company/submissions/275cc121d809a2e655dbf140ead34e243c11e7f11277d356abe406c21a5f8f6e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 275cc121d809a2e655dbf140ead34e243c11e7f11277d356abe406c21a5f8f6e

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3897671/
  
Delivery method
Distributed via web download

Comments