MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 28c5cccd904a42f5393074833568646c27b33aec0513e1c5a4b83e92d9bc8a57. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 28c5cccd904a42f5393074833568646c27b33aec0513e1c5a4b83e92d9bc8a57
SHA3-384 hash: abc8b5166d66f26d664463f756b8cb14623a786758a804d4b15dc1dd13aa887807759353e0d8acaa79d742e569b00489
SHA1 hash: 03c22e63a5a67d26015c464e15a02aa1e23fee88
MD5 hash: e0e51f30e117070ecf63c727598b0f14
humanhash: maine-papa-kentucky-arizona
File name:ok
Download: download sample
File size:1'608 bytes
First seen:2026-08-09 20:33:49 UTC
Last seen:2026-08-10 18:24:36 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 24:MpD9pJQuGDLUOHdb3k4q650bylElVkOZpJkqkdZU2/2:MpD9pyLdHdR+PnkOZpJkqkov
TLSH T12C31419A01105A311103CA4F33B63288B35DF1FB685FD7E1DD890E9A968839CF225F5E
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://5.182.210.174/9c504an/an/aua-wget
http://5.182.210.174/ef75b2n/an/aua-wget
http://5.182.210.174/41cb7bn/an/aua-wget
http://5.182.210.174/0aed7dn/an/aua-wget
http://5.182.210.174/10d086n/an/aua-wget
http://5.182.210.174/42736bn/an/aua-wget
http://5.182.210.174/660bc9n/an/aua-wget
http://5.182.210.174/78dbc7n/an/aua-wget
http://5.182.210.174/7b2025n/an/aua-wget
http://5.182.210.174/e67eddn/an/aua-wget
http://5.182.210.174/f6d64fn/an/aua-wget
http://5.182.210.174/1d4271n/an/aua-wget

Intelligence

File Origin
# of uploads :
4
# of downloads :
55
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive mirai
Link:
https://www.filescan.io/uploads/6a78e4509b4f02a64d09ae8d/reports/050b3636-87e5-4446-a3dc-780dcab082d0/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-08-09T17:55:00Z UTC
Last seen:
2026-08-10T21:22:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/28c5cccd904a42f5393074833568646c27b33aec0513e1c5a4b83e92d9bc8a57/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/4e670be3-0e88-4c38-916d-405401116b69
Behavior Graph:
Download SVG
%3 guuid=a7b5773a-1600-0000-c9df-b058140c0000 pid=3092 /usr/bin/sudo guuid=dc101d3e-1600-0000-c9df-b058150c0000 pid=3093 /tmp/sample.bin guuid=a7b5773a-1600-0000-c9df-b058140c0000 pid=3092->guuid=dc101d3e-1600-0000-c9df-b058150c0000 pid=3093 execve guuid=1c1f1d3f-1600-0000-c9df-b058160c0000 pid=3094 /usr/bin/wget net send-data guuid=dc101d3e-1600-0000-c9df-b058150c0000 pid=3093->guuid=1c1f1d3f-1600-0000-c9df-b058160c0000 pid=3094 execve guuid=919cd945-1600-0000-c9df-b058170c0000 pid=3095 /usr/bin/curl net send-data write-file guuid=dc101d3e-1600-0000-c9df-b058150c0000 pid=3093->guuid=919cd945-1600-0000-c9df-b058170c0000 pid=3095 execve guuid=09a71750-1600-0000-c9df-b0581a0c0000 pid=3098 /usr/bin/chmod guuid=dc101d3e-1600-0000-c9df-b058150c0000 pid=3093->guuid=09a71750-1600-0000-c9df-b0581a0c0000 pid=3098 execve guuid=7c1b5750-1600-0000-c9df-b0581b0c0000 pid=3099 /usr/bin/bash guuid=dc101d3e-1600-0000-c9df-b058150c0000 pid=3093->guuid=7c1b5750-1600-0000-c9df-b0581b0c0000 pid=3099 clone guuid=77598050-1600-0000-c9df-b0581e0c0000 pid=3102 /usr/bin/rm delete-file guuid=dc101d3e-1600-0000-c9df-b058150c0000 pid=3093->guuid=77598050-1600-0000-c9df-b0581e0c0000 pid=3102 execve guuid=c38bbe50-1600-0000-c9df-b058200c0000 pid=3104 /usr/bin/rm guuid=dc101d3e-1600-0000-c9df-b058150c0000 pid=3093->guuid=c38bbe50-1600-0000-c9df-b058200c0000 pid=3104 execve guuid=5e21fb50-1600-0000-c9df-b058220c0000 pid=3106 /usr/bin/wget net send-data guuid=dc101d3e-1600-0000-c9df-b058150c0000 pid=3093->guuid=5e21fb50-1600-0000-c9df-b058220c0000 pid=3106 execve guuid=77554853-1600-0000-c9df-b058260c0000 pid=3110 /usr/bin/curl net send-data write-file guuid=dc101d3e-1600-0000-c9df-b058150c0000 pid=3093->guuid=77554853-1600-0000-c9df-b058260c0000 pid=3110 execve guuid=16371e57-1600-0000-c9df-b058310c0000 pid=3121 /usr/bin/chmod guuid=dc101d3e-1600-0000-c9df-b058150c0000 pid=3093->guuid=16371e57-1600-0000-c9df-b058310c0000 pid=3121 execve guuid=bbe75757-1600-0000-c9df-b058320c0000 pid=3122 /usr/bin/bash guuid=dc101d3e-1600-0000-c9df-b058150c0000 pid=3093->guuid=bbe75757-1600-0000-c9df-b058320c0000 pid=3122 clone guuid=15c2e157-1600-0000-c9df-b058360c0000 pid=3126 /usr/bin/rm delete-file guuid=dc101d3e-1600-0000-c9df-b058150c0000 pid=3093->guuid=15c2e157-1600-0000-c9df-b058360c0000 pid=3126 execve guuid=169f1b58-1600-0000-c9df-b058380c0000 pid=3128 /usr/bin/rm guuid=dc101d3e-1600-0000-c9df-b058150c0000 pid=3093->guuid=169f1b58-1600-0000-c9df-b058380c0000 pid=3128 execve guuid=86955358-1600-0000-c9df-b058390c0000 pid=3129 /usr/bin/wget net send-data guuid=dc101d3e-1600-0000-c9df-b058150c0000 pid=3093->guuid=86955358-1600-0000-c9df-b058390c0000 pid=3129 execve guuid=34768f5b-1600-0000-c9df-b0583a0c0000 pid=3130 /usr/bin/curl net send-data write-file guuid=dc101d3e-1600-0000-c9df-b058150c0000 pid=3093->guuid=34768f5b-1600-0000-c9df-b0583a0c0000 pid=3130 execve guuid=6b318161-1600-0000-c9df-b058430c0000 pid=3139 /usr/bin/chmod guuid=dc101d3e-1600-0000-c9df-b058150c0000 pid=3093->guuid=6b318161-1600-0000-c9df-b058430c0000 pid=3139 execve guuid=e641fe61-1600-0000-c9df-b058440c0000 pid=3140 /usr/bin/bash guuid=dc101d3e-1600-0000-c9df-b058150c0000 pid=3093->guuid=e641fe61-1600-0000-c9df-b058440c0000 pid=3140 clone guuid=7fd03f62-1600-0000-c9df-b058470c0000 pid=3143 /usr/bin/rm delete-file guuid=dc101d3e-1600-0000-c9df-b058150c0000 pid=3093->guuid=7fd03f62-1600-0000-c9df-b058470c0000 pid=3143 execve guuid=1b187f62-1600-0000-c9df-b058490c0000 pid=3145 /usr/bin/rm guuid=dc101d3e-1600-0000-c9df-b058150c0000 pid=3093->guuid=1b187f62-1600-0000-c9df-b058490c0000 pid=3145 execve guuid=2d86bd62-1600-0000-c9df-b0584b0c0000 pid=3147 /usr/bin/wget net send-data guuid=dc101d3e-1600-0000-c9df-b058150c0000 pid=3093->guuid=2d86bd62-1600-0000-c9df-b0584b0c0000 pid=3147 execve guuid=213e2e65-1600-0000-c9df-b058500c0000 pid=3152 /usr/bin/curl net send-data write-file guuid=dc101d3e-1600-0000-c9df-b058150c0000 pid=3093->guuid=213e2e65-1600-0000-c9df-b058500c0000 pid=3152 execve guuid=deb5db68-1600-0000-c9df-b058570c0000 pid=3159 /usr/bin/chmod guuid=dc101d3e-1600-0000-c9df-b058150c0000 pid=3093->guuid=deb5db68-1600-0000-c9df-b058570c0000 pid=3159 execve guuid=767c3869-1600-0000-c9df-b058580c0000 pid=3160 /usr/bin/bash guuid=dc101d3e-1600-0000-c9df-b058150c0000 pid=3093->guuid=767c3869-1600-0000-c9df-b058580c0000 pid=3160 clone guuid=71be8d69-1600-0000-c9df-b0585a0c0000 pid=3162 /usr/bin/rm delete-file guuid=dc101d3e-1600-0000-c9df-b058150c0000 pid=3093->guuid=71be8d69-1600-0000-c9df-b0585a0c0000 pid=3162 execve guuid=0716f869-1600-0000-c9df-b0585b0c0000 pid=3163 /usr/bin/rm guuid=dc101d3e-1600-0000-c9df-b058150c0000 pid=3093->guuid=0716f869-1600-0000-c9df-b0585b0c0000 pid=3163 execve guuid=6dd95b6a-1600-0000-c9df-b0585c0c0000 pid=3164 /usr/bin/wget net send-data guuid=dc101d3e-1600-0000-c9df-b058150c0000 pid=3093->guuid=6dd95b6a-1600-0000-c9df-b0585c0c0000 pid=3164 execve guuid=4752176d-1600-0000-c9df-b0585e0c0000 pid=3166 /usr/bin/curl net send-data write-file guuid=dc101d3e-1600-0000-c9df-b058150c0000 pid=3093->guuid=4752176d-1600-0000-c9df-b0585e0c0000 pid=3166 execve guuid=29499571-1600-0000-c9df-b0586c0c0000 pid=3180 /usr/bin/chmod guuid=dc101d3e-1600-0000-c9df-b058150c0000 pid=3093->guuid=29499571-1600-0000-c9df-b0586c0c0000 pid=3180 execve guuid=d3ccde71-1600-0000-c9df-b0586e0c0000 pid=3182 /usr/bin/bash guuid=dc101d3e-1600-0000-c9df-b058150c0000 pid=3093->guuid=d3ccde71-1600-0000-c9df-b0586e0c0000 pid=3182 clone guuid=05d92b72-1600-0000-c9df-b058710c0000 pid=3185 /usr/bin/rm delete-file guuid=dc101d3e-1600-0000-c9df-b058150c0000 pid=3093->guuid=05d92b72-1600-0000-c9df-b058710c0000 pid=3185 execve guuid=ed227872-1600-0000-c9df-b058730c0000 pid=3187 /usr/bin/rm guuid=dc101d3e-1600-0000-c9df-b058150c0000 pid=3093->guuid=ed227872-1600-0000-c9df-b058730c0000 pid=3187 execve guuid=7d6cba72-1600-0000-c9df-b058750c0000 pid=3189 /usr/bin/wget net send-data guuid=dc101d3e-1600-0000-c9df-b058150c0000 pid=3093->guuid=7d6cba72-1600-0000-c9df-b058750c0000 pid=3189 execve guuid=c732b175-1600-0000-c9df-b0587e0c0000 pid=3198 /usr/bin/curl net send-data write-file guuid=dc101d3e-1600-0000-c9df-b058150c0000 pid=3093->guuid=c732b175-1600-0000-c9df-b0587e0c0000 pid=3198 execve guuid=a092ac7a-1600-0000-c9df-b0588e0c0000 pid=3214 /usr/bin/chmod guuid=dc101d3e-1600-0000-c9df-b058150c0000 pid=3093->guuid=a092ac7a-1600-0000-c9df-b0588e0c0000 pid=3214 execve guuid=1afbea7a-1600-0000-c9df-b058900c0000 pid=3216 /usr/bin/bash guuid=dc101d3e-1600-0000-c9df-b058150c0000 pid=3093->guuid=1afbea7a-1600-0000-c9df-b058900c0000 pid=3216 clone guuid=ab4a1f7b-1600-0000-c9df-b058930c0000 pid=3219 /usr/bin/rm delete-file guuid=dc101d3e-1600-0000-c9df-b058150c0000 pid=3093->guuid=ab4a1f7b-1600-0000-c9df-b058930c0000 pid=3219 execve guuid=5047617b-1600-0000-c9df-b058950c0000 pid=3221 /usr/bin/rm guuid=dc101d3e-1600-0000-c9df-b058150c0000 pid=3093->guuid=5047617b-1600-0000-c9df-b058950c0000 pid=3221 execve guuid=a8ebad7b-1600-0000-c9df-b058970c0000 pid=3223 /usr/bin/wget net send-data guuid=dc101d3e-1600-0000-c9df-b058150c0000 pid=3093->guuid=a8ebad7b-1600-0000-c9df-b058970c0000 pid=3223 execve guuid=0eb8e57e-1600-0000-c9df-b058a20c0000 pid=3234 /usr/bin/curl net send-data write-file guuid=dc101d3e-1600-0000-c9df-b058150c0000 pid=3093->guuid=0eb8e57e-1600-0000-c9df-b058a20c0000 pid=3234 execve guuid=040e3f85-1600-0000-c9df-b058b30c0000 pid=3251 /usr/bin/chmod guuid=dc101d3e-1600-0000-c9df-b058150c0000 pid=3093->guuid=040e3f85-1600-0000-c9df-b058b30c0000 pid=3251 execve guuid=23d98585-1600-0000-c9df-b058b40c0000 pid=3252 /usr/bin/bash guuid=dc101d3e-1600-0000-c9df-b058150c0000 pid=3093->guuid=23d98585-1600-0000-c9df-b058b40c0000 pid=3252 clone guuid=517bb685-1600-0000-c9df-b058b60c0000 pid=3254 /usr/bin/rm delete-file guuid=dc101d3e-1600-0000-c9df-b058150c0000 pid=3093->guuid=517bb685-1600-0000-c9df-b058b60c0000 pid=3254 execve guuid=da0fff85-1600-0000-c9df-b058b70c0000 pid=3255 /usr/bin/rm guuid=dc101d3e-1600-0000-c9df-b058150c0000 pid=3093->guuid=da0fff85-1600-0000-c9df-b058b70c0000 pid=3255 execve guuid=653b3e86-1600-0000-c9df-b058b80c0000 pid=3256 /usr/bin/wget net send-data guuid=dc101d3e-1600-0000-c9df-b058150c0000 pid=3093->guuid=653b3e86-1600-0000-c9df-b058b80c0000 pid=3256 execve guuid=7cbab688-1600-0000-c9df-b058b90c0000 pid=3257 /usr/bin/curl net send-data write-file guuid=dc101d3e-1600-0000-c9df-b058150c0000 pid=3093->guuid=7cbab688-1600-0000-c9df-b058b90c0000 pid=3257 execve guuid=cb46bd8c-1600-0000-c9df-b058ba0c0000 pid=3258 /usr/bin/chmod guuid=dc101d3e-1600-0000-c9df-b058150c0000 pid=3093->guuid=cb46bd8c-1600-0000-c9df-b058ba0c0000 pid=3258 execve guuid=0b414d8d-1600-0000-c9df-b058bb0c0000 pid=3259 /usr/bin/bash guuid=dc101d3e-1600-0000-c9df-b058150c0000 pid=3093->guuid=0b414d8d-1600-0000-c9df-b058bb0c0000 pid=3259 clone guuid=3747c08d-1600-0000-c9df-b058bd0c0000 pid=3261 /usr/bin/rm delete-file guuid=dc101d3e-1600-0000-c9df-b058150c0000 pid=3093->guuid=3747c08d-1600-0000-c9df-b058bd0c0000 pid=3261 execve guuid=f8b54e8e-1600-0000-c9df-b058be0c0000 pid=3262 /usr/bin/rm guuid=dc101d3e-1600-0000-c9df-b058150c0000 pid=3093->guuid=f8b54e8e-1600-0000-c9df-b058be0c0000 pid=3262 execve guuid=1debdb8e-1600-0000-c9df-b058bf0c0000 pid=3263 /usr/bin/wget net send-data guuid=dc101d3e-1600-0000-c9df-b058150c0000 pid=3093->guuid=1debdb8e-1600-0000-c9df-b058bf0c0000 pid=3263 execve guuid=2a2f7d91-1600-0000-c9df-b058c10c0000 pid=3265 /usr/bin/curl net send-data write-file guuid=dc101d3e-1600-0000-c9df-b058150c0000 pid=3093->guuid=2a2f7d91-1600-0000-c9df-b058c10c0000 pid=3265 execve guuid=5bf12195-1600-0000-c9df-b058cc0c0000 pid=3276 /usr/bin/chmod guuid=dc101d3e-1600-0000-c9df-b058150c0000 pid=3093->guuid=5bf12195-1600-0000-c9df-b058cc0c0000 pid=3276 execve guuid=007f6995-1600-0000-c9df-b058cd0c0000 pid=3277 /usr/bin/bash guuid=dc101d3e-1600-0000-c9df-b058150c0000 pid=3093->guuid=007f6995-1600-0000-c9df-b058cd0c0000 pid=3277 clone guuid=f583ac95-1600-0000-c9df-b058d00c0000 pid=3280 /usr/bin/rm delete-file guuid=dc101d3e-1600-0000-c9df-b058150c0000 pid=3093->guuid=f583ac95-1600-0000-c9df-b058d00c0000 pid=3280 execve guuid=e6a50196-1600-0000-c9df-b058d10c0000 pid=3281 /usr/bin/rm guuid=dc101d3e-1600-0000-c9df-b058150c0000 pid=3093->guuid=e6a50196-1600-0000-c9df-b058d10c0000 pid=3281 execve guuid=73cf4996-1600-0000-c9df-b058d20c0000 pid=3282 /usr/bin/wget net send-data guuid=dc101d3e-1600-0000-c9df-b058150c0000 pid=3093->guuid=73cf4996-1600-0000-c9df-b058d20c0000 pid=3282 execve guuid=0e36bf98-1600-0000-c9df-b058da0c0000 pid=3290 /usr/bin/curl net send-data write-file guuid=dc101d3e-1600-0000-c9df-b058150c0000 pid=3093->guuid=0e36bf98-1600-0000-c9df-b058da0c0000 pid=3290 execve guuid=12480fa1-1600-0000-c9df-b058ec0c0000 pid=3308 /usr/bin/chmod guuid=dc101d3e-1600-0000-c9df-b058150c0000 pid=3093->guuid=12480fa1-1600-0000-c9df-b058ec0c0000 pid=3308 execve guuid=5153bea1-1600-0000-c9df-b058ed0c0000 pid=3309 /usr/bin/bash guuid=dc101d3e-1600-0000-c9df-b058150c0000 pid=3093->guuid=5153bea1-1600-0000-c9df-b058ed0c0000 pid=3309 clone guuid=a03105a2-1600-0000-c9df-b058ef0c0000 pid=3311 /usr/bin/rm delete-file guuid=dc101d3e-1600-0000-c9df-b058150c0000 pid=3093->guuid=a03105a2-1600-0000-c9df-b058ef0c0000 pid=3311 execve guuid=0957ada2-1600-0000-c9df-b058f00c0000 pid=3312 /usr/bin/rm guuid=dc101d3e-1600-0000-c9df-b058150c0000 pid=3093->guuid=0957ada2-1600-0000-c9df-b058f00c0000 pid=3312 execve guuid=b67e53a3-1600-0000-c9df-b058f10c0000 pid=3313 /usr/bin/wget net send-data guuid=dc101d3e-1600-0000-c9df-b058150c0000 pid=3093->guuid=b67e53a3-1600-0000-c9df-b058f10c0000 pid=3313 execve guuid=66f30ca7-1600-0000-c9df-b058f40c0000 pid=3316 /usr/bin/curl net send-data write-file guuid=dc101d3e-1600-0000-c9df-b058150c0000 pid=3093->guuid=66f30ca7-1600-0000-c9df-b058f40c0000 pid=3316 execve guuid=cebdf1aa-1600-0000-c9df-b058fd0c0000 pid=3325 /usr/bin/chmod guuid=dc101d3e-1600-0000-c9df-b058150c0000 pid=3093->guuid=cebdf1aa-1600-0000-c9df-b058fd0c0000 pid=3325 execve guuid=23ef3cab-1600-0000-c9df-b058ff0c0000 pid=3327 /usr/bin/bash guuid=dc101d3e-1600-0000-c9df-b058150c0000 pid=3093->guuid=23ef3cab-1600-0000-c9df-b058ff0c0000 pid=3327 clone guuid=8fb076ab-1600-0000-c9df-b058020d0000 pid=3330 /usr/bin/rm delete-file guuid=dc101d3e-1600-0000-c9df-b058150c0000 pid=3093->guuid=8fb076ab-1600-0000-c9df-b058020d0000 pid=3330 execve guuid=e23cbaab-1600-0000-c9df-b058030d0000 pid=3331 /usr/bin/rm guuid=dc101d3e-1600-0000-c9df-b058150c0000 pid=3093->guuid=e23cbaab-1600-0000-c9df-b058030d0000 pid=3331 execve guuid=44cdf7ab-1600-0000-c9df-b058050d0000 pid=3333 /usr/bin/wget net send-data guuid=dc101d3e-1600-0000-c9df-b058150c0000 pid=3093->guuid=44cdf7ab-1600-0000-c9df-b058050d0000 pid=3333 execve guuid=35a35bae-1600-0000-c9df-b0580e0d0000 pid=3342 /usr/bin/curl net send-data write-file guuid=dc101d3e-1600-0000-c9df-b058150c0000 pid=3093->guuid=35a35bae-1600-0000-c9df-b0580e0d0000 pid=3342 execve guuid=5afb0cb2-1600-0000-c9df-b058170d0000 pid=3351 /usr/bin/chmod guuid=dc101d3e-1600-0000-c9df-b058150c0000 pid=3093->guuid=5afb0cb2-1600-0000-c9df-b058170d0000 pid=3351 execve guuid=824b40b2-1600-0000-c9df-b058180d0000 pid=3352 /usr/bin/bash guuid=dc101d3e-1600-0000-c9df-b058150c0000 pid=3093->guuid=824b40b2-1600-0000-c9df-b058180d0000 pid=3352 clone guuid=d3d273b2-1600-0000-c9df-b0581b0d0000 pid=3355 /usr/bin/rm delete-file guuid=dc101d3e-1600-0000-c9df-b058150c0000 pid=3093->guuid=d3d273b2-1600-0000-c9df-b0581b0d0000 pid=3355 execve guuid=69b3a9b2-1600-0000-c9df-b0581c0d0000 pid=3356 /usr/bin/rm guuid=dc101d3e-1600-0000-c9df-b058150c0000 pid=3093->guuid=69b3a9b2-1600-0000-c9df-b0581c0d0000 pid=3356 execve 5b654972-c9e1-50d8-b372-2dc2a5b9ad66 5.182.210.174:80 guuid=1c1f1d3f-1600-0000-c9df-b058160c0000 pid=3094->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=919cd945-1600-0000-c9df-b058170c0000 pid=3095->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=d4446b50-1600-0000-c9df-b0581d0c0000 pid=3101 /usr/bin/bash guuid=7c1b5750-1600-0000-c9df-b0581b0c0000 pid=3099->guuid=d4446b50-1600-0000-c9df-b0581d0c0000 pid=3101 clone guuid=5e21fb50-1600-0000-c9df-b058220c0000 pid=3106->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=77554853-1600-0000-c9df-b058260c0000 pid=3110->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=acf38957-1600-0000-c9df-b058340c0000 pid=3124 /usr/bin/bash guuid=bbe75757-1600-0000-c9df-b058320c0000 pid=3122->guuid=acf38957-1600-0000-c9df-b058340c0000 pid=3124 clone guuid=86955358-1600-0000-c9df-b058390c0000 pid=3129->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=34768f5b-1600-0000-c9df-b0583a0c0000 pid=3130->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=39431962-1600-0000-c9df-b058460c0000 pid=3142 /usr/bin/bash guuid=e641fe61-1600-0000-c9df-b058440c0000 pid=3140->guuid=39431962-1600-0000-c9df-b058460c0000 pid=3142 clone guuid=2d86bd62-1600-0000-c9df-b0584b0c0000 pid=3147->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=213e2e65-1600-0000-c9df-b058500c0000 pid=3152->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=2ec25c69-1600-0000-c9df-b058590c0000 pid=3161 /usr/bin/bash guuid=767c3869-1600-0000-c9df-b058580c0000 pid=3160->guuid=2ec25c69-1600-0000-c9df-b058590c0000 pid=3161 clone guuid=6dd95b6a-1600-0000-c9df-b0585c0c0000 pid=3164->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=4752176d-1600-0000-c9df-b0585e0c0000 pid=3166->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=76e4f871-1600-0000-c9df-b0586f0c0000 pid=3183 /usr/bin/bash guuid=d3ccde71-1600-0000-c9df-b0586e0c0000 pid=3182->guuid=76e4f871-1600-0000-c9df-b0586f0c0000 pid=3183 clone guuid=7d6cba72-1600-0000-c9df-b058750c0000 pid=3189->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=c732b175-1600-0000-c9df-b0587e0c0000 pid=3198->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=045e027b-1600-0000-c9df-b058920c0000 pid=3218 /usr/bin/bash guuid=1afbea7a-1600-0000-c9df-b058900c0000 pid=3216->guuid=045e027b-1600-0000-c9df-b058920c0000 pid=3218 clone guuid=a8ebad7b-1600-0000-c9df-b058970c0000 pid=3223->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=0eb8e57e-1600-0000-c9df-b058a20c0000 pid=3234->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=235a9b85-1600-0000-c9df-b058b50c0000 pid=3253 /usr/bin/bash guuid=23d98585-1600-0000-c9df-b058b40c0000 pid=3252->guuid=235a9b85-1600-0000-c9df-b058b50c0000 pid=3253 clone guuid=653b3e86-1600-0000-c9df-b058b80c0000 pid=3256->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=7cbab688-1600-0000-c9df-b058b90c0000 pid=3257->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=59c6848d-1600-0000-c9df-b058bc0c0000 pid=3260 /usr/bin/bash guuid=0b414d8d-1600-0000-c9df-b058bb0c0000 pid=3259->guuid=59c6848d-1600-0000-c9df-b058bc0c0000 pid=3260 clone guuid=1debdb8e-1600-0000-c9df-b058bf0c0000 pid=3263->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=2a2f7d91-1600-0000-c9df-b058c10c0000 pid=3265->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=02198595-1600-0000-c9df-b058ce0c0000 pid=3278 /usr/bin/bash guuid=007f6995-1600-0000-c9df-b058cd0c0000 pid=3277->guuid=02198595-1600-0000-c9df-b058ce0c0000 pid=3278 clone guuid=73cf4996-1600-0000-c9df-b058d20c0000 pid=3282->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=0e36bf98-1600-0000-c9df-b058da0c0000 pid=3290->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=7767d7a1-1600-0000-c9df-b058ee0c0000 pid=3310 /usr/bin/bash guuid=5153bea1-1600-0000-c9df-b058ed0c0000 pid=3309->guuid=7767d7a1-1600-0000-c9df-b058ee0c0000 pid=3310 clone guuid=b67e53a3-1600-0000-c9df-b058f10c0000 pid=3313->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=66f30ca7-1600-0000-c9df-b058f40c0000 pid=3316->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=1ec951ab-1600-0000-c9df-b058010d0000 pid=3329 /usr/bin/bash guuid=23ef3cab-1600-0000-c9df-b058ff0c0000 pid=3327->guuid=1ec951ab-1600-0000-c9df-b058010d0000 pid=3329 clone guuid=44cdf7ab-1600-0000-c9df-b058050d0000 pid=3333->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=35a35bae-1600-0000-c9df-b0580e0d0000 pid=3342->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=576054b2-1600-0000-c9df-b058190d0000 pid=3353 /usr/bin/bash guuid=824b40b2-1600-0000-c9df-b058180d0000 pid=3352->guuid=576054b2-1600-0000-c9df-b058190d0000 pid=3353 clone
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/28c5cccd904a42f5393074833568646c27b33aec0513e1c5a4b83e92d9bc8a57
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/28c5cccd904a42f5393074833568646c27b33aec0513e1c5a4b83e92d9bc8a57/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-08-09 20:34:27 UTC
File Type:
Text (Shell)
AV detection:
10 of 24 (41.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fdc4ztmqjjbpkojqosbtk2denqt3goxmauj6drnexa7jfwn4rjlq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260809-zcltjacd44/
Behaviour
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.11
Link:
https://yomi.yoroi.company/submissions/28c5cccd904a42f5393074833568646c27b33aec0513e1c5a4b83e92d9bc8a57

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 28c5cccd904a42f5393074833568646c27b33aec0513e1c5a4b83e92d9bc8a57

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3897671/
  
Delivery method
Distributed via web download

Comments