MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 294fdfc8bdacaab572c76264adc483b956002aa85ce2ed85b0ffcaa5e12a5f2e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 294fdfc8bdacaab572c76264adc483b956002aa85ce2ed85b0ffcaa5e12a5f2e
SHA3-384 hash: a9a45a648c0d26ddb705721d9b2dff00b6c5c643f7a5c43447e61b09328d44a19931329bc87b76ef50aef12316703bc1
SHA1 hash: 44668e96cf2d821f21f37109b6f1f6c4c6db8171
MD5 hash: a59b110b243da732d16c2ffebfc3962c
humanhash: magazine-timing-alanine-nevada
File name:p
Download: download sample
File size:831 bytes
First seen:2026-07-18 06:49:14 UTC
Last seen:2026-07-18 08:50:28 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 24:kXCKysE2hi0ziQvZohaY8/X0GWSj3lOMr7:e9Qp+MsY8P0GWSj3MMr7
TLSH T1A3014CD68550AD104029D96E66E762A0B411C38F568A0B747FDC5E3DFB9C904F07AF94
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://129.121.114.124/sBOn/an/aua-wget
http://129.121.114.124/PYjn/an/aua-wget
http://129.121.114.124/n2w0n/an/aua-wget
http://129.121.114.124/CA3n/an/aua-wget
http://129.121.114.124/b8rn/an/aua-wget

Intelligence

File Origin
# of uploads :
2
# of downloads :
72
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive mirai
Link:
https://www.filescan.io/uploads/6a5b21f888889158278c8c9b/reports/48fd9398-a77c-4ce9-8513-d6650a50f4af/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-07-18T04:52:00Z UTC
Last seen:
2026-07-19T22:12:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/294fdfc8bdacaab572c76264adc483b956002aa85ce2ed85b0ffcaa5e12a5f2e/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/277a2cd8-cefd-4b69-aa95-a1e7ea8f0ae8
Behavior Graph:
Download SVG
%3 guuid=abca7c07-1900-0000-d2a2-f200790a0000 pid=2681 /usr/bin/sudo guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683 /tmp/sample.bin write-file guuid=abca7c07-1900-0000-d2a2-f200790a0000 pid=2681->guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683 execve guuid=c5bd8a09-1900-0000-d2a2-f2007c0a0000 pid=2684 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=c5bd8a09-1900-0000-d2a2-f2007c0a0000 pid=2684 execve guuid=b615070a-1900-0000-d2a2-f2007f0a0000 pid=2687 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=b615070a-1900-0000-d2a2-f2007f0a0000 pid=2687 execve guuid=eb11a90a-1900-0000-d2a2-f200820a0000 pid=2690 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=eb11a90a-1900-0000-d2a2-f200820a0000 pid=2690 execve guuid=a74a250b-1900-0000-d2a2-f200850a0000 pid=2693 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=a74a250b-1900-0000-d2a2-f200850a0000 pid=2693 execve guuid=5741c30b-1900-0000-d2a2-f200860a0000 pid=2694 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=5741c30b-1900-0000-d2a2-f200860a0000 pid=2694 execve guuid=8a60520c-1900-0000-d2a2-f200880a0000 pid=2696 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=8a60520c-1900-0000-d2a2-f200880a0000 pid=2696 execve guuid=8959f80c-1900-0000-d2a2-f200890a0000 pid=2697 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=8959f80c-1900-0000-d2a2-f200890a0000 pid=2697 execve guuid=64aa8d0d-1900-0000-d2a2-f2008a0a0000 pid=2698 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=64aa8d0d-1900-0000-d2a2-f2008a0a0000 pid=2698 execve guuid=f33df90d-1900-0000-d2a2-f2008d0a0000 pid=2701 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=f33df90d-1900-0000-d2a2-f2008d0a0000 pid=2701 execve guuid=4b9b5e0e-1900-0000-d2a2-f2008f0a0000 pid=2703 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=4b9b5e0e-1900-0000-d2a2-f2008f0a0000 pid=2703 execve guuid=fdcfc30e-1900-0000-d2a2-f200910a0000 pid=2705 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=fdcfc30e-1900-0000-d2a2-f200910a0000 pid=2705 execve guuid=6230330f-1900-0000-d2a2-f200940a0000 pid=2708 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=6230330f-1900-0000-d2a2-f200940a0000 pid=2708 execve guuid=78f2ac0f-1900-0000-d2a2-f200950a0000 pid=2709 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=78f2ac0f-1900-0000-d2a2-f200950a0000 pid=2709 execve guuid=04952c10-1900-0000-d2a2-f200970a0000 pid=2711 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=04952c10-1900-0000-d2a2-f200970a0000 pid=2711 execve guuid=ca119c10-1900-0000-d2a2-f200980a0000 pid=2712 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=ca119c10-1900-0000-d2a2-f200980a0000 pid=2712 execve guuid=86f11811-1900-0000-d2a2-f200990a0000 pid=2713 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=86f11811-1900-0000-d2a2-f200990a0000 pid=2713 execve guuid=a39fc911-1900-0000-d2a2-f2009a0a0000 pid=2714 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=a39fc911-1900-0000-d2a2-f2009a0a0000 pid=2714 execve guuid=17ce4412-1900-0000-d2a2-f2009d0a0000 pid=2717 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=17ce4412-1900-0000-d2a2-f2009d0a0000 pid=2717 execve guuid=39579f12-1900-0000-d2a2-f2009f0a0000 pid=2719 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=39579f12-1900-0000-d2a2-f2009f0a0000 pid=2719 execve guuid=4ebffd12-1900-0000-d2a2-f200a10a0000 pid=2721 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=4ebffd12-1900-0000-d2a2-f200a10a0000 pid=2721 execve guuid=0e418813-1900-0000-d2a2-f200a40a0000 pid=2724 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=0e418813-1900-0000-d2a2-f200a40a0000 pid=2724 execve guuid=0dfbe413-1900-0000-d2a2-f200a60a0000 pid=2726 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=0dfbe413-1900-0000-d2a2-f200a60a0000 pid=2726 execve guuid=89624414-1900-0000-d2a2-f200a80a0000 pid=2728 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=89624414-1900-0000-d2a2-f200a80a0000 pid=2728 execve guuid=1d45a514-1900-0000-d2a2-f200ab0a0000 pid=2731 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=1d45a514-1900-0000-d2a2-f200ab0a0000 pid=2731 execve guuid=4f6f0015-1900-0000-d2a2-f200ac0a0000 pid=2732 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=4f6f0015-1900-0000-d2a2-f200ac0a0000 pid=2732 execve guuid=036d7215-1900-0000-d2a2-f200ae0a0000 pid=2734 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=036d7215-1900-0000-d2a2-f200ae0a0000 pid=2734 execve guuid=dabade15-1900-0000-d2a2-f200b00a0000 pid=2736 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=dabade15-1900-0000-d2a2-f200b00a0000 pid=2736 execve guuid=d8644316-1900-0000-d2a2-f200b20a0000 pid=2738 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=d8644316-1900-0000-d2a2-f200b20a0000 pid=2738 execve guuid=251dcb16-1900-0000-d2a2-f200b50a0000 pid=2741 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=251dcb16-1900-0000-d2a2-f200b50a0000 pid=2741 execve guuid=8a974a17-1900-0000-d2a2-f200b80a0000 pid=2744 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=8a974a17-1900-0000-d2a2-f200b80a0000 pid=2744 execve guuid=a68ce217-1900-0000-d2a2-f200b90a0000 pid=2745 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=a68ce217-1900-0000-d2a2-f200b90a0000 pid=2745 execve guuid=496f9918-1900-0000-d2a2-f200ba0a0000 pid=2746 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=496f9918-1900-0000-d2a2-f200ba0a0000 pid=2746 execve guuid=353c2819-1900-0000-d2a2-f200bb0a0000 pid=2747 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=353c2819-1900-0000-d2a2-f200bb0a0000 pid=2747 execve guuid=3712ac19-1900-0000-d2a2-f200bc0a0000 pid=2748 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=3712ac19-1900-0000-d2a2-f200bc0a0000 pid=2748 execve guuid=43172b1a-1900-0000-d2a2-f200bd0a0000 pid=2749 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=43172b1a-1900-0000-d2a2-f200bd0a0000 pid=2749 execve guuid=1460b11a-1900-0000-d2a2-f200be0a0000 pid=2750 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=1460b11a-1900-0000-d2a2-f200be0a0000 pid=2750 execve guuid=95415a1b-1900-0000-d2a2-f200bf0a0000 pid=2751 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=95415a1b-1900-0000-d2a2-f200bf0a0000 pid=2751 execve guuid=39c6de1b-1900-0000-d2a2-f200c10a0000 pid=2753 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=39c6de1b-1900-0000-d2a2-f200c10a0000 pid=2753 execve guuid=2bcf881c-1900-0000-d2a2-f200c20a0000 pid=2754 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=2bcf881c-1900-0000-d2a2-f200c20a0000 pid=2754 execve guuid=b1eb001d-1900-0000-d2a2-f200c30a0000 pid=2755 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=b1eb001d-1900-0000-d2a2-f200c30a0000 pid=2755 execve guuid=cf086e1d-1900-0000-d2a2-f200c50a0000 pid=2757 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=cf086e1d-1900-0000-d2a2-f200c50a0000 pid=2757 execve guuid=0033d11d-1900-0000-d2a2-f200c70a0000 pid=2759 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=0033d11d-1900-0000-d2a2-f200c70a0000 pid=2759 execve guuid=04256a1e-1900-0000-d2a2-f200cb0a0000 pid=2763 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=04256a1e-1900-0000-d2a2-f200cb0a0000 pid=2763 execve guuid=34d5071f-1900-0000-d2a2-f200cd0a0000 pid=2765 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=34d5071f-1900-0000-d2a2-f200cd0a0000 pid=2765 execve guuid=4ecd8b1f-1900-0000-d2a2-f200cf0a0000 pid=2767 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=4ecd8b1f-1900-0000-d2a2-f200cf0a0000 pid=2767 execve guuid=28c50c20-1900-0000-d2a2-f200d00a0000 pid=2768 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=28c50c20-1900-0000-d2a2-f200d00a0000 pid=2768 execve guuid=15cf7c20-1900-0000-d2a2-f200d30a0000 pid=2771 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=15cf7c20-1900-0000-d2a2-f200d30a0000 pid=2771 execve guuid=d895e520-1900-0000-d2a2-f200d50a0000 pid=2773 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=d895e520-1900-0000-d2a2-f200d50a0000 pid=2773 execve guuid=2c6d4721-1900-0000-d2a2-f200d80a0000 pid=2776 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=2c6d4721-1900-0000-d2a2-f200d80a0000 pid=2776 execve guuid=cfc1ae21-1900-0000-d2a2-f200da0a0000 pid=2778 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=cfc1ae21-1900-0000-d2a2-f200da0a0000 pid=2778 execve guuid=e57a1722-1900-0000-d2a2-f200dd0a0000 pid=2781 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=e57a1722-1900-0000-d2a2-f200dd0a0000 pid=2781 execve guuid=650e7422-1900-0000-d2a2-f200de0a0000 pid=2782 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=650e7422-1900-0000-d2a2-f200de0a0000 pid=2782 execve guuid=4419d522-1900-0000-d2a2-f200e00a0000 pid=2784 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=4419d522-1900-0000-d2a2-f200e00a0000 pid=2784 execve guuid=43785723-1900-0000-d2a2-f200e10a0000 pid=2785 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=43785723-1900-0000-d2a2-f200e10a0000 pid=2785 execve guuid=cd68d223-1900-0000-d2a2-f200e20a0000 pid=2786 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=cd68d223-1900-0000-d2a2-f200e20a0000 pid=2786 execve guuid=a2913624-1900-0000-d2a2-f200e40a0000 pid=2788 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=a2913624-1900-0000-d2a2-f200e40a0000 pid=2788 execve guuid=00ed8f24-1900-0000-d2a2-f200e70a0000 pid=2791 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=00ed8f24-1900-0000-d2a2-f200e70a0000 pid=2791 execve guuid=88f6ee24-1900-0000-d2a2-f200e90a0000 pid=2793 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=88f6ee24-1900-0000-d2a2-f200e90a0000 pid=2793 execve guuid=12874d25-1900-0000-d2a2-f200eb0a0000 pid=2795 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=12874d25-1900-0000-d2a2-f200eb0a0000 pid=2795 execve guuid=1062b225-1900-0000-d2a2-f200ed0a0000 pid=2797 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=1062b225-1900-0000-d2a2-f200ed0a0000 pid=2797 execve guuid=ff670d26-1900-0000-d2a2-f200ef0a0000 pid=2799 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=ff670d26-1900-0000-d2a2-f200ef0a0000 pid=2799 execve guuid=165e7326-1900-0000-d2a2-f200f00a0000 pid=2800 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=165e7326-1900-0000-d2a2-f200f00a0000 pid=2800 execve guuid=3f49dd26-1900-0000-d2a2-f200f30a0000 pid=2803 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=3f49dd26-1900-0000-d2a2-f200f30a0000 pid=2803 execve guuid=67234127-1900-0000-d2a2-f200f50a0000 pid=2805 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=67234127-1900-0000-d2a2-f200f50a0000 pid=2805 execve guuid=de1aac27-1900-0000-d2a2-f200f70a0000 pid=2807 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=de1aac27-1900-0000-d2a2-f200f70a0000 pid=2807 execve guuid=38172228-1900-0000-d2a2-f200fa0a0000 pid=2810 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=38172228-1900-0000-d2a2-f200fa0a0000 pid=2810 execve guuid=053dab28-1900-0000-d2a2-f200fc0a0000 pid=2812 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=053dab28-1900-0000-d2a2-f200fc0a0000 pid=2812 execve guuid=1b174929-1900-0000-d2a2-f200fd0a0000 pid=2813 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=1b174929-1900-0000-d2a2-f200fd0a0000 pid=2813 execve guuid=3bdbe229-1900-0000-d2a2-f200ff0a0000 pid=2815 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=3bdbe229-1900-0000-d2a2-f200ff0a0000 pid=2815 execve guuid=330c672a-1900-0000-d2a2-f200010b0000 pid=2817 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=330c672a-1900-0000-d2a2-f200010b0000 pid=2817 execve guuid=f356d32a-1900-0000-d2a2-f200030b0000 pid=2819 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=f356d32a-1900-0000-d2a2-f200030b0000 pid=2819 execve guuid=db454b2b-1900-0000-d2a2-f200060b0000 pid=2822 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=db454b2b-1900-0000-d2a2-f200060b0000 pid=2822 execve guuid=275db12b-1900-0000-d2a2-f200080b0000 pid=2824 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=275db12b-1900-0000-d2a2-f200080b0000 pid=2824 execve guuid=d892162c-1900-0000-d2a2-f2000a0b0000 pid=2826 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=d892162c-1900-0000-d2a2-f2000a0b0000 pid=2826 execve guuid=fd3c8e2c-1900-0000-d2a2-f2000b0b0000 pid=2827 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=fd3c8e2c-1900-0000-d2a2-f2000b0b0000 pid=2827 execve guuid=ca3b042d-1900-0000-d2a2-f2000c0b0000 pid=2828 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=ca3b042d-1900-0000-d2a2-f2000c0b0000 pid=2828 execve guuid=aaa0702d-1900-0000-d2a2-f2000d0b0000 pid=2829 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=aaa0702d-1900-0000-d2a2-f2000d0b0000 pid=2829 execve guuid=7cfedc2d-1900-0000-d2a2-f200100b0000 pid=2832 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=7cfedc2d-1900-0000-d2a2-f200100b0000 pid=2832 execve guuid=09793c2e-1900-0000-d2a2-f200130b0000 pid=2835 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=09793c2e-1900-0000-d2a2-f200130b0000 pid=2835 execve guuid=b37d9c2e-1900-0000-d2a2-f200150b0000 pid=2837 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=b37d9c2e-1900-0000-d2a2-f200150b0000 pid=2837 execve guuid=8202f42e-1900-0000-d2a2-f200170b0000 pid=2839 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=8202f42e-1900-0000-d2a2-f200170b0000 pid=2839 execve guuid=223a4c2f-1900-0000-d2a2-f200190b0000 pid=2841 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=223a4c2f-1900-0000-d2a2-f200190b0000 pid=2841 execve guuid=8d03c32f-1900-0000-d2a2-f2001a0b0000 pid=2842 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=8d03c32f-1900-0000-d2a2-f2001a0b0000 pid=2842 execve guuid=50112330-1900-0000-d2a2-f2001d0b0000 pid=2845 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=50112330-1900-0000-d2a2-f2001d0b0000 pid=2845 execve guuid=c9338a30-1900-0000-d2a2-f2001f0b0000 pid=2847 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=c9338a30-1900-0000-d2a2-f2001f0b0000 pid=2847 execve guuid=2ff9ea30-1900-0000-d2a2-f200210b0000 pid=2849 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=2ff9ea30-1900-0000-d2a2-f200210b0000 pid=2849 execve guuid=7ab74e31-1900-0000-d2a2-f200240b0000 pid=2852 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=7ab74e31-1900-0000-d2a2-f200240b0000 pid=2852 execve guuid=8eeead31-1900-0000-d2a2-f200260b0000 pid=2854 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=8eeead31-1900-0000-d2a2-f200260b0000 pid=2854 execve guuid=21721632-1900-0000-d2a2-f200270b0000 pid=2855 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=21721632-1900-0000-d2a2-f200270b0000 pid=2855 execve guuid=efcc7a32-1900-0000-d2a2-f2002a0b0000 pid=2858 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=efcc7a32-1900-0000-d2a2-f2002a0b0000 pid=2858 execve guuid=0e470233-1900-0000-d2a2-f2002c0b0000 pid=2860 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=0e470233-1900-0000-d2a2-f2002c0b0000 pid=2860 execve guuid=daaf7c33-1900-0000-d2a2-f2002f0b0000 pid=2863 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=daaf7c33-1900-0000-d2a2-f2002f0b0000 pid=2863 execve guuid=6cb8e033-1900-0000-d2a2-f200320b0000 pid=2866 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=6cb8e033-1900-0000-d2a2-f200320b0000 pid=2866 execve guuid=387b4934-1900-0000-d2a2-f200340b0000 pid=2868 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=387b4934-1900-0000-d2a2-f200340b0000 pid=2868 execve guuid=5460a234-1900-0000-d2a2-f200370b0000 pid=2871 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=5460a234-1900-0000-d2a2-f200370b0000 pid=2871 execve guuid=24edf934-1900-0000-d2a2-f200390b0000 pid=2873 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=24edf934-1900-0000-d2a2-f200390b0000 pid=2873 execve guuid=785a5535-1900-0000-d2a2-f2003b0b0000 pid=2875 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=785a5535-1900-0000-d2a2-f2003b0b0000 pid=2875 execve guuid=637bab35-1900-0000-d2a2-f2003d0b0000 pid=2877 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=637bab35-1900-0000-d2a2-f2003d0b0000 pid=2877 execve guuid=00990e36-1900-0000-d2a2-f2003f0b0000 pid=2879 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=00990e36-1900-0000-d2a2-f2003f0b0000 pid=2879 execve guuid=7f366a36-1900-0000-d2a2-f200410b0000 pid=2881 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=7f366a36-1900-0000-d2a2-f200410b0000 pid=2881 execve guuid=2ab6cb36-1900-0000-d2a2-f200430b0000 pid=2883 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=2ab6cb36-1900-0000-d2a2-f200430b0000 pid=2883 execve guuid=997a4037-1900-0000-d2a2-f200460b0000 pid=2886 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=997a4037-1900-0000-d2a2-f200460b0000 pid=2886 execve guuid=7125a937-1900-0000-d2a2-f200480b0000 pid=2888 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=7125a937-1900-0000-d2a2-f200480b0000 pid=2888 execve guuid=73760e38-1900-0000-d2a2-f2004b0b0000 pid=2891 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=73760e38-1900-0000-d2a2-f2004b0b0000 pid=2891 execve guuid=c0d96e38-1900-0000-d2a2-f2004d0b0000 pid=2893 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=c0d96e38-1900-0000-d2a2-f2004d0b0000 pid=2893 execve guuid=7241d338-1900-0000-d2a2-f200500b0000 pid=2896 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=7241d338-1900-0000-d2a2-f200500b0000 pid=2896 execve guuid=8a893939-1900-0000-d2a2-f200520b0000 pid=2898 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=8a893939-1900-0000-d2a2-f200520b0000 pid=2898 execve guuid=43539b39-1900-0000-d2a2-f200540b0000 pid=2900 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=43539b39-1900-0000-d2a2-f200540b0000 pid=2900 execve guuid=31c6fc39-1900-0000-d2a2-f200560b0000 pid=2902 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=31c6fc39-1900-0000-d2a2-f200560b0000 pid=2902 execve guuid=b1565e3a-1900-0000-d2a2-f200580b0000 pid=2904 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=b1565e3a-1900-0000-d2a2-f200580b0000 pid=2904 execve guuid=c8750c3b-1900-0000-d2a2-f2005b0b0000 pid=2907 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=c8750c3b-1900-0000-d2a2-f2005b0b0000 pid=2907 execve guuid=a768913b-1900-0000-d2a2-f2005d0b0000 pid=2909 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=a768913b-1900-0000-d2a2-f2005d0b0000 pid=2909 execve guuid=05e71f3c-1900-0000-d2a2-f2005f0b0000 pid=2911 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=05e71f3c-1900-0000-d2a2-f2005f0b0000 pid=2911 execve guuid=2f42a53c-1900-0000-d2a2-f200620b0000 pid=2914 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=2f42a53c-1900-0000-d2a2-f200620b0000 pid=2914 execve guuid=af10283d-1900-0000-d2a2-f200640b0000 pid=2916 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=af10283d-1900-0000-d2a2-f200640b0000 pid=2916 execve guuid=e31eae3d-1900-0000-d2a2-f200660b0000 pid=2918 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=e31eae3d-1900-0000-d2a2-f200660b0000 pid=2918 execve guuid=f1ae1e3e-1900-0000-d2a2-f200690b0000 pid=2921 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=f1ae1e3e-1900-0000-d2a2-f200690b0000 pid=2921 execve guuid=4500773e-1900-0000-d2a2-f2006a0b0000 pid=2922 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=4500773e-1900-0000-d2a2-f2006a0b0000 pid=2922 execve guuid=8a6f053f-1900-0000-d2a2-f2006d0b0000 pid=2925 /usr/bin/ls guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=8a6f053f-1900-0000-d2a2-f2006d0b0000 pid=2925 execve guuid=d46d613f-1900-0000-d2a2-f200700b0000 pid=2928 /usr/bin/rm guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=d46d613f-1900-0000-d2a2-f200700b0000 pid=2928 execve guuid=73d39d3f-1900-0000-d2a2-f200710b0000 pid=2929 /usr/bin/wget net send-data write-file guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=73d39d3f-1900-0000-d2a2-f200710b0000 pid=2929 execve guuid=be0e6359-1900-0000-d2a2-f200a00b0000 pid=2976 /usr/bin/chmod guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=be0e6359-1900-0000-d2a2-f200a00b0000 pid=2976 execve guuid=5b86a259-1900-0000-d2a2-f200a20b0000 pid=2978 /usr/bin/dash guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=5b86a259-1900-0000-d2a2-f200a20b0000 pid=2978 clone guuid=d9b52e5a-1900-0000-d2a2-f200a60b0000 pid=2982 /usr/bin/rm guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=d9b52e5a-1900-0000-d2a2-f200a60b0000 pid=2982 execve guuid=ce9a6c5a-1900-0000-d2a2-f200a70b0000 pid=2983 /usr/bin/wget net send-data write-file guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=ce9a6c5a-1900-0000-d2a2-f200a70b0000 pid=2983 execve guuid=cfc87172-1900-0000-d2a2-f200d70b0000 pid=3031 /usr/bin/chmod guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=cfc87172-1900-0000-d2a2-f200d70b0000 pid=3031 execve guuid=a866c572-1900-0000-d2a2-f200d90b0000 pid=3033 /usr/bin/dash guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=a866c572-1900-0000-d2a2-f200d90b0000 pid=3033 clone guuid=3da88274-1900-0000-d2a2-f200df0b0000 pid=3039 /usr/bin/rm guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=3da88274-1900-0000-d2a2-f200df0b0000 pid=3039 execve guuid=50a7dc74-1900-0000-d2a2-f200e10b0000 pid=3041 /usr/bin/wget net send-data write-file guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=50a7dc74-1900-0000-d2a2-f200e10b0000 pid=3041 execve guuid=64bde88d-1900-0000-d2a2-f2001e0c0000 pid=3102 /usr/bin/chmod guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=64bde88d-1900-0000-d2a2-f2001e0c0000 pid=3102 execve guuid=cd823f8e-1900-0000-d2a2-f200200c0000 pid=3104 /usr/bin/dash guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=cd823f8e-1900-0000-d2a2-f200200c0000 pid=3104 clone guuid=c6a8e48e-1900-0000-d2a2-f200240c0000 pid=3108 /usr/bin/rm guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=c6a8e48e-1900-0000-d2a2-f200240c0000 pid=3108 execve guuid=3ee63f8f-1900-0000-d2a2-f200260c0000 pid=3110 /usr/bin/wget net send-data write-file guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=3ee63f8f-1900-0000-d2a2-f200260c0000 pid=3110 execve guuid=48430ead-1900-0000-d2a2-f200650c0000 pid=3173 /usr/bin/chmod guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=48430ead-1900-0000-d2a2-f200650c0000 pid=3173 execve guuid=334952ad-1900-0000-d2a2-f200670c0000 pid=3175 /usr/bin/dash guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=334952ad-1900-0000-d2a2-f200670c0000 pid=3175 clone guuid=be6fe7ad-1900-0000-d2a2-f2006a0c0000 pid=3178 /usr/bin/rm guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=be6fe7ad-1900-0000-d2a2-f2006a0c0000 pid=3178 execve guuid=414525ae-1900-0000-d2a2-f2006c0c0000 pid=3180 /usr/bin/wget net send-data write-file guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=414525ae-1900-0000-d2a2-f2006c0c0000 pid=3180 execve guuid=2380a4cb-1900-0000-d2a2-f2009d0c0000 pid=3229 /usr/bin/chmod guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=2380a4cb-1900-0000-d2a2-f2009d0c0000 pid=3229 execve guuid=77b20bcc-1900-0000-d2a2-f2009e0c0000 pid=3230 /usr/bin/dash guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=77b20bcc-1900-0000-d2a2-f2009e0c0000 pid=3230 clone guuid=6fc109cd-1900-0000-d2a2-f200a10c0000 pid=3233 /usr/bin/rm delete-file guuid=db615309-1900-0000-d2a2-f2007b0a0000 pid=2683->guuid=6fc109cd-1900-0000-d2a2-f200a10c0000 pid=3233 execve 801186e6-5fe8-5959-a7b4-832d8d66e7aa 129.121.114.124:80 guuid=73d39d3f-1900-0000-d2a2-f200710b0000 pid=2929->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 133B guuid=ce9a6c5a-1900-0000-d2a2-f200a70b0000 pid=2983->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 133B guuid=50a7dc74-1900-0000-d2a2-f200e10b0000 pid=3041->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 134B guuid=3ee63f8f-1900-0000-d2a2-f200260c0000 pid=3110->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 133B guuid=414525ae-1900-0000-d2a2-f2006c0c0000 pid=3180->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 133B
Score:
98%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/294fdfc8bdacaab572c76264adc483b956002aa85ce2ed85b0ffcaa5e12a5f2e
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/294fdfc8bdacaab572c76264adc483b956002aa85ce2ed85b0ffcaa5e12a5f2e/
Threat name:
Document-HTML.Trojan.Bash
Create hunting rule
Status:
Malicious
First seen:
2026-07-18 06:49:40 UTC
File Type:
Text (Shell)
AV detection:
12 of 24 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ffh57sf5vsvlk4whmjsk3redxflaakviltro3bnq77fklyjkl4xa._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
discovery linux
Link:
https://tria.ge/reports/260718-hlkt6aex5t/
Behaviour
Reads runtime system information
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.26
Link:
https://yomi.yoroi.company/submissions/294fdfc8bdacaab572c76264adc483b956002aa85ce2ed85b0ffcaa5e12a5f2e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 294fdfc8bdacaab572c76264adc483b956002aa85ce2ed85b0ffcaa5e12a5f2e

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3866369/
  
Delivery method
Distributed via web download

Comments