MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2c95a7f6f8bfff7ebdefb0cf3dc44bc57e1605268838e526ba033c16c4bfae54. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2c95a7f6f8bfff7ebdefb0cf3dc44bc57e1605268838e526ba033c16c4bfae54
SHA3-384 hash: 0df06cbbb58956a9a3bb456c8b091deee64bfffc706a0abb5fa00997a4ae52cff524b079bbba32e84c2b78d38cad8d54
SHA1 hash: 7ce01b43bf6b41ca099e4ea8be446f56710634ff
MD5 hash: 26d75f2ef5076a485d2dd6c978cc1c60
humanhash: cup-harry-east-batman
File name:Cia.sh
Download: download sample
File size:1'502 bytes
First seen:2026-05-01 19:41:56 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 24:vp73pLpXpXp4fspQbapTTLp7pjcWpv3pbpKsps:vpjpLpXpXp4UpQbap/Lp7pjfp/pbpLps
TLSH T167311ECB21A159756CE6E96772AA880075D4A1CB14CF6F4DACEC38EA90CDE08B410B93
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://176.65.139.26/Mn/an/aelf mips opendir ua-wget
http://176.65.139.26/MSn/an/aelf mips opendir ua-wget
http://176.65.139.26/SH286f6e82b68c6e434b332eaabd801cc9665b78bd40aa74dd3e7449b95804a675 Miraielf mirai opendir SuperH ua-wget
http://176.65.139.26/Xc8c2aa824c8e13ab01585eaa841005544979716170e23cfb173768d7f7d63f71 Gafgytelf gafgyt opendir ua-wget x86
http://176.65.139.26/I6112477336bc947bcbd254f47282149140ea71eee82171dc73ad916298cf9c63e Gafgytelf gafgyt opendir ua-wget x86
http://176.65.139.26/PCn/an/aelf opendir PowerPC ua-wget
http://176.65.139.26/I5ca7200c628ac101dfd0879c7783c45f074dad71d942abe7b78b96bb3b0b32d3b Gafgytelf gafgyt opendir ua-wget x86
http://176.65.139.26/MKb4d564c76fda674c3dcc01802d72c37d6176f0c382407e2428e7d05ab734ff5a Gafgytelf gafgyt m68k opendir ua-wget
http://176.65.139.26/SC1a77cc4339949d0b53836d7e10a7f189012e5195551d74d27793c0d53a9d92c1 Gafgytelf gafgyt opendir sparc ua-wget
http://176.65.139.26/AV449b98e0ef80243d75bc93ed662d5b4dce00598428c926e3292cc7177b8030649 Gafgytarm elf gafgyt opendir ua-wget
http://176.65.139.26/AV5177c820e390451ef4119879af77cbaf780f0434b9f5602b8cc585d092a6456a1 Gafgytarm elf gafgyt opendir ua-wget
http://176.65.139.26/AV6cb1726f0e394a07393312975aa7ba1214613a0816b6682f116bf3511be87aca4 Miraiarm elf mirai opendir ua-wget
http://176.65.139.26/AV71f9a7eabc027995907576bf213333f72c527337389de23eb898ad976bb6e39e3 Miraiarm elf mirai opendir ua-wget

Intelligence

File Origin
# of uploads :
1
# of downloads :
42
Origin country :
DE DE
Vendor Threat Intelligence
Gathering data
Detection(s):
Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
File Type:
unix shell
First seen:
2026-05-01T16:51:00Z UTC
Last seen:
2026-05-02T00:48:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan-Downloader.Shell.Agent.p HEUR:Trojan-Downloader.Shell.Agent.a
Link:
https://opentip.kaspersky.com/2c95a7f6f8bfff7ebdefb0cf3dc44bc57e1605268838e526ba033c16c4bfae54/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/235c817f-32a6-4d15-9ad3-0122bcf5cee6
Behavior Graph:
Download SVG
%3 guuid=5e404d97-1b00-0000-14fc-c7f67f0c0000 pid=3199 /usr/bin/sudo guuid=9c37d499-1b00-0000-14fc-c7f6830c0000 pid=3203 /tmp/sample.bin guuid=5e404d97-1b00-0000-14fc-c7f67f0c0000 pid=3199->guuid=9c37d499-1b00-0000-14fc-c7f6830c0000 pid=3203 execve guuid=1617859a-1b00-0000-14fc-c7f6840c0000 pid=3204 /usr/bin/wget net send-data write-file guuid=9c37d499-1b00-0000-14fc-c7f6830c0000 pid=3203->guuid=1617859a-1b00-0000-14fc-c7f6840c0000 pid=3204 execve guuid=04b5e3a0-1b00-0000-14fc-c7f68c0c0000 pid=3212 /usr/bin/chmod guuid=9c37d499-1b00-0000-14fc-c7f6830c0000 pid=3203->guuid=04b5e3a0-1b00-0000-14fc-c7f68c0c0000 pid=3212 execve guuid=7ee23ea1-1b00-0000-14fc-c7f68d0c0000 pid=3213 /usr/bin/bash guuid=9c37d499-1b00-0000-14fc-c7f6830c0000 pid=3203->guuid=7ee23ea1-1b00-0000-14fc-c7f68d0c0000 pid=3213 clone guuid=d91deda2-1b00-0000-14fc-c7f6930c0000 pid=3219 /usr/bin/rm delete-file guuid=9c37d499-1b00-0000-14fc-c7f6830c0000 pid=3203->guuid=d91deda2-1b00-0000-14fc-c7f6930c0000 pid=3219 execve guuid=56e53ea3-1b00-0000-14fc-c7f6950c0000 pid=3221 /usr/bin/wget net send-data write-file guuid=9c37d499-1b00-0000-14fc-c7f6830c0000 pid=3203->guuid=56e53ea3-1b00-0000-14fc-c7f6950c0000 pid=3221 execve guuid=011a69a7-1b00-0000-14fc-c7f69b0c0000 pid=3227 /usr/bin/chmod guuid=9c37d499-1b00-0000-14fc-c7f6830c0000 pid=3203->guuid=011a69a7-1b00-0000-14fc-c7f69b0c0000 pid=3227 execve guuid=616ebda7-1b00-0000-14fc-c7f69c0c0000 pid=3228 /usr/bin/bash guuid=9c37d499-1b00-0000-14fc-c7f6830c0000 pid=3203->guuid=616ebda7-1b00-0000-14fc-c7f69c0c0000 pid=3228 clone guuid=29f2c3a9-1b00-0000-14fc-c7f69e0c0000 pid=3230 /usr/bin/rm delete-file guuid=9c37d499-1b00-0000-14fc-c7f6830c0000 pid=3203->guuid=29f2c3a9-1b00-0000-14fc-c7f69e0c0000 pid=3230 execve guuid=a35f30aa-1b00-0000-14fc-c7f69f0c0000 pid=3231 /usr/bin/wget net send-data write-file guuid=9c37d499-1b00-0000-14fc-c7f6830c0000 pid=3203->guuid=a35f30aa-1b00-0000-14fc-c7f69f0c0000 pid=3231 execve guuid=0d32f8ae-1b00-0000-14fc-c7f6a00c0000 pid=3232 /usr/bin/chmod guuid=9c37d499-1b00-0000-14fc-c7f6830c0000 pid=3203->guuid=0d32f8ae-1b00-0000-14fc-c7f6a00c0000 pid=3232 execve guuid=f36c83af-1b00-0000-14fc-c7f6a10c0000 pid=3233 /usr/bin/bash guuid=9c37d499-1b00-0000-14fc-c7f6830c0000 pid=3203->guuid=f36c83af-1b00-0000-14fc-c7f6a10c0000 pid=3233 clone guuid=b2bc6fb0-1b00-0000-14fc-c7f6a30c0000 pid=3235 /usr/bin/rm delete-file guuid=9c37d499-1b00-0000-14fc-c7f6830c0000 pid=3203->guuid=b2bc6fb0-1b00-0000-14fc-c7f6a30c0000 pid=3235 execve guuid=8a92dcb0-1b00-0000-14fc-c7f6a40c0000 pid=3236 /usr/bin/wget net send-data write-file guuid=9c37d499-1b00-0000-14fc-c7f6830c0000 pid=3203->guuid=8a92dcb0-1b00-0000-14fc-c7f6a40c0000 pid=3236 execve guuid=a2afbdb4-1b00-0000-14fc-c7f6a50c0000 pid=3237 /usr/bin/chmod guuid=9c37d499-1b00-0000-14fc-c7f6830c0000 pid=3203->guuid=a2afbdb4-1b00-0000-14fc-c7f6a50c0000 pid=3237 execve guuid=0c2b27b5-1b00-0000-14fc-c7f6a60c0000 pid=3238 /tmp/X mprotect-exec net guuid=9c37d499-1b00-0000-14fc-c7f6830c0000 pid=3203->guuid=0c2b27b5-1b00-0000-14fc-c7f6a60c0000 pid=3238 execve guuid=547ffeb5-1b00-0000-14fc-c7f6ab0c0000 pid=3243 /usr/bin/rm delete-file guuid=9c37d499-1b00-0000-14fc-c7f6830c0000 pid=3203->guuid=547ffeb5-1b00-0000-14fc-c7f6ab0c0000 pid=3243 execve guuid=6831b7b6-1b00-0000-14fc-c7f6ac0c0000 pid=3244 /usr/bin/wget net guuid=9c37d499-1b00-0000-14fc-c7f6830c0000 pid=3203->guuid=6831b7b6-1b00-0000-14fc-c7f6ac0c0000 pid=3244 execve fa10b077-9e93-54b2-922b-bd9ca70b1470 176.65.139.26:80 guuid=1617859a-1b00-0000-14fc-c7f6840c0000 pid=3204->fa10b077-9e93-54b2-922b-bd9ca70b1470 send: 129B guuid=56e53ea3-1b00-0000-14fc-c7f6950c0000 pid=3221->fa10b077-9e93-54b2-922b-bd9ca70b1470 send: 130B guuid=a35f30aa-1b00-0000-14fc-c7f69f0c0000 pid=3231->fa10b077-9e93-54b2-922b-bd9ca70b1470 send: 130B guuid=8a92dcb0-1b00-0000-14fc-c7f6a40c0000 pid=3236->fa10b077-9e93-54b2-922b-bd9ca70b1470 send: 129B 8b0a01dc-0728-52c1-8024-c4ba7801b8d6 8.8.8.8:53 guuid=0c2b27b5-1b00-0000-14fc-c7f6a60c0000 pid=3238->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=70b7d3b5-1b00-0000-14fc-c7f6a70c0000 pid=3239 /tmp/X guuid=0c2b27b5-1b00-0000-14fc-c7f6a60c0000 pid=3238->guuid=70b7d3b5-1b00-0000-14fc-c7f6a70c0000 pid=3239 clone guuid=9eadd8b5-1b00-0000-14fc-c7f6a80c0000 pid=3240 /tmp/X guuid=0c2b27b5-1b00-0000-14fc-c7f6a60c0000 pid=3238->guuid=9eadd8b5-1b00-0000-14fc-c7f6a80c0000 pid=3240 clone guuid=ae7ae2b5-1b00-0000-14fc-c7f6a90c0000 pid=3241 /tmp/X net send-data zombie guuid=9eadd8b5-1b00-0000-14fc-c7f6a80c0000 pid=3240->guuid=ae7ae2b5-1b00-0000-14fc-c7f6a90c0000 pid=3241 clone 8c6073d7-6b15-576b-a643-8a529dfdd401 176.65.139.26:5599 guuid=ae7ae2b5-1b00-0000-14fc-c7f6a90c0000 pid=3241->8c6073d7-6b15-576b-a643-8a529dfdd401 send: 92016B guuid=dbd2efb5-1b00-0000-14fc-c7f6aa0c0000 pid=3242 /tmp/X guuid=ae7ae2b5-1b00-0000-14fc-c7f6a90c0000 pid=3241->guuid=dbd2efb5-1b00-0000-14fc-c7f6aa0c0000 pid=3242 clone guuid=6831b7b6-1b00-0000-14fc-c7f6ac0c0000 pid=3244->fa10b077-9e93-54b2-922b-bd9ca70b1470 con
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/2c95a7f6f8bfff7ebdefb0cf3dc44bc57e1605268838e526ba033c16c4bfae54
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2c95a7f6f8bfff7ebdefb0cf3dc44bc57e1605268838e526ba033c16c4bfae54/
Verdict:
Malicious
Threat:
Trojan-Downloader.Shell.Agent
Link:
https://tip.neiki.dev/file/2c95a7f6f8bfff7ebdefb0cf3dc44bc57e1605268838e526ba033c16c4bfae54
Threat name:
Linux.Downloader.Morila
Create hunting rule
Status:
Malicious
First seen:
2026-05-01 19:43:32 UTC
File Type:
Text (Shell)
AV detection:
23 of 36 (63.89%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fsk2p5xyx77x5pppwdht3rclyv7bmbjgra4okjv2am6bnrf7vzka._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
credential_access defense_evasion discovery linux
Link:
https://tria.ge/reports/260501-ye2gbsct6s/
Behaviour
Reads runtime system information
Writes file to tmp directory
Changes its process name
Reads system network configuration
Reads process memory
Enumerates running processes
Reads system routing table
File and Directory Permissions Modification
Executes dropped EXE
Modifies Watchdog functionality
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.89
Link:
https://yomi.yoroi.company/submissions/2c95a7f6f8bfff7ebdefb0cf3dc44bc57e1605268838e526ba033c16c4bfae54

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 2c95a7f6f8bfff7ebdefb0cf3dc44bc57e1605268838e526ba033c16c4bfae54

(this sample)

elf d6aab46ddb2d1d469bd43e9593c00f1d06c8f9acd8793ee3d92e4004491e015b

  
URLhaus
https://urlhaus.abuse.ch/url/3836535/
  
Delivery method
Distributed via web download
  
Dropping
MD5 2f806234d3169442d41b04cd76a548dd
  
Dropping
SHA256 d6aab46ddb2d1d469bd43e9593c00f1d06c8f9acd8793ee3d92e4004491e015b

Comments