🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2d41372a3ee70895ee6be05e3a94d460dc9a2feb61b9fb907f3155e0c120c992. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2d41372a3ee70895ee6be05e3a94d460dc9a2feb61b9fb907f3155e0c120c992
SHA3-384 hash: d65664198c58e0ed778a8973b741e045544eaf6a94c4ecc2c7edaff71ffc969997b49dc11d2dd51658e989e9a888d788
SHA1 hash: ac3b1018c90f8271dccb2afc7c86ac206db9d9f8
MD5 hash: 10b95d1594f17d21ac233990ea777c6d
humanhash: double-carolina-delaware-failed
File name:a7m2qx.sh
Download: download sample
File size:1'519 bytes
First seen:2026-09-08 15:49:37 UTC
Last seen:2026-09-09 10:25:47 UTC
File type: sh
MIME type:text/plain
ssdeep 24:spWLdj4SFIJGrOXTNSXMDM+0izsCIs002/dZl:spSeJUtXMDj0izsCIr//l
TLSH T1AD31C4DF14ACA82264488F453692C408A904E5CB644BCFD97F5D9C3ECDA4E19B279B78
Magika asm
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://160.250.181.124/k7m2q9xa/q4m8azn/an/an/a
http://160.250.181.124/k7m2q9xa/r71kxpn/an/an/a
http://160.250.181.124/k7m2q9xa/s29vbcn/an/an/a
http://160.250.181.124/k7m2q9xa/t6n3wyn/an/an/a
http://160.250.181.124/k7m2q9xa/u84jzfn/an/an/a
http://160.250.181.124/k7m2q9xa/v5x92kn/an/an/a
http://160.250.181.124/k7m2q9xa/w31qhpn/an/an/a
http://160.250.181.124/k7m2q9xa/x7c46mn/an/an/a
http://160.250.181.124/k7m2q9xa/y52ndqn/an/an/a
http://160.250.181.124/k7m2q9xa/z8r17bn/an/an/a
http://160.250.181.124/k7m2q9xa/n4p82sn/an/an/a
http://160.250.181.124/k7m2q9xa/q4m7xzn/an/an/a
http://160.250.181.124/k7m2q9xa/b8t2kpn/an/an/a
http://160.250.181.124/k7m2q9xa/n5c9rwn/an/an/a
http://160.250.181.124/k7m2q9xa/v3k8qpn/an/an/a

Intelligence

File Origin
# of uploads :
4
# of downloads :
29
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.Downloader-32.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
busybox downloader evasive mirai
Link:
https://www.filescan.io/uploads/6aa02ec09e49b6ecf76605a4/reports/0fb4b262-7f07-483f-acff-c75295e4f1a2/overview
Verdict:
Malicious
File Type:
ps1
First seen:
2026-09-08T12:01:00Z UTC
Last seen:
2026-09-09T18:31:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/2d41372a3ee70895ee6be05e3a94d460dc9a2feb61b9fb907f3155e0c120c992/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/61c82829-6c4b-4bbd-92dd-438aff8741df
Behavior Graph:
Download SVG
%3 guuid=3301c735-1800-0000-c892-eae0a30a0000 pid=2723 /usr/bin/sudo guuid=d5da7137-1800-0000-c892-eae0a90a0000 pid=2729 /tmp/sample.bin guuid=3301c735-1800-0000-c892-eae0a30a0000 pid=2723->guuid=d5da7137-1800-0000-c892-eae0a90a0000 pid=2729 execve guuid=9eb0a237-1800-0000-c892-eae0aa0a0000 pid=2730 /usr/bin/busybox net send-data write-file guuid=d5da7137-1800-0000-c892-eae0a90a0000 pid=2729->guuid=9eb0a237-1800-0000-c892-eae0aa0a0000 pid=2730 execve guuid=56d60b7a-1800-0000-c892-eae0220b0000 pid=2850 /usr/bin/chmod guuid=d5da7137-1800-0000-c892-eae0a90a0000 pid=2729->guuid=56d60b7a-1800-0000-c892-eae0220b0000 pid=2850 execve guuid=73655a7a-1800-0000-c892-eae0230b0000 pid=2851 /usr/bin/dash guuid=d5da7137-1800-0000-c892-eae0a90a0000 pid=2729->guuid=73655a7a-1800-0000-c892-eae0230b0000 pid=2851 clone guuid=a61ae67a-1800-0000-c892-eae0260b0000 pid=2854 /usr/bin/rm delete-file guuid=d5da7137-1800-0000-c892-eae0a90a0000 pid=2729->guuid=a61ae67a-1800-0000-c892-eae0260b0000 pid=2854 execve guuid=530d1d7b-1800-0000-c892-eae0270b0000 pid=2855 /usr/bin/busybox net send-data write-file guuid=d5da7137-1800-0000-c892-eae0a90a0000 pid=2729->guuid=530d1d7b-1800-0000-c892-eae0270b0000 pid=2855 execve guuid=2464b0ca-1800-0000-c892-eae0e30b0000 pid=3043 /usr/bin/chmod guuid=d5da7137-1800-0000-c892-eae0a90a0000 pid=2729->guuid=2464b0ca-1800-0000-c892-eae0e30b0000 pid=3043 execve guuid=91b31bcb-1800-0000-c892-eae0e40b0000 pid=3044 /usr/bin/dash guuid=d5da7137-1800-0000-c892-eae0a90a0000 pid=2729->guuid=91b31bcb-1800-0000-c892-eae0e40b0000 pid=3044 clone guuid=69d028cc-1800-0000-c892-eae0e70b0000 pid=3047 /usr/bin/rm delete-file guuid=d5da7137-1800-0000-c892-eae0a90a0000 pid=2729->guuid=69d028cc-1800-0000-c892-eae0e70b0000 pid=3047 execve guuid=d2beb2cc-1800-0000-c892-eae0e80b0000 pid=3048 /usr/bin/busybox net send-data write-file guuid=d5da7137-1800-0000-c892-eae0a90a0000 pid=2729->guuid=d2beb2cc-1800-0000-c892-eae0e80b0000 pid=3048 execve guuid=0b0acf0d-1900-0000-c892-eae0210c0000 pid=3105 /usr/bin/chmod guuid=d5da7137-1800-0000-c892-eae0a90a0000 pid=2729->guuid=0b0acf0d-1900-0000-c892-eae0210c0000 pid=3105 execve guuid=985d6f0e-1900-0000-c892-eae0220c0000 pid=3106 /usr/bin/dash guuid=d5da7137-1800-0000-c892-eae0a90a0000 pid=2729->guuid=985d6f0e-1900-0000-c892-eae0220c0000 pid=3106 clone guuid=6e717c10-1900-0000-c892-eae0250c0000 pid=3109 /usr/bin/rm delete-file guuid=d5da7137-1800-0000-c892-eae0a90a0000 pid=2729->guuid=6e717c10-1900-0000-c892-eae0250c0000 pid=3109 execve guuid=e49be910-1900-0000-c892-eae0270c0000 pid=3111 /usr/bin/busybox net send-data write-file guuid=d5da7137-1800-0000-c892-eae0a90a0000 pid=2729->guuid=e49be910-1900-0000-c892-eae0270c0000 pid=3111 execve guuid=1eed8f5c-1900-0000-c892-eae09c0c0000 pid=3228 /usr/bin/chmod guuid=d5da7137-1800-0000-c892-eae0a90a0000 pid=2729->guuid=1eed8f5c-1900-0000-c892-eae09c0c0000 pid=3228 execve guuid=4f27d55c-1900-0000-c892-eae09e0c0000 pid=3230 /usr/bin/dash guuid=d5da7137-1800-0000-c892-eae0a90a0000 pid=2729->guuid=4f27d55c-1900-0000-c892-eae09e0c0000 pid=3230 clone guuid=4ef6df5f-1900-0000-c892-eae0a60c0000 pid=3238 /usr/bin/rm delete-file guuid=d5da7137-1800-0000-c892-eae0a90a0000 pid=2729->guuid=4ef6df5f-1900-0000-c892-eae0a60c0000 pid=3238 execve guuid=f5272560-1900-0000-c892-eae0a70c0000 pid=3239 /usr/bin/busybox net send-data write-file guuid=d5da7137-1800-0000-c892-eae0a90a0000 pid=2729->guuid=f5272560-1900-0000-c892-eae0a70c0000 pid=3239 execve guuid=af7b6da0-1900-0000-c892-eae0140d0000 pid=3348 /usr/bin/chmod guuid=d5da7137-1800-0000-c892-eae0a90a0000 pid=2729->guuid=af7b6da0-1900-0000-c892-eae0140d0000 pid=3348 execve guuid=bfc7dea0-1900-0000-c892-eae0160d0000 pid=3350 /usr/bin/dash guuid=d5da7137-1800-0000-c892-eae0a90a0000 pid=2729->guuid=bfc7dea0-1900-0000-c892-eae0160d0000 pid=3350 clone guuid=dacb3ba2-1900-0000-c892-eae01b0d0000 pid=3355 /usr/bin/rm delete-file guuid=d5da7137-1800-0000-c892-eae0a90a0000 pid=2729->guuid=dacb3ba2-1900-0000-c892-eae01b0d0000 pid=3355 execve guuid=a9d4a2a2-1900-0000-c892-eae01d0d0000 pid=3357 /usr/bin/busybox net send-data write-file guuid=d5da7137-1800-0000-c892-eae0a90a0000 pid=2729->guuid=a9d4a2a2-1900-0000-c892-eae01d0d0000 pid=3357 execve guuid=56430ef1-1900-0000-c892-eae0bc0d0000 pid=3516 /usr/bin/chmod guuid=d5da7137-1800-0000-c892-eae0a90a0000 pid=2729->guuid=56430ef1-1900-0000-c892-eae0bc0d0000 pid=3516 execve guuid=dc4750f1-1900-0000-c892-eae0be0d0000 pid=3518 /usr/bin/dash guuid=d5da7137-1800-0000-c892-eae0a90a0000 pid=2729->guuid=dc4750f1-1900-0000-c892-eae0be0d0000 pid=3518 clone guuid=4b26d9f1-1900-0000-c892-eae0c10d0000 pid=3521 /usr/bin/rm delete-file guuid=d5da7137-1800-0000-c892-eae0a90a0000 pid=2729->guuid=4b26d9f1-1900-0000-c892-eae0c10d0000 pid=3521 execve guuid=2cbb22f2-1900-0000-c892-eae0c50d0000 pid=3525 /usr/bin/busybox net send-data write-file guuid=d5da7137-1800-0000-c892-eae0a90a0000 pid=2729->guuid=2cbb22f2-1900-0000-c892-eae0c50d0000 pid=3525 execve guuid=597fefda-1a00-0000-c892-eae0f8100000 pid=4344 /usr/bin/chmod guuid=d5da7137-1800-0000-c892-eae0a90a0000 pid=2729->guuid=597fefda-1a00-0000-c892-eae0f8100000 pid=4344 execve guuid=eaa129db-1a00-0000-c892-eae0fa100000 pid=4346 /usr/bin/dash guuid=d5da7137-1800-0000-c892-eae0a90a0000 pid=2729->guuid=eaa129db-1a00-0000-c892-eae0fa100000 pid=4346 clone guuid=3535b3db-1a00-0000-c892-eae0ff100000 pid=4351 /usr/bin/rm delete-file guuid=d5da7137-1800-0000-c892-eae0a90a0000 pid=2729->guuid=3535b3db-1a00-0000-c892-eae0ff100000 pid=4351 execve guuid=2c6519dc-1a00-0000-c892-eae003110000 pid=4355 /usr/bin/busybox net send-data write-file guuid=d5da7137-1800-0000-c892-eae0a90a0000 pid=2729->guuid=2c6519dc-1a00-0000-c892-eae003110000 pid=4355 execve guuid=35261241-1b00-0000-c892-eae026120000 pid=4646 /usr/bin/chmod guuid=d5da7137-1800-0000-c892-eae0a90a0000 pid=2729->guuid=35261241-1b00-0000-c892-eae026120000 pid=4646 execve guuid=96977841-1b00-0000-c892-eae027120000 pid=4647 /usr/bin/dash guuid=d5da7137-1800-0000-c892-eae0a90a0000 pid=2729->guuid=96977841-1b00-0000-c892-eae027120000 pid=4647 clone guuid=b4d5b542-1b00-0000-c892-eae02e120000 pid=4654 /usr/bin/rm delete-file guuid=d5da7137-1800-0000-c892-eae0a90a0000 pid=2729->guuid=b4d5b542-1b00-0000-c892-eae02e120000 pid=4654 execve guuid=a16a0a43-1b00-0000-c892-eae030120000 pid=4656 /usr/bin/busybox net send-data write-file guuid=d5da7137-1800-0000-c892-eae0a90a0000 pid=2729->guuid=a16a0a43-1b00-0000-c892-eae030120000 pid=4656 execve guuid=af90df9d-1b00-0000-c892-eae05e130000 pid=4958 /usr/bin/chmod guuid=d5da7137-1800-0000-c892-eae0a90a0000 pid=2729->guuid=af90df9d-1b00-0000-c892-eae05e130000 pid=4958 execve guuid=e874159e-1b00-0000-c892-eae060130000 pid=4960 /usr/bin/dash guuid=d5da7137-1800-0000-c892-eae0a90a0000 pid=2729->guuid=e874159e-1b00-0000-c892-eae060130000 pid=4960 clone guuid=4af99a9e-1b00-0000-c892-eae066130000 pid=4966 /usr/bin/rm delete-file guuid=d5da7137-1800-0000-c892-eae0a90a0000 pid=2729->guuid=4af99a9e-1b00-0000-c892-eae066130000 pid=4966 execve guuid=3780d89e-1b00-0000-c892-eae067130000 pid=4967 /usr/bin/busybox net send-data write-file guuid=d5da7137-1800-0000-c892-eae0a90a0000 pid=2729->guuid=3780d89e-1b00-0000-c892-eae067130000 pid=4967 execve guuid=2e5f1b01-1c00-0000-c892-eae018140000 pid=5144 /usr/bin/chmod guuid=d5da7137-1800-0000-c892-eae0a90a0000 pid=2729->guuid=2e5f1b01-1c00-0000-c892-eae018140000 pid=5144 execve guuid=56a29501-1c00-0000-c892-eae019140000 pid=5145 /usr/bin/dash guuid=d5da7137-1800-0000-c892-eae0a90a0000 pid=2729->guuid=56a29501-1c00-0000-c892-eae019140000 pid=5145 clone guuid=f2055902-1c00-0000-c892-eae01b140000 pid=5147 /usr/bin/rm delete-file guuid=d5da7137-1800-0000-c892-eae0a90a0000 pid=2729->guuid=f2055902-1c00-0000-c892-eae01b140000 pid=5147 execve guuid=a21cc602-1c00-0000-c892-eae01c140000 pid=5148 /usr/bin/busybox net send-data write-file guuid=d5da7137-1800-0000-c892-eae0a90a0000 pid=2729->guuid=a21cc602-1c00-0000-c892-eae01c140000 pid=5148 execve guuid=f1fc4f69-1c00-0000-c892-eae025140000 pid=5157 /usr/bin/chmod guuid=d5da7137-1800-0000-c892-eae0a90a0000 pid=2729->guuid=f1fc4f69-1c00-0000-c892-eae025140000 pid=5157 execve guuid=18ceab69-1c00-0000-c892-eae026140000 pid=5158 /home/sandbox/n4p82s delete-file net guuid=d5da7137-1800-0000-c892-eae0a90a0000 pid=2729->guuid=18ceab69-1c00-0000-c892-eae026140000 pid=5158 execve guuid=60fcde69-1c00-0000-c892-eae028140000 pid=5160 /usr/bin/rm delete-file guuid=d5da7137-1800-0000-c892-eae0a90a0000 pid=2729->guuid=60fcde69-1c00-0000-c892-eae028140000 pid=5160 execve guuid=bc492b6a-1c00-0000-c892-eae02a140000 pid=5162 /usr/bin/busybox net send-data guuid=d5da7137-1800-0000-c892-eae0a90a0000 pid=2729->guuid=bc492b6a-1c00-0000-c892-eae02a140000 pid=5162 execve guuid=b0fa8583-1c00-0000-c892-eae02b140000 pid=5163 /usr/bin/chmod guuid=d5da7137-1800-0000-c892-eae0a90a0000 pid=2729->guuid=b0fa8583-1c00-0000-c892-eae02b140000 pid=5163 execve guuid=aaa5fb83-1c00-0000-c892-eae02c140000 pid=5164 /usr/bin/dash guuid=d5da7137-1800-0000-c892-eae0a90a0000 pid=2729->guuid=aaa5fb83-1c00-0000-c892-eae02c140000 pid=5164 clone guuid=12b60384-1c00-0000-c892-eae02d140000 pid=5165 /usr/bin/rm guuid=d5da7137-1800-0000-c892-eae0a90a0000 pid=2729->guuid=12b60384-1c00-0000-c892-eae02d140000 pid=5165 execve guuid=af9f5484-1c00-0000-c892-eae02e140000 pid=5166 /usr/bin/busybox net send-data guuid=d5da7137-1800-0000-c892-eae0a90a0000 pid=2729->guuid=af9f5484-1c00-0000-c892-eae02e140000 pid=5166 execve guuid=391148a4-1c00-0000-c892-eae02f140000 pid=5167 /usr/bin/chmod guuid=d5da7137-1800-0000-c892-eae0a90a0000 pid=2729->guuid=391148a4-1c00-0000-c892-eae02f140000 pid=5167 execve guuid=bf8a96a4-1c00-0000-c892-eae030140000 pid=5168 /usr/bin/dash guuid=d5da7137-1800-0000-c892-eae0a90a0000 pid=2729->guuid=bf8a96a4-1c00-0000-c892-eae030140000 pid=5168 clone guuid=c9a4a6a4-1c00-0000-c892-eae031140000 pid=5169 /usr/bin/rm guuid=d5da7137-1800-0000-c892-eae0a90a0000 pid=2729->guuid=c9a4a6a4-1c00-0000-c892-eae031140000 pid=5169 execve guuid=bfb9f0a4-1c00-0000-c892-eae032140000 pid=5170 /usr/bin/busybox net send-data write-file guuid=d5da7137-1800-0000-c892-eae0a90a0000 pid=2729->guuid=bfb9f0a4-1c00-0000-c892-eae032140000 pid=5170 execve guuid=5e305ff0-1c00-0000-c892-eae03a140000 pid=5178 /usr/bin/chmod guuid=d5da7137-1800-0000-c892-eae0a90a0000 pid=2729->guuid=5e305ff0-1c00-0000-c892-eae03a140000 pid=5178 execve guuid=5b9805f1-1c00-0000-c892-eae03b140000 pid=5179 /home/sandbox/n5c9rw net guuid=d5da7137-1800-0000-c892-eae0a90a0000 pid=2729->guuid=5b9805f1-1c00-0000-c892-eae03b140000 pid=5179 execve guuid=c1615df1-1c00-0000-c892-eae03d140000 pid=5181 /usr/bin/rm delete-file guuid=d5da7137-1800-0000-c892-eae0a90a0000 pid=2729->guuid=c1615df1-1c00-0000-c892-eae03d140000 pid=5181 execve guuid=4845cff1-1c00-0000-c892-eae03f140000 pid=5183 /usr/bin/busybox net send-data guuid=d5da7137-1800-0000-c892-eae0a90a0000 pid=2729->guuid=4845cff1-1c00-0000-c892-eae03f140000 pid=5183 execve guuid=874b2d0b-1d00-0000-c892-eae040140000 pid=5184 /usr/bin/chmod guuid=d5da7137-1800-0000-c892-eae0a90a0000 pid=2729->guuid=874b2d0b-1d00-0000-c892-eae040140000 pid=5184 execve guuid=c9dc9c0b-1d00-0000-c892-eae041140000 pid=5185 /usr/bin/dash guuid=d5da7137-1800-0000-c892-eae0a90a0000 pid=2729->guuid=c9dc9c0b-1d00-0000-c892-eae041140000 pid=5185 clone guuid=3999bb0b-1d00-0000-c892-eae042140000 pid=5186 /usr/bin/rm guuid=d5da7137-1800-0000-c892-eae0a90a0000 pid=2729->guuid=3999bb0b-1d00-0000-c892-eae042140000 pid=5186 execve guuid=33231f0c-1d00-0000-c892-eae043140000 pid=5187 /usr/bin/rm delete-file guuid=d5da7137-1800-0000-c892-eae0a90a0000 pid=2729->guuid=33231f0c-1d00-0000-c892-eae043140000 pid=5187 execve 41810b37-cfe3-5e1b-81e2-1800bf1431b3 160.250.181.124:80 guuid=9eb0a237-1800-0000-c892-eae0aa0a0000 pid=2730->41810b37-cfe3-5e1b-81e2-1800bf1431b3 send: 93B guuid=530d1d7b-1800-0000-c892-eae0270b0000 pid=2855->41810b37-cfe3-5e1b-81e2-1800bf1431b3 send: 93B guuid=d2beb2cc-1800-0000-c892-eae0e80b0000 pid=3048->41810b37-cfe3-5e1b-81e2-1800bf1431b3 send: 93B guuid=e49be910-1900-0000-c892-eae0270c0000 pid=3111->41810b37-cfe3-5e1b-81e2-1800bf1431b3 send: 93B guuid=f5272560-1900-0000-c892-eae0a70c0000 pid=3239->41810b37-cfe3-5e1b-81e2-1800bf1431b3 send: 93B guuid=a9d4a2a2-1900-0000-c892-eae01d0d0000 pid=3357->41810b37-cfe3-5e1b-81e2-1800bf1431b3 send: 93B guuid=2cbb22f2-1900-0000-c892-eae0c50d0000 pid=3525->41810b37-cfe3-5e1b-81e2-1800bf1431b3 send: 93B guuid=2c6519dc-1a00-0000-c892-eae003110000 pid=4355->41810b37-cfe3-5e1b-81e2-1800bf1431b3 send: 93B guuid=a16a0a43-1b00-0000-c892-eae030120000 pid=4656->41810b37-cfe3-5e1b-81e2-1800bf1431b3 send: 93B guuid=3780d89e-1b00-0000-c892-eae067130000 pid=4967->41810b37-cfe3-5e1b-81e2-1800bf1431b3 send: 93B guuid=a21cc602-1c00-0000-c892-eae01c140000 pid=5148->41810b37-cfe3-5e1b-81e2-1800bf1431b3 send: 93B 8b0a01dc-0728-52c1-8024-c4ba7801b8d6 8.8.8.8:53 guuid=18ceab69-1c00-0000-c892-eae026140000 pid=5158->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=2ab8d469-1c00-0000-c892-eae027140000 pid=5159 /home/sandbox/n4p82s dns net send-data zombie guuid=18ceab69-1c00-0000-c892-eae026140000 pid=5158->guuid=2ab8d469-1c00-0000-c892-eae027140000 pid=5159 clone guuid=2ab8d469-1c00-0000-c892-eae027140000 pid=5159->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 send: 37B 5ea9a3a5-d8c0-5614-a1b9-5481890fe1f4 ducnhan.duckdns.org:47925 guuid=2ab8d469-1c00-0000-c892-eae027140000 pid=5159->5ea9a3a5-d8c0-5614-a1b9-5481890fe1f4 send: 12B guuid=bd1ae169-1c00-0000-c892-eae029140000 pid=5161 /home/sandbox/n4p82s guuid=2ab8d469-1c00-0000-c892-eae027140000 pid=5159->guuid=bd1ae169-1c00-0000-c892-eae029140000 pid=5161 clone 1fc54b0f-7b9c-56de-84a5-9d977870c6a7 ducnhan.duckdns.org:80 guuid=bc492b6a-1c00-0000-c892-eae02a140000 pid=5162->1fc54b0f-7b9c-56de-84a5-9d977870c6a7 send: 93B guuid=af9f5484-1c00-0000-c892-eae02e140000 pid=5166->1fc54b0f-7b9c-56de-84a5-9d977870c6a7 send: 93B guuid=bfb9f0a4-1c00-0000-c892-eae032140000 pid=5170->1fc54b0f-7b9c-56de-84a5-9d977870c6a7 send: 93B guuid=5b9805f1-1c00-0000-c892-eae03b140000 pid=5179->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=f8a250f1-1c00-0000-c892-eae03c140000 pid=5180 /home/sandbox/n5c9rw dns net send-data zombie guuid=5b9805f1-1c00-0000-c892-eae03b140000 pid=5179->guuid=f8a250f1-1c00-0000-c892-eae03c140000 pid=5180 clone guuid=f8a250f1-1c00-0000-c892-eae03c140000 pid=5180->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 send: 333B guuid=f8a250f1-1c00-0000-c892-eae03c140000 pid=5180->5ea9a3a5-d8c0-5614-a1b9-5481890fe1f4 send: 99B guuid=786263f1-1c00-0000-c892-eae03e140000 pid=5182 /home/sandbox/n5c9rw guuid=f8a250f1-1c00-0000-c892-eae03c140000 pid=5180->guuid=786263f1-1c00-0000-c892-eae03e140000 pid=5182 clone guuid=4845cff1-1c00-0000-c892-eae03f140000 pid=5183->1fc54b0f-7b9c-56de-84a5-9d977870c6a7 send: 93B
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/2d41372a3ee70895ee6be05e3a94d460dc9a2feb61b9fb907f3155e0c120c992
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2d41372a3ee70895ee6be05e3a94d460dc9a2feb61b9fb907f3155e0c120c992/
Threat name:
Document-HTML.Downloader.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2026-09-08 15:50:30 UTC
File Type:
Text (Shell)
AV detection:
14 of 38 (36.84%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fvatokr644ejl3tl4bpdvfgumdojul7lmg47xed7gfk6bqjazgja._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
execution
Link:
https://tria.ge/reports/260908-s95jkstema/
Behaviour
Modifies registry class
Suspicious use of SetWindowsHookEx
Enumerates physical storage devices
Executes a command shell one-liner
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/2d41372a3ee70895ee6be05e3a94d460dc9a2feb61b9fb907f3155e0c120c992

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 2d41372a3ee70895ee6be05e3a94d460dc9a2feb61b9fb907f3155e0c120c992

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3910249/
  
Delivery method
Distributed via web download

Comments