MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2e44d415d83aaf79514ba2398d43095cea216fd048fbd4c3cb7111fa1d1663ec. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2e44d415d83aaf79514ba2398d43095cea216fd048fbd4c3cb7111fa1d1663ec
SHA3-384 hash: f1d5c1b04c62d756cfebb497c447652a07a1f1ee62bba6e1d1cfe4e5ad4aad5aa0ac5e745328b6f33119ff37aebd50dd
SHA1 hash: 788ea9072c5f61c84c879ccb858ba2a8fe507fd4
MD5 hash: b6aa265d7878ffab703ca6fec15ca0f9
humanhash: november-bravo-spaghetti-stream
File name:p
Download: download sample
File size:835 bytes
First seen:2026-07-19 08:49:57 UTC
Last seen:2026-07-19 12:29:15 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 24:kXCKysE2hi0ziQvZoha+xA6jIcFFq13A7:e9Qp+Ms+W6jIcFFW3A7
TLSH T1DA01ABCA92709900006D885D72B6D6B0B431C3C6154A4FB8BFDCE63DEF89E24B076F98
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://129.121.110.105/mFpn/an/aelf ua-wget
http://129.121.110.105/JN2Mn/an/aelf ua-wget
http://129.121.110.105/oVHn/an/aelf ua-wget
http://129.121.110.105/u2yun/an/aelf ua-wget
http://129.121.110.105/OTwn/an/aelf ua-wget

Intelligence

File Origin
# of uploads :
2
# of downloads :
77
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive mirai
Link:
https://www.filescan.io/uploads/6a5c8fdae7ca3dd585f6f497/reports/54b12f7c-06af-4f38-becd-c37b92c9715e/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-07-19T06:08:00Z UTC
Last seen:
2026-07-21T01:23:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/2e44d415d83aaf79514ba2398d43095cea216fd048fbd4c3cb7111fa1d1663ec/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/bcc55de5-7adb-4044-a063-774f203de330
Behavior Graph:
Download SVG
%3 guuid=67b93902-1700-0000-027c-4b037f0c0000 pid=3199 /usr/bin/sudo guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207 /tmp/sample.bin write-file guuid=67b93902-1700-0000-027c-4b037f0c0000 pid=3199->guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207 execve guuid=95f44c06-1700-0000-027c-4b03890c0000 pid=3209 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=95f44c06-1700-0000-027c-4b03890c0000 pid=3209 execve guuid=b402dc06-1700-0000-027c-4b038c0c0000 pid=3212 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=b402dc06-1700-0000-027c-4b038c0c0000 pid=3212 execve guuid=ff18c607-1700-0000-027c-4b038f0c0000 pid=3215 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=ff18c607-1700-0000-027c-4b038f0c0000 pid=3215 execve guuid=ed1c8908-1700-0000-027c-4b03910c0000 pid=3217 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=ed1c8908-1700-0000-027c-4b03910c0000 pid=3217 execve guuid=cd7e2809-1700-0000-027c-4b03930c0000 pid=3219 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=cd7e2809-1700-0000-027c-4b03930c0000 pid=3219 execve guuid=001ac109-1700-0000-027c-4b03950c0000 pid=3221 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=001ac109-1700-0000-027c-4b03950c0000 pid=3221 execve guuid=af4f420a-1700-0000-027c-4b03970c0000 pid=3223 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=af4f420a-1700-0000-027c-4b03970c0000 pid=3223 execve guuid=6e9abc0a-1700-0000-027c-4b039a0c0000 pid=3226 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=6e9abc0a-1700-0000-027c-4b039a0c0000 pid=3226 execve guuid=a9a7340b-1700-0000-027c-4b039c0c0000 pid=3228 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=a9a7340b-1700-0000-027c-4b039c0c0000 pid=3228 execve guuid=6db4aa0b-1700-0000-027c-4b039f0c0000 pid=3231 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=6db4aa0b-1700-0000-027c-4b039f0c0000 pid=3231 execve guuid=ebef2e0c-1700-0000-027c-4b03a10c0000 pid=3233 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=ebef2e0c-1700-0000-027c-4b03a10c0000 pid=3233 execve guuid=a8a4c20c-1700-0000-027c-4b03a40c0000 pid=3236 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=a8a4c20c-1700-0000-027c-4b03a40c0000 pid=3236 execve guuid=c432510d-1700-0000-027c-4b03a60c0000 pid=3238 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=c432510d-1700-0000-027c-4b03a60c0000 pid=3238 execve guuid=7f52d80d-1700-0000-027c-4b03a90c0000 pid=3241 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=7f52d80d-1700-0000-027c-4b03a90c0000 pid=3241 execve guuid=669d610e-1700-0000-027c-4b03ab0c0000 pid=3243 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=669d610e-1700-0000-027c-4b03ab0c0000 pid=3243 execve guuid=087ee70e-1700-0000-027c-4b03ad0c0000 pid=3245 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=087ee70e-1700-0000-027c-4b03ad0c0000 pid=3245 execve guuid=b03e690f-1700-0000-027c-4b03b00c0000 pid=3248 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=b03e690f-1700-0000-027c-4b03b00c0000 pid=3248 execve guuid=779ef00f-1700-0000-027c-4b03b20c0000 pid=3250 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=779ef00f-1700-0000-027c-4b03b20c0000 pid=3250 execve guuid=c01c7310-1700-0000-027c-4b03b40c0000 pid=3252 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=c01c7310-1700-0000-027c-4b03b40c0000 pid=3252 execve guuid=1c6bf110-1700-0000-027c-4b03b50c0000 pid=3253 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=1c6bf110-1700-0000-027c-4b03b50c0000 pid=3253 execve guuid=a2dd6f11-1700-0000-027c-4b03b80c0000 pid=3256 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=a2dd6f11-1700-0000-027c-4b03b80c0000 pid=3256 execve guuid=b2e2e711-1700-0000-027c-4b03ba0c0000 pid=3258 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=b2e2e711-1700-0000-027c-4b03ba0c0000 pid=3258 execve guuid=8fcb6112-1700-0000-027c-4b03bc0c0000 pid=3260 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=8fcb6112-1700-0000-027c-4b03bc0c0000 pid=3260 execve guuid=e9f5dc12-1700-0000-027c-4b03bf0c0000 pid=3263 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=e9f5dc12-1700-0000-027c-4b03bf0c0000 pid=3263 execve guuid=68e06313-1700-0000-027c-4b03c00c0000 pid=3264 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=68e06313-1700-0000-027c-4b03c00c0000 pid=3264 execve guuid=7323f413-1700-0000-027c-4b03c10c0000 pid=3265 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=7323f413-1700-0000-027c-4b03c10c0000 pid=3265 execve guuid=f10b6e14-1700-0000-027c-4b03c30c0000 pid=3267 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=f10b6e14-1700-0000-027c-4b03c30c0000 pid=3267 execve guuid=293eeb14-1700-0000-027c-4b03c50c0000 pid=3269 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=293eeb14-1700-0000-027c-4b03c50c0000 pid=3269 execve guuid=2dca6c15-1700-0000-027c-4b03c70c0000 pid=3271 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=2dca6c15-1700-0000-027c-4b03c70c0000 pid=3271 execve guuid=e73ff515-1700-0000-027c-4b03ca0c0000 pid=3274 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=e73ff515-1700-0000-027c-4b03ca0c0000 pid=3274 execve guuid=aa458316-1700-0000-027c-4b03cc0c0000 pid=3276 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=aa458316-1700-0000-027c-4b03cc0c0000 pid=3276 execve guuid=1edb0a17-1700-0000-027c-4b03cf0c0000 pid=3279 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=1edb0a17-1700-0000-027c-4b03cf0c0000 pid=3279 execve guuid=9c1b8e17-1700-0000-027c-4b03d10c0000 pid=3281 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=9c1b8e17-1700-0000-027c-4b03d10c0000 pid=3281 execve guuid=d05e2018-1700-0000-027c-4b03d40c0000 pid=3284 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=d05e2018-1700-0000-027c-4b03d40c0000 pid=3284 execve guuid=ac82a318-1700-0000-027c-4b03d60c0000 pid=3286 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=ac82a318-1700-0000-027c-4b03d60c0000 pid=3286 execve guuid=aece2f19-1700-0000-027c-4b03d70c0000 pid=3287 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=aece2f19-1700-0000-027c-4b03d70c0000 pid=3287 execve guuid=a04eb519-1700-0000-027c-4b03d90c0000 pid=3289 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=a04eb519-1700-0000-027c-4b03d90c0000 pid=3289 execve guuid=c0ad2d1a-1700-0000-027c-4b03db0c0000 pid=3291 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=c0ad2d1a-1700-0000-027c-4b03db0c0000 pid=3291 execve guuid=aeb2aa1a-1700-0000-027c-4b03de0c0000 pid=3294 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=aeb2aa1a-1700-0000-027c-4b03de0c0000 pid=3294 execve guuid=6424271b-1700-0000-027c-4b03e00c0000 pid=3296 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=6424271b-1700-0000-027c-4b03e00c0000 pid=3296 execve guuid=1333b21b-1700-0000-027c-4b03e20c0000 pid=3298 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=1333b21b-1700-0000-027c-4b03e20c0000 pid=3298 execve guuid=11383d1c-1700-0000-027c-4b03e40c0000 pid=3300 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=11383d1c-1700-0000-027c-4b03e40c0000 pid=3300 execve guuid=1818bc1c-1700-0000-027c-4b03e60c0000 pid=3302 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=1818bc1c-1700-0000-027c-4b03e60c0000 pid=3302 execve guuid=140a311d-1700-0000-027c-4b03e90c0000 pid=3305 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=140a311d-1700-0000-027c-4b03e90c0000 pid=3305 execve guuid=b85ab51d-1700-0000-027c-4b03eb0c0000 pid=3307 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=b85ab51d-1700-0000-027c-4b03eb0c0000 pid=3307 execve guuid=c3222e1e-1700-0000-027c-4b03ee0c0000 pid=3310 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=c3222e1e-1700-0000-027c-4b03ee0c0000 pid=3310 execve guuid=ea57b11e-1700-0000-027c-4b03f00c0000 pid=3312 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=ea57b11e-1700-0000-027c-4b03f00c0000 pid=3312 execve guuid=b84e2f1f-1700-0000-027c-4b03f10c0000 pid=3313 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=b84e2f1f-1700-0000-027c-4b03f10c0000 pid=3313 execve guuid=ceb3a81f-1700-0000-027c-4b03f40c0000 pid=3316 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=ceb3a81f-1700-0000-027c-4b03f40c0000 pid=3316 execve guuid=52440b20-1700-0000-027c-4b03f60c0000 pid=3318 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=52440b20-1700-0000-027c-4b03f60c0000 pid=3318 execve guuid=29ce6c20-1700-0000-027c-4b03f90c0000 pid=3321 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=29ce6c20-1700-0000-027c-4b03f90c0000 pid=3321 execve guuid=b119bb20-1700-0000-027c-4b03fb0c0000 pid=3323 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=b119bb20-1700-0000-027c-4b03fb0c0000 pid=3323 execve guuid=ece91c21-1700-0000-027c-4b03fd0c0000 pid=3325 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=ece91c21-1700-0000-027c-4b03fd0c0000 pid=3325 execve guuid=f4097921-1700-0000-027c-4b03000d0000 pid=3328 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=f4097921-1700-0000-027c-4b03000d0000 pid=3328 execve guuid=df7fd621-1700-0000-027c-4b03020d0000 pid=3330 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=df7fd621-1700-0000-027c-4b03020d0000 pid=3330 execve guuid=10533a22-1700-0000-027c-4b03040d0000 pid=3332 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=10533a22-1700-0000-027c-4b03040d0000 pid=3332 execve guuid=33439d22-1700-0000-027c-4b03050d0000 pid=3333 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=33439d22-1700-0000-027c-4b03050d0000 pid=3333 execve guuid=56a9fc22-1700-0000-027c-4b03080d0000 pid=3336 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=56a9fc22-1700-0000-027c-4b03080d0000 pid=3336 execve guuid=51fe5e23-1700-0000-027c-4b030a0d0000 pid=3338 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=51fe5e23-1700-0000-027c-4b030a0d0000 pid=3338 execve guuid=718eba23-1700-0000-027c-4b030d0d0000 pid=3341 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=718eba23-1700-0000-027c-4b030d0d0000 pid=3341 execve guuid=9b891224-1700-0000-027c-4b030f0d0000 pid=3343 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=9b891224-1700-0000-027c-4b030f0d0000 pid=3343 execve guuid=45e66a24-1700-0000-027c-4b03110d0000 pid=3345 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=45e66a24-1700-0000-027c-4b03110d0000 pid=3345 execve guuid=040bc924-1700-0000-027c-4b03130d0000 pid=3347 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=040bc924-1700-0000-027c-4b03130d0000 pid=3347 execve guuid=a66b2025-1700-0000-027c-4b03150d0000 pid=3349 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=a66b2025-1700-0000-027c-4b03150d0000 pid=3349 execve guuid=e1697925-1700-0000-027c-4b03170d0000 pid=3351 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=e1697925-1700-0000-027c-4b03170d0000 pid=3351 execve guuid=95fcd325-1700-0000-027c-4b03190d0000 pid=3353 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=95fcd325-1700-0000-027c-4b03190d0000 pid=3353 execve guuid=89452b26-1700-0000-027c-4b031c0d0000 pid=3356 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=89452b26-1700-0000-027c-4b031c0d0000 pid=3356 execve guuid=90fc8026-1700-0000-027c-4b031e0d0000 pid=3358 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=90fc8026-1700-0000-027c-4b031e0d0000 pid=3358 execve guuid=7e75d326-1700-0000-027c-4b03210d0000 pid=3361 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=7e75d326-1700-0000-027c-4b03210d0000 pid=3361 execve guuid=69bd2c27-1700-0000-027c-4b03230d0000 pid=3363 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=69bd2c27-1700-0000-027c-4b03230d0000 pid=3363 execve guuid=03d08427-1700-0000-027c-4b03260d0000 pid=3366 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=03d08427-1700-0000-027c-4b03260d0000 pid=3366 execve guuid=a14ce927-1700-0000-027c-4b03280d0000 pid=3368 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=a14ce927-1700-0000-027c-4b03280d0000 pid=3368 execve guuid=c9ba4f28-1700-0000-027c-4b032b0d0000 pid=3371 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=c9ba4f28-1700-0000-027c-4b032b0d0000 pid=3371 execve guuid=17c3b128-1700-0000-027c-4b032d0d0000 pid=3373 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=17c3b128-1700-0000-027c-4b032d0d0000 pid=3373 execve guuid=b0701229-1700-0000-027c-4b03300d0000 pid=3376 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=b0701229-1700-0000-027c-4b03300d0000 pid=3376 execve guuid=e80d7129-1700-0000-027c-4b03310d0000 pid=3377 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=e80d7129-1700-0000-027c-4b03310d0000 pid=3377 execve guuid=f4f7d529-1700-0000-027c-4b03330d0000 pid=3379 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=f4f7d529-1700-0000-027c-4b03330d0000 pid=3379 execve guuid=92f5382a-1700-0000-027c-4b03350d0000 pid=3381 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=92f5382a-1700-0000-027c-4b03350d0000 pid=3381 execve guuid=0fe1932a-1700-0000-027c-4b03380d0000 pid=3384 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=0fe1932a-1700-0000-027c-4b03380d0000 pid=3384 execve guuid=6803e62a-1700-0000-027c-4b033a0d0000 pid=3386 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=6803e62a-1700-0000-027c-4b033a0d0000 pid=3386 execve guuid=0da83d2b-1700-0000-027c-4b033c0d0000 pid=3388 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=0da83d2b-1700-0000-027c-4b033c0d0000 pid=3388 execve guuid=9c08932b-1700-0000-027c-4b033f0d0000 pid=3391 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=9c08932b-1700-0000-027c-4b033f0d0000 pid=3391 execve guuid=7162f32b-1700-0000-027c-4b03410d0000 pid=3393 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=7162f32b-1700-0000-027c-4b03410d0000 pid=3393 execve guuid=8cc6492c-1700-0000-027c-4b03440d0000 pid=3396 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=8cc6492c-1700-0000-027c-4b03440d0000 pid=3396 execve guuid=197ca52c-1700-0000-027c-4b03460d0000 pid=3398 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=197ca52c-1700-0000-027c-4b03460d0000 pid=3398 execve guuid=c799fb2c-1700-0000-027c-4b03490d0000 pid=3401 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=c799fb2c-1700-0000-027c-4b03490d0000 pid=3401 execve guuid=ead54f2d-1700-0000-027c-4b034b0d0000 pid=3403 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=ead54f2d-1700-0000-027c-4b034b0d0000 pid=3403 execve guuid=9c7ca62d-1700-0000-027c-4b034d0d0000 pid=3405 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=9c7ca62d-1700-0000-027c-4b034d0d0000 pid=3405 execve guuid=fdcf022e-1700-0000-027c-4b03500d0000 pid=3408 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=fdcf022e-1700-0000-027c-4b03500d0000 pid=3408 execve guuid=7ec15d2e-1700-0000-027c-4b03520d0000 pid=3410 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=7ec15d2e-1700-0000-027c-4b03520d0000 pid=3410 execve guuid=aff3b62e-1700-0000-027c-4b03550d0000 pid=3413 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=aff3b62e-1700-0000-027c-4b03550d0000 pid=3413 execve guuid=dd1c162f-1700-0000-027c-4b03570d0000 pid=3415 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=dd1c162f-1700-0000-027c-4b03570d0000 pid=3415 execve guuid=a914762f-1700-0000-027c-4b03590d0000 pid=3417 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=a914762f-1700-0000-027c-4b03590d0000 pid=3417 execve guuid=4507d22f-1700-0000-027c-4b035c0d0000 pid=3420 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=4507d22f-1700-0000-027c-4b035c0d0000 pid=3420 execve guuid=d1722d30-1700-0000-027c-4b035e0d0000 pid=3422 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=d1722d30-1700-0000-027c-4b035e0d0000 pid=3422 execve guuid=d9e78d30-1700-0000-027c-4b03610d0000 pid=3425 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=d9e78d30-1700-0000-027c-4b03610d0000 pid=3425 execve guuid=11e6f230-1700-0000-027c-4b03630d0000 pid=3427 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=11e6f230-1700-0000-027c-4b03630d0000 pid=3427 execve guuid=75315031-1700-0000-027c-4b03660d0000 pid=3430 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=75315031-1700-0000-027c-4b03660d0000 pid=3430 execve guuid=a5d2b131-1700-0000-027c-4b03680d0000 pid=3432 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=a5d2b131-1700-0000-027c-4b03680d0000 pid=3432 execve guuid=24371332-1700-0000-027c-4b036b0d0000 pid=3435 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=24371332-1700-0000-027c-4b036b0d0000 pid=3435 execve guuid=538a7932-1700-0000-027c-4b036d0d0000 pid=3437 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=538a7932-1700-0000-027c-4b036d0d0000 pid=3437 execve guuid=6348de32-1700-0000-027c-4b03700d0000 pid=3440 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=6348de32-1700-0000-027c-4b03700d0000 pid=3440 execve guuid=53553433-1700-0000-027c-4b03720d0000 pid=3442 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=53553433-1700-0000-027c-4b03720d0000 pid=3442 execve guuid=01238b33-1700-0000-027c-4b03740d0000 pid=3444 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=01238b33-1700-0000-027c-4b03740d0000 pid=3444 execve guuid=928ce433-1700-0000-027c-4b03770d0000 pid=3447 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=928ce433-1700-0000-027c-4b03770d0000 pid=3447 execve guuid=52f74034-1700-0000-027c-4b03790d0000 pid=3449 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=52f74034-1700-0000-027c-4b03790d0000 pid=3449 execve guuid=ab329d34-1700-0000-027c-4b037c0d0000 pid=3452 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=ab329d34-1700-0000-027c-4b037c0d0000 pid=3452 execve guuid=dc72f434-1700-0000-027c-4b037e0d0000 pid=3454 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=dc72f434-1700-0000-027c-4b037e0d0000 pid=3454 execve guuid=f58a4b35-1700-0000-027c-4b03810d0000 pid=3457 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=f58a4b35-1700-0000-027c-4b03810d0000 pid=3457 execve guuid=cb89a535-1700-0000-027c-4b03830d0000 pid=3459 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=cb89a535-1700-0000-027c-4b03830d0000 pid=3459 execve guuid=561aff35-1700-0000-027c-4b03850d0000 pid=3461 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=561aff35-1700-0000-027c-4b03850d0000 pid=3461 execve guuid=8ad75636-1700-0000-027c-4b03880d0000 pid=3464 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=8ad75636-1700-0000-027c-4b03880d0000 pid=3464 execve guuid=eb02b136-1700-0000-027c-4b038a0d0000 pid=3466 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=eb02b136-1700-0000-027c-4b038a0d0000 pid=3466 execve guuid=db270d37-1700-0000-027c-4b038c0d0000 pid=3468 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=db270d37-1700-0000-027c-4b038c0d0000 pid=3468 execve guuid=99967437-1700-0000-027c-4b038f0d0000 pid=3471 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=99967437-1700-0000-027c-4b038f0d0000 pid=3471 execve guuid=296bde37-1700-0000-027c-4b03910d0000 pid=3473 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=296bde37-1700-0000-027c-4b03910d0000 pid=3473 execve guuid=13304538-1700-0000-027c-4b03940d0000 pid=3476 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=13304538-1700-0000-027c-4b03940d0000 pid=3476 execve guuid=ae7eab38-1700-0000-027c-4b03970d0000 pid=3479 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=ae7eab38-1700-0000-027c-4b03970d0000 pid=3479 execve guuid=d54f0739-1700-0000-027c-4b03990d0000 pid=3481 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=d54f0739-1700-0000-027c-4b03990d0000 pid=3481 execve guuid=35c95c39-1700-0000-027c-4b039b0d0000 pid=3483 /usr/bin/ls guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=35c95c39-1700-0000-027c-4b039b0d0000 pid=3483 execve guuid=479dbc39-1700-0000-027c-4b039e0d0000 pid=3486 /usr/bin/rm guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=479dbc39-1700-0000-027c-4b039e0d0000 pid=3486 execve guuid=cf2ff839-1700-0000-027c-4b03a00d0000 pid=3488 /usr/bin/wget net send-data write-file guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=cf2ff839-1700-0000-027c-4b03a00d0000 pid=3488 execve guuid=79873f3f-1700-0000-027c-4b03b50d0000 pid=3509 /usr/bin/chmod guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=79873f3f-1700-0000-027c-4b03b50d0000 pid=3509 execve guuid=dccc763f-1700-0000-027c-4b03b60d0000 pid=3510 /usr/bin/dash guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=dccc763f-1700-0000-027c-4b03b60d0000 pid=3510 clone guuid=ffb8f93f-1700-0000-027c-4b03ba0d0000 pid=3514 /usr/bin/rm guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=ffb8f93f-1700-0000-027c-4b03ba0d0000 pid=3514 execve guuid=b64b3640-1700-0000-027c-4b03bc0d0000 pid=3516 /usr/bin/wget net send-data write-file guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=b64b3640-1700-0000-027c-4b03bc0d0000 pid=3516 execve guuid=db3ff44b-1700-0000-027c-4b03ca0d0000 pid=3530 /usr/bin/chmod guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=db3ff44b-1700-0000-027c-4b03ca0d0000 pid=3530 execve guuid=ad60764c-1700-0000-027c-4b03cb0d0000 pid=3531 /usr/bin/dash guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=ad60764c-1700-0000-027c-4b03cb0d0000 pid=3531 clone guuid=5346984d-1700-0000-027c-4b03cd0d0000 pid=3533 /usr/bin/rm guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=5346984d-1700-0000-027c-4b03cd0d0000 pid=3533 execve guuid=39f4184e-1700-0000-027c-4b03ce0d0000 pid=3534 /usr/bin/wget net send-data write-file guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=39f4184e-1700-0000-027c-4b03ce0d0000 pid=3534 execve guuid=1d9b2853-1700-0000-027c-4b03d50d0000 pid=3541 /usr/bin/chmod guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=1d9b2853-1700-0000-027c-4b03d50d0000 pid=3541 execve guuid=b5146353-1700-0000-027c-4b03d70d0000 pid=3543 /usr/bin/dash guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=b5146353-1700-0000-027c-4b03d70d0000 pid=3543 clone guuid=ab39e853-1700-0000-027c-4b03db0d0000 pid=3547 /usr/bin/rm guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=ab39e853-1700-0000-027c-4b03db0d0000 pid=3547 execve guuid=0bcf3354-1700-0000-027c-4b03dd0d0000 pid=3549 /usr/bin/wget net send-data write-file guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=0bcf3354-1700-0000-027c-4b03dd0d0000 pid=3549 execve guuid=c0929859-1700-0000-027c-4b03e80d0000 pid=3560 /usr/bin/chmod guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=c0929859-1700-0000-027c-4b03e80d0000 pid=3560 execve guuid=9638025a-1700-0000-027c-4b03ea0d0000 pid=3562 /usr/bin/dash guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=9638025a-1700-0000-027c-4b03ea0d0000 pid=3562 clone guuid=e0d4a25a-1700-0000-027c-4b03ec0d0000 pid=3564 /usr/bin/rm guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=e0d4a25a-1700-0000-027c-4b03ec0d0000 pid=3564 execve guuid=4abee55a-1700-0000-027c-4b03ee0d0000 pid=3566 /usr/bin/wget net send-data write-file guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=4abee55a-1700-0000-027c-4b03ee0d0000 pid=3566 execve guuid=08e89160-1700-0000-027c-4b03fe0d0000 pid=3582 /usr/bin/chmod guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=08e89160-1700-0000-027c-4b03fe0d0000 pid=3582 execve guuid=90f2e660-1700-0000-027c-4b03000e0000 pid=3584 /usr/bin/dash guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=90f2e660-1700-0000-027c-4b03000e0000 pid=3584 clone guuid=dbf66961-1700-0000-027c-4b03030e0000 pid=3587 /usr/bin/rm delete-file guuid=185a9b05-1700-0000-027c-4b03870c0000 pid=3207->guuid=dbf66961-1700-0000-027c-4b03030e0000 pid=3587 execve 0b1ba66e-2f8f-542f-9f7c-00dd01da057c 129.121.110.105:80 guuid=cf2ff839-1700-0000-027c-4b03a00d0000 pid=3488->0b1ba66e-2f8f-542f-9f7c-00dd01da057c send: 133B guuid=b64b3640-1700-0000-027c-4b03bc0d0000 pid=3516->0b1ba66e-2f8f-542f-9f7c-00dd01da057c send: 134B guuid=39f4184e-1700-0000-027c-4b03ce0d0000 pid=3534->0b1ba66e-2f8f-542f-9f7c-00dd01da057c send: 133B guuid=0bcf3354-1700-0000-027c-4b03dd0d0000 pid=3549->0b1ba66e-2f8f-542f-9f7c-00dd01da057c send: 134B guuid=4abee55a-1700-0000-027c-4b03ee0d0000 pid=3566->0b1ba66e-2f8f-542f-9f7c-00dd01da057c send: 133B
Score:
97%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/2e44d415d83aaf79514ba2398d43095cea216fd048fbd4c3cb7111fa1d1663ec
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2e44d415d83aaf79514ba2398d43095cea216fd048fbd4c3cb7111fa1d1663ec/
Threat name:
Document-HTML.Trojan.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2026-07-19 08:50:54 UTC
File Type:
Text (Shell)
AV detection:
11 of 24 (45.83%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fzcnifoyhkxxsuklui4y2qyjltvcc36qjd55jq6loei7uhiwmpwa._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery execution linux persistence privilege_escalation
Link:
https://tria.ge/reports/260719-krvbwsfz7m/
Behaviour
Enumerates kernel/hardware configuration
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
Creates/modifies Cron job
Enumerates running processes
Modifies rc script
Modifies systemd
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.26
Link:
https://yomi.yoroi.company/submissions/2e44d415d83aaf79514ba2398d43095cea216fd048fbd4c3cb7111fa1d1663ec

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 2e44d415d83aaf79514ba2398d43095cea216fd048fbd4c3cb7111fa1d1663ec

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3887342/
  
Delivery method
Distributed via web download

Comments