MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 30ab4af6063c4de8efbff53dbee459b204241e2a0bcc779182c08ea17a3e3df2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 2


Intelligence 2 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 30ab4af6063c4de8efbff53dbee459b204241e2a0bcc779182c08ea17a3e3df2
SHA3-384 hash: bfe8913485fa9190b15cbee91570e050de9ac8be609e14c62a3394ebc34d5b456e4aa00c2ac507b214cb71292578008a
SHA1 hash: 25feb5a3fb650dc8a4c1eb33d9dcc9db8fb20e7a
MD5 hash: 2a808ee008e54db81b8509da857cc159
humanhash: red-cold-double-undress
File name:lateral.sh
Download: download sample
File size:1'713 bytes
First seen:2026-08-03 16:22:32 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 48:T2GRY2167RbLsZQnEwb81KssB8C/Ll2VXvzWmbu:RuJE68s2lvzWp
TLSH T14D3112E4FE648824B40EC7B9B1EA8C506D9B996F44641D48B0DFCF3C4BAE5262215F51
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Tags:
bash lolbin
Link:
https://www.filescan.io/uploads/6a70c07714adf1da25350aef/reports/1c6c7f21-734c-49ce-b012-46bbbfdd3df9/overview
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/0c5b62fe-b693-40c1-90dc-6f542051b238
Behavior Graph:
Download SVG
%3 guuid=6ee6f4db-1600-0000-e300-ea563d0d0000 pid=3389 /usr/bin/sudo guuid=7152b0de-1600-0000-e300-ea56460d0000 pid=3398 /tmp/sample.bin guuid=6ee6f4db-1600-0000-e300-ea563d0d0000 pid=3389->guuid=7152b0de-1600-0000-e300-ea56460d0000 pid=3398 execve guuid=65989cdf-1600-0000-e300-ea564a0d0000 pid=3402 /usr/bin/bash guuid=7152b0de-1600-0000-e300-ea56460d0000 pid=3398->guuid=65989cdf-1600-0000-e300-ea564a0d0000 pid=3402 clone guuid=687130e1-1600-0000-e300-ea56510d0000 pid=3409 /usr/bin/bash guuid=7152b0de-1600-0000-e300-ea56460d0000 pid=3398->guuid=687130e1-1600-0000-e300-ea56510d0000 pid=3409 clone guuid=c2adbee1-1600-0000-e300-ea56550d0000 pid=3413 /usr/bin/seq guuid=7152b0de-1600-0000-e300-ea56460d0000 pid=3398->guuid=c2adbee1-1600-0000-e300-ea56550d0000 pid=3413 execve guuid=d8d796e2-1600-0000-e300-ea56560d0000 pid=3414 /usr/bin/bash guuid=7152b0de-1600-0000-e300-ea56460d0000 pid=3398->guuid=d8d796e2-1600-0000-e300-ea56560d0000 pid=3414 clone guuid=d50fa1e2-1600-0000-e300-ea56570d0000 pid=3415 /usr/bin/bash guuid=7152b0de-1600-0000-e300-ea56460d0000 pid=3398->guuid=d50fa1e2-1600-0000-e300-ea56570d0000 pid=3415 clone guuid=8bd2a7e2-1600-0000-e300-ea56580d0000 pid=3416 /usr/bin/bash guuid=7152b0de-1600-0000-e300-ea56460d0000 pid=3398->guuid=8bd2a7e2-1600-0000-e300-ea56580d0000 pid=3416 clone guuid=85b2b4e2-1600-0000-e300-ea565a0d0000 pid=3418 /usr/bin/seq guuid=7152b0de-1600-0000-e300-ea56460d0000 pid=3398->guuid=85b2b4e2-1600-0000-e300-ea565a0d0000 pid=3418 execve guuid=d71392e3-1600-0000-e300-ea565d0d0000 pid=3421 /usr/bin/bash guuid=7152b0de-1600-0000-e300-ea56460d0000 pid=3398->guuid=d71392e3-1600-0000-e300-ea565d0d0000 pid=3421 clone guuid=90bd9ce3-1600-0000-e300-ea565e0d0000 pid=3422 /usr/bin/bash guuid=7152b0de-1600-0000-e300-ea56460d0000 pid=3398->guuid=90bd9ce3-1600-0000-e300-ea565e0d0000 pid=3422 clone guuid=69e7aae3-1600-0000-e300-ea565f0d0000 pid=3423 /usr/bin/bash guuid=7152b0de-1600-0000-e300-ea56460d0000 pid=3398->guuid=69e7aae3-1600-0000-e300-ea565f0d0000 pid=3423 clone guuid=fe6de6e3-1600-0000-e300-ea56610d0000 pid=3425 /usr/bin/seq guuid=7152b0de-1600-0000-e300-ea56460d0000 pid=3398->guuid=fe6de6e3-1600-0000-e300-ea56610d0000 pid=3425 execve guuid=a56206e7-1600-0000-e300-ea566a0d0000 pid=3434 /usr/bin/bash guuid=7152b0de-1600-0000-e300-ea56460d0000 pid=3398->guuid=a56206e7-1600-0000-e300-ea566a0d0000 pid=3434 clone guuid=bb9711e7-1600-0000-e300-ea566b0d0000 pid=3435 /usr/bin/bash guuid=7152b0de-1600-0000-e300-ea56460d0000 pid=3398->guuid=bb9711e7-1600-0000-e300-ea566b0d0000 pid=3435 clone guuid=6bd323e7-1600-0000-e300-ea566c0d0000 pid=3436 /usr/bin/bash guuid=7152b0de-1600-0000-e300-ea56460d0000 pid=3398->guuid=6bd323e7-1600-0000-e300-ea566c0d0000 pid=3436 clone guuid=7d4e6de7-1600-0000-e300-ea566f0d0000 pid=3439 /usr/bin/seq guuid=7152b0de-1600-0000-e300-ea56460d0000 pid=3398->guuid=7d4e6de7-1600-0000-e300-ea566f0d0000 pid=3439 execve guuid=31d3ffe9-1600-0000-e300-ea56750d0000 pid=3445 /usr/bin/bash guuid=7152b0de-1600-0000-e300-ea56460d0000 pid=3398->guuid=31d3ffe9-1600-0000-e300-ea56750d0000 pid=3445 clone guuid=22fd05ea-1600-0000-e300-ea56760d0000 pid=3446 /usr/bin/bash guuid=7152b0de-1600-0000-e300-ea56460d0000 pid=3398->guuid=22fd05ea-1600-0000-e300-ea56760d0000 pid=3446 clone guuid=5ea416ea-1600-0000-e300-ea56770d0000 pid=3447 /usr/bin/bash guuid=7152b0de-1600-0000-e300-ea56460d0000 pid=3398->guuid=5ea416ea-1600-0000-e300-ea56770d0000 pid=3447 clone guuid=3c03b9ea-1600-0000-e300-ea567a0d0000 pid=3450 /usr/bin/seq guuid=7152b0de-1600-0000-e300-ea56460d0000 pid=3398->guuid=3c03b9ea-1600-0000-e300-ea567a0d0000 pid=3450 execve guuid=27abc4eb-1600-0000-e300-ea56800d0000 pid=3456 /usr/bin/bash guuid=7152b0de-1600-0000-e300-ea56460d0000 pid=3398->guuid=27abc4eb-1600-0000-e300-ea56800d0000 pid=3456 clone guuid=779bcceb-1600-0000-e300-ea56810d0000 pid=3457 /usr/bin/bash guuid=7152b0de-1600-0000-e300-ea56460d0000 pid=3398->guuid=779bcceb-1600-0000-e300-ea56810d0000 pid=3457 clone guuid=7fa0d7eb-1600-0000-e300-ea56820d0000 pid=3458 /usr/bin/bash guuid=7152b0de-1600-0000-e300-ea56460d0000 pid=3398->guuid=7fa0d7eb-1600-0000-e300-ea56820d0000 pid=3458 clone guuid=6675dfeb-1600-0000-e300-ea56830d0000 pid=3459 /usr/bin/seq guuid=7152b0de-1600-0000-e300-ea56460d0000 pid=3398->guuid=6675dfeb-1600-0000-e300-ea56830d0000 pid=3459 execve guuid=d3ee43ee-1600-0000-e300-ea568d0d0000 pid=3469 /usr/bin/bash guuid=7152b0de-1600-0000-e300-ea56460d0000 pid=3398->guuid=d3ee43ee-1600-0000-e300-ea568d0d0000 pid=3469 clone guuid=87fc51ee-1600-0000-e300-ea568e0d0000 pid=3470 /usr/bin/bash guuid=7152b0de-1600-0000-e300-ea56460d0000 pid=3398->guuid=87fc51ee-1600-0000-e300-ea568e0d0000 pid=3470 clone guuid=b868b3ee-1600-0000-e300-ea56910d0000 pid=3473 /usr/bin/bash guuid=7152b0de-1600-0000-e300-ea56460d0000 pid=3398->guuid=b868b3ee-1600-0000-e300-ea56910d0000 pid=3473 clone guuid=244b0fef-1600-0000-e300-ea56930d0000 pid=3475 /usr/bin/seq guuid=7152b0de-1600-0000-e300-ea56460d0000 pid=3398->guuid=244b0fef-1600-0000-e300-ea56930d0000 pid=3475 execve guuid=00dcfdf2-1600-0000-e300-ea56a00d0000 pid=3488 /usr/bin/bash guuid=7152b0de-1600-0000-e300-ea56460d0000 pid=3398->guuid=00dcfdf2-1600-0000-e300-ea56a00d0000 pid=3488 clone guuid=ce1d07f3-1600-0000-e300-ea56a10d0000 pid=3489 /usr/bin/bash guuid=7152b0de-1600-0000-e300-ea56460d0000 pid=3398->guuid=ce1d07f3-1600-0000-e300-ea56a10d0000 pid=3489 clone guuid=f4932bf3-1600-0000-e300-ea56a20d0000 pid=3490 /usr/bin/bash guuid=7152b0de-1600-0000-e300-ea56460d0000 pid=3398->guuid=f4932bf3-1600-0000-e300-ea56a20d0000 pid=3490 clone guuid=92cd7cf3-1600-0000-e300-ea56a40d0000 pid=3492 /usr/bin/seq guuid=7152b0de-1600-0000-e300-ea56460d0000 pid=3398->guuid=92cd7cf3-1600-0000-e300-ea56a40d0000 pid=3492 execve guuid=dc7af7f4-1600-0000-e300-ea56aa0d0000 pid=3498 /usr/bin/bash guuid=7152b0de-1600-0000-e300-ea56460d0000 pid=3398->guuid=dc7af7f4-1600-0000-e300-ea56aa0d0000 pid=3498 clone guuid=9e55fef4-1600-0000-e300-ea56ab0d0000 pid=3499 /usr/bin/bash guuid=7152b0de-1600-0000-e300-ea56460d0000 pid=3398->guuid=9e55fef4-1600-0000-e300-ea56ab0d0000 pid=3499 clone guuid=733019f5-1600-0000-e300-ea56ac0d0000 pid=3500 /usr/bin/bash guuid=7152b0de-1600-0000-e300-ea56460d0000 pid=3398->guuid=733019f5-1600-0000-e300-ea56ac0d0000 pid=3500 clone guuid=5f2265f5-1600-0000-e300-ea56b10d0000 pid=3505 /usr/bin/seq guuid=7152b0de-1600-0000-e300-ea56460d0000 pid=3398->guuid=5f2265f5-1600-0000-e300-ea56b10d0000 pid=3505 execve guuid=67f747f8-1600-0000-e300-ea56bd0d0000 pid=3517 /usr/bin/bash guuid=7152b0de-1600-0000-e300-ea56460d0000 pid=3398->guuid=67f747f8-1600-0000-e300-ea56bd0d0000 pid=3517 clone guuid=6a3051f8-1600-0000-e300-ea56be0d0000 pid=3518 /usr/bin/bash guuid=7152b0de-1600-0000-e300-ea56460d0000 pid=3398->guuid=6a3051f8-1600-0000-e300-ea56be0d0000 pid=3518 clone guuid=82d75ff8-1600-0000-e300-ea56bf0d0000 pid=3519 /usr/bin/bash guuid=7152b0de-1600-0000-e300-ea56460d0000 pid=3398->guuid=82d75ff8-1600-0000-e300-ea56bf0d0000 pid=3519 clone guuid=4d05aef8-1600-0000-e300-ea56c20d0000 pid=3522 /usr/bin/seq guuid=7152b0de-1600-0000-e300-ea56460d0000 pid=3398->guuid=4d05aef8-1600-0000-e300-ea56c20d0000 pid=3522 execve guuid=ee76f8fa-1600-0000-e300-ea56cb0d0000 pid=3531 /usr/bin/bash guuid=7152b0de-1600-0000-e300-ea56460d0000 pid=3398->guuid=ee76f8fa-1600-0000-e300-ea56cb0d0000 pid=3531 clone guuid=8f4800fb-1600-0000-e300-ea56cc0d0000 pid=3532 /usr/bin/bash guuid=7152b0de-1600-0000-e300-ea56460d0000 pid=3398->guuid=8f4800fb-1600-0000-e300-ea56cc0d0000 pid=3532 clone guuid=08ee08fb-1600-0000-e300-ea56cd0d0000 pid=3533 /usr/bin/bash guuid=7152b0de-1600-0000-e300-ea56460d0000 pid=3398->guuid=08ee08fb-1600-0000-e300-ea56cd0d0000 pid=3533 clone guuid=23cb13fb-1600-0000-e300-ea56ce0d0000 pid=3534 /usr/bin/seq guuid=7152b0de-1600-0000-e300-ea56460d0000 pid=3398->guuid=23cb13fb-1600-0000-e300-ea56ce0d0000 pid=3534 execve guuid=cb8df6fe-1600-0000-e300-ea56dc0d0000 pid=3548 /usr/bin/bash guuid=7152b0de-1600-0000-e300-ea56460d0000 pid=3398->guuid=cb8df6fe-1600-0000-e300-ea56dc0d0000 pid=3548 clone guuid=c38f03ff-1600-0000-e300-ea56dd0d0000 pid=3549 /usr/bin/bash guuid=7152b0de-1600-0000-e300-ea56460d0000 pid=3398->guuid=c38f03ff-1600-0000-e300-ea56dd0d0000 pid=3549 clone guuid=632a15ff-1600-0000-e300-ea56de0d0000 pid=3550 /usr/bin/bash guuid=7152b0de-1600-0000-e300-ea56460d0000 pid=3398->guuid=632a15ff-1600-0000-e300-ea56de0d0000 pid=3550 clone guuid=3aecb2df-1600-0000-e300-ea564b0d0000 pid=3403 /usr/bin/ip guuid=65989cdf-1600-0000-e300-ea564a0d0000 pid=3402->guuid=3aecb2df-1600-0000-e300-ea564b0d0000 pid=3403 execve guuid=2d3dbddf-1600-0000-e300-ea564c0d0000 pid=3404 /usr/bin/mawk guuid=65989cdf-1600-0000-e300-ea564a0d0000 pid=3402->guuid=2d3dbddf-1600-0000-e300-ea564c0d0000 pid=3404 execve guuid=8a5a43e1-1600-0000-e300-ea56520d0000 pid=3410 /usr/bin/bash guuid=687130e1-1600-0000-e300-ea56510d0000 pid=3409->guuid=8a5a43e1-1600-0000-e300-ea56520d0000 pid=3410 clone guuid=57924ae1-1600-0000-e300-ea56530d0000 pid=3411 /usr/bin/cut guuid=687130e1-1600-0000-e300-ea56510d0000 pid=3409->guuid=57924ae1-1600-0000-e300-ea56530d0000 pid=3411 execve guuid=4ac4b2e2-1600-0000-e300-ea56590d0000 pid=3417 /usr/bin/timeout guuid=d8d796e2-1600-0000-e300-ea56560d0000 pid=3414->guuid=4ac4b2e2-1600-0000-e300-ea56590d0000 pid=3417 execve guuid=021cc5e2-1600-0000-e300-ea565b0d0000 pid=3419 /usr/bin/timeout guuid=d50fa1e2-1600-0000-e300-ea56570d0000 pid=3415->guuid=021cc5e2-1600-0000-e300-ea565b0d0000 pid=3419 execve guuid=e354cbe2-1600-0000-e300-ea565c0d0000 pid=3420 /usr/bin/timeout guuid=8bd2a7e2-1600-0000-e300-ea56580d0000 pid=3416->guuid=e354cbe2-1600-0000-e300-ea565c0d0000 pid=3420 execve guuid=8890dde3-1600-0000-e300-ea56600d0000 pid=3424 /usr/bin/bash net guuid=4ac4b2e2-1600-0000-e300-ea56590d0000 pid=3417->guuid=8890dde3-1600-0000-e300-ea56600d0000 pid=3424 execve guuid=e540f6e4-1600-0000-e300-ea56660d0000 pid=3430 /usr/bin/bash net guuid=021cc5e2-1600-0000-e300-ea565b0d0000 pid=3419->guuid=e540f6e4-1600-0000-e300-ea56660d0000 pid=3430 execve guuid=ce7034e5-1600-0000-e300-ea56670d0000 pid=3431 /usr/bin/bash net guuid=e354cbe2-1600-0000-e300-ea565c0d0000 pid=3420->guuid=ce7034e5-1600-0000-e300-ea56670d0000 pid=3431 execve guuid=b8f182e4-1600-0000-e300-ea56630d0000 pid=3427 /usr/bin/timeout guuid=d71392e3-1600-0000-e300-ea565d0d0000 pid=3421->guuid=b8f182e4-1600-0000-e300-ea56630d0000 pid=3427 execve guuid=1c2336e4-1600-0000-e300-ea56620d0000 pid=3426 /usr/bin/timeout guuid=90bd9ce3-1600-0000-e300-ea565e0d0000 pid=3422->guuid=1c2336e4-1600-0000-e300-ea56620d0000 pid=3426 execve guuid=5a3eeae4-1600-0000-e300-ea56640d0000 pid=3428 /usr/bin/timeout guuid=69e7aae3-1600-0000-e300-ea565f0d0000 pid=3423->guuid=5a3eeae4-1600-0000-e300-ea56640d0000 pid=3428 execve 204076f4-aae8-51fc-a353-124a6e441b38 0.0.0.1:8265 guuid=8890dde3-1600-0000-e300-ea56600d0000 pid=3424->204076f4-aae8-51fc-a353-124a6e441b38 con guuid=cff5f5e4-1600-0000-e300-ea56650d0000 pid=3429 /usr/bin/bash net guuid=1c2336e4-1600-0000-e300-ea56620d0000 pid=3426->guuid=cff5f5e4-1600-0000-e300-ea56650d0000 pid=3429 execve guuid=fc3880e5-1600-0000-e300-ea56680d0000 pid=3432 /usr/bin/bash net guuid=b8f182e4-1600-0000-e300-ea56630d0000 pid=3427->guuid=fc3880e5-1600-0000-e300-ea56680d0000 pid=3432 execve guuid=66c173e6-1600-0000-e300-ea56690d0000 pid=3433 /usr/bin/bash net guuid=5a3eeae4-1600-0000-e300-ea56640d0000 pid=3428->guuid=66c173e6-1600-0000-e300-ea56690d0000 pid=3433 execve 1337e24d-0499-59d6-b184-d11323100545 0.1.0.1:2375 guuid=cff5f5e4-1600-0000-e300-ea56650d0000 pid=3429->1337e24d-0499-59d6-b184-d11323100545 con bd4d596d-c425-5c6a-be1d-6c61706b36b3 0.0.0.1:2375 guuid=e540f6e4-1600-0000-e300-ea56660d0000 pid=3430->bd4d596d-c425-5c6a-be1d-6c61706b36b3 con 783abba7-7c51-5d39-8edf-8c6183bd4175 0.0.0.1:6379 guuid=ce7034e5-1600-0000-e300-ea56670d0000 pid=3431->783abba7-7c51-5d39-8edf-8c6183bd4175 con 49a09166-5a2c-590d-a657-1b05ce71f1d9 0.1.0.1:8265 guuid=fc3880e5-1600-0000-e300-ea56680d0000 pid=3432->49a09166-5a2c-590d-a657-1b05ce71f1d9 con fedaf323-318b-50ba-b9a8-894992c6ba2b 0.1.0.1:6379 guuid=66c173e6-1600-0000-e300-ea56690d0000 pid=3433->fedaf323-318b-50ba-b9a8-894992c6ba2b con guuid=f7533ae7-1600-0000-e300-ea566e0d0000 pid=3438 /usr/bin/timeout guuid=a56206e7-1600-0000-e300-ea566a0d0000 pid=3434->guuid=f7533ae7-1600-0000-e300-ea566e0d0000 pid=3438 execve guuid=23f7d1e8-1600-0000-e300-ea56710d0000 pid=3441 /usr/bin/timeout guuid=bb9711e7-1600-0000-e300-ea566b0d0000 pid=3435->guuid=23f7d1e8-1600-0000-e300-ea56710d0000 pid=3441 execve guuid=7edb8fe8-1600-0000-e300-ea56700d0000 pid=3440 /usr/bin/timeout guuid=6bd323e7-1600-0000-e300-ea566c0d0000 pid=3436->guuid=7edb8fe8-1600-0000-e300-ea56700d0000 pid=3440 execve guuid=8526e6e8-1600-0000-e300-ea56720d0000 pid=3442 /usr/bin/bash guuid=f7533ae7-1600-0000-e300-ea566e0d0000 pid=3438->guuid=8526e6e8-1600-0000-e300-ea56720d0000 pid=3442 execve guuid=8c0293e9-1600-0000-e300-ea56730d0000 pid=3443 /usr/bin/bash net guuid=7edb8fe8-1600-0000-e300-ea56700d0000 pid=3440->guuid=8c0293e9-1600-0000-e300-ea56730d0000 pid=3443 execve guuid=d687c2e9-1600-0000-e300-ea56740d0000 pid=3444 /usr/bin/bash net guuid=23f7d1e8-1600-0000-e300-ea56710d0000 pid=3441->guuid=d687c2e9-1600-0000-e300-ea56740d0000 pid=3444 execve c4bc6cc5-42d9-5196-b8cf-b845de3ff253 0.2.0.1:6379 guuid=8c0293e9-1600-0000-e300-ea56730d0000 pid=3443->c4bc6cc5-42d9-5196-b8cf-b845de3ff253 con 01f7cbf1-90f2-5dad-9525-f134f58edaa4 0.2.0.1:2375 guuid=d687c2e9-1600-0000-e300-ea56740d0000 pid=3444->01f7cbf1-90f2-5dad-9525-f134f58edaa4 con guuid=d1d13eea-1600-0000-e300-ea56780d0000 pid=3448 /usr/bin/timeout guuid=31d3ffe9-1600-0000-e300-ea56750d0000 pid=3445->guuid=d1d13eea-1600-0000-e300-ea56780d0000 pid=3448 execve guuid=9d68bdea-1600-0000-e300-ea567c0d0000 pid=3452 /usr/bin/timeout guuid=22fd05ea-1600-0000-e300-ea56760d0000 pid=3446->guuid=9d68bdea-1600-0000-e300-ea567c0d0000 pid=3452 execve guuid=bf32f1ea-1600-0000-e300-ea567d0d0000 pid=3453 /usr/bin/timeout guuid=5ea416ea-1600-0000-e300-ea56770d0000 pid=3447->guuid=bf32f1ea-1600-0000-e300-ea567d0d0000 pid=3453 execve guuid=869e8feb-1600-0000-e300-ea567f0d0000 pid=3455 /usr/bin/bash net guuid=d1d13eea-1600-0000-e300-ea56780d0000 pid=3448->guuid=869e8feb-1600-0000-e300-ea567f0d0000 pid=3455 execve guuid=bce0f1eb-1600-0000-e300-ea56840d0000 pid=3460 /usr/bin/bash net guuid=9d68bdea-1600-0000-e300-ea567c0d0000 pid=3452->guuid=bce0f1eb-1600-0000-e300-ea56840d0000 pid=3460 execve guuid=dc326bee-1600-0000-e300-ea568f0d0000 pid=3471 /usr/bin/bash guuid=bf32f1ea-1600-0000-e300-ea567d0d0000 pid=3453->guuid=dc326bee-1600-0000-e300-ea568f0d0000 pid=3471 execve 9bc2fe08-15b1-524b-bdfb-b3aceda4a86b 0.3.0.1:8265 guuid=869e8feb-1600-0000-e300-ea567f0d0000 pid=3455->9bc2fe08-15b1-524b-bdfb-b3aceda4a86b con guuid=0ea030ec-1600-0000-e300-ea56860d0000 pid=3462 /usr/bin/timeout guuid=27abc4eb-1600-0000-e300-ea56800d0000 pid=3456->guuid=0ea030ec-1600-0000-e300-ea56860d0000 pid=3462 execve guuid=22f890ec-1600-0000-e300-ea56870d0000 pid=3463 /usr/bin/timeout guuid=779bcceb-1600-0000-e300-ea56810d0000 pid=3457->guuid=22f890ec-1600-0000-e300-ea56870d0000 pid=3463 execve guuid=8ef9c9ec-1600-0000-e300-ea56880d0000 pid=3464 /usr/bin/timeout guuid=7fa0d7eb-1600-0000-e300-ea56820d0000 pid=3458->guuid=8ef9c9ec-1600-0000-e300-ea56880d0000 pid=3464 execve a5eac53d-7264-5027-af13-ce71449a0df3 0.3.0.1:2375 guuid=bce0f1eb-1600-0000-e300-ea56840d0000 pid=3460->a5eac53d-7264-5027-af13-ce71449a0df3 con guuid=c3a05cf1-1600-0000-e300-ea569c0d0000 pid=3484 /usr/bin/bash guuid=0ea030ec-1600-0000-e300-ea56860d0000 pid=3462->guuid=c3a05cf1-1600-0000-e300-ea569c0d0000 pid=3484 execve guuid=dcf632ef-1600-0000-e300-ea56940d0000 pid=3476 /usr/bin/bash guuid=22f890ec-1600-0000-e300-ea56870d0000 pid=3463->guuid=dcf632ef-1600-0000-e300-ea56940d0000 pid=3476 execve guuid=04da9eed-1600-0000-e300-ea568b0d0000 pid=3467 /usr/bin/bash guuid=8ef9c9ec-1600-0000-e300-ea56880d0000 pid=3464->guuid=04da9eed-1600-0000-e300-ea568b0d0000 pid=3467 execve guuid=942970ee-1600-0000-e300-ea56900d0000 pid=3472 /usr/bin/timeout guuid=d3ee43ee-1600-0000-e300-ea568d0d0000 pid=3469->guuid=942970ee-1600-0000-e300-ea56900d0000 pid=3472 execve guuid=369130f0-1600-0000-e300-ea56970d0000 pid=3479 /usr/bin/timeout guuid=87fc51ee-1600-0000-e300-ea568e0d0000 pid=3470->guuid=369130f0-1600-0000-e300-ea56970d0000 pid=3479 execve guuid=02edcdf0-1600-0000-e300-ea56990d0000 pid=3481 /usr/bin/bash guuid=942970ee-1600-0000-e300-ea56900d0000 pid=3472->guuid=02edcdf0-1600-0000-e300-ea56990d0000 pid=3481 execve guuid=a6ecd2f0-1600-0000-e300-ea569a0d0000 pid=3482 /usr/bin/timeout guuid=b868b3ee-1600-0000-e300-ea56910d0000 pid=3473->guuid=a6ecd2f0-1600-0000-e300-ea569a0d0000 pid=3482 execve guuid=6fd86ff1-1600-0000-e300-ea569d0d0000 pid=3485 /usr/bin/bash guuid=369130f0-1600-0000-e300-ea56970d0000 pid=3479->guuid=6fd86ff1-1600-0000-e300-ea569d0d0000 pid=3485 execve guuid=81d795f2-1600-0000-e300-ea569e0d0000 pid=3486 /usr/bin/bash guuid=a6ecd2f0-1600-0000-e300-ea569a0d0000 pid=3482->guuid=81d795f2-1600-0000-e300-ea569e0d0000 pid=3486 execve guuid=30b448f4-1600-0000-e300-ea56a70d0000 pid=3495 /usr/bin/timeout guuid=00dcfdf2-1600-0000-e300-ea56a00d0000 pid=3488->guuid=30b448f4-1600-0000-e300-ea56a70d0000 pid=3495 execve guuid=e6b95af4-1600-0000-e300-ea56a80d0000 pid=3496 /usr/bin/timeout guuid=ce1d07f3-1600-0000-e300-ea56a10d0000 pid=3489->guuid=e6b95af4-1600-0000-e300-ea56a80d0000 pid=3496 execve guuid=09e938f4-1600-0000-e300-ea56a60d0000 pid=3494 /usr/bin/timeout guuid=f4932bf3-1600-0000-e300-ea56a20d0000 pid=3490->guuid=09e938f4-1600-0000-e300-ea56a60d0000 pid=3494 execve guuid=0da910f6-1600-0000-e300-ea56b30d0000 pid=3507 /usr/bin/bash guuid=09e938f4-1600-0000-e300-ea56a60d0000 pid=3494->guuid=0da910f6-1600-0000-e300-ea56b30d0000 pid=3507 execve guuid=c9f932f5-1600-0000-e300-ea56ad0d0000 pid=3501 /usr/bin/bash guuid=30b448f4-1600-0000-e300-ea56a70d0000 pid=3495->guuid=c9f932f5-1600-0000-e300-ea56ad0d0000 pid=3501 execve guuid=fb6070f6-1600-0000-e300-ea56b60d0000 pid=3510 /usr/bin/bash guuid=e6b95af4-1600-0000-e300-ea56a80d0000 pid=3496->guuid=fb6070f6-1600-0000-e300-ea56b60d0000 pid=3510 execve guuid=201a31f6-1600-0000-e300-ea56b40d0000 pid=3508 /usr/bin/timeout guuid=dc7af7f4-1600-0000-e300-ea56aa0d0000 pid=3498->guuid=201a31f6-1600-0000-e300-ea56b40d0000 pid=3508 execve guuid=202c45f5-1600-0000-e300-ea56ae0d0000 pid=3502 /usr/bin/timeout guuid=9e55fef4-1600-0000-e300-ea56ab0d0000 pid=3499->guuid=202c45f5-1600-0000-e300-ea56ae0d0000 pid=3502 execve guuid=40465df5-1600-0000-e300-ea56b00d0000 pid=3504 /usr/bin/timeout guuid=733019f5-1600-0000-e300-ea56ac0d0000 pid=3500->guuid=40465df5-1600-0000-e300-ea56b00d0000 pid=3504 execve guuid=692a6ef6-1600-0000-e300-ea56b50d0000 pid=3509 /usr/bin/bash guuid=202c45f5-1600-0000-e300-ea56ae0d0000 pid=3502->guuid=692a6ef6-1600-0000-e300-ea56b50d0000 pid=3509 execve guuid=6117b5f6-1600-0000-e300-ea56b80d0000 pid=3512 /usr/bin/bash guuid=40465df5-1600-0000-e300-ea56b00d0000 pid=3504->guuid=6117b5f6-1600-0000-e300-ea56b80d0000 pid=3512 execve guuid=a9c02ff7-1600-0000-e300-ea56ba0d0000 pid=3514 /usr/bin/bash guuid=201a31f6-1600-0000-e300-ea56b40d0000 pid=3508->guuid=a9c02ff7-1600-0000-e300-ea56ba0d0000 pid=3514 execve guuid=5253a9f8-1600-0000-e300-ea56c10d0000 pid=3521 /usr/bin/timeout guuid=67f747f8-1600-0000-e300-ea56bd0d0000 pid=3517->guuid=5253a9f8-1600-0000-e300-ea56c10d0000 pid=3521 execve guuid=94ac76f9-1600-0000-e300-ea56c40d0000 pid=3524 /usr/bin/timeout guuid=6a3051f8-1600-0000-e300-ea56be0d0000 pid=3518->guuid=94ac76f9-1600-0000-e300-ea56c40d0000 pid=3524 execve guuid=9e11acf9-1600-0000-e300-ea56c50d0000 pid=3525 /usr/bin/timeout guuid=82d75ff8-1600-0000-e300-ea56bf0d0000 pid=3519->guuid=9e11acf9-1600-0000-e300-ea56c50d0000 pid=3525 execve guuid=1c0c17fa-1600-0000-e300-ea56c70d0000 pid=3527 /usr/bin/bash guuid=5253a9f8-1600-0000-e300-ea56c10d0000 pid=3521->guuid=1c0c17fa-1600-0000-e300-ea56c70d0000 pid=3527 execve guuid=715455fa-1600-0000-e300-ea56c80d0000 pid=3528 /usr/bin/bash guuid=94ac76f9-1600-0000-e300-ea56c40d0000 pid=3524->guuid=715455fa-1600-0000-e300-ea56c80d0000 pid=3528 execve guuid=115a67fa-1600-0000-e300-ea56c90d0000 pid=3529 /usr/bin/bash guuid=9e11acf9-1600-0000-e300-ea56c50d0000 pid=3525->guuid=115a67fa-1600-0000-e300-ea56c90d0000 pid=3529 execve guuid=57e0eefb-1600-0000-e300-ea56d00d0000 pid=3536 /usr/bin/timeout guuid=ee76f8fa-1600-0000-e300-ea56cb0d0000 pid=3531->guuid=57e0eefb-1600-0000-e300-ea56d00d0000 pid=3536 execve guuid=3ba01bfc-1600-0000-e300-ea56d20d0000 pid=3538 /usr/bin/timeout guuid=8f4800fb-1600-0000-e300-ea56cc0d0000 pid=3532->guuid=3ba01bfc-1600-0000-e300-ea56d20d0000 pid=3538 execve guuid=f3a846fc-1600-0000-e300-ea56d30d0000 pid=3539 /usr/bin/timeout guuid=08ee08fb-1600-0000-e300-ea56cd0d0000 pid=3533->guuid=f3a846fc-1600-0000-e300-ea56d30d0000 pid=3539 execve guuid=ef8d40fd-1600-0000-e300-ea56d90d0000 pid=3545 /usr/bin/bash guuid=57e0eefb-1600-0000-e300-ea56d00d0000 pid=3536->guuid=ef8d40fd-1600-0000-e300-ea56d90d0000 pid=3545 execve guuid=a85a30fd-1600-0000-e300-ea56d80d0000 pid=3544 /usr/bin/bash guuid=3ba01bfc-1600-0000-e300-ea56d20d0000 pid=3538->guuid=a85a30fd-1600-0000-e300-ea56d80d0000 pid=3544 execve guuid=43f249fd-1600-0000-e300-ea56da0d0000 pid=3546 /usr/bin/bash guuid=f3a846fc-1600-0000-e300-ea56d30d0000 pid=3539->guuid=43f249fd-1600-0000-e300-ea56da0d0000 pid=3546 execve guuid=a6a8daff-1600-0000-e300-ea56e10d0000 pid=3553 /usr/bin/timeout guuid=cb8df6fe-1600-0000-e300-ea56dc0d0000 pid=3548->guuid=a6a8daff-1600-0000-e300-ea56e10d0000 pid=3553 execve guuid=7b176500-1700-0000-e300-ea56e20d0000 pid=3554 /usr/bin/timeout guuid=c38f03ff-1600-0000-e300-ea56dd0d0000 pid=3549->guuid=7b176500-1700-0000-e300-ea56e20d0000 pid=3554 execve guuid=4c44a4ff-1600-0000-e300-ea56e00d0000 pid=3552 /usr/bin/timeout guuid=632a15ff-1600-0000-e300-ea56de0d0000 pid=3550->guuid=4c44a4ff-1600-0000-e300-ea56e00d0000 pid=3552 execve guuid=4d27a400-1700-0000-e300-ea56e40d0000 pid=3556 /usr/bin/bash guuid=4c44a4ff-1600-0000-e300-ea56e00d0000 pid=3552->guuid=4d27a400-1700-0000-e300-ea56e40d0000 pid=3556 execve guuid=be9af600-1700-0000-e300-ea56e50d0000 pid=3557 /usr/bin/bash guuid=a6a8daff-1600-0000-e300-ea56e10d0000 pid=3553->guuid=be9af600-1700-0000-e300-ea56e50d0000 pid=3557 execve guuid=bb144f01-1700-0000-e300-ea56e70d0000 pid=3559 /usr/bin/bash guuid=7b176500-1700-0000-e300-ea56e20d0000 pid=3554->guuid=bb144f01-1700-0000-e300-ea56e70d0000 pid=3559 execve
Score:
22%
Verdict:
Benign
File Type:
SCRIPT
Link:
https://malprob.io/report/30ab4af6063c4de8efbff53dbee459b204241e2a0bcc779182c08ea17a3e3df2
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/30ab4af6063c4de8efbff53dbee459b204241e2a0bcc779182c08ea17a3e3df2/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gcvuv5qghrg6r3576u635zczwiccihrkbpghpemcychkc6r6hxza._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
discovery linux
Link:
https://tria.ge/reports/260803-tvycdsvwh1/
Behaviour
Reads runtime system information
System Network Configuration Discovery
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/30ab4af6063c4de8efbff53dbee459b204241e2a0bcc779182c08ea17a3e3df2

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 30ab4af6063c4de8efbff53dbee459b204241e2a0bcc779182c08ea17a3e3df2

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3896317/
  
Delivery method
Distributed via web download

Comments