MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 319f9b804960033b7ddbf8a4a6cde9ef6eef8d2d46e892c1a210f1ef6ef023f2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 319f9b804960033b7ddbf8a4a6cde9ef6eef8d2d46e892c1a210f1ef6ef023f2
SHA3-384 hash: ebb359b51a5328ebd1728af072bab9c71aaa7422f94fb4f0cfaf15d52f56c73ee7cfce51f7cfd965477f9529c92b5db6
SHA1 hash: 5aa222e4510740f778c6a210cc3af393c36a8568
MD5 hash: 5ee7c0f871d1cf686ee225e3e5ce9c5d
humanhash: one-nebraska-tennis-twenty
File name:p
Download: download sample
File size:839 bytes
First seen:2026-07-13 00:03:44 UTC
Last seen:2026-07-13 04:22:08 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkai8CFles9CDVTCTviFSCeO/l0FCs30auD:kXCKysE2hi0ziQvZoha36Hw5c5287307
TLSH T10F01ABDA4940AD4080299A5DA2E7A1D0B451C3CE094A0F787F9C5E2CFB8C910B03AF8D
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://129.121.114.124/deRmn/an/an/a
http://129.121.114.124/8npn/an/an/a
http://129.121.114.124/11nn/an/an/a
http://129.121.114.124/CHUFn/an/an/a
http://129.121.114.124/CufSn/an/an/a

Intelligence

File Origin
# of uploads :
4
# of downloads :
77
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive mirai
Link:
https://www.filescan.io/uploads/6a542b8b3dd22d9c9d768dde/reports/6f8bc7af-cf74-4dfd-aabf-a88fec35bca3/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-07-12T22:06:00Z UTC
Last seen:
2026-07-13T01:45:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/319f9b804960033b7ddbf8a4a6cde9ef6eef8d2d46e892c1a210f1ef6ef023f2/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/16f3172a-6654-4bbc-a5da-2415d23ad2a5
Behavior Graph:
Download SVG
%3 guuid=45ba9c63-1900-0000-a82f-b0f32f140000 pid=5167 /usr/bin/sudo guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168 /tmp/sample.bin write-file guuid=45ba9c63-1900-0000-a82f-b0f32f140000 pid=5167->guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168 execve guuid=ae467267-1900-0000-a82f-b0f331140000 pid=5169 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=ae467267-1900-0000-a82f-b0f331140000 pid=5169 execve guuid=0b20a568-1900-0000-a82f-b0f332140000 pid=5170 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=0b20a568-1900-0000-a82f-b0f332140000 pid=5170 execve guuid=b5721569-1900-0000-a82f-b0f333140000 pid=5171 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=b5721569-1900-0000-a82f-b0f333140000 pid=5171 execve guuid=96257d69-1900-0000-a82f-b0f334140000 pid=5172 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=96257d69-1900-0000-a82f-b0f334140000 pid=5172 execve guuid=1f46ec69-1900-0000-a82f-b0f335140000 pid=5173 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=1f46ec69-1900-0000-a82f-b0f335140000 pid=5173 execve guuid=a8e4546a-1900-0000-a82f-b0f336140000 pid=5174 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=a8e4546a-1900-0000-a82f-b0f336140000 pid=5174 execve guuid=f982cf6a-1900-0000-a82f-b0f337140000 pid=5175 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=f982cf6a-1900-0000-a82f-b0f337140000 pid=5175 execve guuid=3f19406b-1900-0000-a82f-b0f338140000 pid=5176 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=3f19406b-1900-0000-a82f-b0f338140000 pid=5176 execve guuid=0de4b76b-1900-0000-a82f-b0f339140000 pid=5177 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=0de4b76b-1900-0000-a82f-b0f339140000 pid=5177 execve guuid=3daf276c-1900-0000-a82f-b0f33a140000 pid=5178 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=3daf276c-1900-0000-a82f-b0f33a140000 pid=5178 execve guuid=fc4c956c-1900-0000-a82f-b0f33b140000 pid=5179 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=fc4c956c-1900-0000-a82f-b0f33b140000 pid=5179 execve guuid=df34026d-1900-0000-a82f-b0f33c140000 pid=5180 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=df34026d-1900-0000-a82f-b0f33c140000 pid=5180 execve guuid=5467776d-1900-0000-a82f-b0f33d140000 pid=5181 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=5467776d-1900-0000-a82f-b0f33d140000 pid=5181 execve guuid=62a6e26d-1900-0000-a82f-b0f33e140000 pid=5182 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=62a6e26d-1900-0000-a82f-b0f33e140000 pid=5182 execve guuid=d4d94c6e-1900-0000-a82f-b0f33f140000 pid=5183 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=d4d94c6e-1900-0000-a82f-b0f33f140000 pid=5183 execve guuid=f1e8dc6e-1900-0000-a82f-b0f340140000 pid=5184 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=f1e8dc6e-1900-0000-a82f-b0f340140000 pid=5184 execve guuid=dc3b766f-1900-0000-a82f-b0f341140000 pid=5185 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=dc3b766f-1900-0000-a82f-b0f341140000 pid=5185 execve guuid=4ab50470-1900-0000-a82f-b0f342140000 pid=5186 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=4ab50470-1900-0000-a82f-b0f342140000 pid=5186 execve guuid=1d5d9070-1900-0000-a82f-b0f343140000 pid=5187 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=1d5d9070-1900-0000-a82f-b0f343140000 pid=5187 execve guuid=622c2471-1900-0000-a82f-b0f344140000 pid=5188 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=622c2471-1900-0000-a82f-b0f344140000 pid=5188 execve guuid=871d7d72-1900-0000-a82f-b0f345140000 pid=5189 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=871d7d72-1900-0000-a82f-b0f345140000 pid=5189 execve guuid=7f0e3373-1900-0000-a82f-b0f346140000 pid=5190 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=7f0e3373-1900-0000-a82f-b0f346140000 pid=5190 execve guuid=bb07e073-1900-0000-a82f-b0f347140000 pid=5191 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=bb07e073-1900-0000-a82f-b0f347140000 pid=5191 execve guuid=5d858b74-1900-0000-a82f-b0f348140000 pid=5192 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=5d858b74-1900-0000-a82f-b0f348140000 pid=5192 execve guuid=d4aa1775-1900-0000-a82f-b0f349140000 pid=5193 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=d4aa1775-1900-0000-a82f-b0f349140000 pid=5193 execve guuid=37c2ac75-1900-0000-a82f-b0f34a140000 pid=5194 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=37c2ac75-1900-0000-a82f-b0f34a140000 pid=5194 execve guuid=3d363076-1900-0000-a82f-b0f34b140000 pid=5195 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=3d363076-1900-0000-a82f-b0f34b140000 pid=5195 execve guuid=05199676-1900-0000-a82f-b0f34c140000 pid=5196 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=05199676-1900-0000-a82f-b0f34c140000 pid=5196 execve guuid=1b091077-1900-0000-a82f-b0f34d140000 pid=5197 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=1b091077-1900-0000-a82f-b0f34d140000 pid=5197 execve guuid=3f338c77-1900-0000-a82f-b0f34e140000 pid=5198 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=3f338c77-1900-0000-a82f-b0f34e140000 pid=5198 execve guuid=ee753f78-1900-0000-a82f-b0f34f140000 pid=5199 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=ee753f78-1900-0000-a82f-b0f34f140000 pid=5199 execve guuid=94460279-1900-0000-a82f-b0f350140000 pid=5200 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=94460279-1900-0000-a82f-b0f350140000 pid=5200 execve guuid=7e56c179-1900-0000-a82f-b0f351140000 pid=5201 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=7e56c179-1900-0000-a82f-b0f351140000 pid=5201 execve guuid=7a20787a-1900-0000-a82f-b0f352140000 pid=5202 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=7a20787a-1900-0000-a82f-b0f352140000 pid=5202 execve guuid=fee53a7b-1900-0000-a82f-b0f353140000 pid=5203 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=fee53a7b-1900-0000-a82f-b0f353140000 pid=5203 execve guuid=66b4eb7b-1900-0000-a82f-b0f354140000 pid=5204 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=66b4eb7b-1900-0000-a82f-b0f354140000 pid=5204 execve guuid=6e2c937c-1900-0000-a82f-b0f355140000 pid=5205 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=6e2c937c-1900-0000-a82f-b0f355140000 pid=5205 execve guuid=16e4f17c-1900-0000-a82f-b0f356140000 pid=5206 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=16e4f17c-1900-0000-a82f-b0f356140000 pid=5206 execve guuid=634e517d-1900-0000-a82f-b0f357140000 pid=5207 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=634e517d-1900-0000-a82f-b0f357140000 pid=5207 execve guuid=f03fee7d-1900-0000-a82f-b0f359140000 pid=5209 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=f03fee7d-1900-0000-a82f-b0f359140000 pid=5209 execve guuid=a7b5a87e-1900-0000-a82f-b0f35a140000 pid=5210 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=a7b5a87e-1900-0000-a82f-b0f35a140000 pid=5210 execve guuid=4d25557f-1900-0000-a82f-b0f35c140000 pid=5212 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=4d25557f-1900-0000-a82f-b0f35c140000 pid=5212 execve guuid=05d8ea7f-1900-0000-a82f-b0f35e140000 pid=5214 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=05d8ea7f-1900-0000-a82f-b0f35e140000 pid=5214 execve guuid=77326e80-1900-0000-a82f-b0f35f140000 pid=5215 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=77326e80-1900-0000-a82f-b0f35f140000 pid=5215 execve guuid=7168f480-1900-0000-a82f-b0f364140000 pid=5220 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=7168f480-1900-0000-a82f-b0f364140000 pid=5220 execve guuid=1409ef81-1900-0000-a82f-b0f365140000 pid=5221 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=1409ef81-1900-0000-a82f-b0f365140000 pid=5221 execve guuid=7c1f6a82-1900-0000-a82f-b0f366140000 pid=5222 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=7c1f6a82-1900-0000-a82f-b0f366140000 pid=5222 execve guuid=35f6de82-1900-0000-a82f-b0f367140000 pid=5223 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=35f6de82-1900-0000-a82f-b0f367140000 pid=5223 execve guuid=a2646583-1900-0000-a82f-b0f368140000 pid=5224 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=a2646583-1900-0000-a82f-b0f368140000 pid=5224 execve guuid=d09fdf83-1900-0000-a82f-b0f369140000 pid=5225 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=d09fdf83-1900-0000-a82f-b0f369140000 pid=5225 execve guuid=2e455884-1900-0000-a82f-b0f36a140000 pid=5226 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=2e455884-1900-0000-a82f-b0f36a140000 pid=5226 execve guuid=a63fda84-1900-0000-a82f-b0f36b140000 pid=5227 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=a63fda84-1900-0000-a82f-b0f36b140000 pid=5227 execve guuid=360d4f85-1900-0000-a82f-b0f36c140000 pid=5228 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=360d4f85-1900-0000-a82f-b0f36c140000 pid=5228 execve guuid=203dd685-1900-0000-a82f-b0f36d140000 pid=5229 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=203dd685-1900-0000-a82f-b0f36d140000 pid=5229 execve guuid=7090da86-1900-0000-a82f-b0f36e140000 pid=5230 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=7090da86-1900-0000-a82f-b0f36e140000 pid=5230 execve guuid=ba956987-1900-0000-a82f-b0f36f140000 pid=5231 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=ba956987-1900-0000-a82f-b0f36f140000 pid=5231 execve guuid=b7e0f487-1900-0000-a82f-b0f370140000 pid=5232 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=b7e0f487-1900-0000-a82f-b0f370140000 pid=5232 execve guuid=b58f8e88-1900-0000-a82f-b0f371140000 pid=5233 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=b58f8e88-1900-0000-a82f-b0f371140000 pid=5233 execve guuid=4ef23189-1900-0000-a82f-b0f372140000 pid=5234 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=4ef23189-1900-0000-a82f-b0f372140000 pid=5234 execve guuid=d52bb989-1900-0000-a82f-b0f373140000 pid=5235 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=d52bb989-1900-0000-a82f-b0f373140000 pid=5235 execve guuid=9686488a-1900-0000-a82f-b0f374140000 pid=5236 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=9686488a-1900-0000-a82f-b0f374140000 pid=5236 execve guuid=c16ac98a-1900-0000-a82f-b0f375140000 pid=5237 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=c16ac98a-1900-0000-a82f-b0f375140000 pid=5237 execve guuid=d56a438b-1900-0000-a82f-b0f376140000 pid=5238 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=d56a438b-1900-0000-a82f-b0f376140000 pid=5238 execve guuid=e1c6c68b-1900-0000-a82f-b0f377140000 pid=5239 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=e1c6c68b-1900-0000-a82f-b0f377140000 pid=5239 execve guuid=33444b8c-1900-0000-a82f-b0f378140000 pid=5240 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=33444b8c-1900-0000-a82f-b0f378140000 pid=5240 execve guuid=e9cadb8c-1900-0000-a82f-b0f379140000 pid=5241 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=e9cadb8c-1900-0000-a82f-b0f379140000 pid=5241 execve guuid=b8cf698d-1900-0000-a82f-b0f37a140000 pid=5242 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=b8cf698d-1900-0000-a82f-b0f37a140000 pid=5242 execve guuid=d7e21b8e-1900-0000-a82f-b0f37b140000 pid=5243 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=d7e21b8e-1900-0000-a82f-b0f37b140000 pid=5243 execve guuid=24f9ba8e-1900-0000-a82f-b0f37c140000 pid=5244 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=24f9ba8e-1900-0000-a82f-b0f37c140000 pid=5244 execve guuid=7a30b48f-1900-0000-a82f-b0f37d140000 pid=5245 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=7a30b48f-1900-0000-a82f-b0f37d140000 pid=5245 execve guuid=29d07690-1900-0000-a82f-b0f37e140000 pid=5246 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=29d07690-1900-0000-a82f-b0f37e140000 pid=5246 execve guuid=a8c91091-1900-0000-a82f-b0f37f140000 pid=5247 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=a8c91091-1900-0000-a82f-b0f37f140000 pid=5247 execve guuid=f1f39f91-1900-0000-a82f-b0f380140000 pid=5248 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=f1f39f91-1900-0000-a82f-b0f380140000 pid=5248 execve guuid=c3f92f92-1900-0000-a82f-b0f381140000 pid=5249 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=c3f92f92-1900-0000-a82f-b0f381140000 pid=5249 execve guuid=b137ce92-1900-0000-a82f-b0f382140000 pid=5250 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=b137ce92-1900-0000-a82f-b0f382140000 pid=5250 execve guuid=5f8d5793-1900-0000-a82f-b0f383140000 pid=5251 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=5f8d5793-1900-0000-a82f-b0f383140000 pid=5251 execve guuid=0e12e193-1900-0000-a82f-b0f384140000 pid=5252 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=0e12e193-1900-0000-a82f-b0f384140000 pid=5252 execve guuid=e5dc8194-1900-0000-a82f-b0f385140000 pid=5253 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=e5dc8194-1900-0000-a82f-b0f385140000 pid=5253 execve guuid=84c43095-1900-0000-a82f-b0f386140000 pid=5254 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=84c43095-1900-0000-a82f-b0f386140000 pid=5254 execve guuid=146bd395-1900-0000-a82f-b0f387140000 pid=5255 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=146bd395-1900-0000-a82f-b0f387140000 pid=5255 execve guuid=3b5f8796-1900-0000-a82f-b0f388140000 pid=5256 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=3b5f8796-1900-0000-a82f-b0f388140000 pid=5256 execve guuid=ce422197-1900-0000-a82f-b0f389140000 pid=5257 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=ce422197-1900-0000-a82f-b0f389140000 pid=5257 execve guuid=1db2d097-1900-0000-a82f-b0f38a140000 pid=5258 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=1db2d097-1900-0000-a82f-b0f38a140000 pid=5258 execve guuid=3fc25298-1900-0000-a82f-b0f38b140000 pid=5259 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=3fc25298-1900-0000-a82f-b0f38b140000 pid=5259 execve guuid=1cf2cb98-1900-0000-a82f-b0f38c140000 pid=5260 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=1cf2cb98-1900-0000-a82f-b0f38c140000 pid=5260 execve guuid=02c94499-1900-0000-a82f-b0f38d140000 pid=5261 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=02c94499-1900-0000-a82f-b0f38d140000 pid=5261 execve guuid=c56ccf99-1900-0000-a82f-b0f38e140000 pid=5262 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=c56ccf99-1900-0000-a82f-b0f38e140000 pid=5262 execve guuid=818f669a-1900-0000-a82f-b0f38f140000 pid=5263 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=818f669a-1900-0000-a82f-b0f38f140000 pid=5263 execve guuid=08dff99a-1900-0000-a82f-b0f390140000 pid=5264 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=08dff99a-1900-0000-a82f-b0f390140000 pid=5264 execve guuid=e0acb29b-1900-0000-a82f-b0f391140000 pid=5265 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=e0acb29b-1900-0000-a82f-b0f391140000 pid=5265 execve guuid=1c6d749c-1900-0000-a82f-b0f392140000 pid=5266 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=1c6d749c-1900-0000-a82f-b0f392140000 pid=5266 execve guuid=881f2b9d-1900-0000-a82f-b0f393140000 pid=5267 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=881f2b9d-1900-0000-a82f-b0f393140000 pid=5267 execve guuid=113ac29d-1900-0000-a82f-b0f394140000 pid=5268 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=113ac29d-1900-0000-a82f-b0f394140000 pid=5268 execve guuid=7e945e9e-1900-0000-a82f-b0f395140000 pid=5269 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=7e945e9e-1900-0000-a82f-b0f395140000 pid=5269 execve guuid=72f3fa9e-1900-0000-a82f-b0f396140000 pid=5270 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=72f3fa9e-1900-0000-a82f-b0f396140000 pid=5270 execve guuid=b3f5949f-1900-0000-a82f-b0f397140000 pid=5271 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=b3f5949f-1900-0000-a82f-b0f397140000 pid=5271 execve guuid=efaf39a0-1900-0000-a82f-b0f398140000 pid=5272 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=efaf39a0-1900-0000-a82f-b0f398140000 pid=5272 execve guuid=a054d6a0-1900-0000-a82f-b0f399140000 pid=5273 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=a054d6a0-1900-0000-a82f-b0f399140000 pid=5273 execve guuid=7e4287a1-1900-0000-a82f-b0f39a140000 pid=5274 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=7e4287a1-1900-0000-a82f-b0f39a140000 pid=5274 execve guuid=de1530a2-1900-0000-a82f-b0f39b140000 pid=5275 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=de1530a2-1900-0000-a82f-b0f39b140000 pid=5275 execve guuid=ff35c7a2-1900-0000-a82f-b0f39c140000 pid=5276 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=ff35c7a2-1900-0000-a82f-b0f39c140000 pid=5276 execve guuid=cf4f96a3-1900-0000-a82f-b0f39d140000 pid=5277 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=cf4f96a3-1900-0000-a82f-b0f39d140000 pid=5277 execve guuid=3cb874a5-1900-0000-a82f-b0f39e140000 pid=5278 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=3cb874a5-1900-0000-a82f-b0f39e140000 pid=5278 execve guuid=0aeb66a6-1900-0000-a82f-b0f39f140000 pid=5279 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=0aeb66a6-1900-0000-a82f-b0f39f140000 pid=5279 execve guuid=affa25a7-1900-0000-a82f-b0f3a0140000 pid=5280 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=affa25a7-1900-0000-a82f-b0f3a0140000 pid=5280 execve guuid=1bc8f4a7-1900-0000-a82f-b0f3a1140000 pid=5281 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=1bc8f4a7-1900-0000-a82f-b0f3a1140000 pid=5281 execve guuid=8f22bda8-1900-0000-a82f-b0f3a2140000 pid=5282 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=8f22bda8-1900-0000-a82f-b0f3a2140000 pid=5282 execve guuid=be9971a9-1900-0000-a82f-b0f3a3140000 pid=5283 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=be9971a9-1900-0000-a82f-b0f3a3140000 pid=5283 execve guuid=b6c516aa-1900-0000-a82f-b0f3a4140000 pid=5284 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=b6c516aa-1900-0000-a82f-b0f3a4140000 pid=5284 execve guuid=b871bdaa-1900-0000-a82f-b0f3a5140000 pid=5285 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=b871bdaa-1900-0000-a82f-b0f3a5140000 pid=5285 execve guuid=9bd465ab-1900-0000-a82f-b0f3a6140000 pid=5286 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=9bd465ab-1900-0000-a82f-b0f3a6140000 pid=5286 execve guuid=4fdf89ac-1900-0000-a82f-b0f3a7140000 pid=5287 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=4fdf89ac-1900-0000-a82f-b0f3a7140000 pid=5287 execve guuid=92ce3ead-1900-0000-a82f-b0f3a8140000 pid=5288 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=92ce3ead-1900-0000-a82f-b0f3a8140000 pid=5288 execve guuid=25c2f1ad-1900-0000-a82f-b0f3a9140000 pid=5289 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=25c2f1ad-1900-0000-a82f-b0f3a9140000 pid=5289 execve guuid=521f93ae-1900-0000-a82f-b0f3aa140000 pid=5290 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=521f93ae-1900-0000-a82f-b0f3aa140000 pid=5290 execve guuid=945356af-1900-0000-a82f-b0f3ab140000 pid=5291 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=945356af-1900-0000-a82f-b0f3ab140000 pid=5291 execve guuid=2bc002b0-1900-0000-a82f-b0f3ac140000 pid=5292 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=2bc002b0-1900-0000-a82f-b0f3ac140000 pid=5292 execve guuid=f3c59fb0-1900-0000-a82f-b0f3ad140000 pid=5293 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=f3c59fb0-1900-0000-a82f-b0f3ad140000 pid=5293 execve guuid=ca723bb1-1900-0000-a82f-b0f3ae140000 pid=5294 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=ca723bb1-1900-0000-a82f-b0f3ae140000 pid=5294 execve guuid=8106f0b1-1900-0000-a82f-b0f3af140000 pid=5295 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=8106f0b1-1900-0000-a82f-b0f3af140000 pid=5295 execve guuid=3c5791b2-1900-0000-a82f-b0f3b0140000 pid=5296 /usr/bin/ls guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=3c5791b2-1900-0000-a82f-b0f3b0140000 pid=5296 execve guuid=711419b3-1900-0000-a82f-b0f3b1140000 pid=5297 /usr/bin/rm guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=711419b3-1900-0000-a82f-b0f3b1140000 pid=5297 execve guuid=2fb16db3-1900-0000-a82f-b0f3b2140000 pid=5298 /usr/bin/wget net send-data write-file guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=2fb16db3-1900-0000-a82f-b0f3b2140000 pid=5298 execve guuid=04562fd9-1900-0000-a82f-b0f3b3140000 pid=5299 /usr/bin/chmod guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=04562fd9-1900-0000-a82f-b0f3b3140000 pid=5299 execve guuid=3f809fd9-1900-0000-a82f-b0f3b4140000 pid=5300 /usr/bin/dash guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=3f809fd9-1900-0000-a82f-b0f3b4140000 pid=5300 clone guuid=ae9090da-1900-0000-a82f-b0f3b6140000 pid=5302 /usr/bin/rm guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=ae9090da-1900-0000-a82f-b0f3b6140000 pid=5302 execve guuid=b44930db-1900-0000-a82f-b0f3b7140000 pid=5303 /usr/bin/wget net send-data write-file guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=b44930db-1900-0000-a82f-b0f3b7140000 pid=5303 execve guuid=2637abf5-1900-0000-a82f-b0f3b8140000 pid=5304 /usr/bin/chmod guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=2637abf5-1900-0000-a82f-b0f3b8140000 pid=5304 execve guuid=04361ff6-1900-0000-a82f-b0f3b9140000 pid=5305 /usr/bin/dash guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=04361ff6-1900-0000-a82f-b0f3b9140000 pid=5305 clone guuid=eb054700-1a00-0000-a82f-b0f3bb140000 pid=5307 /usr/bin/rm guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=eb054700-1a00-0000-a82f-b0f3bb140000 pid=5307 execve guuid=15c99a00-1a00-0000-a82f-b0f3bc140000 pid=5308 /usr/bin/wget net send-data write-file guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=15c99a00-1a00-0000-a82f-b0f3bc140000 pid=5308 execve guuid=3ebabe1e-1a00-0000-a82f-b0f3bd140000 pid=5309 /usr/bin/chmod guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=3ebabe1e-1a00-0000-a82f-b0f3bd140000 pid=5309 execve guuid=8d82251f-1a00-0000-a82f-b0f3be140000 pid=5310 /usr/bin/dash guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=8d82251f-1a00-0000-a82f-b0f3be140000 pid=5310 clone guuid=4dfc0921-1a00-0000-a82f-b0f3c0140000 pid=5312 /usr/bin/rm guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=4dfc0921-1a00-0000-a82f-b0f3c0140000 pid=5312 execve guuid=1f0c9121-1a00-0000-a82f-b0f3c1140000 pid=5313 /usr/bin/wget net send-data write-file guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=1f0c9121-1a00-0000-a82f-b0f3c1140000 pid=5313 execve guuid=491aa63a-1a00-0000-a82f-b0f3c2140000 pid=5314 /usr/bin/chmod guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=491aa63a-1a00-0000-a82f-b0f3c2140000 pid=5314 execve guuid=0636013b-1a00-0000-a82f-b0f3c3140000 pid=5315 /usr/bin/dash guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=0636013b-1a00-0000-a82f-b0f3c3140000 pid=5315 clone guuid=28191a3c-1a00-0000-a82f-b0f3c5140000 pid=5317 /usr/bin/rm guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=28191a3c-1a00-0000-a82f-b0f3c5140000 pid=5317 execve guuid=8484933c-1a00-0000-a82f-b0f3c6140000 pid=5318 /usr/bin/wget net send-data write-file guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=8484933c-1a00-0000-a82f-b0f3c6140000 pid=5318 execve guuid=600d4355-1a00-0000-a82f-b0f3c7140000 pid=5319 /usr/bin/chmod guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=600d4355-1a00-0000-a82f-b0f3c7140000 pid=5319 execve guuid=dc278b55-1a00-0000-a82f-b0f3c8140000 pid=5320 /usr/bin/dash guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=dc278b55-1a00-0000-a82f-b0f3c8140000 pid=5320 clone guuid=52114c56-1a00-0000-a82f-b0f3ca140000 pid=5322 /usr/bin/rm delete-file guuid=52d10067-1900-0000-a82f-b0f330140000 pid=5168->guuid=52114c56-1a00-0000-a82f-b0f3ca140000 pid=5322 execve 801186e6-5fe8-5959-a7b4-832d8d66e7aa 129.121.114.124:80 guuid=2fb16db3-1900-0000-a82f-b0f3b2140000 pid=5298->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 134B guuid=b44930db-1900-0000-a82f-b0f3b7140000 pid=5303->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 133B guuid=15c99a00-1a00-0000-a82f-b0f3bc140000 pid=5308->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 133B guuid=1f0c9121-1a00-0000-a82f-b0f3c1140000 pid=5313->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 134B guuid=8484933c-1a00-0000-a82f-b0f3c6140000 pid=5318->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 134B
Score:
94%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/319f9b804960033b7ddbf8a4a6cde9ef6eef8d2d46e892c1a210f1ef6ef023f2
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/319f9b804960033b7ddbf8a4a6cde9ef6eef8d2d46e892c1a210f1ef6ef023f2/
Threat name:
Document-HTML.Downloader.Bash
Create hunting rule
Status:
Malicious
First seen:
2026-07-13 00:04:33 UTC
File Type:
Text (Shell)
AV detection:
11 of 36 (30.56%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ggpzxacjmabtw7o37cskntpj55xo7djni3ujfqnccdy663xqepza._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
discovery linux
Link:
https://tria.ge/reports/260713-act3gab16z/
Behaviour
Reads runtime system information
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.26
Link:
https://yomi.yoroi.company/submissions/319f9b804960033b7ddbf8a4a6cde9ef6eef8d2d46e892c1a210f1ef6ef023f2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 319f9b804960033b7ddbf8a4a6cde9ef6eef8d2d46e892c1a210f1ef6ef023f2

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3866369/
  
Delivery method
Distributed via web download

Comments