MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 344f930a6ecd8ca55f4912998c3c64f2149f9cae88ab7b8a080e78ae81f29ba6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 344f930a6ecd8ca55f4912998c3c64f2149f9cae88ab7b8a080e78ae81f29ba6
SHA3-384 hash: 6734998fdfcc83d57b23e861896895af434e9bd0c42caf4f6d1947aac4781b4b0da076d82acafbfee9380984a3705511
SHA1 hash: ac497f78198c154e321f133a7ab941a158fd2bae
MD5 hash: 522d31a9a61f58acde8ce687d9eda8ce
humanhash: item-robin-johnny-north
File name:p
Download: download sample
File size:839 bytes
First seen:2026-08-08 21:15:59 UTC
Last seen:2026-08-09 15:39:12 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkaOC58BFAx8CbfeF+HmCShOs8FCYzCy2Qaa:kXCKysE2hi0ziQvZohaOeCHJkbNtt7
TLSH T112016BC98940E910406ADE5E22D76690B421C3CE458A0FB87F9C5A2DFBD8914F06AFA9
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://129.121.114.124/dnCfn/an/aua-wget
http://129.121.114.124/jdDjn/an/aua-wget
http://129.121.114.124/gEKn/an/aua-wget
http://129.121.114.124/MySn/an/aua-wget
http://129.121.114.124/dS74n/an/aua-wget

Intelligence

File Origin
# of uploads :
3
# of downloads :
68
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive mirai
Link:
https://www.filescan.io/uploads/6a779ca499039a804ee27544/reports/2ff621d6-d140-4f30-856c-a5f1c4c12cc7/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-08-08T19:25:00Z UTC
Last seen:
2026-08-08T20:47:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/344f930a6ecd8ca55f4912998c3c64f2149f9cae88ab7b8a080e78ae81f29ba6/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/5baad2bb-16d2-4b28-9939-3e9dc9d061ba
Behavior Graph:
Download SVG
%3 guuid=05e237b5-1600-0000-7022-75c62c0c0000 pid=3116 /usr/bin/sudo guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117 /tmp/sample.bin write-file guuid=05e237b5-1600-0000-7022-75c62c0c0000 pid=3116->guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117 execve guuid=40b83eb7-1600-0000-7022-75c62e0c0000 pid=3118 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=40b83eb7-1600-0000-7022-75c62e0c0000 pid=3118 execve guuid=fb70a1b7-1600-0000-7022-75c62f0c0000 pid=3119 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=fb70a1b7-1600-0000-7022-75c62f0c0000 pid=3119 execve guuid=c5e8f9b7-1600-0000-7022-75c6300c0000 pid=3120 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=c5e8f9b7-1600-0000-7022-75c6300c0000 pid=3120 execve guuid=a98250b8-1600-0000-7022-75c6320c0000 pid=3122 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=a98250b8-1600-0000-7022-75c6320c0000 pid=3122 execve guuid=a597a0b8-1600-0000-7022-75c6330c0000 pid=3123 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=a597a0b8-1600-0000-7022-75c6330c0000 pid=3123 execve guuid=c502f3b8-1600-0000-7022-75c6350c0000 pid=3125 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=c502f3b8-1600-0000-7022-75c6350c0000 pid=3125 execve guuid=22a342b9-1600-0000-7022-75c6370c0000 pid=3127 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=22a342b9-1600-0000-7022-75c6370c0000 pid=3127 execve guuid=c94993b9-1600-0000-7022-75c6390c0000 pid=3129 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=c94993b9-1600-0000-7022-75c6390c0000 pid=3129 execve guuid=c879e3b9-1600-0000-7022-75c63a0c0000 pid=3130 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=c879e3b9-1600-0000-7022-75c63a0c0000 pid=3130 execve guuid=415d33ba-1600-0000-7022-75c63c0c0000 pid=3132 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=415d33ba-1600-0000-7022-75c63c0c0000 pid=3132 execve guuid=b53b83ba-1600-0000-7022-75c63e0c0000 pid=3134 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=b53b83ba-1600-0000-7022-75c63e0c0000 pid=3134 execve guuid=e208d3ba-1600-0000-7022-75c63f0c0000 pid=3135 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=e208d3ba-1600-0000-7022-75c63f0c0000 pid=3135 execve guuid=27e626bb-1600-0000-7022-75c6410c0000 pid=3137 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=27e626bb-1600-0000-7022-75c6410c0000 pid=3137 execve guuid=27ff76bb-1600-0000-7022-75c6420c0000 pid=3138 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=27ff76bb-1600-0000-7022-75c6420c0000 pid=3138 execve guuid=04d5c5bb-1600-0000-7022-75c6430c0000 pid=3139 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=04d5c5bb-1600-0000-7022-75c6430c0000 pid=3139 execve guuid=11eb1fbc-1600-0000-7022-75c6450c0000 pid=3141 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=11eb1fbc-1600-0000-7022-75c6450c0000 pid=3141 execve guuid=6ddb70bc-1600-0000-7022-75c6460c0000 pid=3142 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=6ddb70bc-1600-0000-7022-75c6460c0000 pid=3142 execve guuid=1b9ec0bc-1600-0000-7022-75c6480c0000 pid=3144 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=1b9ec0bc-1600-0000-7022-75c6480c0000 pid=3144 execve guuid=692513bd-1600-0000-7022-75c64a0c0000 pid=3146 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=692513bd-1600-0000-7022-75c64a0c0000 pid=3146 execve guuid=24e06cbd-1600-0000-7022-75c64b0c0000 pid=3147 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=24e06cbd-1600-0000-7022-75c64b0c0000 pid=3147 execve guuid=0615c1bd-1600-0000-7022-75c64d0c0000 pid=3149 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=0615c1bd-1600-0000-7022-75c64d0c0000 pid=3149 execve guuid=166512be-1600-0000-7022-75c64f0c0000 pid=3151 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=166512be-1600-0000-7022-75c64f0c0000 pid=3151 execve guuid=8bd8c0be-1600-0000-7022-75c6510c0000 pid=3153 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=8bd8c0be-1600-0000-7022-75c6510c0000 pid=3153 execve guuid=abce22bf-1600-0000-7022-75c6520c0000 pid=3154 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=abce22bf-1600-0000-7022-75c6520c0000 pid=3154 execve guuid=043f90bf-1600-0000-7022-75c6530c0000 pid=3155 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=043f90bf-1600-0000-7022-75c6530c0000 pid=3155 execve guuid=306f47c0-1600-0000-7022-75c6540c0000 pid=3156 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=306f47c0-1600-0000-7022-75c6540c0000 pid=3156 execve guuid=2cc200c1-1600-0000-7022-75c6560c0000 pid=3158 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=2cc200c1-1600-0000-7022-75c6560c0000 pid=3158 execve guuid=ddd95cc1-1600-0000-7022-75c6570c0000 pid=3159 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=ddd95cc1-1600-0000-7022-75c6570c0000 pid=3159 execve guuid=7ab8b8c1-1600-0000-7022-75c6590c0000 pid=3161 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=7ab8b8c1-1600-0000-7022-75c6590c0000 pid=3161 execve guuid=57fd1ec2-1600-0000-7022-75c65c0c0000 pid=3164 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=57fd1ec2-1600-0000-7022-75c65c0c0000 pid=3164 execve guuid=5adf82c2-1600-0000-7022-75c65e0c0000 pid=3166 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=5adf82c2-1600-0000-7022-75c65e0c0000 pid=3166 execve guuid=d8a1d8c2-1600-0000-7022-75c6610c0000 pid=3169 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=d8a1d8c2-1600-0000-7022-75c6610c0000 pid=3169 execve guuid=689830c3-1600-0000-7022-75c6620c0000 pid=3170 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=689830c3-1600-0000-7022-75c6620c0000 pid=3170 execve guuid=a194aec3-1600-0000-7022-75c6630c0000 pid=3171 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=a194aec3-1600-0000-7022-75c6630c0000 pid=3171 execve guuid=b77b2bc4-1600-0000-7022-75c6640c0000 pid=3172 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=b77b2bc4-1600-0000-7022-75c6640c0000 pid=3172 execve guuid=ec2bbbc4-1600-0000-7022-75c6650c0000 pid=3173 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=ec2bbbc4-1600-0000-7022-75c6650c0000 pid=3173 execve guuid=b71036c5-1600-0000-7022-75c6660c0000 pid=3174 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=b71036c5-1600-0000-7022-75c6660c0000 pid=3174 execve guuid=5cfbbbc5-1600-0000-7022-75c6670c0000 pid=3175 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=5cfbbbc5-1600-0000-7022-75c6670c0000 pid=3175 execve guuid=55183ac6-1600-0000-7022-75c6680c0000 pid=3176 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=55183ac6-1600-0000-7022-75c6680c0000 pid=3176 execve guuid=d53ac4c6-1600-0000-7022-75c6690c0000 pid=3177 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=d53ac4c6-1600-0000-7022-75c6690c0000 pid=3177 execve guuid=9d7e3bc7-1600-0000-7022-75c66a0c0000 pid=3178 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=9d7e3bc7-1600-0000-7022-75c66a0c0000 pid=3178 execve guuid=1d08adc7-1600-0000-7022-75c66b0c0000 pid=3179 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=1d08adc7-1600-0000-7022-75c66b0c0000 pid=3179 execve guuid=ee3c17c8-1600-0000-7022-75c66d0c0000 pid=3181 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=ee3c17c8-1600-0000-7022-75c66d0c0000 pid=3181 execve guuid=7b8773c8-1600-0000-7022-75c66e0c0000 pid=3182 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=7b8773c8-1600-0000-7022-75c66e0c0000 pid=3182 execve guuid=7448e8c8-1600-0000-7022-75c66f0c0000 pid=3183 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=7448e8c8-1600-0000-7022-75c66f0c0000 pid=3183 execve guuid=a03f4bc9-1600-0000-7022-75c6700c0000 pid=3184 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=a03f4bc9-1600-0000-7022-75c6700c0000 pid=3184 execve guuid=fc7eafc9-1600-0000-7022-75c6710c0000 pid=3185 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=fc7eafc9-1600-0000-7022-75c6710c0000 pid=3185 execve guuid=9b4cfec9-1600-0000-7022-75c6730c0000 pid=3187 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=9b4cfec9-1600-0000-7022-75c6730c0000 pid=3187 execve guuid=a74a50ca-1600-0000-7022-75c6760c0000 pid=3190 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=a74a50ca-1600-0000-7022-75c6760c0000 pid=3190 execve guuid=037994ca-1600-0000-7022-75c6780c0000 pid=3192 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=037994ca-1600-0000-7022-75c6780c0000 pid=3192 execve guuid=cc0fe5ca-1600-0000-7022-75c67a0c0000 pid=3194 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=cc0fe5ca-1600-0000-7022-75c67a0c0000 pid=3194 execve guuid=d1eb34cb-1600-0000-7022-75c67c0c0000 pid=3196 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=d1eb34cb-1600-0000-7022-75c67c0c0000 pid=3196 execve guuid=f86683cb-1600-0000-7022-75c67e0c0000 pid=3198 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=f86683cb-1600-0000-7022-75c67e0c0000 pid=3198 execve guuid=e5c3d5cb-1600-0000-7022-75c6800c0000 pid=3200 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=e5c3d5cb-1600-0000-7022-75c6800c0000 pid=3200 execve guuid=560a25cc-1600-0000-7022-75c6830c0000 pid=3203 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=560a25cc-1600-0000-7022-75c6830c0000 pid=3203 execve guuid=a69174cc-1600-0000-7022-75c6850c0000 pid=3205 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=a69174cc-1600-0000-7022-75c6850c0000 pid=3205 execve guuid=6729c8cc-1600-0000-7022-75c6870c0000 pid=3207 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=6729c8cc-1600-0000-7022-75c6870c0000 pid=3207 execve guuid=61a917cd-1600-0000-7022-75c6890c0000 pid=3209 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=61a917cd-1600-0000-7022-75c6890c0000 pid=3209 execve guuid=87d268cd-1600-0000-7022-75c68b0c0000 pid=3211 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=87d268cd-1600-0000-7022-75c68b0c0000 pid=3211 execve guuid=0d43bccd-1600-0000-7022-75c68d0c0000 pid=3213 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=0d43bccd-1600-0000-7022-75c68d0c0000 pid=3213 execve guuid=6d860ece-1600-0000-7022-75c6900c0000 pid=3216 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=6d860ece-1600-0000-7022-75c6900c0000 pid=3216 execve guuid=2fa55dce-1600-0000-7022-75c6920c0000 pid=3218 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=2fa55dce-1600-0000-7022-75c6920c0000 pid=3218 execve guuid=3b8db3ce-1600-0000-7022-75c6940c0000 pid=3220 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=3b8db3ce-1600-0000-7022-75c6940c0000 pid=3220 execve guuid=886e07cf-1600-0000-7022-75c6950c0000 pid=3221 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=886e07cf-1600-0000-7022-75c6950c0000 pid=3221 execve guuid=6b1468cf-1600-0000-7022-75c6960c0000 pid=3222 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=6b1468cf-1600-0000-7022-75c6960c0000 pid=3222 execve guuid=7f8cc0cf-1600-0000-7022-75c6980c0000 pid=3224 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=7f8cc0cf-1600-0000-7022-75c6980c0000 pid=3224 execve guuid=067713d0-1600-0000-7022-75c69a0c0000 pid=3226 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=067713d0-1600-0000-7022-75c69a0c0000 pid=3226 execve guuid=7b5962d0-1600-0000-7022-75c69c0c0000 pid=3228 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=7b5962d0-1600-0000-7022-75c69c0c0000 pid=3228 execve guuid=2ec6b1d0-1600-0000-7022-75c69e0c0000 pid=3230 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=2ec6b1d0-1600-0000-7022-75c69e0c0000 pid=3230 execve guuid=06b703d1-1600-0000-7022-75c6a00c0000 pid=3232 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=06b703d1-1600-0000-7022-75c6a00c0000 pid=3232 execve guuid=135457d1-1600-0000-7022-75c6a20c0000 pid=3234 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=135457d1-1600-0000-7022-75c6a20c0000 pid=3234 execve guuid=6fdca5d1-1600-0000-7022-75c6a50c0000 pid=3237 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=6fdca5d1-1600-0000-7022-75c6a50c0000 pid=3237 execve guuid=c096f4d1-1600-0000-7022-75c6a70c0000 pid=3239 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=c096f4d1-1600-0000-7022-75c6a70c0000 pid=3239 execve guuid=693447d2-1600-0000-7022-75c6a90c0000 pid=3241 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=693447d2-1600-0000-7022-75c6a90c0000 pid=3241 execve guuid=39fb95d2-1600-0000-7022-75c6ab0c0000 pid=3243 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=39fb95d2-1600-0000-7022-75c6ab0c0000 pid=3243 execve guuid=7bb804d3-1600-0000-7022-75c6ae0c0000 pid=3246 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=7bb804d3-1600-0000-7022-75c6ae0c0000 pid=3246 execve guuid=7e2194d3-1600-0000-7022-75c6b10c0000 pid=3249 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=7e2194d3-1600-0000-7022-75c6b10c0000 pid=3249 execve guuid=968225d4-1600-0000-7022-75c6b50c0000 pid=3253 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=968225d4-1600-0000-7022-75c6b50c0000 pid=3253 execve guuid=e4d6b1d4-1600-0000-7022-75c6b60c0000 pid=3254 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=e4d6b1d4-1600-0000-7022-75c6b60c0000 pid=3254 execve guuid=fe260ed5-1600-0000-7022-75c6b80c0000 pid=3256 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=fe260ed5-1600-0000-7022-75c6b80c0000 pid=3256 execve guuid=b83d80d5-1600-0000-7022-75c6b90c0000 pid=3257 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=b83d80d5-1600-0000-7022-75c6b90c0000 pid=3257 execve guuid=cde6f0d5-1600-0000-7022-75c6bc0c0000 pid=3260 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=cde6f0d5-1600-0000-7022-75c6bc0c0000 pid=3260 execve guuid=dd665cd6-1600-0000-7022-75c6be0c0000 pid=3262 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=dd665cd6-1600-0000-7022-75c6be0c0000 pid=3262 execve guuid=b754b8d6-1600-0000-7022-75c6c10c0000 pid=3265 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=b754b8d6-1600-0000-7022-75c6c10c0000 pid=3265 execve guuid=9de515d7-1600-0000-7022-75c6c30c0000 pid=3267 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=9de515d7-1600-0000-7022-75c6c30c0000 pid=3267 execve guuid=91407ad7-1600-0000-7022-75c6c50c0000 pid=3269 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=91407ad7-1600-0000-7022-75c6c50c0000 pid=3269 execve guuid=9bc5ecd7-1600-0000-7022-75c6c60c0000 pid=3270 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=9bc5ecd7-1600-0000-7022-75c6c60c0000 pid=3270 execve guuid=836860d8-1600-0000-7022-75c6c70c0000 pid=3271 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=836860d8-1600-0000-7022-75c6c70c0000 pid=3271 execve guuid=2951c1d8-1600-0000-7022-75c6ca0c0000 pid=3274 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=2951c1d8-1600-0000-7022-75c6ca0c0000 pid=3274 execve guuid=a36230d9-1600-0000-7022-75c6cc0c0000 pid=3276 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=a36230d9-1600-0000-7022-75c6cc0c0000 pid=3276 execve guuid=1cd399d9-1600-0000-7022-75c6cf0c0000 pid=3279 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=1cd399d9-1600-0000-7022-75c6cf0c0000 pid=3279 execve guuid=9a0901da-1600-0000-7022-75c6d10c0000 pid=3281 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=9a0901da-1600-0000-7022-75c6d10c0000 pid=3281 execve guuid=a9dc65da-1600-0000-7022-75c6d40c0000 pid=3284 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=a9dc65da-1600-0000-7022-75c6d40c0000 pid=3284 execve guuid=c46cceda-1600-0000-7022-75c6d60c0000 pid=3286 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=c46cceda-1600-0000-7022-75c6d60c0000 pid=3286 execve guuid=dd0a3adb-1600-0000-7022-75c6d90c0000 pid=3289 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=dd0a3adb-1600-0000-7022-75c6d90c0000 pid=3289 execve guuid=793cafdb-1600-0000-7022-75c6db0c0000 pid=3291 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=793cafdb-1600-0000-7022-75c6db0c0000 pid=3291 execve guuid=d44f14dc-1600-0000-7022-75c6dd0c0000 pid=3293 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=d44f14dc-1600-0000-7022-75c6dd0c0000 pid=3293 execve guuid=0bc37adc-1600-0000-7022-75c6df0c0000 pid=3295 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=0bc37adc-1600-0000-7022-75c6df0c0000 pid=3295 execve guuid=82b70fdd-1600-0000-7022-75c6e10c0000 pid=3297 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=82b70fdd-1600-0000-7022-75c6e10c0000 pid=3297 execve guuid=06c1a6dd-1600-0000-7022-75c6e40c0000 pid=3300 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=06c1a6dd-1600-0000-7022-75c6e40c0000 pid=3300 execve guuid=cb0742de-1600-0000-7022-75c6e60c0000 pid=3302 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=cb0742de-1600-0000-7022-75c6e60c0000 pid=3302 execve guuid=ae7ed8de-1600-0000-7022-75c6e80c0000 pid=3304 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=ae7ed8de-1600-0000-7022-75c6e80c0000 pid=3304 execve guuid=0eb03fdf-1600-0000-7022-75c6e90c0000 pid=3305 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=0eb03fdf-1600-0000-7022-75c6e90c0000 pid=3305 execve guuid=862ac0df-1600-0000-7022-75c6ea0c0000 pid=3306 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=862ac0df-1600-0000-7022-75c6ea0c0000 pid=3306 execve guuid=ac083fe0-1600-0000-7022-75c6ec0c0000 pid=3308 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=ac083fe0-1600-0000-7022-75c6ec0c0000 pid=3308 execve guuid=b4a5b1e0-1600-0000-7022-75c6ef0c0000 pid=3311 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=b4a5b1e0-1600-0000-7022-75c6ef0c0000 pid=3311 execve guuid=345218e1-1600-0000-7022-75c6f10c0000 pid=3313 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=345218e1-1600-0000-7022-75c6f10c0000 pid=3313 execve guuid=cdf483e1-1600-0000-7022-75c6f40c0000 pid=3316 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=cdf483e1-1600-0000-7022-75c6f40c0000 pid=3316 execve guuid=5ecf00e2-1600-0000-7022-75c6f50c0000 pid=3317 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=5ecf00e2-1600-0000-7022-75c6f50c0000 pid=3317 execve guuid=b56c9fe2-1600-0000-7022-75c6f60c0000 pid=3318 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=b56c9fe2-1600-0000-7022-75c6f60c0000 pid=3318 execve guuid=5b7d3ee3-1600-0000-7022-75c6f70c0000 pid=3319 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=5b7d3ee3-1600-0000-7022-75c6f70c0000 pid=3319 execve guuid=e1cfe9e3-1600-0000-7022-75c6f80c0000 pid=3320 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=e1cfe9e3-1600-0000-7022-75c6f80c0000 pid=3320 execve guuid=80cb87e4-1600-0000-7022-75c6f90c0000 pid=3321 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=80cb87e4-1600-0000-7022-75c6f90c0000 pid=3321 execve guuid=50ae20e5-1600-0000-7022-75c6fa0c0000 pid=3322 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=50ae20e5-1600-0000-7022-75c6fa0c0000 pid=3322 execve guuid=6497bce5-1600-0000-7022-75c6fb0c0000 pid=3323 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=6497bce5-1600-0000-7022-75c6fb0c0000 pid=3323 execve guuid=118046e6-1600-0000-7022-75c6fc0c0000 pid=3324 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=118046e6-1600-0000-7022-75c6fc0c0000 pid=3324 execve guuid=a348d1e6-1600-0000-7022-75c6fd0c0000 pid=3325 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=a348d1e6-1600-0000-7022-75c6fd0c0000 pid=3325 execve guuid=3e3b5ce7-1600-0000-7022-75c6fe0c0000 pid=3326 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=3e3b5ce7-1600-0000-7022-75c6fe0c0000 pid=3326 execve guuid=c17be4e7-1600-0000-7022-75c6ff0c0000 pid=3327 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=c17be4e7-1600-0000-7022-75c6ff0c0000 pid=3327 execve guuid=3ebf79e8-1600-0000-7022-75c6000d0000 pid=3328 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=3ebf79e8-1600-0000-7022-75c6000d0000 pid=3328 execve guuid=17e7f3e8-1600-0000-7022-75c6010d0000 pid=3329 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=17e7f3e8-1600-0000-7022-75c6010d0000 pid=3329 execve guuid=8fab64e9-1600-0000-7022-75c6020d0000 pid=3330 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=8fab64e9-1600-0000-7022-75c6020d0000 pid=3330 execve guuid=f1e6d5e9-1600-0000-7022-75c6030d0000 pid=3331 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=f1e6d5e9-1600-0000-7022-75c6030d0000 pid=3331 execve guuid=c34f70ea-1600-0000-7022-75c6040d0000 pid=3332 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=c34f70ea-1600-0000-7022-75c6040d0000 pid=3332 execve guuid=18e7e4ea-1600-0000-7022-75c6060d0000 pid=3334 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=18e7e4ea-1600-0000-7022-75c6060d0000 pid=3334 execve guuid=604858eb-1600-0000-7022-75c6070d0000 pid=3335 /usr/bin/ls guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=604858eb-1600-0000-7022-75c6070d0000 pid=3335 execve guuid=183dc5eb-1600-0000-7022-75c6090d0000 pid=3337 /usr/bin/rm guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=183dc5eb-1600-0000-7022-75c6090d0000 pid=3337 execve guuid=82bd01ec-1600-0000-7022-75c60b0d0000 pid=3339 /usr/bin/wget net send-data write-file guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=82bd01ec-1600-0000-7022-75c60b0d0000 pid=3339 execve guuid=11e5d004-1700-0000-7022-75c6440d0000 pid=3396 /usr/bin/chmod guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=11e5d004-1700-0000-7022-75c6440d0000 pid=3396 execve guuid=bb960405-1700-0000-7022-75c6450d0000 pid=3397 /usr/bin/dash guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=bb960405-1700-0000-7022-75c6450d0000 pid=3397 clone guuid=70b28d05-1700-0000-7022-75c64a0d0000 pid=3402 /usr/bin/rm guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=70b28d05-1700-0000-7022-75c64a0d0000 pid=3402 execve guuid=87ede105-1700-0000-7022-75c64b0d0000 pid=3403 /usr/bin/wget net send-data write-file guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=87ede105-1700-0000-7022-75c64b0d0000 pid=3403 execve guuid=53df9a1e-1700-0000-7022-75c6920d0000 pid=3474 /usr/bin/chmod guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=53df9a1e-1700-0000-7022-75c6920d0000 pid=3474 execve guuid=d5b8e71e-1700-0000-7022-75c6940d0000 pid=3476 /usr/bin/dash guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=d5b8e71e-1700-0000-7022-75c6940d0000 pid=3476 clone guuid=f367a41f-1700-0000-7022-75c6980d0000 pid=3480 /usr/bin/rm guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=f367a41f-1700-0000-7022-75c6980d0000 pid=3480 execve guuid=e98af41f-1700-0000-7022-75c69a0d0000 pid=3482 /usr/bin/wget net send-data write-file guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=e98af41f-1700-0000-7022-75c69a0d0000 pid=3482 execve guuid=eb5cf839-1700-0000-7022-75c6cf0d0000 pid=3535 /usr/bin/chmod guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=eb5cf839-1700-0000-7022-75c6cf0d0000 pid=3535 execve guuid=eefd5e3a-1700-0000-7022-75c6d20d0000 pid=3538 /usr/bin/dash guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=eefd5e3a-1700-0000-7022-75c6d20d0000 pid=3538 clone guuid=62ba343b-1700-0000-7022-75c6d80d0000 pid=3544 /usr/bin/rm guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=62ba343b-1700-0000-7022-75c6d80d0000 pid=3544 execve guuid=2d348c3b-1700-0000-7022-75c6da0d0000 pid=3546 /usr/bin/wget net send-data write-file guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=2d348c3b-1700-0000-7022-75c6da0d0000 pid=3546 execve guuid=3042285a-1700-0000-7022-75c62f0e0000 pid=3631 /usr/bin/chmod guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=3042285a-1700-0000-7022-75c62f0e0000 pid=3631 execve guuid=88ae855a-1700-0000-7022-75c6310e0000 pid=3633 /usr/bin/dash guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=88ae855a-1700-0000-7022-75c6310e0000 pid=3633 clone guuid=ef3b4c5b-1700-0000-7022-75c6340e0000 pid=3636 /usr/bin/rm guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=ef3b4c5b-1700-0000-7022-75c6340e0000 pid=3636 execve guuid=abbc935b-1700-0000-7022-75c6360e0000 pid=3638 /usr/bin/wget net send-data write-file guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=abbc935b-1700-0000-7022-75c6360e0000 pid=3638 execve guuid=69e75279-1700-0000-7022-75c69a0e0000 pid=3738 /usr/bin/chmod guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=69e75279-1700-0000-7022-75c69a0e0000 pid=3738 execve guuid=ea8e9279-1700-0000-7022-75c69c0e0000 pid=3740 /usr/bin/dash guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=ea8e9279-1700-0000-7022-75c69c0e0000 pid=3740 clone guuid=9342437a-1700-0000-7022-75c6a00e0000 pid=3744 /usr/bin/rm delete-file guuid=a0b00ab7-1600-0000-7022-75c62d0c0000 pid=3117->guuid=9342437a-1700-0000-7022-75c6a00e0000 pid=3744 execve 801186e6-5fe8-5959-a7b4-832d8d66e7aa 129.121.114.124:80 guuid=82bd01ec-1600-0000-7022-75c60b0d0000 pid=3339->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 134B guuid=87ede105-1700-0000-7022-75c64b0d0000 pid=3403->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 134B guuid=e98af41f-1700-0000-7022-75c69a0d0000 pid=3482->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 133B guuid=2d348c3b-1700-0000-7022-75c6da0d0000 pid=3546->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 133B guuid=abbc935b-1700-0000-7022-75c6360e0000 pid=3638->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 134B
Score:
93%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/344f930a6ecd8ca55f4912998c3c64f2149f9cae88ab7b8a080e78ae81f29ba6
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/344f930a6ecd8ca55f4912998c3c64f2149f9cae88ab7b8a080e78ae81f29ba6/
Threat name:
Document-HTML.Trojan.Bash
Create hunting rule
Status:
Malicious
First seen:
2026-08-08 21:16:31 UTC
File Type:
Text (Shell)
AV detection:
11 of 23 (47.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=grhzgctozwgkkx2jckmyypde6ikj7hforcvxxcqibz4k5apstota._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
discovery linux
Link:
https://tria.ge/reports/260808-z4lmvavdkg/
Behaviour
Reads runtime system information
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.26
Link:
https://yomi.yoroi.company/submissions/344f930a6ecd8ca55f4912998c3c64f2149f9cae88ab7b8a080e78ae81f29ba6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 344f930a6ecd8ca55f4912998c3c64f2149f9cae88ab7b8a080e78ae81f29ba6

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3866369/
  
Delivery method
Distributed via web download

Comments