MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3a683ee3937d7fb4e8a8dca9ba51ce6976b406149bed9c95d9e7400efcd48194. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3a683ee3937d7fb4e8a8dca9ba51ce6976b406149bed9c95d9e7400efcd48194
SHA3-384 hash: 83d1115e34397eb8fb465b2a9ae0612728156da2e8b790c96c9c1bfe093aff24440f1166e01be74ac4774dddd41bbbaf
SHA1 hash: 98bd5dc98bcca1b335e197b10ac89f457f5eb443
MD5 hash: c309fab927c3898f80a7f2a01c730956
humanhash: oxygen-lima-pip-fourteen
File name:ok
Download: download sample
File size:1'608 bytes
First seen:2026-06-10 06:32:47 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 12:5V+IrV+EFovJrrP85vptpIrpr7EkBraZN9/grbN9U2rGirrGKBIsrFGaZQrZ1h2/:Zoh85vlKfEf7nKGWQhV4tNW7wHvnAnW
TLSH T1EE31D4DB1F1A368C4901EE6973A12588D054EADE226FD7B0FF480D7BD2C84487249B1E
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://45.205.1.59/43c3ean/an/aelf ua-wget
http://45.205.1.59/64b82en/an/aelf ua-wget
http://45.205.1.59/120aaan/an/aelf ua-wget
http://45.205.1.59/c235ecn/an/aelf ua-wget
http://45.205.1.59/c9d703n/an/aelf ua-wget
http://45.205.1.59/ef53acn/an/aelf ua-wget
http://45.205.1.59/d65f43n/an/aelf ua-wget
http://45.205.1.59/87516en/an/aelf ua-wget
http://45.205.1.59/05dcabn/an/aelf ua-wget
http://45.205.1.59/cb5811n/an/aelf ua-wget
http://45.205.1.59/6cdc8fn/an/aelf ua-wget
http://45.205.1.59/0fb7ebn/an/aelf ua-wget

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive
Link:
https://www.filescan.io/uploads/6a29054d554e843ff866d9a6/reports/3e032dcb-e5cd-46d0-8932-eaf847c5f673/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-06-10T03:51:00Z UTC
Last seen:
2026-06-10T04:03:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan-Downloader.Shell.Agent.a
Link:
https://opentip.kaspersky.com/3a683ee3937d7fb4e8a8dca9ba51ce6976b406149bed9c95d9e7400efcd48194/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/78573017-808d-4975-bcde-523baaf1e9d4
Behavior Graph:
Download SVG
%3 guuid=bacc8b1c-1700-0000-efb2-8240780e0000 pid=3704 /usr/bin/sudo guuid=27a21c1e-1700-0000-efb2-8240820e0000 pid=3714 /tmp/sample.bin guuid=bacc8b1c-1700-0000-efb2-8240780e0000 pid=3704->guuid=27a21c1e-1700-0000-efb2-8240820e0000 pid=3714 execve guuid=721f781e-1700-0000-efb2-8240860e0000 pid=3718 /usr/bin/wget net send-data guuid=27a21c1e-1700-0000-efb2-8240820e0000 pid=3714->guuid=721f781e-1700-0000-efb2-8240860e0000 pid=3718 execve guuid=ef935438-1700-0000-efb2-8240ca0e0000 pid=3786 /usr/bin/curl net send-data write-file guuid=27a21c1e-1700-0000-efb2-8240820e0000 pid=3714->guuid=ef935438-1700-0000-efb2-8240ca0e0000 pid=3786 execve guuid=3725e754-1700-0000-efb2-8240150f0000 pid=3861 /usr/bin/chmod guuid=27a21c1e-1700-0000-efb2-8240820e0000 pid=3714->guuid=3725e754-1700-0000-efb2-8240150f0000 pid=3861 execve guuid=19f96255-1700-0000-efb2-8240170f0000 pid=3863 /usr/bin/bash guuid=27a21c1e-1700-0000-efb2-8240820e0000 pid=3714->guuid=19f96255-1700-0000-efb2-8240170f0000 pid=3863 clone guuid=da6cd855-1700-0000-efb2-82401a0f0000 pid=3866 /usr/bin/rm delete-file guuid=27a21c1e-1700-0000-efb2-8240820e0000 pid=3714->guuid=da6cd855-1700-0000-efb2-82401a0f0000 pid=3866 execve guuid=7d6f4956-1700-0000-efb2-82401b0f0000 pid=3867 /usr/bin/rm guuid=27a21c1e-1700-0000-efb2-8240820e0000 pid=3714->guuid=7d6f4956-1700-0000-efb2-82401b0f0000 pid=3867 execve guuid=e938be56-1700-0000-efb2-82401d0f0000 pid=3869 /usr/bin/wget net send-data guuid=27a21c1e-1700-0000-efb2-8240820e0000 pid=3714->guuid=e938be56-1700-0000-efb2-82401d0f0000 pid=3869 execve guuid=2aee9f71-1700-0000-efb2-82405c0f0000 pid=3932 /usr/bin/curl net send-data write-file guuid=27a21c1e-1700-0000-efb2-8240820e0000 pid=3714->guuid=2aee9f71-1700-0000-efb2-82405c0f0000 pid=3932 execve guuid=4d5ed18c-1700-0000-efb2-8240c70f0000 pid=4039 /usr/bin/chmod guuid=27a21c1e-1700-0000-efb2-8240820e0000 pid=3714->guuid=4d5ed18c-1700-0000-efb2-8240c70f0000 pid=4039 execve guuid=d5f9148d-1700-0000-efb2-8240c90f0000 pid=4041 /usr/bin/bash guuid=27a21c1e-1700-0000-efb2-8240820e0000 pid=3714->guuid=d5f9148d-1700-0000-efb2-8240c90f0000 pid=4041 clone guuid=2f404d8d-1700-0000-efb2-8240cb0f0000 pid=4043 /usr/bin/rm delete-file guuid=27a21c1e-1700-0000-efb2-8240820e0000 pid=3714->guuid=2f404d8d-1700-0000-efb2-8240cb0f0000 pid=4043 execve guuid=923bb68d-1700-0000-efb2-8240cd0f0000 pid=4045 /usr/bin/rm guuid=27a21c1e-1700-0000-efb2-8240820e0000 pid=3714->guuid=923bb68d-1700-0000-efb2-8240cd0f0000 pid=4045 execve guuid=b695f58d-1700-0000-efb2-8240cf0f0000 pid=4047 /usr/bin/wget net send-data guuid=27a21c1e-1700-0000-efb2-8240820e0000 pid=3714->guuid=b695f58d-1700-0000-efb2-8240cf0f0000 pid=4047 execve guuid=365fd2a7-1700-0000-efb2-824047100000 pid=4167 /usr/bin/curl net send-data write-file guuid=27a21c1e-1700-0000-efb2-8240820e0000 pid=3714->guuid=365fd2a7-1700-0000-efb2-824047100000 pid=4167 execve guuid=e6c688c3-1700-0000-efb2-824092100000 pid=4242 /usr/bin/chmod guuid=27a21c1e-1700-0000-efb2-8240820e0000 pid=3714->guuid=e6c688c3-1700-0000-efb2-824092100000 pid=4242 execve guuid=c03617c4-1700-0000-efb2-824094100000 pid=4244 /usr/bin/bash guuid=27a21c1e-1700-0000-efb2-8240820e0000 pid=3714->guuid=c03617c4-1700-0000-efb2-824094100000 pid=4244 clone guuid=3d5e0ac5-1700-0000-efb2-824098100000 pid=4248 /usr/bin/rm delete-file guuid=27a21c1e-1700-0000-efb2-8240820e0000 pid=3714->guuid=3d5e0ac5-1700-0000-efb2-824098100000 pid=4248 execve guuid=0b969ac5-1700-0000-efb2-82409b100000 pid=4251 /usr/bin/rm guuid=27a21c1e-1700-0000-efb2-8240820e0000 pid=3714->guuid=0b969ac5-1700-0000-efb2-82409b100000 pid=4251 execve guuid=2ea92ac6-1700-0000-efb2-82409f100000 pid=4255 /usr/bin/wget net send-data guuid=27a21c1e-1700-0000-efb2-8240820e0000 pid=3714->guuid=2ea92ac6-1700-0000-efb2-82409f100000 pid=4255 execve guuid=181297e0-1700-0000-efb2-8240de100000 pid=4318 /usr/bin/curl net send-data write-file guuid=27a21c1e-1700-0000-efb2-8240820e0000 pid=3714->guuid=181297e0-1700-0000-efb2-8240de100000 pid=4318 execve guuid=8b2ca3fd-1700-0000-efb2-824031110000 pid=4401 /usr/bin/chmod guuid=27a21c1e-1700-0000-efb2-8240820e0000 pid=3714->guuid=8b2ca3fd-1700-0000-efb2-824031110000 pid=4401 execve guuid=611630fe-1700-0000-efb2-824033110000 pid=4403 /usr/bin/bash guuid=27a21c1e-1700-0000-efb2-8240820e0000 pid=3714->guuid=611630fe-1700-0000-efb2-824033110000 pid=4403 clone guuid=211f7cfe-1700-0000-efb2-824036110000 pid=4406 /usr/bin/rm delete-file guuid=27a21c1e-1700-0000-efb2-8240820e0000 pid=3714->guuid=211f7cfe-1700-0000-efb2-824036110000 pid=4406 execve guuid=257207ff-1700-0000-efb2-824039110000 pid=4409 /usr/bin/rm guuid=27a21c1e-1700-0000-efb2-8240820e0000 pid=3714->guuid=257207ff-1700-0000-efb2-824039110000 pid=4409 execve guuid=15fb87ff-1700-0000-efb2-82403c110000 pid=4412 /usr/bin/wget net send-data guuid=27a21c1e-1700-0000-efb2-8240820e0000 pid=3714->guuid=15fb87ff-1700-0000-efb2-82403c110000 pid=4412 execve guuid=d431011a-1800-0000-efb2-8240a5110000 pid=4517 /usr/bin/curl net send-data write-file guuid=27a21c1e-1700-0000-efb2-8240820e0000 pid=3714->guuid=d431011a-1800-0000-efb2-8240a5110000 pid=4517 execve guuid=62ce8335-1800-0000-efb2-8240ef110000 pid=4591 /usr/bin/chmod guuid=27a21c1e-1700-0000-efb2-8240820e0000 pid=3714->guuid=62ce8335-1800-0000-efb2-8240ef110000 pid=4591 execve guuid=f2b5c335-1800-0000-efb2-8240f1110000 pid=4593 /usr/bin/bash guuid=27a21c1e-1700-0000-efb2-8240820e0000 pid=3714->guuid=f2b5c335-1800-0000-efb2-8240f1110000 pid=4593 clone guuid=7ab4f635-1800-0000-efb2-8240f5110000 pid=4597 /usr/bin/rm delete-file guuid=27a21c1e-1700-0000-efb2-8240820e0000 pid=3714->guuid=7ab4f635-1800-0000-efb2-8240f5110000 pid=4597 execve guuid=84625936-1800-0000-efb2-8240f9110000 pid=4601 /usr/bin/rm guuid=27a21c1e-1700-0000-efb2-8240820e0000 pid=3714->guuid=84625936-1800-0000-efb2-8240f9110000 pid=4601 execve guuid=8a7cc136-1800-0000-efb2-8240fb110000 pid=4603 /usr/bin/wget net send-data guuid=27a21c1e-1700-0000-efb2-8240820e0000 pid=3714->guuid=8a7cc136-1800-0000-efb2-8240fb110000 pid=4603 execve guuid=7df66151-1800-0000-efb2-824054120000 pid=4692 /usr/bin/curl net send-data write-file guuid=27a21c1e-1700-0000-efb2-8240820e0000 pid=3714->guuid=7df66151-1800-0000-efb2-824054120000 pid=4692 execve guuid=d546166d-1800-0000-efb2-82408b120000 pid=4747 /usr/bin/chmod guuid=27a21c1e-1700-0000-efb2-8240820e0000 pid=3714->guuid=d546166d-1800-0000-efb2-82408b120000 pid=4747 execve guuid=1ce1996d-1800-0000-efb2-82408d120000 pid=4749 /usr/bin/bash guuid=27a21c1e-1700-0000-efb2-8240820e0000 pid=3714->guuid=1ce1996d-1800-0000-efb2-82408d120000 pid=4749 clone guuid=4ff2396e-1800-0000-efb2-824090120000 pid=4752 /usr/bin/rm delete-file guuid=27a21c1e-1700-0000-efb2-8240820e0000 pid=3714->guuid=4ff2396e-1800-0000-efb2-824090120000 pid=4752 execve guuid=2fb2c66e-1800-0000-efb2-824094120000 pid=4756 /usr/bin/rm guuid=27a21c1e-1700-0000-efb2-8240820e0000 pid=3714->guuid=2fb2c66e-1800-0000-efb2-824094120000 pid=4756 execve guuid=b2184f6f-1800-0000-efb2-824098120000 pid=4760 /usr/bin/wget net send-data guuid=27a21c1e-1700-0000-efb2-8240820e0000 pid=3714->guuid=b2184f6f-1800-0000-efb2-824098120000 pid=4760 execve guuid=7f2d7189-1800-0000-efb2-8240d0120000 pid=4816 /usr/bin/curl net send-data write-file guuid=27a21c1e-1700-0000-efb2-8240820e0000 pid=3714->guuid=7f2d7189-1800-0000-efb2-8240d0120000 pid=4816 execve guuid=a758d9a6-1800-0000-efb2-82403d130000 pid=4925 /usr/bin/chmod guuid=27a21c1e-1700-0000-efb2-8240820e0000 pid=3714->guuid=a758d9a6-1800-0000-efb2-82403d130000 pid=4925 execve guuid=582e15a7-1800-0000-efb2-82403f130000 pid=4927 /usr/bin/bash guuid=27a21c1e-1700-0000-efb2-8240820e0000 pid=3714->guuid=582e15a7-1800-0000-efb2-82403f130000 pid=4927 clone guuid=11e049a7-1800-0000-efb2-824041130000 pid=4929 /usr/bin/rm delete-file guuid=27a21c1e-1700-0000-efb2-8240820e0000 pid=3714->guuid=11e049a7-1800-0000-efb2-824041130000 pid=4929 execve guuid=2e31b9a7-1800-0000-efb2-824043130000 pid=4931 /usr/bin/rm guuid=27a21c1e-1700-0000-efb2-8240820e0000 pid=3714->guuid=2e31b9a7-1800-0000-efb2-824043130000 pid=4931 execve guuid=eeb8fea7-1800-0000-efb2-824046130000 pid=4934 /usr/bin/wget net send-data guuid=27a21c1e-1700-0000-efb2-8240820e0000 pid=3714->guuid=eeb8fea7-1800-0000-efb2-824046130000 pid=4934 execve guuid=f0865bc2-1800-0000-efb2-824090130000 pid=5008 /usr/bin/curl net send-data write-file guuid=27a21c1e-1700-0000-efb2-8240820e0000 pid=3714->guuid=f0865bc2-1800-0000-efb2-824090130000 pid=5008 execve guuid=d4d636dd-1800-0000-efb2-8240e8130000 pid=5096 /usr/bin/chmod guuid=27a21c1e-1700-0000-efb2-8240820e0000 pid=3714->guuid=d4d636dd-1800-0000-efb2-8240e8130000 pid=5096 execve guuid=507e74dd-1800-0000-efb2-8240e9130000 pid=5097 /usr/bin/bash guuid=27a21c1e-1700-0000-efb2-8240820e0000 pid=3714->guuid=507e74dd-1800-0000-efb2-8240e9130000 pid=5097 clone guuid=db99badd-1800-0000-efb2-8240ee130000 pid=5102 /usr/bin/rm delete-file guuid=27a21c1e-1700-0000-efb2-8240820e0000 pid=3714->guuid=db99badd-1800-0000-efb2-8240ee130000 pid=5102 execve guuid=8b6014de-1800-0000-efb2-8240f2130000 pid=5106 /usr/bin/rm guuid=27a21c1e-1700-0000-efb2-8240820e0000 pid=3714->guuid=8b6014de-1800-0000-efb2-8240f2130000 pid=5106 execve guuid=d6b158de-1800-0000-efb2-8240f3130000 pid=5107 /usr/bin/wget net send-data guuid=27a21c1e-1700-0000-efb2-8240820e0000 pid=3714->guuid=d6b158de-1800-0000-efb2-8240f3130000 pid=5107 execve guuid=e3d7e9f7-1800-0000-efb2-824048140000 pid=5192 /usr/bin/curl net send-data write-file guuid=27a21c1e-1700-0000-efb2-8240820e0000 pid=3714->guuid=e3d7e9f7-1800-0000-efb2-824048140000 pid=5192 execve guuid=ec2bcf12-1900-0000-efb2-824097140000 pid=5271 /usr/bin/chmod guuid=27a21c1e-1700-0000-efb2-8240820e0000 pid=3714->guuid=ec2bcf12-1900-0000-efb2-824097140000 pid=5271 execve guuid=61f81b13-1900-0000-efb2-824098140000 pid=5272 /usr/bin/bash guuid=27a21c1e-1700-0000-efb2-8240820e0000 pid=3714->guuid=61f81b13-1900-0000-efb2-824098140000 pid=5272 clone guuid=1eb08113-1900-0000-efb2-82409a140000 pid=5274 /usr/bin/rm delete-file guuid=27a21c1e-1700-0000-efb2-8240820e0000 pid=3714->guuid=1eb08113-1900-0000-efb2-82409a140000 pid=5274 execve guuid=83a9ca13-1900-0000-efb2-82409b140000 pid=5275 /usr/bin/rm guuid=27a21c1e-1700-0000-efb2-8240820e0000 pid=3714->guuid=83a9ca13-1900-0000-efb2-82409b140000 pid=5275 execve guuid=980b1414-1900-0000-efb2-82409c140000 pid=5276 /usr/bin/wget net send-data guuid=27a21c1e-1700-0000-efb2-8240820e0000 pid=3714->guuid=980b1414-1900-0000-efb2-82409c140000 pid=5276 execve guuid=7eff872e-1900-0000-efb2-8240a2140000 pid=5282 /usr/bin/curl net send-data write-file guuid=27a21c1e-1700-0000-efb2-8240820e0000 pid=3714->guuid=7eff872e-1900-0000-efb2-8240a2140000 pid=5282 execve guuid=d500224b-1900-0000-efb2-8240a9140000 pid=5289 /usr/bin/chmod guuid=27a21c1e-1700-0000-efb2-8240820e0000 pid=3714->guuid=d500224b-1900-0000-efb2-8240a9140000 pid=5289 execve guuid=dc046d4b-1900-0000-efb2-8240aa140000 pid=5290 /usr/bin/bash guuid=27a21c1e-1700-0000-efb2-8240820e0000 pid=3714->guuid=dc046d4b-1900-0000-efb2-8240aa140000 pid=5290 clone guuid=5025b64b-1900-0000-efb2-8240ac140000 pid=5292 /usr/bin/rm delete-file guuid=27a21c1e-1700-0000-efb2-8240820e0000 pid=3714->guuid=5025b64b-1900-0000-efb2-8240ac140000 pid=5292 execve guuid=18a4054c-1900-0000-efb2-8240ad140000 pid=5293 /usr/bin/rm guuid=27a21c1e-1700-0000-efb2-8240820e0000 pid=3714->guuid=18a4054c-1900-0000-efb2-8240ad140000 pid=5293 execve guuid=51d4514c-1900-0000-efb2-8240ae140000 pid=5294 /usr/bin/wget net send-data guuid=27a21c1e-1700-0000-efb2-8240820e0000 pid=3714->guuid=51d4514c-1900-0000-efb2-8240ae140000 pid=5294 execve guuid=7e080166-1900-0000-efb2-8240af140000 pid=5295 /usr/bin/curl net send-data write-file guuid=27a21c1e-1700-0000-efb2-8240820e0000 pid=3714->guuid=7e080166-1900-0000-efb2-8240af140000 pid=5295 execve guuid=19d70981-1900-0000-efb2-8240b0140000 pid=5296 /usr/bin/chmod guuid=27a21c1e-1700-0000-efb2-8240820e0000 pid=3714->guuid=19d70981-1900-0000-efb2-8240b0140000 pid=5296 execve guuid=a466ba81-1900-0000-efb2-8240b1140000 pid=5297 /usr/bin/bash guuid=27a21c1e-1700-0000-efb2-8240820e0000 pid=3714->guuid=a466ba81-1900-0000-efb2-8240b1140000 pid=5297 clone guuid=7be26282-1900-0000-efb2-8240b3140000 pid=5299 /usr/bin/rm delete-file guuid=27a21c1e-1700-0000-efb2-8240820e0000 pid=3714->guuid=7be26282-1900-0000-efb2-8240b3140000 pid=5299 execve guuid=3ff51483-1900-0000-efb2-8240b4140000 pid=5300 /usr/bin/rm guuid=27a21c1e-1700-0000-efb2-8240820e0000 pid=3714->guuid=3ff51483-1900-0000-efb2-8240b4140000 pid=5300 execve guuid=897c8f83-1900-0000-efb2-8240b5140000 pid=5301 /usr/bin/wget net send-data guuid=27a21c1e-1700-0000-efb2-8240820e0000 pid=3714->guuid=897c8f83-1900-0000-efb2-8240b5140000 pid=5301 execve guuid=8c392c9d-1900-0000-efb2-8240b6140000 pid=5302 /usr/bin/curl net send-data write-file guuid=27a21c1e-1700-0000-efb2-8240820e0000 pid=3714->guuid=8c392c9d-1900-0000-efb2-8240b6140000 pid=5302 execve guuid=8d85e4b7-1900-0000-efb2-8240b7140000 pid=5303 /usr/bin/chmod guuid=27a21c1e-1700-0000-efb2-8240820e0000 pid=3714->guuid=8d85e4b7-1900-0000-efb2-8240b7140000 pid=5303 execve guuid=3c9c37b8-1900-0000-efb2-8240b8140000 pid=5304 /usr/bin/bash guuid=27a21c1e-1700-0000-efb2-8240820e0000 pid=3714->guuid=3c9c37b8-1900-0000-efb2-8240b8140000 pid=5304 clone guuid=3f1495b8-1900-0000-efb2-8240ba140000 pid=5306 /usr/bin/rm delete-file guuid=27a21c1e-1700-0000-efb2-8240820e0000 pid=3714->guuid=3f1495b8-1900-0000-efb2-8240ba140000 pid=5306 execve guuid=98a5e7b8-1900-0000-efb2-8240bb140000 pid=5307 /usr/bin/rm guuid=27a21c1e-1700-0000-efb2-8240820e0000 pid=3714->guuid=98a5e7b8-1900-0000-efb2-8240bb140000 pid=5307 execve c66e9db5-1465-5188-8e8d-233eabfef671 45.205.1.59:80 guuid=721f781e-1700-0000-efb2-8240860e0000 pid=3718->c66e9db5-1465-5188-8e8d-233eabfef671 send: 132B guuid=ef935438-1700-0000-efb2-8240ca0e0000 pid=3786->c66e9db5-1465-5188-8e8d-233eabfef671 send: 81B guuid=2fc38b55-1700-0000-efb2-8240180f0000 pid=3864 /usr/bin/bash guuid=19f96255-1700-0000-efb2-8240170f0000 pid=3863->guuid=2fc38b55-1700-0000-efb2-8240180f0000 pid=3864 clone guuid=e938be56-1700-0000-efb2-82401d0f0000 pid=3869->c66e9db5-1465-5188-8e8d-233eabfef671 send: 132B guuid=2aee9f71-1700-0000-efb2-82405c0f0000 pid=3932->c66e9db5-1465-5188-8e8d-233eabfef671 send: 81B guuid=46542b8d-1700-0000-efb2-8240ca0f0000 pid=4042 /usr/bin/bash guuid=d5f9148d-1700-0000-efb2-8240c90f0000 pid=4041->guuid=46542b8d-1700-0000-efb2-8240ca0f0000 pid=4042 clone guuid=b695f58d-1700-0000-efb2-8240cf0f0000 pid=4047->c66e9db5-1465-5188-8e8d-233eabfef671 send: 132B guuid=365fd2a7-1700-0000-efb2-824047100000 pid=4167->c66e9db5-1465-5188-8e8d-233eabfef671 send: 81B guuid=82fea6c4-1700-0000-efb2-824096100000 pid=4246 /usr/bin/bash guuid=c03617c4-1700-0000-efb2-824094100000 pid=4244->guuid=82fea6c4-1700-0000-efb2-824096100000 pid=4246 clone guuid=2ea92ac6-1700-0000-efb2-82409f100000 pid=4255->c66e9db5-1465-5188-8e8d-233eabfef671 send: 132B guuid=181297e0-1700-0000-efb2-8240de100000 pid=4318->c66e9db5-1465-5188-8e8d-233eabfef671 send: 81B guuid=a2f845fe-1700-0000-efb2-824034110000 pid=4404 /usr/bin/bash guuid=611630fe-1700-0000-efb2-824033110000 pid=4403->guuid=a2f845fe-1700-0000-efb2-824034110000 pid=4404 clone guuid=15fb87ff-1700-0000-efb2-82403c110000 pid=4412->c66e9db5-1465-5188-8e8d-233eabfef671 send: 132B guuid=d431011a-1800-0000-efb2-8240a5110000 pid=4517->c66e9db5-1465-5188-8e8d-233eabfef671 send: 81B guuid=2c85db35-1800-0000-efb2-8240f4110000 pid=4596 /usr/bin/bash guuid=f2b5c335-1800-0000-efb2-8240f1110000 pid=4593->guuid=2c85db35-1800-0000-efb2-8240f4110000 pid=4596 clone guuid=8a7cc136-1800-0000-efb2-8240fb110000 pid=4603->c66e9db5-1465-5188-8e8d-233eabfef671 send: 132B guuid=7df66151-1800-0000-efb2-824054120000 pid=4692->c66e9db5-1465-5188-8e8d-233eabfef671 send: 81B guuid=5876c96d-1800-0000-efb2-82408e120000 pid=4750 /usr/bin/bash guuid=1ce1996d-1800-0000-efb2-82408d120000 pid=4749->guuid=5876c96d-1800-0000-efb2-82408e120000 pid=4750 clone guuid=b2184f6f-1800-0000-efb2-824098120000 pid=4760->c66e9db5-1465-5188-8e8d-233eabfef671 send: 132B guuid=7f2d7189-1800-0000-efb2-8240d0120000 pid=4816->c66e9db5-1465-5188-8e8d-233eabfef671 send: 81B guuid=49112da7-1800-0000-efb2-824040130000 pid=4928 /usr/bin/bash guuid=582e15a7-1800-0000-efb2-82403f130000 pid=4927->guuid=49112da7-1800-0000-efb2-824040130000 pid=4928 clone guuid=eeb8fea7-1800-0000-efb2-824046130000 pid=4934->c66e9db5-1465-5188-8e8d-233eabfef671 send: 132B guuid=f0865bc2-1800-0000-efb2-824090130000 pid=5008->c66e9db5-1465-5188-8e8d-233eabfef671 send: 81B guuid=d8c098dd-1800-0000-efb2-8240ed130000 pid=5101 /usr/bin/bash guuid=507e74dd-1800-0000-efb2-8240e9130000 pid=5097->guuid=d8c098dd-1800-0000-efb2-8240ed130000 pid=5101 clone guuid=d6b158de-1800-0000-efb2-8240f3130000 pid=5107->c66e9db5-1465-5188-8e8d-233eabfef671 send: 132B guuid=e3d7e9f7-1800-0000-efb2-824048140000 pid=5192->c66e9db5-1465-5188-8e8d-233eabfef671 send: 81B guuid=d1cb3f13-1900-0000-efb2-824099140000 pid=5273 /usr/bin/bash guuid=61f81b13-1900-0000-efb2-824098140000 pid=5272->guuid=d1cb3f13-1900-0000-efb2-824099140000 pid=5273 clone guuid=980b1414-1900-0000-efb2-82409c140000 pid=5276->c66e9db5-1465-5188-8e8d-233eabfef671 send: 132B guuid=7eff872e-1900-0000-efb2-8240a2140000 pid=5282->c66e9db5-1465-5188-8e8d-233eabfef671 send: 81B guuid=e3d9874b-1900-0000-efb2-8240ab140000 pid=5291 /usr/bin/bash guuid=dc046d4b-1900-0000-efb2-8240aa140000 pid=5290->guuid=e3d9874b-1900-0000-efb2-8240ab140000 pid=5291 clone guuid=51d4514c-1900-0000-efb2-8240ae140000 pid=5294->c66e9db5-1465-5188-8e8d-233eabfef671 send: 132B guuid=7e080166-1900-0000-efb2-8240af140000 pid=5295->c66e9db5-1465-5188-8e8d-233eabfef671 send: 81B guuid=0788fc81-1900-0000-efb2-8240b2140000 pid=5298 /usr/bin/bash guuid=a466ba81-1900-0000-efb2-8240b1140000 pid=5297->guuid=0788fc81-1900-0000-efb2-8240b2140000 pid=5298 clone guuid=897c8f83-1900-0000-efb2-8240b5140000 pid=5301->c66e9db5-1465-5188-8e8d-233eabfef671 send: 132B guuid=8c392c9d-1900-0000-efb2-8240b6140000 pid=5302->c66e9db5-1465-5188-8e8d-233eabfef671 send: 81B guuid=cafb53b8-1900-0000-efb2-8240b9140000 pid=5305 /usr/bin/bash guuid=3c9c37b8-1900-0000-efb2-8240b8140000 pid=5304->guuid=cafb53b8-1900-0000-efb2-8240b9140000 pid=5305 clone
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/3a683ee3937d7fb4e8a8dca9ba51ce6976b406149bed9c95d9e7400efcd48194
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3a683ee3937d7fb4e8a8dca9ba51ce6976b406149bed9c95d9e7400efcd48194/
Threat name:
Script.Downloader.Malgent
Create hunting rule
Status:
Malicious
First seen:
2026-06-10 06:34:44 UTC
File Type:
Text (Shell)
AV detection:
11 of 24 (45.83%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hjud5y4tpv73j2fi3su3uuoonf3libqutpwzzfoz45aa57guqgka._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260610-hbmwrsfz3j/
Behaviour
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.34
Link:
https://yomi.yoroi.company/submissions/3a683ee3937d7fb4e8a8dca9ba51ce6976b406149bed9c95d9e7400efcd48194

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 3a683ee3937d7fb4e8a8dca9ba51ce6976b406149bed9c95d9e7400efcd48194

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3859834/
  
Delivery method
Distributed via web download

Comments