🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3b68e808496ac24bc48e284ec484dffb7bbcfd853ed7c060148139e5c1e75fb4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3b68e808496ac24bc48e284ec484dffb7bbcfd853ed7c060148139e5c1e75fb4
SHA3-384 hash: 508a2abdd7f68be72d3f078b9634bd0ff78431e920d3daea73b4ce3765b40886106ae49353ee3486af965cdb9c795963
SHA1 hash: a37f1ab6c5668ddb135e02e61ca7f79420b99cab
MD5 hash: 3c021a4cd748c20274d04935b1b50858
humanhash: bluebird-fix-winner-mars
File name:wget.sh
Download: download sample
File size:2'177 bytes
First seen:2026-10-12 21:44:34 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 48:dP/raH5pk6o27daw8drKuCl3b58rfzuBiu65LNtWgFa0W/Rv3Idng9OC:dPja004faKNtU0WpYd6
TLSH T126415C62786250B1704FC0FF5BA922D07547191F6120AD6ABCCFA4212F2B96C70F9765
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter adliwahid

Intelligence

File Origin
# of uploads :
1
# of downloads :
77
Origin country :
NL NL
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.DownLoader.2650.18301.20048.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
File Type:
unix shell
First seen:
2026-10-12T20:03:00Z UTC
Last seen:
2026-10-13T18:21:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/3b68e808496ac24bc48e284ec484dffb7bbcfd853ed7c060148139e5c1e75fb4/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/d206455c-9188-4ee0-adc7-f630aaf6c5dc
Behavior Graph:
Download SVG
%3 guuid=38374efd-1700-0000-25f8-b961c2090000 pid=2498 /usr/bin/sudo guuid=88e10eff-1700-0000-25f8-b961c8090000 pid=2504 /tmp/sample.bin guuid=38374efd-1700-0000-25f8-b961c2090000 pid=2498->guuid=88e10eff-1700-0000-25f8-b961c8090000 pid=2504 execve guuid=0fc545ff-1700-0000-25f8-b961c9090000 pid=2505 /usr/bin/dash guuid=88e10eff-1700-0000-25f8-b961c8090000 pid=2504->guuid=0fc545ff-1700-0000-25f8-b961c9090000 pid=2505 clone guuid=f953c7ff-1700-0000-25f8-b961cd090000 pid=2509 /usr/bin/rm guuid=88e10eff-1700-0000-25f8-b961c8090000 pid=2504->guuid=f953c7ff-1700-0000-25f8-b961cd090000 pid=2509 execve guuid=7c9f0600-1800-0000-25f8-b961cf090000 pid=2511 /usr/bin/wget net send-data write-file guuid=88e10eff-1700-0000-25f8-b961c8090000 pid=2504->guuid=7c9f0600-1800-0000-25f8-b961cf090000 pid=2511 execve guuid=cd100808-1800-0000-25f8-b961e4090000 pid=2532 /usr/bin/dash guuid=88e10eff-1700-0000-25f8-b961c8090000 pid=2504->guuid=cd100808-1800-0000-25f8-b961e4090000 pid=2532 clone guuid=9b18ac08-1800-0000-25f8-b961e9090000 pid=2537 /usr/bin/chmod guuid=88e10eff-1700-0000-25f8-b961c8090000 pid=2504->guuid=9b18ac08-1800-0000-25f8-b961e9090000 pid=2537 execve guuid=99de0009-1800-0000-25f8-b961eb090000 pid=2539 /tmp/akuma_x64 write-config write-file guuid=88e10eff-1700-0000-25f8-b961c8090000 pid=2504->guuid=99de0009-1800-0000-25f8-b961eb090000 pid=2539 execve guuid=31ab0609-1800-0000-25f8-b961ec090000 pid=2540 /usr/bin/sleep guuid=88e10eff-1700-0000-25f8-b961c8090000 pid=2504->guuid=31ab0609-1800-0000-25f8-b961ec090000 pid=2540 execve guuid=eada5bff-1700-0000-25f8-b961cb090000 pid=2507 /usr/bin/uname guuid=0fc545ff-1700-0000-25f8-b961c9090000 pid=2505->guuid=eada5bff-1700-0000-25f8-b961cb090000 pid=2507 execve a85ef90f-9fb7-5c78-acba-f41e12bad229 85.137.53.167:24380 guuid=7c9f0600-1800-0000-25f8-b961cf090000 pid=2511->a85ef90f-9fb7-5c78-acba-f41e12bad229 send: 155B guuid=14fe1608-1800-0000-25f8-b961e5090000 pid=2533 /usr/bin/wc guuid=cd100808-1800-0000-25f8-b961e4090000 pid=2532->guuid=14fe1608-1800-0000-25f8-b961e5090000 pid=2533 execve guuid=8c782008-1800-0000-25f8-b961e6090000 pid=2534 /usr/bin/tr guuid=cd100808-1800-0000-25f8-b961e4090000 pid=2532->guuid=8c782008-1800-0000-25f8-b961e6090000 pid=2534 execve guuid=b6f5190b-1800-0000-25f8-b961f1090000 pid=2545 /usr/bin/dash guuid=99de0009-1800-0000-25f8-b961eb090000 pid=2539->guuid=b6f5190b-1800-0000-25f8-b961f1090000 pid=2545 execve guuid=c64c6e0b-1800-0000-25f8-b961f3090000 pid=2547 /usr/bin/dash guuid=99de0009-1800-0000-25f8-b961eb090000 pid=2539->guuid=c64c6e0b-1800-0000-25f8-b961f3090000 pid=2547 execve guuid=c37f9556-1800-0000-25f8-b9618f0a0000 pid=2703 /usr/bin/dash guuid=99de0009-1800-0000-25f8-b961eb090000 pid=2539->guuid=c37f9556-1800-0000-25f8-b9618f0a0000 pid=2703 execve guuid=a0d3dd92-1800-0000-25f8-b9612f0b0000 pid=2863 /tmp/akuma_x64 write-file guuid=99de0009-1800-0000-25f8-b961eb090000 pid=2539->guuid=a0d3dd92-1800-0000-25f8-b9612f0b0000 pid=2863 clone guuid=1303e192-1800-0000-25f8-b961300b0000 pid=2864 /tmp/akuma_x64 net send-data write-file guuid=99de0009-1800-0000-25f8-b961eb090000 pid=2539->guuid=1303e192-1800-0000-25f8-b961300b0000 pid=2864 execve guuid=67ee9b0b-1800-0000-25f8-b961f4090000 pid=2548 /usr/bin/systemctl guuid=c64c6e0b-1800-0000-25f8-b961f3090000 pid=2547->guuid=67ee9b0b-1800-0000-25f8-b961f4090000 pid=2548 execve guuid=38ccc156-1800-0000-25f8-b961900a0000 pid=2704 /usr/bin/systemctl guuid=c37f9556-1800-0000-25f8-b9618f0a0000 pid=2703->guuid=38ccc156-1800-0000-25f8-b961900a0000 pid=2704 execve guuid=13d8f157-1800-0000-25f8-b961950a0000 pid=2709 /usr/lib/systemd/systemd-sysv-install guuid=38ccc156-1800-0000-25f8-b961900a0000 pid=2704->guuid=13d8f157-1800-0000-25f8-b961950a0000 pid=2709 execve guuid=1d5d7758-1800-0000-25f8-b961970a0000 pid=2711 /usr/bin/getopt guuid=13d8f157-1800-0000-25f8-b961950a0000 pid=2709->guuid=1d5d7758-1800-0000-25f8-b961970a0000 pid=2711 execve guuid=d2430659-1800-0000-25f8-b961990a0000 pid=2713 /usr/sbin/update-rc.d guuid=13d8f157-1800-0000-25f8-b961950a0000 pid=2709->guuid=d2430659-1800-0000-25f8-b961990a0000 pid=2713 execve guuid=05935991-1800-0000-25f8-b9612b0b0000 pid=2859 /usr/sbin/update-rc.d guuid=13d8f157-1800-0000-25f8-b961950a0000 pid=2709->guuid=05935991-1800-0000-25f8-b9612b0b0000 pid=2859 execve guuid=41a0b55c-1800-0000-25f8-b9619e0a0000 pid=2718 /usr/bin/systemctl guuid=d2430659-1800-0000-25f8-b961990a0000 pid=2713->guuid=41a0b55c-1800-0000-25f8-b9619e0a0000 pid=2718 execve guuid=12f7f292-1800-0000-25f8-b961310b0000 pid=2865 /tmp/akuma_x64 guuid=a0d3dd92-1800-0000-25f8-b9612f0b0000 pid=2863->guuid=12f7f292-1800-0000-25f8-b961310b0000 pid=2865 execve guuid=a17ff892-1800-0000-25f8-b961320b0000 pid=2866 /tmp/akuma_x64 guuid=a0d3dd92-1800-0000-25f8-b9612f0b0000 pid=2863->guuid=a17ff892-1800-0000-25f8-b961320b0000 pid=2866 execve b27da35a-4fe2-5445-ae73-595bd79fb534 85.137.53.167:25565 guuid=1303e192-1800-0000-25f8-b961300b0000 pid=2864->b27da35a-4fe2-5445-ae73-595bd79fb534 send: 29B
Score:
79%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/3b68e808496ac24bc48e284ec484dffb7bbcfd853ed7c060148139e5c1e75fb4
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3b68e808496ac24bc48e284ec484dffb7bbcfd853ed7c060148139e5c1e75fb4/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hnuoqccjnlbexreofbhmjbg77n53z7mfh3l4ayauqe46lqphl62a._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
credential_access defense_evasion discovery execution linux persistence privilege_escalation
Link:
https://tria.ge/reports/261012-1peresfw4w/
Behaviour
Command and Scripting Interpreter: Unix Shell
Enumerates kernel/hardware configuration
Reads runtime system information
System Network Configuration Discovery
Writes file to tmp directory
Changes its process name
Reads system network configuration
Reads process memory
Enumerates active TCP sockets
Enumerates running processes
Modifies init.d
Modifies systemd
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.11
Link:
https://yomi.yoroi.company/submissions/3b68e808496ac24bc48e284ec484dffb7bbcfd853ed7c060148139e5c1e75fb4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Akuma_Wget_Loader
Create hunting rule
Author:KSI Digital
Description:akuma kit loader script (wget.sh) that picks and runs an akuma_ bot from /bins/telnet/
Reference:https://github.com/ksi-digital/threat-research/tree/main/akuma-loader

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments