MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3bbbe5434a963c477170bbcddcee3fc49c11288f9e195affb37db4872d3ac62d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 2


Intelligence 2 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3bbbe5434a963c477170bbcddcee3fc49c11288f9e195affb37db4872d3ac62d
SHA3-384 hash: 71a60d2a10c5fb3742f04f15650548335fa253be293be00439e383b0884fe7dab03a4da65df1973ba6350d1a4e632303
SHA1 hash: 504d5c96602e476bec70ee3b978f5f1c4469ebc5
MD5 hash: fd252d596395ab4ad8dc4986e6534bf4
humanhash: maine-sad-arizona-alabama
File name:install_panel.sh
Download: download sample
File size:80'645 bytes
First seen:2026-07-29 13:48:36 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 1536:30KhgdpevVnosI9fsQyeSxXeil3hLh8xLdfhQH7hrt0sHzmBWptxM7vWB06putR4:kXdmVnosI9fsQyeSxXeil3hLh8xLdfh4
TLSH T1AC730896EF08D9F43C50C22D1B518E0DFA0E92D702157864B0DFB8A42B9CB73B97E616
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
https://www.bt.cn/api/wpanel/SetupCountn/an/an/a
https://api.bt.cn/api/isCNn/an/an/a
https://mirrors.aliyun.com/repo/Centos-vault-8.5.2111.repon/an/an/a
https://mirrors.aliyun.com/repo/epel-archive-8.repon/an/an/a
http://download.bt.cn/install/yumRepo_select.shn/an/an/a
https://www.bt.cn/api/index/get_timen/an/an/a
https://download.bt.cn/install/plugin/oneav/install.shn/an/an/a
https://www.bt.cn/Api/getIpAddressn/an/an/a
https://api.bt.cn/Api/getIpAddressn/an/an/a
https://www.aapanel.com/api/common/getClientIPn/an/an/a
https://www.bt.cn/Api/SetupCountn/an/an/a
https://www.bt.cn/Api/SetupCountPren/an/an/a
https://www.bt.cn/Api/installationCountn/an/an/a
https://www-node3.bt.cn/Api/installationCountn/an/an/a

Intelligence

File Origin
# of uploads :
1
# of downloads :
48
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Gathering data
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
bash lolbin opendir
Link:
https://www.filescan.io/uploads/6a6a04e8add34eca272cb479/reports/20f583ba-dd7b-4bb7-8cc7-aab4f1bf7edf/overview
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/08d4f347-7a5d-4ef1-ad6a-0813105e157b
Behavior Graph:
Download SVG
%3 guuid=53867dd3-1d00-0000-67f3-3918780c0000 pid=3192 /usr/bin/sudo guuid=86a082d7-1d00-0000-67f3-3918800c0000 pid=3200 /tmp/sample.bin guuid=53867dd3-1d00-0000-67f3-3918780c0000 pid=3192->guuid=86a082d7-1d00-0000-67f3-3918800c0000 pid=3200 execve guuid=ddb789d8-1d00-0000-67f3-3918810c0000 pid=3201 /usr/bin/bash guuid=86a082d7-1d00-0000-67f3-3918800c0000 pid=3200->guuid=ddb789d8-1d00-0000-67f3-3918810c0000 pid=3201 clone guuid=f243f6d9-1d00-0000-67f3-3918850c0000 pid=3205 /usr/bin/tee write-file guuid=86a082d7-1d00-0000-67f3-3918800c0000 pid=3200->guuid=f243f6d9-1d00-0000-67f3-3918850c0000 pid=3205 execve guuid=dfe903da-1d00-0000-67f3-3918860c0000 pid=3206 /usr/bin/which.debianutils guuid=86a082d7-1d00-0000-67f3-3918800c0000 pid=3200->guuid=dfe903da-1d00-0000-67f3-3918860c0000 pid=3206 execve guuid=4979b5da-1d00-0000-67f3-3918880c0000 pid=3208 /usr/bin/curl net send-data guuid=86a082d7-1d00-0000-67f3-3918800c0000 pid=3200->guuid=4979b5da-1d00-0000-67f3-3918880c0000 pid=3208 execve guuid=78c75635-1e00-0000-67f3-3918fd0c0000 pid=3325 /usr/bin/whoami guuid=86a082d7-1d00-0000-67f3-3918800c0000 pid=3200->guuid=78c75635-1e00-0000-67f3-3918fd0c0000 pid=3325 execve guuid=57114c36-1e00-0000-67f3-3918000d0000 pid=3328 /usr/bin/bash guuid=86a082d7-1d00-0000-67f3-3918800c0000 pid=3200->guuid=57114c36-1e00-0000-67f3-3918000d0000 pid=3328 clone guuid=93066d37-1e00-0000-67f3-3918070d0000 pid=3335 /usr/bin/getconf guuid=86a082d7-1d00-0000-67f3-3918800c0000 pid=3200->guuid=93066d37-1e00-0000-67f3-3918070d0000 pid=3335 execve guuid=98e7203b-1e00-0000-67f3-3918110d0000 pid=3345 /usr/bin/bash guuid=86a082d7-1d00-0000-67f3-3918800c0000 pid=3200->guuid=98e7203b-1e00-0000-67f3-3918110d0000 pid=3345 clone guuid=c7b5e83b-1e00-0000-67f3-3918180d0000 pid=3352 /usr/bin/bash guuid=86a082d7-1d00-0000-67f3-3918800c0000 pid=3200->guuid=c7b5e83b-1e00-0000-67f3-3918180d0000 pid=3352 clone guuid=0022a73c-1e00-0000-67f3-3918200d0000 pid=3360 /usr/bin/cat guuid=86a082d7-1d00-0000-67f3-3918800c0000 pid=3200->guuid=0022a73c-1e00-0000-67f3-3918200d0000 pid=3360 execve guuid=bc56fe3c-1e00-0000-67f3-3918220d0000 pid=3362 /usr/bin/bash guuid=86a082d7-1d00-0000-67f3-3918800c0000 pid=3200->guuid=bc56fe3c-1e00-0000-67f3-3918220d0000 pid=3362 clone guuid=9f659a3d-1e00-0000-67f3-3918270d0000 pid=3367 /usr/bin/bash guuid=86a082d7-1d00-0000-67f3-3918800c0000 pid=3200->guuid=9f659a3d-1e00-0000-67f3-3918270d0000 pid=3367 clone guuid=846f6e3e-1e00-0000-67f3-39182e0d0000 pid=3374 /usr/bin/bash guuid=86a082d7-1d00-0000-67f3-3918800c0000 pid=3200->guuid=846f6e3e-1e00-0000-67f3-39182e0d0000 pid=3374 clone guuid=da124d3f-1e00-0000-67f3-3918340d0000 pid=3380 /usr/bin/expr guuid=86a082d7-1d00-0000-67f3-3918800c0000 pid=3200->guuid=da124d3f-1e00-0000-67f3-3918340d0000 pid=3380 execve guuid=48aaa5d8-1d00-0000-67f3-3918820c0000 pid=3202 /usr/bin/uname guuid=ddb789d8-1d00-0000-67f3-3918810c0000 pid=3201->guuid=48aaa5d8-1d00-0000-67f3-3918820c0000 pid=3202 execve guuid=2791afd8-1d00-0000-67f3-3918830c0000 pid=3203 /usr/bin/grep guuid=ddb789d8-1d00-0000-67f3-3918810c0000 pid=3201->guuid=2791afd8-1d00-0000-67f3-3918830c0000 pid=3203 execve 83ee29da-e6c1-5782-beaf-7dee6832de76 www.bt.cn:443 guuid=4979b5da-1d00-0000-67f3-3918880c0000 pid=3208->83ee29da-e6c1-5782-beaf-7dee6832de76 send: 789B guuid=4979b5da-1d00-0000-67f3-3918880c0000 pid=3213 /usr/bin/curl dns net send-data guuid=4979b5da-1d00-0000-67f3-3918880c0000 pid=3208->guuid=4979b5da-1d00-0000-67f3-3918880c0000 pid=3213 clone guuid=4979b5da-1d00-0000-67f3-3918880c0000 pid=3213->83ee29da-e6c1-5782-beaf-7dee6832de76 con 4f6baed0-9587-596c-82b3-fd721afe4cc1 10.0.2.3:53 guuid=4979b5da-1d00-0000-67f3-3918880c0000 pid=3213->4f6baed0-9587-596c-82b3-fd721afe4cc1 send: 54B guuid=6ed46136-1e00-0000-67f3-3918010d0000 pid=3329 /usr/bin/free guuid=57114c36-1e00-0000-67f3-3918000d0000 pid=3328->guuid=6ed46136-1e00-0000-67f3-3918010d0000 pid=3329 execve guuid=19da7a36-1e00-0000-67f3-3918020d0000 pid=3330 /usr/bin/grep guuid=57114c36-1e00-0000-67f3-3918000d0000 pid=3328->guuid=19da7a36-1e00-0000-67f3-3918020d0000 pid=3330 execve guuid=92409036-1e00-0000-67f3-3918030d0000 pid=3331 /usr/bin/mawk guuid=57114c36-1e00-0000-67f3-3918000d0000 pid=3328->guuid=92409036-1e00-0000-67f3-3918030d0000 pid=3331 execve guuid=fbcf333b-1e00-0000-67f3-3918130d0000 pid=3347 /usr/bin/cat guuid=98e7203b-1e00-0000-67f3-3918110d0000 pid=3345->guuid=fbcf333b-1e00-0000-67f3-3918130d0000 pid=3347 execve guuid=5d0b403b-1e00-0000-67f3-3918140d0000 pid=3348 /usr/bin/grep guuid=98e7203b-1e00-0000-67f3-3918110d0000 pid=3345->guuid=5d0b403b-1e00-0000-67f3-3918140d0000 pid=3348 execve guuid=7be14b3b-1e00-0000-67f3-3918150d0000 pid=3349 /usr/bin/grep guuid=98e7203b-1e00-0000-67f3-3918110d0000 pid=3345->guuid=7be14b3b-1e00-0000-67f3-3918150d0000 pid=3349 execve guuid=8c09f53b-1e00-0000-67f3-3918190d0000 pid=3353 /usr/bin/cat guuid=c7b5e83b-1e00-0000-67f3-3918180d0000 pid=3352->guuid=8c09f53b-1e00-0000-67f3-3918190d0000 pid=3353 execve guuid=fca3fb3b-1e00-0000-67f3-39181a0d0000 pid=3354 /usr/bin/grep guuid=c7b5e83b-1e00-0000-67f3-3918180d0000 pid=3352->guuid=fca3fb3b-1e00-0000-67f3-39181a0d0000 pid=3354 execve guuid=4a9f2f3c-1e00-0000-67f3-39181c0d0000 pid=3356 /usr/bin/mawk guuid=c7b5e83b-1e00-0000-67f3-3918180d0000 pid=3352->guuid=4a9f2f3c-1e00-0000-67f3-39181c0d0000 pid=3356 execve guuid=41a4343c-1e00-0000-67f3-39181d0d0000 pid=3357 /usr/bin/cut guuid=c7b5e83b-1e00-0000-67f3-3918180d0000 pid=3352->guuid=41a4343c-1e00-0000-67f3-39181d0d0000 pid=3357 execve guuid=ee1e0a3d-1e00-0000-67f3-3918230d0000 pid=3363 /usr/bin/cat guuid=bc56fe3c-1e00-0000-67f3-3918220d0000 pid=3362->guuid=ee1e0a3d-1e00-0000-67f3-3918230d0000 pid=3363 execve guuid=d686103d-1e00-0000-67f3-3918240d0000 pid=3364 /usr/bin/grep guuid=bc56fe3c-1e00-0000-67f3-3918220d0000 pid=3362->guuid=d686103d-1e00-0000-67f3-3918240d0000 pid=3364 execve guuid=146e173d-1e00-0000-67f3-3918250d0000 pid=3365 /usr/bin/grep guuid=bc56fe3c-1e00-0000-67f3-3918220d0000 pid=3362->guuid=146e173d-1e00-0000-67f3-3918250d0000 pid=3365 execve guuid=c3f6a93d-1e00-0000-67f3-3918290d0000 pid=3369 /usr/bin/cat guuid=9f659a3d-1e00-0000-67f3-3918270d0000 pid=3367->guuid=c3f6a93d-1e00-0000-67f3-3918290d0000 pid=3369 execve guuid=ff24b93d-1e00-0000-67f3-39182a0d0000 pid=3370 /usr/bin/grep guuid=9f659a3d-1e00-0000-67f3-3918270d0000 pid=3367->guuid=ff24b93d-1e00-0000-67f3-39182a0d0000 pid=3370 execve guuid=318bc33d-1e00-0000-67f3-39182b0d0000 pid=3371 /usr/bin/grep guuid=9f659a3d-1e00-0000-67f3-3918270d0000 pid=3367->guuid=318bc33d-1e00-0000-67f3-39182b0d0000 pid=3371 execve guuid=89ec783e-1e00-0000-67f3-39182f0d0000 pid=3375 /usr/bin/cat guuid=846f6e3e-1e00-0000-67f3-39182e0d0000 pid=3374->guuid=89ec783e-1e00-0000-67f3-39182f0d0000 pid=3375 execve guuid=2fc07e3e-1e00-0000-67f3-3918300d0000 pid=3376 /usr/bin/grep guuid=846f6e3e-1e00-0000-67f3-39182e0d0000 pid=3374->guuid=2fc07e3e-1e00-0000-67f3-3918300d0000 pid=3376 execve guuid=3f55853e-1e00-0000-67f3-3918310d0000 pid=3377 /usr/bin/wc guuid=846f6e3e-1e00-0000-67f3-39182e0d0000 pid=3374->guuid=3f55853e-1e00-0000-67f3-3918310d0000 pid=3377 execve
Score:
2%
Verdict:
Benign
File Type:
SCRIPT
Link:
https://malprob.io/report/3bbbe5434a963c477170bbcddcee3fc49c11288f9e195affb37db4872d3ac62d
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3bbbe5434a963c477170bbcddcee3fc49c11288f9e195affb37db4872d3ac62d/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ho56kq2ksy6eo4lqxpg5z3r7ysobckeptymvv75tpw2iolj2yywq._file
Result
Malware family:
n/a
Score:
  4/10
Tags:
antivm discovery linux
Link:
https://tria.ge/reports/260729-q4w9xaxths/
Behaviour
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
Reads CPU attributes
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:dependsonpythonailib
Create hunting rule
Author:Tim Brown
Description:Hunts for dependencies on Python AI libraries

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 3bbbe5434a963c477170bbcddcee3fc49c11288f9e195affb37db4872d3ac62d

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3893440/
  
Delivery method
Distributed via web download

Comments