🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3c1234bdb30a65b22f359bc6adecd7e998bc01e160300779be04ffc85000c271. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3c1234bdb30a65b22f359bc6adecd7e998bc01e160300779be04ffc85000c271
SHA3-384 hash: 2dcb4f20d89c1c2b47ccb42c90fc97e5bc474447ea2c3a4b1a36285d5469cf576d31c077fea7db7067bec63aefc3f0dc
SHA1 hash: ea94ca7c112f5c15cfbf3474e3276be88b2df46f
MD5 hash: 0adeaa8febf2a2113467d939759be922
humanhash: sixteen-east-vegan-jupiter
File name:ok
Download: download sample
File size:1'608 bytes
First seen:2026-09-03 15:13:23 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 24:Q4A4XRNhSuxqHJrRjtdhNImNckuzCeeQ1Cw2:NSuxqbjZJNckMCeesc
TLSH T14A31149B05141A719016C99EB3723548B28EEAFF2C9FD7D4DC480EED864D78CF151B1A
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://5.182.210.174/f70b9en/an/an/a
http://5.182.210.174/3f4193n/an/an/a
http://5.182.210.174/391715n/an/an/a
http://5.182.210.174/974261n/an/an/a
http://5.182.210.174/2e634cn/an/an/a
http://5.182.210.174/7aa423n/an/an/a
http://5.182.210.174/8dc54fn/an/an/a
http://5.182.210.174/951812n/an/an/a
http://5.182.210.174/63bc57n/an/an/a
http://5.182.210.174/b90153n/an/an/a
http://5.182.210.174/ceced8n/an/an/a
http://5.182.210.174/ef383an/an/an/a

Intelligence

File Origin
# of uploads :
1
# of downloads :
48
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive mirai
Link:
https://www.filescan.io/uploads/6a998ec40f29dee3803ecce8/reports/1f369c1a-93a4-4a3b-8303-7c742fcd4e4c/overview
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/c4f74df9-80e8-4fef-8941-c75b49884dc2
Behavior Graph:
Download SVG
%3 guuid=dacda936-1900-0000-f5c9-10ce7e0c0000 pid=3198 /usr/bin/sudo guuid=ca00093b-1900-0000-f5c9-10ce860c0000 pid=3206 /tmp/sample.bin guuid=dacda936-1900-0000-f5c9-10ce7e0c0000 pid=3198->guuid=ca00093b-1900-0000-f5c9-10ce860c0000 pid=3206 execve guuid=b602cd3c-1900-0000-f5c9-10ce870c0000 pid=3207 /usr/bin/wget net send-data guuid=ca00093b-1900-0000-f5c9-10ce860c0000 pid=3206->guuid=b602cd3c-1900-0000-f5c9-10ce870c0000 pid=3207 execve guuid=d158d947-1900-0000-f5c9-10ce880c0000 pid=3208 /usr/bin/curl net send-data write-file guuid=ca00093b-1900-0000-f5c9-10ce860c0000 pid=3206->guuid=d158d947-1900-0000-f5c9-10ce880c0000 pid=3208 execve guuid=b1770156-1900-0000-f5c9-10ce940c0000 pid=3220 /usr/bin/chmod guuid=ca00093b-1900-0000-f5c9-10ce860c0000 pid=3206->guuid=b1770156-1900-0000-f5c9-10ce940c0000 pid=3220 execve guuid=eb0e6956-1900-0000-f5c9-10ce960c0000 pid=3222 /usr/bin/bash guuid=ca00093b-1900-0000-f5c9-10ce860c0000 pid=3206->guuid=eb0e6956-1900-0000-f5c9-10ce960c0000 pid=3222 clone guuid=32f3e956-1900-0000-f5c9-10ce980c0000 pid=3224 /usr/bin/rm delete-file guuid=ca00093b-1900-0000-f5c9-10ce860c0000 pid=3206->guuid=32f3e956-1900-0000-f5c9-10ce980c0000 pid=3224 execve guuid=6eda8b57-1900-0000-f5c9-10ce990c0000 pid=3225 /usr/bin/rm guuid=ca00093b-1900-0000-f5c9-10ce860c0000 pid=3206->guuid=6eda8b57-1900-0000-f5c9-10ce990c0000 pid=3225 execve guuid=60e5dc57-1900-0000-f5c9-10ce9a0c0000 pid=3226 /usr/bin/wget net send-data guuid=ca00093b-1900-0000-f5c9-10ce860c0000 pid=3206->guuid=60e5dc57-1900-0000-f5c9-10ce9a0c0000 pid=3226 execve guuid=06bc9a5a-1900-0000-f5c9-10cea10c0000 pid=3233 /usr/bin/curl net send-data write-file guuid=ca00093b-1900-0000-f5c9-10ce860c0000 pid=3206->guuid=06bc9a5a-1900-0000-f5c9-10cea10c0000 pid=3233 execve guuid=1de14f61-1900-0000-f5c9-10ceaa0c0000 pid=3242 /usr/bin/chmod guuid=ca00093b-1900-0000-f5c9-10ce860c0000 pid=3206->guuid=1de14f61-1900-0000-f5c9-10ceaa0c0000 pid=3242 execve guuid=fd8ebe61-1900-0000-f5c9-10ceab0c0000 pid=3243 /usr/bin/bash guuid=ca00093b-1900-0000-f5c9-10ce860c0000 pid=3206->guuid=fd8ebe61-1900-0000-f5c9-10ceab0c0000 pid=3243 clone guuid=fe641862-1900-0000-f5c9-10cead0c0000 pid=3245 /usr/bin/rm delete-file guuid=ca00093b-1900-0000-f5c9-10ce860c0000 pid=3206->guuid=fe641862-1900-0000-f5c9-10cead0c0000 pid=3245 execve guuid=6fa58962-1900-0000-f5c9-10ceae0c0000 pid=3246 /usr/bin/rm guuid=ca00093b-1900-0000-f5c9-10ce860c0000 pid=3206->guuid=6fa58962-1900-0000-f5c9-10ceae0c0000 pid=3246 execve guuid=bd62fc62-1900-0000-f5c9-10ceaf0c0000 pid=3247 /usr/bin/wget net send-data guuid=ca00093b-1900-0000-f5c9-10ce860c0000 pid=3206->guuid=bd62fc62-1900-0000-f5c9-10ceaf0c0000 pid=3247 execve guuid=4f932466-1900-0000-f5c9-10ceb70c0000 pid=3255 /usr/bin/curl net send-data write-file guuid=ca00093b-1900-0000-f5c9-10ce860c0000 pid=3206->guuid=4f932466-1900-0000-f5c9-10ceb70c0000 pid=3255 execve guuid=59b3dc6a-1900-0000-f5c9-10cec00c0000 pid=3264 /usr/bin/chmod guuid=ca00093b-1900-0000-f5c9-10ce860c0000 pid=3206->guuid=59b3dc6a-1900-0000-f5c9-10cec00c0000 pid=3264 execve guuid=fc81506b-1900-0000-f5c9-10cec20c0000 pid=3266 /usr/bin/bash guuid=ca00093b-1900-0000-f5c9-10ce860c0000 pid=3206->guuid=fc81506b-1900-0000-f5c9-10cec20c0000 pid=3266 clone guuid=a749fe6b-1900-0000-f5c9-10cec50c0000 pid=3269 /usr/bin/rm delete-file guuid=ca00093b-1900-0000-f5c9-10ce860c0000 pid=3206->guuid=a749fe6b-1900-0000-f5c9-10cec50c0000 pid=3269 execve guuid=ddad6b6c-1900-0000-f5c9-10cec80c0000 pid=3272 /usr/bin/rm guuid=ca00093b-1900-0000-f5c9-10ce860c0000 pid=3206->guuid=ddad6b6c-1900-0000-f5c9-10cec80c0000 pid=3272 execve guuid=a68bc06c-1900-0000-f5c9-10cec90c0000 pid=3273 /usr/bin/wget net send-data guuid=ca00093b-1900-0000-f5c9-10ce860c0000 pid=3206->guuid=a68bc06c-1900-0000-f5c9-10cec90c0000 pid=3273 execve guuid=c7f1586f-1900-0000-f5c9-10ced30c0000 pid=3283 /usr/bin/curl net send-data write-file guuid=ca00093b-1900-0000-f5c9-10ce860c0000 pid=3206->guuid=c7f1586f-1900-0000-f5c9-10ced30c0000 pid=3283 execve guuid=5eb8f972-1900-0000-f5c9-10cede0c0000 pid=3294 /usr/bin/chmod guuid=ca00093b-1900-0000-f5c9-10ce860c0000 pid=3206->guuid=5eb8f972-1900-0000-f5c9-10cede0c0000 pid=3294 execve guuid=9f2b9173-1900-0000-f5c9-10cee00c0000 pid=3296 /usr/bin/bash guuid=ca00093b-1900-0000-f5c9-10ce860c0000 pid=3206->guuid=9f2b9173-1900-0000-f5c9-10cee00c0000 pid=3296 clone guuid=82fa0974-1900-0000-f5c9-10cee40c0000 pid=3300 /usr/bin/rm delete-file guuid=ca00093b-1900-0000-f5c9-10ce860c0000 pid=3206->guuid=82fa0974-1900-0000-f5c9-10cee40c0000 pid=3300 execve guuid=57daa374-1900-0000-f5c9-10cee70c0000 pid=3303 /usr/bin/rm guuid=ca00093b-1900-0000-f5c9-10ce860c0000 pid=3206->guuid=57daa374-1900-0000-f5c9-10cee70c0000 pid=3303 execve guuid=448f3675-1900-0000-f5c9-10ceeb0c0000 pid=3307 /usr/bin/wget net send-data guuid=ca00093b-1900-0000-f5c9-10ce860c0000 pid=3206->guuid=448f3675-1900-0000-f5c9-10ceeb0c0000 pid=3307 execve guuid=ea343778-1900-0000-f5c9-10cef50c0000 pid=3317 /usr/bin/curl net send-data write-file guuid=ca00093b-1900-0000-f5c9-10ce860c0000 pid=3206->guuid=ea343778-1900-0000-f5c9-10cef50c0000 pid=3317 execve guuid=08d1f17c-1900-0000-f5c9-10ce000d0000 pid=3328 /usr/bin/chmod guuid=ca00093b-1900-0000-f5c9-10ce860c0000 pid=3206->guuid=08d1f17c-1900-0000-f5c9-10ce000d0000 pid=3328 execve guuid=03cd547d-1900-0000-f5c9-10ce020d0000 pid=3330 /usr/bin/bash guuid=ca00093b-1900-0000-f5c9-10ce860c0000 pid=3206->guuid=03cd547d-1900-0000-f5c9-10ce020d0000 pid=3330 clone guuid=711b9d7d-1900-0000-f5c9-10ce050d0000 pid=3333 /usr/bin/rm delete-file guuid=ca00093b-1900-0000-f5c9-10ce860c0000 pid=3206->guuid=711b9d7d-1900-0000-f5c9-10ce050d0000 pid=3333 execve guuid=3206e17d-1900-0000-f5c9-10ce070d0000 pid=3335 /usr/bin/rm guuid=ca00093b-1900-0000-f5c9-10ce860c0000 pid=3206->guuid=3206e17d-1900-0000-f5c9-10ce070d0000 pid=3335 execve guuid=12501c7e-1900-0000-f5c9-10ce080d0000 pid=3336 /usr/bin/wget net send-data guuid=ca00093b-1900-0000-f5c9-10ce860c0000 pid=3206->guuid=12501c7e-1900-0000-f5c9-10ce080d0000 pid=3336 execve guuid=b5a77b80-1900-0000-f5c9-10ce120d0000 pid=3346 /usr/bin/curl net send-data write-file guuid=ca00093b-1900-0000-f5c9-10ce860c0000 pid=3206->guuid=b5a77b80-1900-0000-f5c9-10ce120d0000 pid=3346 execve guuid=720ab583-1900-0000-f5c9-10ce1e0d0000 pid=3358 /usr/bin/chmod guuid=ca00093b-1900-0000-f5c9-10ce860c0000 pid=3206->guuid=720ab583-1900-0000-f5c9-10ce1e0d0000 pid=3358 execve guuid=09b2fd83-1900-0000-f5c9-10ce200d0000 pid=3360 /usr/bin/bash guuid=ca00093b-1900-0000-f5c9-10ce860c0000 pid=3206->guuid=09b2fd83-1900-0000-f5c9-10ce200d0000 pid=3360 clone guuid=a0b04184-1900-0000-f5c9-10ce220d0000 pid=3362 /usr/bin/rm delete-file guuid=ca00093b-1900-0000-f5c9-10ce860c0000 pid=3206->guuid=a0b04184-1900-0000-f5c9-10ce220d0000 pid=3362 execve guuid=e207a784-1900-0000-f5c9-10ce250d0000 pid=3365 /usr/bin/rm guuid=ca00093b-1900-0000-f5c9-10ce860c0000 pid=3206->guuid=e207a784-1900-0000-f5c9-10ce250d0000 pid=3365 execve guuid=49d60b85-1900-0000-f5c9-10ce270d0000 pid=3367 /usr/bin/wget net send-data guuid=ca00093b-1900-0000-f5c9-10ce860c0000 pid=3206->guuid=49d60b85-1900-0000-f5c9-10ce270d0000 pid=3367 execve guuid=aebd1f88-1900-0000-f5c9-10ce330d0000 pid=3379 /usr/bin/curl net send-data write-file guuid=ca00093b-1900-0000-f5c9-10ce860c0000 pid=3206->guuid=aebd1f88-1900-0000-f5c9-10ce330d0000 pid=3379 execve guuid=c741918b-1900-0000-f5c9-10ce3e0d0000 pid=3390 /usr/bin/chmod guuid=ca00093b-1900-0000-f5c9-10ce860c0000 pid=3206->guuid=c741918b-1900-0000-f5c9-10ce3e0d0000 pid=3390 execve guuid=af1af48b-1900-0000-f5c9-10ce400d0000 pid=3392 /usr/bin/bash guuid=ca00093b-1900-0000-f5c9-10ce860c0000 pid=3206->guuid=af1af48b-1900-0000-f5c9-10ce400d0000 pid=3392 clone guuid=8afc398c-1900-0000-f5c9-10ce430d0000 pid=3395 /usr/bin/rm delete-file guuid=ca00093b-1900-0000-f5c9-10ce860c0000 pid=3206->guuid=8afc398c-1900-0000-f5c9-10ce430d0000 pid=3395 execve guuid=084ca78c-1900-0000-f5c9-10ce450d0000 pid=3397 /usr/bin/rm guuid=ca00093b-1900-0000-f5c9-10ce860c0000 pid=3206->guuid=084ca78c-1900-0000-f5c9-10ce450d0000 pid=3397 execve guuid=879cfd8c-1900-0000-f5c9-10ce470d0000 pid=3399 /usr/bin/wget net send-data guuid=ca00093b-1900-0000-f5c9-10ce860c0000 pid=3206->guuid=879cfd8c-1900-0000-f5c9-10ce470d0000 pid=3399 execve guuid=0fa4c28f-1900-0000-f5c9-10ce4f0d0000 pid=3407 /usr/bin/curl net send-data write-file guuid=ca00093b-1900-0000-f5c9-10ce860c0000 pid=3206->guuid=0fa4c28f-1900-0000-f5c9-10ce4f0d0000 pid=3407 execve guuid=3cc4939a-1900-0000-f5c9-10ce5d0d0000 pid=3421 /usr/bin/chmod guuid=ca00093b-1900-0000-f5c9-10ce860c0000 pid=3206->guuid=3cc4939a-1900-0000-f5c9-10ce5d0d0000 pid=3421 execve guuid=ebc87f9b-1900-0000-f5c9-10ce5e0d0000 pid=3422 /usr/bin/bash guuid=ca00093b-1900-0000-f5c9-10ce860c0000 pid=3206->guuid=ebc87f9b-1900-0000-f5c9-10ce5e0d0000 pid=3422 clone guuid=0fe34e9c-1900-0000-f5c9-10ce600d0000 pid=3424 /usr/bin/rm delete-file guuid=ca00093b-1900-0000-f5c9-10ce860c0000 pid=3206->guuid=0fe34e9c-1900-0000-f5c9-10ce600d0000 pid=3424 execve guuid=52ea409e-1900-0000-f5c9-10ce610d0000 pid=3425 /usr/bin/rm guuid=ca00093b-1900-0000-f5c9-10ce860c0000 pid=3206->guuid=52ea409e-1900-0000-f5c9-10ce610d0000 pid=3425 execve guuid=3945b79f-1900-0000-f5c9-10ce620d0000 pid=3426 /usr/bin/wget net send-data guuid=ca00093b-1900-0000-f5c9-10ce860c0000 pid=3206->guuid=3945b79f-1900-0000-f5c9-10ce620d0000 pid=3426 execve guuid=e3bb42a4-1900-0000-f5c9-10ce670d0000 pid=3431 /usr/bin/curl net send-data write-file guuid=ca00093b-1900-0000-f5c9-10ce860c0000 pid=3206->guuid=e3bb42a4-1900-0000-f5c9-10ce670d0000 pid=3431 execve guuid=f96163af-1900-0000-f5c9-10ce740d0000 pid=3444 /usr/bin/chmod guuid=ca00093b-1900-0000-f5c9-10ce860c0000 pid=3206->guuid=f96163af-1900-0000-f5c9-10ce740d0000 pid=3444 execve guuid=1c4cc5af-1900-0000-f5c9-10ce750d0000 pid=3445 /usr/bin/bash guuid=ca00093b-1900-0000-f5c9-10ce860c0000 pid=3206->guuid=1c4cc5af-1900-0000-f5c9-10ce750d0000 pid=3445 clone guuid=c19b16b0-1900-0000-f5c9-10ce780d0000 pid=3448 /usr/bin/rm delete-file guuid=ca00093b-1900-0000-f5c9-10ce860c0000 pid=3206->guuid=c19b16b0-1900-0000-f5c9-10ce780d0000 pid=3448 execve guuid=5d7c83b0-1900-0000-f5c9-10ce790d0000 pid=3449 /usr/bin/rm guuid=ca00093b-1900-0000-f5c9-10ce860c0000 pid=3206->guuid=5d7c83b0-1900-0000-f5c9-10ce790d0000 pid=3449 execve guuid=0c95eab0-1900-0000-f5c9-10ce7a0d0000 pid=3450 /usr/bin/wget net send-data guuid=ca00093b-1900-0000-f5c9-10ce860c0000 pid=3206->guuid=0c95eab0-1900-0000-f5c9-10ce7a0d0000 pid=3450 execve guuid=561f78b4-1900-0000-f5c9-10ce7f0d0000 pid=3455 /usr/bin/curl net send-data write-file guuid=ca00093b-1900-0000-f5c9-10ce860c0000 pid=3206->guuid=561f78b4-1900-0000-f5c9-10ce7f0d0000 pid=3455 execve guuid=933220ba-1900-0000-f5c9-10ce840d0000 pid=3460 /usr/bin/chmod guuid=ca00093b-1900-0000-f5c9-10ce860c0000 pid=3206->guuid=933220ba-1900-0000-f5c9-10ce840d0000 pid=3460 execve guuid=3f0dc4ba-1900-0000-f5c9-10ce870d0000 pid=3463 /usr/bin/bash guuid=ca00093b-1900-0000-f5c9-10ce860c0000 pid=3206->guuid=3f0dc4ba-1900-0000-f5c9-10ce870d0000 pid=3463 clone guuid=00345fbb-1900-0000-f5c9-10ce8a0d0000 pid=3466 /usr/bin/rm delete-file guuid=ca00093b-1900-0000-f5c9-10ce860c0000 pid=3206->guuid=00345fbb-1900-0000-f5c9-10ce8a0d0000 pid=3466 execve guuid=d1fbe6bb-1900-0000-f5c9-10ce8c0d0000 pid=3468 /usr/bin/rm guuid=ca00093b-1900-0000-f5c9-10ce860c0000 pid=3206->guuid=d1fbe6bb-1900-0000-f5c9-10ce8c0d0000 pid=3468 execve guuid=1536b5bc-1900-0000-f5c9-10ce8f0d0000 pid=3471 /usr/bin/wget net send-data guuid=ca00093b-1900-0000-f5c9-10ce860c0000 pid=3206->guuid=1536b5bc-1900-0000-f5c9-10ce8f0d0000 pid=3471 execve guuid=1a74dabf-1900-0000-f5c9-10ce960d0000 pid=3478 /usr/bin/curl net send-data write-file guuid=ca00093b-1900-0000-f5c9-10ce860c0000 pid=3206->guuid=1a74dabf-1900-0000-f5c9-10ce960d0000 pid=3478 execve guuid=30d0a5c9-1900-0000-f5c9-10ce9d0d0000 pid=3485 /usr/bin/chmod guuid=ca00093b-1900-0000-f5c9-10ce860c0000 pid=3206->guuid=30d0a5c9-1900-0000-f5c9-10ce9d0d0000 pid=3485 execve guuid=514b5cca-1900-0000-f5c9-10cea00d0000 pid=3488 /usr/bin/bash guuid=ca00093b-1900-0000-f5c9-10ce860c0000 pid=3206->guuid=514b5cca-1900-0000-f5c9-10cea00d0000 pid=3488 clone guuid=9bb0d1ca-1900-0000-f5c9-10cea20d0000 pid=3490 /usr/bin/rm delete-file guuid=ca00093b-1900-0000-f5c9-10ce860c0000 pid=3206->guuid=9bb0d1ca-1900-0000-f5c9-10cea20d0000 pid=3490 execve guuid=d9488ecb-1900-0000-f5c9-10cea50d0000 pid=3493 /usr/bin/rm guuid=ca00093b-1900-0000-f5c9-10ce860c0000 pid=3206->guuid=d9488ecb-1900-0000-f5c9-10cea50d0000 pid=3493 execve guuid=9f2425cc-1900-0000-f5c9-10cea70d0000 pid=3495 /usr/bin/wget net send-data guuid=ca00093b-1900-0000-f5c9-10ce860c0000 pid=3206->guuid=9f2425cc-1900-0000-f5c9-10cea70d0000 pid=3495 execve guuid=f6936ed1-1900-0000-f5c9-10ceb60d0000 pid=3510 /usr/bin/curl net send-data write-file guuid=ca00093b-1900-0000-f5c9-10ce860c0000 pid=3206->guuid=f6936ed1-1900-0000-f5c9-10ceb60d0000 pid=3510 execve guuid=229e9dd6-1900-0000-f5c9-10cec50d0000 pid=3525 /usr/bin/chmod guuid=ca00093b-1900-0000-f5c9-10ce860c0000 pid=3206->guuid=229e9dd6-1900-0000-f5c9-10cec50d0000 pid=3525 execve guuid=01428ed7-1900-0000-f5c9-10cec80d0000 pid=3528 /usr/bin/bash guuid=ca00093b-1900-0000-f5c9-10ce860c0000 pid=3206->guuid=01428ed7-1900-0000-f5c9-10cec80d0000 pid=3528 clone guuid=b3aa36d8-1900-0000-f5c9-10cecb0d0000 pid=3531 /usr/bin/rm delete-file guuid=ca00093b-1900-0000-f5c9-10ce860c0000 pid=3206->guuid=b3aa36d8-1900-0000-f5c9-10cecb0d0000 pid=3531 execve guuid=f5d6a0d8-1900-0000-f5c9-10cecd0d0000 pid=3533 /usr/bin/rm guuid=ca00093b-1900-0000-f5c9-10ce860c0000 pid=3206->guuid=f5d6a0d8-1900-0000-f5c9-10cecd0d0000 pid=3533 execve 5b654972-c9e1-50d8-b372-2dc2a5b9ad66 5.182.210.174:80 guuid=b602cd3c-1900-0000-f5c9-10ce870c0000 pid=3207->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=d158d947-1900-0000-f5c9-10ce880c0000 pid=3208->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=8a17a556-1900-0000-f5c9-10ce970c0000 pid=3223 /usr/bin/bash guuid=eb0e6956-1900-0000-f5c9-10ce960c0000 pid=3222->guuid=8a17a556-1900-0000-f5c9-10ce970c0000 pid=3223 clone guuid=60e5dc57-1900-0000-f5c9-10ce9a0c0000 pid=3226->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=06bc9a5a-1900-0000-f5c9-10cea10c0000 pid=3233->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=25e2f061-1900-0000-f5c9-10ceac0c0000 pid=3244 /usr/bin/bash guuid=fd8ebe61-1900-0000-f5c9-10ceab0c0000 pid=3243->guuid=25e2f061-1900-0000-f5c9-10ceac0c0000 pid=3244 clone guuid=bd62fc62-1900-0000-f5c9-10ceaf0c0000 pid=3247->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=4f932466-1900-0000-f5c9-10ceb70c0000 pid=3255->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=aff88c6b-1900-0000-f5c9-10cec30c0000 pid=3267 /usr/bin/bash guuid=fc81506b-1900-0000-f5c9-10cec20c0000 pid=3266->guuid=aff88c6b-1900-0000-f5c9-10cec30c0000 pid=3267 clone guuid=a68bc06c-1900-0000-f5c9-10cec90c0000 pid=3273->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=c7f1586f-1900-0000-f5c9-10ced30c0000 pid=3283->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=fc10ba73-1900-0000-f5c9-10cee10c0000 pid=3297 /usr/bin/bash guuid=9f2b9173-1900-0000-f5c9-10cee00c0000 pid=3296->guuid=fc10ba73-1900-0000-f5c9-10cee10c0000 pid=3297 clone guuid=448f3675-1900-0000-f5c9-10ceeb0c0000 pid=3307->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=ea343778-1900-0000-f5c9-10cef50c0000 pid=3317->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=0a5a737d-1900-0000-f5c9-10ce040d0000 pid=3332 /usr/bin/bash guuid=03cd547d-1900-0000-f5c9-10ce020d0000 pid=3330->guuid=0a5a737d-1900-0000-f5c9-10ce040d0000 pid=3332 clone guuid=12501c7e-1900-0000-f5c9-10ce080d0000 pid=3336->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=b5a77b80-1900-0000-f5c9-10ce120d0000 pid=3346->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=25dc1284-1900-0000-f5c9-10ce210d0000 pid=3361 /usr/bin/bash guuid=09b2fd83-1900-0000-f5c9-10ce200d0000 pid=3360->guuid=25dc1284-1900-0000-f5c9-10ce210d0000 pid=3361 clone guuid=49d60b85-1900-0000-f5c9-10ce270d0000 pid=3367->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=aebd1f88-1900-0000-f5c9-10ce330d0000 pid=3379->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=3659148c-1900-0000-f5c9-10ce410d0000 pid=3393 /usr/bin/bash guuid=af1af48b-1900-0000-f5c9-10ce400d0000 pid=3392->guuid=3659148c-1900-0000-f5c9-10ce410d0000 pid=3393 clone guuid=879cfd8c-1900-0000-f5c9-10ce470d0000 pid=3399->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=0fa4c28f-1900-0000-f5c9-10ce4f0d0000 pid=3407->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=b3ffd79b-1900-0000-f5c9-10ce5f0d0000 pid=3423 /usr/bin/bash guuid=ebc87f9b-1900-0000-f5c9-10ce5e0d0000 pid=3422->guuid=b3ffd79b-1900-0000-f5c9-10ce5f0d0000 pid=3423 clone guuid=3945b79f-1900-0000-f5c9-10ce620d0000 pid=3426->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=e3bb42a4-1900-0000-f5c9-10ce670d0000 pid=3431->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=4be2e7af-1900-0000-f5c9-10ce770d0000 pid=3447 /usr/bin/bash guuid=1c4cc5af-1900-0000-f5c9-10ce750d0000 pid=3445->guuid=4be2e7af-1900-0000-f5c9-10ce770d0000 pid=3447 clone guuid=0c95eab0-1900-0000-f5c9-10ce7a0d0000 pid=3450->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=561f78b4-1900-0000-f5c9-10ce7f0d0000 pid=3455->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=41d310bb-1900-0000-f5c9-10ce880d0000 pid=3464 /usr/bin/bash guuid=3f0dc4ba-1900-0000-f5c9-10ce870d0000 pid=3463->guuid=41d310bb-1900-0000-f5c9-10ce880d0000 pid=3464 clone guuid=1536b5bc-1900-0000-f5c9-10ce8f0d0000 pid=3471->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=1a74dabf-1900-0000-f5c9-10ce960d0000 pid=3478->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=d5b878ca-1900-0000-f5c9-10cea10d0000 pid=3489 /usr/bin/bash guuid=514b5cca-1900-0000-f5c9-10cea00d0000 pid=3488->guuid=d5b878ca-1900-0000-f5c9-10cea10d0000 pid=3489 clone guuid=9f2425cc-1900-0000-f5c9-10cea70d0000 pid=3495->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=f6936ed1-1900-0000-f5c9-10ceb60d0000 pid=3510->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=7c3eced7-1900-0000-f5c9-10cec90d0000 pid=3529 /usr/bin/bash guuid=01428ed7-1900-0000-f5c9-10cec80d0000 pid=3528->guuid=7c3eced7-1900-0000-f5c9-10cec90d0000 pid=3529 clone
Score:
99%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/3c1234bdb30a65b22f359bc6adecd7e998bc01e160300779be04ffc85000c271
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3c1234bdb30a65b22f359bc6adecd7e998bc01e160300779be04ffc85000c271/
Gathering data
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hqjdjpntbjs3elzvtpdk33gx5gmlyapbmayao6n6at74quaayjyq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260903-smedwazdna/
Behaviour
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 3c1234bdb30a65b22f359bc6adecd7e998bc01e160300779be04ffc85000c271

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3897671/
  
Delivery method
Distributed via web download

Comments