MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3d59cdeb5d1ca179797367de5ccd8923041851875e997cb6900d434ceeb64abe. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3d59cdeb5d1ca179797367de5ccd8923041851875e997cb6900d434ceeb64abe
SHA3-384 hash: 7ad4e68cab71d07cc0dcb76de20df009450e211c9f7aaec7c65f63d68753b86bf2ccf6fb282571edd7f7d9d769a27d99
SHA1 hash: 566d7d5db7f85a41f89d963d6f9e75dab7ae53a2
MD5 hash: c509d7de26619037aad2b7e1ca345308
humanhash: tennessee-mexico-sink-emma
File name:run.sh
Download: download sample
File size:2'855 bytes
First seen:2026-02-22 09:28:54 UTC
Last seen:Never
File type: sh
MIME type:text/plain
ssdeep 24:wp2JMMibiB0vuZ/EUEnE2EhEwUSbw/UJUfTshM3k:wp2JMMibiB0vuZ//cvyISbwvshM3k
TLSH T1BD5151AB07045B71DA09855EB7FA3574764EE083A6DFC644E9848C2D4ED9D4C3B86F40
Magika txt
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://84.21.173.41/bins/xnxnxnxnxnxnxnxnaarch64xnxnn/an/acensys elf ua-wget
http://84.21.173.41/bins/xnxnxnxnxnxnxnxni386xnxnn/an/acensys elf ua-wget
http://84.21.173.41/bins/xnxnxnxnxnxnxnxnloongarch64xnxnn/an/acensys elf ua-wget
http://84.21.173.41/bins/xnxnxnxnxnxnxnxnm68kxnxnn/an/acensys elf ua-wget
http://84.21.173.41/bins/xnxnxnxnxnxnxnxnmicroblazexnxnn/an/acensys elf ua-wget
http://84.21.173.41/bins/xnxnxnxnxnxnxnxnmipsxnxnn/an/acensys elf ua-wget
http://84.21.173.41/bins/xnxnxnxnxnxnxnxnor1kxnxnn/an/acensys elf ua-wget
http://84.21.173.41/bins/xnxnxnxnxnxnxnxnpowerpcxnxnn/an/acensys elf ua-wget
http://84.21.173.41/bins/xnxnxnxnxnxnxnxnriscv32xnxnn/an/acensys elf ua-wget
http://84.21.173.41/bins/xnxnxnxnxnxnxnxnriscv64xnxnn/an/acensys elf ua-wget
http://84.21.173.41/bins/xnxnxnxnxnxnxnxnsh2xnxnn/an/acensys elf ua-wget
http://84.21.173.41/bins/xnxnxnxnxnxnxnxnsh4xnxnn/an/acensys elf ua-wget
http://84.21.173.41/bins/xnxnxnxnxnxnxnxnx86_64xnxnn/an/acensys elf ua-wget

Intelligence

File Origin
# of uploads :
1
# of downloads :
50
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive mirai
Link:
https://www.filescan.io/uploads/699acc7a97feb4afd651a71a/reports/e5d4f22d-b745-4aea-a2bc-335f491a7ec3/overview
Verdict:
Malicious
File Type:
text
Detections:
HEUR:Trojan-Downloader.Shell.Agent.gen HEUR:Trojan-Downloader.Shell.Agent.a
Link:
https://opentip.kaspersky.com/3d59cdeb5d1ca179797367de5ccd8923041851875e997cb6900d434ceeb64abe/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/24890114-1612-4a94-8017-3546ec8d0f6d
Behavior Graph:
Download SVG
%3 guuid=350ba234-1a00-0000-64f1-13c5240a0000 pid=2596 /usr/bin/sudo guuid=31093136-1a00-0000-64f1-13c52b0a0000 pid=2603 /tmp/sample.bin guuid=350ba234-1a00-0000-64f1-13c5240a0000 pid=2596->guuid=31093136-1a00-0000-64f1-13c52b0a0000 pid=2603 execve guuid=d4b16536-1a00-0000-64f1-13c52d0a0000 pid=2605 /usr/bin/wget net send-data guuid=31093136-1a00-0000-64f1-13c52b0a0000 pid=2603->guuid=d4b16536-1a00-0000-64f1-13c52d0a0000 pid=2605 execve guuid=46860d3a-1a00-0000-64f1-13c53a0a0000 pid=2618 /usr/bin/curl net send-data write-file guuid=31093136-1a00-0000-64f1-13c52b0a0000 pid=2603->guuid=46860d3a-1a00-0000-64f1-13c53a0a0000 pid=2618 execve guuid=1bcd4343-1a00-0000-64f1-13c5580a0000 pid=2648 /usr/bin/chmod guuid=31093136-1a00-0000-64f1-13c52b0a0000 pid=2603->guuid=1bcd4343-1a00-0000-64f1-13c5580a0000 pid=2648 execve guuid=2640ae43-1a00-0000-64f1-13c55a0a0000 pid=2650 /home/sandbox/xnxnxnxnxnxnxnxnaarch64xnxn guuid=31093136-1a00-0000-64f1-13c52b0a0000 pid=2603->guuid=2640ae43-1a00-0000-64f1-13c55a0a0000 pid=2650 execve guuid=26c92844-1a00-0000-64f1-13c55d0a0000 pid=2653 /usr/bin/rm delete-file guuid=31093136-1a00-0000-64f1-13c52b0a0000 pid=2603->guuid=26c92844-1a00-0000-64f1-13c55d0a0000 pid=2653 execve guuid=8a37a144-1a00-0000-64f1-13c55f0a0000 pid=2655 /usr/bin/wget net send-data guuid=31093136-1a00-0000-64f1-13c52b0a0000 pid=2603->guuid=8a37a144-1a00-0000-64f1-13c55f0a0000 pid=2655 execve guuid=9c4f6b46-1a00-0000-64f1-13c5660a0000 pid=2662 /usr/bin/curl net send-data write-file guuid=31093136-1a00-0000-64f1-13c52b0a0000 pid=2603->guuid=9c4f6b46-1a00-0000-64f1-13c5660a0000 pid=2662 execve guuid=4fb61c4a-1a00-0000-64f1-13c5710a0000 pid=2673 /usr/bin/chmod guuid=31093136-1a00-0000-64f1-13c52b0a0000 pid=2603->guuid=4fb61c4a-1a00-0000-64f1-13c5710a0000 pid=2673 execve guuid=5586a74a-1a00-0000-64f1-13c5730a0000 pid=2675 /home/sandbox/xnxnxnxnxnxnxnxni386xnxn guuid=31093136-1a00-0000-64f1-13c52b0a0000 pid=2603->guuid=5586a74a-1a00-0000-64f1-13c5730a0000 pid=2675 execve guuid=5e83eb4a-1a00-0000-64f1-13c5750a0000 pid=2677 /usr/bin/rm delete-file guuid=31093136-1a00-0000-64f1-13c52b0a0000 pid=2603->guuid=5e83eb4a-1a00-0000-64f1-13c5750a0000 pid=2677 execve guuid=8794384b-1a00-0000-64f1-13c5770a0000 pid=2679 /usr/bin/wget net send-data guuid=31093136-1a00-0000-64f1-13c52b0a0000 pid=2603->guuid=8794384b-1a00-0000-64f1-13c5770a0000 pid=2679 execve guuid=04c72d4e-1a00-0000-64f1-13c57e0a0000 pid=2686 /usr/bin/curl net send-data write-file guuid=31093136-1a00-0000-64f1-13c52b0a0000 pid=2603->guuid=04c72d4e-1a00-0000-64f1-13c57e0a0000 pid=2686 execve guuid=d389c551-1a00-0000-64f1-13c58a0a0000 pid=2698 /usr/bin/chmod guuid=31093136-1a00-0000-64f1-13c52b0a0000 pid=2603->guuid=d389c551-1a00-0000-64f1-13c58a0a0000 pid=2698 execve guuid=5aac0152-1a00-0000-64f1-13c58c0a0000 pid=2700 /home/sandbox/xnxnxnxnxnxnxnxnloongarch64xnxn guuid=31093136-1a00-0000-64f1-13c52b0a0000 pid=2603->guuid=5aac0152-1a00-0000-64f1-13c58c0a0000 pid=2700 execve guuid=b6aa3552-1a00-0000-64f1-13c58e0a0000 pid=2702 /usr/bin/rm delete-file guuid=31093136-1a00-0000-64f1-13c52b0a0000 pid=2603->guuid=b6aa3552-1a00-0000-64f1-13c58e0a0000 pid=2702 execve guuid=f3b37552-1a00-0000-64f1-13c5900a0000 pid=2704 /usr/bin/wget net send-data guuid=31093136-1a00-0000-64f1-13c52b0a0000 pid=2603->guuid=f3b37552-1a00-0000-64f1-13c5900a0000 pid=2704 execve guuid=a62e2d54-1a00-0000-64f1-13c5960a0000 pid=2710 /usr/bin/curl net send-data write-file guuid=31093136-1a00-0000-64f1-13c52b0a0000 pid=2603->guuid=a62e2d54-1a00-0000-64f1-13c5960a0000 pid=2710 execve guuid=18ceac56-1a00-0000-64f1-13c59e0a0000 pid=2718 /usr/bin/chmod guuid=31093136-1a00-0000-64f1-13c52b0a0000 pid=2603->guuid=18ceac56-1a00-0000-64f1-13c59e0a0000 pid=2718 execve guuid=52afed56-1a00-0000-64f1-13c5a00a0000 pid=2720 /home/sandbox/xnxnxnxnxnxnxnxnm68kxnxn guuid=31093136-1a00-0000-64f1-13c52b0a0000 pid=2603->guuid=52afed56-1a00-0000-64f1-13c5a00a0000 pid=2720 execve guuid=587b2157-1a00-0000-64f1-13c5a20a0000 pid=2722 /usr/bin/rm delete-file guuid=31093136-1a00-0000-64f1-13c52b0a0000 pid=2603->guuid=587b2157-1a00-0000-64f1-13c5a20a0000 pid=2722 execve guuid=88fa5a57-1a00-0000-64f1-13c5a30a0000 pid=2723 /usr/bin/wget net send-data guuid=31093136-1a00-0000-64f1-13c52b0a0000 pid=2603->guuid=88fa5a57-1a00-0000-64f1-13c5a30a0000 pid=2723 execve guuid=51268059-1a00-0000-64f1-13c5ac0a0000 pid=2732 /usr/bin/curl net send-data write-file guuid=31093136-1a00-0000-64f1-13c52b0a0000 pid=2603->guuid=51268059-1a00-0000-64f1-13c5ac0a0000 pid=2732 execve guuid=66f3eb5b-1a00-0000-64f1-13c5b60a0000 pid=2742 /usr/bin/chmod guuid=31093136-1a00-0000-64f1-13c52b0a0000 pid=2603->guuid=66f3eb5b-1a00-0000-64f1-13c5b60a0000 pid=2742 execve guuid=0eac245c-1a00-0000-64f1-13c5b70a0000 pid=2743 /home/sandbox/xnxnxnxnxnxnxnxnmicroblazexnxn guuid=31093136-1a00-0000-64f1-13c52b0a0000 pid=2603->guuid=0eac245c-1a00-0000-64f1-13c5b70a0000 pid=2743 execve guuid=e617535c-1a00-0000-64f1-13c5b90a0000 pid=2745 /usr/bin/rm delete-file guuid=31093136-1a00-0000-64f1-13c52b0a0000 pid=2603->guuid=e617535c-1a00-0000-64f1-13c5b90a0000 pid=2745 execve guuid=733a8e5c-1a00-0000-64f1-13c5ba0a0000 pid=2746 /usr/bin/wget net send-data guuid=31093136-1a00-0000-64f1-13c52b0a0000 pid=2603->guuid=733a8e5c-1a00-0000-64f1-13c5ba0a0000 pid=2746 execve guuid=e046b65e-1a00-0000-64f1-13c5c10a0000 pid=2753 /usr/bin/curl net send-data write-file guuid=31093136-1a00-0000-64f1-13c52b0a0000 pid=2603->guuid=e046b65e-1a00-0000-64f1-13c5c10a0000 pid=2753 execve guuid=e01c8162-1a00-0000-64f1-13c5cb0a0000 pid=2763 /usr/bin/chmod guuid=31093136-1a00-0000-64f1-13c52b0a0000 pid=2603->guuid=e01c8162-1a00-0000-64f1-13c5cb0a0000 pid=2763 execve guuid=89c7d262-1a00-0000-64f1-13c5cd0a0000 pid=2765 /home/sandbox/xnxnxnxnxnxnxnxnmipsxnxn guuid=31093136-1a00-0000-64f1-13c52b0a0000 pid=2603->guuid=89c7d262-1a00-0000-64f1-13c5cd0a0000 pid=2765 execve guuid=8e930f63-1a00-0000-64f1-13c5ce0a0000 pid=2766 /usr/bin/rm delete-file guuid=31093136-1a00-0000-64f1-13c52b0a0000 pid=2603->guuid=8e930f63-1a00-0000-64f1-13c5ce0a0000 pid=2766 execve guuid=d3e76463-1a00-0000-64f1-13c5d00a0000 pid=2768 /usr/bin/wget net send-data guuid=31093136-1a00-0000-64f1-13c52b0a0000 pid=2603->guuid=d3e76463-1a00-0000-64f1-13c5d00a0000 pid=2768 execve guuid=c60daa66-1a00-0000-64f1-13c5d80a0000 pid=2776 /usr/bin/curl net send-data write-file guuid=31093136-1a00-0000-64f1-13c52b0a0000 pid=2603->guuid=c60daa66-1a00-0000-64f1-13c5d80a0000 pid=2776 execve guuid=2b14fd78-1a00-0000-64f1-13c5f20a0000 pid=2802 /usr/bin/chmod guuid=31093136-1a00-0000-64f1-13c52b0a0000 pid=2603->guuid=2b14fd78-1a00-0000-64f1-13c5f20a0000 pid=2802 execve guuid=e7aa5379-1a00-0000-64f1-13c5f50a0000 pid=2805 /home/sandbox/xnxnxnxnxnxnxnxnor1kxnxn guuid=31093136-1a00-0000-64f1-13c52b0a0000 pid=2603->guuid=e7aa5379-1a00-0000-64f1-13c5f50a0000 pid=2805 execve guuid=c86cc779-1a00-0000-64f1-13c5f70a0000 pid=2807 /usr/bin/rm delete-file guuid=31093136-1a00-0000-64f1-13c52b0a0000 pid=2603->guuid=c86cc779-1a00-0000-64f1-13c5f70a0000 pid=2807 execve guuid=3f2f1d7a-1a00-0000-64f1-13c5f80a0000 pid=2808 /usr/bin/wget net send-data guuid=31093136-1a00-0000-64f1-13c52b0a0000 pid=2603->guuid=3f2f1d7a-1a00-0000-64f1-13c5f80a0000 pid=2808 execve guuid=c53a767d-1a00-0000-64f1-13c5000b0000 pid=2816 /usr/bin/curl net send-data write-file guuid=31093136-1a00-0000-64f1-13c52b0a0000 pid=2603->guuid=c53a767d-1a00-0000-64f1-13c5000b0000 pid=2816 execve guuid=16603081-1a00-0000-64f1-13c50a0b0000 pid=2826 /usr/bin/chmod guuid=31093136-1a00-0000-64f1-13c52b0a0000 pid=2603->guuid=16603081-1a00-0000-64f1-13c50a0b0000 pid=2826 execve guuid=cb889a81-1a00-0000-64f1-13c50c0b0000 pid=2828 /home/sandbox/xnxnxnxnxnxnxnxnpowerpcxnxn guuid=31093136-1a00-0000-64f1-13c52b0a0000 pid=2603->guuid=cb889a81-1a00-0000-64f1-13c50c0b0000 pid=2828 execve guuid=39cef681-1a00-0000-64f1-13c50e0b0000 pid=2830 /usr/bin/rm delete-file guuid=31093136-1a00-0000-64f1-13c52b0a0000 pid=2603->guuid=39cef681-1a00-0000-64f1-13c50e0b0000 pid=2830 execve guuid=6e033b82-1a00-0000-64f1-13c5100b0000 pid=2832 /usr/bin/wget net send-data guuid=31093136-1a00-0000-64f1-13c52b0a0000 pid=2603->guuid=6e033b82-1a00-0000-64f1-13c5100b0000 pid=2832 execve guuid=cf713284-1a00-0000-64f1-13c5130b0000 pid=2835 /usr/bin/curl net send-data write-file guuid=31093136-1a00-0000-64f1-13c52b0a0000 pid=2603->guuid=cf713284-1a00-0000-64f1-13c5130b0000 pid=2835 execve guuid=887e5e88-1a00-0000-64f1-13c5150b0000 pid=2837 /usr/bin/chmod guuid=31093136-1a00-0000-64f1-13c52b0a0000 pid=2603->guuid=887e5e88-1a00-0000-64f1-13c5150b0000 pid=2837 execve guuid=d0d4a288-1a00-0000-64f1-13c5160b0000 pid=2838 /home/sandbox/xnxnxnxnxnxnxnxnriscv32xnxn guuid=31093136-1a00-0000-64f1-13c52b0a0000 pid=2603->guuid=d0d4a288-1a00-0000-64f1-13c5160b0000 pid=2838 execve guuid=cfbadf88-1a00-0000-64f1-13c5180b0000 pid=2840 /usr/bin/rm delete-file guuid=31093136-1a00-0000-64f1-13c52b0a0000 pid=2603->guuid=cfbadf88-1a00-0000-64f1-13c5180b0000 pid=2840 execve guuid=d6206189-1a00-0000-64f1-13c51b0b0000 pid=2843 /usr/bin/wget net send-data guuid=31093136-1a00-0000-64f1-13c52b0a0000 pid=2603->guuid=d6206189-1a00-0000-64f1-13c51b0b0000 pid=2843 execve guuid=c571448c-1a00-0000-64f1-13c5220b0000 pid=2850 /usr/bin/curl net send-data write-file guuid=31093136-1a00-0000-64f1-13c52b0a0000 pid=2603->guuid=c571448c-1a00-0000-64f1-13c5220b0000 pid=2850 execve guuid=eb95ad90-1a00-0000-64f1-13c52f0b0000 pid=2863 /usr/bin/chmod guuid=31093136-1a00-0000-64f1-13c52b0a0000 pid=2603->guuid=eb95ad90-1a00-0000-64f1-13c52f0b0000 pid=2863 execve guuid=9f7a1891-1a00-0000-64f1-13c5310b0000 pid=2865 /home/sandbox/xnxnxnxnxnxnxnxnriscv64xnxn guuid=31093136-1a00-0000-64f1-13c52b0a0000 pid=2603->guuid=9f7a1891-1a00-0000-64f1-13c5310b0000 pid=2865 execve guuid=5e2a6991-1a00-0000-64f1-13c5330b0000 pid=2867 /usr/bin/rm delete-file guuid=31093136-1a00-0000-64f1-13c52b0a0000 pid=2603->guuid=5e2a6991-1a00-0000-64f1-13c5330b0000 pid=2867 execve guuid=899dae91-1a00-0000-64f1-13c5340b0000 pid=2868 /usr/bin/wget net send-data guuid=31093136-1a00-0000-64f1-13c52b0a0000 pid=2603->guuid=899dae91-1a00-0000-64f1-13c5340b0000 pid=2868 execve guuid=bc40af93-1a00-0000-64f1-13c5380b0000 pid=2872 /usr/bin/curl net send-data write-file guuid=31093136-1a00-0000-64f1-13c52b0a0000 pid=2603->guuid=bc40af93-1a00-0000-64f1-13c5380b0000 pid=2872 execve guuid=8451be96-1a00-0000-64f1-13c53e0b0000 pid=2878 /usr/bin/chmod guuid=31093136-1a00-0000-64f1-13c52b0a0000 pid=2603->guuid=8451be96-1a00-0000-64f1-13c53e0b0000 pid=2878 execve guuid=358f0897-1a00-0000-64f1-13c5400b0000 pid=2880 /home/sandbox/xnxnxnxnxnxnxnxnsh2xnxn guuid=31093136-1a00-0000-64f1-13c52b0a0000 pid=2603->guuid=358f0897-1a00-0000-64f1-13c5400b0000 pid=2880 execve guuid=4a9e4497-1a00-0000-64f1-13c5420b0000 pid=2882 /usr/bin/rm delete-file guuid=31093136-1a00-0000-64f1-13c52b0a0000 pid=2603->guuid=4a9e4497-1a00-0000-64f1-13c5420b0000 pid=2882 execve guuid=5d238a97-1a00-0000-64f1-13c5440b0000 pid=2884 /usr/bin/wget net send-data guuid=31093136-1a00-0000-64f1-13c52b0a0000 pid=2603->guuid=5d238a97-1a00-0000-64f1-13c5440b0000 pid=2884 execve guuid=d6cf6199-1a00-0000-64f1-13c5480b0000 pid=2888 /usr/bin/curl net send-data write-file guuid=31093136-1a00-0000-64f1-13c52b0a0000 pid=2603->guuid=d6cf6199-1a00-0000-64f1-13c5480b0000 pid=2888 execve guuid=d8dc539c-1a00-0000-64f1-13c5500b0000 pid=2896 /usr/bin/chmod guuid=31093136-1a00-0000-64f1-13c52b0a0000 pid=2603->guuid=d8dc539c-1a00-0000-64f1-13c5500b0000 pid=2896 execve guuid=9452b99c-1a00-0000-64f1-13c5510b0000 pid=2897 /home/sandbox/xnxnxnxnxnxnxnxnsh4xnxn guuid=31093136-1a00-0000-64f1-13c52b0a0000 pid=2603->guuid=9452b99c-1a00-0000-64f1-13c5510b0000 pid=2897 execve guuid=a986039d-1a00-0000-64f1-13c5520b0000 pid=2898 /usr/bin/rm delete-file guuid=31093136-1a00-0000-64f1-13c52b0a0000 pid=2603->guuid=a986039d-1a00-0000-64f1-13c5520b0000 pid=2898 execve guuid=e6554e9d-1a00-0000-64f1-13c5540b0000 pid=2900 /usr/bin/wget net send-data guuid=31093136-1a00-0000-64f1-13c52b0a0000 pid=2603->guuid=e6554e9d-1a00-0000-64f1-13c5540b0000 pid=2900 execve guuid=966e4a9f-1a00-0000-64f1-13c5590b0000 pid=2905 /usr/bin/curl net send-data write-file guuid=31093136-1a00-0000-64f1-13c52b0a0000 pid=2603->guuid=966e4a9f-1a00-0000-64f1-13c5590b0000 pid=2905 execve guuid=b30152ad-1a00-0000-64f1-13c57e0b0000 pid=2942 /usr/bin/chmod guuid=31093136-1a00-0000-64f1-13c52b0a0000 pid=2603->guuid=b30152ad-1a00-0000-64f1-13c57e0b0000 pid=2942 execve guuid=aff590ad-1a00-0000-64f1-13c5800b0000 pid=2944 /home/sandbox/xnxnxnxnxnxnxnxnx86_64xnxn guuid=31093136-1a00-0000-64f1-13c52b0a0000 pid=2603->guuid=aff590ad-1a00-0000-64f1-13c5800b0000 pid=2944 execve guuid=df87c1ad-1a00-0000-64f1-13c5810b0000 pid=2945 /usr/bin/rm delete-file guuid=31093136-1a00-0000-64f1-13c52b0a0000 pid=2603->guuid=df87c1ad-1a00-0000-64f1-13c5810b0000 pid=2945 execve 2c8fec87-7591-5336-932d-8eda95915330 84.21.173.41:80 guuid=d4b16536-1a00-0000-64f1-13c52d0a0000 pid=2605->2c8fec87-7591-5336-932d-8eda95915330 send: 159B guuid=46860d3a-1a00-0000-64f1-13c53a0a0000 pid=2618->2c8fec87-7591-5336-932d-8eda95915330 send: 108B guuid=8a37a144-1a00-0000-64f1-13c55f0a0000 pid=2655->2c8fec87-7591-5336-932d-8eda95915330 send: 156B guuid=9c4f6b46-1a00-0000-64f1-13c5660a0000 pid=2662->2c8fec87-7591-5336-932d-8eda95915330 send: 105B guuid=8794384b-1a00-0000-64f1-13c5770a0000 pid=2679->2c8fec87-7591-5336-932d-8eda95915330 send: 163B guuid=04c72d4e-1a00-0000-64f1-13c57e0a0000 pid=2686->2c8fec87-7591-5336-932d-8eda95915330 send: 112B guuid=f3b37552-1a00-0000-64f1-13c5900a0000 pid=2704->2c8fec87-7591-5336-932d-8eda95915330 send: 156B guuid=a62e2d54-1a00-0000-64f1-13c5960a0000 pid=2710->2c8fec87-7591-5336-932d-8eda95915330 send: 105B guuid=88fa5a57-1a00-0000-64f1-13c5a30a0000 pid=2723->2c8fec87-7591-5336-932d-8eda95915330 send: 162B guuid=51268059-1a00-0000-64f1-13c5ac0a0000 pid=2732->2c8fec87-7591-5336-932d-8eda95915330 send: 111B guuid=733a8e5c-1a00-0000-64f1-13c5ba0a0000 pid=2746->2c8fec87-7591-5336-932d-8eda95915330 send: 156B guuid=e046b65e-1a00-0000-64f1-13c5c10a0000 pid=2753->2c8fec87-7591-5336-932d-8eda95915330 send: 105B guuid=d3e76463-1a00-0000-64f1-13c5d00a0000 pid=2768->2c8fec87-7591-5336-932d-8eda95915330 send: 156B guuid=c60daa66-1a00-0000-64f1-13c5d80a0000 pid=2776->2c8fec87-7591-5336-932d-8eda95915330 send: 105B guuid=3f2f1d7a-1a00-0000-64f1-13c5f80a0000 pid=2808->2c8fec87-7591-5336-932d-8eda95915330 send: 159B guuid=c53a767d-1a00-0000-64f1-13c5000b0000 pid=2816->2c8fec87-7591-5336-932d-8eda95915330 send: 108B guuid=6e033b82-1a00-0000-64f1-13c5100b0000 pid=2832->2c8fec87-7591-5336-932d-8eda95915330 send: 159B guuid=cf713284-1a00-0000-64f1-13c5130b0000 pid=2835->2c8fec87-7591-5336-932d-8eda95915330 send: 108B guuid=d6206189-1a00-0000-64f1-13c51b0b0000 pid=2843->2c8fec87-7591-5336-932d-8eda95915330 send: 159B guuid=c571448c-1a00-0000-64f1-13c5220b0000 pid=2850->2c8fec87-7591-5336-932d-8eda95915330 send: 108B guuid=899dae91-1a00-0000-64f1-13c5340b0000 pid=2868->2c8fec87-7591-5336-932d-8eda95915330 send: 155B guuid=bc40af93-1a00-0000-64f1-13c5380b0000 pid=2872->2c8fec87-7591-5336-932d-8eda95915330 send: 104B guuid=5d238a97-1a00-0000-64f1-13c5440b0000 pid=2884->2c8fec87-7591-5336-932d-8eda95915330 send: 155B guuid=d6cf6199-1a00-0000-64f1-13c5480b0000 pid=2888->2c8fec87-7591-5336-932d-8eda95915330 send: 104B guuid=e6554e9d-1a00-0000-64f1-13c5540b0000 pid=2900->2c8fec87-7591-5336-932d-8eda95915330 send: 158B guuid=966e4a9f-1a00-0000-64f1-13c5590b0000 pid=2905->2c8fec87-7591-5336-932d-8eda95915330 send: 107B
Score:
99%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/3d59cdeb5d1ca179797367de5ccd8923041851875e997cb6900d434ceeb64abe
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3d59cdeb5d1ca179797367de5ccd8923041851875e997cb6900d434ceeb64abe/
Verdict:
Malicious
Threat:
Trojan-Downloader.Shell.Agent
Link:
https://tip.neiki.dev/file/3d59cdeb5d1ca179797367de5ccd8923041851875e997cb6900d434ceeb64abe
Threat name:
Linux.Downloader.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-02-22 09:29:17 UTC
File Type:
Text (Shell)
AV detection:
6 of 24 (25.00%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hvm43225dsqxs6ltm7pfztmjemcbqumhl2mxznuqbvbuz3vwjk7a._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/260222-lf2r9sew3h/
Behaviour
Modifies registry class
Suspicious use of SetWindowsHookEx
Enumerates physical storage devices
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/3d59cdeb5d1ca179797367de5ccd8923041851875e997cb6900d434ceeb64abe

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 3d59cdeb5d1ca179797367de5ccd8923041851875e997cb6900d434ceeb64abe

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3782725/
  
Delivery method
Distributed via web download

Comments