🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3dc432e5248e4e9d60a5a948c9904d34965113ea01cee1e9ebc5d222b971454c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3dc432e5248e4e9d60a5a948c9904d34965113ea01cee1e9ebc5d222b971454c
SHA3-384 hash: 7b27614b21798aebd3c0e09f67caec4a4d81c82777042c5b8f65be00bcfc821c37ada5e81ead1a8fd4560ba0bed27236
SHA1 hash: 7bd1b42b7045652a3639f733d808572926ca914e
MD5 hash: c25d6e94c53cd044fa84e7bd7411db6d
humanhash: grey-alpha-wolfram-carbon
File name:ok
Download: download sample
File size:1'608 bytes
First seen:2026-08-26 20:59:24 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 12:UFG6FkHnI6naA09YA0A7B/L6B/ah+0e3x63Sa6SDkL6kB51RoIZz6AsRLd6QcBXo:tbI5N/8/ahp+coKp660H7jo
TLSH T14E3120DA06141E325102CE4D72B2394CE24D96E72C4FD7E4DE581FBD92886CCF162B5A
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://5.182.210.174/1d5605n/an/an/a
http://5.182.210.174/be4e34n/an/an/a
http://5.182.210.174/52e0e5n/an/an/a
http://5.182.210.174/a1b9cdn/an/an/a
http://5.182.210.174/eb785fn/an/an/a
http://5.182.210.174/ebbcf8n/an/an/a
http://5.182.210.174/4e888en/an/an/a
http://5.182.210.174/bcfe57n/an/an/a
http://5.182.210.174/384aaan/an/an/a
http://5.182.210.174/0b4100n/an/an/a
http://5.182.210.174/9728f2n/an/an/a
http://5.182.210.174/2e6d5an/an/an/a

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive mirai
Link:
https://www.filescan.io/uploads/6a8f53ed08e4020b0089087a/reports/64c606d0-89aa-4936-9e51-2d70483f25b8/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-08-26T18:15:00Z UTC
Last seen:
2026-08-27T18:07:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/3dc432e5248e4e9d60a5a948c9904d34965113ea01cee1e9ebc5d222b971454c/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/5f288b17-0086-4d22-9477-af0c8ec0999c
Behavior Graph:
Download SVG
%3 guuid=dad191b4-1600-0000-8664-06c7020d0000 pid=3330 /usr/bin/sudo guuid=261218b7-1600-0000-8664-06c70c0d0000 pid=3340 /tmp/sample.bin guuid=dad191b4-1600-0000-8664-06c7020d0000 pid=3330->guuid=261218b7-1600-0000-8664-06c70c0d0000 pid=3340 execve guuid=a47511b8-1600-0000-8664-06c7100d0000 pid=3344 /usr/bin/wget net send-data guuid=261218b7-1600-0000-8664-06c70c0d0000 pid=3340->guuid=a47511b8-1600-0000-8664-06c7100d0000 pid=3344 execve guuid=5d3e68bd-1600-0000-8664-06c7210d0000 pid=3361 /usr/bin/curl net send-data write-file guuid=261218b7-1600-0000-8664-06c70c0d0000 pid=3340->guuid=5d3e68bd-1600-0000-8664-06c7210d0000 pid=3361 execve guuid=4b9c62c5-1600-0000-8664-06c72f0d0000 pid=3375 /usr/bin/chmod guuid=261218b7-1600-0000-8664-06c70c0d0000 pid=3340->guuid=4b9c62c5-1600-0000-8664-06c72f0d0000 pid=3375 execve guuid=38eeafc5-1600-0000-8664-06c7300d0000 pid=3376 /usr/bin/bash guuid=261218b7-1600-0000-8664-06c70c0d0000 pid=3340->guuid=38eeafc5-1600-0000-8664-06c7300d0000 pid=3376 clone guuid=131e16c6-1600-0000-8664-06c7320d0000 pid=3378 /usr/bin/rm delete-file guuid=261218b7-1600-0000-8664-06c70c0d0000 pid=3340->guuid=131e16c6-1600-0000-8664-06c7320d0000 pid=3378 execve guuid=a9ab83c6-1600-0000-8664-06c7330d0000 pid=3379 /usr/bin/rm guuid=261218b7-1600-0000-8664-06c70c0d0000 pid=3340->guuid=a9ab83c6-1600-0000-8664-06c7330d0000 pid=3379 execve guuid=060ed0c6-1600-0000-8664-06c7340d0000 pid=3380 /usr/bin/wget net send-data guuid=261218b7-1600-0000-8664-06c70c0d0000 pid=3340->guuid=060ed0c6-1600-0000-8664-06c7340d0000 pid=3380 execve guuid=700e3cc9-1600-0000-8664-06c73e0d0000 pid=3390 /usr/bin/curl net send-data write-file guuid=261218b7-1600-0000-8664-06c70c0d0000 pid=3340->guuid=700e3cc9-1600-0000-8664-06c73e0d0000 pid=3390 execve guuid=ff9cc1cc-1600-0000-8664-06c7440d0000 pid=3396 /usr/bin/chmod guuid=261218b7-1600-0000-8664-06c70c0d0000 pid=3340->guuid=ff9cc1cc-1600-0000-8664-06c7440d0000 pid=3396 execve guuid=022121cd-1600-0000-8664-06c7460d0000 pid=3398 /usr/bin/bash guuid=261218b7-1600-0000-8664-06c70c0d0000 pid=3340->guuid=022121cd-1600-0000-8664-06c7460d0000 pid=3398 clone guuid=0f8965cd-1600-0000-8664-06c7490d0000 pid=3401 /usr/bin/rm delete-file guuid=261218b7-1600-0000-8664-06c70c0d0000 pid=3340->guuid=0f8965cd-1600-0000-8664-06c7490d0000 pid=3401 execve guuid=cb34a6cd-1600-0000-8664-06c74a0d0000 pid=3402 /usr/bin/rm guuid=261218b7-1600-0000-8664-06c70c0d0000 pid=3340->guuid=cb34a6cd-1600-0000-8664-06c74a0d0000 pid=3402 execve guuid=9d4ef2cd-1600-0000-8664-06c74c0d0000 pid=3404 /usr/bin/wget net send-data guuid=261218b7-1600-0000-8664-06c70c0d0000 pid=3340->guuid=9d4ef2cd-1600-0000-8664-06c74c0d0000 pid=3404 execve guuid=612163d0-1600-0000-8664-06c7500d0000 pid=3408 /usr/bin/curl net send-data write-file guuid=261218b7-1600-0000-8664-06c70c0d0000 pid=3340->guuid=612163d0-1600-0000-8664-06c7500d0000 pid=3408 execve guuid=7db0c6d5-1600-0000-8664-06c75c0d0000 pid=3420 /usr/bin/chmod guuid=261218b7-1600-0000-8664-06c70c0d0000 pid=3340->guuid=7db0c6d5-1600-0000-8664-06c75c0d0000 pid=3420 execve guuid=f5dd09d6-1600-0000-8664-06c75d0d0000 pid=3421 /usr/bin/bash guuid=261218b7-1600-0000-8664-06c70c0d0000 pid=3340->guuid=f5dd09d6-1600-0000-8664-06c75d0d0000 pid=3421 clone guuid=52a339d6-1600-0000-8664-06c75f0d0000 pid=3423 /usr/bin/rm delete-file guuid=261218b7-1600-0000-8664-06c70c0d0000 pid=3340->guuid=52a339d6-1600-0000-8664-06c75f0d0000 pid=3423 execve guuid=f2f3a2d6-1600-0000-8664-06c7620d0000 pid=3426 /usr/bin/rm guuid=261218b7-1600-0000-8664-06c70c0d0000 pid=3340->guuid=f2f3a2d6-1600-0000-8664-06c7620d0000 pid=3426 execve guuid=6f9bf2d6-1600-0000-8664-06c7640d0000 pid=3428 /usr/bin/wget net send-data guuid=261218b7-1600-0000-8664-06c70c0d0000 pid=3340->guuid=6f9bf2d6-1600-0000-8664-06c7640d0000 pid=3428 execve guuid=1b45f2d9-1600-0000-8664-06c7650d0000 pid=3429 /usr/bin/curl net send-data write-file guuid=261218b7-1600-0000-8664-06c70c0d0000 pid=3340->guuid=1b45f2d9-1600-0000-8664-06c7650d0000 pid=3429 execve guuid=88a0ebdf-1600-0000-8664-06c7720d0000 pid=3442 /usr/bin/chmod guuid=261218b7-1600-0000-8664-06c70c0d0000 pid=3340->guuid=88a0ebdf-1600-0000-8664-06c7720d0000 pid=3442 execve guuid=7a5cb5e0-1600-0000-8664-06c7760d0000 pid=3446 /usr/bin/bash guuid=261218b7-1600-0000-8664-06c70c0d0000 pid=3340->guuid=7a5cb5e0-1600-0000-8664-06c7760d0000 pid=3446 clone guuid=1da647e1-1600-0000-8664-06c77a0d0000 pid=3450 /usr/bin/rm delete-file guuid=261218b7-1600-0000-8664-06c70c0d0000 pid=3340->guuid=1da647e1-1600-0000-8664-06c77a0d0000 pid=3450 execve guuid=d627e7e1-1600-0000-8664-06c77d0d0000 pid=3453 /usr/bin/rm guuid=261218b7-1600-0000-8664-06c70c0d0000 pid=3340->guuid=d627e7e1-1600-0000-8664-06c77d0d0000 pid=3453 execve guuid=3a7b87e2-1600-0000-8664-06c7810d0000 pid=3457 /usr/bin/wget net send-data guuid=261218b7-1600-0000-8664-06c70c0d0000 pid=3340->guuid=3a7b87e2-1600-0000-8664-06c7810d0000 pid=3457 execve guuid=3e243ae6-1600-0000-8664-06c78d0d0000 pid=3469 /usr/bin/curl net send-data write-file guuid=261218b7-1600-0000-8664-06c70c0d0000 pid=3340->guuid=3e243ae6-1600-0000-8664-06c78d0d0000 pid=3469 execve guuid=bb63e5eb-1600-0000-8664-06c79a0d0000 pid=3482 /usr/bin/chmod guuid=261218b7-1600-0000-8664-06c70c0d0000 pid=3340->guuid=bb63e5eb-1600-0000-8664-06c79a0d0000 pid=3482 execve guuid=888f25ec-1600-0000-8664-06c79c0d0000 pid=3484 /usr/bin/bash guuid=261218b7-1600-0000-8664-06c70c0d0000 pid=3340->guuid=888f25ec-1600-0000-8664-06c79c0d0000 pid=3484 clone guuid=87d65aec-1600-0000-8664-06c79e0d0000 pid=3486 /usr/bin/rm delete-file guuid=261218b7-1600-0000-8664-06c70c0d0000 pid=3340->guuid=87d65aec-1600-0000-8664-06c79e0d0000 pid=3486 execve guuid=2a4b9fec-1600-0000-8664-06c7a00d0000 pid=3488 /usr/bin/rm guuid=261218b7-1600-0000-8664-06c70c0d0000 pid=3340->guuid=2a4b9fec-1600-0000-8664-06c7a00d0000 pid=3488 execve guuid=744ce1ec-1600-0000-8664-06c7a20d0000 pid=3490 /usr/bin/wget net send-data guuid=261218b7-1600-0000-8664-06c70c0d0000 pid=3340->guuid=744ce1ec-1600-0000-8664-06c7a20d0000 pid=3490 execve guuid=1c2547ef-1600-0000-8664-06c7aa0d0000 pid=3498 /usr/bin/curl net send-data write-file guuid=261218b7-1600-0000-8664-06c70c0d0000 pid=3340->guuid=1c2547ef-1600-0000-8664-06c7aa0d0000 pid=3498 execve guuid=cf9835f4-1600-0000-8664-06c7b70d0000 pid=3511 /usr/bin/chmod guuid=261218b7-1600-0000-8664-06c70c0d0000 pid=3340->guuid=cf9835f4-1600-0000-8664-06c7b70d0000 pid=3511 execve guuid=01e76df4-1600-0000-8664-06c7b90d0000 pid=3513 /usr/bin/bash guuid=261218b7-1600-0000-8664-06c70c0d0000 pid=3340->guuid=01e76df4-1600-0000-8664-06c7b90d0000 pid=3513 clone guuid=26f895f4-1600-0000-8664-06c7bb0d0000 pid=3515 /usr/bin/rm delete-file guuid=261218b7-1600-0000-8664-06c70c0d0000 pid=3340->guuid=26f895f4-1600-0000-8664-06c7bb0d0000 pid=3515 execve guuid=8116d3f4-1600-0000-8664-06c7bd0d0000 pid=3517 /usr/bin/rm guuid=261218b7-1600-0000-8664-06c70c0d0000 pid=3340->guuid=8116d3f4-1600-0000-8664-06c7bd0d0000 pid=3517 execve guuid=a9180af5-1600-0000-8664-06c7be0d0000 pid=3518 /usr/bin/wget net send-data guuid=261218b7-1600-0000-8664-06c70c0d0000 pid=3340->guuid=a9180af5-1600-0000-8664-06c7be0d0000 pid=3518 execve guuid=c17e1afb-1600-0000-8664-06c7c40d0000 pid=3524 /usr/bin/curl net send-data write-file guuid=261218b7-1600-0000-8664-06c70c0d0000 pid=3340->guuid=c17e1afb-1600-0000-8664-06c7c40d0000 pid=3524 execve guuid=2be8a403-1700-0000-8664-06c7d90d0000 pid=3545 /usr/bin/chmod guuid=261218b7-1600-0000-8664-06c70c0d0000 pid=3340->guuid=2be8a403-1700-0000-8664-06c7d90d0000 pid=3545 execve guuid=d6e31d04-1700-0000-8664-06c7da0d0000 pid=3546 /usr/bin/bash guuid=261218b7-1600-0000-8664-06c70c0d0000 pid=3340->guuid=d6e31d04-1700-0000-8664-06c7da0d0000 pid=3546 clone guuid=436c6d04-1700-0000-8664-06c7dc0d0000 pid=3548 /usr/bin/rm delete-file guuid=261218b7-1600-0000-8664-06c70c0d0000 pid=3340->guuid=436c6d04-1700-0000-8664-06c7dc0d0000 pid=3548 execve guuid=2976ce04-1700-0000-8664-06c7e00d0000 pid=3552 /usr/bin/rm guuid=261218b7-1600-0000-8664-06c70c0d0000 pid=3340->guuid=2976ce04-1700-0000-8664-06c7e00d0000 pid=3552 execve guuid=906f2505-1700-0000-8664-06c7e10d0000 pid=3553 /usr/bin/wget net send-data guuid=261218b7-1600-0000-8664-06c70c0d0000 pid=3340->guuid=906f2505-1700-0000-8664-06c7e10d0000 pid=3553 execve guuid=7b892608-1700-0000-8664-06c7eb0d0000 pid=3563 /usr/bin/curl net send-data write-file guuid=261218b7-1600-0000-8664-06c70c0d0000 pid=3340->guuid=7b892608-1700-0000-8664-06c7eb0d0000 pid=3563 execve guuid=48e7310d-1700-0000-8664-06c7fb0d0000 pid=3579 /usr/bin/chmod guuid=261218b7-1600-0000-8664-06c70c0d0000 pid=3340->guuid=48e7310d-1700-0000-8664-06c7fb0d0000 pid=3579 execve guuid=63cd970d-1700-0000-8664-06c7fd0d0000 pid=3581 /usr/bin/bash guuid=261218b7-1600-0000-8664-06c70c0d0000 pid=3340->guuid=63cd970d-1700-0000-8664-06c7fd0d0000 pid=3581 clone guuid=4d5de70d-1700-0000-8664-06c7010e0000 pid=3585 /usr/bin/rm delete-file guuid=261218b7-1600-0000-8664-06c70c0d0000 pid=3340->guuid=4d5de70d-1700-0000-8664-06c7010e0000 pid=3585 execve guuid=f748390e-1700-0000-8664-06c7030e0000 pid=3587 /usr/bin/rm guuid=261218b7-1600-0000-8664-06c70c0d0000 pid=3340->guuid=f748390e-1700-0000-8664-06c7030e0000 pid=3587 execve guuid=b6cf8c0e-1700-0000-8664-06c7040e0000 pid=3588 /usr/bin/wget net send-data guuid=261218b7-1600-0000-8664-06c70c0d0000 pid=3340->guuid=b6cf8c0e-1700-0000-8664-06c7040e0000 pid=3588 execve guuid=ef833811-1700-0000-8664-06c70a0e0000 pid=3594 /usr/bin/curl net send-data write-file guuid=261218b7-1600-0000-8664-06c70c0d0000 pid=3340->guuid=ef833811-1700-0000-8664-06c70a0e0000 pid=3594 execve guuid=de94a915-1700-0000-8664-06c7150e0000 pid=3605 /usr/bin/chmod guuid=261218b7-1600-0000-8664-06c70c0d0000 pid=3340->guuid=de94a915-1700-0000-8664-06c7150e0000 pid=3605 execve guuid=40a4ff15-1700-0000-8664-06c7160e0000 pid=3606 /usr/bin/bash guuid=261218b7-1600-0000-8664-06c70c0d0000 pid=3340->guuid=40a4ff15-1700-0000-8664-06c7160e0000 pid=3606 clone guuid=12723516-1700-0000-8664-06c7180e0000 pid=3608 /usr/bin/rm delete-file guuid=261218b7-1600-0000-8664-06c70c0d0000 pid=3340->guuid=12723516-1700-0000-8664-06c7180e0000 pid=3608 execve guuid=bc939416-1700-0000-8664-06c71a0e0000 pid=3610 /usr/bin/rm guuid=261218b7-1600-0000-8664-06c70c0d0000 pid=3340->guuid=bc939416-1700-0000-8664-06c71a0e0000 pid=3610 execve guuid=4920eb16-1700-0000-8664-06c71b0e0000 pid=3611 /usr/bin/wget net send-data guuid=261218b7-1600-0000-8664-06c70c0d0000 pid=3340->guuid=4920eb16-1700-0000-8664-06c71b0e0000 pid=3611 execve guuid=2df7fe19-1700-0000-8664-06c7210e0000 pid=3617 /usr/bin/curl net send-data write-file guuid=261218b7-1600-0000-8664-06c70c0d0000 pid=3340->guuid=2df7fe19-1700-0000-8664-06c7210e0000 pid=3617 execve guuid=d4baad25-1700-0000-8664-06c73e0e0000 pid=3646 /usr/bin/chmod guuid=261218b7-1600-0000-8664-06c70c0d0000 pid=3340->guuid=d4baad25-1700-0000-8664-06c73e0e0000 pid=3646 execve guuid=90f0f726-1700-0000-8664-06c7430e0000 pid=3651 /usr/bin/bash guuid=261218b7-1600-0000-8664-06c70c0d0000 pid=3340->guuid=90f0f726-1700-0000-8664-06c7430e0000 pid=3651 clone guuid=3f929727-1700-0000-8664-06c7480e0000 pid=3656 /usr/bin/rm delete-file guuid=261218b7-1600-0000-8664-06c70c0d0000 pid=3340->guuid=3f929727-1700-0000-8664-06c7480e0000 pid=3656 execve guuid=4713e127-1700-0000-8664-06c74a0e0000 pid=3658 /usr/bin/rm guuid=261218b7-1600-0000-8664-06c70c0d0000 pid=3340->guuid=4713e127-1700-0000-8664-06c74a0e0000 pid=3658 execve guuid=ad9f2528-1700-0000-8664-06c74c0e0000 pid=3660 /usr/bin/wget net send-data guuid=261218b7-1600-0000-8664-06c70c0d0000 pid=3340->guuid=ad9f2528-1700-0000-8664-06c74c0e0000 pid=3660 execve guuid=c8578f2a-1700-0000-8664-06c75b0e0000 pid=3675 /usr/bin/curl net send-data write-file guuid=261218b7-1600-0000-8664-06c70c0d0000 pid=3340->guuid=c8578f2a-1700-0000-8664-06c75b0e0000 pid=3675 execve guuid=e927182f-1700-0000-8664-06c76c0e0000 pid=3692 /usr/bin/chmod guuid=261218b7-1600-0000-8664-06c70c0d0000 pid=3340->guuid=e927182f-1700-0000-8664-06c76c0e0000 pid=3692 execve guuid=9185882f-1700-0000-8664-06c76d0e0000 pid=3693 /usr/bin/bash guuid=261218b7-1600-0000-8664-06c70c0d0000 pid=3340->guuid=9185882f-1700-0000-8664-06c76d0e0000 pid=3693 clone guuid=f408d82f-1700-0000-8664-06c76f0e0000 pid=3695 /usr/bin/rm delete-file guuid=261218b7-1600-0000-8664-06c70c0d0000 pid=3340->guuid=f408d82f-1700-0000-8664-06c76f0e0000 pid=3695 execve guuid=e8be4030-1700-0000-8664-06c7700e0000 pid=3696 /usr/bin/rm guuid=261218b7-1600-0000-8664-06c70c0d0000 pid=3340->guuid=e8be4030-1700-0000-8664-06c7700e0000 pid=3696 execve guuid=5447aa30-1700-0000-8664-06c7720e0000 pid=3698 /usr/bin/wget net send-data guuid=261218b7-1600-0000-8664-06c70c0d0000 pid=3340->guuid=5447aa30-1700-0000-8664-06c7720e0000 pid=3698 execve guuid=ad176133-1700-0000-8664-06c7780e0000 pid=3704 /usr/bin/curl net send-data write-file guuid=261218b7-1600-0000-8664-06c70c0d0000 pid=3340->guuid=ad176133-1700-0000-8664-06c7780e0000 pid=3704 execve guuid=71568a3c-1700-0000-8664-06c7880e0000 pid=3720 /usr/bin/chmod guuid=261218b7-1600-0000-8664-06c70c0d0000 pid=3340->guuid=71568a3c-1700-0000-8664-06c7880e0000 pid=3720 execve guuid=3077d03c-1700-0000-8664-06c78a0e0000 pid=3722 /usr/bin/bash guuid=261218b7-1600-0000-8664-06c70c0d0000 pid=3340->guuid=3077d03c-1700-0000-8664-06c78a0e0000 pid=3722 clone guuid=b405143d-1700-0000-8664-06c78d0e0000 pid=3725 /usr/bin/rm delete-file guuid=261218b7-1600-0000-8664-06c70c0d0000 pid=3340->guuid=b405143d-1700-0000-8664-06c78d0e0000 pid=3725 execve guuid=295c5d3d-1700-0000-8664-06c78f0e0000 pid=3727 /usr/bin/rm guuid=261218b7-1600-0000-8664-06c70c0d0000 pid=3340->guuid=295c5d3d-1700-0000-8664-06c78f0e0000 pid=3727 execve 5b654972-c9e1-50d8-b372-2dc2a5b9ad66 5.182.210.174:80 guuid=a47511b8-1600-0000-8664-06c7100d0000 pid=3344->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=5d3e68bd-1600-0000-8664-06c7210d0000 pid=3361->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=9554d9c5-1600-0000-8664-06c7310d0000 pid=3377 /usr/bin/bash guuid=38eeafc5-1600-0000-8664-06c7300d0000 pid=3376->guuid=9554d9c5-1600-0000-8664-06c7310d0000 pid=3377 clone guuid=060ed0c6-1600-0000-8664-06c7340d0000 pid=3380->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=700e3cc9-1600-0000-8664-06c73e0d0000 pid=3390->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=90f343cd-1600-0000-8664-06c7480d0000 pid=3400 /usr/bin/bash guuid=022121cd-1600-0000-8664-06c7460d0000 pid=3398->guuid=90f343cd-1600-0000-8664-06c7480d0000 pid=3400 clone guuid=9d4ef2cd-1600-0000-8664-06c74c0d0000 pid=3404->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=612163d0-1600-0000-8664-06c7500d0000 pid=3408->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=47a61cd6-1600-0000-8664-06c75e0d0000 pid=3422 /usr/bin/bash guuid=f5dd09d6-1600-0000-8664-06c75d0d0000 pid=3421->guuid=47a61cd6-1600-0000-8664-06c75e0d0000 pid=3422 clone guuid=6f9bf2d6-1600-0000-8664-06c7640d0000 pid=3428->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=1b45f2d9-1600-0000-8664-06c7650d0000 pid=3429->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=3e0ce3e0-1600-0000-8664-06c7780d0000 pid=3448 /usr/bin/bash guuid=7a5cb5e0-1600-0000-8664-06c7760d0000 pid=3446->guuid=3e0ce3e0-1600-0000-8664-06c7780d0000 pid=3448 clone guuid=3a7b87e2-1600-0000-8664-06c7810d0000 pid=3457->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=3e243ae6-1600-0000-8664-06c78d0d0000 pid=3469->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=42af3dec-1600-0000-8664-06c79d0d0000 pid=3485 /usr/bin/bash guuid=888f25ec-1600-0000-8664-06c79c0d0000 pid=3484->guuid=42af3dec-1600-0000-8664-06c79d0d0000 pid=3485 clone guuid=744ce1ec-1600-0000-8664-06c7a20d0000 pid=3490->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=1c2547ef-1600-0000-8664-06c7aa0d0000 pid=3498->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=62fc7ff4-1600-0000-8664-06c7ba0d0000 pid=3514 /usr/bin/bash guuid=01e76df4-1600-0000-8664-06c7b90d0000 pid=3513->guuid=62fc7ff4-1600-0000-8664-06c7ba0d0000 pid=3514 clone guuid=a9180af5-1600-0000-8664-06c7be0d0000 pid=3518->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=c17e1afb-1600-0000-8664-06c7c40d0000 pid=3524->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=e19a3c04-1700-0000-8664-06c7db0d0000 pid=3547 /usr/bin/bash guuid=d6e31d04-1700-0000-8664-06c7da0d0000 pid=3546->guuid=e19a3c04-1700-0000-8664-06c7db0d0000 pid=3547 clone guuid=906f2505-1700-0000-8664-06c7e10d0000 pid=3553->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=7b892608-1700-0000-8664-06c7eb0d0000 pid=3563->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=1c5fb70d-1700-0000-8664-06c7fe0d0000 pid=3582 /usr/bin/bash guuid=63cd970d-1700-0000-8664-06c7fd0d0000 pid=3581->guuid=1c5fb70d-1700-0000-8664-06c7fe0d0000 pid=3582 clone guuid=b6cf8c0e-1700-0000-8664-06c7040e0000 pid=3588->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=ef833811-1700-0000-8664-06c70a0e0000 pid=3594->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=35431a16-1700-0000-8664-06c7170e0000 pid=3607 /usr/bin/bash guuid=40a4ff15-1700-0000-8664-06c7160e0000 pid=3606->guuid=35431a16-1700-0000-8664-06c7170e0000 pid=3607 clone guuid=4920eb16-1700-0000-8664-06c71b0e0000 pid=3611->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=2df7fe19-1700-0000-8664-06c7210e0000 pid=3617->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=79175e27-1700-0000-8664-06c7450e0000 pid=3653 /usr/bin/bash guuid=90f0f726-1700-0000-8664-06c7430e0000 pid=3651->guuid=79175e27-1700-0000-8664-06c7450e0000 pid=3653 clone guuid=ad9f2528-1700-0000-8664-06c74c0e0000 pid=3660->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=c8578f2a-1700-0000-8664-06c75b0e0000 pid=3675->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=b98da92f-1700-0000-8664-06c76e0e0000 pid=3694 /usr/bin/bash guuid=9185882f-1700-0000-8664-06c76d0e0000 pid=3693->guuid=b98da92f-1700-0000-8664-06c76e0e0000 pid=3694 clone guuid=5447aa30-1700-0000-8664-06c7720e0000 pid=3698->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=ad176133-1700-0000-8664-06c7780e0000 pid=3704->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=53cfed3c-1700-0000-8664-06c78b0e0000 pid=3723 /usr/bin/bash guuid=3077d03c-1700-0000-8664-06c78a0e0000 pid=3722->guuid=53cfed3c-1700-0000-8664-06c78b0e0000 pid=3723 clone
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/3dc432e5248e4e9d60a5a948c9904d34965113ea01cee1e9ebc5d222b971454c
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3dc432e5248e4e9d60a5a948c9904d34965113ea01cee1e9ebc5d222b971454c/
Threat name:
Win32.Trojan.Egairtigado
Create hunting rule
Status:
Malicious
First seen:
2026-08-26 21:00:32 UTC
File Type:
Text (Shell)
AV detection:
12 of 23 (52.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hxcdfzjerzhj2yffvfemtecngslfce7kahhod2plyxjcfolrivga._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260826-zth4zafd22/
Behaviour
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.11
Link:
https://yomi.yoroi.company/submissions/3dc432e5248e4e9d60a5a948c9904d34965113ea01cee1e9ebc5d222b971454c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 3dc432e5248e4e9d60a5a948c9904d34965113ea01cee1e9ebc5d222b971454c

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3897671/
  
Delivery method
Distributed via web download

Comments