🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 40cb6cd334578a3a3f5569a5928fdae1ba4ee4bad1cdcb46c026a30b6af692eb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 40cb6cd334578a3a3f5569a5928fdae1ba4ee4bad1cdcb46c026a30b6af692eb
SHA3-384 hash: bac0cddf46e2cd16a3fe7d8dad7c20df33bda6ce2b15132fe15e0b4e722c3bb0955b7c9af97cea0d1351d30035581320
SHA1 hash: 371e8ce6d9d485190a143dfa5535aa165ead931d
MD5 hash: 859d519bc02dcb22dfcbe34a932b45f2
humanhash: uniform-magnesium-eight-papa
File name:ok
Download: download sample
File size:1'608 bytes
First seen:2026-09-05 03:51:22 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 12:U86OZpBsV6seANaci6D86D63NA6NX9OS6zk8lsDSs6SM9ThlaQ5m6aQ58RPDE36g:3hciYnsGk8lsWuM9a2k2wwFjcVuhBv
TLSH T16A310B9E05105A310443CE8E73B23148B28EE2EF1C9FD3D4DD494DAA92493DCF262B99
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://5.182.210.174/7ddd1an/an/an/a
http://5.182.210.174/3f5085n/an/an/a
http://5.182.210.174/a8403an/an/an/a
http://5.182.210.174/9d5be0n/an/an/a
http://5.182.210.174/841482n/an/an/a
http://5.182.210.174/b07eddn/an/an/a
http://5.182.210.174/b85a5dn/an/an/a
http://5.182.210.174/2088bcn/an/an/a
http://5.182.210.174/36f06dn/an/an/a
http://5.182.210.174/e5ede9n/an/an/a
http://5.182.210.174/1a01fbn/an/an/a
http://5.182.210.174/59d4dcn/an/an/a

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive mirai
Link:
https://www.filescan.io/uploads/6a9b91f0cd0dc11273e16516/reports/ec2a36f7-a4bf-4aa5-90ca-b121d0570399/overview
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/0c45879a-4d5c-4295-8fa4-08aa95883bfb
Behavior Graph:
Download SVG
%3 guuid=edede1f9-1500-0000-3d09-b78dc50b0000 pid=3013 /usr/bin/sudo guuid=3a85b9fb-1500-0000-3d09-b78dcb0b0000 pid=3019 /tmp/sample.bin guuid=edede1f9-1500-0000-3d09-b78dc50b0000 pid=3013->guuid=3a85b9fb-1500-0000-3d09-b78dcb0b0000 pid=3019 execve guuid=fb084bfc-1500-0000-3d09-b78dcd0b0000 pid=3021 /usr/bin/wget net send-data guuid=3a85b9fb-1500-0000-3d09-b78dcb0b0000 pid=3019->guuid=fb084bfc-1500-0000-3d09-b78dcd0b0000 pid=3021 execve guuid=56166a02-1600-0000-3d09-b78dd70b0000 pid=3031 /usr/bin/curl net send-data write-file guuid=3a85b9fb-1500-0000-3d09-b78dcb0b0000 pid=3019->guuid=56166a02-1600-0000-3d09-b78dd70b0000 pid=3031 execve guuid=e2e5f709-1600-0000-3d09-b78de70b0000 pid=3047 /usr/bin/chmod guuid=3a85b9fb-1500-0000-3d09-b78dcb0b0000 pid=3019->guuid=e2e5f709-1600-0000-3d09-b78de70b0000 pid=3047 execve guuid=5e62760a-1600-0000-3d09-b78de80b0000 pid=3048 /usr/bin/bash guuid=3a85b9fb-1500-0000-3d09-b78dcb0b0000 pid=3019->guuid=5e62760a-1600-0000-3d09-b78de80b0000 pid=3048 clone guuid=15eec60a-1600-0000-3d09-b78dea0b0000 pid=3050 /usr/bin/rm delete-file guuid=3a85b9fb-1500-0000-3d09-b78dcb0b0000 pid=3019->guuid=15eec60a-1600-0000-3d09-b78dea0b0000 pid=3050 execve guuid=1e54210b-1600-0000-3d09-b78deb0b0000 pid=3051 /usr/bin/rm guuid=3a85b9fb-1500-0000-3d09-b78dcb0b0000 pid=3019->guuid=1e54210b-1600-0000-3d09-b78deb0b0000 pid=3051 execve guuid=264f710b-1600-0000-3d09-b78ded0b0000 pid=3053 /usr/bin/wget net send-data guuid=3a85b9fb-1500-0000-3d09-b78dcb0b0000 pid=3019->guuid=264f710b-1600-0000-3d09-b78ded0b0000 pid=3053 execve guuid=3dd0830e-1600-0000-3d09-b78df40b0000 pid=3060 /usr/bin/curl net send-data write-file guuid=3a85b9fb-1500-0000-3d09-b78dcb0b0000 pid=3019->guuid=3dd0830e-1600-0000-3d09-b78df40b0000 pid=3060 execve guuid=2105fc11-1600-0000-3d09-b78dfb0b0000 pid=3067 /usr/bin/chmod guuid=3a85b9fb-1500-0000-3d09-b78dcb0b0000 pid=3019->guuid=2105fc11-1600-0000-3d09-b78dfb0b0000 pid=3067 execve guuid=2dde5112-1600-0000-3d09-b78dfc0b0000 pid=3068 /usr/bin/bash guuid=3a85b9fb-1500-0000-3d09-b78dcb0b0000 pid=3019->guuid=2dde5112-1600-0000-3d09-b78dfc0b0000 pid=3068 clone guuid=26739212-1600-0000-3d09-b78dfe0b0000 pid=3070 /usr/bin/rm delete-file guuid=3a85b9fb-1500-0000-3d09-b78dcb0b0000 pid=3019->guuid=26739212-1600-0000-3d09-b78dfe0b0000 pid=3070 execve guuid=2361ea12-1600-0000-3d09-b78dff0b0000 pid=3071 /usr/bin/rm guuid=3a85b9fb-1500-0000-3d09-b78dcb0b0000 pid=3019->guuid=2361ea12-1600-0000-3d09-b78dff0b0000 pid=3071 execve guuid=c03b9613-1600-0000-3d09-b78d000c0000 pid=3072 /usr/bin/wget net send-data guuid=3a85b9fb-1500-0000-3d09-b78dcb0b0000 pid=3019->guuid=c03b9613-1600-0000-3d09-b78d000c0000 pid=3072 execve guuid=87aacc17-1600-0000-3d09-b78d010c0000 pid=3073 /usr/bin/curl net send-data write-file guuid=3a85b9fb-1500-0000-3d09-b78dcb0b0000 pid=3019->guuid=87aacc17-1600-0000-3d09-b78d010c0000 pid=3073 execve guuid=96760123-1600-0000-3d09-b78d020c0000 pid=3074 /usr/bin/chmod guuid=3a85b9fb-1500-0000-3d09-b78dcb0b0000 pid=3019->guuid=96760123-1600-0000-3d09-b78d020c0000 pid=3074 execve guuid=88356623-1600-0000-3d09-b78d030c0000 pid=3075 /usr/bin/bash guuid=3a85b9fb-1500-0000-3d09-b78dcb0b0000 pid=3019->guuid=88356623-1600-0000-3d09-b78d030c0000 pid=3075 clone guuid=25d0bc23-1600-0000-3d09-b78d060c0000 pid=3078 /usr/bin/rm delete-file guuid=3a85b9fb-1500-0000-3d09-b78dcb0b0000 pid=3019->guuid=25d0bc23-1600-0000-3d09-b78d060c0000 pid=3078 execve guuid=7ccf1024-1600-0000-3d09-b78d070c0000 pid=3079 /usr/bin/rm guuid=3a85b9fb-1500-0000-3d09-b78dcb0b0000 pid=3019->guuid=7ccf1024-1600-0000-3d09-b78d070c0000 pid=3079 execve guuid=09267324-1600-0000-3d09-b78d0a0c0000 pid=3082 /usr/bin/wget net send-data guuid=3a85b9fb-1500-0000-3d09-b78dcb0b0000 pid=3019->guuid=09267324-1600-0000-3d09-b78d0a0c0000 pid=3082 execve guuid=7a12f927-1600-0000-3d09-b78d140c0000 pid=3092 /usr/bin/curl net send-data write-file guuid=3a85b9fb-1500-0000-3d09-b78dcb0b0000 pid=3019->guuid=7a12f927-1600-0000-3d09-b78d140c0000 pid=3092 execve guuid=d0afe82b-1600-0000-3d09-b78d1d0c0000 pid=3101 /usr/bin/chmod guuid=3a85b9fb-1500-0000-3d09-b78dcb0b0000 pid=3019->guuid=d0afe82b-1600-0000-3d09-b78d1d0c0000 pid=3101 execve guuid=4991712c-1600-0000-3d09-b78d200c0000 pid=3104 /usr/bin/bash guuid=3a85b9fb-1500-0000-3d09-b78dcb0b0000 pid=3019->guuid=4991712c-1600-0000-3d09-b78d200c0000 pid=3104 clone guuid=de28be2c-1600-0000-3d09-b78d220c0000 pid=3106 /usr/bin/rm delete-file guuid=3a85b9fb-1500-0000-3d09-b78dcb0b0000 pid=3019->guuid=de28be2c-1600-0000-3d09-b78d220c0000 pid=3106 execve guuid=d792252d-1600-0000-3d09-b78d240c0000 pid=3108 /usr/bin/rm guuid=3a85b9fb-1500-0000-3d09-b78dcb0b0000 pid=3019->guuid=d792252d-1600-0000-3d09-b78d240c0000 pid=3108 execve guuid=2f83742d-1600-0000-3d09-b78d260c0000 pid=3110 /usr/bin/wget net send-data guuid=3a85b9fb-1500-0000-3d09-b78dcb0b0000 pid=3019->guuid=2f83742d-1600-0000-3d09-b78d260c0000 pid=3110 execve guuid=293d0d30-1600-0000-3d09-b78d290c0000 pid=3113 /usr/bin/curl net send-data write-file guuid=3a85b9fb-1500-0000-3d09-b78dcb0b0000 pid=3019->guuid=293d0d30-1600-0000-3d09-b78d290c0000 pid=3113 execve guuid=27c7b234-1600-0000-3d09-b78d340c0000 pid=3124 /usr/bin/chmod guuid=3a85b9fb-1500-0000-3d09-b78dcb0b0000 pid=3019->guuid=27c7b234-1600-0000-3d09-b78d340c0000 pid=3124 execve guuid=efad0235-1600-0000-3d09-b78d350c0000 pid=3125 /usr/bin/bash guuid=3a85b9fb-1500-0000-3d09-b78dcb0b0000 pid=3019->guuid=efad0235-1600-0000-3d09-b78d350c0000 pid=3125 clone guuid=f8425835-1600-0000-3d09-b78d370c0000 pid=3127 /usr/bin/rm delete-file guuid=3a85b9fb-1500-0000-3d09-b78dcb0b0000 pid=3019->guuid=f8425835-1600-0000-3d09-b78d370c0000 pid=3127 execve guuid=f0bcb335-1600-0000-3d09-b78d380c0000 pid=3128 /usr/bin/rm guuid=3a85b9fb-1500-0000-3d09-b78dcb0b0000 pid=3019->guuid=f0bcb335-1600-0000-3d09-b78d380c0000 pid=3128 execve guuid=c31f1136-1600-0000-3d09-b78d390c0000 pid=3129 /usr/bin/wget net send-data guuid=3a85b9fb-1500-0000-3d09-b78dcb0b0000 pid=3019->guuid=c31f1136-1600-0000-3d09-b78d390c0000 pid=3129 execve guuid=94c8153a-1600-0000-3d09-b78d3a0c0000 pid=3130 /usr/bin/curl net send-data write-file guuid=3a85b9fb-1500-0000-3d09-b78dcb0b0000 pid=3019->guuid=94c8153a-1600-0000-3d09-b78d3a0c0000 pid=3130 execve guuid=63c6cb41-1600-0000-3d09-b78d3b0c0000 pid=3131 /usr/bin/chmod guuid=3a85b9fb-1500-0000-3d09-b78dcb0b0000 pid=3019->guuid=63c6cb41-1600-0000-3d09-b78d3b0c0000 pid=3131 execve guuid=7ee11b42-1600-0000-3d09-b78d3c0c0000 pid=3132 /usr/bin/bash guuid=3a85b9fb-1500-0000-3d09-b78dcb0b0000 pid=3019->guuid=7ee11b42-1600-0000-3d09-b78d3c0c0000 pid=3132 clone guuid=01136142-1600-0000-3d09-b78d3e0c0000 pid=3134 /usr/bin/rm delete-file guuid=3a85b9fb-1500-0000-3d09-b78dcb0b0000 pid=3019->guuid=01136142-1600-0000-3d09-b78d3e0c0000 pid=3134 execve guuid=0be5aa42-1600-0000-3d09-b78d400c0000 pid=3136 /usr/bin/rm guuid=3a85b9fb-1500-0000-3d09-b78dcb0b0000 pid=3019->guuid=0be5aa42-1600-0000-3d09-b78d400c0000 pid=3136 execve guuid=6096f042-1600-0000-3d09-b78d410c0000 pid=3137 /usr/bin/wget net send-data guuid=3a85b9fb-1500-0000-3d09-b78dcb0b0000 pid=3019->guuid=6096f042-1600-0000-3d09-b78d410c0000 pid=3137 execve guuid=07139b45-1600-0000-3d09-b78d490c0000 pid=3145 /usr/bin/curl net send-data write-file guuid=3a85b9fb-1500-0000-3d09-b78dcb0b0000 pid=3019->guuid=07139b45-1600-0000-3d09-b78d490c0000 pid=3145 execve guuid=9151bf49-1600-0000-3d09-b78d510c0000 pid=3153 /usr/bin/chmod guuid=3a85b9fb-1500-0000-3d09-b78dcb0b0000 pid=3019->guuid=9151bf49-1600-0000-3d09-b78d510c0000 pid=3153 execve guuid=a71c344a-1600-0000-3d09-b78d520c0000 pid=3154 /usr/bin/bash guuid=3a85b9fb-1500-0000-3d09-b78dcb0b0000 pid=3019->guuid=a71c344a-1600-0000-3d09-b78d520c0000 pid=3154 clone guuid=fb29824a-1600-0000-3d09-b78d550c0000 pid=3157 /usr/bin/rm delete-file guuid=3a85b9fb-1500-0000-3d09-b78dcb0b0000 pid=3019->guuid=fb29824a-1600-0000-3d09-b78d550c0000 pid=3157 execve guuid=cf6ed34a-1600-0000-3d09-b78d560c0000 pid=3158 /usr/bin/rm guuid=3a85b9fb-1500-0000-3d09-b78dcb0b0000 pid=3019->guuid=cf6ed34a-1600-0000-3d09-b78d560c0000 pid=3158 execve guuid=5552194b-1600-0000-3d09-b78d580c0000 pid=3160 /usr/bin/wget net send-data guuid=3a85b9fb-1500-0000-3d09-b78dcb0b0000 pid=3019->guuid=5552194b-1600-0000-3d09-b78d580c0000 pid=3160 execve guuid=e664934d-1600-0000-3d09-b78d5d0c0000 pid=3165 /usr/bin/curl net send-data write-file guuid=3a85b9fb-1500-0000-3d09-b78dcb0b0000 pid=3019->guuid=e664934d-1600-0000-3d09-b78d5d0c0000 pid=3165 execve guuid=a0693053-1600-0000-3d09-b78d5e0c0000 pid=3166 /usr/bin/chmod guuid=3a85b9fb-1500-0000-3d09-b78dcb0b0000 pid=3019->guuid=a0693053-1600-0000-3d09-b78d5e0c0000 pid=3166 execve guuid=7e9e7953-1600-0000-3d09-b78d5f0c0000 pid=3167 /usr/bin/bash guuid=3a85b9fb-1500-0000-3d09-b78dcb0b0000 pid=3019->guuid=7e9e7953-1600-0000-3d09-b78d5f0c0000 pid=3167 clone guuid=e9e5b353-1600-0000-3d09-b78d610c0000 pid=3169 /usr/bin/rm delete-file guuid=3a85b9fb-1500-0000-3d09-b78dcb0b0000 pid=3019->guuid=e9e5b353-1600-0000-3d09-b78d610c0000 pid=3169 execve guuid=5e64fb53-1600-0000-3d09-b78d620c0000 pid=3170 /usr/bin/rm guuid=3a85b9fb-1500-0000-3d09-b78dcb0b0000 pid=3019->guuid=5e64fb53-1600-0000-3d09-b78d620c0000 pid=3170 execve guuid=ff2a4154-1600-0000-3d09-b78d630c0000 pid=3171 /usr/bin/wget net send-data guuid=3a85b9fb-1500-0000-3d09-b78dcb0b0000 pid=3019->guuid=ff2a4154-1600-0000-3d09-b78d630c0000 pid=3171 execve guuid=38d1d556-1600-0000-3d09-b78d640c0000 pid=3172 /usr/bin/curl net send-data write-file guuid=3a85b9fb-1500-0000-3d09-b78dcb0b0000 pid=3019->guuid=38d1d556-1600-0000-3d09-b78d640c0000 pid=3172 execve guuid=f9b2b05a-1600-0000-3d09-b78d670c0000 pid=3175 /usr/bin/chmod guuid=3a85b9fb-1500-0000-3d09-b78dcb0b0000 pid=3019->guuid=f9b2b05a-1600-0000-3d09-b78d670c0000 pid=3175 execve guuid=7a50ea5a-1600-0000-3d09-b78d690c0000 pid=3177 /usr/bin/bash guuid=3a85b9fb-1500-0000-3d09-b78dcb0b0000 pid=3019->guuid=7a50ea5a-1600-0000-3d09-b78d690c0000 pid=3177 clone guuid=568a165b-1600-0000-3d09-b78d6b0c0000 pid=3179 /usr/bin/rm delete-file guuid=3a85b9fb-1500-0000-3d09-b78dcb0b0000 pid=3019->guuid=568a165b-1600-0000-3d09-b78d6b0c0000 pid=3179 execve guuid=6c7e4e5b-1600-0000-3d09-b78d6d0c0000 pid=3181 /usr/bin/rm guuid=3a85b9fb-1500-0000-3d09-b78dcb0b0000 pid=3019->guuid=6c7e4e5b-1600-0000-3d09-b78d6d0c0000 pid=3181 execve guuid=5bd7825b-1600-0000-3d09-b78d6e0c0000 pid=3182 /usr/bin/wget net send-data guuid=3a85b9fb-1500-0000-3d09-b78dcb0b0000 pid=3019->guuid=5bd7825b-1600-0000-3d09-b78d6e0c0000 pid=3182 execve guuid=22db1e5e-1600-0000-3d09-b78d750c0000 pid=3189 /usr/bin/curl net send-data write-file guuid=3a85b9fb-1500-0000-3d09-b78dcb0b0000 pid=3019->guuid=22db1e5e-1600-0000-3d09-b78d750c0000 pid=3189 execve guuid=e982a563-1600-0000-3d09-b78d810c0000 pid=3201 /usr/bin/chmod guuid=3a85b9fb-1500-0000-3d09-b78dcb0b0000 pid=3019->guuid=e982a563-1600-0000-3d09-b78d810c0000 pid=3201 execve guuid=9771e963-1600-0000-3d09-b78d820c0000 pid=3202 /usr/bin/bash guuid=3a85b9fb-1500-0000-3d09-b78dcb0b0000 pid=3019->guuid=9771e963-1600-0000-3d09-b78d820c0000 pid=3202 clone guuid=86841a64-1600-0000-3d09-b78d840c0000 pid=3204 /usr/bin/rm delete-file guuid=3a85b9fb-1500-0000-3d09-b78dcb0b0000 pid=3019->guuid=86841a64-1600-0000-3d09-b78d840c0000 pid=3204 execve guuid=c80c6664-1600-0000-3d09-b78d850c0000 pid=3205 /usr/bin/rm guuid=3a85b9fb-1500-0000-3d09-b78dcb0b0000 pid=3019->guuid=c80c6664-1600-0000-3d09-b78d850c0000 pid=3205 execve guuid=56cca364-1600-0000-3d09-b78d860c0000 pid=3206 /usr/bin/wget net send-data guuid=3a85b9fb-1500-0000-3d09-b78dcb0b0000 pid=3019->guuid=56cca364-1600-0000-3d09-b78d860c0000 pid=3206 execve guuid=9c9d8c67-1600-0000-3d09-b78d870c0000 pid=3207 /usr/bin/curl net send-data write-file guuid=3a85b9fb-1500-0000-3d09-b78dcb0b0000 pid=3019->guuid=9c9d8c67-1600-0000-3d09-b78d870c0000 pid=3207 execve guuid=b85ec46b-1600-0000-3d09-b78d890c0000 pid=3209 /usr/bin/chmod guuid=3a85b9fb-1500-0000-3d09-b78dcb0b0000 pid=3019->guuid=b85ec46b-1600-0000-3d09-b78d890c0000 pid=3209 execve guuid=4007176c-1600-0000-3d09-b78d8a0c0000 pid=3210 /usr/bin/bash guuid=3a85b9fb-1500-0000-3d09-b78dcb0b0000 pid=3019->guuid=4007176c-1600-0000-3d09-b78d8a0c0000 pid=3210 clone guuid=9e484d6c-1600-0000-3d09-b78d8d0c0000 pid=3213 /usr/bin/rm delete-file guuid=3a85b9fb-1500-0000-3d09-b78dcb0b0000 pid=3019->guuid=9e484d6c-1600-0000-3d09-b78d8d0c0000 pid=3213 execve guuid=523d906c-1600-0000-3d09-b78d8f0c0000 pid=3215 /usr/bin/rm guuid=3a85b9fb-1500-0000-3d09-b78dcb0b0000 pid=3019->guuid=523d906c-1600-0000-3d09-b78d8f0c0000 pid=3215 execve guuid=5aabd86c-1600-0000-3d09-b78d910c0000 pid=3217 /usr/bin/wget net send-data guuid=3a85b9fb-1500-0000-3d09-b78dcb0b0000 pid=3019->guuid=5aabd86c-1600-0000-3d09-b78d910c0000 pid=3217 execve guuid=1ece4f6f-1600-0000-3d09-b78d9b0c0000 pid=3227 /usr/bin/curl net send-data write-file guuid=3a85b9fb-1500-0000-3d09-b78dcb0b0000 pid=3019->guuid=1ece4f6f-1600-0000-3d09-b78d9b0c0000 pid=3227 execve guuid=13b85375-1600-0000-3d09-b78da60c0000 pid=3238 /usr/bin/chmod guuid=3a85b9fb-1500-0000-3d09-b78dcb0b0000 pid=3019->guuid=13b85375-1600-0000-3d09-b78da60c0000 pid=3238 execve guuid=75fac575-1600-0000-3d09-b78da80c0000 pid=3240 /usr/bin/bash guuid=3a85b9fb-1500-0000-3d09-b78dcb0b0000 pid=3019->guuid=75fac575-1600-0000-3d09-b78da80c0000 pid=3240 clone guuid=79800d76-1600-0000-3d09-b78dab0c0000 pid=3243 /usr/bin/rm delete-file guuid=3a85b9fb-1500-0000-3d09-b78dcb0b0000 pid=3019->guuid=79800d76-1600-0000-3d09-b78dab0c0000 pid=3243 execve guuid=558e5176-1600-0000-3d09-b78dad0c0000 pid=3245 /usr/bin/rm guuid=3a85b9fb-1500-0000-3d09-b78dcb0b0000 pid=3019->guuid=558e5176-1600-0000-3d09-b78dad0c0000 pid=3245 execve 5b654972-c9e1-50d8-b372-2dc2a5b9ad66 5.182.210.174:80 guuid=fb084bfc-1500-0000-3d09-b78dcd0b0000 pid=3021->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=56166a02-1600-0000-3d09-b78dd70b0000 pid=3031->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=b439900a-1600-0000-3d09-b78de90b0000 pid=3049 /usr/bin/bash guuid=5e62760a-1600-0000-3d09-b78de80b0000 pid=3048->guuid=b439900a-1600-0000-3d09-b78de90b0000 pid=3049 clone guuid=264f710b-1600-0000-3d09-b78ded0b0000 pid=3053->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=3dd0830e-1600-0000-3d09-b78df40b0000 pid=3060->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=f82f6d12-1600-0000-3d09-b78dfd0b0000 pid=3069 /usr/bin/bash guuid=2dde5112-1600-0000-3d09-b78dfc0b0000 pid=3068->guuid=f82f6d12-1600-0000-3d09-b78dfd0b0000 pid=3069 clone guuid=c03b9613-1600-0000-3d09-b78d000c0000 pid=3072->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=87aacc17-1600-0000-3d09-b78d010c0000 pid=3073->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=1e968d23-1600-0000-3d09-b78d040c0000 pid=3076 /usr/bin/bash guuid=88356623-1600-0000-3d09-b78d030c0000 pid=3075->guuid=1e968d23-1600-0000-3d09-b78d040c0000 pid=3076 clone guuid=09267324-1600-0000-3d09-b78d0a0c0000 pid=3082->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=7a12f927-1600-0000-3d09-b78d140c0000 pid=3092->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=ce84962c-1600-0000-3d09-b78d210c0000 pid=3105 /usr/bin/bash guuid=4991712c-1600-0000-3d09-b78d200c0000 pid=3104->guuid=ce84962c-1600-0000-3d09-b78d210c0000 pid=3105 clone guuid=2f83742d-1600-0000-3d09-b78d260c0000 pid=3110->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=293d0d30-1600-0000-3d09-b78d290c0000 pid=3113->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=36cb1f35-1600-0000-3d09-b78d360c0000 pid=3126 /usr/bin/bash guuid=efad0235-1600-0000-3d09-b78d350c0000 pid=3125->guuid=36cb1f35-1600-0000-3d09-b78d360c0000 pid=3126 clone guuid=c31f1136-1600-0000-3d09-b78d390c0000 pid=3129->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=94c8153a-1600-0000-3d09-b78d3a0c0000 pid=3130->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=54a93842-1600-0000-3d09-b78d3d0c0000 pid=3133 /usr/bin/bash guuid=7ee11b42-1600-0000-3d09-b78d3c0c0000 pid=3132->guuid=54a93842-1600-0000-3d09-b78d3d0c0000 pid=3133 clone guuid=6096f042-1600-0000-3d09-b78d410c0000 pid=3137->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=07139b45-1600-0000-3d09-b78d490c0000 pid=3145->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=ab814e4a-1600-0000-3d09-b78d530c0000 pid=3155 /usr/bin/bash guuid=a71c344a-1600-0000-3d09-b78d520c0000 pid=3154->guuid=ab814e4a-1600-0000-3d09-b78d530c0000 pid=3155 clone guuid=5552194b-1600-0000-3d09-b78d580c0000 pid=3160->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=e664934d-1600-0000-3d09-b78d5d0c0000 pid=3165->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=00489253-1600-0000-3d09-b78d600c0000 pid=3168 /usr/bin/bash guuid=7e9e7953-1600-0000-3d09-b78d5f0c0000 pid=3167->guuid=00489253-1600-0000-3d09-b78d600c0000 pid=3168 clone guuid=ff2a4154-1600-0000-3d09-b78d630c0000 pid=3171->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=38d1d556-1600-0000-3d09-b78d640c0000 pid=3172->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=fc47fc5a-1600-0000-3d09-b78d6a0c0000 pid=3178 /usr/bin/bash guuid=7a50ea5a-1600-0000-3d09-b78d690c0000 pid=3177->guuid=fc47fc5a-1600-0000-3d09-b78d6a0c0000 pid=3178 clone guuid=5bd7825b-1600-0000-3d09-b78d6e0c0000 pid=3182->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=22db1e5e-1600-0000-3d09-b78d750c0000 pid=3189->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=38fefc63-1600-0000-3d09-b78d830c0000 pid=3203 /usr/bin/bash guuid=9771e963-1600-0000-3d09-b78d820c0000 pid=3202->guuid=38fefc63-1600-0000-3d09-b78d830c0000 pid=3203 clone guuid=56cca364-1600-0000-3d09-b78d860c0000 pid=3206->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=9c9d8c67-1600-0000-3d09-b78d870c0000 pid=3207->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=bf91306c-1600-0000-3d09-b78d8c0c0000 pid=3212 /usr/bin/bash guuid=4007176c-1600-0000-3d09-b78d8a0c0000 pid=3210->guuid=bf91306c-1600-0000-3d09-b78d8c0c0000 pid=3212 clone guuid=5aabd86c-1600-0000-3d09-b78d910c0000 pid=3217->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=1ece4f6f-1600-0000-3d09-b78d9b0c0000 pid=3227->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=8fbae975-1600-0000-3d09-b78da90c0000 pid=3241 /usr/bin/bash guuid=75fac575-1600-0000-3d09-b78da80c0000 pid=3240->guuid=8fbae975-1600-0000-3d09-b78da90c0000 pid=3241 clone
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/40cb6cd334578a3a3f5569a5928fdae1ba4ee4bad1cdcb46c026a30b6af692eb
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/40cb6cd334578a3a3f5569a5928fdae1ba4ee4bad1cdcb46c026a30b6af692eb/
Gathering data
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=idfwzuzuk6fdup2vngszfd624g5e5zf22hg4wrwae2rqw2xwslvq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260905-ee672aszdt/
Behaviour
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.11
Link:
https://yomi.yoroi.company/submissions/40cb6cd334578a3a3f5569a5928fdae1ba4ee4bad1cdcb46c026a30b6af692eb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 40cb6cd334578a3a3f5569a5928fdae1ba4ee4bad1cdcb46c026a30b6af692eb

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3897671/
  
Delivery method
Distributed via web download

Comments