MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 42bf45811ef88b4cbbde334f34197beca2836a38a6d2ba45d7c9f4ec60937450. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 42bf45811ef88b4cbbde334f34197beca2836a38a6d2ba45d7c9f4ec60937450
SHA3-384 hash: 2f09010a9f909a49a32ef0adb949b32fabbe9773fd797d5a2fffe67115c50cf16d51f784b438f9e7ae4cf32b289286eb
SHA1 hash: 8d068c6084e396e3cdc1165d2804e7cc84ec7d91
MD5 hash: 9a3f48f036e88ea454956e3b06bd265b
humanhash: blue-oklahoma-wisconsin-speaker
File name:p
Download: download sample
File size:827 bytes
First seen:2026-07-02 20:21:07 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkaNCRERFCEQ4r3FChXBY8Cf84n/lC+lauD:kXCKysE2hi0ziQvZohaNXj3yLPsJ7
TLSH T11E01A6C68201AD00802ADA1E639B61D0B411C3CF1A4B0B687FDC5A3EFB8CC14F066FE8
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://129.121.114.124/Yexn/an/aelf ua-wget
http://129.121.114.124/5ukn/an/aelf ua-wget
http://129.121.114.124/76Gn/an/aelf ua-wget
http://129.121.114.124/rXFn/an/aelf ua-wget
http://129.121.114.124/OErn/an/aelf ua-wget

Intelligence

File Origin
# of uploads :
1
# of downloads :
93
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
downloader evasive mirai
Link:
https://www.filescan.io/uploads/6a46c8495033028bea3bb68e/reports/0351ec88-af45-4b66-9ade-a03cc3f61cb2/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-07-02T17:26:00Z UTC
Last seen:
2026-07-04T17:15:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan-Downloader.Shell.Agent.a
Link:
https://opentip.kaspersky.com/42bf45811ef88b4cbbde334f34197beca2836a38a6d2ba45d7c9f4ec60937450/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/aa245745-e526-4dae-99c6-1e9c9df48d33
Behavior Graph:
Download SVG
%3 guuid=2cf74f79-1900-0000-a562-13e52b140000 pid=5163 /usr/bin/sudo guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164 /tmp/sample.bin write-file guuid=2cf74f79-1900-0000-a562-13e52b140000 pid=5163->guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164 execve guuid=ca38af7c-1900-0000-a562-13e52d140000 pid=5165 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=ca38af7c-1900-0000-a562-13e52d140000 pid=5165 execve guuid=57a17f7d-1900-0000-a562-13e52e140000 pid=5166 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=57a17f7d-1900-0000-a562-13e52e140000 pid=5166 execve guuid=d146057e-1900-0000-a562-13e52f140000 pid=5167 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=d146057e-1900-0000-a562-13e52f140000 pid=5167 execve guuid=5f788c7e-1900-0000-a562-13e530140000 pid=5168 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=5f788c7e-1900-0000-a562-13e530140000 pid=5168 execve guuid=8c37127f-1900-0000-a562-13e531140000 pid=5169 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=8c37127f-1900-0000-a562-13e531140000 pid=5169 execve guuid=8ff3967f-1900-0000-a562-13e532140000 pid=5170 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=8ff3967f-1900-0000-a562-13e532140000 pid=5170 execve guuid=43bb1080-1900-0000-a562-13e533140000 pid=5171 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=43bb1080-1900-0000-a562-13e533140000 pid=5171 execve guuid=d6829680-1900-0000-a562-13e534140000 pid=5172 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=d6829680-1900-0000-a562-13e534140000 pid=5172 execve guuid=7d1a2181-1900-0000-a562-13e535140000 pid=5173 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=7d1a2181-1900-0000-a562-13e535140000 pid=5173 execve guuid=e418aa81-1900-0000-a562-13e536140000 pid=5174 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=e418aa81-1900-0000-a562-13e536140000 pid=5174 execve guuid=f3152b82-1900-0000-a562-13e537140000 pid=5175 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=f3152b82-1900-0000-a562-13e537140000 pid=5175 execve guuid=2dbaad82-1900-0000-a562-13e538140000 pid=5176 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=2dbaad82-1900-0000-a562-13e538140000 pid=5176 execve guuid=25783183-1900-0000-a562-13e539140000 pid=5177 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=25783183-1900-0000-a562-13e539140000 pid=5177 execve guuid=f08bab83-1900-0000-a562-13e53a140000 pid=5178 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=f08bab83-1900-0000-a562-13e53a140000 pid=5178 execve guuid=b7b11784-1900-0000-a562-13e53b140000 pid=5179 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=b7b11784-1900-0000-a562-13e53b140000 pid=5179 execve guuid=94378f84-1900-0000-a562-13e53c140000 pid=5180 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=94378f84-1900-0000-a562-13e53c140000 pid=5180 execve guuid=8393ff84-1900-0000-a562-13e53d140000 pid=5181 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=8393ff84-1900-0000-a562-13e53d140000 pid=5181 execve guuid=46e07285-1900-0000-a562-13e53e140000 pid=5182 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=46e07285-1900-0000-a562-13e53e140000 pid=5182 execve guuid=6f84dc85-1900-0000-a562-13e53f140000 pid=5183 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=6f84dc85-1900-0000-a562-13e53f140000 pid=5183 execve guuid=32e86986-1900-0000-a562-13e540140000 pid=5184 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=32e86986-1900-0000-a562-13e540140000 pid=5184 execve guuid=6793f986-1900-0000-a562-13e541140000 pid=5185 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=6793f986-1900-0000-a562-13e541140000 pid=5185 execve guuid=96388787-1900-0000-a562-13e542140000 pid=5186 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=96388787-1900-0000-a562-13e542140000 pid=5186 execve guuid=22781988-1900-0000-a562-13e543140000 pid=5187 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=22781988-1900-0000-a562-13e543140000 pid=5187 execve guuid=0df4a888-1900-0000-a562-13e544140000 pid=5188 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=0df4a888-1900-0000-a562-13e544140000 pid=5188 execve guuid=edce3d89-1900-0000-a562-13e545140000 pid=5189 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=edce3d89-1900-0000-a562-13e545140000 pid=5189 execve guuid=f38ebe89-1900-0000-a562-13e546140000 pid=5190 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=f38ebe89-1900-0000-a562-13e546140000 pid=5190 execve guuid=96271f8a-1900-0000-a562-13e547140000 pid=5191 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=96271f8a-1900-0000-a562-13e547140000 pid=5191 execve guuid=c9207b8a-1900-0000-a562-13e548140000 pid=5192 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=c9207b8a-1900-0000-a562-13e548140000 pid=5192 execve guuid=9296d38a-1900-0000-a562-13e549140000 pid=5193 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=9296d38a-1900-0000-a562-13e549140000 pid=5193 execve guuid=c52f2c8b-1900-0000-a562-13e54a140000 pid=5194 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=c52f2c8b-1900-0000-a562-13e54a140000 pid=5194 execve guuid=8eb47e8b-1900-0000-a562-13e54b140000 pid=5195 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=8eb47e8b-1900-0000-a562-13e54b140000 pid=5195 execve guuid=f344cf8b-1900-0000-a562-13e54c140000 pid=5196 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=f344cf8b-1900-0000-a562-13e54c140000 pid=5196 execve guuid=91c2258c-1900-0000-a562-13e54d140000 pid=5197 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=91c2258c-1900-0000-a562-13e54d140000 pid=5197 execve guuid=4d187d8c-1900-0000-a562-13e54e140000 pid=5198 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=4d187d8c-1900-0000-a562-13e54e140000 pid=5198 execve guuid=c249d68c-1900-0000-a562-13e54f140000 pid=5199 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=c249d68c-1900-0000-a562-13e54f140000 pid=5199 execve guuid=4c0d338d-1900-0000-a562-13e550140000 pid=5200 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=4c0d338d-1900-0000-a562-13e550140000 pid=5200 execve guuid=d4168d8d-1900-0000-a562-13e551140000 pid=5201 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=d4168d8d-1900-0000-a562-13e551140000 pid=5201 execve guuid=f680fc8d-1900-0000-a562-13e552140000 pid=5202 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=f680fc8d-1900-0000-a562-13e552140000 pid=5202 execve guuid=c5ef5a8e-1900-0000-a562-13e553140000 pid=5203 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=c5ef5a8e-1900-0000-a562-13e553140000 pid=5203 execve guuid=c8d2ba8e-1900-0000-a562-13e554140000 pid=5204 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=c8d2ba8e-1900-0000-a562-13e554140000 pid=5204 execve guuid=11e8198f-1900-0000-a562-13e555140000 pid=5205 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=11e8198f-1900-0000-a562-13e555140000 pid=5205 execve guuid=4cb37f8f-1900-0000-a562-13e556140000 pid=5206 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=4cb37f8f-1900-0000-a562-13e556140000 pid=5206 execve guuid=8e8ed98f-1900-0000-a562-13e557140000 pid=5207 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=8e8ed98f-1900-0000-a562-13e557140000 pid=5207 execve guuid=8c873c90-1900-0000-a562-13e558140000 pid=5208 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=8c873c90-1900-0000-a562-13e558140000 pid=5208 execve guuid=a6d09f90-1900-0000-a562-13e559140000 pid=5209 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=a6d09f90-1900-0000-a562-13e559140000 pid=5209 execve guuid=00d10991-1900-0000-a562-13e55a140000 pid=5210 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=00d10991-1900-0000-a562-13e55a140000 pid=5210 execve guuid=3b0c7691-1900-0000-a562-13e55b140000 pid=5211 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=3b0c7691-1900-0000-a562-13e55b140000 pid=5211 execve guuid=63f6da91-1900-0000-a562-13e55c140000 pid=5212 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=63f6da91-1900-0000-a562-13e55c140000 pid=5212 execve guuid=bcdf3292-1900-0000-a562-13e55d140000 pid=5213 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=bcdf3292-1900-0000-a562-13e55d140000 pid=5213 execve guuid=e4418f92-1900-0000-a562-13e55e140000 pid=5214 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=e4418f92-1900-0000-a562-13e55e140000 pid=5214 execve guuid=c849e792-1900-0000-a562-13e55f140000 pid=5215 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=c849e792-1900-0000-a562-13e55f140000 pid=5215 execve guuid=87134193-1900-0000-a562-13e560140000 pid=5216 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=87134193-1900-0000-a562-13e560140000 pid=5216 execve guuid=b0c39893-1900-0000-a562-13e561140000 pid=5217 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=b0c39893-1900-0000-a562-13e561140000 pid=5217 execve guuid=d1daf993-1900-0000-a562-13e562140000 pid=5218 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=d1daf993-1900-0000-a562-13e562140000 pid=5218 execve guuid=4c316194-1900-0000-a562-13e563140000 pid=5219 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=4c316194-1900-0000-a562-13e563140000 pid=5219 execve guuid=2315c694-1900-0000-a562-13e564140000 pid=5220 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=2315c694-1900-0000-a562-13e564140000 pid=5220 execve guuid=02db2e95-1900-0000-a562-13e565140000 pid=5221 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=02db2e95-1900-0000-a562-13e565140000 pid=5221 execve guuid=3d769095-1900-0000-a562-13e566140000 pid=5222 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=3d769095-1900-0000-a562-13e566140000 pid=5222 execve guuid=d4d9f095-1900-0000-a562-13e567140000 pid=5223 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=d4d9f095-1900-0000-a562-13e567140000 pid=5223 execve guuid=26225996-1900-0000-a562-13e568140000 pid=5224 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=26225996-1900-0000-a562-13e568140000 pid=5224 execve guuid=f662cd96-1900-0000-a562-13e569140000 pid=5225 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=f662cd96-1900-0000-a562-13e569140000 pid=5225 execve guuid=cadc4397-1900-0000-a562-13e56a140000 pid=5226 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=cadc4397-1900-0000-a562-13e56a140000 pid=5226 execve guuid=6176db97-1900-0000-a562-13e56b140000 pid=5227 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=6176db97-1900-0000-a562-13e56b140000 pid=5227 execve guuid=181c4e98-1900-0000-a562-13e56c140000 pid=5228 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=181c4e98-1900-0000-a562-13e56c140000 pid=5228 execve guuid=4f6ec098-1900-0000-a562-13e56d140000 pid=5229 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=4f6ec098-1900-0000-a562-13e56d140000 pid=5229 execve guuid=51e43399-1900-0000-a562-13e56e140000 pid=5230 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=51e43399-1900-0000-a562-13e56e140000 pid=5230 execve guuid=fe19a999-1900-0000-a562-13e56f140000 pid=5231 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=fe19a999-1900-0000-a562-13e56f140000 pid=5231 execve guuid=88b2129a-1900-0000-a562-13e570140000 pid=5232 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=88b2129a-1900-0000-a562-13e570140000 pid=5232 execve guuid=f03a869a-1900-0000-a562-13e571140000 pid=5233 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=f03a869a-1900-0000-a562-13e571140000 pid=5233 execve guuid=deb8ef9a-1900-0000-a562-13e572140000 pid=5234 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=deb8ef9a-1900-0000-a562-13e572140000 pid=5234 execve guuid=147c5f9b-1900-0000-a562-13e573140000 pid=5235 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=147c5f9b-1900-0000-a562-13e573140000 pid=5235 execve guuid=d62bd29b-1900-0000-a562-13e574140000 pid=5236 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=d62bd29b-1900-0000-a562-13e574140000 pid=5236 execve guuid=86de359c-1900-0000-a562-13e575140000 pid=5237 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=86de359c-1900-0000-a562-13e575140000 pid=5237 execve guuid=54779c9c-1900-0000-a562-13e576140000 pid=5238 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=54779c9c-1900-0000-a562-13e576140000 pid=5238 execve guuid=7763389d-1900-0000-a562-13e577140000 pid=5239 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=7763389d-1900-0000-a562-13e577140000 pid=5239 execve guuid=8a3ab79d-1900-0000-a562-13e578140000 pid=5240 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=8a3ab79d-1900-0000-a562-13e578140000 pid=5240 execve guuid=0f752d9e-1900-0000-a562-13e579140000 pid=5241 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=0f752d9e-1900-0000-a562-13e579140000 pid=5241 execve guuid=6770989e-1900-0000-a562-13e57a140000 pid=5242 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=6770989e-1900-0000-a562-13e57a140000 pid=5242 execve guuid=8bf81c9f-1900-0000-a562-13e57b140000 pid=5243 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=8bf81c9f-1900-0000-a562-13e57b140000 pid=5243 execve guuid=cac8849f-1900-0000-a562-13e57d140000 pid=5245 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=cac8849f-1900-0000-a562-13e57d140000 pid=5245 execve guuid=ac60ed9f-1900-0000-a562-13e57e140000 pid=5246 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=ac60ed9f-1900-0000-a562-13e57e140000 pid=5246 execve guuid=7c9866a0-1900-0000-a562-13e57f140000 pid=5247 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=7c9866a0-1900-0000-a562-13e57f140000 pid=5247 execve guuid=69c4daa0-1900-0000-a562-13e580140000 pid=5248 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=69c4daa0-1900-0000-a562-13e580140000 pid=5248 execve guuid=0b1441a1-1900-0000-a562-13e582140000 pid=5250 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=0b1441a1-1900-0000-a562-13e582140000 pid=5250 execve guuid=f31db8a1-1900-0000-a562-13e584140000 pid=5252 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=f31db8a1-1900-0000-a562-13e584140000 pid=5252 execve guuid=132fa1a2-1900-0000-a562-13e586140000 pid=5254 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=132fa1a2-1900-0000-a562-13e586140000 pid=5254 execve guuid=d7675da3-1900-0000-a562-13e587140000 pid=5255 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=d7675da3-1900-0000-a562-13e587140000 pid=5255 execve guuid=3f07d0a3-1900-0000-a562-13e588140000 pid=5256 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=3f07d0a3-1900-0000-a562-13e588140000 pid=5256 execve guuid=96f832a4-1900-0000-a562-13e589140000 pid=5257 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=96f832a4-1900-0000-a562-13e589140000 pid=5257 execve guuid=d945b5a4-1900-0000-a562-13e58a140000 pid=5258 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=d945b5a4-1900-0000-a562-13e58a140000 pid=5258 execve guuid=17b3afa6-1900-0000-a562-13e58b140000 pid=5259 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=17b3afa6-1900-0000-a562-13e58b140000 pid=5259 execve guuid=7933f4a7-1900-0000-a562-13e58f140000 pid=5263 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=7933f4a7-1900-0000-a562-13e58f140000 pid=5263 execve guuid=518b29a9-1900-0000-a562-13e590140000 pid=5264 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=518b29a9-1900-0000-a562-13e590140000 pid=5264 execve guuid=7ac1f6a9-1900-0000-a562-13e591140000 pid=5265 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=7ac1f6a9-1900-0000-a562-13e591140000 pid=5265 execve guuid=7c8684aa-1900-0000-a562-13e592140000 pid=5266 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=7c8684aa-1900-0000-a562-13e592140000 pid=5266 execve guuid=214708ab-1900-0000-a562-13e593140000 pid=5267 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=214708ab-1900-0000-a562-13e593140000 pid=5267 execve guuid=8e4e91ab-1900-0000-a562-13e594140000 pid=5268 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=8e4e91ab-1900-0000-a562-13e594140000 pid=5268 execve guuid=b8ba10ac-1900-0000-a562-13e595140000 pid=5269 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=b8ba10ac-1900-0000-a562-13e595140000 pid=5269 execve guuid=0d3aa2ac-1900-0000-a562-13e596140000 pid=5270 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=0d3aa2ac-1900-0000-a562-13e596140000 pid=5270 execve guuid=72e239ad-1900-0000-a562-13e597140000 pid=5271 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=72e239ad-1900-0000-a562-13e597140000 pid=5271 execve guuid=bf1ec5ad-1900-0000-a562-13e598140000 pid=5272 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=bf1ec5ad-1900-0000-a562-13e598140000 pid=5272 execve guuid=440047ae-1900-0000-a562-13e599140000 pid=5273 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=440047ae-1900-0000-a562-13e599140000 pid=5273 execve guuid=9bc2c7ae-1900-0000-a562-13e59a140000 pid=5274 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=9bc2c7ae-1900-0000-a562-13e59a140000 pid=5274 execve guuid=37914caf-1900-0000-a562-13e59b140000 pid=5275 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=37914caf-1900-0000-a562-13e59b140000 pid=5275 execve guuid=f05134b0-1900-0000-a562-13e59c140000 pid=5276 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=f05134b0-1900-0000-a562-13e59c140000 pid=5276 execve guuid=9996b5b0-1900-0000-a562-13e59d140000 pid=5277 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=9996b5b0-1900-0000-a562-13e59d140000 pid=5277 execve guuid=7c8b3ab1-1900-0000-a562-13e59e140000 pid=5278 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=7c8b3ab1-1900-0000-a562-13e59e140000 pid=5278 execve guuid=872ec9b1-1900-0000-a562-13e59f140000 pid=5279 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=872ec9b1-1900-0000-a562-13e59f140000 pid=5279 execve guuid=b7884fb2-1900-0000-a562-13e5a0140000 pid=5280 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=b7884fb2-1900-0000-a562-13e5a0140000 pid=5280 execve guuid=096edab2-1900-0000-a562-13e5a1140000 pid=5281 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=096edab2-1900-0000-a562-13e5a1140000 pid=5281 execve guuid=634c65b3-1900-0000-a562-13e5a2140000 pid=5282 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=634c65b3-1900-0000-a562-13e5a2140000 pid=5282 execve guuid=bb74f7b3-1900-0000-a562-13e5a3140000 pid=5283 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=bb74f7b3-1900-0000-a562-13e5a3140000 pid=5283 execve guuid=8d3477b4-1900-0000-a562-13e5a4140000 pid=5284 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=8d3477b4-1900-0000-a562-13e5a4140000 pid=5284 execve guuid=e5ba09b5-1900-0000-a562-13e5a5140000 pid=5285 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=e5ba09b5-1900-0000-a562-13e5a5140000 pid=5285 execve guuid=c062a6b5-1900-0000-a562-13e5a6140000 pid=5286 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=c062a6b5-1900-0000-a562-13e5a6140000 pid=5286 execve guuid=5cc441b6-1900-0000-a562-13e5a7140000 pid=5287 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=5cc441b6-1900-0000-a562-13e5a7140000 pid=5287 execve guuid=3a1fd9b6-1900-0000-a562-13e5a8140000 pid=5288 /usr/bin/ls guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=3a1fd9b6-1900-0000-a562-13e5a8140000 pid=5288 execve guuid=a2d16eb7-1900-0000-a562-13e5a9140000 pid=5289 /usr/bin/rm guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=a2d16eb7-1900-0000-a562-13e5a9140000 pid=5289 execve guuid=f6aacbb7-1900-0000-a562-13e5aa140000 pid=5290 /usr/bin/wget net send-data write-file guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=f6aacbb7-1900-0000-a562-13e5aa140000 pid=5290 execve guuid=1642c0d1-1900-0000-a562-13e5ab140000 pid=5291 /usr/bin/chmod guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=1642c0d1-1900-0000-a562-13e5ab140000 pid=5291 execve guuid=a0cd6bd2-1900-0000-a562-13e5ac140000 pid=5292 /usr/bin/dash guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=a0cd6bd2-1900-0000-a562-13e5ac140000 pid=5292 clone guuid=0f8869d4-1900-0000-a562-13e5ae140000 pid=5294 /usr/bin/rm guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=0f8869d4-1900-0000-a562-13e5ae140000 pid=5294 execve guuid=d82bd0d4-1900-0000-a562-13e5af140000 pid=5295 /usr/bin/wget net send-data write-file guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=d82bd0d4-1900-0000-a562-13e5af140000 pid=5295 execve guuid=9f84b0ee-1900-0000-a562-13e5b0140000 pid=5296 /usr/bin/chmod guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=9f84b0ee-1900-0000-a562-13e5b0140000 pid=5296 execve guuid=96194eef-1900-0000-a562-13e5b1140000 pid=5297 /usr/bin/dash guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=96194eef-1900-0000-a562-13e5b1140000 pid=5297 clone guuid=62c8f5f4-1900-0000-a562-13e5b3140000 pid=5299 /usr/bin/rm guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=62c8f5f4-1900-0000-a562-13e5b3140000 pid=5299 execve guuid=33165bf5-1900-0000-a562-13e5b4140000 pid=5300 /usr/bin/wget net send-data write-file guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=33165bf5-1900-0000-a562-13e5b4140000 pid=5300 execve guuid=5d98f214-1a00-0000-a562-13e5b5140000 pid=5301 /usr/bin/chmod guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=5d98f214-1a00-0000-a562-13e5b5140000 pid=5301 execve guuid=1d654415-1a00-0000-a562-13e5b6140000 pid=5302 /usr/bin/dash guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=1d654415-1a00-0000-a562-13e5b6140000 pid=5302 clone guuid=d4f4df15-1a00-0000-a562-13e5b8140000 pid=5304 /usr/bin/rm guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=d4f4df15-1a00-0000-a562-13e5b8140000 pid=5304 execve guuid=3dfc2e16-1a00-0000-a562-13e5b9140000 pid=5305 /usr/bin/wget net send-data write-file guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=3dfc2e16-1a00-0000-a562-13e5b9140000 pid=5305 execve guuid=fbd17535-1a00-0000-a562-13e5ba140000 pid=5306 /usr/bin/chmod guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=fbd17535-1a00-0000-a562-13e5ba140000 pid=5306 execve guuid=4695e635-1a00-0000-a562-13e5bb140000 pid=5307 /usr/bin/dash guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=4695e635-1a00-0000-a562-13e5bb140000 pid=5307 clone guuid=d91cd036-1a00-0000-a562-13e5bd140000 pid=5309 /usr/bin/rm guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=d91cd036-1a00-0000-a562-13e5bd140000 pid=5309 execve guuid=79183437-1a00-0000-a562-13e5be140000 pid=5310 /usr/bin/wget net send-data write-file guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=79183437-1a00-0000-a562-13e5be140000 pid=5310 execve guuid=bad60855-1a00-0000-a562-13e5bf140000 pid=5311 /usr/bin/chmod guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=bad60855-1a00-0000-a562-13e5bf140000 pid=5311 execve guuid=05fd3557-1a00-0000-a562-13e5c0140000 pid=5312 /usr/bin/dash guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=05fd3557-1a00-0000-a562-13e5c0140000 pid=5312 clone guuid=a12d7058-1a00-0000-a562-13e5c2140000 pid=5314 /usr/bin/rm delete-file guuid=5f4b5f7c-1900-0000-a562-13e52c140000 pid=5164->guuid=a12d7058-1a00-0000-a562-13e5c2140000 pid=5314 execve 801186e6-5fe8-5959-a7b4-832d8d66e7aa 129.121.114.124:80 guuid=f6aacbb7-1900-0000-a562-13e5aa140000 pid=5290->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 133B guuid=d82bd0d4-1900-0000-a562-13e5af140000 pid=5295->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 133B guuid=33165bf5-1900-0000-a562-13e5b4140000 pid=5300->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 133B guuid=3dfc2e16-1a00-0000-a562-13e5b9140000 pid=5305->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 133B guuid=79183437-1a00-0000-a562-13e5be140000 pid=5310->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 133B
Score:
99%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/42bf45811ef88b4cbbde334f34197beca2836a38a6d2ba45d7c9f4ec60937450
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/42bf45811ef88b4cbbde334f34197beca2836a38a6d2ba45d7c9f4ec60937450/
Verdict:
Malicious
Threat:
Family.MIRAI
Link:
https://tip.neiki.dev/file/42bf45811ef88b4cbbde334f34197beca2836a38a6d2ba45d7c9f4ec60937450
Threat name:
Win32.Trojan.Malgent
Create hunting rule
Status:
Malicious
First seen:
2026-07-02 20:21:32 UTC
File Type:
Text (Shell)
AV detection:
9 of 23 (39.13%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ik7ulai67cfuzo66gnhtigl35srig2ryu3jluroxzh2oyyetoria._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
discovery linux
Link:
https://tria.ge/reports/260702-y48xpses31/
Behaviour
Reads runtime system information
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.26
Link:
https://yomi.yoroi.company/submissions/42bf45811ef88b4cbbde334f34197beca2836a38a6d2ba45d7c9f4ec60937450

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 42bf45811ef88b4cbbde334f34197beca2836a38a6d2ba45d7c9f4ec60937450

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3866369/
  
Delivery method
Distributed via web download

Comments