MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 45d6f69fbf1ef58e2d26c370ed52dd4ecf2f423ab2b48408264387652ecc80f5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 45d6f69fbf1ef58e2d26c370ed52dd4ecf2f423ab2b48408264387652ecc80f5
SHA3-384 hash: 88ab84c1b535c80a9fd221c04153b3d5e65eac24e9aa6d5619badce33ab5ec3d06ee9a75667f9aef82b9a7dd345bd1a6
SHA1 hash: dc405d56f408305ee6fc987620d51a2541c14b3a
MD5 hash: 802e6fcf9416fbafff40324e4d832ba1
humanhash: cardinal-mountain-batman-bacon
File name:ok
Download: download sample
File size:1'608 bytes
First seen:2026-08-24 09:19:56 UTC
Last seen:2026-08-25 07:12:36 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 24:r27miL4Dcuzpk/hmoIt1O6ZFzuLuL2iyIx/m:K7JL4WIfO67zuLZQe
TLSH T1C731679F02241A326002ED4E7363354876CDA5EB2D6FD7D589480FA9824D7CCF252F6D
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://5.182.210.174/f7b5dan/an/an/a
http://5.182.210.174/47c0e5n/an/an/a
http://5.182.210.174/1e8b7fn/an/an/a
http://5.182.210.174/f8722cn/an/an/a
http://5.182.210.174/b7ece2n/an/an/a
http://5.182.210.174/820081n/an/an/a
http://5.182.210.174/2d4256n/an/an/a
http://5.182.210.174/8ba499n/an/an/a
http://5.182.210.174/6fe0fbn/an/an/a
http://5.182.210.174/7f89ebn/an/an/a
http://5.182.210.174/18d01cn/an/an/a
http://5.182.210.174/91f71bn/an/an/a

Intelligence

File Origin
# of uploads :
3
# of downloads :
43
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive mirai
Link:
https://www.filescan.io/uploads/6a8c0ccebf2a0d3394532d66/reports/580b3ac1-dbcd-44ac-8b13-131f578ae302/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-08-24T07:35:00Z UTC
Last seen:
2026-08-25T23:28:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/45d6f69fbf1ef58e2d26c370ed52dd4ecf2f423ab2b48408264387652ecc80f5/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/b62b7282-9125-448f-a94a-ee07a05626e1
Behavior Graph:
Download SVG
%3 guuid=c497842b-1700-0000-0308-2c0f2c0e0000 pid=3628 /usr/bin/sudo guuid=5011742d-1700-0000-0308-2c0f320e0000 pid=3634 /tmp/sample.bin guuid=c497842b-1700-0000-0308-2c0f2c0e0000 pid=3628->guuid=5011742d-1700-0000-0308-2c0f320e0000 pid=3634 execve guuid=bb59c72d-1700-0000-0308-2c0f330e0000 pid=3635 /usr/bin/wget net send-data guuid=5011742d-1700-0000-0308-2c0f320e0000 pid=3634->guuid=bb59c72d-1700-0000-0308-2c0f330e0000 pid=3635 execve guuid=36761831-1700-0000-0308-2c0f3f0e0000 pid=3647 /usr/bin/curl net send-data write-file guuid=5011742d-1700-0000-0308-2c0f320e0000 pid=3634->guuid=36761831-1700-0000-0308-2c0f3f0e0000 pid=3647 execve guuid=45ce013a-1700-0000-0308-2c0f6c0e0000 pid=3692 /usr/bin/chmod guuid=5011742d-1700-0000-0308-2c0f320e0000 pid=3634->guuid=45ce013a-1700-0000-0308-2c0f6c0e0000 pid=3692 execve guuid=ae165a3a-1700-0000-0308-2c0f6e0e0000 pid=3694 /usr/bin/bash guuid=5011742d-1700-0000-0308-2c0f320e0000 pid=3634->guuid=ae165a3a-1700-0000-0308-2c0f6e0e0000 pid=3694 clone guuid=dd82bb3a-1700-0000-0308-2c0f750e0000 pid=3701 /usr/bin/rm delete-file guuid=5011742d-1700-0000-0308-2c0f320e0000 pid=3634->guuid=dd82bb3a-1700-0000-0308-2c0f750e0000 pid=3701 execve guuid=d7272b3b-1700-0000-0308-2c0f780e0000 pid=3704 /usr/bin/rm guuid=5011742d-1700-0000-0308-2c0f320e0000 pid=3634->guuid=d7272b3b-1700-0000-0308-2c0f780e0000 pid=3704 execve guuid=dfbe823b-1700-0000-0308-2c0f790e0000 pid=3705 /usr/bin/wget net send-data guuid=5011742d-1700-0000-0308-2c0f320e0000 pid=3634->guuid=dfbe823b-1700-0000-0308-2c0f790e0000 pid=3705 execve guuid=3a651c3e-1700-0000-0308-2c0f800e0000 pid=3712 /usr/bin/curl net send-data write-file guuid=5011742d-1700-0000-0308-2c0f320e0000 pid=3634->guuid=3a651c3e-1700-0000-0308-2c0f800e0000 pid=3712 execve guuid=53240643-1700-0000-0308-2c0f920e0000 pid=3730 /usr/bin/chmod guuid=5011742d-1700-0000-0308-2c0f320e0000 pid=3634->guuid=53240643-1700-0000-0308-2c0f920e0000 pid=3730 execve guuid=2fdc6143-1700-0000-0308-2c0f940e0000 pid=3732 /usr/bin/bash guuid=5011742d-1700-0000-0308-2c0f320e0000 pid=3634->guuid=2fdc6143-1700-0000-0308-2c0f940e0000 pid=3732 clone guuid=f351b043-1700-0000-0308-2c0f970e0000 pid=3735 /usr/bin/rm delete-file guuid=5011742d-1700-0000-0308-2c0f320e0000 pid=3634->guuid=f351b043-1700-0000-0308-2c0f970e0000 pid=3735 execve guuid=f53cff43-1700-0000-0308-2c0f990e0000 pid=3737 /usr/bin/rm guuid=5011742d-1700-0000-0308-2c0f320e0000 pid=3634->guuid=f53cff43-1700-0000-0308-2c0f990e0000 pid=3737 execve guuid=dcfd4944-1700-0000-0308-2c0f9a0e0000 pid=3738 /usr/bin/wget net send-data guuid=5011742d-1700-0000-0308-2c0f320e0000 pid=3634->guuid=dcfd4944-1700-0000-0308-2c0f9a0e0000 pid=3738 execve guuid=213cdf46-1700-0000-0308-2c0fa40e0000 pid=3748 /usr/bin/curl net send-data write-file guuid=5011742d-1700-0000-0308-2c0f320e0000 pid=3634->guuid=213cdf46-1700-0000-0308-2c0fa40e0000 pid=3748 execve guuid=023efe4a-1700-0000-0308-2c0fb80e0000 pid=3768 /usr/bin/chmod guuid=5011742d-1700-0000-0308-2c0f320e0000 pid=3634->guuid=023efe4a-1700-0000-0308-2c0fb80e0000 pid=3768 execve guuid=20ae774b-1700-0000-0308-2c0fbf0e0000 pid=3775 /usr/bin/bash guuid=5011742d-1700-0000-0308-2c0f320e0000 pid=3634->guuid=20ae774b-1700-0000-0308-2c0fbf0e0000 pid=3775 clone guuid=46efbe4b-1700-0000-0308-2c0fc10e0000 pid=3777 /usr/bin/rm delete-file guuid=5011742d-1700-0000-0308-2c0f320e0000 pid=3634->guuid=46efbe4b-1700-0000-0308-2c0fc10e0000 pid=3777 execve guuid=ac660a4c-1700-0000-0308-2c0fc40e0000 pid=3780 /usr/bin/rm guuid=5011742d-1700-0000-0308-2c0f320e0000 pid=3634->guuid=ac660a4c-1700-0000-0308-2c0fc40e0000 pid=3780 execve guuid=0e88514c-1700-0000-0308-2c0fc60e0000 pid=3782 /usr/bin/wget net send-data guuid=5011742d-1700-0000-0308-2c0f320e0000 pid=3634->guuid=0e88514c-1700-0000-0308-2c0fc60e0000 pid=3782 execve guuid=f6de064f-1700-0000-0308-2c0fd50e0000 pid=3797 /usr/bin/curl net send-data write-file guuid=5011742d-1700-0000-0308-2c0f320e0000 pid=3634->guuid=f6de064f-1700-0000-0308-2c0fd50e0000 pid=3797 execve guuid=f03af952-1700-0000-0308-2c0fe10e0000 pid=3809 /usr/bin/chmod guuid=5011742d-1700-0000-0308-2c0f320e0000 pid=3634->guuid=f03af952-1700-0000-0308-2c0fe10e0000 pid=3809 execve guuid=c4524e53-1700-0000-0308-2c0fe20e0000 pid=3810 /usr/bin/bash guuid=5011742d-1700-0000-0308-2c0f320e0000 pid=3634->guuid=c4524e53-1700-0000-0308-2c0fe20e0000 pid=3810 clone guuid=661d8753-1700-0000-0308-2c0fe50e0000 pid=3813 /usr/bin/rm delete-file guuid=5011742d-1700-0000-0308-2c0f320e0000 pid=3634->guuid=661d8753-1700-0000-0308-2c0fe50e0000 pid=3813 execve guuid=8268ce53-1700-0000-0308-2c0fe60e0000 pid=3814 /usr/bin/rm guuid=5011742d-1700-0000-0308-2c0f320e0000 pid=3634->guuid=8268ce53-1700-0000-0308-2c0fe60e0000 pid=3814 execve guuid=35d23554-1700-0000-0308-2c0fe90e0000 pid=3817 /usr/bin/wget net send-data guuid=5011742d-1700-0000-0308-2c0f320e0000 pid=3634->guuid=35d23554-1700-0000-0308-2c0fe90e0000 pid=3817 execve guuid=3f4eb456-1700-0000-0308-2c0ff60e0000 pid=3830 /usr/bin/curl net send-data write-file guuid=5011742d-1700-0000-0308-2c0f320e0000 pid=3634->guuid=3f4eb456-1700-0000-0308-2c0ff60e0000 pid=3830 execve guuid=75166b5a-1700-0000-0308-2c0f090f0000 pid=3849 /usr/bin/chmod guuid=5011742d-1700-0000-0308-2c0f320e0000 pid=3634->guuid=75166b5a-1700-0000-0308-2c0f090f0000 pid=3849 execve guuid=0b79b45a-1700-0000-0308-2c0f0b0f0000 pid=3851 /usr/bin/bash guuid=5011742d-1700-0000-0308-2c0f320e0000 pid=3634->guuid=0b79b45a-1700-0000-0308-2c0f0b0f0000 pid=3851 clone guuid=cf65f15a-1700-0000-0308-2c0f0e0f0000 pid=3854 /usr/bin/rm delete-file guuid=5011742d-1700-0000-0308-2c0f320e0000 pid=3634->guuid=cf65f15a-1700-0000-0308-2c0f0e0f0000 pid=3854 execve guuid=6f643d5b-1700-0000-0308-2c0f100f0000 pid=3856 /usr/bin/rm guuid=5011742d-1700-0000-0308-2c0f320e0000 pid=3634->guuid=6f643d5b-1700-0000-0308-2c0f100f0000 pid=3856 execve guuid=90b7855b-1700-0000-0308-2c0f120f0000 pid=3858 /usr/bin/wget net send-data guuid=5011742d-1700-0000-0308-2c0f320e0000 pid=3634->guuid=90b7855b-1700-0000-0308-2c0f120f0000 pid=3858 execve guuid=cc91035f-1700-0000-0308-2c0f1f0f0000 pid=3871 /usr/bin/curl net send-data write-file guuid=5011742d-1700-0000-0308-2c0f320e0000 pid=3634->guuid=cc91035f-1700-0000-0308-2c0f1f0f0000 pid=3871 execve guuid=fd5db964-1700-0000-0308-2c0f360f0000 pid=3894 /usr/bin/chmod guuid=5011742d-1700-0000-0308-2c0f320e0000 pid=3634->guuid=fd5db964-1700-0000-0308-2c0f360f0000 pid=3894 execve guuid=4cb1fc64-1700-0000-0308-2c0f380f0000 pid=3896 /usr/bin/bash guuid=5011742d-1700-0000-0308-2c0f320e0000 pid=3634->guuid=4cb1fc64-1700-0000-0308-2c0f380f0000 pid=3896 clone guuid=e92c3765-1700-0000-0308-2c0f3b0f0000 pid=3899 /usr/bin/rm delete-file guuid=5011742d-1700-0000-0308-2c0f320e0000 pid=3634->guuid=e92c3765-1700-0000-0308-2c0f3b0f0000 pid=3899 execve guuid=2b4e7a65-1700-0000-0308-2c0f3d0f0000 pid=3901 /usr/bin/rm guuid=5011742d-1700-0000-0308-2c0f320e0000 pid=3634->guuid=2b4e7a65-1700-0000-0308-2c0f3d0f0000 pid=3901 execve guuid=7104bb65-1700-0000-0308-2c0f3f0f0000 pid=3903 /usr/bin/wget net send-data guuid=5011742d-1700-0000-0308-2c0f320e0000 pid=3634->guuid=7104bb65-1700-0000-0308-2c0f3f0f0000 pid=3903 execve guuid=c79d9368-1700-0000-0308-2c0f4d0f0000 pid=3917 /usr/bin/curl net send-data write-file guuid=5011742d-1700-0000-0308-2c0f320e0000 pid=3634->guuid=c79d9368-1700-0000-0308-2c0f4d0f0000 pid=3917 execve guuid=62b1846f-1700-0000-0308-2c0f640f0000 pid=3940 /usr/bin/chmod guuid=5011742d-1700-0000-0308-2c0f320e0000 pid=3634->guuid=62b1846f-1700-0000-0308-2c0f640f0000 pid=3940 execve guuid=216cd06f-1700-0000-0308-2c0f660f0000 pid=3942 /usr/bin/bash guuid=5011742d-1700-0000-0308-2c0f320e0000 pid=3634->guuid=216cd06f-1700-0000-0308-2c0f660f0000 pid=3942 clone guuid=32dbfd6f-1700-0000-0308-2c0f690f0000 pid=3945 /usr/bin/rm delete-file guuid=5011742d-1700-0000-0308-2c0f320e0000 pid=3634->guuid=32dbfd6f-1700-0000-0308-2c0f690f0000 pid=3945 execve guuid=a7be4e70-1700-0000-0308-2c0f6b0f0000 pid=3947 /usr/bin/rm guuid=5011742d-1700-0000-0308-2c0f320e0000 pid=3634->guuid=a7be4e70-1700-0000-0308-2c0f6b0f0000 pid=3947 execve guuid=16698f70-1700-0000-0308-2c0f6c0f0000 pid=3948 /usr/bin/wget net send-data guuid=5011742d-1700-0000-0308-2c0f320e0000 pid=3634->guuid=16698f70-1700-0000-0308-2c0f6c0f0000 pid=3948 execve guuid=86c5fb72-1700-0000-0308-2c0f7b0f0000 pid=3963 /usr/bin/curl net send-data write-file guuid=5011742d-1700-0000-0308-2c0f320e0000 pid=3634->guuid=86c5fb72-1700-0000-0308-2c0f7b0f0000 pid=3963 execve guuid=ccc12777-1700-0000-0308-2c0f8b0f0000 pid=3979 /usr/bin/chmod guuid=5011742d-1700-0000-0308-2c0f320e0000 pid=3634->guuid=ccc12777-1700-0000-0308-2c0f8b0f0000 pid=3979 execve guuid=33948377-1700-0000-0308-2c0f8d0f0000 pid=3981 /usr/bin/bash guuid=5011742d-1700-0000-0308-2c0f320e0000 pid=3634->guuid=33948377-1700-0000-0308-2c0f8d0f0000 pid=3981 clone guuid=ab80cc77-1700-0000-0308-2c0f910f0000 pid=3985 /usr/bin/rm delete-file guuid=5011742d-1700-0000-0308-2c0f320e0000 pid=3634->guuid=ab80cc77-1700-0000-0308-2c0f910f0000 pid=3985 execve guuid=5da11878-1700-0000-0308-2c0f920f0000 pid=3986 /usr/bin/rm guuid=5011742d-1700-0000-0308-2c0f320e0000 pid=3634->guuid=5da11878-1700-0000-0308-2c0f920f0000 pid=3986 execve guuid=5ea66178-1700-0000-0308-2c0f930f0000 pid=3987 /usr/bin/wget net send-data guuid=5011742d-1700-0000-0308-2c0f320e0000 pid=3634->guuid=5ea66178-1700-0000-0308-2c0f930f0000 pid=3987 execve guuid=f978e57a-1700-0000-0308-2c0f9f0f0000 pid=3999 /usr/bin/curl net send-data write-file guuid=5011742d-1700-0000-0308-2c0f320e0000 pid=3634->guuid=f978e57a-1700-0000-0308-2c0f9f0f0000 pid=3999 execve guuid=4745b67e-1700-0000-0308-2c0fac0f0000 pid=4012 /usr/bin/chmod guuid=5011742d-1700-0000-0308-2c0f320e0000 pid=3634->guuid=4745b67e-1700-0000-0308-2c0fac0f0000 pid=4012 execve guuid=d00bed7e-1700-0000-0308-2c0fad0f0000 pid=4013 /usr/bin/bash guuid=5011742d-1700-0000-0308-2c0f320e0000 pid=3634->guuid=d00bed7e-1700-0000-0308-2c0fad0f0000 pid=4013 clone guuid=a725457f-1700-0000-0308-2c0fb10f0000 pid=4017 /usr/bin/rm delete-file guuid=5011742d-1700-0000-0308-2c0f320e0000 pid=3634->guuid=a725457f-1700-0000-0308-2c0fb10f0000 pid=4017 execve guuid=08af807f-1700-0000-0308-2c0fb30f0000 pid=4019 /usr/bin/rm guuid=5011742d-1700-0000-0308-2c0f320e0000 pid=3634->guuid=08af807f-1700-0000-0308-2c0fb30f0000 pid=4019 execve guuid=16b7b97f-1700-0000-0308-2c0fb50f0000 pid=4021 /usr/bin/wget net send-data guuid=5011742d-1700-0000-0308-2c0f320e0000 pid=3634->guuid=16b7b97f-1700-0000-0308-2c0fb50f0000 pid=4021 execve guuid=c3501482-1700-0000-0308-2c0fc20f0000 pid=4034 /usr/bin/curl net send-data write-file guuid=5011742d-1700-0000-0308-2c0f320e0000 pid=3634->guuid=c3501482-1700-0000-0308-2c0fc20f0000 pid=4034 execve guuid=10d2ac85-1700-0000-0308-2c0fd30f0000 pid=4051 /usr/bin/chmod guuid=5011742d-1700-0000-0308-2c0f320e0000 pid=3634->guuid=10d2ac85-1700-0000-0308-2c0fd30f0000 pid=4051 execve guuid=e3781f86-1700-0000-0308-2c0fd60f0000 pid=4054 /usr/bin/bash guuid=5011742d-1700-0000-0308-2c0f320e0000 pid=3634->guuid=e3781f86-1700-0000-0308-2c0fd60f0000 pid=4054 clone guuid=093e5086-1700-0000-0308-2c0fda0f0000 pid=4058 /usr/bin/rm delete-file guuid=5011742d-1700-0000-0308-2c0f320e0000 pid=3634->guuid=093e5086-1700-0000-0308-2c0fda0f0000 pid=4058 execve guuid=de078986-1700-0000-0308-2c0fdb0f0000 pid=4059 /usr/bin/rm guuid=5011742d-1700-0000-0308-2c0f320e0000 pid=3634->guuid=de078986-1700-0000-0308-2c0fdb0f0000 pid=4059 execve guuid=128ec286-1700-0000-0308-2c0fdf0f0000 pid=4063 /usr/bin/wget net send-data guuid=5011742d-1700-0000-0308-2c0f320e0000 pid=3634->guuid=128ec286-1700-0000-0308-2c0fdf0f0000 pid=4063 execve guuid=ff3b1989-1700-0000-0308-2c0fed0f0000 pid=4077 /usr/bin/curl net send-data write-file guuid=5011742d-1700-0000-0308-2c0f320e0000 pid=3634->guuid=ff3b1989-1700-0000-0308-2c0fed0f0000 pid=4077 execve guuid=326cd18e-1700-0000-0308-2c0f05100000 pid=4101 /usr/bin/chmod guuid=5011742d-1700-0000-0308-2c0f320e0000 pid=3634->guuid=326cd18e-1700-0000-0308-2c0f05100000 pid=4101 execve guuid=d9e3148f-1700-0000-0308-2c0f07100000 pid=4103 /usr/bin/bash guuid=5011742d-1700-0000-0308-2c0f320e0000 pid=3634->guuid=d9e3148f-1700-0000-0308-2c0f07100000 pid=4103 clone guuid=1b0c548f-1700-0000-0308-2c0f0a100000 pid=4106 /usr/bin/rm delete-file guuid=5011742d-1700-0000-0308-2c0f320e0000 pid=3634->guuid=1b0c548f-1700-0000-0308-2c0f0a100000 pid=4106 execve guuid=7d52968f-1700-0000-0308-2c0f0c100000 pid=4108 /usr/bin/rm guuid=5011742d-1700-0000-0308-2c0f320e0000 pid=3634->guuid=7d52968f-1700-0000-0308-2c0f0c100000 pid=4108 execve guuid=da4ed58f-1700-0000-0308-2c0f0e100000 pid=4110 /usr/bin/wget net send-data guuid=5011742d-1700-0000-0308-2c0f320e0000 pid=3634->guuid=da4ed58f-1700-0000-0308-2c0f0e100000 pid=4110 execve guuid=41714492-1700-0000-0308-2c0f12100000 pid=4114 /usr/bin/curl net send-data write-file guuid=5011742d-1700-0000-0308-2c0f320e0000 pid=3634->guuid=41714492-1700-0000-0308-2c0f12100000 pid=4114 execve guuid=46412596-1700-0000-0308-2c0f1c100000 pid=4124 /usr/bin/chmod guuid=5011742d-1700-0000-0308-2c0f320e0000 pid=3634->guuid=46412596-1700-0000-0308-2c0f1c100000 pid=4124 execve guuid=34988296-1700-0000-0308-2c0f1d100000 pid=4125 /usr/bin/bash guuid=5011742d-1700-0000-0308-2c0f320e0000 pid=3634->guuid=34988296-1700-0000-0308-2c0f1d100000 pid=4125 clone guuid=3cd5c496-1700-0000-0308-2c0f22100000 pid=4130 /usr/bin/rm delete-file guuid=5011742d-1700-0000-0308-2c0f320e0000 pid=3634->guuid=3cd5c496-1700-0000-0308-2c0f22100000 pid=4130 execve guuid=f9a10897-1700-0000-0308-2c0f23100000 pid=4131 /usr/bin/rm guuid=5011742d-1700-0000-0308-2c0f320e0000 pid=3634->guuid=f9a10897-1700-0000-0308-2c0f23100000 pid=4131 execve 5b654972-c9e1-50d8-b372-2dc2a5b9ad66 5.182.210.174:80 guuid=bb59c72d-1700-0000-0308-2c0f330e0000 pid=3635->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=36761831-1700-0000-0308-2c0f3f0e0000 pid=3647->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=bb10883a-1700-0000-0308-2c0f700e0000 pid=3696 /usr/bin/bash guuid=ae165a3a-1700-0000-0308-2c0f6e0e0000 pid=3694->guuid=bb10883a-1700-0000-0308-2c0f700e0000 pid=3696 clone guuid=dfbe823b-1700-0000-0308-2c0f790e0000 pid=3705->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=3a651c3e-1700-0000-0308-2c0f800e0000 pid=3712->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=5e7f8243-1700-0000-0308-2c0f950e0000 pid=3733 /usr/bin/bash guuid=2fdc6143-1700-0000-0308-2c0f940e0000 pid=3732->guuid=5e7f8243-1700-0000-0308-2c0f950e0000 pid=3733 clone guuid=dcfd4944-1700-0000-0308-2c0f9a0e0000 pid=3738->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=213cdf46-1700-0000-0308-2c0fa40e0000 pid=3748->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=4c40a04b-1700-0000-0308-2c0fc00e0000 pid=3776 /usr/bin/bash guuid=20ae774b-1700-0000-0308-2c0fbf0e0000 pid=3775->guuid=4c40a04b-1700-0000-0308-2c0fc00e0000 pid=3776 clone guuid=0e88514c-1700-0000-0308-2c0fc60e0000 pid=3782->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=f6de064f-1700-0000-0308-2c0fd50e0000 pid=3797->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=4b816853-1700-0000-0308-2c0fe30e0000 pid=3811 /usr/bin/bash guuid=c4524e53-1700-0000-0308-2c0fe20e0000 pid=3810->guuid=4b816853-1700-0000-0308-2c0fe30e0000 pid=3811 clone guuid=35d23554-1700-0000-0308-2c0fe90e0000 pid=3817->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=3f4eb456-1700-0000-0308-2c0ff60e0000 pid=3830->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=41e9cc5a-1700-0000-0308-2c0f0d0f0000 pid=3853 /usr/bin/bash guuid=0b79b45a-1700-0000-0308-2c0f0b0f0000 pid=3851->guuid=41e9cc5a-1700-0000-0308-2c0f0d0f0000 pid=3853 clone guuid=90b7855b-1700-0000-0308-2c0f120f0000 pid=3858->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=cc91035f-1700-0000-0308-2c0f1f0f0000 pid=3871->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=da4e1765-1700-0000-0308-2c0f390f0000 pid=3897 /usr/bin/bash guuid=4cb1fc64-1700-0000-0308-2c0f380f0000 pid=3896->guuid=da4e1765-1700-0000-0308-2c0f390f0000 pid=3897 clone guuid=7104bb65-1700-0000-0308-2c0f3f0f0000 pid=3903->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=c79d9368-1700-0000-0308-2c0f4d0f0000 pid=3917->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=ef2ce36f-1700-0000-0308-2c0f670f0000 pid=3943 /usr/bin/bash guuid=216cd06f-1700-0000-0308-2c0f660f0000 pid=3942->guuid=ef2ce36f-1700-0000-0308-2c0f670f0000 pid=3943 clone guuid=16698f70-1700-0000-0308-2c0f6c0f0000 pid=3948->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=86c5fb72-1700-0000-0308-2c0f7b0f0000 pid=3963->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=0b11a877-1700-0000-0308-2c0f900f0000 pid=3984 /usr/bin/bash guuid=33948377-1700-0000-0308-2c0f8d0f0000 pid=3981->guuid=0b11a877-1700-0000-0308-2c0f900f0000 pid=3984 clone guuid=5ea66178-1700-0000-0308-2c0f930f0000 pid=3987->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=f978e57a-1700-0000-0308-2c0f9f0f0000 pid=3999->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=54b2087f-1700-0000-0308-2c0faf0f0000 pid=4015 /usr/bin/bash guuid=d00bed7e-1700-0000-0308-2c0fad0f0000 pid=4013->guuid=54b2087f-1700-0000-0308-2c0faf0f0000 pid=4015 clone guuid=16b7b97f-1700-0000-0308-2c0fb50f0000 pid=4021->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=c3501482-1700-0000-0308-2c0fc20f0000 pid=4034->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=693f3686-1700-0000-0308-2c0fd90f0000 pid=4057 /usr/bin/bash guuid=e3781f86-1700-0000-0308-2c0fd60f0000 pid=4054->guuid=693f3686-1700-0000-0308-2c0fd90f0000 pid=4057 clone guuid=128ec286-1700-0000-0308-2c0fdf0f0000 pid=4063->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=ff3b1989-1700-0000-0308-2c0fed0f0000 pid=4077->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=bc4c328f-1700-0000-0308-2c0f09100000 pid=4105 /usr/bin/bash guuid=d9e3148f-1700-0000-0308-2c0f07100000 pid=4103->guuid=bc4c328f-1700-0000-0308-2c0f09100000 pid=4105 clone guuid=da4ed58f-1700-0000-0308-2c0f0e100000 pid=4110->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=41714492-1700-0000-0308-2c0f12100000 pid=4114->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=aaa99b96-1700-0000-0308-2c0f1e100000 pid=4126 /usr/bin/bash guuid=34988296-1700-0000-0308-2c0f1d100000 pid=4125->guuid=aaa99b96-1700-0000-0308-2c0f1e100000 pid=4126 clone
Score:
99%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/45d6f69fbf1ef58e2d26c370ed52dd4ecf2f423ab2b48408264387652ecc80f5
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/45d6f69fbf1ef58e2d26c370ed52dd4ecf2f423ab2b48408264387652ecc80f5/
Threat name:
Linux.Trojan.Egairtigado
Create hunting rule
Status:
Malicious
First seen:
2026-08-24 09:20:19 UTC
File Type:
Text (Shell)
AV detection:
13 of 24 (54.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ixlpnh57d32y4ljgynyo2uw5j3hs6qr2wk2iicbgiodwklwmqd2q._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260824-lavf1a1sfs/
Behaviour
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.11
Link:
https://yomi.yoroi.company/submissions/45d6f69fbf1ef58e2d26c370ed52dd4ecf2f423ab2b48408264387652ecc80f5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 45d6f69fbf1ef58e2d26c370ed52dd4ecf2f423ab2b48408264387652ecc80f5

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3897671/
  
Delivery method
Distributed via web download

Comments