MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 472e2fe8dd6b666afc45ebf27ea82280e4926d0b658fe8e75bd8e707107dab46. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 472e2fe8dd6b666afc45ebf27ea82280e4926d0b658fe8e75bd8e707107dab46
SHA3-384 hash: 15617fa13f857c6f97fe5df7e551daaee753d17342bd953cc694e200de3b8f4f50ce1c46bfac675b292ddd32bf66b286
SHA1 hash: 516fe79b38b0aca0ab500a0571792f2d99d72682
MD5 hash: 143f3087236f0e6aa0527063b35acdb4
humanhash: berlin-steak-william-twenty
File name:472e2fe8dd6b666afc45ebf27ea82280e4926d0b658fe8e75bd8e707107dab46
Download: download sample
File size:1'584 bytes
First seen:2026-07-27 15:52:24 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 12:Ur46rQlr46V54xzx6zcIFMSjjK6KxVycZDM60fe26eJ9WDzDBCi6BCXDqXI6XYdN:TxEIvUvbEbW1DOnwXD+ffT2DNCT+B
TLSH T18531609B01140A755313DECE73A3319CB11C92FBA88BC791DD8C0EAD868868CB171FD6
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter Hassan_Pouladi
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://5.182.210.61/c41752n/an/aua-wget
http://5.182.210.61/c55748n/an/aua-wget
http://5.182.210.61/af1816n/an/aua-wget
http://5.182.210.61/574f6bn/an/aua-wget
http://5.182.210.61/1d7077n/an/aua-wget
http://5.182.210.61/e68974n/an/aua-wget
http://5.182.210.61/4f0ee7n/an/aua-wget
http://5.182.210.61/1f75c8n/an/aua-wget
http://5.182.210.61/60972bn/an/aua-wget
http://5.182.210.61/2cf376n/an/aua-wget
http://5.182.210.61/efdf59n/an/aua-wget
http://5.182.210.61/0c5eadn/an/aua-wget

Intelligence

File Origin
# of uploads :
1
# of downloads :
52
Origin country :
CA CA
Vendor Threat Intelligence
No detections
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-07-24T15:01:00Z UTC
Last seen:
2026-07-24T15:22:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/472e2fe8dd6b666afc45ebf27ea82280e4926d0b658fe8e75bd8e707107dab46/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/882a087f-b466-4888-83dc-9c29c1686a7c
Behavior Graph:
Download SVG
%3 guuid=b6df9cb4-1800-0000-00d5-2313160c0000 pid=3094 /usr/bin/sudo guuid=ace5b1b7-1800-0000-00d5-23131b0c0000 pid=3099 /tmp/sample.bin guuid=b6df9cb4-1800-0000-00d5-2313160c0000 pid=3094->guuid=ace5b1b7-1800-0000-00d5-23131b0c0000 pid=3099 execve guuid=46a654b8-1800-0000-00d5-23131c0c0000 pid=3100 /usr/bin/wget net send-data guuid=ace5b1b7-1800-0000-00d5-23131b0c0000 pid=3099->guuid=46a654b8-1800-0000-00d5-23131c0c0000 pid=3100 execve guuid=5c2657bc-1800-0000-00d5-2313220c0000 pid=3106 /usr/bin/curl net send-data write-file guuid=ace5b1b7-1800-0000-00d5-23131b0c0000 pid=3099->guuid=5c2657bc-1800-0000-00d5-2313220c0000 pid=3106 execve guuid=651b29c7-1800-0000-00d5-23132b0c0000 pid=3115 /usr/bin/chmod guuid=ace5b1b7-1800-0000-00d5-23131b0c0000 pid=3099->guuid=651b29c7-1800-0000-00d5-23132b0c0000 pid=3115 execve guuid=c1aac0c7-1800-0000-00d5-23132c0c0000 pid=3116 /usr/bin/bash guuid=ace5b1b7-1800-0000-00d5-23131b0c0000 pid=3099->guuid=c1aac0c7-1800-0000-00d5-23132c0c0000 pid=3116 clone guuid=78ee05c8-1800-0000-00d5-23132e0c0000 pid=3118 /usr/bin/rm delete-file guuid=ace5b1b7-1800-0000-00d5-23131b0c0000 pid=3099->guuid=78ee05c8-1800-0000-00d5-23132e0c0000 pid=3118 execve guuid=d29655c8-1800-0000-00d5-23132f0c0000 pid=3119 /usr/bin/rm guuid=ace5b1b7-1800-0000-00d5-23131b0c0000 pid=3099->guuid=d29655c8-1800-0000-00d5-23132f0c0000 pid=3119 execve guuid=0551a4c8-1800-0000-00d5-2313300c0000 pid=3120 /usr/bin/wget net send-data guuid=ace5b1b7-1800-0000-00d5-23131b0c0000 pid=3099->guuid=0551a4c8-1800-0000-00d5-2313300c0000 pid=3120 execve guuid=10d451cb-1800-0000-00d5-2313320c0000 pid=3122 /usr/bin/curl net send-data write-file guuid=ace5b1b7-1800-0000-00d5-23131b0c0000 pid=3099->guuid=10d451cb-1800-0000-00d5-2313320c0000 pid=3122 execve guuid=715a02d0-1800-0000-00d5-23133a0c0000 pid=3130 /usr/bin/chmod guuid=ace5b1b7-1800-0000-00d5-23131b0c0000 pid=3099->guuid=715a02d0-1800-0000-00d5-23133a0c0000 pid=3130 execve guuid=cd8545d0-1800-0000-00d5-23133b0c0000 pid=3131 /usr/bin/bash guuid=ace5b1b7-1800-0000-00d5-23131b0c0000 pid=3099->guuid=cd8545d0-1800-0000-00d5-23133b0c0000 pid=3131 clone guuid=b59582d0-1800-0000-00d5-23133e0c0000 pid=3134 /usr/bin/rm delete-file guuid=ace5b1b7-1800-0000-00d5-23131b0c0000 pid=3099->guuid=b59582d0-1800-0000-00d5-23133e0c0000 pid=3134 execve guuid=dab4e1d0-1800-0000-00d5-2313400c0000 pid=3136 /usr/bin/rm guuid=ace5b1b7-1800-0000-00d5-23131b0c0000 pid=3099->guuid=dab4e1d0-1800-0000-00d5-2313400c0000 pid=3136 execve guuid=52e95dd1-1800-0000-00d5-2313420c0000 pid=3138 /usr/bin/wget net send-data guuid=ace5b1b7-1800-0000-00d5-23131b0c0000 pid=3099->guuid=52e95dd1-1800-0000-00d5-2313420c0000 pid=3138 execve guuid=9c6815d4-1800-0000-00d5-23134a0c0000 pid=3146 /usr/bin/curl net send-data write-file guuid=ace5b1b7-1800-0000-00d5-23131b0c0000 pid=3099->guuid=9c6815d4-1800-0000-00d5-23134a0c0000 pid=3146 execve guuid=7ab086d9-1800-0000-00d5-23134e0c0000 pid=3150 /usr/bin/chmod guuid=ace5b1b7-1800-0000-00d5-23131b0c0000 pid=3099->guuid=7ab086d9-1800-0000-00d5-23134e0c0000 pid=3150 execve guuid=cc3ed0d9-1800-0000-00d5-2313500c0000 pid=3152 /usr/bin/bash guuid=ace5b1b7-1800-0000-00d5-23131b0c0000 pid=3099->guuid=cc3ed0d9-1800-0000-00d5-2313500c0000 pid=3152 clone guuid=cfeb45da-1800-0000-00d5-2313520c0000 pid=3154 /usr/bin/rm delete-file guuid=ace5b1b7-1800-0000-00d5-23131b0c0000 pid=3099->guuid=cfeb45da-1800-0000-00d5-2313520c0000 pid=3154 execve guuid=9b4ba1da-1800-0000-00d5-2313530c0000 pid=3155 /usr/bin/rm guuid=ace5b1b7-1800-0000-00d5-23131b0c0000 pid=3099->guuid=9b4ba1da-1800-0000-00d5-2313530c0000 pid=3155 execve guuid=a924f8da-1800-0000-00d5-2313540c0000 pid=3156 /usr/bin/wget net send-data guuid=ace5b1b7-1800-0000-00d5-23131b0c0000 pid=3099->guuid=a924f8da-1800-0000-00d5-2313540c0000 pid=3156 execve guuid=b382e8dd-1800-0000-00d5-23135d0c0000 pid=3165 /usr/bin/curl net send-data write-file guuid=ace5b1b7-1800-0000-00d5-23131b0c0000 pid=3099->guuid=b382e8dd-1800-0000-00d5-23135d0c0000 pid=3165 execve guuid=e8efb6e2-1800-0000-00d5-23136d0c0000 pid=3181 /usr/bin/chmod guuid=ace5b1b7-1800-0000-00d5-23131b0c0000 pid=3099->guuid=e8efb6e2-1800-0000-00d5-23136d0c0000 pid=3181 execve guuid=7b82f9e2-1800-0000-00d5-23136f0c0000 pid=3183 /usr/bin/bash guuid=ace5b1b7-1800-0000-00d5-23131b0c0000 pid=3099->guuid=7b82f9e2-1800-0000-00d5-23136f0c0000 pid=3183 clone guuid=87f72fe3-1800-0000-00d5-2313720c0000 pid=3186 /usr/bin/rm delete-file guuid=ace5b1b7-1800-0000-00d5-23131b0c0000 pid=3099->guuid=87f72fe3-1800-0000-00d5-2313720c0000 pid=3186 execve guuid=543776e3-1800-0000-00d5-2313740c0000 pid=3188 /usr/bin/rm guuid=ace5b1b7-1800-0000-00d5-23131b0c0000 pid=3099->guuid=543776e3-1800-0000-00d5-2313740c0000 pid=3188 execve guuid=e6bcb5e3-1800-0000-00d5-2313760c0000 pid=3190 /usr/bin/wget net send-data guuid=ace5b1b7-1800-0000-00d5-23131b0c0000 pid=3099->guuid=e6bcb5e3-1800-0000-00d5-2313760c0000 pid=3190 execve guuid=16d538e6-1800-0000-00d5-2313810c0000 pid=3201 /usr/bin/curl net send-data write-file guuid=ace5b1b7-1800-0000-00d5-23131b0c0000 pid=3099->guuid=16d538e6-1800-0000-00d5-2313810c0000 pid=3201 execve guuid=d08e57eb-1800-0000-00d5-23138a0c0000 pid=3210 /usr/bin/chmod guuid=ace5b1b7-1800-0000-00d5-23131b0c0000 pid=3099->guuid=d08e57eb-1800-0000-00d5-23138a0c0000 pid=3210 execve guuid=337c98eb-1800-0000-00d5-23138b0c0000 pid=3211 /usr/bin/bash guuid=ace5b1b7-1800-0000-00d5-23131b0c0000 pid=3099->guuid=337c98eb-1800-0000-00d5-23138b0c0000 pid=3211 clone guuid=df87cdeb-1800-0000-00d5-23138d0c0000 pid=3213 /usr/bin/rm delete-file guuid=ace5b1b7-1800-0000-00d5-23131b0c0000 pid=3099->guuid=df87cdeb-1800-0000-00d5-23138d0c0000 pid=3213 execve guuid=8adf0aec-1800-0000-00d5-23138e0c0000 pid=3214 /usr/bin/rm guuid=ace5b1b7-1800-0000-00d5-23131b0c0000 pid=3099->guuid=8adf0aec-1800-0000-00d5-23138e0c0000 pid=3214 execve guuid=c54c4eec-1800-0000-00d5-2313900c0000 pid=3216 /usr/bin/wget net send-data guuid=ace5b1b7-1800-0000-00d5-23131b0c0000 pid=3099->guuid=c54c4eec-1800-0000-00d5-2313900c0000 pid=3216 execve guuid=0512efee-1800-0000-00d5-2313980c0000 pid=3224 /usr/bin/curl net send-data write-file guuid=ace5b1b7-1800-0000-00d5-23131b0c0000 pid=3099->guuid=0512efee-1800-0000-00d5-2313980c0000 pid=3224 execve guuid=d0cf19f3-1800-0000-00d5-2313a50c0000 pid=3237 /usr/bin/chmod guuid=ace5b1b7-1800-0000-00d5-23131b0c0000 pid=3099->guuid=d0cf19f3-1800-0000-00d5-2313a50c0000 pid=3237 execve guuid=d7fc56f3-1800-0000-00d5-2313a70c0000 pid=3239 /usr/bin/bash guuid=ace5b1b7-1800-0000-00d5-23131b0c0000 pid=3099->guuid=d7fc56f3-1800-0000-00d5-2313a70c0000 pid=3239 clone guuid=9a2ae4f3-1800-0000-00d5-2313aa0c0000 pid=3242 /usr/bin/rm delete-file guuid=ace5b1b7-1800-0000-00d5-23131b0c0000 pid=3099->guuid=9a2ae4f3-1800-0000-00d5-2313aa0c0000 pid=3242 execve guuid=46362cf4-1800-0000-00d5-2313ac0c0000 pid=3244 /usr/bin/rm guuid=ace5b1b7-1800-0000-00d5-23131b0c0000 pid=3099->guuid=46362cf4-1800-0000-00d5-2313ac0c0000 pid=3244 execve guuid=ee3b72f4-1800-0000-00d5-2313ae0c0000 pid=3246 /usr/bin/wget net send-data guuid=ace5b1b7-1800-0000-00d5-23131b0c0000 pid=3099->guuid=ee3b72f4-1800-0000-00d5-2313ae0c0000 pid=3246 execve guuid=17e8ee33-1900-0000-00d5-23130b0d0000 pid=3339 /usr/bin/curl net send-data write-file guuid=ace5b1b7-1800-0000-00d5-23131b0c0000 pid=3099->guuid=17e8ee33-1900-0000-00d5-23130b0d0000 pid=3339 execve guuid=85072d38-1900-0000-00d5-2313170d0000 pid=3351 /usr/bin/chmod guuid=ace5b1b7-1800-0000-00d5-23131b0c0000 pid=3099->guuid=85072d38-1900-0000-00d5-2313170d0000 pid=3351 execve guuid=b3078d38-1900-0000-00d5-2313190d0000 pid=3353 /usr/bin/bash guuid=ace5b1b7-1800-0000-00d5-23131b0c0000 pid=3099->guuid=b3078d38-1900-0000-00d5-2313190d0000 pid=3353 clone guuid=2f5ecf38-1900-0000-00d5-23131c0d0000 pid=3356 /usr/bin/rm delete-file guuid=ace5b1b7-1800-0000-00d5-23131b0c0000 pid=3099->guuid=2f5ecf38-1900-0000-00d5-23131c0d0000 pid=3356 execve guuid=88302c39-1900-0000-00d5-23131e0d0000 pid=3358 /usr/bin/rm guuid=ace5b1b7-1800-0000-00d5-23131b0c0000 pid=3099->guuid=88302c39-1900-0000-00d5-23131e0d0000 pid=3358 execve guuid=252f7339-1900-0000-00d5-23131f0d0000 pid=3359 /usr/bin/wget net send-data guuid=ace5b1b7-1800-0000-00d5-23131b0c0000 pid=3099->guuid=252f7339-1900-0000-00d5-23131f0d0000 pid=3359 execve guuid=06b2973c-1900-0000-00d5-2313280d0000 pid=3368 /usr/bin/curl net send-data write-file guuid=ace5b1b7-1800-0000-00d5-23131b0c0000 pid=3099->guuid=06b2973c-1900-0000-00d5-2313280d0000 pid=3368 execve guuid=a4993e43-1900-0000-00d5-2313350d0000 pid=3381 /usr/bin/chmod guuid=ace5b1b7-1800-0000-00d5-23131b0c0000 pid=3099->guuid=a4993e43-1900-0000-00d5-2313350d0000 pid=3381 execve guuid=c0438043-1900-0000-00d5-2313370d0000 pid=3383 /usr/bin/bash guuid=ace5b1b7-1800-0000-00d5-23131b0c0000 pid=3099->guuid=c0438043-1900-0000-00d5-2313370d0000 pid=3383 clone guuid=cceab143-1900-0000-00d5-2313390d0000 pid=3385 /usr/bin/rm delete-file guuid=ace5b1b7-1800-0000-00d5-23131b0c0000 pid=3099->guuid=cceab143-1900-0000-00d5-2313390d0000 pid=3385 execve guuid=a1d81544-1900-0000-00d5-23133b0d0000 pid=3387 /usr/bin/rm guuid=ace5b1b7-1800-0000-00d5-23131b0c0000 pid=3099->guuid=a1d81544-1900-0000-00d5-23133b0d0000 pid=3387 execve guuid=6dafe544-1900-0000-00d5-23133d0d0000 pid=3389 /usr/bin/wget net send-data guuid=ace5b1b7-1800-0000-00d5-23131b0c0000 pid=3099->guuid=6dafe544-1900-0000-00d5-23133d0d0000 pid=3389 execve guuid=686a9a4a-1900-0000-00d5-2313480d0000 pid=3400 /usr/bin/curl net send-data write-file guuid=ace5b1b7-1800-0000-00d5-23131b0c0000 pid=3099->guuid=686a9a4a-1900-0000-00d5-2313480d0000 pid=3400 execve guuid=e54fa550-1900-0000-00d5-2313520d0000 pid=3410 /usr/bin/chmod guuid=ace5b1b7-1800-0000-00d5-23131b0c0000 pid=3099->guuid=e54fa550-1900-0000-00d5-2313520d0000 pid=3410 execve guuid=55d3fb50-1900-0000-00d5-2313540d0000 pid=3412 /usr/bin/bash guuid=ace5b1b7-1800-0000-00d5-23131b0c0000 pid=3099->guuid=55d3fb50-1900-0000-00d5-2313540d0000 pid=3412 clone guuid=97fd4251-1900-0000-00d5-2313570d0000 pid=3415 /usr/bin/rm delete-file guuid=ace5b1b7-1800-0000-00d5-23131b0c0000 pid=3099->guuid=97fd4251-1900-0000-00d5-2313570d0000 pid=3415 execve guuid=308c8d51-1900-0000-00d5-2313580d0000 pid=3416 /usr/bin/rm guuid=ace5b1b7-1800-0000-00d5-23131b0c0000 pid=3099->guuid=308c8d51-1900-0000-00d5-2313580d0000 pid=3416 execve guuid=111de051-1900-0000-00d5-23135a0d0000 pid=3418 /usr/bin/wget net send-data guuid=ace5b1b7-1800-0000-00d5-23131b0c0000 pid=3099->guuid=111de051-1900-0000-00d5-23135a0d0000 pid=3418 execve guuid=6a2c5b54-1900-0000-00d5-2313610d0000 pid=3425 /usr/bin/curl net send-data write-file guuid=ace5b1b7-1800-0000-00d5-23131b0c0000 pid=3099->guuid=6a2c5b54-1900-0000-00d5-2313610d0000 pid=3425 execve guuid=20ae6858-1900-0000-00d5-2313690d0000 pid=3433 /usr/bin/chmod guuid=ace5b1b7-1800-0000-00d5-23131b0c0000 pid=3099->guuid=20ae6858-1900-0000-00d5-2313690d0000 pid=3433 execve guuid=9df5a458-1900-0000-00d5-23136a0d0000 pid=3434 /usr/bin/bash guuid=ace5b1b7-1800-0000-00d5-23131b0c0000 pid=3099->guuid=9df5a458-1900-0000-00d5-23136a0d0000 pid=3434 clone guuid=08ee805b-1900-0000-00d5-23136c0d0000 pid=3436 /usr/bin/rm delete-file guuid=ace5b1b7-1800-0000-00d5-23131b0c0000 pid=3099->guuid=08ee805b-1900-0000-00d5-23136c0d0000 pid=3436 execve guuid=a1a1005c-1900-0000-00d5-23136d0d0000 pid=3437 /usr/bin/rm guuid=ace5b1b7-1800-0000-00d5-23131b0c0000 pid=3099->guuid=a1a1005c-1900-0000-00d5-23136d0d0000 pid=3437 execve guuid=40e7735c-1900-0000-00d5-23136e0d0000 pid=3438 /usr/bin/wget net send-data guuid=ace5b1b7-1800-0000-00d5-23131b0c0000 pid=3099->guuid=40e7735c-1900-0000-00d5-23136e0d0000 pid=3438 execve guuid=795f5560-1900-0000-00d5-2313730d0000 pid=3443 /usr/bin/curl net send-data write-file guuid=ace5b1b7-1800-0000-00d5-23131b0c0000 pid=3099->guuid=795f5560-1900-0000-00d5-2313730d0000 pid=3443 execve guuid=61ef8d65-1900-0000-00d5-23137d0d0000 pid=3453 /usr/bin/chmod guuid=ace5b1b7-1800-0000-00d5-23131b0c0000 pid=3099->guuid=61ef8d65-1900-0000-00d5-23137d0d0000 pid=3453 execve guuid=0c05e465-1900-0000-00d5-23137e0d0000 pid=3454 /usr/bin/bash guuid=ace5b1b7-1800-0000-00d5-23131b0c0000 pid=3099->guuid=0c05e465-1900-0000-00d5-23137e0d0000 pid=3454 clone guuid=84412466-1900-0000-00d5-2313800d0000 pid=3456 /usr/bin/rm delete-file guuid=ace5b1b7-1800-0000-00d5-23131b0c0000 pid=3099->guuid=84412466-1900-0000-00d5-2313800d0000 pid=3456 execve guuid=cc708066-1900-0000-00d5-2313810d0000 pid=3457 /usr/bin/rm guuid=ace5b1b7-1800-0000-00d5-23131b0c0000 pid=3099->guuid=cc708066-1900-0000-00d5-2313810d0000 pid=3457 execve guuid=b118d466-1900-0000-00d5-2313830d0000 pid=3459 /usr/bin/wget net send-data guuid=ace5b1b7-1800-0000-00d5-23131b0c0000 pid=3099->guuid=b118d466-1900-0000-00d5-2313830d0000 pid=3459 execve guuid=5f21bf69-1900-0000-00d5-2313880d0000 pid=3464 /usr/bin/curl net send-data write-file guuid=ace5b1b7-1800-0000-00d5-23131b0c0000 pid=3099->guuid=5f21bf69-1900-0000-00d5-2313880d0000 pid=3464 execve guuid=c1d8376d-1900-0000-00d5-23138c0d0000 pid=3468 /usr/bin/chmod guuid=ace5b1b7-1800-0000-00d5-23131b0c0000 pid=3099->guuid=c1d8376d-1900-0000-00d5-23138c0d0000 pid=3468 execve guuid=4c65f06d-1900-0000-00d5-23138d0d0000 pid=3469 /usr/bin/bash guuid=ace5b1b7-1800-0000-00d5-23131b0c0000 pid=3099->guuid=4c65f06d-1900-0000-00d5-23138d0d0000 pid=3469 clone guuid=d1fd206f-1900-0000-00d5-23138f0d0000 pid=3471 /usr/bin/rm delete-file guuid=ace5b1b7-1800-0000-00d5-23131b0c0000 pid=3099->guuid=d1fd206f-1900-0000-00d5-23138f0d0000 pid=3471 execve guuid=a13c9f6f-1900-0000-00d5-2313900d0000 pid=3472 /usr/bin/rm guuid=ace5b1b7-1800-0000-00d5-23131b0c0000 pid=3099->guuid=a13c9f6f-1900-0000-00d5-2313900d0000 pid=3472 execve 9e33e6d7-6ac7-5a65-88f4-941337e56821 5.182.210.61:80 guuid=46a654b8-1800-0000-00d5-23131c0c0000 pid=3100->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=5c2657bc-1800-0000-00d5-2313220c0000 pid=3106->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=f5eae0c7-1800-0000-00d5-23132d0c0000 pid=3117 /usr/bin/bash guuid=c1aac0c7-1800-0000-00d5-23132c0c0000 pid=3116->guuid=f5eae0c7-1800-0000-00d5-23132d0c0000 pid=3117 clone guuid=0551a4c8-1800-0000-00d5-2313300c0000 pid=3120->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=10d451cb-1800-0000-00d5-2313320c0000 pid=3122->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=16ba5ad0-1800-0000-00d5-23133c0c0000 pid=3132 /usr/bin/bash guuid=cd8545d0-1800-0000-00d5-23133b0c0000 pid=3131->guuid=16ba5ad0-1800-0000-00d5-23133c0c0000 pid=3132 clone guuid=52e95dd1-1800-0000-00d5-2313420c0000 pid=3138->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=9c6815d4-1800-0000-00d5-23134a0c0000 pid=3146->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=7a53e9d9-1800-0000-00d5-2313510c0000 pid=3153 /usr/bin/bash guuid=cc3ed0d9-1800-0000-00d5-2313500c0000 pid=3152->guuid=7a53e9d9-1800-0000-00d5-2313510c0000 pid=3153 clone guuid=a924f8da-1800-0000-00d5-2313540c0000 pid=3156->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=b382e8dd-1800-0000-00d5-23135d0c0000 pid=3165->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=e83911e3-1800-0000-00d5-2313700c0000 pid=3184 /usr/bin/bash guuid=7b82f9e2-1800-0000-00d5-23136f0c0000 pid=3183->guuid=e83911e3-1800-0000-00d5-2313700c0000 pid=3184 clone guuid=e6bcb5e3-1800-0000-00d5-2313760c0000 pid=3190->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=16d538e6-1800-0000-00d5-2313810c0000 pid=3201->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=4c1ab0eb-1800-0000-00d5-23138c0c0000 pid=3212 /usr/bin/bash guuid=337c98eb-1800-0000-00d5-23138b0c0000 pid=3211->guuid=4c1ab0eb-1800-0000-00d5-23138c0c0000 pid=3212 clone guuid=c54c4eec-1800-0000-00d5-2313900c0000 pid=3216->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=0512efee-1800-0000-00d5-2313980c0000 pid=3224->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=d341bef3-1800-0000-00d5-2313a90c0000 pid=3241 /usr/bin/bash guuid=d7fc56f3-1800-0000-00d5-2313a70c0000 pid=3239->guuid=d341bef3-1800-0000-00d5-2313a90c0000 pid=3241 clone guuid=ee3b72f4-1800-0000-00d5-2313ae0c0000 pid=3246->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=17e8ee33-1900-0000-00d5-23130b0d0000 pid=3339->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=67d4ad38-1900-0000-00d5-23131b0d0000 pid=3355 /usr/bin/bash guuid=b3078d38-1900-0000-00d5-2313190d0000 pid=3353->guuid=67d4ad38-1900-0000-00d5-23131b0d0000 pid=3355 clone guuid=252f7339-1900-0000-00d5-23131f0d0000 pid=3359->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=06b2973c-1900-0000-00d5-2313280d0000 pid=3368->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=1f219443-1900-0000-00d5-2313380d0000 pid=3384 /usr/bin/bash guuid=c0438043-1900-0000-00d5-2313370d0000 pid=3383->guuid=1f219443-1900-0000-00d5-2313380d0000 pid=3384 clone guuid=6dafe544-1900-0000-00d5-23133d0d0000 pid=3389->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=686a9a4a-1900-0000-00d5-2313480d0000 pid=3400->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=d1281251-1900-0000-00d5-2313550d0000 pid=3413 /usr/bin/bash guuid=55d3fb50-1900-0000-00d5-2313540d0000 pid=3412->guuid=d1281251-1900-0000-00d5-2313550d0000 pid=3413 clone guuid=111de051-1900-0000-00d5-23135a0d0000 pid=3418->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=6a2c5b54-1900-0000-00d5-2313610d0000 pid=3425->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=2f71af5a-1900-0000-00d5-23136b0d0000 pid=3435 /usr/bin/bash guuid=9df5a458-1900-0000-00d5-23136a0d0000 pid=3434->guuid=2f71af5a-1900-0000-00d5-23136b0d0000 pid=3435 clone guuid=40e7735c-1900-0000-00d5-23136e0d0000 pid=3438->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=795f5560-1900-0000-00d5-2313730d0000 pid=3443->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=be590066-1900-0000-00d5-23137f0d0000 pid=3455 /usr/bin/bash guuid=0c05e465-1900-0000-00d5-23137e0d0000 pid=3454->guuid=be590066-1900-0000-00d5-23137f0d0000 pid=3455 clone guuid=b118d466-1900-0000-00d5-2313830d0000 pid=3459->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=5f21bf69-1900-0000-00d5-2313880d0000 pid=3464->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=6125566e-1900-0000-00d5-23138e0d0000 pid=3470 /usr/bin/bash guuid=4c65f06d-1900-0000-00d5-23138d0d0000 pid=3469->guuid=6125566e-1900-0000-00d5-23138e0d0000 pid=3470 clone
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/472e2fe8dd6b666afc45ebf27ea82280e4926d0b658fe8e75bd8e707107dab46
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/472e2fe8dd6b666afc45ebf27ea82280e4926d0b658fe8e75bd8e707107dab46/
Threat name:
Linux.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-07-25 05:13:00 UTC
AV detection:
13 of 24 (54.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=i4xc72g5nntgv7cf5pzh5kbcqdsje3ilmwh6rz233dtqoed5vnda._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260727-tbfy1awzez/
Behaviour
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.11
Link:
https://yomi.yoroi.company/submissions/472e2fe8dd6b666afc45ebf27ea82280e4926d0b658fe8e75bd8e707107dab46

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments