🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4a292b499ed7a56bda441a45bb9e8c95c884437d0a30b4e9df4484bd5bf90338. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4a292b499ed7a56bda441a45bb9e8c95c884437d0a30b4e9df4484bd5bf90338
SHA3-384 hash: 999a700946db69187c672795d24b151399c61cfdde1936a6eb48ebc3d1ffaa8c2534c2c0d0746e49c21637050172b903
SHA1 hash: 1d8d0d2bd74833afc04d791617ee6bb6012d927a
MD5 hash: 8c9684a90413db04fe432b4b5c3e2585
humanhash: massachusetts-yellow-beryllium-eight
File name:beacon
Download: download sample
File size:5'934 bytes
First seen:2026-09-16 14:58:04 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 96:7RjDylKKMvELqXRlQEoISJTZTsXCLzdRwSTKx7iloE2:0klELqhuEvSJTpxLzwY2
TLSH T144C186A6B221A271BD4F68E09B5F3694A442A03F1D607845F5DC5C24F76D348F3BCA3A
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter BlinkzSec
URLMalware sample (SHA256 hash)SignatureTags
http://95.217.82.39:8888/exec-outn/an/an/a

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
AT AT
Vendor Threat Intelligence
No detections
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-09-16T14:12:00Z UTC
Last seen:
2026-09-16T14:39:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/4a292b499ed7a56bda441a45bb9e8c95c884437d0a30b4e9df4484bd5bf90338/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/a32bddbf-57ea-4174-b0b9-3bdeb2447640
Behavior Graph:
Download SVG
%3 guuid=15fdcad2-1b00-0000-f765-46b6520a0000 pid=2642 /usr/bin/sudo guuid=8eb836dd-1b00-0000-f765-46b6580a0000 pid=2648 /tmp/sample.bin write-file guuid=15fdcad2-1b00-0000-f765-46b6520a0000 pid=2642->guuid=8eb836dd-1b00-0000-f765-46b6580a0000 pid=2648 execve guuid=eb2c2fdf-1b00-0000-f765-46b65b0a0000 pid=2651 /usr/bin/date guuid=8eb836dd-1b00-0000-f765-46b6580a0000 pid=2648->guuid=eb2c2fdf-1b00-0000-f765-46b65b0a0000 pid=2651 execve guuid=dd016fdf-1b00-0000-f765-46b65c0a0000 pid=2652 /usr/bin/curl net guuid=8eb836dd-1b00-0000-f765-46b6580a0000 pid=2648->guuid=dd016fdf-1b00-0000-f765-46b65c0a0000 pid=2652 execve guuid=dc06eaf4-1b00-0000-f765-46b6700a0000 pid=2672 /usr/bin/date guuid=8eb836dd-1b00-0000-f765-46b6580a0000 pid=2648->guuid=dc06eaf4-1b00-0000-f765-46b6700a0000 pid=2672 execve guuid=1c87e1f5-1b00-0000-f765-46b6720a0000 pid=2674 /usr/bin/sleep guuid=8eb836dd-1b00-0000-f765-46b6580a0000 pid=2648->guuid=1c87e1f5-1b00-0000-f765-46b6720a0000 pid=2674 execve guuid=29129baa-1c00-0000-f765-46b63b0b0000 pid=2875 /usr/bin/grep guuid=8eb836dd-1b00-0000-f765-46b6580a0000 pid=2648->guuid=29129baa-1c00-0000-f765-46b63b0b0000 pid=2875 execve guuid=a00da7ab-1c00-0000-f765-46b63d0b0000 pid=2877 /usr/bin/bash guuid=8eb836dd-1b00-0000-f765-46b6580a0000 pid=2648->guuid=a00da7ab-1c00-0000-f765-46b63d0b0000 pid=2877 clone guuid=1a61b8bd-1c00-0000-f765-46b6590b0000 pid=2905 /usr/bin/bash guuid=8eb836dd-1b00-0000-f765-46b6580a0000 pid=2648->guuid=1a61b8bd-1c00-0000-f765-46b6590b0000 pid=2905 clone guuid=f98065c7-1c00-0000-f765-46b6690b0000 pid=2921 /usr/bin/cat write-file guuid=8eb836dd-1b00-0000-f765-46b6580a0000 pid=2648->guuid=f98065c7-1c00-0000-f765-46b6690b0000 pid=2921 execve guuid=084476cd-1c00-0000-f765-46b6740b0000 pid=2932 /usr/bin/chmod guuid=8eb836dd-1b00-0000-f765-46b6580a0000 pid=2648->guuid=084476cd-1c00-0000-f765-46b6740b0000 pid=2932 execve guuid=e1144ece-1c00-0000-f765-46b6750b0000 pid=2933 /usr/bin/touch guuid=8eb836dd-1b00-0000-f765-46b6580a0000 pid=2648->guuid=e1144ece-1c00-0000-f765-46b6750b0000 pid=2933 execve guuid=209f34cf-1c00-0000-f765-46b6780b0000 pid=2936 /usr/bin/cat write-config guuid=8eb836dd-1b00-0000-f765-46b6580a0000 pid=2648->guuid=209f34cf-1c00-0000-f765-46b6780b0000 pid=2936 execve guuid=4325a9cf-1c00-0000-f765-46b67a0b0000 pid=2938 /usr/bin/touch guuid=8eb836dd-1b00-0000-f765-46b6580a0000 pid=2648->guuid=4325a9cf-1c00-0000-f765-46b67a0b0000 pid=2938 execve guuid=77df1ad0-1c00-0000-f765-46b67c0b0000 pid=2940 /usr/bin/systemctl guuid=8eb836dd-1b00-0000-f765-46b6580a0000 pid=2648->guuid=77df1ad0-1c00-0000-f765-46b67c0b0000 pid=2940 execve guuid=ad52982f-1d00-0000-f765-46b6120c0000 pid=3090 /usr/bin/systemctl guuid=8eb836dd-1b00-0000-f765-46b6580a0000 pid=2648->guuid=ad52982f-1d00-0000-f765-46b6120c0000 pid=3090 execve guuid=cf631b8e-1d00-0000-f765-46b65c0c0000 pid=3164 /usr/bin/systemctl guuid=8eb836dd-1b00-0000-f765-46b6580a0000 pid=2648->guuid=cf631b8e-1d00-0000-f765-46b65c0c0000 pid=3164 execve guuid=bdc1c494-1d00-0000-f765-46b65e0c0000 pid=3166 /usr/bin/cat write-file guuid=8eb836dd-1b00-0000-f765-46b6580a0000 pid=2648->guuid=bdc1c494-1d00-0000-f765-46b65e0c0000 pid=3166 execve guuid=c77b7695-1d00-0000-f765-46b65f0c0000 pid=3167 /usr/bin/chmod guuid=8eb836dd-1b00-0000-f765-46b6580a0000 pid=2648->guuid=c77b7695-1d00-0000-f765-46b65f0c0000 pid=3167 execve guuid=0f8f0496-1d00-0000-f765-46b6600c0000 pid=3168 /usr/bin/cat write-config guuid=8eb836dd-1b00-0000-f765-46b6580a0000 pid=2648->guuid=0f8f0496-1d00-0000-f765-46b6600c0000 pid=3168 execve guuid=f2aee196-1d00-0000-f765-46b6620c0000 pid=3170 /usr/bin/cat write-config guuid=8eb836dd-1b00-0000-f765-46b6580a0000 pid=2648->guuid=f2aee196-1d00-0000-f765-46b6620c0000 pid=3170 execve guuid=13245e97-1d00-0000-f765-46b6630c0000 pid=3171 /usr/bin/systemctl guuid=8eb836dd-1b00-0000-f765-46b6580a0000 pid=2648->guuid=13245e97-1d00-0000-f765-46b6630c0000 pid=3171 execve guuid=bb761ef5-1d00-0000-f765-46b6c10c0000 pid=3265 /usr/bin/systemctl guuid=8eb836dd-1b00-0000-f765-46b6580a0000 pid=2648->guuid=bb761ef5-1d00-0000-f765-46b6c10c0000 pid=3265 execve guuid=36e1526f-1e00-0000-f765-46b63b0d0000 pid=3387 /usr/bin/systemctl guuid=8eb836dd-1b00-0000-f765-46b6580a0000 pid=2648->guuid=36e1526f-1e00-0000-f765-46b63b0d0000 pid=3387 execve guuid=ece6087f-1e00-0000-f765-46b6470d0000 pid=3399 /usr/bin/curl net send-data write-file guuid=8eb836dd-1b00-0000-f765-46b6580a0000 pid=2648->guuid=ece6087f-1e00-0000-f765-46b6470d0000 pid=3399 execve guuid=af214f8b-1e00-0000-f765-46b65a0d0000 pid=3418 /usr/bin/touch guuid=8eb836dd-1b00-0000-f765-46b6580a0000 pid=2648->guuid=af214f8b-1e00-0000-f765-46b65a0d0000 pid=3418 execve guuid=2fc0398c-1e00-0000-f765-46b65d0d0000 pid=3421 /usr/bin/sleep guuid=8eb836dd-1b00-0000-f765-46b6580a0000 pid=2648->guuid=2fc0398c-1e00-0000-f765-46b65d0d0000 pid=3421 execve guuid=d71ed9b7-1f00-0000-f765-46b6170f0000 pid=3863 /usr/bin/systemctl guuid=8eb836dd-1b00-0000-f765-46b6580a0000 pid=2648->guuid=d71ed9b7-1f00-0000-f765-46b6170f0000 pid=3863 execve guuid=98c4e1b7-1f00-0000-f765-46b6180f0000 pid=3864 /usr/bin/curl net guuid=8eb836dd-1b00-0000-f765-46b6580a0000 pid=2648->guuid=98c4e1b7-1f00-0000-f765-46b6180f0000 pid=3864 execve guuid=dec31fc1-1f00-0000-f765-46b6290f0000 pid=3881 /usr/bin/bash guuid=8eb836dd-1b00-0000-f765-46b6580a0000 pid=2648->guuid=dec31fc1-1f00-0000-f765-46b6290f0000 pid=3881 clone guuid=56b239c1-1f00-0000-f765-46b62a0f0000 pid=3882 /usr/bin/curl net guuid=8eb836dd-1b00-0000-f765-46b6580a0000 pid=2648->guuid=56b239c1-1f00-0000-f765-46b62a0f0000 pid=3882 execve guuid=9dc0e9c9-1f00-0000-f765-46b63c0f0000 pid=3900 /usr/bin/rm delete-file guuid=8eb836dd-1b00-0000-f765-46b6580a0000 pid=2648->guuid=9dc0e9c9-1f00-0000-f765-46b63c0f0000 pid=3900 execve guuid=5934badf-1b00-0000-f765-46b65d0a0000 pid=2653 /usr/bin/hostname guuid=eb2c2fdf-1b00-0000-f765-46b65b0a0000 pid=2651->guuid=5934badf-1b00-0000-f765-46b65d0a0000 pid=2653 execve a95c0073-d012-51ee-b7ed-2d66ed9185a1 95.217.82.39:8888 guuid=dd016fdf-1b00-0000-f765-46b65c0a0000 pid=2652->a95c0073-d012-51ee-b7ed-2d66ed9185a1 con guuid=6124e1ab-1c00-0000-f765-46b63e0b0000 pid=2878 /usr/bin/ss guuid=a00da7ab-1c00-0000-f765-46b63d0b0000 pid=2877->guuid=6124e1ab-1c00-0000-f765-46b63e0b0000 pid=2878 execve guuid=19ff0cac-1c00-0000-f765-46b6400b0000 pid=2880 /usr/bin/grep guuid=a00da7ab-1c00-0000-f765-46b63d0b0000 pid=2877->guuid=19ff0cac-1c00-0000-f765-46b6400b0000 pid=2880 execve guuid=40a335ac-1c00-0000-f765-46b6410b0000 pid=2881 /usr/bin/grep guuid=a00da7ab-1c00-0000-f765-46b63d0b0000 pid=2877->guuid=40a335ac-1c00-0000-f765-46b6410b0000 pid=2881 execve guuid=e80840ac-1c00-0000-f765-46b6420b0000 pid=2882 /usr/bin/head guuid=a00da7ab-1c00-0000-f765-46b63d0b0000 pid=2877->guuid=e80840ac-1c00-0000-f765-46b6420b0000 pid=2882 execve guuid=3d084cac-1c00-0000-f765-46b6430b0000 pid=2883 /usr/bin/cut guuid=a00da7ab-1c00-0000-f765-46b63d0b0000 pid=2877->guuid=3d084cac-1c00-0000-f765-46b6430b0000 pid=2883 execve guuid=c4f6c7bd-1c00-0000-f765-46b65a0b0000 pid=2906 /usr/bin/ps guuid=1a61b8bd-1c00-0000-f765-46b6590b0000 pid=2905->guuid=c4f6c7bd-1c00-0000-f765-46b65a0b0000 pid=2906 execve guuid=b66dd0bd-1c00-0000-f765-46b65b0b0000 pid=2907 /usr/bin/grep guuid=1a61b8bd-1c00-0000-f765-46b6590b0000 pid=2905->guuid=b66dd0bd-1c00-0000-f765-46b65b0b0000 pid=2907 execve guuid=7bbbddbd-1c00-0000-f765-46b65c0b0000 pid=2908 /usr/bin/grep guuid=1a61b8bd-1c00-0000-f765-46b6590b0000 pid=2905->guuid=7bbbddbd-1c00-0000-f765-46b65c0b0000 pid=2908 execve guuid=ae52e7bd-1c00-0000-f765-46b65d0b0000 pid=2909 /usr/bin/sort guuid=1a61b8bd-1c00-0000-f765-46b6590b0000 pid=2905->guuid=ae52e7bd-1c00-0000-f765-46b65d0b0000 pid=2909 execve guuid=7fa1eebd-1c00-0000-f765-46b65e0b0000 pid=2910 /usr/bin/head guuid=1a61b8bd-1c00-0000-f765-46b6590b0000 pid=2905->guuid=7fa1eebd-1c00-0000-f765-46b65e0b0000 pid=2910 execve guuid=9fd3f7bd-1c00-0000-f765-46b65f0b0000 pid=2911 /usr/bin/mawk guuid=1a61b8bd-1c00-0000-f765-46b6590b0000 pid=2905->guuid=9fd3f7bd-1c00-0000-f765-46b65f0b0000 pid=2911 execve 2f45b22c-62bf-55a4-a2f5-8d3759a6afae 95.217.82.39:8081 guuid=ece6087f-1e00-0000-f765-46b6470d0000 pid=3399->2f45b22c-62bf-55a4-a2f5-8d3759a6afae send: 86B guuid=98c4e1b7-1f00-0000-f765-46b6180f0000 pid=3864->a95c0073-d012-51ee-b7ed-2d66ed9185a1 con guuid=56b239c1-1f00-0000-f765-46b62a0f0000 pid=3882->a95c0073-d012-51ee-b7ed-2d66ed9185a1 con
Score:
2%
Verdict:
Benign
File Type:
SCRIPT
Link:
https://malprob.io/report/4a292b499ed7a56bda441a45bb9e8c95c884437d0a30b4e9df4484bd5bf90338
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4a292b499ed7a56bda441a45bb9e8c95c884437d0a30b4e9df4484bd5bf90338/
Threat name:
Linux.Backdoor.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-09-16 14:56:29 UTC
File Type:
Text (Shell)
AV detection:
7 of 38 (18.42%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jiuswsm626swxwsedjc3xhumsxeiiq35biylj2o7iscl2w7zam4a._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux persistence privilege_escalation
Link:
https://tria.ge/reports/260916-scbv1acn4x/
Behaviour
Enumerates kernel/hardware configuration
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
Discovers running processes
Reads CPU attributes
Enumerates running processes
Modifies systemd
Write file to user bin folder
File and Directory Permissions Modification
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.34
Link:
https://yomi.yoroi.company/submissions/4a292b499ed7a56bda441a45bb9e8c95c884437d0a30b4e9df4484bd5bf90338

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ClickFix_macOS_Generic_ClipboardExec
Create hunting rule
Author:Novum Analytica GmbH
Description:Generic ClickFix execution pattern on macOS: eval of decoded blob, or curl piped to a shell
Reference:https://github.com/raimurokko/macos-threat-tracking

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments