🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4b6c5c2d773b5d4b9483a20098faf68cbbc552ab477fbb7d5734409dd78f52ea. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4b6c5c2d773b5d4b9483a20098faf68cbbc552ab477fbb7d5734409dd78f52ea
SHA3-384 hash: 0cf47e8478c51580140424ac0a17f1bb4fe77b4778bb60908a19af9f54abf3ac1a550c1585ac20ef791ffc8bcfa28a93
SHA1 hash: 9e4220ccff0d30388e9ced109a0b050903cd3bba
MD5 hash: fc3bbc8437e1acf9c301e2238df2f48f
humanhash: aspen-pasta-lima-hot
File name:4b6c5c2d773b5d4b9483a20098faf68cbbc552ab477fbb7d5734409dd78f52ea
Download: download sample
File size:1'608 bytes
First seen:2026-08-30 23:00:12 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 12:UV6zRDQqlrex6rec+MEHlk6lpwTNqU76NqY9RKkdY6d5Dul06Dn7CvNV6NiEbX70:Xlb3EhpAOKk9wuxE4JBNoUoC
TLSH T1ED31CF9F05010EB11047ED4E73B37548738DA2EB2C5FC7E9A8490EA9828878CF160F9E
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter EnthecSolutions
Tags:enthec sh
URLMalware sample (SHA256 hash)SignatureTags
http://5.182.210.174/c68937n/an/an/a
http://5.182.210.174/a63371n/an/an/a
http://5.182.210.174/c41cf2n/an/an/a
http://5.182.210.174/9abd0dn/an/an/a
http://5.182.210.174/ddf37an/an/an/a
http://5.182.210.174/e1fd50n/an/an/a
http://5.182.210.174/9bb09bn/an/an/a
http://5.182.210.174/f5b3een/an/an/a
http://5.182.210.174/edbd09n/an/an/a
http://5.182.210.174/749d2fn/an/an/a
http://5.182.210.174/f71950n/an/an/a
http://5.182.210.174/19cbb3n/an/an/a

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
CA CA
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
downloader evasive mirai
Link:
https://www.filescan.io/uploads/6a94b603bc100e6ce3e81a38/reports/b0c81530-3e5a-461a-aea4-ceafea1622d4/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-08-28T19:41:00Z UTC
Last seen:
2026-08-30T22:39:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/4b6c5c2d773b5d4b9483a20098faf68cbbc552ab477fbb7d5734409dd78f52ea/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/31309ab5-77e6-40b2-9fcf-ba2ecf8253f8
Behavior Graph:
Download SVG
%3 guuid=5eada8d9-1600-0000-3b3e-251dc00d0000 pid=3520 /usr/bin/sudo guuid=f444bcdb-1600-0000-3b3e-251dc80d0000 pid=3528 /tmp/sample.bin guuid=5eada8d9-1600-0000-3b3e-251dc00d0000 pid=3520->guuid=f444bcdb-1600-0000-3b3e-251dc80d0000 pid=3528 execve guuid=a9d6b7dc-1600-0000-3b3e-251dcc0d0000 pid=3532 /usr/bin/wget net send-data guuid=f444bcdb-1600-0000-3b3e-251dc80d0000 pid=3528->guuid=a9d6b7dc-1600-0000-3b3e-251dcc0d0000 pid=3532 execve guuid=102940e2-1600-0000-3b3e-251dd60d0000 pid=3542 /usr/bin/curl net send-data write-file guuid=f444bcdb-1600-0000-3b3e-251dc80d0000 pid=3528->guuid=102940e2-1600-0000-3b3e-251dd60d0000 pid=3542 execve guuid=07cacbec-1600-0000-3b3e-251de00d0000 pid=3552 /usr/bin/chmod guuid=f444bcdb-1600-0000-3b3e-251dc80d0000 pid=3528->guuid=07cacbec-1600-0000-3b3e-251de00d0000 pid=3552 execve guuid=90e116ed-1600-0000-3b3e-251de20d0000 pid=3554 /usr/bin/bash guuid=f444bcdb-1600-0000-3b3e-251dc80d0000 pid=3528->guuid=90e116ed-1600-0000-3b3e-251de20d0000 pid=3554 clone guuid=8dcc59ed-1600-0000-3b3e-251de50d0000 pid=3557 /usr/bin/rm delete-file guuid=f444bcdb-1600-0000-3b3e-251dc80d0000 pid=3528->guuid=8dcc59ed-1600-0000-3b3e-251de50d0000 pid=3557 execve guuid=7e1c9fed-1600-0000-3b3e-251de70d0000 pid=3559 /usr/bin/rm guuid=f444bcdb-1600-0000-3b3e-251dc80d0000 pid=3528->guuid=7e1c9fed-1600-0000-3b3e-251de70d0000 pid=3559 execve guuid=1112dced-1600-0000-3b3e-251de80d0000 pid=3560 /usr/bin/wget net send-data guuid=f444bcdb-1600-0000-3b3e-251dc80d0000 pid=3528->guuid=1112dced-1600-0000-3b3e-251de80d0000 pid=3560 execve guuid=95c51cf1-1600-0000-3b3e-251df00d0000 pid=3568 /usr/bin/curl net send-data write-file guuid=f444bcdb-1600-0000-3b3e-251dc80d0000 pid=3528->guuid=95c51cf1-1600-0000-3b3e-251df00d0000 pid=3568 execve guuid=10c954f5-1600-0000-3b3e-251dfd0d0000 pid=3581 /usr/bin/chmod guuid=f444bcdb-1600-0000-3b3e-251dc80d0000 pid=3528->guuid=10c954f5-1600-0000-3b3e-251dfd0d0000 pid=3581 execve guuid=0da395f5-1600-0000-3b3e-251dff0d0000 pid=3583 /usr/bin/bash guuid=f444bcdb-1600-0000-3b3e-251dc80d0000 pid=3528->guuid=0da395f5-1600-0000-3b3e-251dff0d0000 pid=3583 clone guuid=8b68cef5-1600-0000-3b3e-251d020e0000 pid=3586 /usr/bin/rm delete-file guuid=f444bcdb-1600-0000-3b3e-251dc80d0000 pid=3528->guuid=8b68cef5-1600-0000-3b3e-251d020e0000 pid=3586 execve guuid=d14313f6-1600-0000-3b3e-251d050e0000 pid=3589 /usr/bin/rm guuid=f444bcdb-1600-0000-3b3e-251dc80d0000 pid=3528->guuid=d14313f6-1600-0000-3b3e-251d050e0000 pid=3589 execve guuid=b69e54f6-1600-0000-3b3e-251d060e0000 pid=3590 /usr/bin/wget net send-data guuid=f444bcdb-1600-0000-3b3e-251dc80d0000 pid=3528->guuid=b69e54f6-1600-0000-3b3e-251d060e0000 pid=3590 execve guuid=080cccf8-1600-0000-3b3e-251d140e0000 pid=3604 /usr/bin/curl net send-data write-file guuid=f444bcdb-1600-0000-3b3e-251dc80d0000 pid=3528->guuid=080cccf8-1600-0000-3b3e-251d140e0000 pid=3604 execve guuid=0a4d70fc-1600-0000-3b3e-251d260e0000 pid=3622 /usr/bin/chmod guuid=f444bcdb-1600-0000-3b3e-251dc80d0000 pid=3528->guuid=0a4d70fc-1600-0000-3b3e-251d260e0000 pid=3622 execve guuid=9cf0aafc-1600-0000-3b3e-251d280e0000 pid=3624 /usr/bin/bash guuid=f444bcdb-1600-0000-3b3e-251dc80d0000 pid=3528->guuid=9cf0aafc-1600-0000-3b3e-251d280e0000 pid=3624 clone guuid=93cddefc-1600-0000-3b3e-251d2c0e0000 pid=3628 /usr/bin/rm delete-file guuid=f444bcdb-1600-0000-3b3e-251dc80d0000 pid=3528->guuid=93cddefc-1600-0000-3b3e-251d2c0e0000 pid=3628 execve guuid=df2419fd-1600-0000-3b3e-251d300e0000 pid=3632 /usr/bin/rm guuid=f444bcdb-1600-0000-3b3e-251dc80d0000 pid=3528->guuid=df2419fd-1600-0000-3b3e-251d300e0000 pid=3632 execve guuid=bbd255fd-1600-0000-3b3e-251d310e0000 pid=3633 /usr/bin/wget net send-data guuid=f444bcdb-1600-0000-3b3e-251dc80d0000 pid=3528->guuid=bbd255fd-1600-0000-3b3e-251d310e0000 pid=3633 execve guuid=bd6bdaff-1600-0000-3b3e-251d3c0e0000 pid=3644 /usr/bin/curl net send-data write-file guuid=f444bcdb-1600-0000-3b3e-251dc80d0000 pid=3528->guuid=bd6bdaff-1600-0000-3b3e-251d3c0e0000 pid=3644 execve guuid=9df53c03-1700-0000-3b3e-251d480e0000 pid=3656 /usr/bin/chmod guuid=f444bcdb-1600-0000-3b3e-251dc80d0000 pid=3528->guuid=9df53c03-1700-0000-3b3e-251d480e0000 pid=3656 execve guuid=5e609d03-1700-0000-3b3e-251d4a0e0000 pid=3658 /usr/bin/bash guuid=f444bcdb-1600-0000-3b3e-251dc80d0000 pid=3528->guuid=5e609d03-1700-0000-3b3e-251d4a0e0000 pid=3658 clone guuid=decff203-1700-0000-3b3e-251d4c0e0000 pid=3660 /usr/bin/rm delete-file guuid=f444bcdb-1600-0000-3b3e-251dc80d0000 pid=3528->guuid=decff203-1700-0000-3b3e-251d4c0e0000 pid=3660 execve guuid=e1254404-1700-0000-3b3e-251d4e0e0000 pid=3662 /usr/bin/rm guuid=f444bcdb-1600-0000-3b3e-251dc80d0000 pid=3528->guuid=e1254404-1700-0000-3b3e-251d4e0e0000 pid=3662 execve guuid=83148a04-1700-0000-3b3e-251d500e0000 pid=3664 /usr/bin/wget net send-data guuid=f444bcdb-1600-0000-3b3e-251dc80d0000 pid=3528->guuid=83148a04-1700-0000-3b3e-251d500e0000 pid=3664 execve guuid=da937707-1700-0000-3b3e-251d5b0e0000 pid=3675 /usr/bin/curl net send-data write-file guuid=f444bcdb-1600-0000-3b3e-251dc80d0000 pid=3528->guuid=da937707-1700-0000-3b3e-251d5b0e0000 pid=3675 execve guuid=4623670c-1700-0000-3b3e-251d770e0000 pid=3703 /usr/bin/chmod guuid=f444bcdb-1600-0000-3b3e-251dc80d0000 pid=3528->guuid=4623670c-1700-0000-3b3e-251d770e0000 pid=3703 execve guuid=0ea0a80c-1700-0000-3b3e-251d7a0e0000 pid=3706 /usr/bin/bash guuid=f444bcdb-1600-0000-3b3e-251dc80d0000 pid=3528->guuid=0ea0a80c-1700-0000-3b3e-251d7a0e0000 pid=3706 clone guuid=baeed80c-1700-0000-3b3e-251d7e0e0000 pid=3710 /usr/bin/rm delete-file guuid=f444bcdb-1600-0000-3b3e-251dc80d0000 pid=3528->guuid=baeed80c-1700-0000-3b3e-251d7e0e0000 pid=3710 execve guuid=3ae0580e-1700-0000-3b3e-251d870e0000 pid=3719 /usr/bin/rm guuid=f444bcdb-1600-0000-3b3e-251dc80d0000 pid=3528->guuid=3ae0580e-1700-0000-3b3e-251d870e0000 pid=3719 execve guuid=5976b40e-1700-0000-3b3e-251d8a0e0000 pid=3722 /usr/bin/wget net send-data guuid=f444bcdb-1600-0000-3b3e-251dc80d0000 pid=3528->guuid=5976b40e-1700-0000-3b3e-251d8a0e0000 pid=3722 execve guuid=d7702712-1700-0000-3b3e-251d970e0000 pid=3735 /usr/bin/curl net send-data write-file guuid=f444bcdb-1600-0000-3b3e-251dc80d0000 pid=3528->guuid=d7702712-1700-0000-3b3e-251d970e0000 pid=3735 execve guuid=d404cc1e-1700-0000-3b3e-251da20e0000 pid=3746 /usr/bin/chmod guuid=f444bcdb-1600-0000-3b3e-251dc80d0000 pid=3528->guuid=d404cc1e-1700-0000-3b3e-251da20e0000 pid=3746 execve guuid=63a4c81f-1700-0000-3b3e-251da50e0000 pid=3749 /usr/bin/bash guuid=f444bcdb-1600-0000-3b3e-251dc80d0000 pid=3528->guuid=63a4c81f-1700-0000-3b3e-251da50e0000 pid=3749 clone guuid=b8910e21-1700-0000-3b3e-251dab0e0000 pid=3755 /usr/bin/rm delete-file guuid=f444bcdb-1600-0000-3b3e-251dc80d0000 pid=3528->guuid=b8910e21-1700-0000-3b3e-251dab0e0000 pid=3755 execve guuid=12916a21-1700-0000-3b3e-251daf0e0000 pid=3759 /usr/bin/rm guuid=f444bcdb-1600-0000-3b3e-251dc80d0000 pid=3528->guuid=12916a21-1700-0000-3b3e-251daf0e0000 pid=3759 execve guuid=1d8a3222-1700-0000-3b3e-251db30e0000 pid=3763 /usr/bin/wget net send-data guuid=f444bcdb-1600-0000-3b3e-251dc80d0000 pid=3528->guuid=1d8a3222-1700-0000-3b3e-251db30e0000 pid=3763 execve guuid=ff119825-1700-0000-3b3e-251dbc0e0000 pid=3772 /usr/bin/curl net send-data write-file guuid=f444bcdb-1600-0000-3b3e-251dc80d0000 pid=3528->guuid=ff119825-1700-0000-3b3e-251dbc0e0000 pid=3772 execve guuid=2827282a-1700-0000-3b3e-251dcb0e0000 pid=3787 /usr/bin/chmod guuid=f444bcdb-1600-0000-3b3e-251dc80d0000 pid=3528->guuid=2827282a-1700-0000-3b3e-251dcb0e0000 pid=3787 execve guuid=48287c2a-1700-0000-3b3e-251dcf0e0000 pid=3791 /usr/bin/bash guuid=f444bcdb-1600-0000-3b3e-251dc80d0000 pid=3528->guuid=48287c2a-1700-0000-3b3e-251dcf0e0000 pid=3791 clone guuid=09d7c32a-1700-0000-3b3e-251dd20e0000 pid=3794 /usr/bin/rm delete-file guuid=f444bcdb-1600-0000-3b3e-251dc80d0000 pid=3528->guuid=09d7c32a-1700-0000-3b3e-251dd20e0000 pid=3794 execve guuid=9182172b-1700-0000-3b3e-251dd50e0000 pid=3797 /usr/bin/rm guuid=f444bcdb-1600-0000-3b3e-251dc80d0000 pid=3528->guuid=9182172b-1700-0000-3b3e-251dd50e0000 pid=3797 execve guuid=0cbe682b-1700-0000-3b3e-251dd70e0000 pid=3799 /usr/bin/wget net send-data guuid=f444bcdb-1600-0000-3b3e-251dc80d0000 pid=3528->guuid=0cbe682b-1700-0000-3b3e-251dd70e0000 pid=3799 execve guuid=86ad262e-1700-0000-3b3e-251de20e0000 pid=3810 /usr/bin/curl net send-data write-file guuid=f444bcdb-1600-0000-3b3e-251dc80d0000 pid=3528->guuid=86ad262e-1700-0000-3b3e-251de20e0000 pid=3810 execve guuid=2b413032-1700-0000-3b3e-251df50e0000 pid=3829 /usr/bin/chmod guuid=f444bcdb-1600-0000-3b3e-251dc80d0000 pid=3528->guuid=2b413032-1700-0000-3b3e-251df50e0000 pid=3829 execve guuid=d4e36632-1700-0000-3b3e-251df70e0000 pid=3831 /usr/bin/bash guuid=f444bcdb-1600-0000-3b3e-251dc80d0000 pid=3528->guuid=d4e36632-1700-0000-3b3e-251df70e0000 pid=3831 clone guuid=ce049632-1700-0000-3b3e-251dfa0e0000 pid=3834 /usr/bin/rm delete-file guuid=f444bcdb-1600-0000-3b3e-251dc80d0000 pid=3528->guuid=ce049632-1700-0000-3b3e-251dfa0e0000 pid=3834 execve guuid=3905d032-1700-0000-3b3e-251dfb0e0000 pid=3835 /usr/bin/rm guuid=f444bcdb-1600-0000-3b3e-251dc80d0000 pid=3528->guuid=3905d032-1700-0000-3b3e-251dfb0e0000 pid=3835 execve guuid=a9640833-1700-0000-3b3e-251dfd0e0000 pid=3837 /usr/bin/wget net send-data guuid=f444bcdb-1600-0000-3b3e-251dc80d0000 pid=3528->guuid=a9640833-1700-0000-3b3e-251dfd0e0000 pid=3837 execve guuid=af597435-1700-0000-3b3e-251d070f0000 pid=3847 /usr/bin/curl net send-data write-file guuid=f444bcdb-1600-0000-3b3e-251dc80d0000 pid=3528->guuid=af597435-1700-0000-3b3e-251d070f0000 pid=3847 execve guuid=b9352c39-1700-0000-3b3e-251d1f0f0000 pid=3871 /usr/bin/chmod guuid=f444bcdb-1600-0000-3b3e-251dc80d0000 pid=3528->guuid=b9352c39-1700-0000-3b3e-251d1f0f0000 pid=3871 execve guuid=764c6d39-1700-0000-3b3e-251d210f0000 pid=3873 /usr/bin/bash guuid=f444bcdb-1600-0000-3b3e-251dc80d0000 pid=3528->guuid=764c6d39-1700-0000-3b3e-251d210f0000 pid=3873 clone guuid=40bcb139-1700-0000-3b3e-251d240f0000 pid=3876 /usr/bin/rm delete-file guuid=f444bcdb-1600-0000-3b3e-251dc80d0000 pid=3528->guuid=40bcb139-1700-0000-3b3e-251d240f0000 pid=3876 execve guuid=8497ff39-1700-0000-3b3e-251d270f0000 pid=3879 /usr/bin/rm guuid=f444bcdb-1600-0000-3b3e-251dc80d0000 pid=3528->guuid=8497ff39-1700-0000-3b3e-251d270f0000 pid=3879 execve guuid=a0db493a-1700-0000-3b3e-251d2a0f0000 pid=3882 /usr/bin/wget net send-data guuid=f444bcdb-1600-0000-3b3e-251dc80d0000 pid=3528->guuid=a0db493a-1700-0000-3b3e-251d2a0f0000 pid=3882 execve guuid=f0d5d23c-1700-0000-3b3e-251d340f0000 pid=3892 /usr/bin/curl net send-data write-file guuid=f444bcdb-1600-0000-3b3e-251dc80d0000 pid=3528->guuid=f0d5d23c-1700-0000-3b3e-251d340f0000 pid=3892 execve guuid=e0ce2e40-1700-0000-3b3e-251d460f0000 pid=3910 /usr/bin/chmod guuid=f444bcdb-1600-0000-3b3e-251dc80d0000 pid=3528->guuid=e0ce2e40-1700-0000-3b3e-251d460f0000 pid=3910 execve guuid=57546940-1700-0000-3b3e-251d480f0000 pid=3912 /usr/bin/bash guuid=f444bcdb-1600-0000-3b3e-251dc80d0000 pid=3528->guuid=57546940-1700-0000-3b3e-251d480f0000 pid=3912 clone guuid=a7599340-1700-0000-3b3e-251d4a0f0000 pid=3914 /usr/bin/rm delete-file guuid=f444bcdb-1600-0000-3b3e-251dc80d0000 pid=3528->guuid=a7599340-1700-0000-3b3e-251d4a0f0000 pid=3914 execve guuid=9102cc40-1700-0000-3b3e-251d4c0f0000 pid=3916 /usr/bin/rm guuid=f444bcdb-1600-0000-3b3e-251dc80d0000 pid=3528->guuid=9102cc40-1700-0000-3b3e-251d4c0f0000 pid=3916 execve guuid=4bcc0141-1700-0000-3b3e-251d4e0f0000 pid=3918 /usr/bin/wget net send-data guuid=f444bcdb-1600-0000-3b3e-251dc80d0000 pid=3528->guuid=4bcc0141-1700-0000-3b3e-251d4e0f0000 pid=3918 execve guuid=60388943-1700-0000-3b3e-251d5a0f0000 pid=3930 /usr/bin/curl net send-data write-file guuid=f444bcdb-1600-0000-3b3e-251dc80d0000 pid=3528->guuid=60388943-1700-0000-3b3e-251d5a0f0000 pid=3930 execve guuid=e19aa647-1700-0000-3b3e-251d710f0000 pid=3953 /usr/bin/chmod guuid=f444bcdb-1600-0000-3b3e-251dc80d0000 pid=3528->guuid=e19aa647-1700-0000-3b3e-251d710f0000 pid=3953 execve guuid=4f95dd47-1700-0000-3b3e-251d730f0000 pid=3955 /usr/bin/bash guuid=f444bcdb-1600-0000-3b3e-251dc80d0000 pid=3528->guuid=4f95dd47-1700-0000-3b3e-251d730f0000 pid=3955 clone guuid=0c0c0c48-1700-0000-3b3e-251d760f0000 pid=3958 /usr/bin/rm delete-file guuid=f444bcdb-1600-0000-3b3e-251dc80d0000 pid=3528->guuid=0c0c0c48-1700-0000-3b3e-251d760f0000 pid=3958 execve guuid=7b924c48-1700-0000-3b3e-251d770f0000 pid=3959 /usr/bin/rm guuid=f444bcdb-1600-0000-3b3e-251dc80d0000 pid=3528->guuid=7b924c48-1700-0000-3b3e-251d770f0000 pid=3959 execve guuid=cdf28648-1700-0000-3b3e-251d790f0000 pid=3961 /usr/bin/wget net send-data guuid=f444bcdb-1600-0000-3b3e-251dc80d0000 pid=3528->guuid=cdf28648-1700-0000-3b3e-251d790f0000 pid=3961 execve guuid=3c2a0a4b-1700-0000-3b3e-251d860f0000 pid=3974 /usr/bin/curl net send-data write-file guuid=f444bcdb-1600-0000-3b3e-251dc80d0000 pid=3528->guuid=3c2a0a4b-1700-0000-3b3e-251d860f0000 pid=3974 execve guuid=9334894e-1700-0000-3b3e-251d970f0000 pid=3991 /usr/bin/chmod guuid=f444bcdb-1600-0000-3b3e-251dc80d0000 pid=3528->guuid=9334894e-1700-0000-3b3e-251d970f0000 pid=3991 execve guuid=3d9bc44e-1700-0000-3b3e-251d990f0000 pid=3993 /usr/bin/bash guuid=f444bcdb-1600-0000-3b3e-251dc80d0000 pid=3528->guuid=3d9bc44e-1700-0000-3b3e-251d990f0000 pid=3993 clone guuid=4507f64e-1700-0000-3b3e-251d9c0f0000 pid=3996 /usr/bin/rm delete-file guuid=f444bcdb-1600-0000-3b3e-251dc80d0000 pid=3528->guuid=4507f64e-1700-0000-3b3e-251d9c0f0000 pid=3996 execve guuid=f10a314f-1700-0000-3b3e-251d9e0f0000 pid=3998 /usr/bin/rm guuid=f444bcdb-1600-0000-3b3e-251dc80d0000 pid=3528->guuid=f10a314f-1700-0000-3b3e-251d9e0f0000 pid=3998 execve 5b654972-c9e1-50d8-b372-2dc2a5b9ad66 5.182.210.174:80 guuid=a9d6b7dc-1600-0000-3b3e-251dcc0d0000 pid=3532->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=102940e2-1600-0000-3b3e-251dd60d0000 pid=3542->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=186e32ed-1600-0000-3b3e-251de30d0000 pid=3555 /usr/bin/bash guuid=90e116ed-1600-0000-3b3e-251de20d0000 pid=3554->guuid=186e32ed-1600-0000-3b3e-251de30d0000 pid=3555 clone guuid=1112dced-1600-0000-3b3e-251de80d0000 pid=3560->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=95c51cf1-1600-0000-3b3e-251df00d0000 pid=3568->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=f9fcacf5-1600-0000-3b3e-251d000e0000 pid=3584 /usr/bin/bash guuid=0da395f5-1600-0000-3b3e-251dff0d0000 pid=3583->guuid=f9fcacf5-1600-0000-3b3e-251d000e0000 pid=3584 clone guuid=b69e54f6-1600-0000-3b3e-251d060e0000 pid=3590->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=080cccf8-1600-0000-3b3e-251d140e0000 pid=3604->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=3e82bffc-1600-0000-3b3e-251d2b0e0000 pid=3627 /usr/bin/bash guuid=9cf0aafc-1600-0000-3b3e-251d280e0000 pid=3624->guuid=3e82bffc-1600-0000-3b3e-251d2b0e0000 pid=3627 clone guuid=bbd255fd-1600-0000-3b3e-251d310e0000 pid=3633->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=bd6bdaff-1600-0000-3b3e-251d3c0e0000 pid=3644->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=91b1ba03-1700-0000-3b3e-251d4b0e0000 pid=3659 /usr/bin/bash guuid=5e609d03-1700-0000-3b3e-251d4a0e0000 pid=3658->guuid=91b1ba03-1700-0000-3b3e-251d4b0e0000 pid=3659 clone guuid=83148a04-1700-0000-3b3e-251d500e0000 pid=3664->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=da937707-1700-0000-3b3e-251d5b0e0000 pid=3675->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=4615bc0c-1700-0000-3b3e-251d7b0e0000 pid=3707 /usr/bin/bash guuid=0ea0a80c-1700-0000-3b3e-251d7a0e0000 pid=3706->guuid=4615bc0c-1700-0000-3b3e-251d7b0e0000 pid=3707 clone guuid=5976b40e-1700-0000-3b3e-251d8a0e0000 pid=3722->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=d7702712-1700-0000-3b3e-251d970e0000 pid=3735->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=3d950c20-1700-0000-3b3e-251da70e0000 pid=3751 /usr/bin/bash guuid=63a4c81f-1700-0000-3b3e-251da50e0000 pid=3749->guuid=3d950c20-1700-0000-3b3e-251da70e0000 pid=3751 clone guuid=1d8a3222-1700-0000-3b3e-251db30e0000 pid=3763->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=ff119825-1700-0000-3b3e-251dbc0e0000 pid=3772->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=6df3992a-1700-0000-3b3e-251dd00e0000 pid=3792 /usr/bin/bash guuid=48287c2a-1700-0000-3b3e-251dcf0e0000 pid=3791->guuid=6df3992a-1700-0000-3b3e-251dd00e0000 pid=3792 clone guuid=0cbe682b-1700-0000-3b3e-251dd70e0000 pid=3799->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=86ad262e-1700-0000-3b3e-251de20e0000 pid=3810->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=f5817932-1700-0000-3b3e-251df80e0000 pid=3832 /usr/bin/bash guuid=d4e36632-1700-0000-3b3e-251df70e0000 pid=3831->guuid=f5817932-1700-0000-3b3e-251df80e0000 pid=3832 clone guuid=a9640833-1700-0000-3b3e-251dfd0e0000 pid=3837->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=af597435-1700-0000-3b3e-251d070f0000 pid=3847->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=9bcc8c39-1700-0000-3b3e-251d230f0000 pid=3875 /usr/bin/bash guuid=764c6d39-1700-0000-3b3e-251d210f0000 pid=3873->guuid=9bcc8c39-1700-0000-3b3e-251d230f0000 pid=3875 clone guuid=a0db493a-1700-0000-3b3e-251d2a0f0000 pid=3882->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=f0d5d23c-1700-0000-3b3e-251d340f0000 pid=3892->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=3d767a40-1700-0000-3b3e-251d490f0000 pid=3913 /usr/bin/bash guuid=57546940-1700-0000-3b3e-251d480f0000 pid=3912->guuid=3d767a40-1700-0000-3b3e-251d490f0000 pid=3913 clone guuid=4bcc0141-1700-0000-3b3e-251d4e0f0000 pid=3918->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=60388943-1700-0000-3b3e-251d5a0f0000 pid=3930->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=b4dbf147-1700-0000-3b3e-251d740f0000 pid=3956 /usr/bin/bash guuid=4f95dd47-1700-0000-3b3e-251d730f0000 pid=3955->guuid=b4dbf147-1700-0000-3b3e-251d740f0000 pid=3956 clone guuid=cdf28648-1700-0000-3b3e-251d790f0000 pid=3961->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=3c2a0a4b-1700-0000-3b3e-251d860f0000 pid=3974->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=afebd74e-1700-0000-3b3e-251d9a0f0000 pid=3994 /usr/bin/bash guuid=3d9bc44e-1700-0000-3b3e-251d990f0000 pid=3993->guuid=afebd74e-1700-0000-3b3e-251d9a0f0000 pid=3994 clone
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/4b6c5c2d773b5d4b9483a20098faf68cbbc552ab477fbb7d5734409dd78f52ea
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4b6c5c2d773b5d4b9483a20098faf68cbbc552ab477fbb7d5734409dd78f52ea/
Threat name:
Linux.Downloader.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-08-29 05:07:03 UTC
File Type:
Text (Shell)
AV detection:
17 of 36 (47.22%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jnwfyllxhnouxfeduiajr6xwrs54kuvli573w7kxgraj3v4pklva._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260830-2y9htsbj6z/
Behaviour
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/4b6c5c2d773b5d4b9483a20098faf68cbbc552ab477fbb7d5734409dd78f52ea

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments