MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4cc5af32dfe739b1d73d1291dd178e4b8b76cb5b5cb4096b03d060c9236a5896. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4cc5af32dfe739b1d73d1291dd178e4b8b76cb5b5cb4096b03d060c9236a5896
SHA3-384 hash: b4acf004664b4ab165fa3a74e3c8dd80ad7e27fb6e0ea1e80fdaff2896ad31a4316bb3e657bc880f449402a6ee22b991
SHA1 hash: 825d925b5e2f90d7d5160c9fb07a465f7f7219d5
MD5 hash: fbfc482fd1420ffc9f918f064a20c59c
humanhash: one-iowa-uniform-yellow
File name:ok
Download: download sample
File size:1'608 bytes
First seen:2026-08-04 22:09:48 UTC
Last seen:2026-08-05 06:52:14 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 24:q3pGyj6b6BYKEVpPo0dHXwg+jeYsFYmoCcgl7J7NE:Io1dpw0dAg+6YsFN7J7NE
TLSH T13F3190FF0316DB128904CA4BB3A1154D5205C2AF2F6BE7F8EF4C2D3A638A5583259B47
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://45.135.194.70/0b9a70n/an/aua-wget
http://45.135.194.70/24f787n/an/aua-wget
http://45.135.194.70/5a6354n/an/aua-wget
http://45.135.194.70/fb275cn/an/aua-wget
http://45.135.194.70/6c4faen/an/aua-wget
http://45.135.194.70/5df8f3n/an/aua-wget
http://45.135.194.70/7791ffn/an/aua-wget
http://45.135.194.70/4efa5fn/an/aua-wget
http://45.135.194.70/550a54n/an/aua-wget
http://45.135.194.70/638fadn/an/aua-wget
http://45.135.194.70/3e6f4bn/an/aua-wget
http://45.135.194.70/e47dadn/an/aua-wget

Intelligence

File Origin
# of uploads :
2
# of downloads :
69
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive mirai
Link:
https://www.filescan.io/uploads/6a72635f8650235216a9d612/reports/257161df-0943-48b6-890b-95707377e1c2/overview
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/9dac9593-5b5c-491b-8b75-816d66bb91f3
Behavior Graph:
Download SVG
%3 guuid=464563fe-1800-0000-167a-5f769d080000 pid=2205 /usr/bin/sudo guuid=bb49c600-1900-0000-167a-5f76a1080000 pid=2209 /tmp/sample.bin guuid=464563fe-1800-0000-167a-5f769d080000 pid=2205->guuid=bb49c600-1900-0000-167a-5f76a1080000 pid=2209 execve guuid=a4c54801-1900-0000-167a-5f76a4080000 pid=2212 /usr/bin/wget net send-data guuid=bb49c600-1900-0000-167a-5f76a1080000 pid=2209->guuid=a4c54801-1900-0000-167a-5f76a4080000 pid=2212 execve guuid=2a71e807-1900-0000-167a-5f76b5080000 pid=2229 /usr/bin/curl net send-data write-file guuid=bb49c600-1900-0000-167a-5f76a1080000 pid=2209->guuid=2a71e807-1900-0000-167a-5f76b5080000 pid=2229 execve guuid=e16bd314-1900-0000-167a-5f76ca080000 pid=2250 /usr/bin/chmod guuid=bb49c600-1900-0000-167a-5f76a1080000 pid=2209->guuid=e16bd314-1900-0000-167a-5f76ca080000 pid=2250 execve guuid=7f341215-1900-0000-167a-5f76cb080000 pid=2251 /usr/bin/bash guuid=bb49c600-1900-0000-167a-5f76a1080000 pid=2209->guuid=7f341215-1900-0000-167a-5f76cb080000 pid=2251 clone guuid=bb785615-1900-0000-167a-5f76cd080000 pid=2253 /usr/bin/rm delete-file guuid=bb49c600-1900-0000-167a-5f76a1080000 pid=2209->guuid=bb785615-1900-0000-167a-5f76cd080000 pid=2253 execve guuid=04659a15-1900-0000-167a-5f76ce080000 pid=2254 /usr/bin/rm guuid=bb49c600-1900-0000-167a-5f76a1080000 pid=2209->guuid=04659a15-1900-0000-167a-5f76ce080000 pid=2254 execve guuid=e2f8e315-1900-0000-167a-5f76cf080000 pid=2255 /usr/bin/wget net send-data guuid=bb49c600-1900-0000-167a-5f76a1080000 pid=2209->guuid=e2f8e315-1900-0000-167a-5f76cf080000 pid=2255 execve guuid=3aa1d71c-1900-0000-167a-5f76d8080000 pid=2264 /usr/bin/curl net send-data write-file guuid=bb49c600-1900-0000-167a-5f76a1080000 pid=2209->guuid=3aa1d71c-1900-0000-167a-5f76d8080000 pid=2264 execve guuid=81478c29-1900-0000-167a-5f76f0080000 pid=2288 /usr/bin/chmod guuid=bb49c600-1900-0000-167a-5f76a1080000 pid=2209->guuid=81478c29-1900-0000-167a-5f76f0080000 pid=2288 execve guuid=4c87242a-1900-0000-167a-5f76f3080000 pid=2291 /usr/bin/bash guuid=bb49c600-1900-0000-167a-5f76a1080000 pid=2209->guuid=4c87242a-1900-0000-167a-5f76f3080000 pid=2291 clone guuid=f844722a-1900-0000-167a-5f76f5080000 pid=2293 /usr/bin/rm delete-file guuid=bb49c600-1900-0000-167a-5f76a1080000 pid=2209->guuid=f844722a-1900-0000-167a-5f76f5080000 pid=2293 execve guuid=3b8c262b-1900-0000-167a-5f76f6080000 pid=2294 /usr/bin/rm guuid=bb49c600-1900-0000-167a-5f76a1080000 pid=2209->guuid=3b8c262b-1900-0000-167a-5f76f6080000 pid=2294 execve guuid=39b1d52b-1900-0000-167a-5f76f8080000 pid=2296 /usr/bin/wget net send-data guuid=bb49c600-1900-0000-167a-5f76a1080000 pid=2209->guuid=39b1d52b-1900-0000-167a-5f76f8080000 pid=2296 execve guuid=57ae7c31-1900-0000-167a-5f7601090000 pid=2305 /usr/bin/curl net send-data write-file guuid=bb49c600-1900-0000-167a-5f76a1080000 pid=2209->guuid=57ae7c31-1900-0000-167a-5f7601090000 pid=2305 execve guuid=4d24183a-1900-0000-167a-5f7609090000 pid=2313 /usr/bin/chmod guuid=bb49c600-1900-0000-167a-5f76a1080000 pid=2209->guuid=4d24183a-1900-0000-167a-5f7609090000 pid=2313 execve guuid=ebb3563a-1900-0000-167a-5f760b090000 pid=2315 /usr/bin/bash guuid=bb49c600-1900-0000-167a-5f76a1080000 pid=2209->guuid=ebb3563a-1900-0000-167a-5f760b090000 pid=2315 clone guuid=6620a03a-1900-0000-167a-5f760e090000 pid=2318 /usr/bin/rm delete-file guuid=bb49c600-1900-0000-167a-5f76a1080000 pid=2209->guuid=6620a03a-1900-0000-167a-5f760e090000 pid=2318 execve guuid=2870f23a-1900-0000-167a-5f7610090000 pid=2320 /usr/bin/rm guuid=bb49c600-1900-0000-167a-5f76a1080000 pid=2209->guuid=2870f23a-1900-0000-167a-5f7610090000 pid=2320 execve guuid=c91e343b-1900-0000-167a-5f7611090000 pid=2321 /usr/bin/wget net send-data guuid=bb49c600-1900-0000-167a-5f76a1080000 pid=2209->guuid=c91e343b-1900-0000-167a-5f7611090000 pid=2321 execve guuid=6c386240-1900-0000-167a-5f761e090000 pid=2334 /usr/bin/curl net send-data write-file guuid=bb49c600-1900-0000-167a-5f76a1080000 pid=2209->guuid=6c386240-1900-0000-167a-5f761e090000 pid=2334 execve guuid=a578cb47-1900-0000-167a-5f7631090000 pid=2353 /usr/bin/chmod guuid=bb49c600-1900-0000-167a-5f76a1080000 pid=2209->guuid=a578cb47-1900-0000-167a-5f7631090000 pid=2353 execve guuid=7b973c48-1900-0000-167a-5f7632090000 pid=2354 /usr/bin/bash guuid=bb49c600-1900-0000-167a-5f76a1080000 pid=2209->guuid=7b973c48-1900-0000-167a-5f7632090000 pid=2354 clone guuid=ecfd8348-1900-0000-167a-5f7635090000 pid=2357 /usr/bin/rm delete-file guuid=bb49c600-1900-0000-167a-5f76a1080000 pid=2209->guuid=ecfd8348-1900-0000-167a-5f7635090000 pid=2357 execve guuid=8066d648-1900-0000-167a-5f7637090000 pid=2359 /usr/bin/rm guuid=bb49c600-1900-0000-167a-5f76a1080000 pid=2209->guuid=8066d648-1900-0000-167a-5f7637090000 pid=2359 execve guuid=a8760e49-1900-0000-167a-5f7638090000 pid=2360 /usr/bin/wget net send-data guuid=bb49c600-1900-0000-167a-5f76a1080000 pid=2209->guuid=a8760e49-1900-0000-167a-5f7638090000 pid=2360 execve guuid=4c9fd34d-1900-0000-167a-5f7646090000 pid=2374 /usr/bin/curl net send-data write-file guuid=bb49c600-1900-0000-167a-5f76a1080000 pid=2209->guuid=4c9fd34d-1900-0000-167a-5f7646090000 pid=2374 execve guuid=64972b54-1900-0000-167a-5f7659090000 pid=2393 /usr/bin/chmod guuid=bb49c600-1900-0000-167a-5f76a1080000 pid=2209->guuid=64972b54-1900-0000-167a-5f7659090000 pid=2393 execve guuid=d0d87e54-1900-0000-167a-5f765a090000 pid=2394 /usr/bin/bash guuid=bb49c600-1900-0000-167a-5f76a1080000 pid=2209->guuid=d0d87e54-1900-0000-167a-5f765a090000 pid=2394 clone guuid=8320c954-1900-0000-167a-5f765d090000 pid=2397 /usr/bin/rm delete-file guuid=bb49c600-1900-0000-167a-5f76a1080000 pid=2209->guuid=8320c954-1900-0000-167a-5f765d090000 pid=2397 execve guuid=a58f3c55-1900-0000-167a-5f765f090000 pid=2399 /usr/bin/rm guuid=bb49c600-1900-0000-167a-5f76a1080000 pid=2209->guuid=a58f3c55-1900-0000-167a-5f765f090000 pid=2399 execve guuid=04dca155-1900-0000-167a-5f7661090000 pid=2401 /usr/bin/wget net send-data guuid=bb49c600-1900-0000-167a-5f76a1080000 pid=2209->guuid=04dca155-1900-0000-167a-5f7661090000 pid=2401 execve guuid=acd7eb5a-1900-0000-167a-5f766c090000 pid=2412 /usr/bin/curl net send-data write-file guuid=bb49c600-1900-0000-167a-5f76a1080000 pid=2209->guuid=acd7eb5a-1900-0000-167a-5f766c090000 pid=2412 execve guuid=65fb2962-1900-0000-167a-5f7675090000 pid=2421 /usr/bin/chmod guuid=bb49c600-1900-0000-167a-5f76a1080000 pid=2209->guuid=65fb2962-1900-0000-167a-5f7675090000 pid=2421 execve guuid=b869be62-1900-0000-167a-5f7676090000 pid=2422 /usr/bin/bash guuid=bb49c600-1900-0000-167a-5f76a1080000 pid=2209->guuid=b869be62-1900-0000-167a-5f7676090000 pid=2422 clone guuid=577e1563-1900-0000-167a-5f7679090000 pid=2425 /usr/bin/rm delete-file guuid=bb49c600-1900-0000-167a-5f76a1080000 pid=2209->guuid=577e1563-1900-0000-167a-5f7679090000 pid=2425 execve guuid=02319563-1900-0000-167a-5f767b090000 pid=2427 /usr/bin/rm guuid=bb49c600-1900-0000-167a-5f76a1080000 pid=2209->guuid=02319563-1900-0000-167a-5f767b090000 pid=2427 execve guuid=276afb63-1900-0000-167a-5f767d090000 pid=2429 /usr/bin/wget net send-data guuid=bb49c600-1900-0000-167a-5f76a1080000 pid=2209->guuid=276afb63-1900-0000-167a-5f767d090000 pid=2429 execve guuid=4016a469-1900-0000-167a-5f7684090000 pid=2436 /usr/bin/curl net send-data write-file guuid=bb49c600-1900-0000-167a-5f76a1080000 pid=2209->guuid=4016a469-1900-0000-167a-5f7684090000 pid=2436 execve guuid=0ae6ec70-1900-0000-167a-5f768f090000 pid=2447 /usr/bin/chmod guuid=bb49c600-1900-0000-167a-5f76a1080000 pid=2209->guuid=0ae6ec70-1900-0000-167a-5f768f090000 pid=2447 execve guuid=6b6ea071-1900-0000-167a-5f7691090000 pid=2449 /usr/bin/bash guuid=bb49c600-1900-0000-167a-5f76a1080000 pid=2209->guuid=6b6ea071-1900-0000-167a-5f7691090000 pid=2449 clone guuid=32e24472-1900-0000-167a-5f7695090000 pid=2453 /usr/bin/rm delete-file guuid=bb49c600-1900-0000-167a-5f76a1080000 pid=2209->guuid=32e24472-1900-0000-167a-5f7695090000 pid=2453 execve guuid=a9e2d472-1900-0000-167a-5f7698090000 pid=2456 /usr/bin/rm guuid=bb49c600-1900-0000-167a-5f76a1080000 pid=2209->guuid=a9e2d472-1900-0000-167a-5f7698090000 pid=2456 execve guuid=fff1f973-1900-0000-167a-5f769a090000 pid=2458 /usr/bin/wget net send-data guuid=bb49c600-1900-0000-167a-5f76a1080000 pid=2209->guuid=fff1f973-1900-0000-167a-5f769a090000 pid=2458 execve guuid=384c807b-1900-0000-167a-5f76a2090000 pid=2466 /usr/bin/curl net send-data write-file guuid=bb49c600-1900-0000-167a-5f76a1080000 pid=2209->guuid=384c807b-1900-0000-167a-5f76a2090000 pid=2466 execve guuid=010ea383-1900-0000-167a-5f76a8090000 pid=2472 /usr/bin/chmod guuid=bb49c600-1900-0000-167a-5f76a1080000 pid=2209->guuid=010ea383-1900-0000-167a-5f76a8090000 pid=2472 execve guuid=e3ab1d84-1900-0000-167a-5f76a9090000 pid=2473 /usr/bin/bash guuid=bb49c600-1900-0000-167a-5f76a1080000 pid=2209->guuid=e3ab1d84-1900-0000-167a-5f76a9090000 pid=2473 clone guuid=ca6b7884-1900-0000-167a-5f76ab090000 pid=2475 /usr/bin/rm delete-file guuid=bb49c600-1900-0000-167a-5f76a1080000 pid=2209->guuid=ca6b7884-1900-0000-167a-5f76ab090000 pid=2475 execve guuid=72feff84-1900-0000-167a-5f76ac090000 pid=2476 /usr/bin/rm guuid=bb49c600-1900-0000-167a-5f76a1080000 pid=2209->guuid=72feff84-1900-0000-167a-5f76ac090000 pid=2476 execve guuid=c55e7c85-1900-0000-167a-5f76ae090000 pid=2478 /usr/bin/wget net send-data guuid=bb49c600-1900-0000-167a-5f76a1080000 pid=2209->guuid=c55e7c85-1900-0000-167a-5f76ae090000 pid=2478 execve guuid=5c335e8b-1900-0000-167a-5f76b9090000 pid=2489 /usr/bin/curl net send-data write-file guuid=bb49c600-1900-0000-167a-5f76a1080000 pid=2209->guuid=5c335e8b-1900-0000-167a-5f76b9090000 pid=2489 execve guuid=a5d94d97-1900-0000-167a-5f76d2090000 pid=2514 /usr/bin/chmod guuid=bb49c600-1900-0000-167a-5f76a1080000 pid=2209->guuid=a5d94d97-1900-0000-167a-5f76d2090000 pid=2514 execve guuid=5f843398-1900-0000-167a-5f76d7090000 pid=2519 /usr/bin/bash guuid=bb49c600-1900-0000-167a-5f76a1080000 pid=2209->guuid=5f843398-1900-0000-167a-5f76d7090000 pid=2519 clone guuid=f53dd698-1900-0000-167a-5f76db090000 pid=2523 /usr/bin/rm delete-file guuid=bb49c600-1900-0000-167a-5f76a1080000 pid=2209->guuid=f53dd698-1900-0000-167a-5f76db090000 pid=2523 execve guuid=76cbc699-1900-0000-167a-5f76df090000 pid=2527 /usr/bin/rm guuid=bb49c600-1900-0000-167a-5f76a1080000 pid=2209->guuid=76cbc699-1900-0000-167a-5f76df090000 pid=2527 execve guuid=27708e9a-1900-0000-167a-5f76e3090000 pid=2531 /usr/bin/wget net send-data guuid=bb49c600-1900-0000-167a-5f76a1080000 pid=2209->guuid=27708e9a-1900-0000-167a-5f76e3090000 pid=2531 execve guuid=eb6f65a0-1900-0000-167a-5f76f2090000 pid=2546 /usr/bin/curl net send-data write-file guuid=bb49c600-1900-0000-167a-5f76a1080000 pid=2209->guuid=eb6f65a0-1900-0000-167a-5f76f2090000 pid=2546 execve guuid=c7a1c9a6-1900-0000-167a-5f76040a0000 pid=2564 /usr/bin/chmod guuid=bb49c600-1900-0000-167a-5f76a1080000 pid=2209->guuid=c7a1c9a6-1900-0000-167a-5f76040a0000 pid=2564 execve guuid=fa1451a7-1900-0000-167a-5f76060a0000 pid=2566 /usr/bin/bash guuid=bb49c600-1900-0000-167a-5f76a1080000 pid=2209->guuid=fa1451a7-1900-0000-167a-5f76060a0000 pid=2566 clone guuid=7c0b8ca7-1900-0000-167a-5f76080a0000 pid=2568 /usr/bin/rm delete-file guuid=bb49c600-1900-0000-167a-5f76a1080000 pid=2209->guuid=7c0b8ca7-1900-0000-167a-5f76080a0000 pid=2568 execve guuid=9195e1a7-1900-0000-167a-5f760a0a0000 pid=2570 /usr/bin/rm guuid=bb49c600-1900-0000-167a-5f76a1080000 pid=2209->guuid=9195e1a7-1900-0000-167a-5f760a0a0000 pid=2570 execve guuid=bd5e38a8-1900-0000-167a-5f760c0a0000 pid=2572 /usr/bin/wget net send-data guuid=bb49c600-1900-0000-167a-5f76a1080000 pid=2209->guuid=bd5e38a8-1900-0000-167a-5f760c0a0000 pid=2572 execve guuid=d7c376ad-1900-0000-167a-5f76190a0000 pid=2585 /usr/bin/curl net send-data write-file guuid=bb49c600-1900-0000-167a-5f76a1080000 pid=2209->guuid=d7c376ad-1900-0000-167a-5f76190a0000 pid=2585 execve guuid=7d3a15bb-1900-0000-167a-5f76370a0000 pid=2615 /usr/bin/chmod guuid=bb49c600-1900-0000-167a-5f76a1080000 pid=2209->guuid=7d3a15bb-1900-0000-167a-5f76370a0000 pid=2615 execve guuid=7b9ddfbb-1900-0000-167a-5f763c0a0000 pid=2620 /usr/bin/bash guuid=bb49c600-1900-0000-167a-5f76a1080000 pid=2209->guuid=7b9ddfbb-1900-0000-167a-5f763c0a0000 pid=2620 clone guuid=896561bc-1900-0000-167a-5f76400a0000 pid=2624 /usr/bin/rm delete-file guuid=bb49c600-1900-0000-167a-5f76a1080000 pid=2209->guuid=896561bc-1900-0000-167a-5f76400a0000 pid=2624 execve guuid=44620fbd-1900-0000-167a-5f76440a0000 pid=2628 /usr/bin/rm guuid=bb49c600-1900-0000-167a-5f76a1080000 pid=2209->guuid=44620fbd-1900-0000-167a-5f76440a0000 pid=2628 execve guuid=b70b64bd-1900-0000-167a-5f76460a0000 pid=2630 /usr/bin/wget net send-data guuid=bb49c600-1900-0000-167a-5f76a1080000 pid=2209->guuid=b70b64bd-1900-0000-167a-5f76460a0000 pid=2630 execve guuid=75bafdc2-1900-0000-167a-5f76570a0000 pid=2647 /usr/bin/curl net send-data write-file guuid=bb49c600-1900-0000-167a-5f76a1080000 pid=2209->guuid=75bafdc2-1900-0000-167a-5f76570a0000 pid=2647 execve guuid=d604f3cc-1900-0000-167a-5f766e0a0000 pid=2670 /usr/bin/chmod guuid=bb49c600-1900-0000-167a-5f76a1080000 pid=2209->guuid=d604f3cc-1900-0000-167a-5f766e0a0000 pid=2670 execve guuid=5d1d69cd-1900-0000-167a-5f766f0a0000 pid=2671 /usr/bin/bash guuid=bb49c600-1900-0000-167a-5f76a1080000 pid=2209->guuid=5d1d69cd-1900-0000-167a-5f766f0a0000 pid=2671 clone guuid=40fcb3cd-1900-0000-167a-5f76720a0000 pid=2674 /usr/bin/rm delete-file guuid=bb49c600-1900-0000-167a-5f76a1080000 pid=2209->guuid=40fcb3cd-1900-0000-167a-5f76720a0000 pid=2674 execve guuid=06c923ce-1900-0000-167a-5f76730a0000 pid=2675 /usr/bin/rm guuid=bb49c600-1900-0000-167a-5f76a1080000 pid=2209->guuid=06c923ce-1900-0000-167a-5f76730a0000 pid=2675 execve 31ae31d1-82f1-53e4-9741-df532413b27c 45.135.194.70:80 guuid=a4c54801-1900-0000-167a-5f76a4080000 pid=2212->31ae31d1-82f1-53e4-9741-df532413b27c send: 134B guuid=2a71e807-1900-0000-167a-5f76b5080000 pid=2229->31ae31d1-82f1-53e4-9741-df532413b27c send: 83B guuid=fbd32e15-1900-0000-167a-5f76cc080000 pid=2252 /usr/bin/bash guuid=7f341215-1900-0000-167a-5f76cb080000 pid=2251->guuid=fbd32e15-1900-0000-167a-5f76cc080000 pid=2252 clone guuid=e2f8e315-1900-0000-167a-5f76cf080000 pid=2255->31ae31d1-82f1-53e4-9741-df532413b27c send: 134B guuid=3aa1d71c-1900-0000-167a-5f76d8080000 pid=2264->31ae31d1-82f1-53e4-9741-df532413b27c send: 83B guuid=fed1492a-1900-0000-167a-5f76f4080000 pid=2292 /usr/bin/bash guuid=4c87242a-1900-0000-167a-5f76f3080000 pid=2291->guuid=fed1492a-1900-0000-167a-5f76f4080000 pid=2292 clone guuid=39b1d52b-1900-0000-167a-5f76f8080000 pid=2296->31ae31d1-82f1-53e4-9741-df532413b27c send: 134B guuid=57ae7c31-1900-0000-167a-5f7601090000 pid=2305->31ae31d1-82f1-53e4-9741-df532413b27c send: 83B guuid=3c546f3a-1900-0000-167a-5f760c090000 pid=2316 /usr/bin/bash guuid=ebb3563a-1900-0000-167a-5f760b090000 pid=2315->guuid=3c546f3a-1900-0000-167a-5f760c090000 pid=2316 clone guuid=c91e343b-1900-0000-167a-5f7611090000 pid=2321->31ae31d1-82f1-53e4-9741-df532413b27c send: 134B guuid=6c386240-1900-0000-167a-5f761e090000 pid=2334->31ae31d1-82f1-53e4-9741-df532413b27c send: 83B guuid=b3235f48-1900-0000-167a-5f7633090000 pid=2355 /usr/bin/bash guuid=7b973c48-1900-0000-167a-5f7632090000 pid=2354->guuid=b3235f48-1900-0000-167a-5f7633090000 pid=2355 clone guuid=a8760e49-1900-0000-167a-5f7638090000 pid=2360->31ae31d1-82f1-53e4-9741-df532413b27c send: 134B guuid=4c9fd34d-1900-0000-167a-5f7646090000 pid=2374->31ae31d1-82f1-53e4-9741-df532413b27c send: 83B guuid=28dca354-1900-0000-167a-5f765c090000 pid=2396 /usr/bin/bash guuid=d0d87e54-1900-0000-167a-5f765a090000 pid=2394->guuid=28dca354-1900-0000-167a-5f765c090000 pid=2396 clone guuid=04dca155-1900-0000-167a-5f7661090000 pid=2401->31ae31d1-82f1-53e4-9741-df532413b27c send: 134B guuid=acd7eb5a-1900-0000-167a-5f766c090000 pid=2412->31ae31d1-82f1-53e4-9741-df532413b27c send: 83B guuid=abdfe362-1900-0000-167a-5f7678090000 pid=2424 /usr/bin/bash guuid=b869be62-1900-0000-167a-5f7676090000 pid=2422->guuid=abdfe362-1900-0000-167a-5f7678090000 pid=2424 clone guuid=276afb63-1900-0000-167a-5f767d090000 pid=2429->31ae31d1-82f1-53e4-9741-df532413b27c send: 134B guuid=4016a469-1900-0000-167a-5f7684090000 pid=2436->31ae31d1-82f1-53e4-9741-df532413b27c send: 83B guuid=c4a9f971-1900-0000-167a-5f7694090000 pid=2452 /usr/bin/bash guuid=6b6ea071-1900-0000-167a-5f7691090000 pid=2449->guuid=c4a9f971-1900-0000-167a-5f7694090000 pid=2452 clone guuid=fff1f973-1900-0000-167a-5f769a090000 pid=2458->31ae31d1-82f1-53e4-9741-df532413b27c send: 134B guuid=384c807b-1900-0000-167a-5f76a2090000 pid=2466->31ae31d1-82f1-53e4-9741-df532413b27c send: 83B guuid=33164784-1900-0000-167a-5f76aa090000 pid=2474 /usr/bin/bash guuid=e3ab1d84-1900-0000-167a-5f76a9090000 pid=2473->guuid=33164784-1900-0000-167a-5f76aa090000 pid=2474 clone guuid=c55e7c85-1900-0000-167a-5f76ae090000 pid=2478->31ae31d1-82f1-53e4-9741-df532413b27c send: 134B guuid=5c335e8b-1900-0000-167a-5f76b9090000 pid=2489->31ae31d1-82f1-53e4-9741-df532413b27c send: 83B guuid=45038698-1900-0000-167a-5f76d9090000 pid=2521 /usr/bin/bash guuid=5f843398-1900-0000-167a-5f76d7090000 pid=2519->guuid=45038698-1900-0000-167a-5f76d9090000 pid=2521 clone guuid=27708e9a-1900-0000-167a-5f76e3090000 pid=2531->31ae31d1-82f1-53e4-9741-df532413b27c send: 134B guuid=eb6f65a0-1900-0000-167a-5f76f2090000 pid=2546->31ae31d1-82f1-53e4-9741-df532413b27c send: 83B guuid=b17d6aa7-1900-0000-167a-5f76070a0000 pid=2567 /usr/bin/bash guuid=fa1451a7-1900-0000-167a-5f76060a0000 pid=2566->guuid=b17d6aa7-1900-0000-167a-5f76070a0000 pid=2567 clone guuid=bd5e38a8-1900-0000-167a-5f760c0a0000 pid=2572->31ae31d1-82f1-53e4-9741-df532413b27c send: 134B guuid=d7c376ad-1900-0000-167a-5f76190a0000 pid=2585->31ae31d1-82f1-53e4-9741-df532413b27c send: 83B guuid=142e0ebc-1900-0000-167a-5f763d0a0000 pid=2621 /usr/bin/bash guuid=7b9ddfbb-1900-0000-167a-5f763c0a0000 pid=2620->guuid=142e0ebc-1900-0000-167a-5f763d0a0000 pid=2621 clone guuid=b70b64bd-1900-0000-167a-5f76460a0000 pid=2630->31ae31d1-82f1-53e4-9741-df532413b27c send: 134B guuid=75bafdc2-1900-0000-167a-5f76570a0000 pid=2647->31ae31d1-82f1-53e4-9741-df532413b27c send: 83B guuid=5a2c88cd-1900-0000-167a-5f76700a0000 pid=2672 /usr/bin/bash guuid=5d1d69cd-1900-0000-167a-5f766f0a0000 pid=2671->guuid=5a2c88cd-1900-0000-167a-5f76700a0000 pid=2672 clone
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/4cc5af32dfe739b1d73d1291dd178e4b8b76cb5b5cb4096b03d060c9236a5896
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4cc5af32dfe739b1d73d1291dd178e4b8b76cb5b5cb4096b03d060c9236a5896/
Threat name:
Document-HTML.Hacktool.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2026-08-04 22:10:15 UTC
File Type:
Text (Shell)
AV detection:
9 of 36 (25.00%)
Threat level:
  1/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jtc26mw74443dvz5cki52f4ojofxns23ls2as2yd2bqmsi3klcla._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260804-13n71ser2y/
Behaviour
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.11
Link:
https://yomi.yoroi.company/submissions/4cc5af32dfe739b1d73d1291dd178e4b8b76cb5b5cb4096b03d060c9236a5896

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 4cc5af32dfe739b1d73d1291dd178e4b8b76cb5b5cb4096b03d060c9236a5896

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3897027/
  
Delivery method
Distributed via web download

Comments