MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4e4e1863e1521a9ed6faaae28e08a7c3e37b3752a398aef77fc65290e04c4aa4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4e4e1863e1521a9ed6faaae28e08a7c3e37b3752a398aef77fc65290e04c4aa4
SHA3-384 hash: 72221f4eb380e35e05714fb46ec3f3b2e1a40afc307f296869b950bee78e086a43e5305dd13e3711e7064729327d9076
SHA1 hash: 990a44cfee9af647280c37433bdf59643f99dbf4
MD5 hash: 439e5fae088d29d32f8ffbd2555cbfe3
humanhash: four-massachusetts-november-echo
File name:4e4e1863e1521a9ed6faaae28e08a7c3e37b3752a398aef77fc65290e04c4aa4
Download: download sample
File size:1'608 bytes
First seen:2026-08-28 23:00:15 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 24:SLdLdNfRixMEGd658R8PcBVeOj+s4bX7PTITZhp81GUPwFUH52:SppPEGdWGkcuOj+sQX7PTITpYwO2
TLSH T17231A5DE54101A310403CD4E33B7364CB59DEAE7295FD7D0E8690EA98248AECF121B4E
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter EnthecSolutions
Tags:enthec sh
URLMalware sample (SHA256 hash)SignatureTags
http://5.182.210.174/a97a18n/an/an/a
http://5.182.210.174/4c23ben/an/an/a
http://5.182.210.174/1c8912n/an/an/a
http://5.182.210.174/50e59dn/an/an/a
http://5.182.210.174/34d97en/an/an/a
http://5.182.210.174/0aec05n/an/an/a
http://5.182.210.174/7a66aen/an/an/a
http://5.182.210.174/6fd7e6n/an/an/a
http://5.182.210.174/99bda9n/an/an/a
http://5.182.210.174/8a6c47n/an/an/a
http://5.182.210.174/80e217n/an/an/a
http://5.182.210.174/1b77b2n/an/an/a

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
CA CA
Vendor Threat Intelligence
No detections
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/a558329e-cb33-4798-ac0a-9f94acfa0d30
Behavior Graph:
Download SVG
%3 guuid=039ff3fd-1800-0000-d8df-cf88b70b0000 pid=2999 /usr/bin/sudo guuid=c46a8f01-1900-0000-d8df-cf88c00b0000 pid=3008 /tmp/sample.bin guuid=039ff3fd-1800-0000-d8df-cf88b70b0000 pid=2999->guuid=c46a8f01-1900-0000-d8df-cf88c00b0000 pid=3008 execve guuid=fb3e1002-1900-0000-d8df-cf88c20b0000 pid=3010 /usr/bin/wget net send-data guuid=c46a8f01-1900-0000-d8df-cf88c00b0000 pid=3008->guuid=fb3e1002-1900-0000-d8df-cf88c20b0000 pid=3010 execve guuid=d20ad306-1900-0000-d8df-cf88ce0b0000 pid=3022 /usr/bin/curl net send-data write-file guuid=c46a8f01-1900-0000-d8df-cf88c00b0000 pid=3008->guuid=d20ad306-1900-0000-d8df-cf88ce0b0000 pid=3022 execve guuid=add70512-1900-0000-d8df-cf88e70b0000 pid=3047 /usr/bin/chmod guuid=c46a8f01-1900-0000-d8df-cf88c00b0000 pid=3008->guuid=add70512-1900-0000-d8df-cf88e70b0000 pid=3047 execve guuid=22707412-1900-0000-d8df-cf88e80b0000 pid=3048 /usr/bin/bash guuid=c46a8f01-1900-0000-d8df-cf88c00b0000 pid=3008->guuid=22707412-1900-0000-d8df-cf88e80b0000 pid=3048 clone guuid=2fe00113-1900-0000-d8df-cf88eb0b0000 pid=3051 /usr/bin/rm delete-file guuid=c46a8f01-1900-0000-d8df-cf88c00b0000 pid=3008->guuid=2fe00113-1900-0000-d8df-cf88eb0b0000 pid=3051 execve guuid=1dcb4813-1900-0000-d8df-cf88ec0b0000 pid=3052 /usr/bin/rm guuid=c46a8f01-1900-0000-d8df-cf88c00b0000 pid=3008->guuid=1dcb4813-1900-0000-d8df-cf88ec0b0000 pid=3052 execve guuid=3c868f13-1900-0000-d8df-cf88ee0b0000 pid=3054 /usr/bin/wget net send-data guuid=c46a8f01-1900-0000-d8df-cf88c00b0000 pid=3008->guuid=3c868f13-1900-0000-d8df-cf88ee0b0000 pid=3054 execve guuid=2863a516-1900-0000-d8df-cf88f50b0000 pid=3061 /usr/bin/curl net send-data write-file guuid=c46a8f01-1900-0000-d8df-cf88c00b0000 pid=3008->guuid=2863a516-1900-0000-d8df-cf88f50b0000 pid=3061 execve guuid=3503441d-1900-0000-d8df-cf88fc0b0000 pid=3068 /usr/bin/chmod guuid=c46a8f01-1900-0000-d8df-cf88c00b0000 pid=3008->guuid=3503441d-1900-0000-d8df-cf88fc0b0000 pid=3068 execve guuid=6a0aac1d-1900-0000-d8df-cf88fd0b0000 pid=3069 /usr/bin/bash guuid=c46a8f01-1900-0000-d8df-cf88c00b0000 pid=3008->guuid=6a0aac1d-1900-0000-d8df-cf88fd0b0000 pid=3069 clone guuid=8b860b1e-1900-0000-d8df-cf88ff0b0000 pid=3071 /usr/bin/rm delete-file guuid=c46a8f01-1900-0000-d8df-cf88c00b0000 pid=3008->guuid=8b860b1e-1900-0000-d8df-cf88ff0b0000 pid=3071 execve guuid=4800b31e-1900-0000-d8df-cf88000c0000 pid=3072 /usr/bin/rm guuid=c46a8f01-1900-0000-d8df-cf88c00b0000 pid=3008->guuid=4800b31e-1900-0000-d8df-cf88000c0000 pid=3072 execve guuid=2d1d3c1f-1900-0000-d8df-cf88010c0000 pid=3073 /usr/bin/wget net send-data guuid=c46a8f01-1900-0000-d8df-cf88c00b0000 pid=3008->guuid=2d1d3c1f-1900-0000-d8df-cf88010c0000 pid=3073 execve guuid=5e209e22-1900-0000-d8df-cf88020c0000 pid=3074 /usr/bin/curl net send-data write-file guuid=c46a8f01-1900-0000-d8df-cf88c00b0000 pid=3008->guuid=5e209e22-1900-0000-d8df-cf88020c0000 pid=3074 execve guuid=cda8fd26-1900-0000-d8df-cf88030c0000 pid=3075 /usr/bin/chmod guuid=c46a8f01-1900-0000-d8df-cf88c00b0000 pid=3008->guuid=cda8fd26-1900-0000-d8df-cf88030c0000 pid=3075 execve guuid=f6ce5d27-1900-0000-d8df-cf88040c0000 pid=3076 /usr/bin/bash guuid=c46a8f01-1900-0000-d8df-cf88c00b0000 pid=3008->guuid=f6ce5d27-1900-0000-d8df-cf88040c0000 pid=3076 clone guuid=bf68af27-1900-0000-d8df-cf88060c0000 pid=3078 /usr/bin/rm delete-file guuid=c46a8f01-1900-0000-d8df-cf88c00b0000 pid=3008->guuid=bf68af27-1900-0000-d8df-cf88060c0000 pid=3078 execve guuid=24991328-1900-0000-d8df-cf88070c0000 pid=3079 /usr/bin/rm guuid=c46a8f01-1900-0000-d8df-cf88c00b0000 pid=3008->guuid=24991328-1900-0000-d8df-cf88070c0000 pid=3079 execve guuid=08ab7128-1900-0000-d8df-cf88080c0000 pid=3080 /usr/bin/wget net send-data guuid=c46a8f01-1900-0000-d8df-cf88c00b0000 pid=3008->guuid=08ab7128-1900-0000-d8df-cf88080c0000 pid=3080 execve guuid=cdc8c22b-1900-0000-d8df-cf88090c0000 pid=3081 /usr/bin/curl net send-data write-file guuid=c46a8f01-1900-0000-d8df-cf88c00b0000 pid=3008->guuid=cdc8c22b-1900-0000-d8df-cf88090c0000 pid=3081 execve guuid=9708d22f-1900-0000-d8df-cf880f0c0000 pid=3087 /usr/bin/chmod guuid=c46a8f01-1900-0000-d8df-cf88c00b0000 pid=3008->guuid=9708d22f-1900-0000-d8df-cf880f0c0000 pid=3087 execve guuid=3bfb1b30-1900-0000-d8df-cf88110c0000 pid=3089 /usr/bin/bash guuid=c46a8f01-1900-0000-d8df-cf88c00b0000 pid=3008->guuid=3bfb1b30-1900-0000-d8df-cf88110c0000 pid=3089 clone guuid=9ddf6030-1900-0000-d8df-cf88130c0000 pid=3091 /usr/bin/rm delete-file guuid=c46a8f01-1900-0000-d8df-cf88c00b0000 pid=3008->guuid=9ddf6030-1900-0000-d8df-cf88130c0000 pid=3091 execve guuid=a3f1ba30-1900-0000-d8df-cf88150c0000 pid=3093 /usr/bin/rm guuid=c46a8f01-1900-0000-d8df-cf88c00b0000 pid=3008->guuid=a3f1ba30-1900-0000-d8df-cf88150c0000 pid=3093 execve guuid=2bef1131-1900-0000-d8df-cf88170c0000 pid=3095 /usr/bin/wget net send-data guuid=c46a8f01-1900-0000-d8df-cf88c00b0000 pid=3008->guuid=2bef1131-1900-0000-d8df-cf88170c0000 pid=3095 execve guuid=3081e333-1900-0000-d8df-cf881d0c0000 pid=3101 /usr/bin/curl net send-data write-file guuid=c46a8f01-1900-0000-d8df-cf88c00b0000 pid=3008->guuid=3081e333-1900-0000-d8df-cf881d0c0000 pid=3101 execve guuid=a7fcfe3b-1900-0000-d8df-cf88270c0000 pid=3111 /usr/bin/chmod guuid=c46a8f01-1900-0000-d8df-cf88c00b0000 pid=3008->guuid=a7fcfe3b-1900-0000-d8df-cf88270c0000 pid=3111 execve guuid=a92d893c-1900-0000-d8df-cf88290c0000 pid=3113 /usr/bin/bash guuid=c46a8f01-1900-0000-d8df-cf88c00b0000 pid=3008->guuid=a92d893c-1900-0000-d8df-cf88290c0000 pid=3113 clone guuid=242a063d-1900-0000-d8df-cf882d0c0000 pid=3117 /usr/bin/rm delete-file guuid=c46a8f01-1900-0000-d8df-cf88c00b0000 pid=3008->guuid=242a063d-1900-0000-d8df-cf882d0c0000 pid=3117 execve guuid=0d3ac83d-1900-0000-d8df-cf882e0c0000 pid=3118 /usr/bin/rm guuid=c46a8f01-1900-0000-d8df-cf88c00b0000 pid=3008->guuid=0d3ac83d-1900-0000-d8df-cf882e0c0000 pid=3118 execve guuid=eb10533e-1900-0000-d8df-cf882f0c0000 pid=3119 /usr/bin/wget net send-data guuid=c46a8f01-1900-0000-d8df-cf88c00b0000 pid=3008->guuid=eb10533e-1900-0000-d8df-cf882f0c0000 pid=3119 execve guuid=ae5c1942-1900-0000-d8df-cf88340c0000 pid=3124 /usr/bin/curl net send-data write-file guuid=c46a8f01-1900-0000-d8df-cf88c00b0000 pid=3008->guuid=ae5c1942-1900-0000-d8df-cf88340c0000 pid=3124 execve guuid=1b126a46-1900-0000-d8df-cf883c0c0000 pid=3132 /usr/bin/chmod guuid=c46a8f01-1900-0000-d8df-cf88c00b0000 pid=3008->guuid=1b126a46-1900-0000-d8df-cf883c0c0000 pid=3132 execve guuid=a2bcc346-1900-0000-d8df-cf883d0c0000 pid=3133 /usr/bin/bash guuid=c46a8f01-1900-0000-d8df-cf88c00b0000 pid=3008->guuid=a2bcc346-1900-0000-d8df-cf883d0c0000 pid=3133 clone guuid=84520147-1900-0000-d8df-cf883f0c0000 pid=3135 /usr/bin/rm delete-file guuid=c46a8f01-1900-0000-d8df-cf88c00b0000 pid=3008->guuid=84520147-1900-0000-d8df-cf883f0c0000 pid=3135 execve guuid=1b06c447-1900-0000-d8df-cf88400c0000 pid=3136 /usr/bin/rm guuid=c46a8f01-1900-0000-d8df-cf88c00b0000 pid=3008->guuid=1b06c447-1900-0000-d8df-cf88400c0000 pid=3136 execve guuid=fc0e0e48-1900-0000-d8df-cf88410c0000 pid=3137 /usr/bin/wget net send-data guuid=c46a8f01-1900-0000-d8df-cf88c00b0000 pid=3008->guuid=fc0e0e48-1900-0000-d8df-cf88410c0000 pid=3137 execve guuid=dc75974a-1900-0000-d8df-cf88420c0000 pid=3138 /usr/bin/curl net send-data write-file guuid=c46a8f01-1900-0000-d8df-cf88c00b0000 pid=3008->guuid=dc75974a-1900-0000-d8df-cf88420c0000 pid=3138 execve guuid=af3f1451-1900-0000-d8df-cf88430c0000 pid=3139 /usr/bin/chmod guuid=c46a8f01-1900-0000-d8df-cf88c00b0000 pid=3008->guuid=af3f1451-1900-0000-d8df-cf88430c0000 pid=3139 execve guuid=7a599351-1900-0000-d8df-cf88440c0000 pid=3140 /usr/bin/bash guuid=c46a8f01-1900-0000-d8df-cf88c00b0000 pid=3008->guuid=7a599351-1900-0000-d8df-cf88440c0000 pid=3140 clone guuid=aa77f551-1900-0000-d8df-cf88460c0000 pid=3142 /usr/bin/rm delete-file guuid=c46a8f01-1900-0000-d8df-cf88c00b0000 pid=3008->guuid=aa77f551-1900-0000-d8df-cf88460c0000 pid=3142 execve guuid=ecba7252-1900-0000-d8df-cf88470c0000 pid=3143 /usr/bin/rm guuid=c46a8f01-1900-0000-d8df-cf88c00b0000 pid=3008->guuid=ecba7252-1900-0000-d8df-cf88470c0000 pid=3143 execve guuid=131eee52-1900-0000-d8df-cf88480c0000 pid=3144 /usr/bin/wget net send-data guuid=c46a8f01-1900-0000-d8df-cf88c00b0000 pid=3008->guuid=131eee52-1900-0000-d8df-cf88480c0000 pid=3144 execve guuid=e76f1e56-1900-0000-d8df-cf88490c0000 pid=3145 /usr/bin/curl net send-data write-file guuid=c46a8f01-1900-0000-d8df-cf88c00b0000 pid=3008->guuid=e76f1e56-1900-0000-d8df-cf88490c0000 pid=3145 execve guuid=71944e5b-1900-0000-d8df-cf884a0c0000 pid=3146 /usr/bin/chmod guuid=c46a8f01-1900-0000-d8df-cf88c00b0000 pid=3008->guuid=71944e5b-1900-0000-d8df-cf884a0c0000 pid=3146 execve guuid=1cadbb5b-1900-0000-d8df-cf884b0c0000 pid=3147 /usr/bin/bash guuid=c46a8f01-1900-0000-d8df-cf88c00b0000 pid=3008->guuid=1cadbb5b-1900-0000-d8df-cf884b0c0000 pid=3147 clone guuid=1f52205c-1900-0000-d8df-cf884d0c0000 pid=3149 /usr/bin/rm delete-file guuid=c46a8f01-1900-0000-d8df-cf88c00b0000 pid=3008->guuid=1f52205c-1900-0000-d8df-cf884d0c0000 pid=3149 execve guuid=b0ddeb5c-1900-0000-d8df-cf884e0c0000 pid=3150 /usr/bin/rm guuid=c46a8f01-1900-0000-d8df-cf88c00b0000 pid=3008->guuid=b0ddeb5c-1900-0000-d8df-cf884e0c0000 pid=3150 execve guuid=789e8b5d-1900-0000-d8df-cf884f0c0000 pid=3151 /usr/bin/wget net send-data guuid=c46a8f01-1900-0000-d8df-cf88c00b0000 pid=3008->guuid=789e8b5d-1900-0000-d8df-cf884f0c0000 pid=3151 execve guuid=b68e0c62-1900-0000-d8df-cf88510c0000 pid=3153 /usr/bin/curl net send-data write-file guuid=c46a8f01-1900-0000-d8df-cf88c00b0000 pid=3008->guuid=b68e0c62-1900-0000-d8df-cf88510c0000 pid=3153 execve guuid=a725b068-1900-0000-d8df-cf88590c0000 pid=3161 /usr/bin/chmod guuid=c46a8f01-1900-0000-d8df-cf88c00b0000 pid=3008->guuid=a725b068-1900-0000-d8df-cf88590c0000 pid=3161 execve guuid=f367ec68-1900-0000-d8df-cf885a0c0000 pid=3162 /usr/bin/bash guuid=c46a8f01-1900-0000-d8df-cf88c00b0000 pid=3008->guuid=f367ec68-1900-0000-d8df-cf885a0c0000 pid=3162 clone guuid=516a6169-1900-0000-d8df-cf885c0c0000 pid=3164 /usr/bin/rm delete-file guuid=c46a8f01-1900-0000-d8df-cf88c00b0000 pid=3008->guuid=516a6169-1900-0000-d8df-cf885c0c0000 pid=3164 execve guuid=3f5fa169-1900-0000-d8df-cf885d0c0000 pid=3165 /usr/bin/rm guuid=c46a8f01-1900-0000-d8df-cf88c00b0000 pid=3008->guuid=3f5fa169-1900-0000-d8df-cf885d0c0000 pid=3165 execve guuid=6735db69-1900-0000-d8df-cf885f0c0000 pid=3167 /usr/bin/wget net send-data guuid=c46a8f01-1900-0000-d8df-cf88c00b0000 pid=3008->guuid=6735db69-1900-0000-d8df-cf885f0c0000 pid=3167 execve guuid=53c4436d-1900-0000-d8df-cf88650c0000 pid=3173 /usr/bin/curl net send-data write-file guuid=c46a8f01-1900-0000-d8df-cf88c00b0000 pid=3008->guuid=53c4436d-1900-0000-d8df-cf88650c0000 pid=3173 execve guuid=d8594a74-1900-0000-d8df-cf886d0c0000 pid=3181 /usr/bin/chmod guuid=c46a8f01-1900-0000-d8df-cf88c00b0000 pid=3008->guuid=d8594a74-1900-0000-d8df-cf886d0c0000 pid=3181 execve guuid=e4c3c674-1900-0000-d8df-cf886e0c0000 pid=3182 /usr/bin/bash guuid=c46a8f01-1900-0000-d8df-cf88c00b0000 pid=3008->guuid=e4c3c674-1900-0000-d8df-cf886e0c0000 pid=3182 clone guuid=e0573275-1900-0000-d8df-cf88700c0000 pid=3184 /usr/bin/rm delete-file guuid=c46a8f01-1900-0000-d8df-cf88c00b0000 pid=3008->guuid=e0573275-1900-0000-d8df-cf88700c0000 pid=3184 execve guuid=31c7d475-1900-0000-d8df-cf88710c0000 pid=3185 /usr/bin/rm guuid=c46a8f01-1900-0000-d8df-cf88c00b0000 pid=3008->guuid=31c7d475-1900-0000-d8df-cf88710c0000 pid=3185 execve guuid=76174777-1900-0000-d8df-cf88720c0000 pid=3186 /usr/bin/wget net send-data guuid=c46a8f01-1900-0000-d8df-cf88c00b0000 pid=3008->guuid=76174777-1900-0000-d8df-cf88720c0000 pid=3186 execve guuid=b50c1d7e-1900-0000-d8df-cf887b0c0000 pid=3195 /usr/bin/curl net send-data write-file guuid=c46a8f01-1900-0000-d8df-cf88c00b0000 pid=3008->guuid=b50c1d7e-1900-0000-d8df-cf887b0c0000 pid=3195 execve guuid=8d32be82-1900-0000-d8df-cf88880c0000 pid=3208 /usr/bin/chmod guuid=c46a8f01-1900-0000-d8df-cf88c00b0000 pid=3008->guuid=8d32be82-1900-0000-d8df-cf88880c0000 pid=3208 execve guuid=9c34fc82-1900-0000-d8df-cf888a0c0000 pid=3210 /usr/bin/bash guuid=c46a8f01-1900-0000-d8df-cf88c00b0000 pid=3008->guuid=9c34fc82-1900-0000-d8df-cf888a0c0000 pid=3210 clone guuid=80c33383-1900-0000-d8df-cf888c0c0000 pid=3212 /usr/bin/rm delete-file guuid=c46a8f01-1900-0000-d8df-cf88c00b0000 pid=3008->guuid=80c33383-1900-0000-d8df-cf888c0c0000 pid=3212 execve guuid=a9579083-1900-0000-d8df-cf888d0c0000 pid=3213 /usr/bin/rm guuid=c46a8f01-1900-0000-d8df-cf88c00b0000 pid=3008->guuid=a9579083-1900-0000-d8df-cf888d0c0000 pid=3213 execve guuid=40c0e583-1900-0000-d8df-cf888e0c0000 pid=3214 /usr/bin/wget net send-data guuid=c46a8f01-1900-0000-d8df-cf88c00b0000 pid=3008->guuid=40c0e583-1900-0000-d8df-cf888e0c0000 pid=3214 execve guuid=b1ec9e86-1900-0000-d8df-cf88960c0000 pid=3222 /usr/bin/curl net send-data write-file guuid=c46a8f01-1900-0000-d8df-cf88c00b0000 pid=3008->guuid=b1ec9e86-1900-0000-d8df-cf88960c0000 pid=3222 execve guuid=32850c8b-1900-0000-d8df-cf88a60c0000 pid=3238 /usr/bin/chmod guuid=c46a8f01-1900-0000-d8df-cf88c00b0000 pid=3008->guuid=32850c8b-1900-0000-d8df-cf88a60c0000 pid=3238 execve guuid=4c8a6d8b-1900-0000-d8df-cf88a80c0000 pid=3240 /usr/bin/bash guuid=c46a8f01-1900-0000-d8df-cf88c00b0000 pid=3008->guuid=4c8a6d8b-1900-0000-d8df-cf88a80c0000 pid=3240 clone guuid=6e2bb78b-1900-0000-d8df-cf88ab0c0000 pid=3243 /usr/bin/rm delete-file guuid=c46a8f01-1900-0000-d8df-cf88c00b0000 pid=3008->guuid=6e2bb78b-1900-0000-d8df-cf88ab0c0000 pid=3243 execve guuid=d597198c-1900-0000-d8df-cf88ae0c0000 pid=3246 /usr/bin/rm guuid=c46a8f01-1900-0000-d8df-cf88c00b0000 pid=3008->guuid=d597198c-1900-0000-d8df-cf88ae0c0000 pid=3246 execve 5b654972-c9e1-50d8-b372-2dc2a5b9ad66 5.182.210.174:80 guuid=fb3e1002-1900-0000-d8df-cf88c20b0000 pid=3010->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=d20ad306-1900-0000-d8df-cf88ce0b0000 pid=3022->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=79909a12-1900-0000-d8df-cf88e90b0000 pid=3049 /usr/bin/bash guuid=22707412-1900-0000-d8df-cf88e80b0000 pid=3048->guuid=79909a12-1900-0000-d8df-cf88e90b0000 pid=3049 clone guuid=3c868f13-1900-0000-d8df-cf88ee0b0000 pid=3054->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=2863a516-1900-0000-d8df-cf88f50b0000 pid=3061->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=37c8d31d-1900-0000-d8df-cf88fe0b0000 pid=3070 /usr/bin/bash guuid=6a0aac1d-1900-0000-d8df-cf88fd0b0000 pid=3069->guuid=37c8d31d-1900-0000-d8df-cf88fe0b0000 pid=3070 clone guuid=2d1d3c1f-1900-0000-d8df-cf88010c0000 pid=3073->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=5e209e22-1900-0000-d8df-cf88020c0000 pid=3074->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=286c8127-1900-0000-d8df-cf88050c0000 pid=3077 /usr/bin/bash guuid=f6ce5d27-1900-0000-d8df-cf88040c0000 pid=3076->guuid=286c8127-1900-0000-d8df-cf88050c0000 pid=3077 clone guuid=08ab7128-1900-0000-d8df-cf88080c0000 pid=3080->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=cdc8c22b-1900-0000-d8df-cf88090c0000 pid=3081->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=f4113130-1900-0000-d8df-cf88120c0000 pid=3090 /usr/bin/bash guuid=3bfb1b30-1900-0000-d8df-cf88110c0000 pid=3089->guuid=f4113130-1900-0000-d8df-cf88120c0000 pid=3090 clone guuid=2bef1131-1900-0000-d8df-cf88170c0000 pid=3095->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=3081e333-1900-0000-d8df-cf881d0c0000 pid=3101->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=4a98bd3c-1900-0000-d8df-cf882b0c0000 pid=3115 /usr/bin/bash guuid=a92d893c-1900-0000-d8df-cf88290c0000 pid=3113->guuid=4a98bd3c-1900-0000-d8df-cf882b0c0000 pid=3115 clone guuid=eb10533e-1900-0000-d8df-cf882f0c0000 pid=3119->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=ae5c1942-1900-0000-d8df-cf88340c0000 pid=3124->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=b083dc46-1900-0000-d8df-cf883e0c0000 pid=3134 /usr/bin/bash guuid=a2bcc346-1900-0000-d8df-cf883d0c0000 pid=3133->guuid=b083dc46-1900-0000-d8df-cf883e0c0000 pid=3134 clone guuid=fc0e0e48-1900-0000-d8df-cf88410c0000 pid=3137->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=dc75974a-1900-0000-d8df-cf88420c0000 pid=3138->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=542bc351-1900-0000-d8df-cf88450c0000 pid=3141 /usr/bin/bash guuid=7a599351-1900-0000-d8df-cf88440c0000 pid=3140->guuid=542bc351-1900-0000-d8df-cf88450c0000 pid=3141 clone guuid=131eee52-1900-0000-d8df-cf88480c0000 pid=3144->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=e76f1e56-1900-0000-d8df-cf88490c0000 pid=3145->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=db7fda5b-1900-0000-d8df-cf884c0c0000 pid=3148 /usr/bin/bash guuid=1cadbb5b-1900-0000-d8df-cf884b0c0000 pid=3147->guuid=db7fda5b-1900-0000-d8df-cf884c0c0000 pid=3148 clone guuid=789e8b5d-1900-0000-d8df-cf884f0c0000 pid=3151->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=b68e0c62-1900-0000-d8df-cf88510c0000 pid=3153->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=ebc00769-1900-0000-d8df-cf885b0c0000 pid=3163 /usr/bin/bash guuid=f367ec68-1900-0000-d8df-cf885a0c0000 pid=3162->guuid=ebc00769-1900-0000-d8df-cf885b0c0000 pid=3163 clone guuid=6735db69-1900-0000-d8df-cf885f0c0000 pid=3167->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=53c4436d-1900-0000-d8df-cf88650c0000 pid=3173->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=4365f474-1900-0000-d8df-cf886f0c0000 pid=3183 /usr/bin/bash guuid=e4c3c674-1900-0000-d8df-cf886e0c0000 pid=3182->guuid=4365f474-1900-0000-d8df-cf886f0c0000 pid=3183 clone guuid=76174777-1900-0000-d8df-cf88720c0000 pid=3186->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=b50c1d7e-1900-0000-d8df-cf887b0c0000 pid=3195->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=3aff1183-1900-0000-d8df-cf888b0c0000 pid=3211 /usr/bin/bash guuid=9c34fc82-1900-0000-d8df-cf888a0c0000 pid=3210->guuid=3aff1183-1900-0000-d8df-cf888b0c0000 pid=3211 clone guuid=40c0e583-1900-0000-d8df-cf888e0c0000 pid=3214->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=b1ec9e86-1900-0000-d8df-cf88960c0000 pid=3222->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=0a4b8b8b-1900-0000-d8df-cf88aa0c0000 pid=3242 /usr/bin/bash guuid=4c8a6d8b-1900-0000-d8df-cf88a80c0000 pid=3240->guuid=0a4b8b8b-1900-0000-d8df-cf88aa0c0000 pid=3242 clone
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/4e4e1863e1521a9ed6faaae28e08a7c3e37b3752a398aef77fc65290e04c4aa4
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4e4e1863e1521a9ed6faaae28e08a7c3e37b3752a398aef77fc65290e04c4aa4/
Threat name:
Linux.Downloader.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-08-28 23:01:22 UTC
File Type:
Text (Shell)
AV detection:
13 of 36 (36.11%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jzhbqy7bkinj5vx2vlri4cfhyprxwn2suomk5537yzjjbycmjksa._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260828-2y5jwatwhv/
Behaviour
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.11
Link:
https://yomi.yoroi.company/submissions/4e4e1863e1521a9ed6faaae28e08a7c3e37b3752a398aef77fc65290e04c4aa4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments