MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4e8b40b2171cb737e29d115b3cd9d82315cffe3f65406149ef2548e538a734a0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4e8b40b2171cb737e29d115b3cd9d82315cffe3f65406149ef2548e538a734a0
SHA3-384 hash: d63da750d1da2f4c8190606b3cad99d0e15f7f991ade276f01bf62f876ee70eb1e84bc9e5bf5f1adcd0ac16d423e91d9
SHA1 hash: e57f9c82ba1479441856f5ec8b601f100d73fdda
MD5 hash: 58581d9307babd92c785529472a1016d
humanhash: romeo-comet-black-juliet
File name:p
Download: download sample
File size:839 bytes
First seen:2026-07-22 10:35:27 UTC
Last seen:2026-07-22 14:38:08 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 24:kXCKysE2hi0ziQvZohaCcmahqSX4g3DlzC7:e9Qp+MsCRaIS4MJ27
TLSH T1B901ABCAD2209E50512EDD5E339652A0B421C3C6594B4F78BFAC983EEB98D04B066F98
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://129.121.110.105/bgXn/an/aelf ua-wget
http://129.121.110.105/XOBn/an/aelf ua-wget
http://129.121.110.105/idSLn/an/aelf ua-wget
http://129.121.110.105/AAgCn/an/aelf ua-wget
http://129.121.110.105/FpmOn/an/aelf ua-wget

Intelligence

File Origin
# of uploads :
3
# of downloads :
75
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive mirai
Link:
https://www.filescan.io/uploads/6a609cffdfb271538809c52a/reports/32627c75-c37f-4f47-9fb7-0986af62432b/overview
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/a30a06fc-f09f-4d5c-a853-0fabda880541
Behavior Graph:
Download SVG
%3 guuid=6fc63270-1700-0000-e572-f628690d0000 pid=3433 /usr/bin/sudo guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441 /tmp/sample.bin write-file guuid=6fc63270-1700-0000-e572-f628690d0000 pid=3433->guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441 execve guuid=a57c1672-1700-0000-e572-f628720d0000 pid=3442 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=a57c1672-1700-0000-e572-f628720d0000 pid=3442 execve guuid=b7b37d72-1700-0000-e572-f628740d0000 pid=3444 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=b7b37d72-1700-0000-e572-f628740d0000 pid=3444 execve guuid=aa63d872-1700-0000-e572-f628770d0000 pid=3447 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=aa63d872-1700-0000-e572-f628770d0000 pid=3447 execve guuid=a55e3973-1700-0000-e572-f628790d0000 pid=3449 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=a55e3973-1700-0000-e572-f628790d0000 pid=3449 execve guuid=68e69873-1700-0000-e572-f6287b0d0000 pid=3451 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=68e69873-1700-0000-e572-f6287b0d0000 pid=3451 execve guuid=43dffa73-1700-0000-e572-f6287d0d0000 pid=3453 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=43dffa73-1700-0000-e572-f6287d0d0000 pid=3453 execve guuid=aafc5e74-1700-0000-e572-f628800d0000 pid=3456 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=aafc5e74-1700-0000-e572-f628800d0000 pid=3456 execve guuid=4d2fc074-1700-0000-e572-f628820d0000 pid=3458 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=4d2fc074-1700-0000-e572-f628820d0000 pid=3458 execve guuid=57232575-1700-0000-e572-f628840d0000 pid=3460 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=57232575-1700-0000-e572-f628840d0000 pid=3460 execve guuid=d48b8075-1700-0000-e572-f628860d0000 pid=3462 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=d48b8075-1700-0000-e572-f628860d0000 pid=3462 execve guuid=e806e675-1700-0000-e572-f628880d0000 pid=3464 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=e806e675-1700-0000-e572-f628880d0000 pid=3464 execve guuid=31ed4976-1700-0000-e572-f6288b0d0000 pid=3467 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=31ed4976-1700-0000-e572-f6288b0d0000 pid=3467 execve guuid=13c8aa76-1700-0000-e572-f6288d0d0000 pid=3469 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=13c8aa76-1700-0000-e572-f6288d0d0000 pid=3469 execve guuid=f2d90e77-1700-0000-e572-f6288f0d0000 pid=3471 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=f2d90e77-1700-0000-e572-f6288f0d0000 pid=3471 execve guuid=2e1d6d77-1700-0000-e572-f628920d0000 pid=3474 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=2e1d6d77-1700-0000-e572-f628920d0000 pid=3474 execve guuid=8dafe477-1700-0000-e572-f628940d0000 pid=3476 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=8dafe477-1700-0000-e572-f628940d0000 pid=3476 execve guuid=cee44878-1700-0000-e572-f628960d0000 pid=3478 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=cee44878-1700-0000-e572-f628960d0000 pid=3478 execve guuid=b6f2ae78-1700-0000-e572-f628990d0000 pid=3481 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=b6f2ae78-1700-0000-e572-f628990d0000 pid=3481 execve guuid=a15a0e79-1700-0000-e572-f6289c0d0000 pid=3484 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=a15a0e79-1700-0000-e572-f6289c0d0000 pid=3484 execve guuid=be927379-1700-0000-e572-f6289e0d0000 pid=3486 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=be927379-1700-0000-e572-f6289e0d0000 pid=3486 execve guuid=f412cd79-1700-0000-e572-f628a00d0000 pid=3488 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=f412cd79-1700-0000-e572-f628a00d0000 pid=3488 execve guuid=6618317a-1700-0000-e572-f628a30d0000 pid=3491 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=6618317a-1700-0000-e572-f628a30d0000 pid=3491 execve guuid=931a977a-1700-0000-e572-f628a50d0000 pid=3493 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=931a977a-1700-0000-e572-f628a50d0000 pid=3493 execve guuid=328f027b-1700-0000-e572-f628a80d0000 pid=3496 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=328f027b-1700-0000-e572-f628a80d0000 pid=3496 execve guuid=d0e5687b-1700-0000-e572-f628aa0d0000 pid=3498 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=d0e5687b-1700-0000-e572-f628aa0d0000 pid=3498 execve guuid=7a97cd7b-1700-0000-e572-f628ad0d0000 pid=3501 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=7a97cd7b-1700-0000-e572-f628ad0d0000 pid=3501 execve guuid=36fb2e7c-1700-0000-e572-f628af0d0000 pid=3503 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=36fb2e7c-1700-0000-e572-f628af0d0000 pid=3503 execve guuid=c1339c7c-1700-0000-e572-f628b20d0000 pid=3506 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=c1339c7c-1700-0000-e572-f628b20d0000 pid=3506 execve guuid=a47cf57c-1700-0000-e572-f628b40d0000 pid=3508 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=a47cf57c-1700-0000-e572-f628b40d0000 pid=3508 execve guuid=10af567d-1700-0000-e572-f628b60d0000 pid=3510 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=10af567d-1700-0000-e572-f628b60d0000 pid=3510 execve guuid=4bc2b47d-1700-0000-e572-f628b70d0000 pid=3511 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=4bc2b47d-1700-0000-e572-f628b70d0000 pid=3511 execve guuid=b9be127e-1700-0000-e572-f628b90d0000 pid=3513 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=b9be127e-1700-0000-e572-f628b90d0000 pid=3513 execve guuid=7e326f7e-1700-0000-e572-f628bb0d0000 pid=3515 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=7e326f7e-1700-0000-e572-f628bb0d0000 pid=3515 execve guuid=e78bcc7e-1700-0000-e572-f628bd0d0000 pid=3517 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=e78bcc7e-1700-0000-e572-f628bd0d0000 pid=3517 execve guuid=eedd257f-1700-0000-e572-f628c00d0000 pid=3520 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=eedd257f-1700-0000-e572-f628c00d0000 pid=3520 execve guuid=b1f4847f-1700-0000-e572-f628c30d0000 pid=3523 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=b1f4847f-1700-0000-e572-f628c30d0000 pid=3523 execve guuid=5edcea7f-1700-0000-e572-f628c60d0000 pid=3526 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=5edcea7f-1700-0000-e572-f628c60d0000 pid=3526 execve guuid=19ab5580-1700-0000-e572-f628c80d0000 pid=3528 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=19ab5580-1700-0000-e572-f628c80d0000 pid=3528 execve guuid=5f4dbe80-1700-0000-e572-f628ca0d0000 pid=3530 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=5f4dbe80-1700-0000-e572-f628ca0d0000 pid=3530 execve guuid=3d962181-1700-0000-e572-f628cb0d0000 pid=3531 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=3d962181-1700-0000-e572-f628cb0d0000 pid=3531 execve guuid=50978481-1700-0000-e572-f628cc0d0000 pid=3532 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=50978481-1700-0000-e572-f628cc0d0000 pid=3532 execve guuid=7680e381-1700-0000-e572-f628cd0d0000 pid=3533 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=7680e381-1700-0000-e572-f628cd0d0000 pid=3533 execve guuid=e4e64c82-1700-0000-e572-f628ce0d0000 pid=3534 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=e4e64c82-1700-0000-e572-f628ce0d0000 pid=3534 execve guuid=9320aa82-1700-0000-e572-f628cf0d0000 pid=3535 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=9320aa82-1700-0000-e572-f628cf0d0000 pid=3535 execve guuid=9b7b0b83-1700-0000-e572-f628d00d0000 pid=3536 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=9b7b0b83-1700-0000-e572-f628d00d0000 pid=3536 execve guuid=ddac6e83-1700-0000-e572-f628d10d0000 pid=3537 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=ddac6e83-1700-0000-e572-f628d10d0000 pid=3537 execve guuid=0bc9e083-1700-0000-e572-f628d20d0000 pid=3538 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=0bc9e083-1700-0000-e572-f628d20d0000 pid=3538 execve guuid=288f4184-1700-0000-e572-f628d30d0000 pid=3539 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=288f4184-1700-0000-e572-f628d30d0000 pid=3539 execve guuid=b72ea684-1700-0000-e572-f628d40d0000 pid=3540 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=b72ea684-1700-0000-e572-f628d40d0000 pid=3540 execve guuid=d7ba8885-1700-0000-e572-f628d80d0000 pid=3544 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=d7ba8885-1700-0000-e572-f628d80d0000 pid=3544 execve guuid=d59fe586-1700-0000-e572-f628db0d0000 pid=3547 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=d59fe586-1700-0000-e572-f628db0d0000 pid=3547 execve guuid=314e5387-1700-0000-e572-f628df0d0000 pid=3551 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=314e5387-1700-0000-e572-f628df0d0000 pid=3551 execve guuid=e756ae87-1700-0000-e572-f628e10d0000 pid=3553 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=e756ae87-1700-0000-e572-f628e10d0000 pid=3553 execve guuid=dd5a0e88-1700-0000-e572-f628e50d0000 pid=3557 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=dd5a0e88-1700-0000-e572-f628e50d0000 pid=3557 execve guuid=5dff6e88-1700-0000-e572-f628e90d0000 pid=3561 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=5dff6e88-1700-0000-e572-f628e90d0000 pid=3561 execve guuid=5eaec188-1700-0000-e572-f628eb0d0000 pid=3563 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=5eaec188-1700-0000-e572-f628eb0d0000 pid=3563 execve guuid=a2072389-1700-0000-e572-f628ed0d0000 pid=3565 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=a2072389-1700-0000-e572-f628ed0d0000 pid=3565 execve guuid=d46a8289-1700-0000-e572-f628ef0d0000 pid=3567 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=d46a8289-1700-0000-e572-f628ef0d0000 pid=3567 execve guuid=c92ee589-1700-0000-e572-f628f10d0000 pid=3569 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=c92ee589-1700-0000-e572-f628f10d0000 pid=3569 execve guuid=812f638a-1700-0000-e572-f628f40d0000 pid=3572 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=812f638a-1700-0000-e572-f628f40d0000 pid=3572 execve guuid=e565ed8a-1700-0000-e572-f628f70d0000 pid=3575 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=e565ed8a-1700-0000-e572-f628f70d0000 pid=3575 execve guuid=0cc6688b-1700-0000-e572-f628fb0d0000 pid=3579 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=0cc6688b-1700-0000-e572-f628fb0d0000 pid=3579 execve guuid=08b5c68b-1700-0000-e572-f628ff0d0000 pid=3583 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=08b5c68b-1700-0000-e572-f628ff0d0000 pid=3583 execve guuid=48b7268c-1700-0000-e572-f628010e0000 pid=3585 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=48b7268c-1700-0000-e572-f628010e0000 pid=3585 execve guuid=e10f848c-1700-0000-e572-f628030e0000 pid=3587 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=e10f848c-1700-0000-e572-f628030e0000 pid=3587 execve guuid=7df7e28c-1700-0000-e572-f628060e0000 pid=3590 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=7df7e28c-1700-0000-e572-f628060e0000 pid=3590 execve guuid=439e3c8d-1700-0000-e572-f628080e0000 pid=3592 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=439e3c8d-1700-0000-e572-f628080e0000 pid=3592 execve guuid=01168d8d-1700-0000-e572-f6280b0e0000 pid=3595 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=01168d8d-1700-0000-e572-f6280b0e0000 pid=3595 execve guuid=3a0ddd8d-1700-0000-e572-f6280d0e0000 pid=3597 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=3a0ddd8d-1700-0000-e572-f6280d0e0000 pid=3597 execve guuid=681a2f8e-1700-0000-e572-f6280f0e0000 pid=3599 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=681a2f8e-1700-0000-e572-f6280f0e0000 pid=3599 execve guuid=ab8e7d8e-1700-0000-e572-f628120e0000 pid=3602 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=ab8e7d8e-1700-0000-e572-f628120e0000 pid=3602 execve guuid=2e2acf8e-1700-0000-e572-f628160e0000 pid=3606 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=2e2acf8e-1700-0000-e572-f628160e0000 pid=3606 execve guuid=93ba1e8f-1700-0000-e572-f628180e0000 pid=3608 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=93ba1e8f-1700-0000-e572-f628180e0000 pid=3608 execve guuid=de32708f-1700-0000-e572-f6281a0e0000 pid=3610 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=de32708f-1700-0000-e572-f6281a0e0000 pid=3610 execve guuid=ce87bf8f-1700-0000-e572-f6281c0e0000 pid=3612 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=ce87bf8f-1700-0000-e572-f6281c0e0000 pid=3612 execve guuid=9cbf1190-1700-0000-e572-f6281f0e0000 pid=3615 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=9cbf1190-1700-0000-e572-f6281f0e0000 pid=3615 execve guuid=f2e06a90-1700-0000-e572-f628210e0000 pid=3617 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=f2e06a90-1700-0000-e572-f628210e0000 pid=3617 execve guuid=2f6fd890-1700-0000-e572-f628220e0000 pid=3618 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=2f6fd890-1700-0000-e572-f628220e0000 pid=3618 execve guuid=8faf5b91-1700-0000-e572-f628230e0000 pid=3619 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=8faf5b91-1700-0000-e572-f628230e0000 pid=3619 execve guuid=a735db91-1700-0000-e572-f628240e0000 pid=3620 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=a735db91-1700-0000-e572-f628240e0000 pid=3620 execve guuid=a4ce6492-1700-0000-e572-f628250e0000 pid=3621 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=a4ce6492-1700-0000-e572-f628250e0000 pid=3621 execve guuid=39feed92-1700-0000-e572-f628260e0000 pid=3622 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=39feed92-1700-0000-e572-f628260e0000 pid=3622 execve guuid=584b7d93-1700-0000-e572-f628270e0000 pid=3623 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=584b7d93-1700-0000-e572-f628270e0000 pid=3623 execve guuid=34ad0d94-1700-0000-e572-f628280e0000 pid=3624 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=34ad0d94-1700-0000-e572-f628280e0000 pid=3624 execve guuid=09dc9894-1700-0000-e572-f628290e0000 pid=3625 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=09dc9894-1700-0000-e572-f628290e0000 pid=3625 execve guuid=f4952695-1700-0000-e572-f6282a0e0000 pid=3626 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=f4952695-1700-0000-e572-f6282a0e0000 pid=3626 execve guuid=6d74b595-1700-0000-e572-f6282b0e0000 pid=3627 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=6d74b595-1700-0000-e572-f6282b0e0000 pid=3627 execve guuid=21dd4b96-1700-0000-e572-f6282c0e0000 pid=3628 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=21dd4b96-1700-0000-e572-f6282c0e0000 pid=3628 execve guuid=778cc996-1700-0000-e572-f6282d0e0000 pid=3629 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=778cc996-1700-0000-e572-f6282d0e0000 pid=3629 execve guuid=d7de4897-1700-0000-e572-f6282e0e0000 pid=3630 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=d7de4897-1700-0000-e572-f6282e0e0000 pid=3630 execve guuid=ae8bbc97-1700-0000-e572-f6282f0e0000 pid=3631 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=ae8bbc97-1700-0000-e572-f6282f0e0000 pid=3631 execve guuid=1ca29c98-1700-0000-e572-f628300e0000 pid=3632 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=1ca29c98-1700-0000-e572-f628300e0000 pid=3632 execve guuid=85701f99-1700-0000-e572-f628310e0000 pid=3633 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=85701f99-1700-0000-e572-f628310e0000 pid=3633 execve guuid=638f9e99-1700-0000-e572-f628340e0000 pid=3636 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=638f9e99-1700-0000-e572-f628340e0000 pid=3636 execve guuid=d450009a-1700-0000-e572-f628360e0000 pid=3638 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=d450009a-1700-0000-e572-f628360e0000 pid=3638 execve guuid=eb936e9a-1700-0000-e572-f6283a0e0000 pid=3642 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=eb936e9a-1700-0000-e572-f6283a0e0000 pid=3642 execve guuid=e9a3da9a-1700-0000-e572-f6283c0e0000 pid=3644 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=e9a3da9a-1700-0000-e572-f6283c0e0000 pid=3644 execve guuid=a859479b-1700-0000-e572-f6283f0e0000 pid=3647 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=a859479b-1700-0000-e572-f6283f0e0000 pid=3647 execve guuid=972fa89b-1700-0000-e572-f628410e0000 pid=3649 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=972fa89b-1700-0000-e572-f628410e0000 pid=3649 execve guuid=8855059c-1700-0000-e572-f628430e0000 pid=3651 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=8855059c-1700-0000-e572-f628430e0000 pid=3651 execve guuid=750a6a9c-1700-0000-e572-f628450e0000 pid=3653 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=750a6a9c-1700-0000-e572-f628450e0000 pid=3653 execve guuid=f134ff9c-1700-0000-e572-f628460e0000 pid=3654 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=f134ff9c-1700-0000-e572-f628460e0000 pid=3654 execve guuid=c4718d9d-1700-0000-e572-f628470e0000 pid=3655 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=c4718d9d-1700-0000-e572-f628470e0000 pid=3655 execve guuid=4a3e199e-1700-0000-e572-f628480e0000 pid=3656 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=4a3e199e-1700-0000-e572-f628480e0000 pid=3656 execve guuid=57f49d9e-1700-0000-e572-f628490e0000 pid=3657 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=57f49d9e-1700-0000-e572-f628490e0000 pid=3657 execve guuid=3b63319f-1700-0000-e572-f6284a0e0000 pid=3658 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=3b63319f-1700-0000-e572-f6284a0e0000 pid=3658 execve guuid=a250c29f-1700-0000-e572-f6284b0e0000 pid=3659 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=a250c29f-1700-0000-e572-f6284b0e0000 pid=3659 execve guuid=f6f12ca0-1700-0000-e572-f6284f0e0000 pid=3663 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=f6f12ca0-1700-0000-e572-f6284f0e0000 pid=3663 execve guuid=5c9d9ea0-1700-0000-e572-f628500e0000 pid=3664 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=5c9d9ea0-1700-0000-e572-f628500e0000 pid=3664 execve guuid=955afca0-1700-0000-e572-f628540e0000 pid=3668 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=955afca0-1700-0000-e572-f628540e0000 pid=3668 execve guuid=fbf1a6a1-1700-0000-e572-f628580e0000 pid=3672 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=fbf1a6a1-1700-0000-e572-f628580e0000 pid=3672 execve guuid=c5be05a2-1700-0000-e572-f6285a0e0000 pid=3674 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=c5be05a2-1700-0000-e572-f6285a0e0000 pid=3674 execve guuid=257363a2-1700-0000-e572-f6285c0e0000 pid=3676 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=257363a2-1700-0000-e572-f6285c0e0000 pid=3676 execve guuid=5c3dbfa2-1700-0000-e572-f6285f0e0000 pid=3679 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=5c3dbfa2-1700-0000-e572-f6285f0e0000 pid=3679 execve guuid=18350da3-1700-0000-e572-f628610e0000 pid=3681 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=18350da3-1700-0000-e572-f628610e0000 pid=3681 execve guuid=ddac5ea3-1700-0000-e572-f628620e0000 pid=3682 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=ddac5ea3-1700-0000-e572-f628620e0000 pid=3682 execve guuid=1369c7a3-1700-0000-e572-f628650e0000 pid=3685 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=1369c7a3-1700-0000-e572-f628650e0000 pid=3685 execve guuid=ddb719a4-1700-0000-e572-f628670e0000 pid=3687 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=ddb719a4-1700-0000-e572-f628670e0000 pid=3687 execve guuid=5d847da4-1700-0000-e572-f628690e0000 pid=3689 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=5d847da4-1700-0000-e572-f628690e0000 pid=3689 execve guuid=5f93cfa4-1700-0000-e572-f6286b0e0000 pid=3691 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=5f93cfa4-1700-0000-e572-f6286b0e0000 pid=3691 execve guuid=699120a5-1700-0000-e572-f6286d0e0000 pid=3693 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=699120a5-1700-0000-e572-f6286d0e0000 pid=3693 execve guuid=4e996da5-1700-0000-e572-f628710e0000 pid=3697 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=4e996da5-1700-0000-e572-f628710e0000 pid=3697 execve guuid=7d45c5a5-1700-0000-e572-f628720e0000 pid=3698 /usr/bin/ls guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=7d45c5a5-1700-0000-e572-f628720e0000 pid=3698 execve guuid=ace827a6-1700-0000-e572-f628730e0000 pid=3699 /usr/bin/rm guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=ace827a6-1700-0000-e572-f628730e0000 pid=3699 execve guuid=708271a6-1700-0000-e572-f628760e0000 pid=3702 /usr/bin/wget net send-data write-file guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=708271a6-1700-0000-e572-f628760e0000 pid=3702 execve guuid=9a2b6cac-1700-0000-e572-f628920e0000 pid=3730 /usr/bin/chmod guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=9a2b6cac-1700-0000-e572-f628920e0000 pid=3730 execve guuid=2f87aaac-1700-0000-e572-f628940e0000 pid=3732 /usr/bin/dash guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=2f87aaac-1700-0000-e572-f628940e0000 pid=3732 clone guuid=f09a45ad-1700-0000-e572-f628990e0000 pid=3737 /usr/bin/rm guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=f09a45ad-1700-0000-e572-f628990e0000 pid=3737 execve guuid=e2d888ad-1700-0000-e572-f6289a0e0000 pid=3738 /usr/bin/wget net send-data write-file guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=e2d888ad-1700-0000-e572-f6289a0e0000 pid=3738 execve guuid=c37a38b3-1700-0000-e572-f628af0e0000 pid=3759 /usr/bin/chmod guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=c37a38b3-1700-0000-e572-f628af0e0000 pid=3759 execve guuid=306494b3-1700-0000-e572-f628b10e0000 pid=3761 /usr/bin/dash guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=306494b3-1700-0000-e572-f628b10e0000 pid=3761 clone guuid=f55539b4-1700-0000-e572-f628b50e0000 pid=3765 /usr/bin/rm guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=f55539b4-1700-0000-e572-f628b50e0000 pid=3765 execve guuid=d7ce80b4-1700-0000-e572-f628b70e0000 pid=3767 /usr/bin/wget net send-data write-file guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=d7ce80b4-1700-0000-e572-f628b70e0000 pid=3767 execve guuid=72796cb9-1700-0000-e572-f628ca0e0000 pid=3786 /usr/bin/chmod guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=72796cb9-1700-0000-e572-f628ca0e0000 pid=3786 execve guuid=4734a7b9-1700-0000-e572-f628cb0e0000 pid=3787 /usr/bin/dash guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=4734a7b9-1700-0000-e572-f628cb0e0000 pid=3787 clone guuid=731144ba-1700-0000-e572-f628cf0e0000 pid=3791 /usr/bin/rm guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=731144ba-1700-0000-e572-f628cf0e0000 pid=3791 execve guuid=df4098ba-1700-0000-e572-f628d20e0000 pid=3794 /usr/bin/wget net send-data write-file guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=df4098ba-1700-0000-e572-f628d20e0000 pid=3794 execve guuid=f1898fc0-1700-0000-e572-f628ea0e0000 pid=3818 /usr/bin/chmod guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=f1898fc0-1700-0000-e572-f628ea0e0000 pid=3818 execve guuid=9360ffc0-1700-0000-e572-f628ee0e0000 pid=3822 /usr/bin/dash guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=9360ffc0-1700-0000-e572-f628ee0e0000 pid=3822 clone guuid=5130a3c1-1700-0000-e572-f628f40e0000 pid=3828 /usr/bin/rm guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=5130a3c1-1700-0000-e572-f628f40e0000 pid=3828 execve guuid=d82de6c1-1700-0000-e572-f628f50e0000 pid=3829 /usr/bin/wget net send-data write-file guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=d82de6c1-1700-0000-e572-f628f50e0000 pid=3829 execve guuid=50a8d5cf-1700-0000-e572-f628280f0000 pid=3880 /usr/bin/chmod guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=50a8d5cf-1700-0000-e572-f628280f0000 pid=3880 execve guuid=e3b715d0-1700-0000-e572-f628290f0000 pid=3881 /usr/bin/dash guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=e3b715d0-1700-0000-e572-f628290f0000 pid=3881 clone guuid=911096d0-1700-0000-e572-f6282d0f0000 pid=3885 /usr/bin/rm delete-file guuid=5670d771-1700-0000-e572-f628710d0000 pid=3441->guuid=911096d0-1700-0000-e572-f6282d0f0000 pid=3885 execve 0b1ba66e-2f8f-542f-9f7c-00dd01da057c 129.121.110.105:80 guuid=708271a6-1700-0000-e572-f628760e0000 pid=3702->0b1ba66e-2f8f-542f-9f7c-00dd01da057c send: 133B guuid=e2d888ad-1700-0000-e572-f6289a0e0000 pid=3738->0b1ba66e-2f8f-542f-9f7c-00dd01da057c send: 133B guuid=d7ce80b4-1700-0000-e572-f628b70e0000 pid=3767->0b1ba66e-2f8f-542f-9f7c-00dd01da057c send: 134B guuid=df4098ba-1700-0000-e572-f628d20e0000 pid=3794->0b1ba66e-2f8f-542f-9f7c-00dd01da057c send: 134B guuid=d82de6c1-1700-0000-e572-f628f50e0000 pid=3829->0b1ba66e-2f8f-542f-9f7c-00dd01da057c send: 134B
Score:
96%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/4e8b40b2171cb737e29d115b3cd9d82315cffe3f65406149ef2548e538a734a0
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4e8b40b2171cb737e29d115b3cd9d82315cffe3f65406149ef2548e538a734a0/
Threat name:
Document-HTML.Browser.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2026-07-22 10:35:58 UTC
File Type:
Text (Shell)
AV detection:
8 of 36 (22.22%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=j2fubmqxds3tpyu5cfntzwoyemk477r7mvagcsppeveokofhgsqa._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery execution linux persistence privilege_escalation
Link:
https://tria.ge/reports/260722-mm2lhsgn3v/
Behaviour
Enumerates kernel/hardware configuration
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
Creates/modifies Cron job
Enumerates running processes
Modifies rc script
Modifies systemd
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.26
Link:
https://yomi.yoroi.company/submissions/4e8b40b2171cb737e29d115b3cd9d82315cffe3f65406149ef2548e538a734a0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 4e8b40b2171cb737e29d115b3cd9d82315cffe3f65406149ef2548e538a734a0

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3887342/
  
Delivery method
Distributed via web download

Comments