🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 51d41d6c6f7ca2102cc49771d08053c6052dfccc879e623e8b305c7776985142. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 51d41d6c6f7ca2102cc49771d08053c6052dfccc879e623e8b305c7776985142
SHA3-384 hash: 6f850feb920b67178ae5e8c12021b45245d6616f3f6e806f71f514aca946d65fdcad5aa72a706afef9906ac5c4572581
SHA1 hash: 05426c5ab94835b1fbe9f3d6c5031e9df69ced62
MD5 hash: a432bc5b37db0ef6c9b6ec828c7a4c8c
humanhash: golf-snake-high-july
File name:run.sh
Download: download sample
File size:2'907 bytes
First seen:2026-10-03 23:54:52 UTC
Last seen:Never
File type: sh
MIME type:text/plain
ssdeep 24:JQ2JMTlbiBb4uZaE9EnE2EhE6fhbwUzJUfIzhM3e:JQ2JMTlbiBb4uZaacvyphbwozhM3e
TLSH T1D751A2EB02185B35BA4A868FB7F03334A10BE1D26ADFD6C4EA48086C0FC9D4C36D5E55
Magika txt
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://91.208.197.133/bins/xnxnxnxnxnxnxnxnaarch64xnxnn/an/acensys elf ua-wget
http://91.208.197.133/bins/xnxnxnxnxnxnxnxni386xnxnn/an/acensys elf ua-wget
http://91.208.197.133/bins/xnxnxnxnxnxnxnxnloongarch64xnxnn/an/acensys elf ua-wget
http://91.208.197.133/bins/xnxnxnxnxnxnxnxnm68kxnxnn/an/acensys elf ua-wget
http://91.208.197.133/bins/xnxnxnxnxnxnxnxnmicroblazexnxnn/an/acensys elf ua-wget
http://91.208.197.133/bins/xnxnxnxnxnxnxnxnmipsxnxnn/an/acensys elf ua-wget
http://91.208.197.133/bins/xnxnxnxnxnxnxnxnor1kxnxnn/an/acensys elf ua-wget
http://91.208.197.133/bins/xnxnxnxnxnxnxnxnpowerpcxnxnn/an/acensys elf ua-wget
http://91.208.197.133/bins/xnxnxnxnxnxnxnxnriscv32xnxnn/an/acensys elf ua-wget
http://91.208.197.133/bins/xnxnxnxnxnxnxnxnriscv64xnxnn/an/acensys elf ua-wget
http://91.208.197.133/bins/xnxnxnxnxnxnxnxnsh2xnxnn/an/acensys elf ua-wget
http://91.208.197.133/bins/xnxnxnxnxnxnxnxnsh4xnxnn/an/acensys elf ua-wget
http://91.208.197.133/bins/xnxnxnxnxnxnxnxnx86_64xnxnn/an/acensys elf ua-wget

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive
Link:
https://www.filescan.io/uploads/6ac196021801d80b1f9a9c5e/reports/e1ddb8bf-508c-42b6-8ef5-a96a2b3aa88a/overview
Verdict:
Malicious
File Type:
text
First seen:
2026-10-03T21:12:00Z UTC
Last seen:
2026-10-05T04:26:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/51d41d6c6f7ca2102cc49771d08053c6052dfccc879e623e8b305c7776985142/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/d8d42a8f-f5e0-4bf8-988e-e0d47ab0ccc7
Behavior Graph:
Download SVG
%3 guuid=159c2d7c-1d00-0000-e144-26403a080000 pid=2106 /usr/bin/sudo guuid=1543a97e-1d00-0000-e144-264044080000 pid=2116 /tmp/sample.bin guuid=159c2d7c-1d00-0000-e144-26403a080000 pid=2106->guuid=1543a97e-1d00-0000-e144-264044080000 pid=2116 execve guuid=9060047f-1d00-0000-e144-264047080000 pid=2119 /usr/bin/wget net send-data guuid=1543a97e-1d00-0000-e144-264044080000 pid=2116->guuid=9060047f-1d00-0000-e144-264047080000 pid=2119 execve guuid=f24e038d-1d00-0000-e144-264054080000 pid=2132 /usr/bin/curl net send-data write-file guuid=1543a97e-1d00-0000-e144-264044080000 pid=2116->guuid=f24e038d-1d00-0000-e144-264054080000 pid=2132 execve guuid=6bb6b2b7-1d00-0000-e144-264079080000 pid=2169 /usr/bin/chmod guuid=1543a97e-1d00-0000-e144-264044080000 pid=2116->guuid=6bb6b2b7-1d00-0000-e144-264079080000 pid=2169 execve guuid=de3afbb7-1d00-0000-e144-26407a080000 pid=2170 /home/sandbox/xnxnxnxnxnxnxnxnaarch64xnxn guuid=1543a97e-1d00-0000-e144-264044080000 pid=2116->guuid=de3afbb7-1d00-0000-e144-26407a080000 pid=2170 execve guuid=ef6543b8-1d00-0000-e144-26407b080000 pid=2171 /usr/bin/rm delete-file guuid=1543a97e-1d00-0000-e144-264044080000 pid=2116->guuid=ef6543b8-1d00-0000-e144-26407b080000 pid=2171 execve guuid=a50c85b8-1d00-0000-e144-26407d080000 pid=2173 /usr/bin/wget net send-data guuid=1543a97e-1d00-0000-e144-264044080000 pid=2116->guuid=a50c85b8-1d00-0000-e144-26407d080000 pid=2173 execve guuid=9ffcbabe-1d00-0000-e144-264088080000 pid=2184 /usr/bin/curl net send-data write-file guuid=1543a97e-1d00-0000-e144-264044080000 pid=2116->guuid=9ffcbabe-1d00-0000-e144-264088080000 pid=2184 execve guuid=9ebf90c6-1d00-0000-e144-264098080000 pid=2200 /usr/bin/chmod guuid=1543a97e-1d00-0000-e144-264044080000 pid=2116->guuid=9ebf90c6-1d00-0000-e144-264098080000 pid=2200 execve guuid=f0bbe1c6-1d00-0000-e144-26409a080000 pid=2202 /home/sandbox/xnxnxnxnxnxnxnxni386xnxn guuid=1543a97e-1d00-0000-e144-264044080000 pid=2116->guuid=f0bbe1c6-1d00-0000-e144-26409a080000 pid=2202 execve guuid=5ba618c7-1d00-0000-e144-26409c080000 pid=2204 /usr/bin/rm delete-file guuid=1543a97e-1d00-0000-e144-264044080000 pid=2116->guuid=5ba618c7-1d00-0000-e144-26409c080000 pid=2204 execve guuid=cc866cc7-1d00-0000-e144-26409e080000 pid=2206 /usr/bin/wget net send-data guuid=1543a97e-1d00-0000-e144-264044080000 pid=2116->guuid=cc866cc7-1d00-0000-e144-26409e080000 pid=2206 execve guuid=030daacd-1d00-0000-e144-2640ac080000 pid=2220 /usr/bin/curl net send-data write-file guuid=1543a97e-1d00-0000-e144-264044080000 pid=2116->guuid=030daacd-1d00-0000-e144-2640ac080000 pid=2220 execve guuid=b92e79d5-1d00-0000-e144-2640b4080000 pid=2228 /usr/bin/chmod guuid=1543a97e-1d00-0000-e144-264044080000 pid=2116->guuid=b92e79d5-1d00-0000-e144-2640b4080000 pid=2228 execve guuid=edbec3d5-1d00-0000-e144-2640b6080000 pid=2230 /home/sandbox/xnxnxnxnxnxnxnxnloongarch64xnxn guuid=1543a97e-1d00-0000-e144-264044080000 pid=2116->guuid=edbec3d5-1d00-0000-e144-2640b6080000 pid=2230 execve guuid=121d20d6-1d00-0000-e144-2640b7080000 pid=2231 /usr/bin/rm delete-file guuid=1543a97e-1d00-0000-e144-264044080000 pid=2116->guuid=121d20d6-1d00-0000-e144-2640b7080000 pid=2231 execve guuid=4cac7dd6-1d00-0000-e144-2640b8080000 pid=2232 /usr/bin/wget net send-data guuid=1543a97e-1d00-0000-e144-264044080000 pid=2116->guuid=4cac7dd6-1d00-0000-e144-2640b8080000 pid=2232 execve guuid=ba96c5dc-1d00-0000-e144-2640c4080000 pid=2244 /usr/bin/curl net send-data write-file guuid=1543a97e-1d00-0000-e144-264044080000 pid=2116->guuid=ba96c5dc-1d00-0000-e144-2640c4080000 pid=2244 execve guuid=62fc5ee8-1d00-0000-e144-2640d1080000 pid=2257 /usr/bin/chmod guuid=1543a97e-1d00-0000-e144-264044080000 pid=2116->guuid=62fc5ee8-1d00-0000-e144-2640d1080000 pid=2257 execve guuid=ffa3d4e8-1d00-0000-e144-2640d3080000 pid=2259 /home/sandbox/xnxnxnxnxnxnxnxnm68kxnxn guuid=1543a97e-1d00-0000-e144-264044080000 pid=2116->guuid=ffa3d4e8-1d00-0000-e144-2640d3080000 pid=2259 execve guuid=4ecb46e9-1d00-0000-e144-2640d6080000 pid=2262 /usr/bin/rm delete-file guuid=1543a97e-1d00-0000-e144-264044080000 pid=2116->guuid=4ecb46e9-1d00-0000-e144-2640d6080000 pid=2262 execve guuid=0837aee9-1d00-0000-e144-2640d8080000 pid=2264 /usr/bin/wget net send-data guuid=1543a97e-1d00-0000-e144-264044080000 pid=2116->guuid=0837aee9-1d00-0000-e144-2640d8080000 pid=2264 execve guuid=4d3393f1-1d00-0000-e144-2640e3080000 pid=2275 /usr/bin/curl net send-data write-file guuid=1543a97e-1d00-0000-e144-264044080000 pid=2116->guuid=4d3393f1-1d00-0000-e144-2640e3080000 pid=2275 execve guuid=360a5efe-1d00-0000-e144-2640f6080000 pid=2294 /usr/bin/chmod guuid=1543a97e-1d00-0000-e144-264044080000 pid=2116->guuid=360a5efe-1d00-0000-e144-2640f6080000 pid=2294 execve guuid=e21bd0fe-1d00-0000-e144-2640f8080000 pid=2296 /home/sandbox/xnxnxnxnxnxnxnxnmicroblazexnxn guuid=1543a97e-1d00-0000-e144-264044080000 pid=2116->guuid=e21bd0fe-1d00-0000-e144-2640f8080000 pid=2296 execve guuid=90de28ff-1d00-0000-e144-2640f9080000 pid=2297 /usr/bin/rm delete-file guuid=1543a97e-1d00-0000-e144-264044080000 pid=2116->guuid=90de28ff-1d00-0000-e144-2640f9080000 pid=2297 execve guuid=02e79eff-1d00-0000-e144-2640fc080000 pid=2300 /usr/bin/wget net send-data guuid=1543a97e-1d00-0000-e144-264044080000 pid=2116->guuid=02e79eff-1d00-0000-e144-2640fc080000 pid=2300 execve guuid=e78e1506-1e00-0000-e144-26400a090000 pid=2314 /usr/bin/curl net send-data write-file guuid=1543a97e-1d00-0000-e144-264044080000 pid=2116->guuid=e78e1506-1e00-0000-e144-26400a090000 pid=2314 execve guuid=3e856a10-1e00-0000-e144-264014090000 pid=2324 /usr/bin/chmod guuid=1543a97e-1d00-0000-e144-264044080000 pid=2116->guuid=3e856a10-1e00-0000-e144-264014090000 pid=2324 execve guuid=9d632311-1e00-0000-e144-264017090000 pid=2327 /home/sandbox/xnxnxnxnxnxnxnxnmipsxnxn guuid=1543a97e-1d00-0000-e144-264044080000 pid=2116->guuid=9d632311-1e00-0000-e144-264017090000 pid=2327 execve guuid=7bb4a611-1e00-0000-e144-26401a090000 pid=2330 /usr/bin/rm delete-file guuid=1543a97e-1d00-0000-e144-264044080000 pid=2116->guuid=7bb4a611-1e00-0000-e144-26401a090000 pid=2330 execve guuid=70486612-1e00-0000-e144-26401c090000 pid=2332 /usr/bin/wget net send-data guuid=1543a97e-1d00-0000-e144-264044080000 pid=2116->guuid=70486612-1e00-0000-e144-26401c090000 pid=2332 execve guuid=e6296d1a-1e00-0000-e144-264031090000 pid=2353 /usr/bin/curl net send-data write-file guuid=1543a97e-1d00-0000-e144-264044080000 pid=2116->guuid=e6296d1a-1e00-0000-e144-264031090000 pid=2353 execve guuid=c1077024-1e00-0000-e144-26403e090000 pid=2366 /usr/bin/chmod guuid=1543a97e-1d00-0000-e144-264044080000 pid=2116->guuid=c1077024-1e00-0000-e144-26403e090000 pid=2366 execve guuid=d469b324-1e00-0000-e144-264040090000 pid=2368 /home/sandbox/xnxnxnxnxnxnxnxnor1kxnxn guuid=1543a97e-1d00-0000-e144-264044080000 pid=2116->guuid=d469b324-1e00-0000-e144-264040090000 pid=2368 execve guuid=d5dcf624-1e00-0000-e144-264041090000 pid=2369 /usr/bin/rm delete-file guuid=1543a97e-1d00-0000-e144-264044080000 pid=2116->guuid=d5dcf624-1e00-0000-e144-264041090000 pid=2369 execve guuid=52373625-1e00-0000-e144-264042090000 pid=2370 /usr/bin/wget net send-data guuid=1543a97e-1d00-0000-e144-264044080000 pid=2116->guuid=52373625-1e00-0000-e144-264042090000 pid=2370 execve guuid=db973e2b-1e00-0000-e144-26404e090000 pid=2382 /usr/bin/curl net send-data write-file guuid=1543a97e-1d00-0000-e144-264044080000 pid=2116->guuid=db973e2b-1e00-0000-e144-26404e090000 pid=2382 execve guuid=5d77c237-1e00-0000-e144-264067090000 pid=2407 /usr/bin/chmod guuid=1543a97e-1d00-0000-e144-264044080000 pid=2116->guuid=5d77c237-1e00-0000-e144-264067090000 pid=2407 execve guuid=9ee71938-1e00-0000-e144-264069090000 pid=2409 /home/sandbox/xnxnxnxnxnxnxnxnpowerpcxnxn guuid=1543a97e-1d00-0000-e144-264044080000 pid=2116->guuid=9ee71938-1e00-0000-e144-264069090000 pid=2409 execve guuid=602a8c38-1e00-0000-e144-26406b090000 pid=2411 /usr/bin/rm delete-file guuid=1543a97e-1d00-0000-e144-264044080000 pid=2116->guuid=602a8c38-1e00-0000-e144-26406b090000 pid=2411 execve guuid=3ebd3839-1e00-0000-e144-26406d090000 pid=2413 /usr/bin/wget net send-data guuid=1543a97e-1d00-0000-e144-264044080000 pid=2116->guuid=3ebd3839-1e00-0000-e144-26406d090000 pid=2413 execve guuid=91f93f40-1e00-0000-e144-264077090000 pid=2423 /usr/bin/curl net send-data write-file guuid=1543a97e-1d00-0000-e144-264044080000 pid=2116->guuid=91f93f40-1e00-0000-e144-264077090000 pid=2423 execve guuid=dd7ec149-1e00-0000-e144-264089090000 pid=2441 /usr/bin/chmod guuid=1543a97e-1d00-0000-e144-264044080000 pid=2116->guuid=dd7ec149-1e00-0000-e144-264089090000 pid=2441 execve guuid=91dd1e4a-1e00-0000-e144-26408a090000 pid=2442 /home/sandbox/xnxnxnxnxnxnxnxnriscv32xnxn guuid=1543a97e-1d00-0000-e144-264044080000 pid=2116->guuid=91dd1e4a-1e00-0000-e144-26408a090000 pid=2442 execve guuid=e153124b-1e00-0000-e144-26408d090000 pid=2445 /usr/bin/rm delete-file guuid=1543a97e-1d00-0000-e144-264044080000 pid=2116->guuid=e153124b-1e00-0000-e144-26408d090000 pid=2445 execve guuid=f224e44b-1e00-0000-e144-264090090000 pid=2448 /usr/bin/wget net send-data guuid=1543a97e-1d00-0000-e144-264044080000 pid=2116->guuid=f224e44b-1e00-0000-e144-264090090000 pid=2448 execve guuid=a27e5653-1e00-0000-e144-26409d090000 pid=2461 /usr/bin/curl net send-data write-file guuid=1543a97e-1d00-0000-e144-264044080000 pid=2116->guuid=a27e5653-1e00-0000-e144-26409d090000 pid=2461 execve guuid=7d88679c-1e00-0000-e144-26400c0a0000 pid=2572 /usr/bin/chmod guuid=1543a97e-1d00-0000-e144-264044080000 pid=2116->guuid=7d88679c-1e00-0000-e144-26400c0a0000 pid=2572 execve guuid=6f86089d-1e00-0000-e144-26400e0a0000 pid=2574 /home/sandbox/xnxnxnxnxnxnxnxnriscv64xnxn guuid=1543a97e-1d00-0000-e144-264044080000 pid=2116->guuid=6f86089d-1e00-0000-e144-26400e0a0000 pid=2574 execve guuid=78c7949d-1e00-0000-e144-26400f0a0000 pid=2575 /usr/bin/rm delete-file guuid=1543a97e-1d00-0000-e144-264044080000 pid=2116->guuid=78c7949d-1e00-0000-e144-26400f0a0000 pid=2575 execve guuid=970f289e-1e00-0000-e144-2640100a0000 pid=2576 /usr/bin/wget net send-data guuid=1543a97e-1d00-0000-e144-264044080000 pid=2116->guuid=970f289e-1e00-0000-e144-2640100a0000 pid=2576 execve guuid=b71b28b7-1e00-0000-e144-2640350a0000 pid=2613 /usr/bin/curl net send-data write-file guuid=1543a97e-1d00-0000-e144-264044080000 pid=2116->guuid=b71b28b7-1e00-0000-e144-2640350a0000 pid=2613 execve guuid=b7ad80c0-1e00-0000-e144-2640440a0000 pid=2628 /usr/bin/chmod guuid=1543a97e-1d00-0000-e144-264044080000 pid=2116->guuid=b7ad80c0-1e00-0000-e144-2640440a0000 pid=2628 execve guuid=bb20a1e3-1e00-0000-e144-2640640a0000 pid=2660 /home/sandbox/xnxnxnxnxnxnxnxnsh2xnxn guuid=1543a97e-1d00-0000-e144-264044080000 pid=2116->guuid=bb20a1e3-1e00-0000-e144-2640640a0000 pid=2660 execve guuid=28d7e8e3-1e00-0000-e144-2640650a0000 pid=2661 /usr/bin/rm delete-file guuid=1543a97e-1d00-0000-e144-264044080000 pid=2116->guuid=28d7e8e3-1e00-0000-e144-2640650a0000 pid=2661 execve guuid=62f93de4-1e00-0000-e144-2640660a0000 pid=2662 /usr/bin/wget net send-data guuid=1543a97e-1d00-0000-e144-264044080000 pid=2116->guuid=62f93de4-1e00-0000-e144-2640660a0000 pid=2662 execve guuid=088664ea-1e00-0000-e144-2640750a0000 pid=2677 /usr/bin/curl net send-data write-file guuid=1543a97e-1d00-0000-e144-264044080000 pid=2116->guuid=088664ea-1e00-0000-e144-2640750a0000 pid=2677 execve guuid=8590f5f2-1e00-0000-e144-2640870a0000 pid=2695 /usr/bin/chmod guuid=1543a97e-1d00-0000-e144-264044080000 pid=2116->guuid=8590f5f2-1e00-0000-e144-2640870a0000 pid=2695 execve guuid=0f9d6bf3-1e00-0000-e144-2640890a0000 pid=2697 /home/sandbox/xnxnxnxnxnxnxnxnsh4xnxn guuid=1543a97e-1d00-0000-e144-264044080000 pid=2116->guuid=0f9d6bf3-1e00-0000-e144-2640890a0000 pid=2697 execve guuid=c8cac4f3-1e00-0000-e144-26408a0a0000 pid=2698 /usr/bin/rm delete-file guuid=1543a97e-1d00-0000-e144-264044080000 pid=2116->guuid=c8cac4f3-1e00-0000-e144-26408a0a0000 pid=2698 execve guuid=3c382ef4-1e00-0000-e144-26408c0a0000 pid=2700 /usr/bin/wget net send-data guuid=1543a97e-1d00-0000-e144-264044080000 pid=2116->guuid=3c382ef4-1e00-0000-e144-26408c0a0000 pid=2700 execve guuid=3a7ce6f9-1e00-0000-e144-2640960a0000 pid=2710 /usr/bin/curl net send-data write-file guuid=1543a97e-1d00-0000-e144-264044080000 pid=2116->guuid=3a7ce6f9-1e00-0000-e144-2640960a0000 pid=2710 execve guuid=7f2b1901-1f00-0000-e144-2640a50a0000 pid=2725 /usr/bin/chmod guuid=1543a97e-1d00-0000-e144-264044080000 pid=2116->guuid=7f2b1901-1f00-0000-e144-2640a50a0000 pid=2725 execve guuid=edb5a201-1f00-0000-e144-2640a70a0000 pid=2727 /home/sandbox/xnxnxnxnxnxnxnxnx86_64xnxn guuid=1543a97e-1d00-0000-e144-264044080000 pid=2116->guuid=edb5a201-1f00-0000-e144-2640a70a0000 pid=2727 execve guuid=6d6af001-1f00-0000-e144-2640aa0a0000 pid=2730 /usr/bin/rm delete-file guuid=1543a97e-1d00-0000-e144-264044080000 pid=2116->guuid=6d6af001-1f00-0000-e144-2640aa0a0000 pid=2730 execve 1f0601ec-5d49-5dbe-b026-2b3db51888d9 91.208.197.133:80 guuid=9060047f-1d00-0000-e144-264047080000 pid=2119->1f0601ec-5d49-5dbe-b026-2b3db51888d9 send: 161B guuid=f24e038d-1d00-0000-e144-264054080000 pid=2132->1f0601ec-5d49-5dbe-b026-2b3db51888d9 send: 110B guuid=a50c85b8-1d00-0000-e144-26407d080000 pid=2173->1f0601ec-5d49-5dbe-b026-2b3db51888d9 send: 158B guuid=9ffcbabe-1d00-0000-e144-264088080000 pid=2184->1f0601ec-5d49-5dbe-b026-2b3db51888d9 send: 107B guuid=cc866cc7-1d00-0000-e144-26409e080000 pid=2206->1f0601ec-5d49-5dbe-b026-2b3db51888d9 send: 165B guuid=030daacd-1d00-0000-e144-2640ac080000 pid=2220->1f0601ec-5d49-5dbe-b026-2b3db51888d9 send: 114B guuid=4cac7dd6-1d00-0000-e144-2640b8080000 pid=2232->1f0601ec-5d49-5dbe-b026-2b3db51888d9 send: 158B guuid=ba96c5dc-1d00-0000-e144-2640c4080000 pid=2244->1f0601ec-5d49-5dbe-b026-2b3db51888d9 send: 107B guuid=0837aee9-1d00-0000-e144-2640d8080000 pid=2264->1f0601ec-5d49-5dbe-b026-2b3db51888d9 send: 164B guuid=4d3393f1-1d00-0000-e144-2640e3080000 pid=2275->1f0601ec-5d49-5dbe-b026-2b3db51888d9 send: 113B guuid=02e79eff-1d00-0000-e144-2640fc080000 pid=2300->1f0601ec-5d49-5dbe-b026-2b3db51888d9 send: 158B guuid=e78e1506-1e00-0000-e144-26400a090000 pid=2314->1f0601ec-5d49-5dbe-b026-2b3db51888d9 send: 107B guuid=70486612-1e00-0000-e144-26401c090000 pid=2332->1f0601ec-5d49-5dbe-b026-2b3db51888d9 send: 158B guuid=e6296d1a-1e00-0000-e144-264031090000 pid=2353->1f0601ec-5d49-5dbe-b026-2b3db51888d9 send: 107B guuid=52373625-1e00-0000-e144-264042090000 pid=2370->1f0601ec-5d49-5dbe-b026-2b3db51888d9 send: 161B guuid=db973e2b-1e00-0000-e144-26404e090000 pid=2382->1f0601ec-5d49-5dbe-b026-2b3db51888d9 send: 110B guuid=3ebd3839-1e00-0000-e144-26406d090000 pid=2413->1f0601ec-5d49-5dbe-b026-2b3db51888d9 send: 161B guuid=91f93f40-1e00-0000-e144-264077090000 pid=2423->1f0601ec-5d49-5dbe-b026-2b3db51888d9 send: 110B guuid=f224e44b-1e00-0000-e144-264090090000 pid=2448->1f0601ec-5d49-5dbe-b026-2b3db51888d9 send: 161B guuid=a27e5653-1e00-0000-e144-26409d090000 pid=2461->1f0601ec-5d49-5dbe-b026-2b3db51888d9 send: 110B guuid=970f289e-1e00-0000-e144-2640100a0000 pid=2576->1f0601ec-5d49-5dbe-b026-2b3db51888d9 send: 157B guuid=b71b28b7-1e00-0000-e144-2640350a0000 pid=2613->1f0601ec-5d49-5dbe-b026-2b3db51888d9 send: 106B guuid=62f93de4-1e00-0000-e144-2640660a0000 pid=2662->1f0601ec-5d49-5dbe-b026-2b3db51888d9 send: 157B guuid=088664ea-1e00-0000-e144-2640750a0000 pid=2677->1f0601ec-5d49-5dbe-b026-2b3db51888d9 send: 106B guuid=3c382ef4-1e00-0000-e144-26408c0a0000 pid=2700->1f0601ec-5d49-5dbe-b026-2b3db51888d9 send: 160B guuid=3a7ce6f9-1e00-0000-e144-2640960a0000 pid=2710->1f0601ec-5d49-5dbe-b026-2b3db51888d9 send: 109B
Score:
98%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/51d41d6c6f7ca2102cc49771d08053c6052dfccc879e623e8b305c7776985142
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/51d41d6c6f7ca2102cc49771d08053c6052dfccc879e623e8b305c7776985142/
Threat name:
Win32.Trojan.Ravartar
Create hunting rule
Status:
Malicious
First seen:
2026-10-03 23:55:36 UTC
File Type:
Text (Shell)
AV detection:
14 of 37 (37.84%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=khkb23dppsrbalges5y5bactyycs37gmq6pgepulgboho5uykfba._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
execution
Link:
https://tria.ge/reports/261003-3ynrsszz8j/
Behaviour
Modifies registry class
Suspicious use of SetWindowsHookEx
Enumerates physical storage devices
Executes a command shell one-liner
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/51d41d6c6f7ca2102cc49771d08053c6052dfccc879e623e8b305c7776985142

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 51d41d6c6f7ca2102cc49771d08053c6052dfccc879e623e8b305c7776985142

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3928046/
  
Delivery method
Distributed via web download

Comments