🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5752ae9a94cebf686664cdbf5cb88f7c53a1cd70947934a0958992bd98b532f4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5752ae9a94cebf686664cdbf5cb88f7c53a1cd70947934a0958992bd98b532f4
SHA3-384 hash: b7680ce8942827b9c9c2f0100065bb1ebaa9fd328f78ae7062ef476470b87595243205142a903750e9f124562280389f
SHA1 hash: 89f66aed54054b19404a68fc65004601d339fac6
MD5 hash: 3761316e5a30054562791e1886ad06ed
humanhash: romeo-island-early-table
File name:ok
Download: download sample
File size:1'608 bytes
First seen:2026-08-22 03:47:41 UTC
Last seen:2026-08-23 03:12:10 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 12:UL6hhtS6+r6mpj9bSw164iD5BU36UcGDbDlx6lDkVbONI6NgF9j8OB66By5J7G6C:vtSpRQW3LVPjpfyTv3m4qDFxQs9
TLSH T1763141DE00941A700262CE8EB3A7314CA68DB2F7385FDBD4AD581DA993486ACF251F5D
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://5.182.210.174/20c791n/an/aua-wget
http://5.182.210.174/2be985n/an/aua-wget
http://5.182.210.174/20fbaen/an/aua-wget
http://5.182.210.174/c5d83dn/an/aua-wget
http://5.182.210.174/233bc5n/an/aua-wget
http://5.182.210.174/0ab716n/an/aua-wget
http://5.182.210.174/5bf116n/an/aua-wget
http://5.182.210.174/dd08c4n/an/aua-wget
http://5.182.210.174/766551n/an/aua-wget
http://5.182.210.174/67dfb1n/an/aua-wget
http://5.182.210.174/9f0d8cn/an/aua-wget
http://5.182.210.174/69e5ebn/an/aua-wget

Intelligence

File Origin
# of uploads :
3
# of downloads :
70
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive mirai
Link:
https://www.filescan.io/uploads/6a891bf971d684b01ef2a0d0/reports/2d653c60-d567-4d7b-87dc-ec249d21129e/overview
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/ef68eb5f-2733-4221-ba8f-5f01e45dc96b
Behavior Graph:
Download SVG
%3 guuid=a905ebde-1600-0000-0658-3bfc390d0000 pid=3385 /usr/bin/sudo guuid=f22675e1-1600-0000-0658-3bfc3e0d0000 pid=3390 /tmp/sample.bin guuid=a905ebde-1600-0000-0658-3bfc390d0000 pid=3385->guuid=f22675e1-1600-0000-0658-3bfc3e0d0000 pid=3390 execve guuid=bc9d8ce2-1600-0000-0658-3bfc3f0d0000 pid=3391 /usr/bin/wget net send-data guuid=f22675e1-1600-0000-0658-3bfc3e0d0000 pid=3390->guuid=bc9d8ce2-1600-0000-0658-3bfc3f0d0000 pid=3391 execve guuid=82e30ce9-1600-0000-0658-3bfc4c0d0000 pid=3404 /usr/bin/curl net send-data write-file guuid=f22675e1-1600-0000-0658-3bfc3e0d0000 pid=3390->guuid=82e30ce9-1600-0000-0658-3bfc4c0d0000 pid=3404 execve guuid=b11849f7-1600-0000-0658-3bfc590d0000 pid=3417 /usr/bin/chmod guuid=f22675e1-1600-0000-0658-3bfc3e0d0000 pid=3390->guuid=b11849f7-1600-0000-0658-3bfc590d0000 pid=3417 execve guuid=ac938af7-1600-0000-0658-3bfc5b0d0000 pid=3419 /usr/bin/bash guuid=f22675e1-1600-0000-0658-3bfc3e0d0000 pid=3390->guuid=ac938af7-1600-0000-0658-3bfc5b0d0000 pid=3419 clone guuid=b7bce9f7-1600-0000-0658-3bfc5e0d0000 pid=3422 /usr/bin/rm delete-file guuid=f22675e1-1600-0000-0658-3bfc3e0d0000 pid=3390->guuid=b7bce9f7-1600-0000-0658-3bfc5e0d0000 pid=3422 execve guuid=968a40f8-1600-0000-0658-3bfc600d0000 pid=3424 /usr/bin/rm guuid=f22675e1-1600-0000-0658-3bfc3e0d0000 pid=3390->guuid=968a40f8-1600-0000-0658-3bfc600d0000 pid=3424 execve guuid=23598bf8-1600-0000-0658-3bfc620d0000 pid=3426 /usr/bin/wget net send-data guuid=f22675e1-1600-0000-0658-3bfc3e0d0000 pid=3390->guuid=23598bf8-1600-0000-0658-3bfc620d0000 pid=3426 execve guuid=2e1020fb-1600-0000-0658-3bfc6c0d0000 pid=3436 /usr/bin/curl net send-data write-file guuid=f22675e1-1600-0000-0658-3bfc3e0d0000 pid=3390->guuid=2e1020fb-1600-0000-0658-3bfc6c0d0000 pid=3436 execve guuid=bff3fdfe-1600-0000-0658-3bfc7a0d0000 pid=3450 /usr/bin/chmod guuid=f22675e1-1600-0000-0658-3bfc3e0d0000 pid=3390->guuid=bff3fdfe-1600-0000-0658-3bfc7a0d0000 pid=3450 execve guuid=4d9359ff-1600-0000-0658-3bfc7b0d0000 pid=3451 /usr/bin/bash guuid=f22675e1-1600-0000-0658-3bfc3e0d0000 pid=3390->guuid=4d9359ff-1600-0000-0658-3bfc7b0d0000 pid=3451 clone guuid=fd419fff-1600-0000-0658-3bfc7e0d0000 pid=3454 /usr/bin/rm delete-file guuid=f22675e1-1600-0000-0658-3bfc3e0d0000 pid=3390->guuid=fd419fff-1600-0000-0658-3bfc7e0d0000 pid=3454 execve guuid=ac91f5ff-1600-0000-0658-3bfc7f0d0000 pid=3455 /usr/bin/rm guuid=f22675e1-1600-0000-0658-3bfc3e0d0000 pid=3390->guuid=ac91f5ff-1600-0000-0658-3bfc7f0d0000 pid=3455 execve guuid=6b1e5f00-1700-0000-0658-3bfc810d0000 pid=3457 /usr/bin/wget net send-data guuid=f22675e1-1600-0000-0658-3bfc3e0d0000 pid=3390->guuid=6b1e5f00-1700-0000-0658-3bfc810d0000 pid=3457 execve guuid=146b3303-1700-0000-0658-3bfc890d0000 pid=3465 /usr/bin/curl net send-data write-file guuid=f22675e1-1600-0000-0658-3bfc3e0d0000 pid=3390->guuid=146b3303-1700-0000-0658-3bfc890d0000 pid=3465 execve guuid=9037fa07-1700-0000-0658-3bfc950d0000 pid=3477 /usr/bin/chmod guuid=f22675e1-1600-0000-0658-3bfc3e0d0000 pid=3390->guuid=9037fa07-1700-0000-0658-3bfc950d0000 pid=3477 execve guuid=e562ad08-1700-0000-0658-3bfc970d0000 pid=3479 /usr/bin/bash guuid=f22675e1-1600-0000-0658-3bfc3e0d0000 pid=3390->guuid=e562ad08-1700-0000-0658-3bfc970d0000 pid=3479 clone guuid=e05d4209-1700-0000-0658-3bfc990d0000 pid=3481 /usr/bin/rm delete-file guuid=f22675e1-1600-0000-0658-3bfc3e0d0000 pid=3390->guuid=e05d4209-1700-0000-0658-3bfc990d0000 pid=3481 execve guuid=ce54f309-1700-0000-0658-3bfc9b0d0000 pid=3483 /usr/bin/rm guuid=f22675e1-1600-0000-0658-3bfc3e0d0000 pid=3390->guuid=ce54f309-1700-0000-0658-3bfc9b0d0000 pid=3483 execve guuid=16e2690a-1700-0000-0658-3bfc9d0d0000 pid=3485 /usr/bin/wget net send-data guuid=f22675e1-1600-0000-0658-3bfc3e0d0000 pid=3390->guuid=16e2690a-1700-0000-0658-3bfc9d0d0000 pid=3485 execve guuid=16f26f0d-1700-0000-0658-3bfca20d0000 pid=3490 /usr/bin/curl net send-data write-file guuid=f22675e1-1600-0000-0658-3bfc3e0d0000 pid=3390->guuid=16f26f0d-1700-0000-0658-3bfca20d0000 pid=3490 execve guuid=6d181a18-1700-0000-0658-3bfcbb0d0000 pid=3515 /usr/bin/chmod guuid=f22675e1-1600-0000-0658-3bfc3e0d0000 pid=3390->guuid=6d181a18-1700-0000-0658-3bfcbb0d0000 pid=3515 execve guuid=d4bb1119-1700-0000-0658-3bfcbd0d0000 pid=3517 /usr/bin/bash guuid=f22675e1-1600-0000-0658-3bfc3e0d0000 pid=3390->guuid=d4bb1119-1700-0000-0658-3bfcbd0d0000 pid=3517 clone guuid=ad3a9119-1700-0000-0658-3bfcc20d0000 pid=3522 /usr/bin/rm delete-file guuid=f22675e1-1600-0000-0658-3bfc3e0d0000 pid=3390->guuid=ad3a9119-1700-0000-0658-3bfcc20d0000 pid=3522 execve guuid=f57be719-1700-0000-0658-3bfcc30d0000 pid=3523 /usr/bin/rm guuid=f22675e1-1600-0000-0658-3bfc3e0d0000 pid=3390->guuid=f57be719-1700-0000-0658-3bfcc30d0000 pid=3523 execve guuid=9bbf3d1a-1700-0000-0658-3bfcc40d0000 pid=3524 /usr/bin/wget net send-data guuid=f22675e1-1600-0000-0658-3bfc3e0d0000 pid=3390->guuid=9bbf3d1a-1700-0000-0658-3bfcc40d0000 pid=3524 execve guuid=92a24326-1700-0000-0658-3bfce10d0000 pid=3553 /usr/bin/curl net send-data write-file guuid=f22675e1-1600-0000-0658-3bfc3e0d0000 pid=3390->guuid=92a24326-1700-0000-0658-3bfce10d0000 pid=3553 execve guuid=6f2ae02f-1700-0000-0658-3bfcfc0d0000 pid=3580 /usr/bin/chmod guuid=f22675e1-1600-0000-0658-3bfc3e0d0000 pid=3390->guuid=6f2ae02f-1700-0000-0658-3bfcfc0d0000 pid=3580 execve guuid=fa125730-1700-0000-0658-3bfcfe0d0000 pid=3582 /usr/bin/bash guuid=f22675e1-1600-0000-0658-3bfc3e0d0000 pid=3390->guuid=fa125730-1700-0000-0658-3bfcfe0d0000 pid=3582 clone guuid=806db730-1700-0000-0658-3bfc010e0000 pid=3585 /usr/bin/rm delete-file guuid=f22675e1-1600-0000-0658-3bfc3e0d0000 pid=3390->guuid=806db730-1700-0000-0658-3bfc010e0000 pid=3585 execve guuid=daba3931-1700-0000-0658-3bfc030e0000 pid=3587 /usr/bin/rm guuid=f22675e1-1600-0000-0658-3bfc3e0d0000 pid=3390->guuid=daba3931-1700-0000-0658-3bfc030e0000 pid=3587 execve guuid=e517b831-1700-0000-0658-3bfc050e0000 pid=3589 /usr/bin/wget net send-data guuid=f22675e1-1600-0000-0658-3bfc3e0d0000 pid=3390->guuid=e517b831-1700-0000-0658-3bfc050e0000 pid=3589 execve guuid=0f3fe337-1700-0000-0658-3bfc140e0000 pid=3604 /usr/bin/curl net send-data write-file guuid=f22675e1-1600-0000-0658-3bfc3e0d0000 pid=3390->guuid=0f3fe337-1700-0000-0658-3bfc140e0000 pid=3604 execve guuid=1850773b-1700-0000-0658-3bfc210e0000 pid=3617 /usr/bin/chmod guuid=f22675e1-1600-0000-0658-3bfc3e0d0000 pid=3390->guuid=1850773b-1700-0000-0658-3bfc210e0000 pid=3617 execve guuid=ce24dc3b-1700-0000-0658-3bfc240e0000 pid=3620 /usr/bin/bash guuid=f22675e1-1600-0000-0658-3bfc3e0d0000 pid=3390->guuid=ce24dc3b-1700-0000-0658-3bfc240e0000 pid=3620 clone guuid=79d6523c-1700-0000-0658-3bfc270e0000 pid=3623 /usr/bin/rm delete-file guuid=f22675e1-1600-0000-0658-3bfc3e0d0000 pid=3390->guuid=79d6523c-1700-0000-0658-3bfc270e0000 pid=3623 execve guuid=4209bd3c-1700-0000-0658-3bfc2a0e0000 pid=3626 /usr/bin/rm guuid=f22675e1-1600-0000-0658-3bfc3e0d0000 pid=3390->guuid=4209bd3c-1700-0000-0658-3bfc2a0e0000 pid=3626 execve guuid=0095283d-1700-0000-0658-3bfc2c0e0000 pid=3628 /usr/bin/wget net send-data guuid=f22675e1-1600-0000-0658-3bfc3e0d0000 pid=3390->guuid=0095283d-1700-0000-0658-3bfc2c0e0000 pid=3628 execve guuid=bd80ff3f-1700-0000-0658-3bfc390e0000 pid=3641 /usr/bin/curl net send-data write-file guuid=f22675e1-1600-0000-0658-3bfc3e0d0000 pid=3390->guuid=bd80ff3f-1700-0000-0658-3bfc390e0000 pid=3641 execve guuid=d203e344-1700-0000-0658-3bfc4b0e0000 pid=3659 /usr/bin/chmod guuid=f22675e1-1600-0000-0658-3bfc3e0d0000 pid=3390->guuid=d203e344-1700-0000-0658-3bfc4b0e0000 pid=3659 execve guuid=eb8e4445-1700-0000-0658-3bfc4f0e0000 pid=3663 /usr/bin/bash guuid=f22675e1-1600-0000-0658-3bfc3e0d0000 pid=3390->guuid=eb8e4445-1700-0000-0658-3bfc4f0e0000 pid=3663 clone guuid=393ca345-1700-0000-0658-3bfc510e0000 pid=3665 /usr/bin/rm delete-file guuid=f22675e1-1600-0000-0658-3bfc3e0d0000 pid=3390->guuid=393ca345-1700-0000-0658-3bfc510e0000 pid=3665 execve guuid=a3f10e46-1700-0000-0658-3bfc550e0000 pid=3669 /usr/bin/rm guuid=f22675e1-1600-0000-0658-3bfc3e0d0000 pid=3390->guuid=a3f10e46-1700-0000-0658-3bfc550e0000 pid=3669 execve guuid=52be7d46-1700-0000-0658-3bfc570e0000 pid=3671 /usr/bin/wget net send-data guuid=f22675e1-1600-0000-0658-3bfc3e0d0000 pid=3390->guuid=52be7d46-1700-0000-0658-3bfc570e0000 pid=3671 execve guuid=b6517b4b-1700-0000-0658-3bfc660e0000 pid=3686 /usr/bin/curl net send-data write-file guuid=f22675e1-1600-0000-0658-3bfc3e0d0000 pid=3390->guuid=b6517b4b-1700-0000-0658-3bfc660e0000 pid=3686 execve guuid=ed0d0b4f-1700-0000-0658-3bfc6e0e0000 pid=3694 /usr/bin/chmod guuid=f22675e1-1600-0000-0658-3bfc3e0d0000 pid=3390->guuid=ed0d0b4f-1700-0000-0658-3bfc6e0e0000 pid=3694 execve guuid=91954b4f-1700-0000-0658-3bfc700e0000 pid=3696 /usr/bin/bash guuid=f22675e1-1600-0000-0658-3bfc3e0d0000 pid=3390->guuid=91954b4f-1700-0000-0658-3bfc700e0000 pid=3696 clone guuid=8a0f834f-1700-0000-0658-3bfc730e0000 pid=3699 /usr/bin/rm delete-file guuid=f22675e1-1600-0000-0658-3bfc3e0d0000 pid=3390->guuid=8a0f834f-1700-0000-0658-3bfc730e0000 pid=3699 execve guuid=de8cc44f-1700-0000-0658-3bfc750e0000 pid=3701 /usr/bin/rm guuid=f22675e1-1600-0000-0658-3bfc3e0d0000 pid=3390->guuid=de8cc44f-1700-0000-0658-3bfc750e0000 pid=3701 execve guuid=912b0550-1700-0000-0658-3bfc770e0000 pid=3703 /usr/bin/wget net send-data guuid=f22675e1-1600-0000-0658-3bfc3e0d0000 pid=3390->guuid=912b0550-1700-0000-0658-3bfc770e0000 pid=3703 execve guuid=17f15a52-1700-0000-0658-3bfc870e0000 pid=3719 /usr/bin/curl net send-data write-file guuid=f22675e1-1600-0000-0658-3bfc3e0d0000 pid=3390->guuid=17f15a52-1700-0000-0658-3bfc870e0000 pid=3719 execve guuid=96a86c56-1700-0000-0658-3bfc9e0e0000 pid=3742 /usr/bin/chmod guuid=f22675e1-1600-0000-0658-3bfc3e0d0000 pid=3390->guuid=96a86c56-1700-0000-0658-3bfc9e0e0000 pid=3742 execve guuid=6cb52257-1700-0000-0658-3bfca40e0000 pid=3748 /usr/bin/bash guuid=f22675e1-1600-0000-0658-3bfc3e0d0000 pid=3390->guuid=6cb52257-1700-0000-0658-3bfca40e0000 pid=3748 clone guuid=49908d57-1700-0000-0658-3bfca80e0000 pid=3752 /usr/bin/rm delete-file guuid=f22675e1-1600-0000-0658-3bfc3e0d0000 pid=3390->guuid=49908d57-1700-0000-0658-3bfca80e0000 pid=3752 execve guuid=f9363f58-1700-0000-0658-3bfcae0e0000 pid=3758 /usr/bin/rm guuid=f22675e1-1600-0000-0658-3bfc3e0d0000 pid=3390->guuid=f9363f58-1700-0000-0658-3bfcae0e0000 pid=3758 execve guuid=4427d258-1700-0000-0658-3bfcb10e0000 pid=3761 /usr/bin/wget net send-data guuid=f22675e1-1600-0000-0658-3bfc3e0d0000 pid=3390->guuid=4427d258-1700-0000-0658-3bfcb10e0000 pid=3761 execve guuid=e5def05c-1700-0000-0658-3bfcb90e0000 pid=3769 /usr/bin/curl net send-data write-file guuid=f22675e1-1600-0000-0658-3bfc3e0d0000 pid=3390->guuid=e5def05c-1700-0000-0658-3bfcb90e0000 pid=3769 execve guuid=ba727561-1700-0000-0658-3bfccd0e0000 pid=3789 /usr/bin/chmod guuid=f22675e1-1600-0000-0658-3bfc3e0d0000 pid=3390->guuid=ba727561-1700-0000-0658-3bfccd0e0000 pid=3789 execve guuid=414aba61-1700-0000-0658-3bfccf0e0000 pid=3791 /usr/bin/bash guuid=f22675e1-1600-0000-0658-3bfc3e0d0000 pid=3390->guuid=414aba61-1700-0000-0658-3bfccf0e0000 pid=3791 clone guuid=441aed61-1700-0000-0658-3bfcd10e0000 pid=3793 /usr/bin/rm delete-file guuid=f22675e1-1600-0000-0658-3bfc3e0d0000 pid=3390->guuid=441aed61-1700-0000-0658-3bfcd10e0000 pid=3793 execve guuid=06863362-1700-0000-0658-3bfcd30e0000 pid=3795 /usr/bin/rm guuid=f22675e1-1600-0000-0658-3bfc3e0d0000 pid=3390->guuid=06863362-1700-0000-0658-3bfcd30e0000 pid=3795 execve guuid=f6a77d62-1700-0000-0658-3bfcd60e0000 pid=3798 /usr/bin/wget net send-data guuid=f22675e1-1600-0000-0658-3bfc3e0d0000 pid=3390->guuid=f6a77d62-1700-0000-0658-3bfcd60e0000 pid=3798 execve guuid=74dddc64-1700-0000-0658-3bfce10e0000 pid=3809 /usr/bin/curl net send-data write-file guuid=f22675e1-1600-0000-0658-3bfc3e0d0000 pid=3390->guuid=74dddc64-1700-0000-0658-3bfce10e0000 pid=3809 execve guuid=cb32b768-1700-0000-0658-3bfcef0e0000 pid=3823 /usr/bin/chmod guuid=f22675e1-1600-0000-0658-3bfc3e0d0000 pid=3390->guuid=cb32b768-1700-0000-0658-3bfcef0e0000 pid=3823 execve guuid=6af6fb68-1700-0000-0658-3bfcf00e0000 pid=3824 /usr/bin/bash guuid=f22675e1-1600-0000-0658-3bfc3e0d0000 pid=3390->guuid=6af6fb68-1700-0000-0658-3bfcf00e0000 pid=3824 clone guuid=50553569-1700-0000-0658-3bfcf30e0000 pid=3827 /usr/bin/rm delete-file guuid=f22675e1-1600-0000-0658-3bfc3e0d0000 pid=3390->guuid=50553569-1700-0000-0658-3bfcf30e0000 pid=3827 execve guuid=bb0d7569-1700-0000-0658-3bfcf40e0000 pid=3828 /usr/bin/rm guuid=f22675e1-1600-0000-0658-3bfc3e0d0000 pid=3390->guuid=bb0d7569-1700-0000-0658-3bfcf40e0000 pid=3828 execve guuid=cd7fbd69-1700-0000-0658-3bfcf80e0000 pid=3832 /usr/bin/wget net send-data guuid=f22675e1-1600-0000-0658-3bfc3e0d0000 pid=3390->guuid=cd7fbd69-1700-0000-0658-3bfcf80e0000 pid=3832 execve guuid=c2d73f6d-1700-0000-0658-3bfc020f0000 pid=3842 /usr/bin/curl net send-data write-file guuid=f22675e1-1600-0000-0658-3bfc3e0d0000 pid=3390->guuid=c2d73f6d-1700-0000-0658-3bfc020f0000 pid=3842 execve guuid=59175672-1700-0000-0658-3bfc1b0f0000 pid=3867 /usr/bin/chmod guuid=f22675e1-1600-0000-0658-3bfc3e0d0000 pid=3390->guuid=59175672-1700-0000-0658-3bfc1b0f0000 pid=3867 execve guuid=74279b72-1700-0000-0658-3bfc1d0f0000 pid=3869 /usr/bin/bash guuid=f22675e1-1600-0000-0658-3bfc3e0d0000 pid=3390->guuid=74279b72-1700-0000-0658-3bfc1d0f0000 pid=3869 clone guuid=5150d572-1700-0000-0658-3bfc200f0000 pid=3872 /usr/bin/rm delete-file guuid=f22675e1-1600-0000-0658-3bfc3e0d0000 pid=3390->guuid=5150d572-1700-0000-0658-3bfc200f0000 pid=3872 execve guuid=bcda1d73-1700-0000-0658-3bfc220f0000 pid=3874 /usr/bin/rm guuid=f22675e1-1600-0000-0658-3bfc3e0d0000 pid=3390->guuid=bcda1d73-1700-0000-0658-3bfc220f0000 pid=3874 execve 5b654972-c9e1-50d8-b372-2dc2a5b9ad66 5.182.210.174:80 guuid=bc9d8ce2-1600-0000-0658-3bfc3f0d0000 pid=3391->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=82e30ce9-1600-0000-0658-3bfc4c0d0000 pid=3404->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=f7cda3f7-1600-0000-0658-3bfc5c0d0000 pid=3420 /usr/bin/bash guuid=ac938af7-1600-0000-0658-3bfc5b0d0000 pid=3419->guuid=f7cda3f7-1600-0000-0658-3bfc5c0d0000 pid=3420 clone guuid=23598bf8-1600-0000-0658-3bfc620d0000 pid=3426->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=2e1020fb-1600-0000-0658-3bfc6c0d0000 pid=3436->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=894f78ff-1600-0000-0658-3bfc7c0d0000 pid=3452 /usr/bin/bash guuid=4d9359ff-1600-0000-0658-3bfc7b0d0000 pid=3451->guuid=894f78ff-1600-0000-0658-3bfc7c0d0000 pid=3452 clone guuid=6b1e5f00-1700-0000-0658-3bfc810d0000 pid=3457->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=146b3303-1700-0000-0658-3bfc890d0000 pid=3465->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=6c87f808-1700-0000-0658-3bfc980d0000 pid=3480 /usr/bin/bash guuid=e562ad08-1700-0000-0658-3bfc970d0000 pid=3479->guuid=6c87f808-1700-0000-0658-3bfc980d0000 pid=3480 clone guuid=16e2690a-1700-0000-0658-3bfc9d0d0000 pid=3485->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=16f26f0d-1700-0000-0658-3bfca20d0000 pid=3490->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=c6943619-1700-0000-0658-3bfcbe0d0000 pid=3518 /usr/bin/bash guuid=d4bb1119-1700-0000-0658-3bfcbd0d0000 pid=3517->guuid=c6943619-1700-0000-0658-3bfcbe0d0000 pid=3518 clone guuid=9bbf3d1a-1700-0000-0658-3bfcc40d0000 pid=3524->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=92a24326-1700-0000-0658-3bfce10d0000 pid=3553->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=b42a8230-1700-0000-0658-3bfcff0d0000 pid=3583 /usr/bin/bash guuid=fa125730-1700-0000-0658-3bfcfe0d0000 pid=3582->guuid=b42a8230-1700-0000-0658-3bfcff0d0000 pid=3583 clone guuid=e517b831-1700-0000-0658-3bfc050e0000 pid=3589->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=0f3fe337-1700-0000-0658-3bfc140e0000 pid=3604->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=26c7f73b-1700-0000-0658-3bfc260e0000 pid=3622 /usr/bin/bash guuid=ce24dc3b-1700-0000-0658-3bfc240e0000 pid=3620->guuid=26c7f73b-1700-0000-0658-3bfc260e0000 pid=3622 clone guuid=0095283d-1700-0000-0658-3bfc2c0e0000 pid=3628->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=bd80ff3f-1700-0000-0658-3bfc390e0000 pid=3641->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=5fc36645-1700-0000-0658-3bfc500e0000 pid=3664 /usr/bin/bash guuid=eb8e4445-1700-0000-0658-3bfc4f0e0000 pid=3663->guuid=5fc36645-1700-0000-0658-3bfc500e0000 pid=3664 clone guuid=52be7d46-1700-0000-0658-3bfc570e0000 pid=3671->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=b6517b4b-1700-0000-0658-3bfc660e0000 pid=3686->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=bec3634f-1700-0000-0658-3bfc720e0000 pid=3698 /usr/bin/bash guuid=91954b4f-1700-0000-0658-3bfc700e0000 pid=3696->guuid=bec3634f-1700-0000-0658-3bfc720e0000 pid=3698 clone guuid=912b0550-1700-0000-0658-3bfc770e0000 pid=3703->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=17f15a52-1700-0000-0658-3bfc870e0000 pid=3719->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=a43b4c57-1700-0000-0658-3bfca60e0000 pid=3750 /usr/bin/bash guuid=6cb52257-1700-0000-0658-3bfca40e0000 pid=3748->guuid=a43b4c57-1700-0000-0658-3bfca60e0000 pid=3750 clone guuid=4427d258-1700-0000-0658-3bfcb10e0000 pid=3761->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=e5def05c-1700-0000-0658-3bfcb90e0000 pid=3769->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=cd68d161-1700-0000-0658-3bfcd00e0000 pid=3792 /usr/bin/bash guuid=414aba61-1700-0000-0658-3bfccf0e0000 pid=3791->guuid=cd68d161-1700-0000-0658-3bfcd00e0000 pid=3792 clone guuid=f6a77d62-1700-0000-0658-3bfcd60e0000 pid=3798->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=74dddc64-1700-0000-0658-3bfce10e0000 pid=3809->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=1a721469-1700-0000-0658-3bfcf10e0000 pid=3825 /usr/bin/bash guuid=6af6fb68-1700-0000-0658-3bfcf00e0000 pid=3824->guuid=1a721469-1700-0000-0658-3bfcf10e0000 pid=3825 clone guuid=cd7fbd69-1700-0000-0658-3bfcf80e0000 pid=3832->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=c2d73f6d-1700-0000-0658-3bfc020f0000 pid=3842->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=9f80b372-1700-0000-0658-3bfc1e0f0000 pid=3870 /usr/bin/bash guuid=74279b72-1700-0000-0658-3bfc1d0f0000 pid=3869->guuid=9f80b372-1700-0000-0658-3bfc1e0f0000 pid=3870 clone
Score:
99%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/5752ae9a94cebf686664cdbf5cb88f7c53a1cd70947934a0958992bd98b532f4
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5752ae9a94cebf686664cdbf5cb88f7c53a1cd70947934a0958992bd98b532f4/
Threat name:
Linux.Trojan.Egairtigado
Create hunting rule
Status:
Malicious
First seen:
2026-08-22 03:48:16 UTC
File Type:
Text (Shell)
AV detection:
13 of 24 (54.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=k5jk5guuz27wqztezw7vzoepprj2dtlqsr4tjievrgjl3gfvgl2a._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260822-ect5pa1arf/
Behaviour
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.11
Link:
https://yomi.yoroi.company/submissions/5752ae9a94cebf686664cdbf5cb88f7c53a1cd70947934a0958992bd98b532f4

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 5752ae9a94cebf686664cdbf5cb88f7c53a1cd70947934a0958992bd98b532f4

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3897671/
  
Delivery method
Distributed via web download

Comments