MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5804a9c2f5d8dbdd9d49476df3cf29c43dcf425f541a09ecef3d80e571a24bdb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5804a9c2f5d8dbdd9d49476df3cf29c43dcf425f541a09ecef3d80e571a24bdb
SHA3-384 hash: c696d50cbd083b94a794f1ee19beead8ad9daff25adfd07a43eef3eb4ba2f18b328174996dcc3070f84c301d1c14cc02
SHA1 hash: 6434b487f20bb099924829df8c3d50906e298fcb
MD5 hash: 6c7dda09fabb23fb909e9d7ea946f069
humanhash: burger-dakota-fillet-white
File name:ok
Download: download sample
File size:1'608 bytes
First seen:2026-08-28 21:24:57 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 24:34PptoNJ39FBccbBqWUuE00Z8B/aDQNnDTO5rX:34PG9FBcmDVP/aDQ5vOBX
TLSH T11231449A50505F311142CA9E77B2364CA24EA6F7385FD7C4DC590EA8468DA8CF2E2F8D
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://5.182.210.174/d174b5n/an/an/a
http://5.182.210.174/5ab444n/an/an/a
http://5.182.210.174/615199n/an/an/a
http://5.182.210.174/a92b33n/an/an/a
http://5.182.210.174/9a6d02n/an/an/a
http://5.182.210.174/9bb405n/an/an/a
http://5.182.210.174/1a5a26n/an/an/a
http://5.182.210.174/ee9c60n/an/an/a
http://5.182.210.174/a921b4n/an/an/a
http://5.182.210.174/4378a7n/an/an/a
http://5.182.210.174/4b94e6n/an/an/a
http://5.182.210.174/5d0b3bn/an/an/a

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-08-28T19:12:00Z UTC
Last seen:
2026-08-29T20:13:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/5804a9c2f5d8dbdd9d49476df3cf29c43dcf425f541a09ecef3d80e571a24bdb/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/7d0e47ac-f8c3-42f7-90bb-117acb60dc61
Behavior Graph:
Download SVG
%3 guuid=11963db0-1900-0000-7764-6946570b0000 pid=2903 /usr/bin/sudo guuid=dfaddbb1-1900-0000-7764-69465c0b0000 pid=2908 /tmp/sample.bin guuid=11963db0-1900-0000-7764-6946570b0000 pid=2903->guuid=dfaddbb1-1900-0000-7764-69465c0b0000 pid=2908 execve guuid=429ef1b2-1900-0000-7764-6946600b0000 pid=2912 /usr/bin/wget net send-data guuid=dfaddbb1-1900-0000-7764-69465c0b0000 pid=2908->guuid=429ef1b2-1900-0000-7764-6946600b0000 pid=2912 execve guuid=605ee2b8-1900-0000-7764-6946710b0000 pid=2929 /usr/bin/curl net send-data write-file guuid=dfaddbb1-1900-0000-7764-69465c0b0000 pid=2908->guuid=605ee2b8-1900-0000-7764-6946710b0000 pid=2929 execve guuid=8132dfc4-1900-0000-7764-69468a0b0000 pid=2954 /usr/bin/chmod guuid=dfaddbb1-1900-0000-7764-69465c0b0000 pid=2908->guuid=8132dfc4-1900-0000-7764-69468a0b0000 pid=2954 execve guuid=8de457c5-1900-0000-7764-69468c0b0000 pid=2956 /usr/bin/bash guuid=dfaddbb1-1900-0000-7764-69465c0b0000 pid=2908->guuid=8de457c5-1900-0000-7764-69468c0b0000 pid=2956 clone guuid=948eb1c5-1900-0000-7764-69468f0b0000 pid=2959 /usr/bin/rm delete-file guuid=dfaddbb1-1900-0000-7764-69465c0b0000 pid=2908->guuid=948eb1c5-1900-0000-7764-69468f0b0000 pid=2959 execve guuid=33c915c6-1900-0000-7764-6946910b0000 pid=2961 /usr/bin/rm guuid=dfaddbb1-1900-0000-7764-69465c0b0000 pid=2908->guuid=33c915c6-1900-0000-7764-6946910b0000 pid=2961 execve guuid=5ed47dc6-1900-0000-7764-6946930b0000 pid=2963 /usr/bin/wget net send-data guuid=dfaddbb1-1900-0000-7764-69465c0b0000 pid=2908->guuid=5ed47dc6-1900-0000-7764-6946930b0000 pid=2963 execve guuid=be8dedca-1900-0000-7764-69469b0b0000 pid=2971 /usr/bin/curl net send-data write-file guuid=dfaddbb1-1900-0000-7764-69465c0b0000 pid=2908->guuid=be8dedca-1900-0000-7764-69469b0b0000 pid=2971 execve guuid=4099acd2-1900-0000-7764-6946a60b0000 pid=2982 /usr/bin/chmod guuid=dfaddbb1-1900-0000-7764-69465c0b0000 pid=2908->guuid=4099acd2-1900-0000-7764-6946a60b0000 pid=2982 execve guuid=c4302cd3-1900-0000-7764-6946a70b0000 pid=2983 /usr/bin/bash guuid=dfaddbb1-1900-0000-7764-69465c0b0000 pid=2908->guuid=c4302cd3-1900-0000-7764-6946a70b0000 pid=2983 clone guuid=198c85d3-1900-0000-7764-6946a90b0000 pid=2985 /usr/bin/rm delete-file guuid=dfaddbb1-1900-0000-7764-69465c0b0000 pid=2908->guuid=198c85d3-1900-0000-7764-6946a90b0000 pid=2985 execve guuid=fe30fdd3-1900-0000-7764-6946aa0b0000 pid=2986 /usr/bin/rm guuid=dfaddbb1-1900-0000-7764-69465c0b0000 pid=2908->guuid=fe30fdd3-1900-0000-7764-6946aa0b0000 pid=2986 execve guuid=45f96dd4-1900-0000-7764-6946ac0b0000 pid=2988 /usr/bin/wget net send-data guuid=dfaddbb1-1900-0000-7764-69465c0b0000 pid=2908->guuid=45f96dd4-1900-0000-7764-6946ac0b0000 pid=2988 execve guuid=06ade7d8-1900-0000-7764-6946af0b0000 pid=2991 /usr/bin/curl net send-data write-file guuid=dfaddbb1-1900-0000-7764-69465c0b0000 pid=2908->guuid=06ade7d8-1900-0000-7764-6946af0b0000 pid=2991 execve guuid=e647d2e3-1900-0000-7764-6946c60b0000 pid=3014 /usr/bin/chmod guuid=dfaddbb1-1900-0000-7764-69465c0b0000 pid=2908->guuid=e647d2e3-1900-0000-7764-6946c60b0000 pid=3014 execve guuid=2d9d16e4-1900-0000-7764-6946c70b0000 pid=3015 /usr/bin/bash guuid=dfaddbb1-1900-0000-7764-69465c0b0000 pid=2908->guuid=2d9d16e4-1900-0000-7764-6946c70b0000 pid=3015 clone guuid=556451e4-1900-0000-7764-6946ca0b0000 pid=3018 /usr/bin/rm delete-file guuid=dfaddbb1-1900-0000-7764-69465c0b0000 pid=2908->guuid=556451e4-1900-0000-7764-6946ca0b0000 pid=3018 execve guuid=648899e4-1900-0000-7764-6946cb0b0000 pid=3019 /usr/bin/rm guuid=dfaddbb1-1900-0000-7764-69465c0b0000 pid=2908->guuid=648899e4-1900-0000-7764-6946cb0b0000 pid=3019 execve guuid=da1ce1e4-1900-0000-7764-6946ce0b0000 pid=3022 /usr/bin/wget net send-data guuid=dfaddbb1-1900-0000-7764-69465c0b0000 pid=2908->guuid=da1ce1e4-1900-0000-7764-6946ce0b0000 pid=3022 execve guuid=8388cfe7-1900-0000-7764-6946d70b0000 pid=3031 /usr/bin/curl net send-data write-file guuid=dfaddbb1-1900-0000-7764-69465c0b0000 pid=2908->guuid=8388cfe7-1900-0000-7764-6946d70b0000 pid=3031 execve guuid=f590d1ec-1900-0000-7764-6946e50b0000 pid=3045 /usr/bin/chmod guuid=dfaddbb1-1900-0000-7764-69465c0b0000 pid=2908->guuid=f590d1ec-1900-0000-7764-6946e50b0000 pid=3045 execve guuid=c97334ed-1900-0000-7764-6946e70b0000 pid=3047 /usr/bin/bash guuid=dfaddbb1-1900-0000-7764-69465c0b0000 pid=2908->guuid=c97334ed-1900-0000-7764-6946e70b0000 pid=3047 clone guuid=5e5089ed-1900-0000-7764-6946ea0b0000 pid=3050 /usr/bin/rm delete-file guuid=dfaddbb1-1900-0000-7764-69465c0b0000 pid=2908->guuid=5e5089ed-1900-0000-7764-6946ea0b0000 pid=3050 execve guuid=b84df3ed-1900-0000-7764-6946ec0b0000 pid=3052 /usr/bin/rm guuid=dfaddbb1-1900-0000-7764-69465c0b0000 pid=2908->guuid=b84df3ed-1900-0000-7764-6946ec0b0000 pid=3052 execve guuid=82475bee-1900-0000-7764-6946f00b0000 pid=3056 /usr/bin/wget net send-data guuid=dfaddbb1-1900-0000-7764-69465c0b0000 pid=2908->guuid=82475bee-1900-0000-7764-6946f00b0000 pid=3056 execve guuid=ae85f6f0-1900-0000-7764-6946f60b0000 pid=3062 /usr/bin/curl net send-data write-file guuid=dfaddbb1-1900-0000-7764-69465c0b0000 pid=2908->guuid=ae85f6f0-1900-0000-7764-6946f60b0000 pid=3062 execve guuid=2b11aff4-1900-0000-7764-6946fd0b0000 pid=3069 /usr/bin/chmod guuid=dfaddbb1-1900-0000-7764-69465c0b0000 pid=2908->guuid=2b11aff4-1900-0000-7764-6946fd0b0000 pid=3069 execve guuid=08574df5-1900-0000-7764-6946000c0000 pid=3072 /usr/bin/bash guuid=dfaddbb1-1900-0000-7764-69465c0b0000 pid=2908->guuid=08574df5-1900-0000-7764-6946000c0000 pid=3072 clone guuid=2e7590f5-1900-0000-7764-6946030c0000 pid=3075 /usr/bin/rm delete-file guuid=dfaddbb1-1900-0000-7764-69465c0b0000 pid=2908->guuid=2e7590f5-1900-0000-7764-6946030c0000 pid=3075 execve guuid=4d73f8f5-1900-0000-7764-6946040c0000 pid=3076 /usr/bin/rm guuid=dfaddbb1-1900-0000-7764-69465c0b0000 pid=2908->guuid=4d73f8f5-1900-0000-7764-6946040c0000 pid=3076 execve guuid=86353df6-1900-0000-7764-6946050c0000 pid=3077 /usr/bin/wget net send-data guuid=dfaddbb1-1900-0000-7764-69465c0b0000 pid=2908->guuid=86353df6-1900-0000-7764-6946050c0000 pid=3077 execve guuid=b801cdf8-1900-0000-7764-69460a0c0000 pid=3082 /usr/bin/curl net send-data write-file guuid=dfaddbb1-1900-0000-7764-69465c0b0000 pid=2908->guuid=b801cdf8-1900-0000-7764-69460a0c0000 pid=3082 execve guuid=09260c04-1a00-0000-7764-6946120c0000 pid=3090 /usr/bin/chmod guuid=dfaddbb1-1900-0000-7764-69465c0b0000 pid=2908->guuid=09260c04-1a00-0000-7764-6946120c0000 pid=3090 execve guuid=58588904-1a00-0000-7764-6946130c0000 pid=3091 /usr/bin/bash guuid=dfaddbb1-1900-0000-7764-69465c0b0000 pid=2908->guuid=58588904-1a00-0000-7764-6946130c0000 pid=3091 clone guuid=882fdf04-1a00-0000-7764-6946150c0000 pid=3093 /usr/bin/rm delete-file guuid=dfaddbb1-1900-0000-7764-69465c0b0000 pid=2908->guuid=882fdf04-1a00-0000-7764-6946150c0000 pid=3093 execve guuid=829c5005-1a00-0000-7764-6946160c0000 pid=3094 /usr/bin/rm guuid=dfaddbb1-1900-0000-7764-69465c0b0000 pid=2908->guuid=829c5005-1a00-0000-7764-6946160c0000 pid=3094 execve guuid=951f9e05-1a00-0000-7764-6946180c0000 pid=3096 /usr/bin/wget net send-data guuid=dfaddbb1-1900-0000-7764-69465c0b0000 pid=2908->guuid=951f9e05-1a00-0000-7764-6946180c0000 pid=3096 execve guuid=72d7d709-1a00-0000-7764-69461e0c0000 pid=3102 /usr/bin/curl net send-data write-file guuid=dfaddbb1-1900-0000-7764-69465c0b0000 pid=2908->guuid=72d7d709-1a00-0000-7764-69461e0c0000 pid=3102 execve guuid=a9ef3410-1a00-0000-7764-69461f0c0000 pid=3103 /usr/bin/chmod guuid=dfaddbb1-1900-0000-7764-69465c0b0000 pid=2908->guuid=a9ef3410-1a00-0000-7764-69461f0c0000 pid=3103 execve guuid=5632f010-1a00-0000-7764-6946200c0000 pid=3104 /usr/bin/bash guuid=dfaddbb1-1900-0000-7764-69465c0b0000 pid=2908->guuid=5632f010-1a00-0000-7764-6946200c0000 pid=3104 clone guuid=97cc8e11-1a00-0000-7764-6946220c0000 pid=3106 /usr/bin/rm delete-file guuid=dfaddbb1-1900-0000-7764-69465c0b0000 pid=2908->guuid=97cc8e11-1a00-0000-7764-6946220c0000 pid=3106 execve guuid=3123e111-1a00-0000-7764-6946230c0000 pid=3107 /usr/bin/rm guuid=dfaddbb1-1900-0000-7764-69465c0b0000 pid=2908->guuid=3123e111-1a00-0000-7764-6946230c0000 pid=3107 execve guuid=abc42a12-1a00-0000-7764-6946240c0000 pid=3108 /usr/bin/wget net send-data guuid=dfaddbb1-1900-0000-7764-69465c0b0000 pid=2908->guuid=abc42a12-1a00-0000-7764-6946240c0000 pid=3108 execve guuid=997af615-1a00-0000-7764-6946250c0000 pid=3109 /usr/bin/curl net send-data write-file guuid=dfaddbb1-1900-0000-7764-69465c0b0000 pid=2908->guuid=997af615-1a00-0000-7764-6946250c0000 pid=3109 execve guuid=f6300a1a-1a00-0000-7764-6946260c0000 pid=3110 /usr/bin/chmod guuid=dfaddbb1-1900-0000-7764-69465c0b0000 pid=2908->guuid=f6300a1a-1a00-0000-7764-6946260c0000 pid=3110 execve guuid=9475851a-1a00-0000-7764-6946270c0000 pid=3111 /usr/bin/bash guuid=dfaddbb1-1900-0000-7764-69465c0b0000 pid=2908->guuid=9475851a-1a00-0000-7764-6946270c0000 pid=3111 clone guuid=d1d6d11a-1a00-0000-7764-6946290c0000 pid=3113 /usr/bin/rm delete-file guuid=dfaddbb1-1900-0000-7764-69465c0b0000 pid=2908->guuid=d1d6d11a-1a00-0000-7764-6946290c0000 pid=3113 execve guuid=cd802b1b-1a00-0000-7764-69462a0c0000 pid=3114 /usr/bin/rm guuid=dfaddbb1-1900-0000-7764-69465c0b0000 pid=2908->guuid=cd802b1b-1a00-0000-7764-69462a0c0000 pid=3114 execve guuid=a67ac41b-1a00-0000-7764-69462b0c0000 pid=3115 /usr/bin/wget net send-data guuid=dfaddbb1-1900-0000-7764-69465c0b0000 pid=2908->guuid=a67ac41b-1a00-0000-7764-69462b0c0000 pid=3115 execve guuid=ffdccc20-1a00-0000-7764-69462c0c0000 pid=3116 /usr/bin/curl net send-data write-file guuid=dfaddbb1-1900-0000-7764-69465c0b0000 pid=2908->guuid=ffdccc20-1a00-0000-7764-69462c0c0000 pid=3116 execve guuid=846fb427-1a00-0000-7764-69462d0c0000 pid=3117 /usr/bin/chmod guuid=dfaddbb1-1900-0000-7764-69465c0b0000 pid=2908->guuid=846fb427-1a00-0000-7764-69462d0c0000 pid=3117 execve guuid=f2e72928-1a00-0000-7764-69462e0c0000 pid=3118 /usr/bin/bash guuid=dfaddbb1-1900-0000-7764-69465c0b0000 pid=2908->guuid=f2e72928-1a00-0000-7764-69462e0c0000 pid=3118 clone guuid=48e09028-1a00-0000-7764-6946300c0000 pid=3120 /usr/bin/rm delete-file guuid=dfaddbb1-1900-0000-7764-69465c0b0000 pid=2908->guuid=48e09028-1a00-0000-7764-6946300c0000 pid=3120 execve guuid=adb52129-1a00-0000-7764-6946310c0000 pid=3121 /usr/bin/rm guuid=dfaddbb1-1900-0000-7764-69465c0b0000 pid=2908->guuid=adb52129-1a00-0000-7764-6946310c0000 pid=3121 execve guuid=ffe38f29-1a00-0000-7764-6946320c0000 pid=3122 /usr/bin/wget net send-data guuid=dfaddbb1-1900-0000-7764-69465c0b0000 pid=2908->guuid=ffe38f29-1a00-0000-7764-6946320c0000 pid=3122 execve guuid=b4d1182d-1a00-0000-7764-6946330c0000 pid=3123 /usr/bin/curl net send-data write-file guuid=dfaddbb1-1900-0000-7764-69465c0b0000 pid=2908->guuid=b4d1182d-1a00-0000-7764-6946330c0000 pid=3123 execve guuid=1c9a4833-1a00-0000-7764-6946360c0000 pid=3126 /usr/bin/chmod guuid=dfaddbb1-1900-0000-7764-69465c0b0000 pid=2908->guuid=1c9a4833-1a00-0000-7764-6946360c0000 pid=3126 execve guuid=73238433-1a00-0000-7764-6946370c0000 pid=3127 /usr/bin/bash guuid=dfaddbb1-1900-0000-7764-69465c0b0000 pid=2908->guuid=73238433-1a00-0000-7764-6946370c0000 pid=3127 clone guuid=b1f1b333-1a00-0000-7764-69463a0c0000 pid=3130 /usr/bin/rm delete-file guuid=dfaddbb1-1900-0000-7764-69465c0b0000 pid=2908->guuid=b1f1b333-1a00-0000-7764-69463a0c0000 pid=3130 execve guuid=947bee33-1a00-0000-7764-69463b0c0000 pid=3131 /usr/bin/rm guuid=dfaddbb1-1900-0000-7764-69465c0b0000 pid=2908->guuid=947bee33-1a00-0000-7764-69463b0c0000 pid=3131 execve guuid=17642534-1a00-0000-7764-69463d0c0000 pid=3133 /usr/bin/wget net send-data guuid=dfaddbb1-1900-0000-7764-69465c0b0000 pid=2908->guuid=17642534-1a00-0000-7764-69463d0c0000 pid=3133 execve guuid=b0989936-1a00-0000-7764-6946430c0000 pid=3139 /usr/bin/curl net send-data write-file guuid=dfaddbb1-1900-0000-7764-69465c0b0000 pid=2908->guuid=b0989936-1a00-0000-7764-6946430c0000 pid=3139 execve guuid=005d623c-1a00-0000-7764-69464b0c0000 pid=3147 /usr/bin/chmod guuid=dfaddbb1-1900-0000-7764-69465c0b0000 pid=2908->guuid=005d623c-1a00-0000-7764-69464b0c0000 pid=3147 execve guuid=269c533d-1a00-0000-7764-69464f0c0000 pid=3151 /usr/bin/bash guuid=dfaddbb1-1900-0000-7764-69465c0b0000 pid=2908->guuid=269c533d-1a00-0000-7764-69464f0c0000 pid=3151 clone guuid=c8a3ce3d-1a00-0000-7764-6946510c0000 pid=3153 /usr/bin/rm delete-file guuid=dfaddbb1-1900-0000-7764-69465c0b0000 pid=2908->guuid=c8a3ce3d-1a00-0000-7764-6946510c0000 pid=3153 execve guuid=a4d1693e-1a00-0000-7764-6946550c0000 pid=3157 /usr/bin/rm guuid=dfaddbb1-1900-0000-7764-69465c0b0000 pid=2908->guuid=a4d1693e-1a00-0000-7764-6946550c0000 pid=3157 execve guuid=3bebd83e-1a00-0000-7764-6946580c0000 pid=3160 /usr/bin/wget net send-data guuid=dfaddbb1-1900-0000-7764-69465c0b0000 pid=2908->guuid=3bebd83e-1a00-0000-7764-6946580c0000 pid=3160 execve guuid=55717742-1a00-0000-7764-69465d0c0000 pid=3165 /usr/bin/curl net send-data write-file guuid=dfaddbb1-1900-0000-7764-69465c0b0000 pid=2908->guuid=55717742-1a00-0000-7764-69465d0c0000 pid=3165 execve guuid=4e392d46-1a00-0000-7764-6946650c0000 pid=3173 /usr/bin/chmod guuid=dfaddbb1-1900-0000-7764-69465c0b0000 pid=2908->guuid=4e392d46-1a00-0000-7764-6946650c0000 pid=3173 execve guuid=40088946-1a00-0000-7764-6946670c0000 pid=3175 /usr/bin/bash guuid=dfaddbb1-1900-0000-7764-69465c0b0000 pid=2908->guuid=40088946-1a00-0000-7764-6946670c0000 pid=3175 clone guuid=1593da46-1a00-0000-7764-6946690c0000 pid=3177 /usr/bin/rm delete-file guuid=dfaddbb1-1900-0000-7764-69465c0b0000 pid=2908->guuid=1593da46-1a00-0000-7764-6946690c0000 pid=3177 execve guuid=2ef53247-1a00-0000-7764-69466a0c0000 pid=3178 /usr/bin/rm guuid=dfaddbb1-1900-0000-7764-69465c0b0000 pid=2908->guuid=2ef53247-1a00-0000-7764-69466a0c0000 pid=3178 execve 5b654972-c9e1-50d8-b372-2dc2a5b9ad66 5.182.210.174:80 guuid=429ef1b2-1900-0000-7764-6946600b0000 pid=2912->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=605ee2b8-1900-0000-7764-6946710b0000 pid=2929->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=7b2f75c5-1900-0000-7764-69468e0b0000 pid=2958 /usr/bin/bash guuid=8de457c5-1900-0000-7764-69468c0b0000 pid=2956->guuid=7b2f75c5-1900-0000-7764-69468e0b0000 pid=2958 clone guuid=5ed47dc6-1900-0000-7764-6946930b0000 pid=2963->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=be8dedca-1900-0000-7764-69469b0b0000 pid=2971->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=da9e50d3-1900-0000-7764-6946a80b0000 pid=2984 /usr/bin/bash guuid=c4302cd3-1900-0000-7764-6946a70b0000 pid=2983->guuid=da9e50d3-1900-0000-7764-6946a80b0000 pid=2984 clone guuid=45f96dd4-1900-0000-7764-6946ac0b0000 pid=2988->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=06ade7d8-1900-0000-7764-6946af0b0000 pid=2991->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=eb5b2be4-1900-0000-7764-6946c80b0000 pid=3016 /usr/bin/bash guuid=2d9d16e4-1900-0000-7764-6946c70b0000 pid=3015->guuid=eb5b2be4-1900-0000-7764-6946c80b0000 pid=3016 clone guuid=da1ce1e4-1900-0000-7764-6946ce0b0000 pid=3022->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=8388cfe7-1900-0000-7764-6946d70b0000 pid=3031->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=abd051ed-1900-0000-7764-6946e90b0000 pid=3049 /usr/bin/bash guuid=c97334ed-1900-0000-7764-6946e70b0000 pid=3047->guuid=abd051ed-1900-0000-7764-6946e90b0000 pid=3049 clone guuid=82475bee-1900-0000-7764-6946f00b0000 pid=3056->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=ae85f6f0-1900-0000-7764-6946f60b0000 pid=3062->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=952e6ff5-1900-0000-7764-6946020c0000 pid=3074 /usr/bin/bash guuid=08574df5-1900-0000-7764-6946000c0000 pid=3072->guuid=952e6ff5-1900-0000-7764-6946020c0000 pid=3074 clone guuid=86353df6-1900-0000-7764-6946050c0000 pid=3077->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=b801cdf8-1900-0000-7764-69460a0c0000 pid=3082->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=9797ab04-1a00-0000-7764-6946140c0000 pid=3092 /usr/bin/bash guuid=58588904-1a00-0000-7764-6946130c0000 pid=3091->guuid=9797ab04-1a00-0000-7764-6946140c0000 pid=3092 clone guuid=951f9e05-1a00-0000-7764-6946180c0000 pid=3096->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=72d7d709-1a00-0000-7764-69461e0c0000 pid=3102->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=36122911-1a00-0000-7764-6946210c0000 pid=3105 /usr/bin/bash guuid=5632f010-1a00-0000-7764-6946200c0000 pid=3104->guuid=36122911-1a00-0000-7764-6946210c0000 pid=3105 clone guuid=abc42a12-1a00-0000-7764-6946240c0000 pid=3108->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=997af615-1a00-0000-7764-6946250c0000 pid=3109->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=3f18a81a-1a00-0000-7764-6946280c0000 pid=3112 /usr/bin/bash guuid=9475851a-1a00-0000-7764-6946270c0000 pid=3111->guuid=3f18a81a-1a00-0000-7764-6946280c0000 pid=3112 clone guuid=a67ac41b-1a00-0000-7764-69462b0c0000 pid=3115->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=ffdccc20-1a00-0000-7764-69462c0c0000 pid=3116->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=1cbc4f28-1a00-0000-7764-69462f0c0000 pid=3119 /usr/bin/bash guuid=f2e72928-1a00-0000-7764-69462e0c0000 pid=3118->guuid=1cbc4f28-1a00-0000-7764-69462f0c0000 pid=3119 clone guuid=ffe38f29-1a00-0000-7764-6946320c0000 pid=3122->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=b4d1182d-1a00-0000-7764-6946330c0000 pid=3123->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=72ab9733-1a00-0000-7764-6946390c0000 pid=3129 /usr/bin/bash guuid=73238433-1a00-0000-7764-6946370c0000 pid=3127->guuid=72ab9733-1a00-0000-7764-6946390c0000 pid=3129 clone guuid=17642534-1a00-0000-7764-69463d0c0000 pid=3133->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=b0989936-1a00-0000-7764-6946430c0000 pid=3139->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=9784843d-1a00-0000-7764-6946500c0000 pid=3152 /usr/bin/bash guuid=269c533d-1a00-0000-7764-69464f0c0000 pid=3151->guuid=9784843d-1a00-0000-7764-6946500c0000 pid=3152 clone guuid=3bebd83e-1a00-0000-7764-6946580c0000 pid=3160->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=55717742-1a00-0000-7764-69465d0c0000 pid=3165->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=01bca146-1a00-0000-7764-6946680c0000 pid=3176 /usr/bin/bash guuid=40088946-1a00-0000-7764-6946670c0000 pid=3175->guuid=01bca146-1a00-0000-7764-6946680c0000 pid=3176 clone
Score:
99%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/5804a9c2f5d8dbdd9d49476df3cf29c43dcf425f541a09ecef3d80e571a24bdb
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5804a9c2f5d8dbdd9d49476df3cf29c43dcf425f541a09ecef3d80e571a24bdb/
Threat name:
Linux.Trojan.Egairtigado
Create hunting rule
Status:
Malicious
First seen:
2026-08-28 21:25:35 UTC
File Type:
Text (Shell)
AV detection:
13 of 24 (54.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lacktqxv3dn53hkji5w7htzjyq646qs7kqnat3hphwaok4ncjpnq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260828-z9r2tatdld/
Behaviour
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.11
Link:
https://yomi.yoroi.company/submissions/5804a9c2f5d8dbdd9d49476df3cf29c43dcf425f541a09ecef3d80e571a24bdb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 5804a9c2f5d8dbdd9d49476df3cf29c43dcf425f541a09ecef3d80e571a24bdb

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3897671/
  
Delivery method
Distributed via web download

Comments