🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5ab17ffaee90af78c5fb986a9b673bbd4fc8d5a7fe5e846a1333981e96a60730. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5ab17ffaee90af78c5fb986a9b673bbd4fc8d5a7fe5e846a1333981e96a60730
SHA3-384 hash: d0a7c08f543d926a8e391fce396ffe4e2228c985d4e551301268f7c68d3f97dd729fb40e87a29a0c4e57a7ee1fe7c5c2
SHA1 hash: 3d80d5d21c8dc14fd526c27e2045f44adf2c0f95
MD5 hash: 65007f119c55fea2b2af9b0c08166118
humanhash: sink-queen-robin-october
File name:ok
Download: download sample
File size:1'608 bytes
First seen:2026-09-08 05:29:48 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 12:UG6PWa6+py76peo6LQlNkECr6NkEAmwNn6N5l11bE1qlLL6LauVXc8Z6WSKHr6Ke:d2ERP6ZNElRxFAWv1ZYDBHINxcR7M29
TLSH T13731A4AE045406321253DA8E73B3754CB19DA6F7289FD7E4D84C0E9982C968CF271F5A
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://5.182.210.174/868111n/an/an/a
http://5.182.210.174/4970d5n/an/an/a
http://5.182.210.174/cdd0f0n/an/an/a
http://5.182.210.174/0b0c5an/an/an/a
http://5.182.210.174/9d322an/an/an/a
http://5.182.210.174/956668n/an/an/a
http://5.182.210.174/48987dn/an/an/a
http://5.182.210.174/749521n/an/an/a
http://5.182.210.174/af0b2fn/an/an/a
http://5.182.210.174/4b262cn/an/an/a
http://5.182.210.174/69e1a8n/an/an/a
http://5.182.210.174/c497c7n/an/an/a

Intelligence

File Origin
# of uploads :
1
# of downloads :
42
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive mirai
Link:
https://www.filescan.io/uploads/6a9f9d76a51c5f914d026be6/reports/3712b822-b3ec-437f-abfb-7dad365c5808/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-09-08T02:21:00Z UTC
Last seen:
2026-09-09T18:31:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/5ab17ffaee90af78c5fb986a9b673bbd4fc8d5a7fe5e846a1333981e96a60730/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/db2501d0-6745-4e34-8a47-a3b81b7bbd75
Behavior Graph:
Download SVG
%3 guuid=1bf05c94-3a00-0000-ef3c-c4bc3e030000 pid=830 /usr/bin/sudo guuid=49e1dd96-3a00-0000-ef3c-c4bc3f030000 pid=831 /tmp/sample.bin guuid=1bf05c94-3a00-0000-ef3c-c4bc3e030000 pid=830->guuid=49e1dd96-3a00-0000-ef3c-c4bc3f030000 pid=831 execve guuid=34fa3b97-3a00-0000-ef3c-c4bc40030000 pid=832 /usr/bin/wget net send-data guuid=49e1dd96-3a00-0000-ef3c-c4bc3f030000 pid=831->guuid=34fa3b97-3a00-0000-ef3c-c4bc40030000 pid=832 execve guuid=da2dee6c-3e00-0000-ef3c-c4bc41030000 pid=833 /usr/bin/curl net send-data write-file guuid=49e1dd96-3a00-0000-ef3c-c4bc3f030000 pid=831->guuid=da2dee6c-3e00-0000-ef3c-c4bc41030000 pid=833 execve guuid=2be093ab-4300-0000-ef3c-c4bc42030000 pid=834 /usr/bin/chmod guuid=49e1dd96-3a00-0000-ef3c-c4bc3f030000 pid=831->guuid=2be093ab-4300-0000-ef3c-c4bc42030000 pid=834 execve guuid=415519ac-4300-0000-ef3c-c4bc43030000 pid=835 /usr/bin/bash guuid=49e1dd96-3a00-0000-ef3c-c4bc3f030000 pid=831->guuid=415519ac-4300-0000-ef3c-c4bc43030000 pid=835 clone guuid=2f3b86ac-4300-0000-ef3c-c4bc45030000 pid=837 /usr/bin/rm delete-file guuid=49e1dd96-3a00-0000-ef3c-c4bc3f030000 pid=831->guuid=2f3b86ac-4300-0000-ef3c-c4bc45030000 pid=837 execve guuid=7a010aad-4300-0000-ef3c-c4bc46030000 pid=838 /usr/bin/rm guuid=49e1dd96-3a00-0000-ef3c-c4bc3f030000 pid=831->guuid=7a010aad-4300-0000-ef3c-c4bc46030000 pid=838 execve guuid=f30474ad-4300-0000-ef3c-c4bc47030000 pid=839 /usr/bin/wget net send-data guuid=49e1dd96-3a00-0000-ef3c-c4bc3f030000 pid=831->guuid=f30474ad-4300-0000-ef3c-c4bc47030000 pid=839 execve guuid=ede2e8b0-4300-0000-ef3c-c4bc48030000 pid=840 /usr/bin/curl net send-data write-file guuid=49e1dd96-3a00-0000-ef3c-c4bc3f030000 pid=831->guuid=ede2e8b0-4300-0000-ef3c-c4bc48030000 pid=840 execve guuid=6cfc4bb4-4300-0000-ef3c-c4bc49030000 pid=841 /usr/bin/chmod guuid=49e1dd96-3a00-0000-ef3c-c4bc3f030000 pid=831->guuid=6cfc4bb4-4300-0000-ef3c-c4bc49030000 pid=841 execve guuid=ba35d9b4-4300-0000-ef3c-c4bc4a030000 pid=842 /usr/bin/bash guuid=49e1dd96-3a00-0000-ef3c-c4bc3f030000 pid=831->guuid=ba35d9b4-4300-0000-ef3c-c4bc4a030000 pid=842 clone guuid=abf04bb5-4300-0000-ef3c-c4bc4c030000 pid=844 /usr/bin/rm delete-file guuid=49e1dd96-3a00-0000-ef3c-c4bc3f030000 pid=831->guuid=abf04bb5-4300-0000-ef3c-c4bc4c030000 pid=844 execve guuid=24cfe0b5-4300-0000-ef3c-c4bc4d030000 pid=845 /usr/bin/rm guuid=49e1dd96-3a00-0000-ef3c-c4bc3f030000 pid=831->guuid=24cfe0b5-4300-0000-ef3c-c4bc4d030000 pid=845 execve guuid=531533b6-4300-0000-ef3c-c4bc4e030000 pid=846 /usr/bin/wget net send-data guuid=49e1dd96-3a00-0000-ef3c-c4bc3f030000 pid=831->guuid=531533b6-4300-0000-ef3c-c4bc4e030000 pid=846 execve guuid=20c5bab9-4300-0000-ef3c-c4bc4f030000 pid=847 /usr/bin/curl net send-data write-file guuid=49e1dd96-3a00-0000-ef3c-c4bc3f030000 pid=831->guuid=20c5bab9-4300-0000-ef3c-c4bc4f030000 pid=847 execve guuid=435421bd-4300-0000-ef3c-c4bc50030000 pid=848 /usr/bin/chmod guuid=49e1dd96-3a00-0000-ef3c-c4bc3f030000 pid=831->guuid=435421bd-4300-0000-ef3c-c4bc50030000 pid=848 execve guuid=992677bd-4300-0000-ef3c-c4bc51030000 pid=849 /usr/bin/bash guuid=49e1dd96-3a00-0000-ef3c-c4bc3f030000 pid=831->guuid=992677bd-4300-0000-ef3c-c4bc51030000 pid=849 clone guuid=55d4ecbd-4300-0000-ef3c-c4bc53030000 pid=851 /usr/bin/rm delete-file guuid=49e1dd96-3a00-0000-ef3c-c4bc3f030000 pid=831->guuid=55d4ecbd-4300-0000-ef3c-c4bc53030000 pid=851 execve guuid=875e37be-4300-0000-ef3c-c4bc54030000 pid=852 /usr/bin/rm guuid=49e1dd96-3a00-0000-ef3c-c4bc3f030000 pid=831->guuid=875e37be-4300-0000-ef3c-c4bc54030000 pid=852 execve guuid=85a2c1be-4300-0000-ef3c-c4bc55030000 pid=853 /usr/bin/wget net send-data guuid=49e1dd96-3a00-0000-ef3c-c4bc3f030000 pid=831->guuid=85a2c1be-4300-0000-ef3c-c4bc55030000 pid=853 execve guuid=d3023bc1-4300-0000-ef3c-c4bc56030000 pid=854 /usr/bin/curl net send-data write-file guuid=49e1dd96-3a00-0000-ef3c-c4bc3f030000 pid=831->guuid=d3023bc1-4300-0000-ef3c-c4bc56030000 pid=854 execve guuid=c27608c6-4300-0000-ef3c-c4bc57030000 pid=855 /usr/bin/chmod guuid=49e1dd96-3a00-0000-ef3c-c4bc3f030000 pid=831->guuid=c27608c6-4300-0000-ef3c-c4bc57030000 pid=855 execve guuid=bede59c6-4300-0000-ef3c-c4bc58030000 pid=856 /usr/bin/bash guuid=49e1dd96-3a00-0000-ef3c-c4bc3f030000 pid=831->guuid=bede59c6-4300-0000-ef3c-c4bc58030000 pid=856 clone guuid=3c87c1c6-4300-0000-ef3c-c4bc5a030000 pid=858 /usr/bin/rm delete-file guuid=49e1dd96-3a00-0000-ef3c-c4bc3f030000 pid=831->guuid=3c87c1c6-4300-0000-ef3c-c4bc5a030000 pid=858 execve guuid=82aa47c7-4300-0000-ef3c-c4bc5b030000 pid=859 /usr/bin/rm guuid=49e1dd96-3a00-0000-ef3c-c4bc3f030000 pid=831->guuid=82aa47c7-4300-0000-ef3c-c4bc5b030000 pid=859 execve guuid=d5af8dc7-4300-0000-ef3c-c4bc5c030000 pid=860 /usr/bin/wget net send-data guuid=49e1dd96-3a00-0000-ef3c-c4bc3f030000 pid=831->guuid=d5af8dc7-4300-0000-ef3c-c4bc5c030000 pid=860 execve guuid=f3f0daca-4300-0000-ef3c-c4bc5d030000 pid=861 /usr/bin/curl net send-data write-file guuid=49e1dd96-3a00-0000-ef3c-c4bc3f030000 pid=831->guuid=f3f0daca-4300-0000-ef3c-c4bc5d030000 pid=861 execve guuid=bbf042ce-4300-0000-ef3c-c4bc5e030000 pid=862 /usr/bin/chmod guuid=49e1dd96-3a00-0000-ef3c-c4bc3f030000 pid=831->guuid=bbf042ce-4300-0000-ef3c-c4bc5e030000 pid=862 execve guuid=2db6c5ce-4300-0000-ef3c-c4bc5f030000 pid=863 /usr/bin/bash guuid=49e1dd96-3a00-0000-ef3c-c4bc3f030000 pid=831->guuid=2db6c5ce-4300-0000-ef3c-c4bc5f030000 pid=863 clone guuid=887915cf-4300-0000-ef3c-c4bc61030000 pid=865 /usr/bin/rm delete-file guuid=49e1dd96-3a00-0000-ef3c-c4bc3f030000 pid=831->guuid=887915cf-4300-0000-ef3c-c4bc61030000 pid=865 execve guuid=4f8393cf-4300-0000-ef3c-c4bc62030000 pid=866 /usr/bin/rm guuid=49e1dd96-3a00-0000-ef3c-c4bc3f030000 pid=831->guuid=4f8393cf-4300-0000-ef3c-c4bc62030000 pid=866 execve guuid=2c66dbcf-4300-0000-ef3c-c4bc63030000 pid=867 /usr/bin/wget net send-data guuid=49e1dd96-3a00-0000-ef3c-c4bc3f030000 pid=831->guuid=2c66dbcf-4300-0000-ef3c-c4bc63030000 pid=867 execve guuid=2fdc08d3-4300-0000-ef3c-c4bc64030000 pid=868 /usr/bin/curl net send-data write-file guuid=49e1dd96-3a00-0000-ef3c-c4bc3f030000 pid=831->guuid=2fdc08d3-4300-0000-ef3c-c4bc64030000 pid=868 execve guuid=9d9a8bd6-4300-0000-ef3c-c4bc65030000 pid=869 /usr/bin/chmod guuid=49e1dd96-3a00-0000-ef3c-c4bc3f030000 pid=831->guuid=9d9a8bd6-4300-0000-ef3c-c4bc65030000 pid=869 execve guuid=2055ecd6-4300-0000-ef3c-c4bc66030000 pid=870 /usr/bin/bash guuid=49e1dd96-3a00-0000-ef3c-c4bc3f030000 pid=831->guuid=2055ecd6-4300-0000-ef3c-c4bc66030000 pid=870 clone guuid=49b230d7-4300-0000-ef3c-c4bc68030000 pid=872 /usr/bin/rm delete-file guuid=49e1dd96-3a00-0000-ef3c-c4bc3f030000 pid=831->guuid=49b230d7-4300-0000-ef3c-c4bc68030000 pid=872 execve guuid=dc6098d7-4300-0000-ef3c-c4bc69030000 pid=873 /usr/bin/rm guuid=49e1dd96-3a00-0000-ef3c-c4bc3f030000 pid=831->guuid=dc6098d7-4300-0000-ef3c-c4bc69030000 pid=873 execve guuid=f9e6e3d7-4300-0000-ef3c-c4bc6a030000 pid=874 /usr/bin/wget net send-data guuid=49e1dd96-3a00-0000-ef3c-c4bc3f030000 pid=831->guuid=f9e6e3d7-4300-0000-ef3c-c4bc6a030000 pid=874 execve guuid=0221d0db-4300-0000-ef3c-c4bc6b030000 pid=875 /usr/bin/curl net send-data write-file guuid=49e1dd96-3a00-0000-ef3c-c4bc3f030000 pid=831->guuid=0221d0db-4300-0000-ef3c-c4bc6b030000 pid=875 execve guuid=b07eef68-4400-0000-ef3c-c4bc6c030000 pid=876 /usr/bin/chmod guuid=49e1dd96-3a00-0000-ef3c-c4bc3f030000 pid=831->guuid=b07eef68-4400-0000-ef3c-c4bc6c030000 pid=876 execve guuid=f3e28069-4400-0000-ef3c-c4bc6d030000 pid=877 /usr/bin/bash guuid=49e1dd96-3a00-0000-ef3c-c4bc3f030000 pid=831->guuid=f3e28069-4400-0000-ef3c-c4bc6d030000 pid=877 clone guuid=e7e0df69-4400-0000-ef3c-c4bc6f030000 pid=879 /usr/bin/rm delete-file guuid=49e1dd96-3a00-0000-ef3c-c4bc3f030000 pid=831->guuid=e7e0df69-4400-0000-ef3c-c4bc6f030000 pid=879 execve guuid=5083536a-4400-0000-ef3c-c4bc70030000 pid=880 /usr/bin/rm guuid=49e1dd96-3a00-0000-ef3c-c4bc3f030000 pid=831->guuid=5083536a-4400-0000-ef3c-c4bc70030000 pid=880 execve guuid=f9e5b16a-4400-0000-ef3c-c4bc71030000 pid=881 /usr/bin/wget net send-data guuid=49e1dd96-3a00-0000-ef3c-c4bc3f030000 pid=831->guuid=f9e5b16a-4400-0000-ef3c-c4bc71030000 pid=881 execve guuid=2e2e5d6d-4400-0000-ef3c-c4bc72030000 pid=882 /usr/bin/curl net send-data write-file guuid=49e1dd96-3a00-0000-ef3c-c4bc3f030000 pid=831->guuid=2e2e5d6d-4400-0000-ef3c-c4bc72030000 pid=882 execve guuid=99958870-4400-0000-ef3c-c4bc73030000 pid=883 /usr/bin/chmod guuid=49e1dd96-3a00-0000-ef3c-c4bc3f030000 pid=831->guuid=99958870-4400-0000-ef3c-c4bc73030000 pid=883 execve guuid=314fce70-4400-0000-ef3c-c4bc74030000 pid=884 /usr/bin/bash guuid=49e1dd96-3a00-0000-ef3c-c4bc3f030000 pid=831->guuid=314fce70-4400-0000-ef3c-c4bc74030000 pid=884 clone guuid=80bc0971-4400-0000-ef3c-c4bc76030000 pid=886 /usr/bin/rm delete-file guuid=49e1dd96-3a00-0000-ef3c-c4bc3f030000 pid=831->guuid=80bc0971-4400-0000-ef3c-c4bc76030000 pid=886 execve guuid=a3c29571-4400-0000-ef3c-c4bc77030000 pid=887 /usr/bin/rm guuid=49e1dd96-3a00-0000-ef3c-c4bc3f030000 pid=831->guuid=a3c29571-4400-0000-ef3c-c4bc77030000 pid=887 execve guuid=9d10e671-4400-0000-ef3c-c4bc78030000 pid=888 /usr/bin/wget net send-data guuid=49e1dd96-3a00-0000-ef3c-c4bc3f030000 pid=831->guuid=9d10e671-4400-0000-ef3c-c4bc78030000 pid=888 execve guuid=f9445075-4400-0000-ef3c-c4bc79030000 pid=889 /usr/bin/curl net send-data write-file guuid=49e1dd96-3a00-0000-ef3c-c4bc3f030000 pid=831->guuid=f9445075-4400-0000-ef3c-c4bc79030000 pid=889 execve guuid=ab1d8678-4400-0000-ef3c-c4bc7a030000 pid=890 /usr/bin/chmod guuid=49e1dd96-3a00-0000-ef3c-c4bc3f030000 pid=831->guuid=ab1d8678-4400-0000-ef3c-c4bc7a030000 pid=890 execve guuid=d511d478-4400-0000-ef3c-c4bc7b030000 pid=891 /usr/bin/bash guuid=49e1dd96-3a00-0000-ef3c-c4bc3f030000 pid=831->guuid=d511d478-4400-0000-ef3c-c4bc7b030000 pid=891 clone guuid=c4592979-4400-0000-ef3c-c4bc7d030000 pid=893 /usr/bin/rm delete-file guuid=49e1dd96-3a00-0000-ef3c-c4bc3f030000 pid=831->guuid=c4592979-4400-0000-ef3c-c4bc7d030000 pid=893 execve guuid=fbd97b79-4400-0000-ef3c-c4bc7e030000 pid=894 /usr/bin/rm guuid=49e1dd96-3a00-0000-ef3c-c4bc3f030000 pid=831->guuid=fbd97b79-4400-0000-ef3c-c4bc7e030000 pid=894 execve guuid=8140f279-4400-0000-ef3c-c4bc7f030000 pid=895 /usr/bin/wget net send-data guuid=49e1dd96-3a00-0000-ef3c-c4bc3f030000 pid=831->guuid=8140f279-4400-0000-ef3c-c4bc7f030000 pid=895 execve guuid=dddc507c-4400-0000-ef3c-c4bc80030000 pid=896 /usr/bin/curl net send-data write-file guuid=49e1dd96-3a00-0000-ef3c-c4bc3f030000 pid=831->guuid=dddc507c-4400-0000-ef3c-c4bc80030000 pid=896 execve guuid=55943d80-4400-0000-ef3c-c4bc81030000 pid=897 /usr/bin/chmod guuid=49e1dd96-3a00-0000-ef3c-c4bc3f030000 pid=831->guuid=55943d80-4400-0000-ef3c-c4bc81030000 pid=897 execve guuid=1e07a380-4400-0000-ef3c-c4bc82030000 pid=898 /usr/bin/bash guuid=49e1dd96-3a00-0000-ef3c-c4bc3f030000 pid=831->guuid=1e07a380-4400-0000-ef3c-c4bc82030000 pid=898 clone guuid=8fe7f380-4400-0000-ef3c-c4bc84030000 pid=900 /usr/bin/rm delete-file guuid=49e1dd96-3a00-0000-ef3c-c4bc3f030000 pid=831->guuid=8fe7f380-4400-0000-ef3c-c4bc84030000 pid=900 execve guuid=b7d64781-4400-0000-ef3c-c4bc85030000 pid=901 /usr/bin/rm guuid=49e1dd96-3a00-0000-ef3c-c4bc3f030000 pid=831->guuid=b7d64781-4400-0000-ef3c-c4bc85030000 pid=901 execve guuid=c7608f81-4400-0000-ef3c-c4bc86030000 pid=902 /usr/bin/wget net send-data guuid=49e1dd96-3a00-0000-ef3c-c4bc3f030000 pid=831->guuid=c7608f81-4400-0000-ef3c-c4bc86030000 pid=902 execve guuid=284b2784-4400-0000-ef3c-c4bc87030000 pid=903 /usr/bin/curl net send-data write-file guuid=49e1dd96-3a00-0000-ef3c-c4bc3f030000 pid=831->guuid=284b2784-4400-0000-ef3c-c4bc87030000 pid=903 execve guuid=f44a4f87-4400-0000-ef3c-c4bc88030000 pid=904 /usr/bin/chmod guuid=49e1dd96-3a00-0000-ef3c-c4bc3f030000 pid=831->guuid=f44a4f87-4400-0000-ef3c-c4bc88030000 pid=904 execve guuid=9b1ba987-4400-0000-ef3c-c4bc89030000 pid=905 /usr/bin/bash guuid=49e1dd96-3a00-0000-ef3c-c4bc3f030000 pid=831->guuid=9b1ba987-4400-0000-ef3c-c4bc89030000 pid=905 clone guuid=fd1dea87-4400-0000-ef3c-c4bc8b030000 pid=907 /usr/bin/rm delete-file guuid=49e1dd96-3a00-0000-ef3c-c4bc3f030000 pid=831->guuid=fd1dea87-4400-0000-ef3c-c4bc8b030000 pid=907 execve guuid=369a4388-4400-0000-ef3c-c4bc8c030000 pid=908 /usr/bin/rm guuid=49e1dd96-3a00-0000-ef3c-c4bc3f030000 pid=831->guuid=369a4388-4400-0000-ef3c-c4bc8c030000 pid=908 execve guuid=b4429288-4400-0000-ef3c-c4bc8d030000 pid=909 /usr/bin/wget net send-data guuid=49e1dd96-3a00-0000-ef3c-c4bc3f030000 pid=831->guuid=b4429288-4400-0000-ef3c-c4bc8d030000 pid=909 execve guuid=593ae08a-4400-0000-ef3c-c4bc8e030000 pid=910 /usr/bin/curl net send-data write-file guuid=49e1dd96-3a00-0000-ef3c-c4bc3f030000 pid=831->guuid=593ae08a-4400-0000-ef3c-c4bc8e030000 pid=910 execve guuid=e6a69b8e-4400-0000-ef3c-c4bc8f030000 pid=911 /usr/bin/chmod guuid=49e1dd96-3a00-0000-ef3c-c4bc3f030000 pid=831->guuid=e6a69b8e-4400-0000-ef3c-c4bc8f030000 pid=911 execve guuid=8a46e38e-4400-0000-ef3c-c4bc90030000 pid=912 /usr/bin/bash guuid=49e1dd96-3a00-0000-ef3c-c4bc3f030000 pid=831->guuid=8a46e38e-4400-0000-ef3c-c4bc90030000 pid=912 clone guuid=d0452d8f-4400-0000-ef3c-c4bc92030000 pid=914 /usr/bin/rm delete-file guuid=49e1dd96-3a00-0000-ef3c-c4bc3f030000 pid=831->guuid=d0452d8f-4400-0000-ef3c-c4bc92030000 pid=914 execve guuid=f88b798f-4400-0000-ef3c-c4bc93030000 pid=915 /usr/bin/rm guuid=49e1dd96-3a00-0000-ef3c-c4bc3f030000 pid=831->guuid=f88b798f-4400-0000-ef3c-c4bc93030000 pid=915 execve 5b654972-c9e1-50d8-b372-2dc2a5b9ad66 5.182.210.174:80 guuid=34fa3b97-3a00-0000-ef3c-c4bc40030000 pid=832->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=da2dee6c-3e00-0000-ef3c-c4bc41030000 pid=833->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=4d134aac-4300-0000-ef3c-c4bc44030000 pid=836 /usr/bin/bash guuid=415519ac-4300-0000-ef3c-c4bc43030000 pid=835->guuid=4d134aac-4300-0000-ef3c-c4bc44030000 pid=836 clone guuid=f30474ad-4300-0000-ef3c-c4bc47030000 pid=839->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=ede2e8b0-4300-0000-ef3c-c4bc48030000 pid=840->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=676d0db5-4300-0000-ef3c-c4bc4b030000 pid=843 /usr/bin/bash guuid=ba35d9b4-4300-0000-ef3c-c4bc4a030000 pid=842->guuid=676d0db5-4300-0000-ef3c-c4bc4b030000 pid=843 clone guuid=531533b6-4300-0000-ef3c-c4bc4e030000 pid=846->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=20c5bab9-4300-0000-ef3c-c4bc4f030000 pid=847->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=91ababbd-4300-0000-ef3c-c4bc52030000 pid=850 /usr/bin/bash guuid=992677bd-4300-0000-ef3c-c4bc51030000 pid=849->guuid=91ababbd-4300-0000-ef3c-c4bc52030000 pid=850 clone guuid=85a2c1be-4300-0000-ef3c-c4bc55030000 pid=853->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=d3023bc1-4300-0000-ef3c-c4bc56030000 pid=854->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=d41589c6-4300-0000-ef3c-c4bc59030000 pid=857 /usr/bin/bash guuid=bede59c6-4300-0000-ef3c-c4bc58030000 pid=856->guuid=d41589c6-4300-0000-ef3c-c4bc59030000 pid=857 clone guuid=d5af8dc7-4300-0000-ef3c-c4bc5c030000 pid=860->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=f3f0daca-4300-0000-ef3c-c4bc5d030000 pid=861->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=bd29e1ce-4300-0000-ef3c-c4bc60030000 pid=864 /usr/bin/bash guuid=2db6c5ce-4300-0000-ef3c-c4bc5f030000 pid=863->guuid=bd29e1ce-4300-0000-ef3c-c4bc60030000 pid=864 clone guuid=2c66dbcf-4300-0000-ef3c-c4bc63030000 pid=867->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=2fdc08d3-4300-0000-ef3c-c4bc64030000 pid=868->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=86f703d7-4300-0000-ef3c-c4bc67030000 pid=871 /usr/bin/bash guuid=2055ecd6-4300-0000-ef3c-c4bc66030000 pid=870->guuid=86f703d7-4300-0000-ef3c-c4bc67030000 pid=871 clone guuid=f9e6e3d7-4300-0000-ef3c-c4bc6a030000 pid=874->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=0221d0db-4300-0000-ef3c-c4bc6b030000 pid=875->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=5713a969-4400-0000-ef3c-c4bc6e030000 pid=878 /usr/bin/bash guuid=f3e28069-4400-0000-ef3c-c4bc6d030000 pid=877->guuid=5713a969-4400-0000-ef3c-c4bc6e030000 pid=878 clone guuid=f9e5b16a-4400-0000-ef3c-c4bc71030000 pid=881->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=2e2e5d6d-4400-0000-ef3c-c4bc72030000 pid=882->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=a170e570-4400-0000-ef3c-c4bc75030000 pid=885 /usr/bin/bash guuid=314fce70-4400-0000-ef3c-c4bc74030000 pid=884->guuid=a170e570-4400-0000-ef3c-c4bc75030000 pid=885 clone guuid=9d10e671-4400-0000-ef3c-c4bc78030000 pid=888->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=f9445075-4400-0000-ef3c-c4bc79030000 pid=889->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=7eecf078-4400-0000-ef3c-c4bc7c030000 pid=892 /usr/bin/bash guuid=d511d478-4400-0000-ef3c-c4bc7b030000 pid=891->guuid=7eecf078-4400-0000-ef3c-c4bc7c030000 pid=892 clone guuid=8140f279-4400-0000-ef3c-c4bc7f030000 pid=895->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=dddc507c-4400-0000-ef3c-c4bc80030000 pid=896->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=a8b6c280-4400-0000-ef3c-c4bc83030000 pid=899 /usr/bin/bash guuid=1e07a380-4400-0000-ef3c-c4bc82030000 pid=898->guuid=a8b6c280-4400-0000-ef3c-c4bc83030000 pid=899 clone guuid=c7608f81-4400-0000-ef3c-c4bc86030000 pid=902->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=284b2784-4400-0000-ef3c-c4bc87030000 pid=903->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=d601c287-4400-0000-ef3c-c4bc8a030000 pid=906 /usr/bin/bash guuid=9b1ba987-4400-0000-ef3c-c4bc89030000 pid=905->guuid=d601c287-4400-0000-ef3c-c4bc8a030000 pid=906 clone guuid=b4429288-4400-0000-ef3c-c4bc8d030000 pid=909->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=593ae08a-4400-0000-ef3c-c4bc8e030000 pid=910->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=adbb058f-4400-0000-ef3c-c4bc91030000 pid=913 /usr/bin/bash guuid=8a46e38e-4400-0000-ef3c-c4bc90030000 pid=912->guuid=adbb058f-4400-0000-ef3c-c4bc91030000 pid=913 clone
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/5ab17ffaee90af78c5fb986a9b673bbd4fc8d5a7fe5e846a1333981e96a60730
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5ab17ffaee90af78c5fb986a9b673bbd4fc8d5a7fe5e846a1333981e96a60730/
Threat name:
Linux.Trojan.Multiverze
Create hunting rule
Status:
Malicious
First seen:
2026-09-08 05:30:45 UTC
File Type:
Text (Shell)
AV detection:
18 of 38 (47.37%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lkyx76xoscxxrrp3tbvjwzz3xvh4rvnh7zpii2qtgomb5fvga4ya._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260908-f8dy1ssdke/
Behaviour
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.11
Link:
https://yomi.yoroi.company/submissions/5ab17ffaee90af78c5fb986a9b673bbd4fc8d5a7fe5e846a1333981e96a60730

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 5ab17ffaee90af78c5fb986a9b673bbd4fc8d5a7fe5e846a1333981e96a60730

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3897671/
  
Delivery method
Distributed via web download

Comments