MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5d477992a3d765e3652ac0064d6cd1ad9a540c5df2f5d3a28276c079fb026d12. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5d477992a3d765e3652ac0064d6cd1ad9a540c5df2f5d3a28276c079fb026d12
SHA3-384 hash: afc6235313ef648b011831dcd64f51a1fe9504cd88adc4551a22eb846c6b8f387b26b2c20b8a90f1a82b12e3dfa2dee1
SHA1 hash: f3202076e18bf1361122aa314b204b8e5bffb054
MD5 hash: 7c5a28b5e3ca9ec1dd2c62aa000e599b
humanhash: alaska-steak-utah-snake
File name:ok
Download: download sample
File size:1'608 bytes
First seen:2026-08-20 09:37:47 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 12:U+6EqWNGQ6NGywI6wfgLq6VFkccNZ6RxDNWVx6NWV5nxtBtzdi6dsMcTI7x6I7HX:+gAfg1k2MtOMcOEWJk2g6JMI6YrpB
TLSH T1DD3164CE54605A311503CA8E72A3764972CEA9EB2D9FC7E4D9180FAD824C3CDF1D6B09
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://5.182.210.174/b3eb09n/an/aua-wget
http://5.182.210.174/9c9685n/an/aua-wget
http://5.182.210.174/026141n/an/aua-wget
http://5.182.210.174/3eafe3n/an/aua-wget
http://5.182.210.174/c4a84fn/an/aua-wget
http://5.182.210.174/939936n/an/aua-wget
http://5.182.210.174/fc2db6n/an/aua-wget
http://5.182.210.174/6a40aen/an/aua-wget
http://5.182.210.174/f287aan/an/aua-wget
http://5.182.210.174/9a3160n/an/aua-wget
http://5.182.210.174/ad61ecn/an/aua-wget
http://5.182.210.174/b97872n/an/aua-wget

Intelligence

File Origin
# of uploads :
1
# of downloads :
43
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive mirai
Link:
https://www.filescan.io/uploads/6a86cb09d58adbb2e6c36ae1/reports/ed15a978-2acd-4b14-bb58-c5781078a234/overview
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/730ca807-750a-42a9-a102-b3ede9bbaa84
Behavior Graph:
Download SVG
%3 guuid=789e955c-1900-0000-34d9-10a16f0d0000 pid=3439 /usr/bin/sudo guuid=927a535e-1900-0000-34d9-10a1750d0000 pid=3445 /tmp/sample.bin guuid=789e955c-1900-0000-34d9-10a16f0d0000 pid=3439->guuid=927a535e-1900-0000-34d9-10a1750d0000 pid=3445 execve guuid=9da9af5e-1900-0000-34d9-10a1770d0000 pid=3447 /usr/bin/wget net send-data guuid=927a535e-1900-0000-34d9-10a1750d0000 pid=3445->guuid=9da9af5e-1900-0000-34d9-10a1770d0000 pid=3447 execve guuid=9cb50a64-1900-0000-34d9-10a1860d0000 pid=3462 /usr/bin/curl net send-data write-file guuid=927a535e-1900-0000-34d9-10a1750d0000 pid=3445->guuid=9cb50a64-1900-0000-34d9-10a1860d0000 pid=3462 execve guuid=bb55db6c-1900-0000-34d9-10a19d0d0000 pid=3485 /usr/bin/chmod guuid=927a535e-1900-0000-34d9-10a1750d0000 pid=3445->guuid=bb55db6c-1900-0000-34d9-10a19d0d0000 pid=3485 execve guuid=6fa81f6d-1900-0000-34d9-10a19f0d0000 pid=3487 /usr/bin/bash guuid=927a535e-1900-0000-34d9-10a1750d0000 pid=3445->guuid=6fa81f6d-1900-0000-34d9-10a19f0d0000 pid=3487 clone guuid=e5ab6f6d-1900-0000-34d9-10a1a20d0000 pid=3490 /usr/bin/rm delete-file guuid=927a535e-1900-0000-34d9-10a1750d0000 pid=3445->guuid=e5ab6f6d-1900-0000-34d9-10a1a20d0000 pid=3490 execve guuid=7a6bb06d-1900-0000-34d9-10a1a50d0000 pid=3493 /usr/bin/rm guuid=927a535e-1900-0000-34d9-10a1750d0000 pid=3445->guuid=7a6bb06d-1900-0000-34d9-10a1a50d0000 pid=3493 execve guuid=2fcfed6d-1900-0000-34d9-10a1a60d0000 pid=3494 /usr/bin/wget net send-data guuid=927a535e-1900-0000-34d9-10a1750d0000 pid=3445->guuid=2fcfed6d-1900-0000-34d9-10a1a60d0000 pid=3494 execve guuid=16ce5270-1900-0000-34d9-10a1af0d0000 pid=3503 /usr/bin/curl net send-data write-file guuid=927a535e-1900-0000-34d9-10a1750d0000 pid=3445->guuid=16ce5270-1900-0000-34d9-10a1af0d0000 pid=3503 execve guuid=78410677-1900-0000-34d9-10a1c40d0000 pid=3524 /usr/bin/chmod guuid=927a535e-1900-0000-34d9-10a1750d0000 pid=3445->guuid=78410677-1900-0000-34d9-10a1c40d0000 pid=3524 execve guuid=da146e77-1900-0000-34d9-10a1c50d0000 pid=3525 /usr/bin/bash guuid=927a535e-1900-0000-34d9-10a1750d0000 pid=3445->guuid=da146e77-1900-0000-34d9-10a1c50d0000 pid=3525 clone guuid=d43cb677-1900-0000-34d9-10a1c70d0000 pid=3527 /usr/bin/rm delete-file guuid=927a535e-1900-0000-34d9-10a1750d0000 pid=3445->guuid=d43cb677-1900-0000-34d9-10a1c70d0000 pid=3527 execve guuid=9caf0e78-1900-0000-34d9-10a1cb0d0000 pid=3531 /usr/bin/rm guuid=927a535e-1900-0000-34d9-10a1750d0000 pid=3445->guuid=9caf0e78-1900-0000-34d9-10a1cb0d0000 pid=3531 execve guuid=524d5f78-1900-0000-34d9-10a1cd0d0000 pid=3533 /usr/bin/wget net send-data guuid=927a535e-1900-0000-34d9-10a1750d0000 pid=3445->guuid=524d5f78-1900-0000-34d9-10a1cd0d0000 pid=3533 execve guuid=6c40d27a-1900-0000-34d9-10a1d80d0000 pid=3544 /usr/bin/curl net send-data write-file guuid=927a535e-1900-0000-34d9-10a1750d0000 pid=3445->guuid=6c40d27a-1900-0000-34d9-10a1d80d0000 pid=3544 execve guuid=0708cc7e-1900-0000-34d9-10a1e50d0000 pid=3557 /usr/bin/chmod guuid=927a535e-1900-0000-34d9-10a1750d0000 pid=3445->guuid=0708cc7e-1900-0000-34d9-10a1e50d0000 pid=3557 execve guuid=dfe7467f-1900-0000-34d9-10a1e60d0000 pid=3558 /usr/bin/bash guuid=927a535e-1900-0000-34d9-10a1750d0000 pid=3445->guuid=dfe7467f-1900-0000-34d9-10a1e60d0000 pid=3558 clone guuid=a5cdc17f-1900-0000-34d9-10a1e80d0000 pid=3560 /usr/bin/rm delete-file guuid=927a535e-1900-0000-34d9-10a1750d0000 pid=3445->guuid=a5cdc17f-1900-0000-34d9-10a1e80d0000 pid=3560 execve guuid=08455b80-1900-0000-34d9-10a1e90d0000 pid=3561 /usr/bin/rm guuid=927a535e-1900-0000-34d9-10a1750d0000 pid=3445->guuid=08455b80-1900-0000-34d9-10a1e90d0000 pid=3561 execve guuid=188ae780-1900-0000-34d9-10a1ea0d0000 pid=3562 /usr/bin/wget net send-data guuid=927a535e-1900-0000-34d9-10a1750d0000 pid=3445->guuid=188ae780-1900-0000-34d9-10a1ea0d0000 pid=3562 execve guuid=f34bfb83-1900-0000-34d9-10a1eb0d0000 pid=3563 /usr/bin/curl net send-data write-file guuid=927a535e-1900-0000-34d9-10a1750d0000 pid=3445->guuid=f34bfb83-1900-0000-34d9-10a1eb0d0000 pid=3563 execve guuid=abe07888-1900-0000-34d9-10a1ef0d0000 pid=3567 /usr/bin/chmod guuid=927a535e-1900-0000-34d9-10a1750d0000 pid=3445->guuid=abe07888-1900-0000-34d9-10a1ef0d0000 pid=3567 execve guuid=41cdd888-1900-0000-34d9-10a1f00d0000 pid=3568 /usr/bin/bash guuid=927a535e-1900-0000-34d9-10a1750d0000 pid=3445->guuid=41cdd888-1900-0000-34d9-10a1f00d0000 pid=3568 clone guuid=be113a89-1900-0000-34d9-10a1f50d0000 pid=3573 /usr/bin/rm delete-file guuid=927a535e-1900-0000-34d9-10a1750d0000 pid=3445->guuid=be113a89-1900-0000-34d9-10a1f50d0000 pid=3573 execve guuid=40969389-1900-0000-34d9-10a1f60d0000 pid=3574 /usr/bin/rm guuid=927a535e-1900-0000-34d9-10a1750d0000 pid=3445->guuid=40969389-1900-0000-34d9-10a1f60d0000 pid=3574 execve guuid=9fcbfb89-1900-0000-34d9-10a1f70d0000 pid=3575 /usr/bin/wget net send-data guuid=927a535e-1900-0000-34d9-10a1750d0000 pid=3445->guuid=9fcbfb89-1900-0000-34d9-10a1f70d0000 pid=3575 execve guuid=2f7d238e-1900-0000-34d9-10a1fe0d0000 pid=3582 /usr/bin/curl net send-data write-file guuid=927a535e-1900-0000-34d9-10a1750d0000 pid=3445->guuid=2f7d238e-1900-0000-34d9-10a1fe0d0000 pid=3582 execve guuid=eb9af593-1900-0000-34d9-10a1060e0000 pid=3590 /usr/bin/chmod guuid=927a535e-1900-0000-34d9-10a1750d0000 pid=3445->guuid=eb9af593-1900-0000-34d9-10a1060e0000 pid=3590 execve guuid=1a534494-1900-0000-34d9-10a1080e0000 pid=3592 /usr/bin/bash guuid=927a535e-1900-0000-34d9-10a1750d0000 pid=3445->guuid=1a534494-1900-0000-34d9-10a1080e0000 pid=3592 clone guuid=f5177e94-1900-0000-34d9-10a10b0e0000 pid=3595 /usr/bin/rm delete-file guuid=927a535e-1900-0000-34d9-10a1750d0000 pid=3445->guuid=f5177e94-1900-0000-34d9-10a10b0e0000 pid=3595 execve guuid=626ac294-1900-0000-34d9-10a10d0e0000 pid=3597 /usr/bin/rm guuid=927a535e-1900-0000-34d9-10a1750d0000 pid=3445->guuid=626ac294-1900-0000-34d9-10a10d0e0000 pid=3597 execve guuid=825c0d95-1900-0000-34d9-10a10f0e0000 pid=3599 /usr/bin/wget net send-data guuid=927a535e-1900-0000-34d9-10a1750d0000 pid=3445->guuid=825c0d95-1900-0000-34d9-10a10f0e0000 pid=3599 execve guuid=c44ece97-1900-0000-34d9-10a1190e0000 pid=3609 /usr/bin/curl net send-data write-file guuid=927a535e-1900-0000-34d9-10a1750d0000 pid=3445->guuid=c44ece97-1900-0000-34d9-10a1190e0000 pid=3609 execve guuid=f532209c-1900-0000-34d9-10a12e0e0000 pid=3630 /usr/bin/chmod guuid=927a535e-1900-0000-34d9-10a1750d0000 pid=3445->guuid=f532209c-1900-0000-34d9-10a12e0e0000 pid=3630 execve guuid=0cc5639c-1900-0000-34d9-10a1320e0000 pid=3634 /usr/bin/bash guuid=927a535e-1900-0000-34d9-10a1750d0000 pid=3445->guuid=0cc5639c-1900-0000-34d9-10a1320e0000 pid=3634 clone guuid=cd87a49c-1900-0000-34d9-10a1340e0000 pid=3636 /usr/bin/rm delete-file guuid=927a535e-1900-0000-34d9-10a1750d0000 pid=3445->guuid=cd87a49c-1900-0000-34d9-10a1340e0000 pid=3636 execve guuid=7a6bec9c-1900-0000-34d9-10a1360e0000 pid=3638 /usr/bin/rm guuid=927a535e-1900-0000-34d9-10a1750d0000 pid=3445->guuid=7a6bec9c-1900-0000-34d9-10a1360e0000 pid=3638 execve guuid=0bfb319d-1900-0000-34d9-10a1380e0000 pid=3640 /usr/bin/wget net send-data guuid=927a535e-1900-0000-34d9-10a1750d0000 pid=3445->guuid=0bfb319d-1900-0000-34d9-10a1380e0000 pid=3640 execve guuid=b53fb2a1-1900-0000-34d9-10a1510e0000 pid=3665 /usr/bin/curl net send-data write-file guuid=927a535e-1900-0000-34d9-10a1750d0000 pid=3445->guuid=b53fb2a1-1900-0000-34d9-10a1510e0000 pid=3665 execve guuid=92dc5ba8-1900-0000-34d9-10a1650e0000 pid=3685 /usr/bin/chmod guuid=927a535e-1900-0000-34d9-10a1750d0000 pid=3445->guuid=92dc5ba8-1900-0000-34d9-10a1650e0000 pid=3685 execve guuid=780ac9a8-1900-0000-34d9-10a1670e0000 pid=3687 /usr/bin/bash guuid=927a535e-1900-0000-34d9-10a1750d0000 pid=3445->guuid=780ac9a8-1900-0000-34d9-10a1670e0000 pid=3687 clone guuid=007f00a9-1900-0000-34d9-10a1690e0000 pid=3689 /usr/bin/rm delete-file guuid=927a535e-1900-0000-34d9-10a1750d0000 pid=3445->guuid=007f00a9-1900-0000-34d9-10a1690e0000 pid=3689 execve guuid=d2d43da9-1900-0000-34d9-10a16b0e0000 pid=3691 /usr/bin/rm guuid=927a535e-1900-0000-34d9-10a1750d0000 pid=3445->guuid=d2d43da9-1900-0000-34d9-10a16b0e0000 pid=3691 execve guuid=316977a9-1900-0000-34d9-10a16c0e0000 pid=3692 /usr/bin/wget net send-data guuid=927a535e-1900-0000-34d9-10a1750d0000 pid=3445->guuid=316977a9-1900-0000-34d9-10a16c0e0000 pid=3692 execve guuid=437759ac-1900-0000-34d9-10a1760e0000 pid=3702 /usr/bin/curl net send-data write-file guuid=927a535e-1900-0000-34d9-10a1750d0000 pid=3445->guuid=437759ac-1900-0000-34d9-10a1760e0000 pid=3702 execve guuid=d67934b1-1900-0000-34d9-10a1840e0000 pid=3716 /usr/bin/chmod guuid=927a535e-1900-0000-34d9-10a1750d0000 pid=3445->guuid=d67934b1-1900-0000-34d9-10a1840e0000 pid=3716 execve guuid=05b8cab1-1900-0000-34d9-10a1870e0000 pid=3719 /usr/bin/bash guuid=927a535e-1900-0000-34d9-10a1750d0000 pid=3445->guuid=05b8cab1-1900-0000-34d9-10a1870e0000 pid=3719 clone guuid=94ec1eb2-1900-0000-34d9-10a18a0e0000 pid=3722 /usr/bin/rm delete-file guuid=927a535e-1900-0000-34d9-10a1750d0000 pid=3445->guuid=94ec1eb2-1900-0000-34d9-10a18a0e0000 pid=3722 execve guuid=96ec5eb2-1900-0000-34d9-10a18c0e0000 pid=3724 /usr/bin/rm guuid=927a535e-1900-0000-34d9-10a1750d0000 pid=3445->guuid=96ec5eb2-1900-0000-34d9-10a18c0e0000 pid=3724 execve guuid=40159eb2-1900-0000-34d9-10a18e0e0000 pid=3726 /usr/bin/wget net send-data guuid=927a535e-1900-0000-34d9-10a1750d0000 pid=3445->guuid=40159eb2-1900-0000-34d9-10a18e0e0000 pid=3726 execve guuid=b04d33b5-1900-0000-34d9-10a19d0e0000 pid=3741 /usr/bin/curl net send-data write-file guuid=927a535e-1900-0000-34d9-10a1750d0000 pid=3445->guuid=b04d33b5-1900-0000-34d9-10a19d0e0000 pid=3741 execve guuid=91db96bb-1900-0000-34d9-10a1b30e0000 pid=3763 /usr/bin/chmod guuid=927a535e-1900-0000-34d9-10a1750d0000 pid=3445->guuid=91db96bb-1900-0000-34d9-10a1b30e0000 pid=3763 execve guuid=bf05d1bb-1900-0000-34d9-10a1b50e0000 pid=3765 /usr/bin/bash guuid=927a535e-1900-0000-34d9-10a1750d0000 pid=3445->guuid=bf05d1bb-1900-0000-34d9-10a1b50e0000 pid=3765 clone guuid=af83fbbb-1900-0000-34d9-10a1b70e0000 pid=3767 /usr/bin/rm delete-file guuid=927a535e-1900-0000-34d9-10a1750d0000 pid=3445->guuid=af83fbbb-1900-0000-34d9-10a1b70e0000 pid=3767 execve guuid=761836bc-1900-0000-34d9-10a1b90e0000 pid=3769 /usr/bin/rm guuid=927a535e-1900-0000-34d9-10a1750d0000 pid=3445->guuid=761836bc-1900-0000-34d9-10a1b90e0000 pid=3769 execve guuid=f7ed6dbc-1900-0000-34d9-10a1bc0e0000 pid=3772 /usr/bin/wget net send-data guuid=927a535e-1900-0000-34d9-10a1750d0000 pid=3445->guuid=f7ed6dbc-1900-0000-34d9-10a1bc0e0000 pid=3772 execve guuid=6249debe-1900-0000-34d9-10a1c30e0000 pid=3779 /usr/bin/curl net send-data write-file guuid=927a535e-1900-0000-34d9-10a1750d0000 pid=3445->guuid=6249debe-1900-0000-34d9-10a1c30e0000 pid=3779 execve guuid=792e87c4-1900-0000-34d9-10a1d20e0000 pid=3794 /usr/bin/chmod guuid=927a535e-1900-0000-34d9-10a1750d0000 pid=3445->guuid=792e87c4-1900-0000-34d9-10a1d20e0000 pid=3794 execve guuid=49d3d9c4-1900-0000-34d9-10a1d60e0000 pid=3798 /usr/bin/bash guuid=927a535e-1900-0000-34d9-10a1750d0000 pid=3445->guuid=49d3d9c4-1900-0000-34d9-10a1d60e0000 pid=3798 clone guuid=cd210ec5-1900-0000-34d9-10a1d80e0000 pid=3800 /usr/bin/rm delete-file guuid=927a535e-1900-0000-34d9-10a1750d0000 pid=3445->guuid=cd210ec5-1900-0000-34d9-10a1d80e0000 pid=3800 execve guuid=33365ec5-1900-0000-34d9-10a1d90e0000 pid=3801 /usr/bin/rm guuid=927a535e-1900-0000-34d9-10a1750d0000 pid=3445->guuid=33365ec5-1900-0000-34d9-10a1d90e0000 pid=3801 execve guuid=8b009fc5-1900-0000-34d9-10a1dc0e0000 pid=3804 /usr/bin/wget net send-data guuid=927a535e-1900-0000-34d9-10a1750d0000 pid=3445->guuid=8b009fc5-1900-0000-34d9-10a1dc0e0000 pid=3804 execve guuid=1362b2c8-1900-0000-34d9-10a1e90e0000 pid=3817 /usr/bin/curl net send-data write-file guuid=927a535e-1900-0000-34d9-10a1750d0000 pid=3445->guuid=1362b2c8-1900-0000-34d9-10a1e90e0000 pid=3817 execve guuid=409692cc-1900-0000-34d9-10a1fe0e0000 pid=3838 /usr/bin/chmod guuid=927a535e-1900-0000-34d9-10a1750d0000 pid=3445->guuid=409692cc-1900-0000-34d9-10a1fe0e0000 pid=3838 execve guuid=a984d2cc-1900-0000-34d9-10a1020f0000 pid=3842 /usr/bin/bash guuid=927a535e-1900-0000-34d9-10a1750d0000 pid=3445->guuid=a984d2cc-1900-0000-34d9-10a1020f0000 pid=3842 clone guuid=4ce802cd-1900-0000-34d9-10a1040f0000 pid=3844 /usr/bin/rm delete-file guuid=927a535e-1900-0000-34d9-10a1750d0000 pid=3445->guuid=4ce802cd-1900-0000-34d9-10a1040f0000 pid=3844 execve guuid=78843ecd-1900-0000-34d9-10a1060f0000 pid=3846 /usr/bin/rm guuid=927a535e-1900-0000-34d9-10a1750d0000 pid=3445->guuid=78843ecd-1900-0000-34d9-10a1060f0000 pid=3846 execve guuid=3bce7acd-1900-0000-34d9-10a1080f0000 pid=3848 /usr/bin/wget net send-data guuid=927a535e-1900-0000-34d9-10a1750d0000 pid=3445->guuid=3bce7acd-1900-0000-34d9-10a1080f0000 pid=3848 execve guuid=a5e1dad0-1900-0000-34d9-10a1170f0000 pid=3863 /usr/bin/curl net send-data write-file guuid=927a535e-1900-0000-34d9-10a1750d0000 pid=3445->guuid=a5e1dad0-1900-0000-34d9-10a1170f0000 pid=3863 execve guuid=3522edd4-1900-0000-34d9-10a11e0f0000 pid=3870 /usr/bin/chmod guuid=927a535e-1900-0000-34d9-10a1750d0000 pid=3445->guuid=3522edd4-1900-0000-34d9-10a11e0f0000 pid=3870 execve guuid=6c7849d5-1900-0000-34d9-10a1220f0000 pid=3874 /usr/bin/bash guuid=927a535e-1900-0000-34d9-10a1750d0000 pid=3445->guuid=6c7849d5-1900-0000-34d9-10a1220f0000 pid=3874 clone guuid=2067ead5-1900-0000-34d9-10a1240f0000 pid=3876 /usr/bin/rm delete-file guuid=927a535e-1900-0000-34d9-10a1750d0000 pid=3445->guuid=2067ead5-1900-0000-34d9-10a1240f0000 pid=3876 execve guuid=6b9040d6-1900-0000-34d9-10a1270f0000 pid=3879 /usr/bin/rm guuid=927a535e-1900-0000-34d9-10a1750d0000 pid=3445->guuid=6b9040d6-1900-0000-34d9-10a1270f0000 pid=3879 execve 5b654972-c9e1-50d8-b372-2dc2a5b9ad66 5.182.210.174:80 guuid=9da9af5e-1900-0000-34d9-10a1770d0000 pid=3447->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=9cb50a64-1900-0000-34d9-10a1860d0000 pid=3462->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=4a69386d-1900-0000-34d9-10a1a10d0000 pid=3489 /usr/bin/bash guuid=6fa81f6d-1900-0000-34d9-10a19f0d0000 pid=3487->guuid=4a69386d-1900-0000-34d9-10a1a10d0000 pid=3489 clone guuid=2fcfed6d-1900-0000-34d9-10a1a60d0000 pid=3494->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=16ce5270-1900-0000-34d9-10a1af0d0000 pid=3503->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=8af78d77-1900-0000-34d9-10a1c60d0000 pid=3526 /usr/bin/bash guuid=da146e77-1900-0000-34d9-10a1c50d0000 pid=3525->guuid=8af78d77-1900-0000-34d9-10a1c60d0000 pid=3526 clone guuid=524d5f78-1900-0000-34d9-10a1cd0d0000 pid=3533->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=6c40d27a-1900-0000-34d9-10a1d80d0000 pid=3544->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=520b847f-1900-0000-34d9-10a1e70d0000 pid=3559 /usr/bin/bash guuid=dfe7467f-1900-0000-34d9-10a1e60d0000 pid=3558->guuid=520b847f-1900-0000-34d9-10a1e70d0000 pid=3559 clone guuid=188ae780-1900-0000-34d9-10a1ea0d0000 pid=3562->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=f34bfb83-1900-0000-34d9-10a1eb0d0000 pid=3563->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=88a0f588-1900-0000-34d9-10a1f20d0000 pid=3570 /usr/bin/bash guuid=41cdd888-1900-0000-34d9-10a1f00d0000 pid=3568->guuid=88a0f588-1900-0000-34d9-10a1f20d0000 pid=3570 clone guuid=9fcbfb89-1900-0000-34d9-10a1f70d0000 pid=3575->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=2f7d238e-1900-0000-34d9-10a1fe0d0000 pid=3582->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=db135b94-1900-0000-34d9-10a10a0e0000 pid=3594 /usr/bin/bash guuid=1a534494-1900-0000-34d9-10a1080e0000 pid=3592->guuid=db135b94-1900-0000-34d9-10a10a0e0000 pid=3594 clone guuid=825c0d95-1900-0000-34d9-10a10f0e0000 pid=3599->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=c44ece97-1900-0000-34d9-10a1190e0000 pid=3609->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=ea0e7b9c-1900-0000-34d9-10a1330e0000 pid=3635 /usr/bin/bash guuid=0cc5639c-1900-0000-34d9-10a1320e0000 pid=3634->guuid=ea0e7b9c-1900-0000-34d9-10a1330e0000 pid=3635 clone guuid=0bfb319d-1900-0000-34d9-10a1380e0000 pid=3640->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=b53fb2a1-1900-0000-34d9-10a1510e0000 pid=3665->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=704fe0a8-1900-0000-34d9-10a1680e0000 pid=3688 /usr/bin/bash guuid=780ac9a8-1900-0000-34d9-10a1670e0000 pid=3687->guuid=704fe0a8-1900-0000-34d9-10a1680e0000 pid=3688 clone guuid=316977a9-1900-0000-34d9-10a16c0e0000 pid=3692->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=437759ac-1900-0000-34d9-10a1760e0000 pid=3702->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=3f98e7b1-1900-0000-34d9-10a1880e0000 pid=3720 /usr/bin/bash guuid=05b8cab1-1900-0000-34d9-10a1870e0000 pid=3719->guuid=3f98e7b1-1900-0000-34d9-10a1880e0000 pid=3720 clone guuid=40159eb2-1900-0000-34d9-10a18e0e0000 pid=3726->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=b04d33b5-1900-0000-34d9-10a19d0e0000 pid=3741->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=3dc8e3bb-1900-0000-34d9-10a1b60e0000 pid=3766 /usr/bin/bash guuid=bf05d1bb-1900-0000-34d9-10a1b50e0000 pid=3765->guuid=3dc8e3bb-1900-0000-34d9-10a1b60e0000 pid=3766 clone guuid=f7ed6dbc-1900-0000-34d9-10a1bc0e0000 pid=3772->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=6249debe-1900-0000-34d9-10a1c30e0000 pid=3779->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=5370eec4-1900-0000-34d9-10a1d70e0000 pid=3799 /usr/bin/bash guuid=49d3d9c4-1900-0000-34d9-10a1d60e0000 pid=3798->guuid=5370eec4-1900-0000-34d9-10a1d70e0000 pid=3799 clone guuid=8b009fc5-1900-0000-34d9-10a1dc0e0000 pid=3804->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=1362b2c8-1900-0000-34d9-10a1e90e0000 pid=3817->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=6d44e5cc-1900-0000-34d9-10a1030f0000 pid=3843 /usr/bin/bash guuid=a984d2cc-1900-0000-34d9-10a1020f0000 pid=3842->guuid=6d44e5cc-1900-0000-34d9-10a1030f0000 pid=3843 clone guuid=3bce7acd-1900-0000-34d9-10a1080f0000 pid=3848->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=a5e1dad0-1900-0000-34d9-10a1170f0000 pid=3863->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=0f6885d5-1900-0000-34d9-10a1230f0000 pid=3875 /usr/bin/bash guuid=6c7849d5-1900-0000-34d9-10a1220f0000 pid=3874->guuid=0f6885d5-1900-0000-34d9-10a1230f0000 pid=3875 clone
Score:
99%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/5d477992a3d765e3652ac0064d6cd1ad9a540c5df2f5d3a28276c079fb026d12
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5d477992a3d765e3652ac0064d6cd1ad9a540c5df2f5d3a28276c079fb026d12/
Threat name:
Linux.Downloader.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-08-20 09:38:22 UTC
File Type:
Text (Shell)
AV detection:
12 of 36 (33.33%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lvdxtevd25s6gzjkyade23grvwnfidc56l25hiuco3aht6ycnuja._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260820-ll6y6sw1c1/
Behaviour
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 5d477992a3d765e3652ac0064d6cd1ad9a540c5df2f5d3a28276c079fb026d12

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3897671/
  
Delivery method
Distributed via web download

Comments