MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5defeb91306afab4c73faed6a436bed659f6b19f31d7e86f4063bab5e2abd3cd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5defeb91306afab4c73faed6a436bed659f6b19f31d7e86f4063bab5e2abd3cd
SHA3-384 hash: 9ba9404ad315e0a41e29a0bc6771c534aee9918ce65c2a7d2fddb5795e3ac0f9d4222d522b12dde69512c8f7be37b312
SHA1 hash: a6607da1ca6791cddfb3e4db45a943bbc5e56061
MD5 hash: 4f99142412c02cfc8a7a24089e7f533e
humanhash: tennis-lion-timing-lithium
File name:ok
Download: download sample
File size:1'608 bytes
First seen:2026-08-24 13:22:19 UTC
Last seen:2026-08-25 04:11:27 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 12:UBJr6BRVlTDHyoSwU605dCENG3ROx6NG3RO85iy6OaH6aPzWueh76WueDa+L5L3z:+2lnyV5aqgjSUdGp5D8V0
TLSH T1D53152EF610819321142DE4E72B2358D768E91EB289FD7F4D8180DA9824C7C8F261F5D
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://5.182.210.174/5adfbdn/an/an/a
http://5.182.210.174/fbb672n/an/an/a
http://5.182.210.174/9ce742n/an/an/a
http://5.182.210.174/4613b1n/an/an/a
http://5.182.210.174/0b21a3n/an/an/a
http://5.182.210.174/21d1abn/an/an/a
http://5.182.210.174/348c17n/an/an/a
http://5.182.210.174/dec99fn/an/an/a
http://5.182.210.174/47f969n/an/an/a
http://5.182.210.174/a15406n/an/an/a
http://5.182.210.174/895e1en/an/an/a
http://5.182.210.174/0cb82bn/an/an/a

Intelligence

File Origin
# of uploads :
2
# of downloads :
37
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-08-24T11:35:00Z UTC
Last seen:
2026-08-25T23:28:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/5defeb91306afab4c73faed6a436bed659f6b19f31d7e86f4063bab5e2abd3cd/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/d54b260e-4b33-4503-941d-26e4bba93e45
Behavior Graph:
Download SVG
%3 guuid=50a07108-1800-0000-94a8-f8edd30d0000 pid=3539 /usr/bin/sudo guuid=f1cbab0a-1800-0000-94a8-f8edd40d0000 pid=3540 /tmp/sample.bin guuid=50a07108-1800-0000-94a8-f8edd30d0000 pid=3539->guuid=f1cbab0a-1800-0000-94a8-f8edd40d0000 pid=3540 execve guuid=e1aa820b-1800-0000-94a8-f8edd50d0000 pid=3541 /usr/bin/wget net send-data guuid=f1cbab0a-1800-0000-94a8-f8edd40d0000 pid=3540->guuid=e1aa820b-1800-0000-94a8-f8edd50d0000 pid=3541 execve guuid=b2a9f012-1800-0000-94a8-f8eddd0d0000 pid=3549 /usr/bin/curl net send-data write-file guuid=f1cbab0a-1800-0000-94a8-f8edd40d0000 pid=3540->guuid=b2a9f012-1800-0000-94a8-f8eddd0d0000 pid=3549 execve guuid=33ce5e1f-1800-0000-94a8-f8edf00d0000 pid=3568 /usr/bin/chmod guuid=f1cbab0a-1800-0000-94a8-f8edd40d0000 pid=3540->guuid=33ce5e1f-1800-0000-94a8-f8edf00d0000 pid=3568 execve guuid=674ba31f-1800-0000-94a8-f8edf20d0000 pid=3570 /usr/bin/bash guuid=f1cbab0a-1800-0000-94a8-f8edd40d0000 pid=3540->guuid=674ba31f-1800-0000-94a8-f8edf20d0000 pid=3570 clone guuid=ca49ea1f-1800-0000-94a8-f8edf40d0000 pid=3572 /usr/bin/rm delete-file guuid=f1cbab0a-1800-0000-94a8-f8edd40d0000 pid=3540->guuid=ca49ea1f-1800-0000-94a8-f8edf40d0000 pid=3572 execve guuid=3e364d20-1800-0000-94a8-f8edf70d0000 pid=3575 /usr/bin/rm guuid=f1cbab0a-1800-0000-94a8-f8edd40d0000 pid=3540->guuid=3e364d20-1800-0000-94a8-f8edf70d0000 pid=3575 execve guuid=deb19420-1800-0000-94a8-f8edf80d0000 pid=3576 /usr/bin/wget net send-data guuid=f1cbab0a-1800-0000-94a8-f8edd40d0000 pid=3540->guuid=deb19420-1800-0000-94a8-f8edf80d0000 pid=3576 execve guuid=a3c5da23-1800-0000-94a8-f8ed060e0000 pid=3590 /usr/bin/curl net send-data write-file guuid=f1cbab0a-1800-0000-94a8-f8edd40d0000 pid=3540->guuid=a3c5da23-1800-0000-94a8-f8ed060e0000 pid=3590 execve guuid=03d3c92c-1800-0000-94a8-f8ed2a0e0000 pid=3626 /usr/bin/chmod guuid=f1cbab0a-1800-0000-94a8-f8edd40d0000 pid=3540->guuid=03d3c92c-1800-0000-94a8-f8ed2a0e0000 pid=3626 execve guuid=6f45332d-1800-0000-94a8-f8ed2b0e0000 pid=3627 /usr/bin/bash guuid=f1cbab0a-1800-0000-94a8-f8edd40d0000 pid=3540->guuid=6f45332d-1800-0000-94a8-f8ed2b0e0000 pid=3627 clone guuid=faa8692d-1800-0000-94a8-f8ed300e0000 pid=3632 /usr/bin/rm delete-file guuid=f1cbab0a-1800-0000-94a8-f8edd40d0000 pid=3540->guuid=faa8692d-1800-0000-94a8-f8ed300e0000 pid=3632 execve guuid=a563af2d-1800-0000-94a8-f8ed310e0000 pid=3633 /usr/bin/rm guuid=f1cbab0a-1800-0000-94a8-f8edd40d0000 pid=3540->guuid=a563af2d-1800-0000-94a8-f8ed310e0000 pid=3633 execve guuid=8926f22d-1800-0000-94a8-f8ed320e0000 pid=3634 /usr/bin/wget net send-data guuid=f1cbab0a-1800-0000-94a8-f8edd40d0000 pid=3540->guuid=8926f22d-1800-0000-94a8-f8ed320e0000 pid=3634 execve guuid=42d98d31-1800-0000-94a8-f8ed3f0e0000 pid=3647 /usr/bin/curl net send-data write-file guuid=f1cbab0a-1800-0000-94a8-f8edd40d0000 pid=3540->guuid=42d98d31-1800-0000-94a8-f8ed3f0e0000 pid=3647 execve guuid=54bc4636-1800-0000-94a8-f8ed4b0e0000 pid=3659 /usr/bin/chmod guuid=f1cbab0a-1800-0000-94a8-f8edd40d0000 pid=3540->guuid=54bc4636-1800-0000-94a8-f8ed4b0e0000 pid=3659 execve guuid=c86fb036-1800-0000-94a8-f8ed4d0e0000 pid=3661 /usr/bin/bash guuid=f1cbab0a-1800-0000-94a8-f8edd40d0000 pid=3540->guuid=c86fb036-1800-0000-94a8-f8ed4d0e0000 pid=3661 clone guuid=96c1f236-1800-0000-94a8-f8ed500e0000 pid=3664 /usr/bin/rm delete-file guuid=f1cbab0a-1800-0000-94a8-f8edd40d0000 pid=3540->guuid=96c1f236-1800-0000-94a8-f8ed500e0000 pid=3664 execve guuid=84a75437-1800-0000-94a8-f8ed520e0000 pid=3666 /usr/bin/rm guuid=f1cbab0a-1800-0000-94a8-f8edd40d0000 pid=3540->guuid=84a75437-1800-0000-94a8-f8ed520e0000 pid=3666 execve guuid=336aac37-1800-0000-94a8-f8ed580e0000 pid=3672 /usr/bin/wget net send-data guuid=f1cbab0a-1800-0000-94a8-f8edd40d0000 pid=3540->guuid=336aac37-1800-0000-94a8-f8ed580e0000 pid=3672 execve guuid=88125b3a-1800-0000-94a8-f8ed620e0000 pid=3682 /usr/bin/curl net send-data write-file guuid=f1cbab0a-1800-0000-94a8-f8edd40d0000 pid=3540->guuid=88125b3a-1800-0000-94a8-f8ed620e0000 pid=3682 execve guuid=80ba993e-1800-0000-94a8-f8ed710e0000 pid=3697 /usr/bin/chmod guuid=f1cbab0a-1800-0000-94a8-f8edd40d0000 pid=3540->guuid=80ba993e-1800-0000-94a8-f8ed710e0000 pid=3697 execve guuid=9da3d93e-1800-0000-94a8-f8ed730e0000 pid=3699 /usr/bin/bash guuid=f1cbab0a-1800-0000-94a8-f8edd40d0000 pid=3540->guuid=9da3d93e-1800-0000-94a8-f8ed730e0000 pid=3699 clone guuid=e00e103f-1800-0000-94a8-f8ed760e0000 pid=3702 /usr/bin/rm delete-file guuid=f1cbab0a-1800-0000-94a8-f8edd40d0000 pid=3540->guuid=e00e103f-1800-0000-94a8-f8ed760e0000 pid=3702 execve guuid=96804d3f-1800-0000-94a8-f8ed780e0000 pid=3704 /usr/bin/rm guuid=f1cbab0a-1800-0000-94a8-f8edd40d0000 pid=3540->guuid=96804d3f-1800-0000-94a8-f8ed780e0000 pid=3704 execve guuid=85d6a33f-1800-0000-94a8-f8ed7b0e0000 pid=3707 /usr/bin/wget net send-data guuid=f1cbab0a-1800-0000-94a8-f8edd40d0000 pid=3540->guuid=85d6a33f-1800-0000-94a8-f8ed7b0e0000 pid=3707 execve guuid=d9c70f42-1800-0000-94a8-f8ed8e0e0000 pid=3726 /usr/bin/curl net send-data write-file guuid=f1cbab0a-1800-0000-94a8-f8edd40d0000 pid=3540->guuid=d9c70f42-1800-0000-94a8-f8ed8e0e0000 pid=3726 execve guuid=86bd3846-1800-0000-94a8-f8ed9c0e0000 pid=3740 /usr/bin/chmod guuid=f1cbab0a-1800-0000-94a8-f8edd40d0000 pid=3540->guuid=86bd3846-1800-0000-94a8-f8ed9c0e0000 pid=3740 execve guuid=349f7946-1800-0000-94a8-f8ed9f0e0000 pid=3743 /usr/bin/bash guuid=f1cbab0a-1800-0000-94a8-f8edd40d0000 pid=3540->guuid=349f7946-1800-0000-94a8-f8ed9f0e0000 pid=3743 clone guuid=b732ac46-1800-0000-94a8-f8eda20e0000 pid=3746 /usr/bin/rm delete-file guuid=f1cbab0a-1800-0000-94a8-f8edd40d0000 pid=3540->guuid=b732ac46-1800-0000-94a8-f8eda20e0000 pid=3746 execve guuid=d6c0f246-1800-0000-94a8-f8eda50e0000 pid=3749 /usr/bin/rm guuid=f1cbab0a-1800-0000-94a8-f8edd40d0000 pid=3540->guuid=d6c0f246-1800-0000-94a8-f8eda50e0000 pid=3749 execve guuid=dda54347-1800-0000-94a8-f8eda80e0000 pid=3752 /usr/bin/wget net send-data guuid=f1cbab0a-1800-0000-94a8-f8edd40d0000 pid=3540->guuid=dda54347-1800-0000-94a8-f8eda80e0000 pid=3752 execve guuid=fd3dc649-1800-0000-94a8-f8edb30e0000 pid=3763 /usr/bin/curl net send-data write-file guuid=f1cbab0a-1800-0000-94a8-f8edd40d0000 pid=3540->guuid=fd3dc649-1800-0000-94a8-f8edb30e0000 pid=3763 execve guuid=5057254d-1800-0000-94a8-f8edc10e0000 pid=3777 /usr/bin/chmod guuid=f1cbab0a-1800-0000-94a8-f8edd40d0000 pid=3540->guuid=5057254d-1800-0000-94a8-f8edc10e0000 pid=3777 execve guuid=d7916c4d-1800-0000-94a8-f8edc30e0000 pid=3779 /usr/bin/bash guuid=f1cbab0a-1800-0000-94a8-f8edd40d0000 pid=3540->guuid=d7916c4d-1800-0000-94a8-f8edc30e0000 pid=3779 clone guuid=1307b54d-1800-0000-94a8-f8edc60e0000 pid=3782 /usr/bin/rm delete-file guuid=f1cbab0a-1800-0000-94a8-f8edd40d0000 pid=3540->guuid=1307b54d-1800-0000-94a8-f8edc60e0000 pid=3782 execve guuid=c5ddfa4d-1800-0000-94a8-f8edc80e0000 pid=3784 /usr/bin/rm guuid=f1cbab0a-1800-0000-94a8-f8edd40d0000 pid=3540->guuid=c5ddfa4d-1800-0000-94a8-f8edc80e0000 pid=3784 execve guuid=fad13c4e-1800-0000-94a8-f8edc90e0000 pid=3785 /usr/bin/wget net send-data guuid=f1cbab0a-1800-0000-94a8-f8edd40d0000 pid=3540->guuid=fad13c4e-1800-0000-94a8-f8edc90e0000 pid=3785 execve guuid=2e445951-1800-0000-94a8-f8edd50e0000 pid=3797 /usr/bin/curl net send-data write-file guuid=f1cbab0a-1800-0000-94a8-f8edd40d0000 pid=3540->guuid=2e445951-1800-0000-94a8-f8edd50e0000 pid=3797 execve guuid=06b6115a-1800-0000-94a8-f8eddf0e0000 pid=3807 /usr/bin/chmod guuid=f1cbab0a-1800-0000-94a8-f8edd40d0000 pid=3540->guuid=06b6115a-1800-0000-94a8-f8eddf0e0000 pid=3807 execve guuid=401fda5a-1800-0000-94a8-f8ede30e0000 pid=3811 /usr/bin/bash guuid=f1cbab0a-1800-0000-94a8-f8edd40d0000 pid=3540->guuid=401fda5a-1800-0000-94a8-f8ede30e0000 pid=3811 clone guuid=a407635b-1800-0000-94a8-f8ede70e0000 pid=3815 /usr/bin/rm delete-file guuid=f1cbab0a-1800-0000-94a8-f8edd40d0000 pid=3540->guuid=a407635b-1800-0000-94a8-f8ede70e0000 pid=3815 execve guuid=5311ee5b-1800-0000-94a8-f8ede90e0000 pid=3817 /usr/bin/rm guuid=f1cbab0a-1800-0000-94a8-f8edd40d0000 pid=3540->guuid=5311ee5b-1800-0000-94a8-f8ede90e0000 pid=3817 execve guuid=67d8465c-1800-0000-94a8-f8edea0e0000 pid=3818 /usr/bin/wget net send-data guuid=f1cbab0a-1800-0000-94a8-f8edd40d0000 pid=3540->guuid=67d8465c-1800-0000-94a8-f8edea0e0000 pid=3818 execve guuid=9557495f-1800-0000-94a8-f8edf30e0000 pid=3827 /usr/bin/curl net send-data write-file guuid=f1cbab0a-1800-0000-94a8-f8edd40d0000 pid=3540->guuid=9557495f-1800-0000-94a8-f8edf30e0000 pid=3827 execve guuid=1df36563-1800-0000-94a8-f8edfc0e0000 pid=3836 /usr/bin/chmod guuid=f1cbab0a-1800-0000-94a8-f8edd40d0000 pid=3540->guuid=1df36563-1800-0000-94a8-f8edfc0e0000 pid=3836 execve guuid=900dbc63-1800-0000-94a8-f8edfe0e0000 pid=3838 /usr/bin/bash guuid=f1cbab0a-1800-0000-94a8-f8edd40d0000 pid=3540->guuid=900dbc63-1800-0000-94a8-f8edfe0e0000 pid=3838 clone guuid=f8f0f963-1800-0000-94a8-f8ed010f0000 pid=3841 /usr/bin/rm delete-file guuid=f1cbab0a-1800-0000-94a8-f8edd40d0000 pid=3540->guuid=f8f0f963-1800-0000-94a8-f8ed010f0000 pid=3841 execve guuid=30813c64-1800-0000-94a8-f8ed030f0000 pid=3843 /usr/bin/rm guuid=f1cbab0a-1800-0000-94a8-f8edd40d0000 pid=3540->guuid=30813c64-1800-0000-94a8-f8ed030f0000 pid=3843 execve guuid=6d0e7d64-1800-0000-94a8-f8ed050f0000 pid=3845 /usr/bin/wget net send-data guuid=f1cbab0a-1800-0000-94a8-f8edd40d0000 pid=3540->guuid=6d0e7d64-1800-0000-94a8-f8ed050f0000 pid=3845 execve guuid=7066f866-1800-0000-94a8-f8ed110f0000 pid=3857 /usr/bin/curl net send-data write-file guuid=f1cbab0a-1800-0000-94a8-f8edd40d0000 pid=3540->guuid=7066f866-1800-0000-94a8-f8ed110f0000 pid=3857 execve guuid=b6aacb6c-1800-0000-94a8-f8ed250f0000 pid=3877 /usr/bin/chmod guuid=f1cbab0a-1800-0000-94a8-f8edd40d0000 pid=3540->guuid=b6aacb6c-1800-0000-94a8-f8ed250f0000 pid=3877 execve guuid=e8ed336d-1800-0000-94a8-f8ed270f0000 pid=3879 /usr/bin/bash guuid=f1cbab0a-1800-0000-94a8-f8edd40d0000 pid=3540->guuid=e8ed336d-1800-0000-94a8-f8ed270f0000 pid=3879 clone guuid=3496866d-1800-0000-94a8-f8ed2b0f0000 pid=3883 /usr/bin/rm delete-file guuid=f1cbab0a-1800-0000-94a8-f8edd40d0000 pid=3540->guuid=3496866d-1800-0000-94a8-f8ed2b0f0000 pid=3883 execve guuid=a330f26d-1800-0000-94a8-f8ed2e0f0000 pid=3886 /usr/bin/rm guuid=f1cbab0a-1800-0000-94a8-f8edd40d0000 pid=3540->guuid=a330f26d-1800-0000-94a8-f8ed2e0f0000 pid=3886 execve guuid=4dd35c6e-1800-0000-94a8-f8ed300f0000 pid=3888 /usr/bin/wget net send-data guuid=f1cbab0a-1800-0000-94a8-f8edd40d0000 pid=3540->guuid=4dd35c6e-1800-0000-94a8-f8ed300f0000 pid=3888 execve guuid=72a1a971-1800-0000-94a8-f8ed360f0000 pid=3894 /usr/bin/curl net send-data write-file guuid=f1cbab0a-1800-0000-94a8-f8edd40d0000 pid=3540->guuid=72a1a971-1800-0000-94a8-f8ed360f0000 pid=3894 execve guuid=35cbca76-1800-0000-94a8-f8ed470f0000 pid=3911 /usr/bin/chmod guuid=f1cbab0a-1800-0000-94a8-f8edd40d0000 pid=3540->guuid=35cbca76-1800-0000-94a8-f8ed470f0000 pid=3911 execve guuid=29e83277-1800-0000-94a8-f8ed4a0f0000 pid=3914 /usr/bin/bash guuid=f1cbab0a-1800-0000-94a8-f8edd40d0000 pid=3540->guuid=29e83277-1800-0000-94a8-f8ed4a0f0000 pid=3914 clone guuid=fc599d77-1800-0000-94a8-f8ed4c0f0000 pid=3916 /usr/bin/rm delete-file guuid=f1cbab0a-1800-0000-94a8-f8edd40d0000 pid=3540->guuid=fc599d77-1800-0000-94a8-f8ed4c0f0000 pid=3916 execve guuid=51f0fb77-1800-0000-94a8-f8ed4d0f0000 pid=3917 /usr/bin/rm guuid=f1cbab0a-1800-0000-94a8-f8edd40d0000 pid=3540->guuid=51f0fb77-1800-0000-94a8-f8ed4d0f0000 pid=3917 execve guuid=b9874f78-1800-0000-94a8-f8ed4e0f0000 pid=3918 /usr/bin/wget net send-data guuid=f1cbab0a-1800-0000-94a8-f8edd40d0000 pid=3540->guuid=b9874f78-1800-0000-94a8-f8ed4e0f0000 pid=3918 execve guuid=4c81c77a-1800-0000-94a8-f8ed5b0f0000 pid=3931 /usr/bin/curl net send-data write-file guuid=f1cbab0a-1800-0000-94a8-f8edd40d0000 pid=3540->guuid=4c81c77a-1800-0000-94a8-f8ed5b0f0000 pid=3931 execve guuid=0bce277e-1800-0000-94a8-f8ed6d0f0000 pid=3949 /usr/bin/chmod guuid=f1cbab0a-1800-0000-94a8-f8edd40d0000 pid=3540->guuid=0bce277e-1800-0000-94a8-f8ed6d0f0000 pid=3949 execve guuid=bd696e7e-1800-0000-94a8-f8ed6f0f0000 pid=3951 /usr/bin/bash guuid=f1cbab0a-1800-0000-94a8-f8edd40d0000 pid=3540->guuid=bd696e7e-1800-0000-94a8-f8ed6f0f0000 pid=3951 clone guuid=04669f7e-1800-0000-94a8-f8ed720f0000 pid=3954 /usr/bin/rm delete-file guuid=f1cbab0a-1800-0000-94a8-f8edd40d0000 pid=3540->guuid=04669f7e-1800-0000-94a8-f8ed720f0000 pid=3954 execve guuid=dc6cef7e-1800-0000-94a8-f8ed740f0000 pid=3956 /usr/bin/rm guuid=f1cbab0a-1800-0000-94a8-f8edd40d0000 pid=3540->guuid=dc6cef7e-1800-0000-94a8-f8ed740f0000 pid=3956 execve guuid=2bc1337f-1800-0000-94a8-f8ed750f0000 pid=3957 /usr/bin/wget net send-data guuid=f1cbab0a-1800-0000-94a8-f8edd40d0000 pid=3540->guuid=2bc1337f-1800-0000-94a8-f8ed750f0000 pid=3957 execve guuid=bf89b581-1800-0000-94a8-f8ed810f0000 pid=3969 /usr/bin/curl net send-data write-file guuid=f1cbab0a-1800-0000-94a8-f8edd40d0000 pid=3540->guuid=bf89b581-1800-0000-94a8-f8ed810f0000 pid=3969 execve guuid=6a85db88-1800-0000-94a8-f8ed910f0000 pid=3985 /usr/bin/chmod guuid=f1cbab0a-1800-0000-94a8-f8edd40d0000 pid=3540->guuid=6a85db88-1800-0000-94a8-f8ed910f0000 pid=3985 execve guuid=129a1689-1800-0000-94a8-f8ed920f0000 pid=3986 /usr/bin/bash guuid=f1cbab0a-1800-0000-94a8-f8edd40d0000 pid=3540->guuid=129a1689-1800-0000-94a8-f8ed920f0000 pid=3986 clone guuid=7f214589-1800-0000-94a8-f8ed940f0000 pid=3988 /usr/bin/rm delete-file guuid=f1cbab0a-1800-0000-94a8-f8edd40d0000 pid=3540->guuid=7f214589-1800-0000-94a8-f8ed940f0000 pid=3988 execve guuid=f0967f89-1800-0000-94a8-f8ed950f0000 pid=3989 /usr/bin/rm guuid=f1cbab0a-1800-0000-94a8-f8edd40d0000 pid=3540->guuid=f0967f89-1800-0000-94a8-f8ed950f0000 pid=3989 execve 5b654972-c9e1-50d8-b372-2dc2a5b9ad66 5.182.210.174:80 guuid=e1aa820b-1800-0000-94a8-f8edd50d0000 pid=3541->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=b2a9f012-1800-0000-94a8-f8eddd0d0000 pid=3549->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=d0a8c41f-1800-0000-94a8-f8edf30d0000 pid=3571 /usr/bin/bash guuid=674ba31f-1800-0000-94a8-f8edf20d0000 pid=3570->guuid=d0a8c41f-1800-0000-94a8-f8edf30d0000 pid=3571 clone guuid=deb19420-1800-0000-94a8-f8edf80d0000 pid=3576->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=a3c5da23-1800-0000-94a8-f8ed060e0000 pid=3590->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=9b264c2d-1800-0000-94a8-f8ed2d0e0000 pid=3629 /usr/bin/bash guuid=6f45332d-1800-0000-94a8-f8ed2b0e0000 pid=3627->guuid=9b264c2d-1800-0000-94a8-f8ed2d0e0000 pid=3629 clone guuid=8926f22d-1800-0000-94a8-f8ed320e0000 pid=3634->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=42d98d31-1800-0000-94a8-f8ed3f0e0000 pid=3647->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=9b10cf36-1800-0000-94a8-f8ed4f0e0000 pid=3663 /usr/bin/bash guuid=c86fb036-1800-0000-94a8-f8ed4d0e0000 pid=3661->guuid=9b10cf36-1800-0000-94a8-f8ed4f0e0000 pid=3663 clone guuid=336aac37-1800-0000-94a8-f8ed580e0000 pid=3672->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=88125b3a-1800-0000-94a8-f8ed620e0000 pid=3682->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=ea72f13e-1800-0000-94a8-f8ed740e0000 pid=3700 /usr/bin/bash guuid=9da3d93e-1800-0000-94a8-f8ed730e0000 pid=3699->guuid=ea72f13e-1800-0000-94a8-f8ed740e0000 pid=3700 clone guuid=85d6a33f-1800-0000-94a8-f8ed7b0e0000 pid=3707->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=d9c70f42-1800-0000-94a8-f8ed8e0e0000 pid=3726->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=af088e46-1800-0000-94a8-f8eda00e0000 pid=3744 /usr/bin/bash guuid=349f7946-1800-0000-94a8-f8ed9f0e0000 pid=3743->guuid=af088e46-1800-0000-94a8-f8eda00e0000 pid=3744 clone guuid=dda54347-1800-0000-94a8-f8eda80e0000 pid=3752->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=fd3dc649-1800-0000-94a8-f8edb30e0000 pid=3763->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=27b6834d-1800-0000-94a8-f8edc40e0000 pid=3780 /usr/bin/bash guuid=d7916c4d-1800-0000-94a8-f8edc30e0000 pid=3779->guuid=27b6834d-1800-0000-94a8-f8edc40e0000 pid=3780 clone guuid=fad13c4e-1800-0000-94a8-f8edc90e0000 pid=3785->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=2e445951-1800-0000-94a8-f8edd50e0000 pid=3797->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=ee82135b-1800-0000-94a8-f8ede40e0000 pid=3812 /usr/bin/bash guuid=401fda5a-1800-0000-94a8-f8ede30e0000 pid=3811->guuid=ee82135b-1800-0000-94a8-f8ede40e0000 pid=3812 clone guuid=67d8465c-1800-0000-94a8-f8edea0e0000 pid=3818->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=9557495f-1800-0000-94a8-f8edf30e0000 pid=3827->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=f3bfd463-1800-0000-94a8-f8ed000f0000 pid=3840 /usr/bin/bash guuid=900dbc63-1800-0000-94a8-f8edfe0e0000 pid=3838->guuid=f3bfd463-1800-0000-94a8-f8ed000f0000 pid=3840 clone guuid=6d0e7d64-1800-0000-94a8-f8ed050f0000 pid=3845->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=7066f866-1800-0000-94a8-f8ed110f0000 pid=3857->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=97ec566d-1800-0000-94a8-f8ed290f0000 pid=3881 /usr/bin/bash guuid=e8ed336d-1800-0000-94a8-f8ed270f0000 pid=3879->guuid=97ec566d-1800-0000-94a8-f8ed290f0000 pid=3881 clone guuid=4dd35c6e-1800-0000-94a8-f8ed300f0000 pid=3888->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=72a1a971-1800-0000-94a8-f8ed360f0000 pid=3894->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=7fd15877-1800-0000-94a8-f8ed4b0f0000 pid=3915 /usr/bin/bash guuid=29e83277-1800-0000-94a8-f8ed4a0f0000 pid=3914->guuid=7fd15877-1800-0000-94a8-f8ed4b0f0000 pid=3915 clone guuid=b9874f78-1800-0000-94a8-f8ed4e0f0000 pid=3918->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=4c81c77a-1800-0000-94a8-f8ed5b0f0000 pid=3931->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=2cf1827e-1800-0000-94a8-f8ed700f0000 pid=3952 /usr/bin/bash guuid=bd696e7e-1800-0000-94a8-f8ed6f0f0000 pid=3951->guuid=2cf1827e-1800-0000-94a8-f8ed700f0000 pid=3952 clone guuid=2bc1337f-1800-0000-94a8-f8ed750f0000 pid=3957->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=bf89b581-1800-0000-94a8-f8ed810f0000 pid=3969->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=d76f2b89-1800-0000-94a8-f8ed930f0000 pid=3987 /usr/bin/bash guuid=129a1689-1800-0000-94a8-f8ed920f0000 pid=3986->guuid=d76f2b89-1800-0000-94a8-f8ed930f0000 pid=3987 clone
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/5defeb91306afab4c73faed6a436bed659f6b19f31d7e86f4063bab5e2abd3cd
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5defeb91306afab4c73faed6a436bed659f6b19f31d7e86f4063bab5e2abd3cd/
Threat name:
Linux.Trojan.Egairtigado
Create hunting rule
Status:
Malicious
First seen:
2026-08-24 13:23:17 UTC
File Type:
Text (Shell)
AV detection:
13 of 24 (54.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lxx6xejqnl5ljrz7v3lkinv62zm7nmm7ghl6q32amo5llyvl2pgq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260824-qmvpratyey/
Behaviour
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.11
Link:
https://yomi.yoroi.company/submissions/5defeb91306afab4c73faed6a436bed659f6b19f31d7e86f4063bab5e2abd3cd

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 5defeb91306afab4c73faed6a436bed659f6b19f31d7e86f4063bab5e2abd3cd

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3897671/
  
Delivery method
Distributed via web download

Comments