MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6281d4d089723c18509b01e16d02e7b15a67eeddaa04f17228b8b5f6ef857e98. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6281d4d089723c18509b01e16d02e7b15a67eeddaa04f17228b8b5f6ef857e98
SHA3-384 hash: c9215065e4f4de542b30bd6d62cc4a077972102194d6ddd65cd42f4692a29afaf2723157c0fee704bfb3b7e184596d67
SHA1 hash: 7fdefe9810c9fccebd242832cac05478597141b1
MD5 hash: 8cd9e9a9951dbf9920ef9498338fbe29
humanhash: east-batman-cat-hotel
File name:ok
Download: download sample
File size:1'608 bytes
First seen:2026-08-13 20:12:53 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 12:UYI6YngFD9FVB376FVBAhSN5i6N5UPYe89W0aI60aFuzlBK6BGva657eNCI6CMWd:E21NUfVao9JaEaMvvWvSMyo8c5EJOk
TLSH T17C31B1CA11105A310143E94E77B23148B68EE6FB2C4FE7D5D95D0EE992883CCF2A1B8D
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://5.182.210.174/748306n/an/aua-wget
http://5.182.210.174/1b9ac2n/an/aua-wget
http://5.182.210.174/98953an/an/aua-wget
http://5.182.210.174/3cf53cn/an/aua-wget
http://5.182.210.174/51fc22n/an/aua-wget
http://5.182.210.174/035755n/an/aua-wget
http://5.182.210.174/c3106en/an/aua-wget
http://5.182.210.174/1d49ddn/an/aua-wget
http://5.182.210.174/dcdd69n/an/aua-wget
http://5.182.210.174/7a276an/an/aua-wget
http://5.182.210.174/61d4b3n/an/aua-wget
http://5.182.210.174/44066bn/an/aua-wget

Intelligence

File Origin
# of uploads :
1
# of downloads :
27
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive mirai
Link:
https://www.filescan.io/uploads/6a7e256f183bd8b2ebf71aa1/reports/c2761995-3a5e-47d5-89bc-62a79dcf873d/overview
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/6cef1f92-5c0d-4bba-a0b1-b85391f4c220
Behavior Graph:
Download SVG
%3 guuid=a79c7319-1900-0000-fd60-e0ffbe0c0000 pid=3262 /usr/bin/sudo guuid=7b7a041b-1900-0000-fd60-e0ffc30c0000 pid=3267 /tmp/sample.bin guuid=a79c7319-1900-0000-fd60-e0ffbe0c0000 pid=3262->guuid=7b7a041b-1900-0000-fd60-e0ffc30c0000 pid=3267 execve guuid=2d718b1b-1900-0000-fd60-e0ffc50c0000 pid=3269 /usr/bin/wget net send-data guuid=7b7a041b-1900-0000-fd60-e0ffc30c0000 pid=3267->guuid=2d718b1b-1900-0000-fd60-e0ffc50c0000 pid=3269 execve guuid=cf310920-1900-0000-fd60-e0ffd20c0000 pid=3282 /usr/bin/curl net send-data write-file guuid=7b7a041b-1900-0000-fd60-e0ffc30c0000 pid=3267->guuid=cf310920-1900-0000-fd60-e0ffd20c0000 pid=3282 execve guuid=d1029427-1900-0000-fd60-e0ffe40c0000 pid=3300 /usr/bin/chmod guuid=7b7a041b-1900-0000-fd60-e0ffc30c0000 pid=3267->guuid=d1029427-1900-0000-fd60-e0ffe40c0000 pid=3300 execve guuid=8e49f427-1900-0000-fd60-e0ffe70c0000 pid=3303 /usr/bin/bash guuid=7b7a041b-1900-0000-fd60-e0ffc30c0000 pid=3267->guuid=8e49f427-1900-0000-fd60-e0ffe70c0000 pid=3303 clone guuid=02185f28-1900-0000-fd60-e0ffea0c0000 pid=3306 /usr/bin/rm delete-file guuid=7b7a041b-1900-0000-fd60-e0ffc30c0000 pid=3267->guuid=02185f28-1900-0000-fd60-e0ffea0c0000 pid=3306 execve guuid=d9aaa328-1900-0000-fd60-e0ffec0c0000 pid=3308 /usr/bin/rm guuid=7b7a041b-1900-0000-fd60-e0ffc30c0000 pid=3267->guuid=d9aaa328-1900-0000-fd60-e0ffec0c0000 pid=3308 execve guuid=10ebe428-1900-0000-fd60-e0ffed0c0000 pid=3309 /usr/bin/wget net send-data guuid=7b7a041b-1900-0000-fd60-e0ffc30c0000 pid=3267->guuid=10ebe428-1900-0000-fd60-e0ffed0c0000 pid=3309 execve guuid=649a4f2b-1900-0000-fd60-e0fff60c0000 pid=3318 /usr/bin/curl net send-data write-file guuid=7b7a041b-1900-0000-fd60-e0ffc30c0000 pid=3267->guuid=649a4f2b-1900-0000-fd60-e0fff60c0000 pid=3318 execve guuid=a5f5bd2e-1900-0000-fd60-e0ffff0c0000 pid=3327 /usr/bin/chmod guuid=7b7a041b-1900-0000-fd60-e0ffc30c0000 pid=3267->guuid=a5f5bd2e-1900-0000-fd60-e0ffff0c0000 pid=3327 execve guuid=204e042f-1900-0000-fd60-e0ff010d0000 pid=3329 /usr/bin/bash guuid=7b7a041b-1900-0000-fd60-e0ffc30c0000 pid=3267->guuid=204e042f-1900-0000-fd60-e0ff010d0000 pid=3329 clone guuid=7c343c2f-1900-0000-fd60-e0ff040d0000 pid=3332 /usr/bin/rm delete-file guuid=7b7a041b-1900-0000-fd60-e0ffc30c0000 pid=3267->guuid=7c343c2f-1900-0000-fd60-e0ff040d0000 pid=3332 execve guuid=7b1c962f-1900-0000-fd60-e0ff060d0000 pid=3334 /usr/bin/rm guuid=7b7a041b-1900-0000-fd60-e0ffc30c0000 pid=3267->guuid=7b1c962f-1900-0000-fd60-e0ff060d0000 pid=3334 execve guuid=0c78fb2f-1900-0000-fd60-e0ff080d0000 pid=3336 /usr/bin/wget net send-data guuid=7b7a041b-1900-0000-fd60-e0ffc30c0000 pid=3267->guuid=0c78fb2f-1900-0000-fd60-e0ff080d0000 pid=3336 execve guuid=fcc90533-1900-0000-fd60-e0ff100d0000 pid=3344 /usr/bin/curl net send-data write-file guuid=7b7a041b-1900-0000-fd60-e0ffc30c0000 pid=3267->guuid=fcc90533-1900-0000-fd60-e0ff100d0000 pid=3344 execve guuid=8f7ec537-1900-0000-fd60-e0ff1b0d0000 pid=3355 /usr/bin/chmod guuid=7b7a041b-1900-0000-fd60-e0ffc30c0000 pid=3267->guuid=8f7ec537-1900-0000-fd60-e0ff1b0d0000 pid=3355 execve guuid=78857438-1900-0000-fd60-e0ff1e0d0000 pid=3358 /usr/bin/bash guuid=7b7a041b-1900-0000-fd60-e0ffc30c0000 pid=3267->guuid=78857438-1900-0000-fd60-e0ff1e0d0000 pid=3358 clone guuid=5da90539-1900-0000-fd60-e0ff220d0000 pid=3362 /usr/bin/rm delete-file guuid=7b7a041b-1900-0000-fd60-e0ffc30c0000 pid=3267->guuid=5da90539-1900-0000-fd60-e0ff220d0000 pid=3362 execve guuid=3fce9739-1900-0000-fd60-e0ff250d0000 pid=3365 /usr/bin/rm guuid=7b7a041b-1900-0000-fd60-e0ffc30c0000 pid=3267->guuid=3fce9739-1900-0000-fd60-e0ff250d0000 pid=3365 execve guuid=2095263a-1900-0000-fd60-e0ff270d0000 pid=3367 /usr/bin/wget net send-data guuid=7b7a041b-1900-0000-fd60-e0ffc30c0000 pid=3267->guuid=2095263a-1900-0000-fd60-e0ff270d0000 pid=3367 execve guuid=d88cbe3d-1900-0000-fd60-e0ff310d0000 pid=3377 /usr/bin/curl net send-data write-file guuid=7b7a041b-1900-0000-fd60-e0ffc30c0000 pid=3267->guuid=d88cbe3d-1900-0000-fd60-e0ff310d0000 pid=3377 execve guuid=52150a44-1900-0000-fd60-e0ff3b0d0000 pid=3387 /usr/bin/chmod guuid=7b7a041b-1900-0000-fd60-e0ffc30c0000 pid=3267->guuid=52150a44-1900-0000-fd60-e0ff3b0d0000 pid=3387 execve guuid=90487344-1900-0000-fd60-e0ff3d0d0000 pid=3389 /usr/bin/bash guuid=7b7a041b-1900-0000-fd60-e0ffc30c0000 pid=3267->guuid=90487344-1900-0000-fd60-e0ff3d0d0000 pid=3389 clone guuid=7aa2de44-1900-0000-fd60-e0ff400d0000 pid=3392 /usr/bin/rm delete-file guuid=7b7a041b-1900-0000-fd60-e0ffc30c0000 pid=3267->guuid=7aa2de44-1900-0000-fd60-e0ff400d0000 pid=3392 execve guuid=04be7a45-1900-0000-fd60-e0ff440d0000 pid=3396 /usr/bin/rm guuid=7b7a041b-1900-0000-fd60-e0ffc30c0000 pid=3267->guuid=04be7a45-1900-0000-fd60-e0ff440d0000 pid=3396 execve guuid=2ddcc345-1900-0000-fd60-e0ff460d0000 pid=3398 /usr/bin/wget net send-data guuid=7b7a041b-1900-0000-fd60-e0ffc30c0000 pid=3267->guuid=2ddcc345-1900-0000-fd60-e0ff460d0000 pid=3398 execve guuid=a53fbb4a-1900-0000-fd60-e0ff470d0000 pid=3399 /usr/bin/curl net send-data write-file guuid=7b7a041b-1900-0000-fd60-e0ffc30c0000 pid=3267->guuid=a53fbb4a-1900-0000-fd60-e0ff470d0000 pid=3399 execve guuid=5b408f4f-1900-0000-fd60-e0ff4f0d0000 pid=3407 /usr/bin/chmod guuid=7b7a041b-1900-0000-fd60-e0ffc30c0000 pid=3267->guuid=5b408f4f-1900-0000-fd60-e0ff4f0d0000 pid=3407 execve guuid=6a01f24f-1900-0000-fd60-e0ff500d0000 pid=3408 /usr/bin/bash guuid=7b7a041b-1900-0000-fd60-e0ffc30c0000 pid=3267->guuid=6a01f24f-1900-0000-fd60-e0ff500d0000 pid=3408 clone guuid=ccfe3e50-1900-0000-fd60-e0ff530d0000 pid=3411 /usr/bin/rm delete-file guuid=7b7a041b-1900-0000-fd60-e0ffc30c0000 pid=3267->guuid=ccfe3e50-1900-0000-fd60-e0ff530d0000 pid=3411 execve guuid=a7fca350-1900-0000-fd60-e0ff550d0000 pid=3413 /usr/bin/rm guuid=7b7a041b-1900-0000-fd60-e0ffc30c0000 pid=3267->guuid=a7fca350-1900-0000-fd60-e0ff550d0000 pid=3413 execve guuid=78730251-1900-0000-fd60-e0ff570d0000 pid=3415 /usr/bin/wget net send-data guuid=7b7a041b-1900-0000-fd60-e0ffc30c0000 pid=3267->guuid=78730251-1900-0000-fd60-e0ff570d0000 pid=3415 execve guuid=1b568453-1900-0000-fd60-e0ff5b0d0000 pid=3419 /usr/bin/curl net send-data write-file guuid=7b7a041b-1900-0000-fd60-e0ffc30c0000 pid=3267->guuid=1b568453-1900-0000-fd60-e0ff5b0d0000 pid=3419 execve guuid=c8a6be58-1900-0000-fd60-e0ff5c0d0000 pid=3420 /usr/bin/chmod guuid=7b7a041b-1900-0000-fd60-e0ffc30c0000 pid=3267->guuid=c8a6be58-1900-0000-fd60-e0ff5c0d0000 pid=3420 execve guuid=6d723859-1900-0000-fd60-e0ff5d0d0000 pid=3421 /usr/bin/bash guuid=7b7a041b-1900-0000-fd60-e0ffc30c0000 pid=3267->guuid=6d723859-1900-0000-fd60-e0ff5d0d0000 pid=3421 clone guuid=814e8359-1900-0000-fd60-e0ff5f0d0000 pid=3423 /usr/bin/rm delete-file guuid=7b7a041b-1900-0000-fd60-e0ffc30c0000 pid=3267->guuid=814e8359-1900-0000-fd60-e0ff5f0d0000 pid=3423 execve guuid=8bcef259-1900-0000-fd60-e0ff600d0000 pid=3424 /usr/bin/rm guuid=7b7a041b-1900-0000-fd60-e0ffc30c0000 pid=3267->guuid=8bcef259-1900-0000-fd60-e0ff600d0000 pid=3424 execve guuid=bd30805a-1900-0000-fd60-e0ff610d0000 pid=3425 /usr/bin/wget net send-data guuid=7b7a041b-1900-0000-fd60-e0ffc30c0000 pid=3267->guuid=bd30805a-1900-0000-fd60-e0ff610d0000 pid=3425 execve guuid=b409765d-1900-0000-fd60-e0ff620d0000 pid=3426 /usr/bin/curl net send-data write-file guuid=7b7a041b-1900-0000-fd60-e0ffc30c0000 pid=3267->guuid=b409765d-1900-0000-fd60-e0ff620d0000 pid=3426 execve guuid=12932e62-1900-0000-fd60-e0ff630d0000 pid=3427 /usr/bin/chmod guuid=7b7a041b-1900-0000-fd60-e0ffc30c0000 pid=3267->guuid=12932e62-1900-0000-fd60-e0ff630d0000 pid=3427 execve guuid=0e429b62-1900-0000-fd60-e0ff640d0000 pid=3428 /usr/bin/bash guuid=7b7a041b-1900-0000-fd60-e0ffc30c0000 pid=3267->guuid=0e429b62-1900-0000-fd60-e0ff640d0000 pid=3428 clone guuid=b9b8d862-1900-0000-fd60-e0ff660d0000 pid=3430 /usr/bin/rm delete-file guuid=7b7a041b-1900-0000-fd60-e0ffc30c0000 pid=3267->guuid=b9b8d862-1900-0000-fd60-e0ff660d0000 pid=3430 execve guuid=a26d4363-1900-0000-fd60-e0ff670d0000 pid=3431 /usr/bin/rm guuid=7b7a041b-1900-0000-fd60-e0ffc30c0000 pid=3267->guuid=a26d4363-1900-0000-fd60-e0ff670d0000 pid=3431 execve guuid=bcc18663-1900-0000-fd60-e0ff680d0000 pid=3432 /usr/bin/wget net send-data guuid=7b7a041b-1900-0000-fd60-e0ffc30c0000 pid=3267->guuid=bcc18663-1900-0000-fd60-e0ff680d0000 pid=3432 execve guuid=b781f865-1900-0000-fd60-e0ff690d0000 pid=3433 /usr/bin/curl net send-data write-file guuid=7b7a041b-1900-0000-fd60-e0ffc30c0000 pid=3267->guuid=b781f865-1900-0000-fd60-e0ff690d0000 pid=3433 execve guuid=3b1a606b-1900-0000-fd60-e0ff6a0d0000 pid=3434 /usr/bin/chmod guuid=7b7a041b-1900-0000-fd60-e0ffc30c0000 pid=3267->guuid=3b1a606b-1900-0000-fd60-e0ff6a0d0000 pid=3434 execve guuid=8d17c76b-1900-0000-fd60-e0ff6b0d0000 pid=3435 /usr/bin/bash guuid=7b7a041b-1900-0000-fd60-e0ffc30c0000 pid=3267->guuid=8d17c76b-1900-0000-fd60-e0ff6b0d0000 pid=3435 clone guuid=d939216c-1900-0000-fd60-e0ff6d0d0000 pid=3437 /usr/bin/rm delete-file guuid=7b7a041b-1900-0000-fd60-e0ffc30c0000 pid=3267->guuid=d939216c-1900-0000-fd60-e0ff6d0d0000 pid=3437 execve guuid=ed6d786c-1900-0000-fd60-e0ff6e0d0000 pid=3438 /usr/bin/rm guuid=7b7a041b-1900-0000-fd60-e0ffc30c0000 pid=3267->guuid=ed6d786c-1900-0000-fd60-e0ff6e0d0000 pid=3438 execve guuid=bd2efa6c-1900-0000-fd60-e0ff6f0d0000 pid=3439 /usr/bin/wget net send-data guuid=7b7a041b-1900-0000-fd60-e0ffc30c0000 pid=3267->guuid=bd2efa6c-1900-0000-fd60-e0ff6f0d0000 pid=3439 execve guuid=8a77976f-1900-0000-fd60-e0ff700d0000 pid=3440 /usr/bin/curl net send-data write-file guuid=7b7a041b-1900-0000-fd60-e0ffc30c0000 pid=3267->guuid=8a77976f-1900-0000-fd60-e0ff700d0000 pid=3440 execve guuid=1a641474-1900-0000-fd60-e0ff720d0000 pid=3442 /usr/bin/chmod guuid=7b7a041b-1900-0000-fd60-e0ffc30c0000 pid=3267->guuid=1a641474-1900-0000-fd60-e0ff720d0000 pid=3442 execve guuid=dada8774-1900-0000-fd60-e0ff730d0000 pid=3443 /usr/bin/bash guuid=7b7a041b-1900-0000-fd60-e0ffc30c0000 pid=3267->guuid=dada8774-1900-0000-fd60-e0ff730d0000 pid=3443 clone guuid=2d219877-1900-0000-fd60-e0ff750d0000 pid=3445 /usr/bin/rm delete-file guuid=7b7a041b-1900-0000-fd60-e0ffc30c0000 pid=3267->guuid=2d219877-1900-0000-fd60-e0ff750d0000 pid=3445 execve guuid=197a1078-1900-0000-fd60-e0ff770d0000 pid=3447 /usr/bin/rm guuid=7b7a041b-1900-0000-fd60-e0ffc30c0000 pid=3267->guuid=197a1078-1900-0000-fd60-e0ff770d0000 pid=3447 execve guuid=5ac56d78-1900-0000-fd60-e0ff780d0000 pid=3448 /usr/bin/wget net send-data guuid=7b7a041b-1900-0000-fd60-e0ffc30c0000 pid=3267->guuid=5ac56d78-1900-0000-fd60-e0ff780d0000 pid=3448 execve guuid=ec07917b-1900-0000-fd60-e0ff7e0d0000 pid=3454 /usr/bin/curl net send-data write-file guuid=7b7a041b-1900-0000-fd60-e0ffc30c0000 pid=3267->guuid=ec07917b-1900-0000-fd60-e0ff7e0d0000 pid=3454 execve guuid=3aa35480-1900-0000-fd60-e0ff840d0000 pid=3460 /usr/bin/chmod guuid=7b7a041b-1900-0000-fd60-e0ffc30c0000 pid=3267->guuid=3aa35480-1900-0000-fd60-e0ff840d0000 pid=3460 execve guuid=186ab280-1900-0000-fd60-e0ff860d0000 pid=3462 /usr/bin/bash guuid=7b7a041b-1900-0000-fd60-e0ffc30c0000 pid=3267->guuid=186ab280-1900-0000-fd60-e0ff860d0000 pid=3462 clone guuid=ff04f480-1900-0000-fd60-e0ff880d0000 pid=3464 /usr/bin/rm delete-file guuid=7b7a041b-1900-0000-fd60-e0ffc30c0000 pid=3267->guuid=ff04f480-1900-0000-fd60-e0ff880d0000 pid=3464 execve guuid=a5bc4c81-1900-0000-fd60-e0ff8a0d0000 pid=3466 /usr/bin/rm guuid=7b7a041b-1900-0000-fd60-e0ffc30c0000 pid=3267->guuid=a5bc4c81-1900-0000-fd60-e0ff8a0d0000 pid=3466 execve guuid=ba72a081-1900-0000-fd60-e0ff8c0d0000 pid=3468 /usr/bin/wget net send-data guuid=7b7a041b-1900-0000-fd60-e0ffc30c0000 pid=3267->guuid=ba72a081-1900-0000-fd60-e0ff8c0d0000 pid=3468 execve guuid=96ef3084-1900-0000-fd60-e0ff940d0000 pid=3476 /usr/bin/curl net send-data write-file guuid=7b7a041b-1900-0000-fd60-e0ffc30c0000 pid=3267->guuid=96ef3084-1900-0000-fd60-e0ff940d0000 pid=3476 execve guuid=6b2bc589-1900-0000-fd60-e0ff980d0000 pid=3480 /usr/bin/chmod guuid=7b7a041b-1900-0000-fd60-e0ffc30c0000 pid=3267->guuid=6b2bc589-1900-0000-fd60-e0ff980d0000 pid=3480 execve guuid=6d39108a-1900-0000-fd60-e0ff990d0000 pid=3481 /usr/bin/bash guuid=7b7a041b-1900-0000-fd60-e0ffc30c0000 pid=3267->guuid=6d39108a-1900-0000-fd60-e0ff990d0000 pid=3481 clone guuid=0272508a-1900-0000-fd60-e0ff9b0d0000 pid=3483 /usr/bin/rm delete-file guuid=7b7a041b-1900-0000-fd60-e0ffc30c0000 pid=3267->guuid=0272508a-1900-0000-fd60-e0ff9b0d0000 pid=3483 execve guuid=3c22ac8a-1900-0000-fd60-e0ff9c0d0000 pid=3484 /usr/bin/rm guuid=7b7a041b-1900-0000-fd60-e0ffc30c0000 pid=3267->guuid=3c22ac8a-1900-0000-fd60-e0ff9c0d0000 pid=3484 execve guuid=4d9ff68a-1900-0000-fd60-e0ff9d0d0000 pid=3485 /usr/bin/wget net send-data guuid=7b7a041b-1900-0000-fd60-e0ffc30c0000 pid=3267->guuid=4d9ff68a-1900-0000-fd60-e0ff9d0d0000 pid=3485 execve guuid=24797d8d-1900-0000-fd60-e0ffa60d0000 pid=3494 /usr/bin/curl net send-data write-file guuid=7b7a041b-1900-0000-fd60-e0ffc30c0000 pid=3267->guuid=24797d8d-1900-0000-fd60-e0ffa60d0000 pid=3494 execve guuid=5e9ee091-1900-0000-fd60-e0ffb10d0000 pid=3505 /usr/bin/chmod guuid=7b7a041b-1900-0000-fd60-e0ffc30c0000 pid=3267->guuid=5e9ee091-1900-0000-fd60-e0ffb10d0000 pid=3505 execve guuid=b3c35892-1900-0000-fd60-e0ffb40d0000 pid=3508 /usr/bin/bash guuid=7b7a041b-1900-0000-fd60-e0ffc30c0000 pid=3267->guuid=b3c35892-1900-0000-fd60-e0ffb40d0000 pid=3508 clone guuid=ea9ccc92-1900-0000-fd60-e0ffb80d0000 pid=3512 /usr/bin/rm delete-file guuid=7b7a041b-1900-0000-fd60-e0ffc30c0000 pid=3267->guuid=ea9ccc92-1900-0000-fd60-e0ffb80d0000 pid=3512 execve guuid=d07e4093-1900-0000-fd60-e0ffbb0d0000 pid=3515 /usr/bin/rm guuid=7b7a041b-1900-0000-fd60-e0ffc30c0000 pid=3267->guuid=d07e4093-1900-0000-fd60-e0ffbb0d0000 pid=3515 execve 5b654972-c9e1-50d8-b372-2dc2a5b9ad66 5.182.210.174:80 guuid=2d718b1b-1900-0000-fd60-e0ffc50c0000 pid=3269->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=cf310920-1900-0000-fd60-e0ffd20c0000 pid=3282->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=94d42c28-1900-0000-fd60-e0ffe90c0000 pid=3305 /usr/bin/bash guuid=8e49f427-1900-0000-fd60-e0ffe70c0000 pid=3303->guuid=94d42c28-1900-0000-fd60-e0ffe90c0000 pid=3305 clone guuid=10ebe428-1900-0000-fd60-e0ffed0c0000 pid=3309->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=649a4f2b-1900-0000-fd60-e0fff60c0000 pid=3318->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=ea471b2f-1900-0000-fd60-e0ff030d0000 pid=3331 /usr/bin/bash guuid=204e042f-1900-0000-fd60-e0ff010d0000 pid=3329->guuid=ea471b2f-1900-0000-fd60-e0ff030d0000 pid=3331 clone guuid=0c78fb2f-1900-0000-fd60-e0ff080d0000 pid=3336->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=fcc90533-1900-0000-fd60-e0ff100d0000 pid=3344->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=26cfbb38-1900-0000-fd60-e0ff200d0000 pid=3360 /usr/bin/bash guuid=78857438-1900-0000-fd60-e0ff1e0d0000 pid=3358->guuid=26cfbb38-1900-0000-fd60-e0ff200d0000 pid=3360 clone guuid=2095263a-1900-0000-fd60-e0ff270d0000 pid=3367->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=d88cbe3d-1900-0000-fd60-e0ff310d0000 pid=3377->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=32a7a244-1900-0000-fd60-e0ff3e0d0000 pid=3390 /usr/bin/bash guuid=90487344-1900-0000-fd60-e0ff3d0d0000 pid=3389->guuid=32a7a244-1900-0000-fd60-e0ff3e0d0000 pid=3390 clone guuid=2ddcc345-1900-0000-fd60-e0ff460d0000 pid=3398->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=a53fbb4a-1900-0000-fd60-e0ff470d0000 pid=3399->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=f2b01350-1900-0000-fd60-e0ff520d0000 pid=3410 /usr/bin/bash guuid=6a01f24f-1900-0000-fd60-e0ff500d0000 pid=3408->guuid=f2b01350-1900-0000-fd60-e0ff520d0000 pid=3410 clone guuid=78730251-1900-0000-fd60-e0ff570d0000 pid=3415->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=1b568453-1900-0000-fd60-e0ff5b0d0000 pid=3419->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=53486059-1900-0000-fd60-e0ff5e0d0000 pid=3422 /usr/bin/bash guuid=6d723859-1900-0000-fd60-e0ff5d0d0000 pid=3421->guuid=53486059-1900-0000-fd60-e0ff5e0d0000 pid=3422 clone guuid=bd30805a-1900-0000-fd60-e0ff610d0000 pid=3425->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=b409765d-1900-0000-fd60-e0ff620d0000 pid=3426->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=69cfb162-1900-0000-fd60-e0ff650d0000 pid=3429 /usr/bin/bash guuid=0e429b62-1900-0000-fd60-e0ff640d0000 pid=3428->guuid=69cfb162-1900-0000-fd60-e0ff650d0000 pid=3429 clone guuid=bcc18663-1900-0000-fd60-e0ff680d0000 pid=3432->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=b781f865-1900-0000-fd60-e0ff690d0000 pid=3433->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=b281ed6b-1900-0000-fd60-e0ff6c0d0000 pid=3436 /usr/bin/bash guuid=8d17c76b-1900-0000-fd60-e0ff6b0d0000 pid=3435->guuid=b281ed6b-1900-0000-fd60-e0ff6c0d0000 pid=3436 clone guuid=bd2efa6c-1900-0000-fd60-e0ff6f0d0000 pid=3439->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=8a77976f-1900-0000-fd60-e0ff700d0000 pid=3440->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=42b85777-1900-0000-fd60-e0ff740d0000 pid=3444 /usr/bin/bash guuid=dada8774-1900-0000-fd60-e0ff730d0000 pid=3443->guuid=42b85777-1900-0000-fd60-e0ff740d0000 pid=3444 clone guuid=5ac56d78-1900-0000-fd60-e0ff780d0000 pid=3448->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=ec07917b-1900-0000-fd60-e0ff7e0d0000 pid=3454->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=91e3cd80-1900-0000-fd60-e0ff870d0000 pid=3463 /usr/bin/bash guuid=186ab280-1900-0000-fd60-e0ff860d0000 pid=3462->guuid=91e3cd80-1900-0000-fd60-e0ff870d0000 pid=3463 clone guuid=ba72a081-1900-0000-fd60-e0ff8c0d0000 pid=3468->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=96ef3084-1900-0000-fd60-e0ff940d0000 pid=3476->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=066c308a-1900-0000-fd60-e0ff9a0d0000 pid=3482 /usr/bin/bash guuid=6d39108a-1900-0000-fd60-e0ff990d0000 pid=3481->guuid=066c308a-1900-0000-fd60-e0ff9a0d0000 pid=3482 clone guuid=4d9ff68a-1900-0000-fd60-e0ff9d0d0000 pid=3485->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=24797d8d-1900-0000-fd60-e0ffa60d0000 pid=3494->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=8cd58592-1900-0000-fd60-e0ffb60d0000 pid=3510 /usr/bin/bash guuid=b3c35892-1900-0000-fd60-e0ffb40d0000 pid=3508->guuid=8cd58592-1900-0000-fd60-e0ffb60d0000 pid=3510 clone
Score:
99%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/6281d4d089723c18509b01e16d02e7b15a67eeddaa04f17228b8b5f6ef857e98
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6281d4d089723c18509b01e16d02e7b15a67eeddaa04f17228b8b5f6ef857e98/
Threat name:
Linux.Downloader.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-08-13 20:13:37 UTC
File Type:
Text (Shell)
AV detection:
12 of 36 (33.33%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mka5juejoi6bque3ahqw2axhwfngp3w5vicpc4rixc27n34fp2ma._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260813-yzpchafj5s/
Behaviour
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.11
Link:
https://yomi.yoroi.company/submissions/6281d4d089723c18509b01e16d02e7b15a67eeddaa04f17228b8b5f6ef857e98

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 6281d4d089723c18509b01e16d02e7b15a67eeddaa04f17228b8b5f6ef857e98

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3897671/
  
Delivery method
Distributed via web download

Comments