🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 69f56b1f300ead7b60d5b0f74acc595e75d348f2d5f0c1ed9a1b0bceb1eaee9a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 69f56b1f300ead7b60d5b0f74acc595e75d348f2d5f0c1ed9a1b0bceb1eaee9a
SHA3-384 hash: e0e46354d8fe6f9eb9b483cff82484c16302d76ed28e2de5aacdea3a1bde2c9a5637893ed48e5e0daf337c6dd64c4a64
SHA1 hash: f24adf0508cf619dd6705f784e2a113ea87f5fd1
MD5 hash: 058906b26e948a3f847028100e40adb9
humanhash: ack-kitten-beryllium-johnny
File name:ok
Download: download sample
File size:1'608 bytes
First seen:2026-08-27 02:33:40 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 24:zwKw3wWEJ2wCpx7gegouJu/w2HDcSHFFHFPF+E9FQPwQIn:zfmEQxtffH3HVM4d
TLSH T12F3148DA05181A351103CE9E77A6359CA29EF1F72C9FCBD4D9490FA9418C68CF262B1A
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://5.182.210.174/b87248n/an/an/a
http://5.182.210.174/444233n/an/an/a
http://5.182.210.174/8e8453n/an/an/a
http://5.182.210.174/bbf6ccn/an/an/a
http://5.182.210.174/ba8634n/an/an/a
http://5.182.210.174/e23be8n/an/an/a
http://5.182.210.174/301c0an/an/an/a
http://5.182.210.174/db5ca4n/an/an/a
http://5.182.210.174/21963fn/an/an/a
http://5.182.210.174/c9c7cfn/an/an/a
http://5.182.210.174/af259en/an/an/a
http://5.182.210.174/38b25dn/an/an/a

Intelligence

File Origin
# of uploads :
1
# of downloads :
67
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-08-27T00:47:00Z UTC
Last seen:
2026-08-27T06:40:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/69f56b1f300ead7b60d5b0f74acc595e75d348f2d5f0c1ed9a1b0bceb1eaee9a/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/e26ab431-6da5-44b3-a9dd-ee82d7b412a0
Behavior Graph:
Download SVG
%3 guuid=4267d604-1a00-0000-198c-2f3d420b0000 pid=2882 /usr/bin/sudo guuid=13b4d607-1a00-0000-198c-2f3d4b0b0000 pid=2891 /tmp/sample.bin guuid=4267d604-1a00-0000-198c-2f3d420b0000 pid=2882->guuid=13b4d607-1a00-0000-198c-2f3d4b0b0000 pid=2891 execve guuid=9feb6408-1a00-0000-198c-2f3d4d0b0000 pid=2893 /usr/bin/wget net send-data guuid=13b4d607-1a00-0000-198c-2f3d4b0b0000 pid=2891->guuid=9feb6408-1a00-0000-198c-2f3d4d0b0000 pid=2893 execve guuid=39511910-1a00-0000-198c-2f3d580b0000 pid=2904 /usr/bin/curl net send-data write-file guuid=13b4d607-1a00-0000-198c-2f3d4b0b0000 pid=2891->guuid=39511910-1a00-0000-198c-2f3d580b0000 pid=2904 execve guuid=4cf5ed1b-1a00-0000-198c-2f3d6f0b0000 pid=2927 /usr/bin/chmod guuid=13b4d607-1a00-0000-198c-2f3d4b0b0000 pid=2891->guuid=4cf5ed1b-1a00-0000-198c-2f3d6f0b0000 pid=2927 execve guuid=2d4a6b1c-1a00-0000-198c-2f3d710b0000 pid=2929 /usr/bin/bash guuid=13b4d607-1a00-0000-198c-2f3d4b0b0000 pid=2891->guuid=2d4a6b1c-1a00-0000-198c-2f3d710b0000 pid=2929 clone guuid=6105cb1c-1a00-0000-198c-2f3d740b0000 pid=2932 /usr/bin/rm delete-file guuid=13b4d607-1a00-0000-198c-2f3d4b0b0000 pid=2891->guuid=6105cb1c-1a00-0000-198c-2f3d740b0000 pid=2932 execve guuid=0d91361d-1a00-0000-198c-2f3d760b0000 pid=2934 /usr/bin/rm guuid=13b4d607-1a00-0000-198c-2f3d4b0b0000 pid=2891->guuid=0d91361d-1a00-0000-198c-2f3d760b0000 pid=2934 execve guuid=ed70ad1d-1a00-0000-198c-2f3d780b0000 pid=2936 /usr/bin/wget net send-data guuid=13b4d607-1a00-0000-198c-2f3d4b0b0000 pid=2891->guuid=ed70ad1d-1a00-0000-198c-2f3d780b0000 pid=2936 execve guuid=32d20621-1a00-0000-198c-2f3d820b0000 pid=2946 /usr/bin/curl net send-data write-file guuid=13b4d607-1a00-0000-198c-2f3d4b0b0000 pid=2891->guuid=32d20621-1a00-0000-198c-2f3d820b0000 pid=2946 execve guuid=c1421d28-1a00-0000-198c-2f3d920b0000 pid=2962 /usr/bin/chmod guuid=13b4d607-1a00-0000-198c-2f3d4b0b0000 pid=2891->guuid=c1421d28-1a00-0000-198c-2f3d920b0000 pid=2962 execve guuid=9ae37a28-1a00-0000-198c-2f3d940b0000 pid=2964 /usr/bin/bash guuid=13b4d607-1a00-0000-198c-2f3d4b0b0000 pid=2891->guuid=9ae37a28-1a00-0000-198c-2f3d940b0000 pid=2964 clone guuid=c23fc028-1a00-0000-198c-2f3d970b0000 pid=2967 /usr/bin/rm delete-file guuid=13b4d607-1a00-0000-198c-2f3d4b0b0000 pid=2891->guuid=c23fc028-1a00-0000-198c-2f3d970b0000 pid=2967 execve guuid=cdcc0d29-1a00-0000-198c-2f3d990b0000 pid=2969 /usr/bin/rm guuid=13b4d607-1a00-0000-198c-2f3d4b0b0000 pid=2891->guuid=cdcc0d29-1a00-0000-198c-2f3d990b0000 pid=2969 execve guuid=33856e29-1a00-0000-198c-2f3d9b0b0000 pid=2971 /usr/bin/wget net send-data guuid=13b4d607-1a00-0000-198c-2f3d4b0b0000 pid=2891->guuid=33856e29-1a00-0000-198c-2f3d9b0b0000 pid=2971 execve guuid=880f162c-1a00-0000-198c-2f3da30b0000 pid=2979 /usr/bin/curl net send-data write-file guuid=13b4d607-1a00-0000-198c-2f3d4b0b0000 pid=2891->guuid=880f162c-1a00-0000-198c-2f3da30b0000 pid=2979 execve guuid=8aad3831-1a00-0000-198c-2f3daf0b0000 pid=2991 /usr/bin/chmod guuid=13b4d607-1a00-0000-198c-2f3d4b0b0000 pid=2891->guuid=8aad3831-1a00-0000-198c-2f3daf0b0000 pid=2991 execve guuid=48e88531-1a00-0000-198c-2f3db10b0000 pid=2993 /usr/bin/bash guuid=13b4d607-1a00-0000-198c-2f3d4b0b0000 pid=2891->guuid=48e88531-1a00-0000-198c-2f3db10b0000 pid=2993 clone guuid=111dc331-1a00-0000-198c-2f3db30b0000 pid=2995 /usr/bin/rm delete-file guuid=13b4d607-1a00-0000-198c-2f3d4b0b0000 pid=2891->guuid=111dc331-1a00-0000-198c-2f3db30b0000 pid=2995 execve guuid=395a2532-1a00-0000-198c-2f3db50b0000 pid=2997 /usr/bin/rm guuid=13b4d607-1a00-0000-198c-2f3d4b0b0000 pid=2891->guuid=395a2532-1a00-0000-198c-2f3db50b0000 pid=2997 execve guuid=32eb9532-1a00-0000-198c-2f3db60b0000 pid=2998 /usr/bin/wget net send-data guuid=13b4d607-1a00-0000-198c-2f3d4b0b0000 pid=2891->guuid=32eb9532-1a00-0000-198c-2f3db60b0000 pid=2998 execve guuid=35de6535-1a00-0000-198c-2f3dbe0b0000 pid=3006 /usr/bin/curl net send-data write-file guuid=13b4d607-1a00-0000-198c-2f3d4b0b0000 pid=2891->guuid=35de6535-1a00-0000-198c-2f3dbe0b0000 pid=3006 execve guuid=1d8a9739-1a00-0000-198c-2f3dca0b0000 pid=3018 /usr/bin/chmod guuid=13b4d607-1a00-0000-198c-2f3d4b0b0000 pid=2891->guuid=1d8a9739-1a00-0000-198c-2f3dca0b0000 pid=3018 execve guuid=dbd8f439-1a00-0000-198c-2f3dcc0b0000 pid=3020 /usr/bin/bash guuid=13b4d607-1a00-0000-198c-2f3d4b0b0000 pid=2891->guuid=dbd8f439-1a00-0000-198c-2f3dcc0b0000 pid=3020 clone guuid=88213b3a-1a00-0000-198c-2f3dcf0b0000 pid=3023 /usr/bin/rm delete-file guuid=13b4d607-1a00-0000-198c-2f3d4b0b0000 pid=2891->guuid=88213b3a-1a00-0000-198c-2f3dcf0b0000 pid=3023 execve guuid=3245993a-1a00-0000-198c-2f3dd00b0000 pid=3024 /usr/bin/rm guuid=13b4d607-1a00-0000-198c-2f3d4b0b0000 pid=2891->guuid=3245993a-1a00-0000-198c-2f3dd00b0000 pid=3024 execve guuid=480f043b-1a00-0000-198c-2f3dd20b0000 pid=3026 /usr/bin/wget net send-data guuid=13b4d607-1a00-0000-198c-2f3d4b0b0000 pid=2891->guuid=480f043b-1a00-0000-198c-2f3dd20b0000 pid=3026 execve guuid=465eef3d-1a00-0000-198c-2f3dda0b0000 pid=3034 /usr/bin/curl net send-data write-file guuid=13b4d607-1a00-0000-198c-2f3d4b0b0000 pid=2891->guuid=465eef3d-1a00-0000-198c-2f3dda0b0000 pid=3034 execve guuid=48a6b842-1a00-0000-198c-2f3de50b0000 pid=3045 /usr/bin/chmod guuid=13b4d607-1a00-0000-198c-2f3d4b0b0000 pid=2891->guuid=48a6b842-1a00-0000-198c-2f3de50b0000 pid=3045 execve guuid=166e1043-1a00-0000-198c-2f3de60b0000 pid=3046 /usr/bin/bash guuid=13b4d607-1a00-0000-198c-2f3d4b0b0000 pid=2891->guuid=166e1043-1a00-0000-198c-2f3de60b0000 pid=3046 clone guuid=f12c5c43-1a00-0000-198c-2f3de90b0000 pid=3049 /usr/bin/rm delete-file guuid=13b4d607-1a00-0000-198c-2f3d4b0b0000 pid=2891->guuid=f12c5c43-1a00-0000-198c-2f3de90b0000 pid=3049 execve guuid=9a05ee43-1a00-0000-198c-2f3deb0b0000 pid=3051 /usr/bin/rm guuid=13b4d607-1a00-0000-198c-2f3d4b0b0000 pid=2891->guuid=9a05ee43-1a00-0000-198c-2f3deb0b0000 pid=3051 execve guuid=72897444-1a00-0000-198c-2f3ded0b0000 pid=3053 /usr/bin/wget net send-data guuid=13b4d607-1a00-0000-198c-2f3d4b0b0000 pid=2891->guuid=72897444-1a00-0000-198c-2f3ded0b0000 pid=3053 execve guuid=a8598247-1a00-0000-198c-2f3df60b0000 pid=3062 /usr/bin/curl net send-data write-file guuid=13b4d607-1a00-0000-198c-2f3d4b0b0000 pid=2891->guuid=a8598247-1a00-0000-198c-2f3df60b0000 pid=3062 execve guuid=bf571b4c-1a00-0000-198c-2f3dfd0b0000 pid=3069 /usr/bin/chmod guuid=13b4d607-1a00-0000-198c-2f3d4b0b0000 pid=2891->guuid=bf571b4c-1a00-0000-198c-2f3dfd0b0000 pid=3069 execve guuid=bc805d4c-1a00-0000-198c-2f3dfe0b0000 pid=3070 /usr/bin/bash guuid=13b4d607-1a00-0000-198c-2f3d4b0b0000 pid=2891->guuid=bc805d4c-1a00-0000-198c-2f3dfe0b0000 pid=3070 clone guuid=a7f4954c-1a00-0000-198c-2f3d010c0000 pid=3073 /usr/bin/rm delete-file guuid=13b4d607-1a00-0000-198c-2f3d4b0b0000 pid=2891->guuid=a7f4954c-1a00-0000-198c-2f3d010c0000 pid=3073 execve guuid=d5aed14c-1a00-0000-198c-2f3d020c0000 pid=3074 /usr/bin/rm guuid=13b4d607-1a00-0000-198c-2f3d4b0b0000 pid=2891->guuid=d5aed14c-1a00-0000-198c-2f3d020c0000 pid=3074 execve guuid=dee30a4d-1a00-0000-198c-2f3d040c0000 pid=3076 /usr/bin/wget net send-data guuid=13b4d607-1a00-0000-198c-2f3d4b0b0000 pid=2891->guuid=dee30a4d-1a00-0000-198c-2f3d040c0000 pid=3076 execve guuid=2accef4f-1a00-0000-198c-2f3d0b0c0000 pid=3083 /usr/bin/curl net send-data write-file guuid=13b4d607-1a00-0000-198c-2f3d4b0b0000 pid=2891->guuid=2accef4f-1a00-0000-198c-2f3d0b0c0000 pid=3083 execve guuid=3cb6a056-1a00-0000-198c-2f3d160c0000 pid=3094 /usr/bin/chmod guuid=13b4d607-1a00-0000-198c-2f3d4b0b0000 pid=2891->guuid=3cb6a056-1a00-0000-198c-2f3d160c0000 pid=3094 execve guuid=9a765357-1a00-0000-198c-2f3d180c0000 pid=3096 /usr/bin/bash guuid=13b4d607-1a00-0000-198c-2f3d4b0b0000 pid=2891->guuid=9a765357-1a00-0000-198c-2f3d180c0000 pid=3096 clone guuid=54e0ef57-1a00-0000-198c-2f3d1c0c0000 pid=3100 /usr/bin/rm delete-file guuid=13b4d607-1a00-0000-198c-2f3d4b0b0000 pid=2891->guuid=54e0ef57-1a00-0000-198c-2f3d1c0c0000 pid=3100 execve guuid=b0e0d858-1a00-0000-198c-2f3d1e0c0000 pid=3102 /usr/bin/rm guuid=13b4d607-1a00-0000-198c-2f3d4b0b0000 pid=2891->guuid=b0e0d858-1a00-0000-198c-2f3d1e0c0000 pid=3102 execve guuid=32bee259-1a00-0000-198c-2f3d210c0000 pid=3105 /usr/bin/wget net send-data guuid=13b4d607-1a00-0000-198c-2f3d4b0b0000 pid=2891->guuid=32bee259-1a00-0000-198c-2f3d210c0000 pid=3105 execve guuid=e9eab65e-1a00-0000-198c-2f3d260c0000 pid=3110 /usr/bin/curl net send-data write-file guuid=13b4d607-1a00-0000-198c-2f3d4b0b0000 pid=2891->guuid=e9eab65e-1a00-0000-198c-2f3d260c0000 pid=3110 execve guuid=58f29f65-1a00-0000-198c-2f3d270c0000 pid=3111 /usr/bin/chmod guuid=13b4d607-1a00-0000-198c-2f3d4b0b0000 pid=2891->guuid=58f29f65-1a00-0000-198c-2f3d270c0000 pid=3111 execve guuid=5a058566-1a00-0000-198c-2f3d280c0000 pid=3112 /usr/bin/bash guuid=13b4d607-1a00-0000-198c-2f3d4b0b0000 pid=2891->guuid=5a058566-1a00-0000-198c-2f3d280c0000 pid=3112 clone guuid=e5d73f67-1a00-0000-198c-2f3d2a0c0000 pid=3114 /usr/bin/rm delete-file guuid=13b4d607-1a00-0000-198c-2f3d4b0b0000 pid=2891->guuid=e5d73f67-1a00-0000-198c-2f3d2a0c0000 pid=3114 execve guuid=d8004a68-1a00-0000-198c-2f3d2b0c0000 pid=3115 /usr/bin/rm guuid=13b4d607-1a00-0000-198c-2f3d4b0b0000 pid=2891->guuid=d8004a68-1a00-0000-198c-2f3d2b0c0000 pid=3115 execve guuid=2e685e69-1a00-0000-198c-2f3d2c0c0000 pid=3116 /usr/bin/wget net send-data guuid=13b4d607-1a00-0000-198c-2f3d4b0b0000 pid=2891->guuid=2e685e69-1a00-0000-198c-2f3d2c0c0000 pid=3116 execve guuid=d32aa16d-1a00-0000-198c-2f3d2d0c0000 pid=3117 /usr/bin/curl net send-data write-file guuid=13b4d607-1a00-0000-198c-2f3d4b0b0000 pid=2891->guuid=d32aa16d-1a00-0000-198c-2f3d2d0c0000 pid=3117 execve guuid=de3b8374-1a00-0000-198c-2f3d2f0c0000 pid=3119 /usr/bin/chmod guuid=13b4d607-1a00-0000-198c-2f3d4b0b0000 pid=2891->guuid=de3b8374-1a00-0000-198c-2f3d2f0c0000 pid=3119 execve guuid=0dddf774-1a00-0000-198c-2f3d310c0000 pid=3121 /usr/bin/bash guuid=13b4d607-1a00-0000-198c-2f3d4b0b0000 pid=2891->guuid=0dddf774-1a00-0000-198c-2f3d310c0000 pid=3121 clone guuid=e9639175-1a00-0000-198c-2f3d340c0000 pid=3124 /usr/bin/rm delete-file guuid=13b4d607-1a00-0000-198c-2f3d4b0b0000 pid=2891->guuid=e9639175-1a00-0000-198c-2f3d340c0000 pid=3124 execve guuid=d664fe75-1a00-0000-198c-2f3d360c0000 pid=3126 /usr/bin/rm guuid=13b4d607-1a00-0000-198c-2f3d4b0b0000 pid=2891->guuid=d664fe75-1a00-0000-198c-2f3d360c0000 pid=3126 execve guuid=f0aa6476-1a00-0000-198c-2f3d380c0000 pid=3128 /usr/bin/wget net send-data guuid=13b4d607-1a00-0000-198c-2f3d4b0b0000 pid=2891->guuid=f0aa6476-1a00-0000-198c-2f3d380c0000 pid=3128 execve guuid=3817997a-1a00-0000-198c-2f3d410c0000 pid=3137 /usr/bin/curl net send-data write-file guuid=13b4d607-1a00-0000-198c-2f3d4b0b0000 pid=2891->guuid=3817997a-1a00-0000-198c-2f3d410c0000 pid=3137 execve guuid=a4ed5e82-1a00-0000-198c-2f3d4e0c0000 pid=3150 /usr/bin/chmod guuid=13b4d607-1a00-0000-198c-2f3d4b0b0000 pid=2891->guuid=a4ed5e82-1a00-0000-198c-2f3d4e0c0000 pid=3150 execve guuid=2d7abf82-1a00-0000-198c-2f3d4f0c0000 pid=3151 /usr/bin/bash guuid=13b4d607-1a00-0000-198c-2f3d4b0b0000 pid=2891->guuid=2d7abf82-1a00-0000-198c-2f3d4f0c0000 pid=3151 clone guuid=0b1d2583-1a00-0000-198c-2f3d510c0000 pid=3153 /usr/bin/rm delete-file guuid=13b4d607-1a00-0000-198c-2f3d4b0b0000 pid=2891->guuid=0b1d2583-1a00-0000-198c-2f3d510c0000 pid=3153 execve guuid=5837ae83-1a00-0000-198c-2f3d520c0000 pid=3154 /usr/bin/rm guuid=13b4d607-1a00-0000-198c-2f3d4b0b0000 pid=2891->guuid=5837ae83-1a00-0000-198c-2f3d520c0000 pid=3154 execve guuid=43643b84-1a00-0000-198c-2f3d530c0000 pid=3155 /usr/bin/wget net send-data guuid=13b4d607-1a00-0000-198c-2f3d4b0b0000 pid=2891->guuid=43643b84-1a00-0000-198c-2f3d530c0000 pid=3155 execve guuid=232c4c87-1a00-0000-198c-2f3d550c0000 pid=3157 /usr/bin/curl net send-data write-file guuid=13b4d607-1a00-0000-198c-2f3d4b0b0000 pid=2891->guuid=232c4c87-1a00-0000-198c-2f3d550c0000 pid=3157 execve guuid=13d7b28e-1a00-0000-198c-2f3d600c0000 pid=3168 /usr/bin/chmod guuid=13b4d607-1a00-0000-198c-2f3d4b0b0000 pid=2891->guuid=13d7b28e-1a00-0000-198c-2f3d600c0000 pid=3168 execve guuid=f0e91a8f-1a00-0000-198c-2f3d610c0000 pid=3169 /usr/bin/bash guuid=13b4d607-1a00-0000-198c-2f3d4b0b0000 pid=2891->guuid=f0e91a8f-1a00-0000-198c-2f3d610c0000 pid=3169 clone guuid=5eca608f-1a00-0000-198c-2f3d630c0000 pid=3171 /usr/bin/rm delete-file guuid=13b4d607-1a00-0000-198c-2f3d4b0b0000 pid=2891->guuid=5eca608f-1a00-0000-198c-2f3d630c0000 pid=3171 execve guuid=3ab84290-1a00-0000-198c-2f3d640c0000 pid=3172 /usr/bin/rm guuid=13b4d607-1a00-0000-198c-2f3d4b0b0000 pid=2891->guuid=3ab84290-1a00-0000-198c-2f3d640c0000 pid=3172 execve guuid=73dec790-1a00-0000-198c-2f3d650c0000 pid=3173 /usr/bin/wget net send-data guuid=13b4d607-1a00-0000-198c-2f3d4b0b0000 pid=2891->guuid=73dec790-1a00-0000-198c-2f3d650c0000 pid=3173 execve guuid=c3cc4094-1a00-0000-198c-2f3d660c0000 pid=3174 /usr/bin/curl net send-data write-file guuid=13b4d607-1a00-0000-198c-2f3d4b0b0000 pid=2891->guuid=c3cc4094-1a00-0000-198c-2f3d660c0000 pid=3174 execve guuid=501d929c-1a00-0000-198c-2f3d670c0000 pid=3175 /usr/bin/chmod guuid=13b4d607-1a00-0000-198c-2f3d4b0b0000 pid=2891->guuid=501d929c-1a00-0000-198c-2f3d670c0000 pid=3175 execve guuid=c65e4e9d-1a00-0000-198c-2f3d680c0000 pid=3176 /usr/bin/bash guuid=13b4d607-1a00-0000-198c-2f3d4b0b0000 pid=2891->guuid=c65e4e9d-1a00-0000-198c-2f3d680c0000 pid=3176 clone guuid=363ddc9d-1a00-0000-198c-2f3d6a0c0000 pid=3178 /usr/bin/rm delete-file guuid=13b4d607-1a00-0000-198c-2f3d4b0b0000 pid=2891->guuid=363ddc9d-1a00-0000-198c-2f3d6a0c0000 pid=3178 execve guuid=6cc07e9e-1a00-0000-198c-2f3d6b0c0000 pid=3179 /usr/bin/rm guuid=13b4d607-1a00-0000-198c-2f3d4b0b0000 pid=2891->guuid=6cc07e9e-1a00-0000-198c-2f3d6b0c0000 pid=3179 execve 5b654972-c9e1-50d8-b372-2dc2a5b9ad66 5.182.210.174:80 guuid=9feb6408-1a00-0000-198c-2f3d4d0b0000 pid=2893->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=39511910-1a00-0000-198c-2f3d580b0000 pid=2904->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=1f2b8a1c-1a00-0000-198c-2f3d730b0000 pid=2931 /usr/bin/bash guuid=2d4a6b1c-1a00-0000-198c-2f3d710b0000 pid=2929->guuid=1f2b8a1c-1a00-0000-198c-2f3d730b0000 pid=2931 clone guuid=ed70ad1d-1a00-0000-198c-2f3d780b0000 pid=2936->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=32d20621-1a00-0000-198c-2f3d820b0000 pid=2946->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=ede19528-1a00-0000-198c-2f3d960b0000 pid=2966 /usr/bin/bash guuid=9ae37a28-1a00-0000-198c-2f3d940b0000 pid=2964->guuid=ede19528-1a00-0000-198c-2f3d960b0000 pid=2966 clone guuid=33856e29-1a00-0000-198c-2f3d9b0b0000 pid=2971->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=880f162c-1a00-0000-198c-2f3da30b0000 pid=2979->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=e69da131-1a00-0000-198c-2f3db20b0000 pid=2994 /usr/bin/bash guuid=48e88531-1a00-0000-198c-2f3db10b0000 pid=2993->guuid=e69da131-1a00-0000-198c-2f3db20b0000 pid=2994 clone guuid=32eb9532-1a00-0000-198c-2f3db60b0000 pid=2998->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=35de6535-1a00-0000-198c-2f3dbe0b0000 pid=3006->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=32fc103a-1a00-0000-198c-2f3dcd0b0000 pid=3021 /usr/bin/bash guuid=dbd8f439-1a00-0000-198c-2f3dcc0b0000 pid=3020->guuid=32fc103a-1a00-0000-198c-2f3dcd0b0000 pid=3021 clone guuid=480f043b-1a00-0000-198c-2f3dd20b0000 pid=3026->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=465eef3d-1a00-0000-198c-2f3dda0b0000 pid=3034->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=d7622743-1a00-0000-198c-2f3de70b0000 pid=3047 /usr/bin/bash guuid=166e1043-1a00-0000-198c-2f3de60b0000 pid=3046->guuid=d7622743-1a00-0000-198c-2f3de70b0000 pid=3047 clone guuid=72897444-1a00-0000-198c-2f3ded0b0000 pid=3053->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=a8598247-1a00-0000-198c-2f3df60b0000 pid=3062->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=6177724c-1a00-0000-198c-2f3dff0b0000 pid=3071 /usr/bin/bash guuid=bc805d4c-1a00-0000-198c-2f3dfe0b0000 pid=3070->guuid=6177724c-1a00-0000-198c-2f3dff0b0000 pid=3071 clone guuid=dee30a4d-1a00-0000-198c-2f3d040c0000 pid=3076->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=2accef4f-1a00-0000-198c-2f3d0b0c0000 pid=3083->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=96569a57-1a00-0000-198c-2f3d1a0c0000 pid=3098 /usr/bin/bash guuid=9a765357-1a00-0000-198c-2f3d180c0000 pid=3096->guuid=96569a57-1a00-0000-198c-2f3d1a0c0000 pid=3098 clone guuid=32bee259-1a00-0000-198c-2f3d210c0000 pid=3105->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=e9eab65e-1a00-0000-198c-2f3d260c0000 pid=3110->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=13f0de66-1a00-0000-198c-2f3d290c0000 pid=3113 /usr/bin/bash guuid=5a058566-1a00-0000-198c-2f3d280c0000 pid=3112->guuid=13f0de66-1a00-0000-198c-2f3d290c0000 pid=3113 clone guuid=2e685e69-1a00-0000-198c-2f3d2c0c0000 pid=3116->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=d32aa16d-1a00-0000-198c-2f3d2d0c0000 pid=3117->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=3a831e75-1a00-0000-198c-2f3d320c0000 pid=3122 /usr/bin/bash guuid=0dddf774-1a00-0000-198c-2f3d310c0000 pid=3121->guuid=3a831e75-1a00-0000-198c-2f3d320c0000 pid=3122 clone guuid=f0aa6476-1a00-0000-198c-2f3d380c0000 pid=3128->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=3817997a-1a00-0000-198c-2f3d410c0000 pid=3137->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=51a8f782-1a00-0000-198c-2f3d500c0000 pid=3152 /usr/bin/bash guuid=2d7abf82-1a00-0000-198c-2f3d4f0c0000 pid=3151->guuid=51a8f782-1a00-0000-198c-2f3d500c0000 pid=3152 clone guuid=43643b84-1a00-0000-198c-2f3d530c0000 pid=3155->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=232c4c87-1a00-0000-198c-2f3d550c0000 pid=3157->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=92e23a8f-1a00-0000-198c-2f3d620c0000 pid=3170 /usr/bin/bash guuid=f0e91a8f-1a00-0000-198c-2f3d610c0000 pid=3169->guuid=92e23a8f-1a00-0000-198c-2f3d620c0000 pid=3170 clone guuid=73dec790-1a00-0000-198c-2f3d650c0000 pid=3173->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=c3cc4094-1a00-0000-198c-2f3d660c0000 pid=3174->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=06d5809d-1a00-0000-198c-2f3d690c0000 pid=3177 /usr/bin/bash guuid=c65e4e9d-1a00-0000-198c-2f3d680c0000 pid=3176->guuid=06d5809d-1a00-0000-198c-2f3d690c0000 pid=3177 clone
Score:
99%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/69f56b1f300ead7b60d5b0f74acc595e75d348f2d5f0c1ed9a1b0bceb1eaee9a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/69f56b1f300ead7b60d5b0f74acc595e75d348f2d5f0c1ed9a1b0bceb1eaee9a/
Threat name:
Linux.Trojan.Egairtigado
Create hunting rule
Status:
Malicious
First seen:
2026-08-27 02:34:16 UTC
File Type:
Text (Shell)
AV detection:
13 of 24 (54.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nh2wwhzqb2wxwygvwd3uvtczlz25gshs2xymd3m2dmf45mpk52na._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260827-c2jn5sw1hs/
Behaviour
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.11
Link:
https://yomi.yoroi.company/submissions/69f56b1f300ead7b60d5b0f74acc595e75d348f2d5f0c1ed9a1b0bceb1eaee9a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 69f56b1f300ead7b60d5b0f74acc595e75d348f2d5f0c1ed9a1b0bceb1eaee9a

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3897671/
  
Delivery method
Distributed via web download

Comments