MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6a1a2fe9ac8989421c9249cdc3cd87d35d0d668debd5b87e3e9bdeb2cd130891. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6a1a2fe9ac8989421c9249cdc3cd87d35d0d668debd5b87e3e9bdeb2cd130891
SHA3-384 hash: 92dad768284c426bf8baa756f9951959de4c2e08d111cb8414222c69bb50a5b5adf34f1a3d3d16644e2c57486b0f3dba
SHA1 hash: 8e022ce33e80a2e22b05790c1c13748b3c4bd99b
MD5 hash: 65b95f7e7e66b3059a756c4913c2fc9b
humanhash: hamper-friend-fifteen-missouri
File name:6a1a2fe9ac8989421c9249cdc3cd87d35d0d668debd5b87e3e9bdeb2cd130891
Download: download sample
File size:1'584 bytes
First seen:2026-07-29 18:30:19 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 24:r/RJLJDZGRpLSXbD+AkM6keUke55XzlJVG1NiD1R/5K2um6:fLJYLSRkM6keUke5ZzlzMihR/5K/p
TLSH T1143140CE05142A391312CBDE73B23548B44CC3F76D6BC7959C490EED82498CDB17ABAA
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter EnthecSolutions
Tags:enthec sh
URLMalware sample (SHA256 hash)SignatureTags
http://5.182.210.61/6dfc96n/an/aua-wget
http://5.182.210.61/6d7e02n/an/aua-wget
http://5.182.210.61/cdb6cfn/an/aua-wget
http://5.182.210.61/d87017n/an/aua-wget
http://5.182.210.61/5d7d3bn/an/aua-wget
http://5.182.210.61/76705dn/an/aua-wget
http://5.182.210.61/18e6ddn/an/aua-wget
http://5.182.210.61/94115cn/an/aua-wget
http://5.182.210.61/1dc272n/an/aua-wget
http://5.182.210.61/519e48n/an/aua-wget
http://5.182.210.61/2dde2fn/an/aua-wget
http://5.182.210.61/e9cc83n/an/aua-wget

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
CA CA
Vendor Threat Intelligence
No detections
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-07-29T16:14:00Z UTC
Last seen:
2026-07-30T19:37:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/6a1a2fe9ac8989421c9249cdc3cd87d35d0d668debd5b87e3e9bdeb2cd130891/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/ec6d8ecc-4836-49e5-8efc-5c5ecc7bebbd
Behavior Graph:
Download SVG
%3 guuid=7db6a533-1900-0000-cf6b-1c163f0c0000 pid=3135 /usr/bin/sudo guuid=7ae89535-1900-0000-cf6b-1c16420c0000 pid=3138 /tmp/sample.bin guuid=7db6a533-1900-0000-cf6b-1c163f0c0000 pid=3135->guuid=7ae89535-1900-0000-cf6b-1c16420c0000 pid=3138 execve guuid=e1021036-1900-0000-cf6b-1c16440c0000 pid=3140 /usr/bin/wget net send-data guuid=7ae89535-1900-0000-cf6b-1c16420c0000 pid=3138->guuid=e1021036-1900-0000-cf6b-1c16440c0000 pid=3140 execve guuid=9d54ba3a-1900-0000-cf6b-1c16550c0000 pid=3157 /usr/bin/curl net send-data write-file guuid=7ae89535-1900-0000-cf6b-1c16420c0000 pid=3138->guuid=9d54ba3a-1900-0000-cf6b-1c16550c0000 pid=3157 execve guuid=69f96b43-1900-0000-cf6b-1c16640c0000 pid=3172 /usr/bin/chmod guuid=7ae89535-1900-0000-cf6b-1c16420c0000 pid=3138->guuid=69f96b43-1900-0000-cf6b-1c16640c0000 pid=3172 execve guuid=ede9b343-1900-0000-cf6b-1c16660c0000 pid=3174 /usr/bin/bash guuid=7ae89535-1900-0000-cf6b-1c16420c0000 pid=3138->guuid=ede9b343-1900-0000-cf6b-1c16660c0000 pid=3174 clone guuid=719eff43-1900-0000-cf6b-1c16690c0000 pid=3177 /usr/bin/rm delete-file guuid=7ae89535-1900-0000-cf6b-1c16420c0000 pid=3138->guuid=719eff43-1900-0000-cf6b-1c16690c0000 pid=3177 execve guuid=0c4b7344-1900-0000-cf6b-1c166b0c0000 pid=3179 /usr/bin/rm guuid=7ae89535-1900-0000-cf6b-1c16420c0000 pid=3138->guuid=0c4b7344-1900-0000-cf6b-1c166b0c0000 pid=3179 execve guuid=b520e644-1900-0000-cf6b-1c166d0c0000 pid=3181 /usr/bin/wget net send-data guuid=7ae89535-1900-0000-cf6b-1c16420c0000 pid=3138->guuid=b520e644-1900-0000-cf6b-1c166d0c0000 pid=3181 execve guuid=8586a947-1900-0000-cf6b-1c16720c0000 pid=3186 /usr/bin/curl net send-data write-file guuid=7ae89535-1900-0000-cf6b-1c16420c0000 pid=3138->guuid=8586a947-1900-0000-cf6b-1c16720c0000 pid=3186 execve guuid=8f4fa24b-1900-0000-cf6b-1c16780c0000 pid=3192 /usr/bin/chmod guuid=7ae89535-1900-0000-cf6b-1c16420c0000 pid=3138->guuid=8f4fa24b-1900-0000-cf6b-1c16780c0000 pid=3192 execve guuid=67f7e14b-1900-0000-cf6b-1c167a0c0000 pid=3194 /usr/bin/bash guuid=7ae89535-1900-0000-cf6b-1c16420c0000 pid=3138->guuid=67f7e14b-1900-0000-cf6b-1c167a0c0000 pid=3194 clone guuid=e5be174c-1900-0000-cf6b-1c167d0c0000 pid=3197 /usr/bin/rm delete-file guuid=7ae89535-1900-0000-cf6b-1c16420c0000 pid=3138->guuid=e5be174c-1900-0000-cf6b-1c167d0c0000 pid=3197 execve guuid=fbc6614c-1900-0000-cf6b-1c167e0c0000 pid=3198 /usr/bin/rm guuid=7ae89535-1900-0000-cf6b-1c16420c0000 pid=3138->guuid=fbc6614c-1900-0000-cf6b-1c167e0c0000 pid=3198 execve guuid=0657a14c-1900-0000-cf6b-1c16800c0000 pid=3200 /usr/bin/wget net send-data guuid=7ae89535-1900-0000-cf6b-1c16420c0000 pid=3138->guuid=0657a14c-1900-0000-cf6b-1c16800c0000 pid=3200 execve guuid=2a361c4f-1900-0000-cf6b-1c16870c0000 pid=3207 /usr/bin/curl net send-data write-file guuid=7ae89535-1900-0000-cf6b-1c16420c0000 pid=3138->guuid=2a361c4f-1900-0000-cf6b-1c16870c0000 pid=3207 execve guuid=56a5d452-1900-0000-cf6b-1c16910c0000 pid=3217 /usr/bin/chmod guuid=7ae89535-1900-0000-cf6b-1c16420c0000 pid=3138->guuid=56a5d452-1900-0000-cf6b-1c16910c0000 pid=3217 execve guuid=ed862c53-1900-0000-cf6b-1c16930c0000 pid=3219 /usr/bin/bash guuid=7ae89535-1900-0000-cf6b-1c16420c0000 pid=3138->guuid=ed862c53-1900-0000-cf6b-1c16930c0000 pid=3219 clone guuid=190b8a53-1900-0000-cf6b-1c16950c0000 pid=3221 /usr/bin/rm delete-file guuid=7ae89535-1900-0000-cf6b-1c16420c0000 pid=3138->guuid=190b8a53-1900-0000-cf6b-1c16950c0000 pid=3221 execve guuid=449ff353-1900-0000-cf6b-1c16970c0000 pid=3223 /usr/bin/rm guuid=7ae89535-1900-0000-cf6b-1c16420c0000 pid=3138->guuid=449ff353-1900-0000-cf6b-1c16970c0000 pid=3223 execve guuid=da734154-1900-0000-cf6b-1c16980c0000 pid=3224 /usr/bin/wget net send-data guuid=7ae89535-1900-0000-cf6b-1c16420c0000 pid=3138->guuid=da734154-1900-0000-cf6b-1c16980c0000 pid=3224 execve guuid=07a3fb56-1900-0000-cf6b-1c169e0c0000 pid=3230 /usr/bin/curl net send-data write-file guuid=7ae89535-1900-0000-cf6b-1c16420c0000 pid=3138->guuid=07a3fb56-1900-0000-cf6b-1c169e0c0000 pid=3230 execve guuid=e7171d5e-1900-0000-cf6b-1c169f0c0000 pid=3231 /usr/bin/chmod guuid=7ae89535-1900-0000-cf6b-1c16420c0000 pid=3138->guuid=e7171d5e-1900-0000-cf6b-1c169f0c0000 pid=3231 execve guuid=3017735e-1900-0000-cf6b-1c16a00c0000 pid=3232 /usr/bin/bash guuid=7ae89535-1900-0000-cf6b-1c16420c0000 pid=3138->guuid=3017735e-1900-0000-cf6b-1c16a00c0000 pid=3232 clone guuid=aaa9be5e-1900-0000-cf6b-1c16a20c0000 pid=3234 /usr/bin/rm delete-file guuid=7ae89535-1900-0000-cf6b-1c16420c0000 pid=3138->guuid=aaa9be5e-1900-0000-cf6b-1c16a20c0000 pid=3234 execve guuid=cebe125f-1900-0000-cf6b-1c16a30c0000 pid=3235 /usr/bin/rm guuid=7ae89535-1900-0000-cf6b-1c16420c0000 pid=3138->guuid=cebe125f-1900-0000-cf6b-1c16a30c0000 pid=3235 execve guuid=6d0f6d5f-1900-0000-cf6b-1c16a40c0000 pid=3236 /usr/bin/wget net send-data guuid=7ae89535-1900-0000-cf6b-1c16420c0000 pid=3138->guuid=6d0f6d5f-1900-0000-cf6b-1c16a40c0000 pid=3236 execve guuid=1923aa62-1900-0000-cf6b-1c16a50c0000 pid=3237 /usr/bin/curl net send-data write-file guuid=7ae89535-1900-0000-cf6b-1c16420c0000 pid=3138->guuid=1923aa62-1900-0000-cf6b-1c16a50c0000 pid=3237 execve guuid=f5340768-1900-0000-cf6b-1c16a70c0000 pid=3239 /usr/bin/chmod guuid=7ae89535-1900-0000-cf6b-1c16420c0000 pid=3138->guuid=f5340768-1900-0000-cf6b-1c16a70c0000 pid=3239 execve guuid=7f8ebb68-1900-0000-cf6b-1c16a80c0000 pid=3240 /usr/bin/bash guuid=7ae89535-1900-0000-cf6b-1c16420c0000 pid=3138->guuid=7f8ebb68-1900-0000-cf6b-1c16a80c0000 pid=3240 clone guuid=28025a69-1900-0000-cf6b-1c16aa0c0000 pid=3242 /usr/bin/rm delete-file guuid=7ae89535-1900-0000-cf6b-1c16420c0000 pid=3138->guuid=28025a69-1900-0000-cf6b-1c16aa0c0000 pid=3242 execve guuid=7265126a-1900-0000-cf6b-1c16ab0c0000 pid=3243 /usr/bin/rm guuid=7ae89535-1900-0000-cf6b-1c16420c0000 pid=3138->guuid=7265126a-1900-0000-cf6b-1c16ab0c0000 pid=3243 execve guuid=fd00bb6a-1900-0000-cf6b-1c16ac0c0000 pid=3244 /usr/bin/wget net send-data guuid=7ae89535-1900-0000-cf6b-1c16420c0000 pid=3138->guuid=fd00bb6a-1900-0000-cf6b-1c16ac0c0000 pid=3244 execve guuid=8b0d1b6f-1900-0000-cf6b-1c16b20c0000 pid=3250 /usr/bin/curl net send-data write-file guuid=7ae89535-1900-0000-cf6b-1c16420c0000 pid=3138->guuid=8b0d1b6f-1900-0000-cf6b-1c16b20c0000 pid=3250 execve guuid=fd676c74-1900-0000-cf6b-1c16bc0c0000 pid=3260 /usr/bin/chmod guuid=7ae89535-1900-0000-cf6b-1c16420c0000 pid=3138->guuid=fd676c74-1900-0000-cf6b-1c16bc0c0000 pid=3260 execve guuid=07bbd974-1900-0000-cf6b-1c16be0c0000 pid=3262 /usr/bin/bash guuid=7ae89535-1900-0000-cf6b-1c16420c0000 pid=3138->guuid=07bbd974-1900-0000-cf6b-1c16be0c0000 pid=3262 clone guuid=147d4475-1900-0000-cf6b-1c16c10c0000 pid=3265 /usr/bin/rm delete-file guuid=7ae89535-1900-0000-cf6b-1c16420c0000 pid=3138->guuid=147d4475-1900-0000-cf6b-1c16c10c0000 pid=3265 execve guuid=586eae75-1900-0000-cf6b-1c16c30c0000 pid=3267 /usr/bin/rm guuid=7ae89535-1900-0000-cf6b-1c16420c0000 pid=3138->guuid=586eae75-1900-0000-cf6b-1c16c30c0000 pid=3267 execve guuid=e1be2976-1900-0000-cf6b-1c16c40c0000 pid=3268 /usr/bin/wget net send-data guuid=7ae89535-1900-0000-cf6b-1c16420c0000 pid=3138->guuid=e1be2976-1900-0000-cf6b-1c16c40c0000 pid=3268 execve guuid=cec3067b-1900-0000-cf6b-1c16cb0c0000 pid=3275 /usr/bin/curl net send-data write-file guuid=7ae89535-1900-0000-cf6b-1c16420c0000 pid=3138->guuid=cec3067b-1900-0000-cf6b-1c16cb0c0000 pid=3275 execve guuid=6e1b8e85-1900-0000-cf6b-1c16d80c0000 pid=3288 /usr/bin/chmod guuid=7ae89535-1900-0000-cf6b-1c16420c0000 pid=3138->guuid=6e1b8e85-1900-0000-cf6b-1c16d80c0000 pid=3288 execve guuid=79fb0586-1900-0000-cf6b-1c16d90c0000 pid=3289 /usr/bin/bash guuid=7ae89535-1900-0000-cf6b-1c16420c0000 pid=3138->guuid=79fb0586-1900-0000-cf6b-1c16d90c0000 pid=3289 clone guuid=14877986-1900-0000-cf6b-1c16db0c0000 pid=3291 /usr/bin/rm delete-file guuid=7ae89535-1900-0000-cf6b-1c16420c0000 pid=3138->guuid=14877986-1900-0000-cf6b-1c16db0c0000 pid=3291 execve guuid=80b8fa86-1900-0000-cf6b-1c16dc0c0000 pid=3292 /usr/bin/rm guuid=7ae89535-1900-0000-cf6b-1c16420c0000 pid=3138->guuid=80b8fa86-1900-0000-cf6b-1c16dc0c0000 pid=3292 execve guuid=ceb58187-1900-0000-cf6b-1c16de0c0000 pid=3294 /usr/bin/wget net send-data guuid=7ae89535-1900-0000-cf6b-1c16420c0000 pid=3138->guuid=ceb58187-1900-0000-cf6b-1c16de0c0000 pid=3294 execve guuid=65d9178d-1900-0000-cf6b-1c16e80c0000 pid=3304 /usr/bin/curl net send-data write-file guuid=7ae89535-1900-0000-cf6b-1c16420c0000 pid=3138->guuid=65d9178d-1900-0000-cf6b-1c16e80c0000 pid=3304 execve guuid=f1b36892-1900-0000-cf6b-1c16f20c0000 pid=3314 /usr/bin/chmod guuid=7ae89535-1900-0000-cf6b-1c16420c0000 pid=3138->guuid=f1b36892-1900-0000-cf6b-1c16f20c0000 pid=3314 execve guuid=5f23e292-1900-0000-cf6b-1c16f30c0000 pid=3315 /usr/bin/bash guuid=7ae89535-1900-0000-cf6b-1c16420c0000 pid=3138->guuid=5f23e292-1900-0000-cf6b-1c16f30c0000 pid=3315 clone guuid=a23c7293-1900-0000-cf6b-1c16f70c0000 pid=3319 /usr/bin/rm delete-file guuid=7ae89535-1900-0000-cf6b-1c16420c0000 pid=3138->guuid=a23c7293-1900-0000-cf6b-1c16f70c0000 pid=3319 execve guuid=7e520f94-1900-0000-cf6b-1c16f90c0000 pid=3321 /usr/bin/rm guuid=7ae89535-1900-0000-cf6b-1c16420c0000 pid=3138->guuid=7e520f94-1900-0000-cf6b-1c16f90c0000 pid=3321 execve guuid=c8ee6194-1900-0000-cf6b-1c16fb0c0000 pid=3323 /usr/bin/wget net send-data guuid=7ae89535-1900-0000-cf6b-1c16420c0000 pid=3138->guuid=c8ee6194-1900-0000-cf6b-1c16fb0c0000 pid=3323 execve guuid=e4283b97-1900-0000-cf6b-1c16000d0000 pid=3328 /usr/bin/curl net send-data write-file guuid=7ae89535-1900-0000-cf6b-1c16420c0000 pid=3138->guuid=e4283b97-1900-0000-cf6b-1c16000d0000 pid=3328 execve guuid=da277d9c-1900-0000-cf6b-1c160d0d0000 pid=3341 /usr/bin/chmod guuid=7ae89535-1900-0000-cf6b-1c16420c0000 pid=3138->guuid=da277d9c-1900-0000-cf6b-1c160d0d0000 pid=3341 execve guuid=6ce47c9d-1900-0000-cf6b-1c160f0d0000 pid=3343 /usr/bin/bash guuid=7ae89535-1900-0000-cf6b-1c16420c0000 pid=3138->guuid=6ce47c9d-1900-0000-cf6b-1c160f0d0000 pid=3343 clone guuid=4ff11a9e-1900-0000-cf6b-1c16130d0000 pid=3347 /usr/bin/rm delete-file guuid=7ae89535-1900-0000-cf6b-1c16420c0000 pid=3138->guuid=4ff11a9e-1900-0000-cf6b-1c16130d0000 pid=3347 execve guuid=332f029f-1900-0000-cf6b-1c16160d0000 pid=3350 /usr/bin/rm guuid=7ae89535-1900-0000-cf6b-1c16420c0000 pid=3138->guuid=332f029f-1900-0000-cf6b-1c16160d0000 pid=3350 execve guuid=a5b4b19f-1900-0000-cf6b-1c16180d0000 pid=3352 /usr/bin/wget net send-data guuid=7ae89535-1900-0000-cf6b-1c16420c0000 pid=3138->guuid=a5b4b19f-1900-0000-cf6b-1c16180d0000 pid=3352 execve guuid=7a6a4ba4-1900-0000-cf6b-1c16230d0000 pid=3363 /usr/bin/curl net send-data write-file guuid=7ae89535-1900-0000-cf6b-1c16420c0000 pid=3138->guuid=7a6a4ba4-1900-0000-cf6b-1c16230d0000 pid=3363 execve guuid=2cbe3dac-1900-0000-cf6b-1c16340d0000 pid=3380 /usr/bin/chmod guuid=7ae89535-1900-0000-cf6b-1c16420c0000 pid=3138->guuid=2cbe3dac-1900-0000-cf6b-1c16340d0000 pid=3380 execve guuid=6b7fadac-1900-0000-cf6b-1c16350d0000 pid=3381 /usr/bin/bash guuid=7ae89535-1900-0000-cf6b-1c16420c0000 pid=3138->guuid=6b7fadac-1900-0000-cf6b-1c16350d0000 pid=3381 clone guuid=de6efdac-1900-0000-cf6b-1c16380d0000 pid=3384 /usr/bin/rm delete-file guuid=7ae89535-1900-0000-cf6b-1c16420c0000 pid=3138->guuid=de6efdac-1900-0000-cf6b-1c16380d0000 pid=3384 execve guuid=12ff65ad-1900-0000-cf6b-1c16390d0000 pid=3385 /usr/bin/rm guuid=7ae89535-1900-0000-cf6b-1c16420c0000 pid=3138->guuid=12ff65ad-1900-0000-cf6b-1c16390d0000 pid=3385 execve guuid=3925bbad-1900-0000-cf6b-1c163b0d0000 pid=3387 /usr/bin/wget net send-data guuid=7ae89535-1900-0000-cf6b-1c16420c0000 pid=3138->guuid=3925bbad-1900-0000-cf6b-1c163b0d0000 pid=3387 execve guuid=8701e1b0-1900-0000-cf6b-1c16420d0000 pid=3394 /usr/bin/curl net send-data write-file guuid=7ae89535-1900-0000-cf6b-1c16420c0000 pid=3138->guuid=8701e1b0-1900-0000-cf6b-1c16420d0000 pid=3394 execve guuid=44934cb7-1900-0000-cf6b-1c164d0d0000 pid=3405 /usr/bin/chmod guuid=7ae89535-1900-0000-cf6b-1c16420c0000 pid=3138->guuid=44934cb7-1900-0000-cf6b-1c164d0d0000 pid=3405 execve guuid=2b1caeb8-1900-0000-cf6b-1c16520d0000 pid=3410 /usr/bin/bash guuid=7ae89535-1900-0000-cf6b-1c16420c0000 pid=3138->guuid=2b1caeb8-1900-0000-cf6b-1c16520d0000 pid=3410 clone guuid=7f7148b9-1900-0000-cf6b-1c16550d0000 pid=3413 /usr/bin/rm delete-file guuid=7ae89535-1900-0000-cf6b-1c16420c0000 pid=3138->guuid=7f7148b9-1900-0000-cf6b-1c16550d0000 pid=3413 execve guuid=a6a76dba-1900-0000-cf6b-1c16580d0000 pid=3416 /usr/bin/rm guuid=7ae89535-1900-0000-cf6b-1c16420c0000 pid=3138->guuid=a6a76dba-1900-0000-cf6b-1c16580d0000 pid=3416 execve guuid=49624bbb-1900-0000-cf6b-1c165b0d0000 pid=3419 /usr/bin/wget net send-data guuid=7ae89535-1900-0000-cf6b-1c16420c0000 pid=3138->guuid=49624bbb-1900-0000-cf6b-1c165b0d0000 pid=3419 execve guuid=f7f194bf-1900-0000-cf6b-1c16650d0000 pid=3429 /usr/bin/curl net send-data write-file guuid=7ae89535-1900-0000-cf6b-1c16420c0000 pid=3138->guuid=f7f194bf-1900-0000-cf6b-1c16650d0000 pid=3429 execve guuid=559fa3c7-1900-0000-cf6b-1c16740d0000 pid=3444 /usr/bin/chmod guuid=7ae89535-1900-0000-cf6b-1c16420c0000 pid=3138->guuid=559fa3c7-1900-0000-cf6b-1c16740d0000 pid=3444 execve guuid=4fc00fc8-1900-0000-cf6b-1c16760d0000 pid=3446 /usr/bin/bash guuid=7ae89535-1900-0000-cf6b-1c16420c0000 pid=3138->guuid=4fc00fc8-1900-0000-cf6b-1c16760d0000 pid=3446 clone guuid=dd2161c8-1900-0000-cf6b-1c16780d0000 pid=3448 /usr/bin/rm delete-file guuid=7ae89535-1900-0000-cf6b-1c16420c0000 pid=3138->guuid=dd2161c8-1900-0000-cf6b-1c16780d0000 pid=3448 execve guuid=2920d3c8-1900-0000-cf6b-1c167a0d0000 pid=3450 /usr/bin/rm guuid=7ae89535-1900-0000-cf6b-1c16420c0000 pid=3138->guuid=2920d3c8-1900-0000-cf6b-1c167a0d0000 pid=3450 execve 9e33e6d7-6ac7-5a65-88f4-941337e56821 5.182.210.61:80 guuid=e1021036-1900-0000-cf6b-1c16440c0000 pid=3140->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=9d54ba3a-1900-0000-cf6b-1c16550c0000 pid=3157->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=a6d2da43-1900-0000-cf6b-1c16670c0000 pid=3175 /usr/bin/bash guuid=ede9b343-1900-0000-cf6b-1c16660c0000 pid=3174->guuid=a6d2da43-1900-0000-cf6b-1c16670c0000 pid=3175 clone guuid=b520e644-1900-0000-cf6b-1c166d0c0000 pid=3181->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=8586a947-1900-0000-cf6b-1c16720c0000 pid=3186->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=38acf84b-1900-0000-cf6b-1c167b0c0000 pid=3195 /usr/bin/bash guuid=67f7e14b-1900-0000-cf6b-1c167a0c0000 pid=3194->guuid=38acf84b-1900-0000-cf6b-1c167b0c0000 pid=3195 clone guuid=0657a14c-1900-0000-cf6b-1c16800c0000 pid=3200->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=2a361c4f-1900-0000-cf6b-1c16870c0000 pid=3207->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=7e724853-1900-0000-cf6b-1c16940c0000 pid=3220 /usr/bin/bash guuid=ed862c53-1900-0000-cf6b-1c16930c0000 pid=3219->guuid=7e724853-1900-0000-cf6b-1c16940c0000 pid=3220 clone guuid=da734154-1900-0000-cf6b-1c16980c0000 pid=3224->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=07a3fb56-1900-0000-cf6b-1c169e0c0000 pid=3230->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=42e5965e-1900-0000-cf6b-1c16a10c0000 pid=3233 /usr/bin/bash guuid=3017735e-1900-0000-cf6b-1c16a00c0000 pid=3232->guuid=42e5965e-1900-0000-cf6b-1c16a10c0000 pid=3233 clone guuid=6d0f6d5f-1900-0000-cf6b-1c16a40c0000 pid=3236->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=1923aa62-1900-0000-cf6b-1c16a50c0000 pid=3237->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=489f0a69-1900-0000-cf6b-1c16a90c0000 pid=3241 /usr/bin/bash guuid=7f8ebb68-1900-0000-cf6b-1c16a80c0000 pid=3240->guuid=489f0a69-1900-0000-cf6b-1c16a90c0000 pid=3241 clone guuid=fd00bb6a-1900-0000-cf6b-1c16ac0c0000 pid=3244->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=8b0d1b6f-1900-0000-cf6b-1c16b20c0000 pid=3250->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=5f9b0475-1900-0000-cf6b-1c16c00c0000 pid=3264 /usr/bin/bash guuid=07bbd974-1900-0000-cf6b-1c16be0c0000 pid=3262->guuid=5f9b0475-1900-0000-cf6b-1c16c00c0000 pid=3264 clone guuid=e1be2976-1900-0000-cf6b-1c16c40c0000 pid=3268->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=cec3067b-1900-0000-cf6b-1c16cb0c0000 pid=3275->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=ee0c2c86-1900-0000-cf6b-1c16da0c0000 pid=3290 /usr/bin/bash guuid=79fb0586-1900-0000-cf6b-1c16d90c0000 pid=3289->guuid=ee0c2c86-1900-0000-cf6b-1c16da0c0000 pid=3290 clone guuid=ceb58187-1900-0000-cf6b-1c16de0c0000 pid=3294->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=65d9178d-1900-0000-cf6b-1c16e80c0000 pid=3304->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=0a201093-1900-0000-cf6b-1c16f50c0000 pid=3317 /usr/bin/bash guuid=5f23e292-1900-0000-cf6b-1c16f30c0000 pid=3315->guuid=0a201093-1900-0000-cf6b-1c16f50c0000 pid=3317 clone guuid=c8ee6194-1900-0000-cf6b-1c16fb0c0000 pid=3323->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=e4283b97-1900-0000-cf6b-1c16000d0000 pid=3328->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=28ff9f9d-1900-0000-cf6b-1c16110d0000 pid=3345 /usr/bin/bash guuid=6ce47c9d-1900-0000-cf6b-1c160f0d0000 pid=3343->guuid=28ff9f9d-1900-0000-cf6b-1c16110d0000 pid=3345 clone guuid=a5b4b19f-1900-0000-cf6b-1c16180d0000 pid=3352->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=7a6a4ba4-1900-0000-cf6b-1c16230d0000 pid=3363->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=d387d0ac-1900-0000-cf6b-1c16360d0000 pid=3382 /usr/bin/bash guuid=6b7fadac-1900-0000-cf6b-1c16350d0000 pid=3381->guuid=d387d0ac-1900-0000-cf6b-1c16360d0000 pid=3382 clone guuid=3925bbad-1900-0000-cf6b-1c163b0d0000 pid=3387->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=8701e1b0-1900-0000-cf6b-1c16420d0000 pid=3394->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=fb23cfb8-1900-0000-cf6b-1c16530d0000 pid=3411 /usr/bin/bash guuid=2b1caeb8-1900-0000-cf6b-1c16520d0000 pid=3410->guuid=fb23cfb8-1900-0000-cf6b-1c16530d0000 pid=3411 clone guuid=49624bbb-1900-0000-cf6b-1c165b0d0000 pid=3419->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=f7f194bf-1900-0000-cf6b-1c16650d0000 pid=3429->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=025334c8-1900-0000-cf6b-1c16770d0000 pid=3447 /usr/bin/bash guuid=4fc00fc8-1900-0000-cf6b-1c16760d0000 pid=3446->guuid=025334c8-1900-0000-cf6b-1c16770d0000 pid=3447 clone
Score:
99%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/6a1a2fe9ac8989421c9249cdc3cd87d35d0d668debd5b87e3e9bdeb2cd130891
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6a1a2fe9ac8989421c9249cdc3cd87d35d0d668debd5b87e3e9bdeb2cd130891/
Threat name:
Linux.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-07-29 18:31:44 UTC
File Type:
Text (Shell)
AV detection:
14 of 36 (38.89%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ninc72nmrgeuehesjhg4htmh2noq2zun5pk3q7r6tpplftitbciq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260729-w5xvqach63/
Behaviour
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.11
Link:
https://yomi.yoroi.company/submissions/6a1a2fe9ac8989421c9249cdc3cd87d35d0d668debd5b87e3e9bdeb2cd130891

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments