🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6e9f662effac38e5c7fa865fa6c2e67e770ad1ec096cc84ae6b056084e715a56. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6e9f662effac38e5c7fa865fa6c2e67e770ad1ec096cc84ae6b056084e715a56
SHA3-384 hash: c96d0adee370ef5124b746085cc807a9bd32517a6761462d8e8ff8bd50b221e863455765204bd5d01fc3fa54cf23304e
SHA1 hash: e79c7f7e808a3c281c086d6c23bb7ad2e9a2c26d
MD5 hash: 9a271976e30454fced81c67048a06aa8
humanhash: earth-blue-oregon-eight
File name:ok
Download: download sample
File size:1'608 bytes
First seen:2026-08-24 14:43:32 UTC
Last seen:2026-08-25 13:35:39 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 24:3ZotNtGQGNmJXxo34a2sCah1UP0+GDLxAf:PVl2sCah1UVGD8
TLSH T18B318A9A06501A315103CF9E7376354CB54EA5E7289FCBE0D84C0EE983487CCF662F4A
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://5.182.210.174/a8912bn/an/an/a
http://5.182.210.174/d1c667n/an/an/a
http://5.182.210.174/7c5f6an/an/an/a
http://5.182.210.174/6112e6n/an/an/a
http://5.182.210.174/2a91f9n/an/an/a
http://5.182.210.174/58f460n/an/an/a
http://5.182.210.174/381e42n/an/an/a
http://5.182.210.174/5f1bafn/an/an/a
http://5.182.210.174/661922n/an/an/a
http://5.182.210.174/2bc324n/an/an/a
http://5.182.210.174/627199n/an/an/a
http://5.182.210.174/880851n/an/an/a

Intelligence

File Origin
# of uploads :
3
# of downloads :
41
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive mirai
Link:
https://www.filescan.io/uploads/6a8c58bd31652d3db7cafde0/reports/71dcc332-72cf-4e9f-9941-dd63feed6619/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-08-24T12:53:00Z UTC
Last seen:
2026-08-25T23:28:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/6e9f662effac38e5c7fa865fa6c2e67e770ad1ec096cc84ae6b056084e715a56/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/765fcfc1-bb5e-429b-9265-6d69937c39ca
Behavior Graph:
Download SVG
%3 guuid=c69677eb-1600-0000-55b3-a4bad30d0000 pid=3539 /usr/bin/sudo guuid=1399a8ed-1600-0000-55b3-a4bad50d0000 pid=3541 /tmp/sample.bin guuid=c69677eb-1600-0000-55b3-a4bad30d0000 pid=3539->guuid=1399a8ed-1600-0000-55b3-a4bad50d0000 pid=3541 execve guuid=288180ee-1600-0000-55b3-a4bad60d0000 pid=3542 /usr/bin/wget net send-data guuid=1399a8ed-1600-0000-55b3-a4bad50d0000 pid=3541->guuid=288180ee-1600-0000-55b3-a4bad60d0000 pid=3542 execve guuid=54d805f6-1600-0000-55b3-a4bad70d0000 pid=3543 /usr/bin/curl net send-data write-file guuid=1399a8ed-1600-0000-55b3-a4bad50d0000 pid=3541->guuid=54d805f6-1600-0000-55b3-a4bad70d0000 pid=3543 execve guuid=bf563e01-1700-0000-55b3-a4bae20d0000 pid=3554 /usr/bin/chmod guuid=1399a8ed-1600-0000-55b3-a4bad50d0000 pid=3541->guuid=bf563e01-1700-0000-55b3-a4bae20d0000 pid=3554 execve guuid=c7cba101-1700-0000-55b3-a4bae40d0000 pid=3556 /usr/bin/bash guuid=1399a8ed-1600-0000-55b3-a4bad50d0000 pid=3541->guuid=c7cba101-1700-0000-55b3-a4bae40d0000 pid=3556 clone guuid=9c5a9802-1700-0000-55b3-a4bae70d0000 pid=3559 /usr/bin/rm delete-file guuid=1399a8ed-1600-0000-55b3-a4bad50d0000 pid=3541->guuid=9c5a9802-1700-0000-55b3-a4bae70d0000 pid=3559 execve guuid=5a5d3403-1700-0000-55b3-a4bae80d0000 pid=3560 /usr/bin/rm guuid=1399a8ed-1600-0000-55b3-a4bad50d0000 pid=3541->guuid=5a5d3403-1700-0000-55b3-a4bae80d0000 pid=3560 execve guuid=264bc703-1700-0000-55b3-a4bae90d0000 pid=3561 /usr/bin/wget net send-data guuid=1399a8ed-1600-0000-55b3-a4bad50d0000 pid=3541->guuid=264bc703-1700-0000-55b3-a4bae90d0000 pid=3561 execve guuid=2169e307-1700-0000-55b3-a4baed0d0000 pid=3565 /usr/bin/curl net send-data write-file guuid=1399a8ed-1600-0000-55b3-a4bad50d0000 pid=3541->guuid=2169e307-1700-0000-55b3-a4baed0d0000 pid=3565 execve guuid=3017ee0d-1700-0000-55b3-a4baf80d0000 pid=3576 /usr/bin/chmod guuid=1399a8ed-1600-0000-55b3-a4bad50d0000 pid=3541->guuid=3017ee0d-1700-0000-55b3-a4baf80d0000 pid=3576 execve guuid=9112a50e-1700-0000-55b3-a4bafa0d0000 pid=3578 /usr/bin/bash guuid=1399a8ed-1600-0000-55b3-a4bad50d0000 pid=3541->guuid=9112a50e-1700-0000-55b3-a4bafa0d0000 pid=3578 clone guuid=9f42290f-1700-0000-55b3-a4bafc0d0000 pid=3580 /usr/bin/rm delete-file guuid=1399a8ed-1600-0000-55b3-a4bad50d0000 pid=3541->guuid=9f42290f-1700-0000-55b3-a4bafc0d0000 pid=3580 execve guuid=fa41ca0f-1700-0000-55b3-a4bafe0d0000 pid=3582 /usr/bin/rm guuid=1399a8ed-1600-0000-55b3-a4bad50d0000 pid=3541->guuid=fa41ca0f-1700-0000-55b3-a4bafe0d0000 pid=3582 execve guuid=af7c6610-1700-0000-55b3-a4ba000e0000 pid=3584 /usr/bin/wget net send-data guuid=1399a8ed-1600-0000-55b3-a4bad50d0000 pid=3541->guuid=af7c6610-1700-0000-55b3-a4ba000e0000 pid=3584 execve guuid=81ee7a14-1700-0000-55b3-a4ba080e0000 pid=3592 /usr/bin/curl net send-data write-file guuid=1399a8ed-1600-0000-55b3-a4bad50d0000 pid=3541->guuid=81ee7a14-1700-0000-55b3-a4ba080e0000 pid=3592 execve guuid=08303b1b-1700-0000-55b3-a4ba1f0e0000 pid=3615 /usr/bin/chmod guuid=1399a8ed-1600-0000-55b3-a4bad50d0000 pid=3541->guuid=08303b1b-1700-0000-55b3-a4ba1f0e0000 pid=3615 execve guuid=ea6df81b-1700-0000-55b3-a4ba230e0000 pid=3619 /usr/bin/bash guuid=1399a8ed-1600-0000-55b3-a4bad50d0000 pid=3541->guuid=ea6df81b-1700-0000-55b3-a4ba230e0000 pid=3619 clone guuid=70d87e1c-1700-0000-55b3-a4ba280e0000 pid=3624 /usr/bin/rm delete-file guuid=1399a8ed-1600-0000-55b3-a4bad50d0000 pid=3541->guuid=70d87e1c-1700-0000-55b3-a4ba280e0000 pid=3624 execve guuid=ddcd241d-1700-0000-55b3-a4ba2b0e0000 pid=3627 /usr/bin/rm guuid=1399a8ed-1600-0000-55b3-a4bad50d0000 pid=3541->guuid=ddcd241d-1700-0000-55b3-a4ba2b0e0000 pid=3627 execve guuid=04e39e1d-1700-0000-55b3-a4ba2f0e0000 pid=3631 /usr/bin/wget net send-data guuid=1399a8ed-1600-0000-55b3-a4bad50d0000 pid=3541->guuid=04e39e1d-1700-0000-55b3-a4ba2f0e0000 pid=3631 execve guuid=fcd09f21-1700-0000-55b3-a4ba3e0e0000 pid=3646 /usr/bin/curl net send-data write-file guuid=1399a8ed-1600-0000-55b3-a4bad50d0000 pid=3541->guuid=fcd09f21-1700-0000-55b3-a4ba3e0e0000 pid=3646 execve guuid=758e6827-1700-0000-55b3-a4ba490e0000 pid=3657 /usr/bin/chmod guuid=1399a8ed-1600-0000-55b3-a4bad50d0000 pid=3541->guuid=758e6827-1700-0000-55b3-a4ba490e0000 pid=3657 execve guuid=1918c127-1700-0000-55b3-a4ba4a0e0000 pid=3658 /usr/bin/bash guuid=1399a8ed-1600-0000-55b3-a4bad50d0000 pid=3541->guuid=1918c127-1700-0000-55b3-a4ba4a0e0000 pid=3658 clone guuid=bee91128-1700-0000-55b3-a4ba4d0e0000 pid=3661 /usr/bin/rm delete-file guuid=1399a8ed-1600-0000-55b3-a4bad50d0000 pid=3541->guuid=bee91128-1700-0000-55b3-a4ba4d0e0000 pid=3661 execve guuid=3e5c6928-1700-0000-55b3-a4ba4e0e0000 pid=3662 /usr/bin/rm guuid=1399a8ed-1600-0000-55b3-a4bad50d0000 pid=3541->guuid=3e5c6928-1700-0000-55b3-a4ba4e0e0000 pid=3662 execve guuid=1756ba28-1700-0000-55b3-a4ba4f0e0000 pid=3663 /usr/bin/wget net send-data guuid=1399a8ed-1600-0000-55b3-a4bad50d0000 pid=3541->guuid=1756ba28-1700-0000-55b3-a4ba4f0e0000 pid=3663 execve guuid=2066962b-1700-0000-55b3-a4ba560e0000 pid=3670 /usr/bin/curl net send-data write-file guuid=1399a8ed-1600-0000-55b3-a4bad50d0000 pid=3541->guuid=2066962b-1700-0000-55b3-a4ba560e0000 pid=3670 execve guuid=05a84e2f-1700-0000-55b3-a4ba6c0e0000 pid=3692 /usr/bin/chmod guuid=1399a8ed-1600-0000-55b3-a4bad50d0000 pid=3541->guuid=05a84e2f-1700-0000-55b3-a4ba6c0e0000 pid=3692 execve guuid=c4fd962f-1700-0000-55b3-a4ba6f0e0000 pid=3695 /usr/bin/bash guuid=1399a8ed-1600-0000-55b3-a4bad50d0000 pid=3541->guuid=c4fd962f-1700-0000-55b3-a4ba6f0e0000 pid=3695 clone guuid=cc20d52f-1700-0000-55b3-a4ba710e0000 pid=3697 /usr/bin/rm delete-file guuid=1399a8ed-1600-0000-55b3-a4bad50d0000 pid=3541->guuid=cc20d52f-1700-0000-55b3-a4ba710e0000 pid=3697 execve guuid=87e03330-1700-0000-55b3-a4ba740e0000 pid=3700 /usr/bin/rm guuid=1399a8ed-1600-0000-55b3-a4bad50d0000 pid=3541->guuid=87e03330-1700-0000-55b3-a4ba740e0000 pid=3700 execve guuid=af787130-1700-0000-55b3-a4ba770e0000 pid=3703 /usr/bin/wget net send-data guuid=1399a8ed-1600-0000-55b3-a4bad50d0000 pid=3541->guuid=af787130-1700-0000-55b3-a4ba770e0000 pid=3703 execve guuid=d58edc32-1700-0000-55b3-a4ba870e0000 pid=3719 /usr/bin/curl net send-data write-file guuid=1399a8ed-1600-0000-55b3-a4bad50d0000 pid=3541->guuid=d58edc32-1700-0000-55b3-a4ba870e0000 pid=3719 execve guuid=09bd7837-1700-0000-55b3-a4ba9a0e0000 pid=3738 /usr/bin/chmod guuid=1399a8ed-1600-0000-55b3-a4bad50d0000 pid=3541->guuid=09bd7837-1700-0000-55b3-a4ba9a0e0000 pid=3738 execve guuid=d02acf37-1700-0000-55b3-a4ba9c0e0000 pid=3740 /usr/bin/bash guuid=1399a8ed-1600-0000-55b3-a4bad50d0000 pid=3541->guuid=d02acf37-1700-0000-55b3-a4ba9c0e0000 pid=3740 clone guuid=bc4f0938-1700-0000-55b3-a4ba9f0e0000 pid=3743 /usr/bin/rm delete-file guuid=1399a8ed-1600-0000-55b3-a4bad50d0000 pid=3541->guuid=bc4f0938-1700-0000-55b3-a4ba9f0e0000 pid=3743 execve guuid=00595c38-1700-0000-55b3-a4baa00e0000 pid=3744 /usr/bin/rm guuid=1399a8ed-1600-0000-55b3-a4bad50d0000 pid=3541->guuid=00595c38-1700-0000-55b3-a4baa00e0000 pid=3744 execve guuid=b5aeaa38-1700-0000-55b3-a4baa20e0000 pid=3746 /usr/bin/wget net send-data guuid=1399a8ed-1600-0000-55b3-a4bad50d0000 pid=3541->guuid=b5aeaa38-1700-0000-55b3-a4baa20e0000 pid=3746 execve guuid=412c713b-1700-0000-55b3-a4baac0e0000 pid=3756 /usr/bin/curl net send-data write-file guuid=1399a8ed-1600-0000-55b3-a4bad50d0000 pid=3541->guuid=412c713b-1700-0000-55b3-a4baac0e0000 pid=3756 execve guuid=9dc42a40-1700-0000-55b3-a4babf0e0000 pid=3775 /usr/bin/chmod guuid=1399a8ed-1600-0000-55b3-a4bad50d0000 pid=3541->guuid=9dc42a40-1700-0000-55b3-a4babf0e0000 pid=3775 execve guuid=b5457040-1700-0000-55b3-a4bac20e0000 pid=3778 /usr/bin/bash guuid=1399a8ed-1600-0000-55b3-a4bad50d0000 pid=3541->guuid=b5457040-1700-0000-55b3-a4bac20e0000 pid=3778 clone guuid=84c3b640-1700-0000-55b3-a4bac70e0000 pid=3783 /usr/bin/rm delete-file guuid=1399a8ed-1600-0000-55b3-a4bad50d0000 pid=3541->guuid=84c3b640-1700-0000-55b3-a4bac70e0000 pid=3783 execve guuid=1fb00341-1700-0000-55b3-a4bac80e0000 pid=3784 /usr/bin/rm guuid=1399a8ed-1600-0000-55b3-a4bad50d0000 pid=3541->guuid=1fb00341-1700-0000-55b3-a4bac80e0000 pid=3784 execve guuid=f66b5541-1700-0000-55b3-a4baca0e0000 pid=3786 /usr/bin/wget net send-data guuid=1399a8ed-1600-0000-55b3-a4bad50d0000 pid=3541->guuid=f66b5541-1700-0000-55b3-a4baca0e0000 pid=3786 execve guuid=73f7eb43-1700-0000-55b3-a4bad10e0000 pid=3793 /usr/bin/curl net send-data write-file guuid=1399a8ed-1600-0000-55b3-a4bad50d0000 pid=3541->guuid=73f7eb43-1700-0000-55b3-a4bad10e0000 pid=3793 execve guuid=3dd2354b-1700-0000-55b3-a4baf50e0000 pid=3829 /usr/bin/chmod guuid=1399a8ed-1600-0000-55b3-a4bad50d0000 pid=3541->guuid=3dd2354b-1700-0000-55b3-a4baf50e0000 pid=3829 execve guuid=483d034c-1700-0000-55b3-a4baf80e0000 pid=3832 /usr/bin/bash guuid=1399a8ed-1600-0000-55b3-a4bad50d0000 pid=3541->guuid=483d034c-1700-0000-55b3-a4baf80e0000 pid=3832 clone guuid=dd15a64c-1700-0000-55b3-a4bafb0e0000 pid=3835 /usr/bin/rm delete-file guuid=1399a8ed-1600-0000-55b3-a4bad50d0000 pid=3541->guuid=dd15a64c-1700-0000-55b3-a4bafb0e0000 pid=3835 execve guuid=f0b6724d-1700-0000-55b3-a4bafe0e0000 pid=3838 /usr/bin/rm guuid=1399a8ed-1600-0000-55b3-a4bad50d0000 pid=3541->guuid=f0b6724d-1700-0000-55b3-a4bafe0e0000 pid=3838 execve guuid=184c3b4e-1700-0000-55b3-a4ba000f0000 pid=3840 /usr/bin/wget net send-data guuid=1399a8ed-1600-0000-55b3-a4bad50d0000 pid=3541->guuid=184c3b4e-1700-0000-55b3-a4ba000f0000 pid=3840 execve guuid=6b979d52-1700-0000-55b3-a4ba0e0f0000 pid=3854 /usr/bin/curl net send-data write-file guuid=1399a8ed-1600-0000-55b3-a4bad50d0000 pid=3541->guuid=6b979d52-1700-0000-55b3-a4ba0e0f0000 pid=3854 execve guuid=46d23156-1700-0000-55b3-a4ba230f0000 pid=3875 /usr/bin/chmod guuid=1399a8ed-1600-0000-55b3-a4bad50d0000 pid=3541->guuid=46d23156-1700-0000-55b3-a4ba230f0000 pid=3875 execve guuid=3e1d6b56-1700-0000-55b3-a4ba260f0000 pid=3878 /usr/bin/bash guuid=1399a8ed-1600-0000-55b3-a4bad50d0000 pid=3541->guuid=3e1d6b56-1700-0000-55b3-a4ba260f0000 pid=3878 clone guuid=d8a8c856-1700-0000-55b3-a4ba2a0f0000 pid=3882 /usr/bin/rm delete-file guuid=1399a8ed-1600-0000-55b3-a4bad50d0000 pid=3541->guuid=d8a8c856-1700-0000-55b3-a4ba2a0f0000 pid=3882 execve guuid=bd0b0657-1700-0000-55b3-a4ba2b0f0000 pid=3883 /usr/bin/rm guuid=1399a8ed-1600-0000-55b3-a4bad50d0000 pid=3541->guuid=bd0b0657-1700-0000-55b3-a4ba2b0f0000 pid=3883 execve guuid=14104657-1700-0000-55b3-a4ba2e0f0000 pid=3886 /usr/bin/wget net send-data guuid=1399a8ed-1600-0000-55b3-a4bad50d0000 pid=3541->guuid=14104657-1700-0000-55b3-a4ba2e0f0000 pid=3886 execve guuid=cbbb9659-1700-0000-55b3-a4ba3b0f0000 pid=3899 /usr/bin/curl net send-data write-file guuid=1399a8ed-1600-0000-55b3-a4bad50d0000 pid=3541->guuid=cbbb9659-1700-0000-55b3-a4ba3b0f0000 pid=3899 execve guuid=785fc85c-1700-0000-55b3-a4ba490f0000 pid=3913 /usr/bin/chmod guuid=1399a8ed-1600-0000-55b3-a4bad50d0000 pid=3541->guuid=785fc85c-1700-0000-55b3-a4ba490f0000 pid=3913 execve guuid=f84c075d-1700-0000-55b3-a4ba4b0f0000 pid=3915 /usr/bin/bash guuid=1399a8ed-1600-0000-55b3-a4bad50d0000 pid=3541->guuid=f84c075d-1700-0000-55b3-a4ba4b0f0000 pid=3915 clone guuid=029e345d-1700-0000-55b3-a4ba4d0f0000 pid=3917 /usr/bin/rm delete-file guuid=1399a8ed-1600-0000-55b3-a4bad50d0000 pid=3541->guuid=029e345d-1700-0000-55b3-a4ba4d0f0000 pid=3917 execve guuid=1734715d-1700-0000-55b3-a4ba510f0000 pid=3921 /usr/bin/rm guuid=1399a8ed-1600-0000-55b3-a4bad50d0000 pid=3541->guuid=1734715d-1700-0000-55b3-a4ba510f0000 pid=3921 execve guuid=1b04ab5d-1700-0000-55b3-a4ba520f0000 pid=3922 /usr/bin/wget net send-data guuid=1399a8ed-1600-0000-55b3-a4bad50d0000 pid=3541->guuid=1b04ab5d-1700-0000-55b3-a4ba520f0000 pid=3922 execve guuid=0a2f0960-1700-0000-55b3-a4ba5d0f0000 pid=3933 /usr/bin/curl net send-data write-file guuid=1399a8ed-1600-0000-55b3-a4bad50d0000 pid=3541->guuid=0a2f0960-1700-0000-55b3-a4ba5d0f0000 pid=3933 execve guuid=12afbd63-1700-0000-55b3-a4ba710f0000 pid=3953 /usr/bin/chmod guuid=1399a8ed-1600-0000-55b3-a4bad50d0000 pid=3541->guuid=12afbd63-1700-0000-55b3-a4ba710f0000 pid=3953 execve guuid=89582d64-1700-0000-55b3-a4ba740f0000 pid=3956 /usr/bin/bash guuid=1399a8ed-1600-0000-55b3-a4bad50d0000 pid=3541->guuid=89582d64-1700-0000-55b3-a4ba740f0000 pid=3956 clone guuid=b6266564-1700-0000-55b3-a4ba770f0000 pid=3959 /usr/bin/rm delete-file guuid=1399a8ed-1600-0000-55b3-a4bad50d0000 pid=3541->guuid=b6266564-1700-0000-55b3-a4ba770f0000 pid=3959 execve guuid=979ca464-1700-0000-55b3-a4ba790f0000 pid=3961 /usr/bin/rm guuid=1399a8ed-1600-0000-55b3-a4bad50d0000 pid=3541->guuid=979ca464-1700-0000-55b3-a4ba790f0000 pid=3961 execve guuid=9508e964-1700-0000-55b3-a4ba7d0f0000 pid=3965 /usr/bin/wget net send-data guuid=1399a8ed-1600-0000-55b3-a4bad50d0000 pid=3541->guuid=9508e964-1700-0000-55b3-a4ba7d0f0000 pid=3965 execve guuid=64547167-1700-0000-55b3-a4ba870f0000 pid=3975 /usr/bin/curl net send-data write-file guuid=1399a8ed-1600-0000-55b3-a4bad50d0000 pid=3541->guuid=64547167-1700-0000-55b3-a4ba870f0000 pid=3975 execve guuid=51e2786a-1700-0000-55b3-a4ba990f0000 pid=3993 /usr/bin/chmod guuid=1399a8ed-1600-0000-55b3-a4bad50d0000 pid=3541->guuid=51e2786a-1700-0000-55b3-a4ba990f0000 pid=3993 execve guuid=cab8af6a-1700-0000-55b3-a4ba9b0f0000 pid=3995 /usr/bin/bash guuid=1399a8ed-1600-0000-55b3-a4bad50d0000 pid=3541->guuid=cab8af6a-1700-0000-55b3-a4ba9b0f0000 pid=3995 clone guuid=2ea6dc6a-1700-0000-55b3-a4ba9d0f0000 pid=3997 /usr/bin/rm delete-file guuid=1399a8ed-1600-0000-55b3-a4bad50d0000 pid=3541->guuid=2ea6dc6a-1700-0000-55b3-a4ba9d0f0000 pid=3997 execve guuid=6985136b-1700-0000-55b3-a4ba9f0f0000 pid=3999 /usr/bin/rm guuid=1399a8ed-1600-0000-55b3-a4bad50d0000 pid=3541->guuid=6985136b-1700-0000-55b3-a4ba9f0f0000 pid=3999 execve 5b654972-c9e1-50d8-b372-2dc2a5b9ad66 5.182.210.174:80 guuid=288180ee-1600-0000-55b3-a4bad60d0000 pid=3542->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=54d805f6-1600-0000-55b3-a4bad70d0000 pid=3543->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=f6e45402-1700-0000-55b3-a4bae60d0000 pid=3558 /usr/bin/bash guuid=c7cba101-1700-0000-55b3-a4bae40d0000 pid=3556->guuid=f6e45402-1700-0000-55b3-a4bae60d0000 pid=3558 clone guuid=264bc703-1700-0000-55b3-a4bae90d0000 pid=3561->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=2169e307-1700-0000-55b3-a4baed0d0000 pid=3565->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=1049d80e-1700-0000-55b3-a4bafb0d0000 pid=3579 /usr/bin/bash guuid=9112a50e-1700-0000-55b3-a4bafa0d0000 pid=3578->guuid=1049d80e-1700-0000-55b3-a4bafb0d0000 pid=3579 clone guuid=af7c6610-1700-0000-55b3-a4ba000e0000 pid=3584->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=81ee7a14-1700-0000-55b3-a4ba080e0000 pid=3592->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=72e1311c-1700-0000-55b3-a4ba270e0000 pid=3623 /usr/bin/bash guuid=ea6df81b-1700-0000-55b3-a4ba230e0000 pid=3619->guuid=72e1311c-1700-0000-55b3-a4ba270e0000 pid=3623 clone guuid=04e39e1d-1700-0000-55b3-a4ba2f0e0000 pid=3631->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=fcd09f21-1700-0000-55b3-a4ba3e0e0000 pid=3646->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=f59fe227-1700-0000-55b3-a4ba4b0e0000 pid=3659 /usr/bin/bash guuid=1918c127-1700-0000-55b3-a4ba4a0e0000 pid=3658->guuid=f59fe227-1700-0000-55b3-a4ba4b0e0000 pid=3659 clone guuid=1756ba28-1700-0000-55b3-a4ba4f0e0000 pid=3663->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=2066962b-1700-0000-55b3-a4ba560e0000 pid=3670->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=c0ceb82f-1700-0000-55b3-a4ba700e0000 pid=3696 /usr/bin/bash guuid=c4fd962f-1700-0000-55b3-a4ba6f0e0000 pid=3695->guuid=c0ceb82f-1700-0000-55b3-a4ba700e0000 pid=3696 clone guuid=af787130-1700-0000-55b3-a4ba770e0000 pid=3703->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=d58edc32-1700-0000-55b3-a4ba870e0000 pid=3719->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=fe72e437-1700-0000-55b3-a4ba9d0e0000 pid=3741 /usr/bin/bash guuid=d02acf37-1700-0000-55b3-a4ba9c0e0000 pid=3740->guuid=fe72e437-1700-0000-55b3-a4ba9d0e0000 pid=3741 clone guuid=b5aeaa38-1700-0000-55b3-a4baa20e0000 pid=3746->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=412c713b-1700-0000-55b3-a4baac0e0000 pid=3756->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=26838b40-1700-0000-55b3-a4bac30e0000 pid=3779 /usr/bin/bash guuid=b5457040-1700-0000-55b3-a4bac20e0000 pid=3778->guuid=26838b40-1700-0000-55b3-a4bac30e0000 pid=3779 clone guuid=f66b5541-1700-0000-55b3-a4baca0e0000 pid=3786->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=73f7eb43-1700-0000-55b3-a4bad10e0000 pid=3793->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=5d884c4c-1700-0000-55b3-a4bafa0e0000 pid=3834 /usr/bin/bash guuid=483d034c-1700-0000-55b3-a4baf80e0000 pid=3832->guuid=5d884c4c-1700-0000-55b3-a4bafa0e0000 pid=3834 clone guuid=184c3b4e-1700-0000-55b3-a4ba000f0000 pid=3840->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=6b979d52-1700-0000-55b3-a4ba0e0f0000 pid=3854->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=f8b37e56-1700-0000-55b3-a4ba270f0000 pid=3879 /usr/bin/bash guuid=3e1d6b56-1700-0000-55b3-a4ba260f0000 pid=3878->guuid=f8b37e56-1700-0000-55b3-a4ba270f0000 pid=3879 clone guuid=14104657-1700-0000-55b3-a4ba2e0f0000 pid=3886->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=cbbb9659-1700-0000-55b3-a4ba3b0f0000 pid=3899->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=58ab195d-1700-0000-55b3-a4ba4c0f0000 pid=3916 /usr/bin/bash guuid=f84c075d-1700-0000-55b3-a4ba4b0f0000 pid=3915->guuid=58ab195d-1700-0000-55b3-a4ba4c0f0000 pid=3916 clone guuid=1b04ab5d-1700-0000-55b3-a4ba520f0000 pid=3922->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=0a2f0960-1700-0000-55b3-a4ba5d0f0000 pid=3933->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=17bc4864-1700-0000-55b3-a4ba750f0000 pid=3957 /usr/bin/bash guuid=89582d64-1700-0000-55b3-a4ba740f0000 pid=3956->guuid=17bc4864-1700-0000-55b3-a4ba750f0000 pid=3957 clone guuid=9508e964-1700-0000-55b3-a4ba7d0f0000 pid=3965->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=64547167-1700-0000-55b3-a4ba870f0000 pid=3975->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=b671c16a-1700-0000-55b3-a4ba9c0f0000 pid=3996 /usr/bin/bash guuid=cab8af6a-1700-0000-55b3-a4ba9b0f0000 pid=3995->guuid=b671c16a-1700-0000-55b3-a4ba9c0f0000 pid=3996 clone
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/6e9f662effac38e5c7fa865fa6c2e67e770ad1ec096cc84ae6b056084e715a56
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6e9f662effac38e5c7fa865fa6c2e67e770ad1ec096cc84ae6b056084e715a56/
Threat name:
Linux.Trojan.Malgent
Create hunting rule
Status:
Malicious
First seen:
2026-08-24 14:44:19 UTC
File Type:
Text (Shell)
AV detection:
18 of 38 (47.37%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=n2pwmlx7vq4olr72qzp2nqxgpz3qvupmbfwmqsxgwblaqttrljla._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260824-r38f8avxcz/
Behaviour
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.11
Link:
https://yomi.yoroi.company/submissions/6e9f662effac38e5c7fa865fa6c2e67e770ad1ec096cc84ae6b056084e715a56

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 6e9f662effac38e5c7fa865fa6c2e67e770ad1ec096cc84ae6b056084e715a56

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3897671/
  
Delivery method
Distributed via web download

Comments