🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 72f3dc51b371c370ee4d03f5069c2b0c0747ce5bd38a9aa017f744c7b403bb90. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 72f3dc51b371c370ee4d03f5069c2b0c0747ce5bd38a9aa017f744c7b403bb90
SHA3-384 hash: 912ba2cc1273a010906cbfc7bec26ea6ba94d71364dc29ecf01057f8e0146dddec1466f8227f9e376de3c70f4d668425
SHA1 hash: 1f8541ee0e34ca59e7714323932086687c7873d0
MD5 hash: 29fb725cfd074683f548c2b85d2e7027
humanhash: louisiana-uranus-queen-zulu
File name:ok
Download: download sample
File size:1'608 bytes
First seen:2026-08-29 21:23:37 UTC
Last seen:2026-08-30 02:08:11 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 24:fq1qqZILkSFOOtB/FZSSOBBFudS/2nG8nGAF1jNNW8Wp1l:vLkSw9jq1vW8Wp1l
TLSH T15B3161AB00109B722503DE9D7776308CA2AD95FB699FD7D4C8080ED982493CCF595F4E
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://5.182.210.174/35e935n/an/an/a
http://5.182.210.174/518c7dn/an/an/a
http://5.182.210.174/6d37f4n/an/an/a
http://5.182.210.174/1fa983n/an/an/a
http://5.182.210.174/7df419n/an/an/a
http://5.182.210.174/918c55n/an/an/a
http://5.182.210.174/9c5d24n/an/an/a
http://5.182.210.174/80d748n/an/an/a
http://5.182.210.174/75bbcbn/an/an/a
http://5.182.210.174/d135den/an/an/a
http://5.182.210.174/877f43n/an/an/a
http://5.182.210.174/5f3618n/an/an/a

Intelligence

File Origin
# of uploads :
2
# of downloads :
67
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive mirai
Link:
https://www.filescan.io/uploads/6a934df951af5d4b2e3893c1/reports/b2d5ead6-94c9-4802-ac4c-44a27280282d/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-08-29T19:27:00Z UTC
Last seen:
2026-08-31T00:41:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/72f3dc51b371c370ee4d03f5069c2b0c0747ce5bd38a9aa017f744c7b403bb90/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/cb4bcf10-fa4f-4d13-b488-02dbfecb6ed3
Behavior Graph:
Download SVG
%3 guuid=8339efc5-1900-0000-2a13-66a001080000 pid=2049 /usr/bin/sudo guuid=a0b64ac8-1900-0000-2a13-66a004080000 pid=2052 /tmp/sample.bin guuid=8339efc5-1900-0000-2a13-66a001080000 pid=2049->guuid=a0b64ac8-1900-0000-2a13-66a004080000 pid=2052 execve guuid=9e4db3c8-1900-0000-2a13-66a006080000 pid=2054 /usr/bin/wget net send-data guuid=a0b64ac8-1900-0000-2a13-66a004080000 pid=2052->guuid=9e4db3c8-1900-0000-2a13-66a006080000 pid=2054 execve guuid=352ce2cf-1900-0000-2a13-66a00d080000 pid=2061 /usr/bin/curl net send-data write-file guuid=a0b64ac8-1900-0000-2a13-66a004080000 pid=2052->guuid=352ce2cf-1900-0000-2a13-66a00d080000 pid=2061 execve guuid=2411a2e3-1900-0000-2a13-66a031080000 pid=2097 /usr/bin/chmod guuid=a0b64ac8-1900-0000-2a13-66a004080000 pid=2052->guuid=2411a2e3-1900-0000-2a13-66a031080000 pid=2097 execve guuid=ddbfefe3-1900-0000-2a13-66a033080000 pid=2099 /usr/bin/bash guuid=a0b64ac8-1900-0000-2a13-66a004080000 pid=2052->guuid=ddbfefe3-1900-0000-2a13-66a033080000 pid=2099 clone guuid=742634e4-1900-0000-2a13-66a035080000 pid=2101 /usr/bin/rm delete-file guuid=a0b64ac8-1900-0000-2a13-66a004080000 pid=2052->guuid=742634e4-1900-0000-2a13-66a035080000 pid=2101 execve guuid=3f0b78e4-1900-0000-2a13-66a037080000 pid=2103 /usr/bin/rm guuid=a0b64ac8-1900-0000-2a13-66a004080000 pid=2052->guuid=3f0b78e4-1900-0000-2a13-66a037080000 pid=2103 execve guuid=51a3bde4-1900-0000-2a13-66a039080000 pid=2105 /usr/bin/wget net send-data guuid=a0b64ac8-1900-0000-2a13-66a004080000 pid=2052->guuid=51a3bde4-1900-0000-2a13-66a039080000 pid=2105 execve guuid=72fc94e7-1900-0000-2a13-66a042080000 pid=2114 /usr/bin/curl net send-data write-file guuid=a0b64ac8-1900-0000-2a13-66a004080000 pid=2052->guuid=72fc94e7-1900-0000-2a13-66a042080000 pid=2114 execve guuid=c66a64ed-1900-0000-2a13-66a04f080000 pid=2127 /usr/bin/chmod guuid=a0b64ac8-1900-0000-2a13-66a004080000 pid=2052->guuid=c66a64ed-1900-0000-2a13-66a04f080000 pid=2127 execve guuid=f4e7d9ed-1900-0000-2a13-66a052080000 pid=2130 /usr/bin/bash guuid=a0b64ac8-1900-0000-2a13-66a004080000 pid=2052->guuid=f4e7d9ed-1900-0000-2a13-66a052080000 pid=2130 clone guuid=efd128ee-1900-0000-2a13-66a054080000 pid=2132 /usr/bin/rm delete-file guuid=a0b64ac8-1900-0000-2a13-66a004080000 pid=2052->guuid=efd128ee-1900-0000-2a13-66a054080000 pid=2132 execve guuid=eeb780ee-1900-0000-2a13-66a056080000 pid=2134 /usr/bin/rm guuid=a0b64ac8-1900-0000-2a13-66a004080000 pid=2052->guuid=eeb780ee-1900-0000-2a13-66a056080000 pid=2134 execve guuid=34dcd7ee-1900-0000-2a13-66a058080000 pid=2136 /usr/bin/wget net send-data guuid=a0b64ac8-1900-0000-2a13-66a004080000 pid=2052->guuid=34dcd7ee-1900-0000-2a13-66a058080000 pid=2136 execve guuid=cc47e4f1-1900-0000-2a13-66a061080000 pid=2145 /usr/bin/curl net send-data write-file guuid=a0b64ac8-1900-0000-2a13-66a004080000 pid=2052->guuid=cc47e4f1-1900-0000-2a13-66a061080000 pid=2145 execve guuid=6503bdf8-1900-0000-2a13-66a070080000 pid=2160 /usr/bin/chmod guuid=a0b64ac8-1900-0000-2a13-66a004080000 pid=2052->guuid=6503bdf8-1900-0000-2a13-66a070080000 pid=2160 execve guuid=66bb13f9-1900-0000-2a13-66a071080000 pid=2161 /usr/bin/bash guuid=a0b64ac8-1900-0000-2a13-66a004080000 pid=2052->guuid=66bb13f9-1900-0000-2a13-66a071080000 pid=2161 clone guuid=542961f9-1900-0000-2a13-66a074080000 pid=2164 /usr/bin/rm delete-file guuid=a0b64ac8-1900-0000-2a13-66a004080000 pid=2052->guuid=542961f9-1900-0000-2a13-66a074080000 pid=2164 execve guuid=dab6cff9-1900-0000-2a13-66a075080000 pid=2165 /usr/bin/rm guuid=a0b64ac8-1900-0000-2a13-66a004080000 pid=2052->guuid=dab6cff9-1900-0000-2a13-66a075080000 pid=2165 execve guuid=73c94dfa-1900-0000-2a13-66a077080000 pid=2167 /usr/bin/wget net send-data guuid=a0b64ac8-1900-0000-2a13-66a004080000 pid=2052->guuid=73c94dfa-1900-0000-2a13-66a077080000 pid=2167 execve guuid=d0bf7efe-1900-0000-2a13-66a081080000 pid=2177 /usr/bin/curl net send-data write-file guuid=a0b64ac8-1900-0000-2a13-66a004080000 pid=2052->guuid=d0bf7efe-1900-0000-2a13-66a081080000 pid=2177 execve guuid=11b72c06-1a00-0000-2a13-66a091080000 pid=2193 /usr/bin/chmod guuid=a0b64ac8-1900-0000-2a13-66a004080000 pid=2052->guuid=11b72c06-1a00-0000-2a13-66a091080000 pid=2193 execve guuid=65069006-1a00-0000-2a13-66a093080000 pid=2195 /usr/bin/bash guuid=a0b64ac8-1900-0000-2a13-66a004080000 pid=2052->guuid=65069006-1a00-0000-2a13-66a093080000 pid=2195 clone guuid=e1f2de06-1a00-0000-2a13-66a095080000 pid=2197 /usr/bin/rm delete-file guuid=a0b64ac8-1900-0000-2a13-66a004080000 pid=2052->guuid=e1f2de06-1a00-0000-2a13-66a095080000 pid=2197 execve guuid=a7723d07-1a00-0000-2a13-66a096080000 pid=2198 /usr/bin/rm guuid=a0b64ac8-1900-0000-2a13-66a004080000 pid=2052->guuid=a7723d07-1a00-0000-2a13-66a096080000 pid=2198 execve guuid=f5169907-1a00-0000-2a13-66a098080000 pid=2200 /usr/bin/wget net send-data guuid=a0b64ac8-1900-0000-2a13-66a004080000 pid=2052->guuid=f5169907-1a00-0000-2a13-66a098080000 pid=2200 execve guuid=5336fb09-1a00-0000-2a13-66a09e080000 pid=2206 /usr/bin/curl net send-data write-file guuid=a0b64ac8-1900-0000-2a13-66a004080000 pid=2052->guuid=5336fb09-1a00-0000-2a13-66a09e080000 pid=2206 execve guuid=4607ae0d-1a00-0000-2a13-66a0a2080000 pid=2210 /usr/bin/chmod guuid=a0b64ac8-1900-0000-2a13-66a004080000 pid=2052->guuid=4607ae0d-1a00-0000-2a13-66a0a2080000 pid=2210 execve guuid=c84b1c0e-1a00-0000-2a13-66a0a4080000 pid=2212 /usr/bin/bash guuid=a0b64ac8-1900-0000-2a13-66a004080000 pid=2052->guuid=c84b1c0e-1a00-0000-2a13-66a0a4080000 pid=2212 clone guuid=7ce9730e-1a00-0000-2a13-66a0a7080000 pid=2215 /usr/bin/rm delete-file guuid=a0b64ac8-1900-0000-2a13-66a004080000 pid=2052->guuid=7ce9730e-1a00-0000-2a13-66a0a7080000 pid=2215 execve guuid=f0a6e80e-1a00-0000-2a13-66a0a8080000 pid=2216 /usr/bin/rm guuid=a0b64ac8-1900-0000-2a13-66a004080000 pid=2052->guuid=f0a6e80e-1a00-0000-2a13-66a0a8080000 pid=2216 execve guuid=74ed490f-1a00-0000-2a13-66a0aa080000 pid=2218 /usr/bin/wget net send-data guuid=a0b64ac8-1900-0000-2a13-66a004080000 pid=2052->guuid=74ed490f-1a00-0000-2a13-66a0aa080000 pid=2218 execve guuid=c0b33a12-1a00-0000-2a13-66a0ad080000 pid=2221 /usr/bin/curl net send-data write-file guuid=a0b64ac8-1900-0000-2a13-66a004080000 pid=2052->guuid=c0b33a12-1a00-0000-2a13-66a0ad080000 pid=2221 execve guuid=75ca2217-1a00-0000-2a13-66a0b4080000 pid=2228 /usr/bin/chmod guuid=a0b64ac8-1900-0000-2a13-66a004080000 pid=2052->guuid=75ca2217-1a00-0000-2a13-66a0b4080000 pid=2228 execve guuid=0a1af017-1a00-0000-2a13-66a0b5080000 pid=2229 /usr/bin/bash guuid=a0b64ac8-1900-0000-2a13-66a004080000 pid=2052->guuid=0a1af017-1a00-0000-2a13-66a0b5080000 pid=2229 clone guuid=03dac918-1a00-0000-2a13-66a0b8080000 pid=2232 /usr/bin/rm delete-file guuid=a0b64ac8-1900-0000-2a13-66a004080000 pid=2052->guuid=03dac918-1a00-0000-2a13-66a0b8080000 pid=2232 execve guuid=f7348119-1a00-0000-2a13-66a0bb080000 pid=2235 /usr/bin/rm guuid=a0b64ac8-1900-0000-2a13-66a004080000 pid=2052->guuid=f7348119-1a00-0000-2a13-66a0bb080000 pid=2235 execve guuid=60834c1a-1a00-0000-2a13-66a0be080000 pid=2238 /usr/bin/wget net send-data guuid=a0b64ac8-1900-0000-2a13-66a004080000 pid=2052->guuid=60834c1a-1a00-0000-2a13-66a0be080000 pid=2238 execve guuid=6848f01d-1a00-0000-2a13-66a0c5080000 pid=2245 /usr/bin/curl net send-data write-file guuid=a0b64ac8-1900-0000-2a13-66a004080000 pid=2052->guuid=6848f01d-1a00-0000-2a13-66a0c5080000 pid=2245 execve guuid=9b6a6122-1a00-0000-2a13-66a0cc080000 pid=2252 /usr/bin/chmod guuid=a0b64ac8-1900-0000-2a13-66a004080000 pid=2052->guuid=9b6a6122-1a00-0000-2a13-66a0cc080000 pid=2252 execve guuid=8602a122-1a00-0000-2a13-66a0cd080000 pid=2253 /usr/bin/bash guuid=a0b64ac8-1900-0000-2a13-66a004080000 pid=2052->guuid=8602a122-1a00-0000-2a13-66a0cd080000 pid=2253 clone guuid=2ae3d322-1a00-0000-2a13-66a0cf080000 pid=2255 /usr/bin/rm delete-file guuid=a0b64ac8-1900-0000-2a13-66a004080000 pid=2052->guuid=2ae3d322-1a00-0000-2a13-66a0cf080000 pid=2255 execve guuid=a08b2423-1a00-0000-2a13-66a0d0080000 pid=2256 /usr/bin/rm guuid=a0b64ac8-1900-0000-2a13-66a004080000 pid=2052->guuid=a08b2423-1a00-0000-2a13-66a0d0080000 pid=2256 execve guuid=01e78323-1a00-0000-2a13-66a0d2080000 pid=2258 /usr/bin/wget net send-data guuid=a0b64ac8-1900-0000-2a13-66a004080000 pid=2052->guuid=01e78323-1a00-0000-2a13-66a0d2080000 pid=2258 execve guuid=136e7e28-1a00-0000-2a13-66a0de080000 pid=2270 /usr/bin/curl net send-data write-file guuid=a0b64ac8-1900-0000-2a13-66a004080000 pid=2052->guuid=136e7e28-1a00-0000-2a13-66a0de080000 pid=2270 execve guuid=e43c6e34-1a00-0000-2a13-66a0f3080000 pid=2291 /usr/bin/chmod guuid=a0b64ac8-1900-0000-2a13-66a004080000 pid=2052->guuid=e43c6e34-1a00-0000-2a13-66a0f3080000 pid=2291 execve guuid=91f6e434-1a00-0000-2a13-66a0f5080000 pid=2293 /usr/bin/bash guuid=a0b64ac8-1900-0000-2a13-66a004080000 pid=2052->guuid=91f6e434-1a00-0000-2a13-66a0f5080000 pid=2293 clone guuid=9cea3b35-1a00-0000-2a13-66a0f7080000 pid=2295 /usr/bin/rm delete-file guuid=a0b64ac8-1900-0000-2a13-66a004080000 pid=2052->guuid=9cea3b35-1a00-0000-2a13-66a0f7080000 pid=2295 execve guuid=f9bcb735-1a00-0000-2a13-66a0f9080000 pid=2297 /usr/bin/rm guuid=a0b64ac8-1900-0000-2a13-66a004080000 pid=2052->guuid=f9bcb735-1a00-0000-2a13-66a0f9080000 pid=2297 execve guuid=23cd4436-1a00-0000-2a13-66a0fb080000 pid=2299 /usr/bin/wget net send-data guuid=a0b64ac8-1900-0000-2a13-66a004080000 pid=2052->guuid=23cd4436-1a00-0000-2a13-66a0fb080000 pid=2299 execve guuid=96b4ad3c-1a00-0000-2a13-66a003090000 pid=2307 /usr/bin/curl net send-data write-file guuid=a0b64ac8-1900-0000-2a13-66a004080000 pid=2052->guuid=96b4ad3c-1a00-0000-2a13-66a003090000 pid=2307 execve guuid=841fea44-1a00-0000-2a13-66a00f090000 pid=2319 /usr/bin/chmod guuid=a0b64ac8-1900-0000-2a13-66a004080000 pid=2052->guuid=841fea44-1a00-0000-2a13-66a00f090000 pid=2319 execve guuid=a5b27645-1a00-0000-2a13-66a011090000 pid=2321 /usr/bin/bash guuid=a0b64ac8-1900-0000-2a13-66a004080000 pid=2052->guuid=a5b27645-1a00-0000-2a13-66a011090000 pid=2321 clone guuid=6323d545-1a00-0000-2a13-66a014090000 pid=2324 /usr/bin/rm delete-file guuid=a0b64ac8-1900-0000-2a13-66a004080000 pid=2052->guuid=6323d545-1a00-0000-2a13-66a014090000 pid=2324 execve guuid=3b695d46-1a00-0000-2a13-66a015090000 pid=2325 /usr/bin/rm guuid=a0b64ac8-1900-0000-2a13-66a004080000 pid=2052->guuid=3b695d46-1a00-0000-2a13-66a015090000 pid=2325 execve guuid=ece27847-1a00-0000-2a13-66a017090000 pid=2327 /usr/bin/wget net send-data guuid=a0b64ac8-1900-0000-2a13-66a004080000 pid=2052->guuid=ece27847-1a00-0000-2a13-66a017090000 pid=2327 execve guuid=e65dbe4c-1a00-0000-2a13-66a01d090000 pid=2333 /usr/bin/curl net send-data write-file guuid=a0b64ac8-1900-0000-2a13-66a004080000 pid=2052->guuid=e65dbe4c-1a00-0000-2a13-66a01d090000 pid=2333 execve guuid=16ee3355-1a00-0000-2a13-66a01e090000 pid=2334 /usr/bin/chmod guuid=a0b64ac8-1900-0000-2a13-66a004080000 pid=2052->guuid=16ee3355-1a00-0000-2a13-66a01e090000 pid=2334 execve guuid=e680dd55-1a00-0000-2a13-66a01f090000 pid=2335 /usr/bin/bash guuid=a0b64ac8-1900-0000-2a13-66a004080000 pid=2052->guuid=e680dd55-1a00-0000-2a13-66a01f090000 pid=2335 clone guuid=39f26856-1a00-0000-2a13-66a021090000 pid=2337 /usr/bin/rm delete-file guuid=a0b64ac8-1900-0000-2a13-66a004080000 pid=2052->guuid=39f26856-1a00-0000-2a13-66a021090000 pid=2337 execve guuid=21d34457-1a00-0000-2a13-66a022090000 pid=2338 /usr/bin/rm guuid=a0b64ac8-1900-0000-2a13-66a004080000 pid=2052->guuid=21d34457-1a00-0000-2a13-66a022090000 pid=2338 execve guuid=2aaa0958-1a00-0000-2a13-66a023090000 pid=2339 /usr/bin/wget net send-data guuid=a0b64ac8-1900-0000-2a13-66a004080000 pid=2052->guuid=2aaa0958-1a00-0000-2a13-66a023090000 pid=2339 execve guuid=7c54b55d-1a00-0000-2a13-66a027090000 pid=2343 /usr/bin/curl net send-data write-file guuid=a0b64ac8-1900-0000-2a13-66a004080000 pid=2052->guuid=7c54b55d-1a00-0000-2a13-66a027090000 pid=2343 execve guuid=a311b564-1a00-0000-2a13-66a031090000 pid=2353 /usr/bin/chmod guuid=a0b64ac8-1900-0000-2a13-66a004080000 pid=2052->guuid=a311b564-1a00-0000-2a13-66a031090000 pid=2353 execve guuid=e10f8965-1a00-0000-2a13-66a032090000 pid=2354 /usr/bin/bash guuid=a0b64ac8-1900-0000-2a13-66a004080000 pid=2052->guuid=e10f8965-1a00-0000-2a13-66a032090000 pid=2354 clone guuid=6c681366-1a00-0000-2a13-66a035090000 pid=2357 /usr/bin/rm delete-file guuid=a0b64ac8-1900-0000-2a13-66a004080000 pid=2052->guuid=6c681366-1a00-0000-2a13-66a035090000 pid=2357 execve guuid=ae181167-1a00-0000-2a13-66a038090000 pid=2360 /usr/bin/rm guuid=a0b64ac8-1900-0000-2a13-66a004080000 pid=2052->guuid=ae181167-1a00-0000-2a13-66a038090000 pid=2360 execve guuid=60ed0268-1a00-0000-2a13-66a03b090000 pid=2363 /usr/bin/wget net send-data guuid=a0b64ac8-1900-0000-2a13-66a004080000 pid=2052->guuid=60ed0268-1a00-0000-2a13-66a03b090000 pid=2363 execve guuid=79db876c-1a00-0000-2a13-66a040090000 pid=2368 /usr/bin/curl net send-data write-file guuid=a0b64ac8-1900-0000-2a13-66a004080000 pid=2052->guuid=79db876c-1a00-0000-2a13-66a040090000 pid=2368 execve guuid=6ce3a874-1a00-0000-2a13-66a04c090000 pid=2380 /usr/bin/chmod guuid=a0b64ac8-1900-0000-2a13-66a004080000 pid=2052->guuid=6ce3a874-1a00-0000-2a13-66a04c090000 pid=2380 execve guuid=583b6875-1a00-0000-2a13-66a04d090000 pid=2381 /usr/bin/bash guuid=a0b64ac8-1900-0000-2a13-66a004080000 pid=2052->guuid=583b6875-1a00-0000-2a13-66a04d090000 pid=2381 clone guuid=40d4c475-1a00-0000-2a13-66a04f090000 pid=2383 /usr/bin/rm delete-file guuid=a0b64ac8-1900-0000-2a13-66a004080000 pid=2052->guuid=40d4c475-1a00-0000-2a13-66a04f090000 pid=2383 execve guuid=22960776-1a00-0000-2a13-66a050090000 pid=2384 /usr/bin/rm guuid=a0b64ac8-1900-0000-2a13-66a004080000 pid=2052->guuid=22960776-1a00-0000-2a13-66a050090000 pid=2384 execve 5b654972-c9e1-50d8-b372-2dc2a5b9ad66 5.182.210.174:80 guuid=9e4db3c8-1900-0000-2a13-66a006080000 pid=2054->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=352ce2cf-1900-0000-2a13-66a00d080000 pid=2061->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=fa1c08e4-1900-0000-2a13-66a034080000 pid=2100 /usr/bin/bash guuid=ddbfefe3-1900-0000-2a13-66a033080000 pid=2099->guuid=fa1c08e4-1900-0000-2a13-66a034080000 pid=2100 clone guuid=51a3bde4-1900-0000-2a13-66a039080000 pid=2105->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=72fc94e7-1900-0000-2a13-66a042080000 pid=2114->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=5a8ffded-1900-0000-2a13-66a053080000 pid=2131 /usr/bin/bash guuid=f4e7d9ed-1900-0000-2a13-66a052080000 pid=2130->guuid=5a8ffded-1900-0000-2a13-66a053080000 pid=2131 clone guuid=34dcd7ee-1900-0000-2a13-66a058080000 pid=2136->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=cc47e4f1-1900-0000-2a13-66a061080000 pid=2145->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=0fd537f9-1900-0000-2a13-66a072080000 pid=2162 /usr/bin/bash guuid=66bb13f9-1900-0000-2a13-66a071080000 pid=2161->guuid=0fd537f9-1900-0000-2a13-66a072080000 pid=2162 clone guuid=73c94dfa-1900-0000-2a13-66a077080000 pid=2167->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=d0bf7efe-1900-0000-2a13-66a081080000 pid=2177->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=6359b306-1a00-0000-2a13-66a094080000 pid=2196 /usr/bin/bash guuid=65069006-1a00-0000-2a13-66a093080000 pid=2195->guuid=6359b306-1a00-0000-2a13-66a094080000 pid=2196 clone guuid=f5169907-1a00-0000-2a13-66a098080000 pid=2200->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=5336fb09-1a00-0000-2a13-66a09e080000 pid=2206->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=4b9b420e-1a00-0000-2a13-66a0a5080000 pid=2213 /usr/bin/bash guuid=c84b1c0e-1a00-0000-2a13-66a0a4080000 pid=2212->guuid=4b9b420e-1a00-0000-2a13-66a0a5080000 pid=2213 clone guuid=74ed490f-1a00-0000-2a13-66a0aa080000 pid=2218->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=c0b33a12-1a00-0000-2a13-66a0ad080000 pid=2221->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=0e583318-1a00-0000-2a13-66a0b6080000 pid=2230 /usr/bin/bash guuid=0a1af017-1a00-0000-2a13-66a0b5080000 pid=2229->guuid=0e583318-1a00-0000-2a13-66a0b6080000 pid=2230 clone guuid=60834c1a-1a00-0000-2a13-66a0be080000 pid=2238->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=6848f01d-1a00-0000-2a13-66a0c5080000 pid=2245->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=be71b422-1a00-0000-2a13-66a0ce080000 pid=2254 /usr/bin/bash guuid=8602a122-1a00-0000-2a13-66a0cd080000 pid=2253->guuid=be71b422-1a00-0000-2a13-66a0ce080000 pid=2254 clone guuid=01e78323-1a00-0000-2a13-66a0d2080000 pid=2258->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=136e7e28-1a00-0000-2a13-66a0de080000 pid=2270->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=69950935-1a00-0000-2a13-66a0f6080000 pid=2294 /usr/bin/bash guuid=91f6e434-1a00-0000-2a13-66a0f5080000 pid=2293->guuid=69950935-1a00-0000-2a13-66a0f6080000 pid=2294 clone guuid=23cd4436-1a00-0000-2a13-66a0fb080000 pid=2299->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=96b4ad3c-1a00-0000-2a13-66a003090000 pid=2307->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=fd479e45-1a00-0000-2a13-66a012090000 pid=2322 /usr/bin/bash guuid=a5b27645-1a00-0000-2a13-66a011090000 pid=2321->guuid=fd479e45-1a00-0000-2a13-66a012090000 pid=2322 clone guuid=ece27847-1a00-0000-2a13-66a017090000 pid=2327->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=e65dbe4c-1a00-0000-2a13-66a01d090000 pid=2333->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=f3d62056-1a00-0000-2a13-66a020090000 pid=2336 /usr/bin/bash guuid=e680dd55-1a00-0000-2a13-66a01f090000 pid=2335->guuid=f3d62056-1a00-0000-2a13-66a020090000 pid=2336 clone guuid=2aaa0958-1a00-0000-2a13-66a023090000 pid=2339->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=7c54b55d-1a00-0000-2a13-66a027090000 pid=2343->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=e038cb65-1a00-0000-2a13-66a033090000 pid=2355 /usr/bin/bash guuid=e10f8965-1a00-0000-2a13-66a032090000 pid=2354->guuid=e038cb65-1a00-0000-2a13-66a033090000 pid=2355 clone guuid=60ed0268-1a00-0000-2a13-66a03b090000 pid=2363->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=79db876c-1a00-0000-2a13-66a040090000 pid=2368->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=6e008175-1a00-0000-2a13-66a04e090000 pid=2382 /usr/bin/bash guuid=583b6875-1a00-0000-2a13-66a04d090000 pid=2381->guuid=6e008175-1a00-0000-2a13-66a04e090000 pid=2382 clone
Score:
99%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/72f3dc51b371c370ee4d03f5069c2b0c0747ce5bd38a9aa017f744c7b403bb90
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/72f3dc51b371c370ee4d03f5069c2b0c0747ce5bd38a9aa017f744c7b403bb90/
Threat name:
Linux.Trojan.Egairtigado
Create hunting rule
Status:
Malicious
First seen:
2026-08-29 21:24:09 UTC
File Type:
Text (Shell)
AV detection:
11 of 24 (45.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=olz5yuntohbxb3snap2qnhblbqdupts32ofjviax65cmpnadxoia._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260829-z83rxsdp8y/
Behaviour
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.11
Link:
https://yomi.yoroi.company/submissions/72f3dc51b371c370ee4d03f5069c2b0c0747ce5bd38a9aa017f744c7b403bb90

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 72f3dc51b371c370ee4d03f5069c2b0c0747ce5bd38a9aa017f744c7b403bb90

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3897671/
  
Delivery method
Distributed via web download

Comments