MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 730b92b5efa23055eab5fdc74fe856c6d8e2b5bf6aaef645d2821947de21c524. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 730b92b5efa23055eab5fdc74fe856c6d8e2b5bf6aaef645d2821947de21c524
SHA3-384 hash: 7651e1f4bd382e16dae94b59a6959ece9aa90af262dd965f0cbec4ee81c2463eea2231c65db08a09698a19c3faa5647c
SHA1 hash: 5c9c8eceba71ffa54b2866e24928339405b936a2
MD5 hash: d89a8645f78302ffbd9751481c757a24
humanhash: lemon-gee-five-bacon
File name:730b92b5efa23055eab5fdc74fe856c6d8e2b5bf6aaef645d2821947de21c524
Download: download sample
File size:1'584 bytes
First seen:2026-07-25 12:01:18 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 12:U66kqszAz6O76813U4M6+3mOyGNg6N3YtnXV2EI62EaPllS6divR3YWNb6NOGu6S:rcSmOUX9TQTyRIUM9/f/Az1k1Nyd
TLSH T1D431618B492429341303DEDE73AA394CB00D85F768DFCB64DC484EA956881CD7532FD5
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter Anonymous
Tags:cowrie hermes-noc honeypot sh


Avatar
Anonymous
Captured by Hermes-NOC Cowrie SSH honeypot
URLMalware sample (SHA256 hash)SignatureTags
http://5.182.210.61/9700c7n/an/aua-wget
http://5.182.210.61/2576b4n/an/aua-wget
http://5.182.210.61/bbc647n/an/aua-wget
http://5.182.210.61/d42f5an/an/aua-wget
http://5.182.210.61/bf991an/an/aua-wget
http://5.182.210.61/5e69cfn/an/aua-wget
http://5.182.210.61/dfcbd2n/an/aua-wget
http://5.182.210.61/b725d8n/an/aua-wget
http://5.182.210.61/b36640n/an/aua-wget
http://5.182.210.61/3ac63bn/an/aua-wget
http://5.182.210.61/425e20n/an/aua-wget
http://5.182.210.61/fcbe11n/an/aua-wget

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
NL NL
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive mirai
Link:
https://www.filescan.io/uploads/6a64a5d37ee9b4df54e78fae/reports/49d728e1-a795-4703-a3f7-95d8d61d69c4/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-07-25T10:05:00Z UTC
Last seen:
2026-07-25T11:40:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/730b92b5efa23055eab5fdc74fe856c6d8e2b5bf6aaef645d2821947de21c524/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/7ddc0325-eff4-443e-8bd5-a5a7dacb83dc
Behavior Graph:
Download SVG
%3 guuid=f57cedbd-1700-0000-3a07-12eff80d0000 pid=3576 /usr/bin/sudo guuid=51b2cec0-1700-0000-3a07-12ef050e0000 pid=3589 /tmp/sample.bin guuid=f57cedbd-1700-0000-3a07-12eff80d0000 pid=3576->guuid=51b2cec0-1700-0000-3a07-12ef050e0000 pid=3589 execve guuid=85a435c1-1700-0000-3a07-12ef060e0000 pid=3590 /usr/bin/wget net send-data guuid=51b2cec0-1700-0000-3a07-12ef050e0000 pid=3589->guuid=85a435c1-1700-0000-3a07-12ef060e0000 pid=3590 execve guuid=3713e6c4-1700-0000-3a07-12ef140e0000 pid=3604 /usr/bin/curl net send-data write-file guuid=51b2cec0-1700-0000-3a07-12ef050e0000 pid=3589->guuid=3713e6c4-1700-0000-3a07-12ef140e0000 pid=3604 execve guuid=aaee91ce-1700-0000-3a07-12ef310e0000 pid=3633 /usr/bin/chmod guuid=51b2cec0-1700-0000-3a07-12ef050e0000 pid=3589->guuid=aaee91ce-1700-0000-3a07-12ef310e0000 pid=3633 execve guuid=caea10cf-1700-0000-3a07-12ef330e0000 pid=3635 /usr/bin/bash guuid=51b2cec0-1700-0000-3a07-12ef050e0000 pid=3589->guuid=caea10cf-1700-0000-3a07-12ef330e0000 pid=3635 clone guuid=eec183cf-1700-0000-3a07-12ef360e0000 pid=3638 /usr/bin/rm delete-file guuid=51b2cec0-1700-0000-3a07-12ef050e0000 pid=3589->guuid=eec183cf-1700-0000-3a07-12ef360e0000 pid=3638 execve guuid=c44de7cf-1700-0000-3a07-12ef370e0000 pid=3639 /usr/bin/rm guuid=51b2cec0-1700-0000-3a07-12ef050e0000 pid=3589->guuid=c44de7cf-1700-0000-3a07-12ef370e0000 pid=3639 execve guuid=874941d0-1700-0000-3a07-12ef390e0000 pid=3641 /usr/bin/wget net send-data guuid=51b2cec0-1700-0000-3a07-12ef050e0000 pid=3589->guuid=874941d0-1700-0000-3a07-12ef390e0000 pid=3641 execve guuid=9c0b25d3-1700-0000-3a07-12ef400e0000 pid=3648 /usr/bin/curl net send-data write-file guuid=51b2cec0-1700-0000-3a07-12ef050e0000 pid=3589->guuid=9c0b25d3-1700-0000-3a07-12ef400e0000 pid=3648 execve guuid=7e36bed9-1700-0000-3a07-12ef560e0000 pid=3670 /usr/bin/chmod guuid=51b2cec0-1700-0000-3a07-12ef050e0000 pid=3589->guuid=7e36bed9-1700-0000-3a07-12ef560e0000 pid=3670 execve guuid=c64812da-1700-0000-3a07-12ef580e0000 pid=3672 /usr/bin/bash guuid=51b2cec0-1700-0000-3a07-12ef050e0000 pid=3589->guuid=c64812da-1700-0000-3a07-12ef580e0000 pid=3672 clone guuid=31835bda-1700-0000-3a07-12ef5b0e0000 pid=3675 /usr/bin/rm delete-file guuid=51b2cec0-1700-0000-3a07-12ef050e0000 pid=3589->guuid=31835bda-1700-0000-3a07-12ef5b0e0000 pid=3675 execve guuid=723dc0da-1700-0000-3a07-12ef5d0e0000 pid=3677 /usr/bin/rm guuid=51b2cec0-1700-0000-3a07-12ef050e0000 pid=3589->guuid=723dc0da-1700-0000-3a07-12ef5d0e0000 pid=3677 execve guuid=b08046db-1700-0000-3a07-12ef5f0e0000 pid=3679 /usr/bin/wget net send-data guuid=51b2cec0-1700-0000-3a07-12ef050e0000 pid=3589->guuid=b08046db-1700-0000-3a07-12ef5f0e0000 pid=3679 execve guuid=b6d074de-1700-0000-3a07-12ef6c0e0000 pid=3692 /usr/bin/curl net send-data write-file guuid=51b2cec0-1700-0000-3a07-12ef050e0000 pid=3589->guuid=b6d074de-1700-0000-3a07-12ef6c0e0000 pid=3692 execve guuid=69880ae3-1700-0000-3a07-12ef810e0000 pid=3713 /usr/bin/chmod guuid=51b2cec0-1700-0000-3a07-12ef050e0000 pid=3589->guuid=69880ae3-1700-0000-3a07-12ef810e0000 pid=3713 execve guuid=068b22e5-1700-0000-3a07-12ef860e0000 pid=3718 /usr/bin/bash guuid=51b2cec0-1700-0000-3a07-12ef050e0000 pid=3589->guuid=068b22e5-1700-0000-3a07-12ef860e0000 pid=3718 clone guuid=7d6fa7e5-1700-0000-3a07-12ef880e0000 pid=3720 /usr/bin/rm delete-file guuid=51b2cec0-1700-0000-3a07-12ef050e0000 pid=3589->guuid=7d6fa7e5-1700-0000-3a07-12ef880e0000 pid=3720 execve guuid=65f80de6-1700-0000-3a07-12ef890e0000 pid=3721 /usr/bin/rm guuid=51b2cec0-1700-0000-3a07-12ef050e0000 pid=3589->guuid=65f80de6-1700-0000-3a07-12ef890e0000 pid=3721 execve guuid=914f79e6-1700-0000-3a07-12ef8a0e0000 pid=3722 /usr/bin/wget net send-data guuid=51b2cec0-1700-0000-3a07-12ef050e0000 pid=3589->guuid=914f79e6-1700-0000-3a07-12ef8a0e0000 pid=3722 execve guuid=76066bea-1700-0000-3a07-12ef920e0000 pid=3730 /usr/bin/curl net send-data write-file guuid=51b2cec0-1700-0000-3a07-12ef050e0000 pid=3589->guuid=76066bea-1700-0000-3a07-12ef920e0000 pid=3730 execve guuid=d6fc33f1-1700-0000-3a07-12efa10e0000 pid=3745 /usr/bin/chmod guuid=51b2cec0-1700-0000-3a07-12ef050e0000 pid=3589->guuid=d6fc33f1-1700-0000-3a07-12efa10e0000 pid=3745 execve guuid=e7d2b2f1-1700-0000-3a07-12efa30e0000 pid=3747 /usr/bin/bash guuid=51b2cec0-1700-0000-3a07-12ef050e0000 pid=3589->guuid=e7d2b2f1-1700-0000-3a07-12efa30e0000 pid=3747 clone guuid=d31a18f2-1700-0000-3a07-12efa60e0000 pid=3750 /usr/bin/rm delete-file guuid=51b2cec0-1700-0000-3a07-12ef050e0000 pid=3589->guuid=d31a18f2-1700-0000-3a07-12efa60e0000 pid=3750 execve guuid=8cd0a3f2-1700-0000-3a07-12efa90e0000 pid=3753 /usr/bin/rm guuid=51b2cec0-1700-0000-3a07-12ef050e0000 pid=3589->guuid=8cd0a3f2-1700-0000-3a07-12efa90e0000 pid=3753 execve guuid=1de122f3-1700-0000-3a07-12efab0e0000 pid=3755 /usr/bin/wget net send-data guuid=51b2cec0-1700-0000-3a07-12ef050e0000 pid=3589->guuid=1de122f3-1700-0000-3a07-12efab0e0000 pid=3755 execve guuid=6becc5f6-1700-0000-3a07-12efb30e0000 pid=3763 /usr/bin/curl net send-data write-file guuid=51b2cec0-1700-0000-3a07-12ef050e0000 pid=3589->guuid=6becc5f6-1700-0000-3a07-12efb30e0000 pid=3763 execve guuid=fe9819fd-1700-0000-3a07-12efbf0e0000 pid=3775 /usr/bin/chmod guuid=51b2cec0-1700-0000-3a07-12ef050e0000 pid=3589->guuid=fe9819fd-1700-0000-3a07-12efbf0e0000 pid=3775 execve guuid=4b1b8afd-1700-0000-3a07-12efc00e0000 pid=3776 /usr/bin/bash guuid=51b2cec0-1700-0000-3a07-12ef050e0000 pid=3589->guuid=4b1b8afd-1700-0000-3a07-12efc00e0000 pid=3776 clone guuid=11f529fe-1700-0000-3a07-12efc50e0000 pid=3781 /usr/bin/rm delete-file guuid=51b2cec0-1700-0000-3a07-12ef050e0000 pid=3589->guuid=11f529fe-1700-0000-3a07-12efc50e0000 pid=3781 execve guuid=d4058efe-1700-0000-3a07-12efc60e0000 pid=3782 /usr/bin/rm guuid=51b2cec0-1700-0000-3a07-12ef050e0000 pid=3589->guuid=d4058efe-1700-0000-3a07-12efc60e0000 pid=3782 execve guuid=db1ff8fe-1700-0000-3a07-12efca0e0000 pid=3786 /usr/bin/wget net send-data guuid=51b2cec0-1700-0000-3a07-12ef050e0000 pid=3589->guuid=db1ff8fe-1700-0000-3a07-12efca0e0000 pid=3786 execve guuid=fe196d02-1800-0000-3a07-12efd50e0000 pid=3797 /usr/bin/curl net send-data write-file guuid=51b2cec0-1700-0000-3a07-12ef050e0000 pid=3589->guuid=fe196d02-1800-0000-3a07-12efd50e0000 pid=3797 execve guuid=d3246a07-1800-0000-3a07-12efe50e0000 pid=3813 /usr/bin/chmod guuid=51b2cec0-1700-0000-3a07-12ef050e0000 pid=3589->guuid=d3246a07-1800-0000-3a07-12efe50e0000 pid=3813 execve guuid=da56dc07-1800-0000-3a07-12efe90e0000 pid=3817 /usr/bin/bash guuid=51b2cec0-1700-0000-3a07-12ef050e0000 pid=3589->guuid=da56dc07-1800-0000-3a07-12efe90e0000 pid=3817 clone guuid=c2ac2e08-1800-0000-3a07-12efeb0e0000 pid=3819 /usr/bin/rm delete-file guuid=51b2cec0-1700-0000-3a07-12ef050e0000 pid=3589->guuid=c2ac2e08-1800-0000-3a07-12efeb0e0000 pid=3819 execve guuid=cd2c9808-1800-0000-3a07-12efee0e0000 pid=3822 /usr/bin/rm guuid=51b2cec0-1700-0000-3a07-12ef050e0000 pid=3589->guuid=cd2c9808-1800-0000-3a07-12efee0e0000 pid=3822 execve guuid=19b8fe08-1800-0000-3a07-12eff00e0000 pid=3824 /usr/bin/wget net send-data guuid=51b2cec0-1700-0000-3a07-12ef050e0000 pid=3589->guuid=19b8fe08-1800-0000-3a07-12eff00e0000 pid=3824 execve guuid=77471a0c-1800-0000-3a07-12eff70e0000 pid=3831 /usr/bin/curl net send-data write-file guuid=51b2cec0-1700-0000-3a07-12ef050e0000 pid=3589->guuid=77471a0c-1800-0000-3a07-12eff70e0000 pid=3831 execve guuid=b254dd10-1800-0000-3a07-12ef060f0000 pid=3846 /usr/bin/chmod guuid=51b2cec0-1700-0000-3a07-12ef050e0000 pid=3589->guuid=b254dd10-1800-0000-3a07-12ef060f0000 pid=3846 execve guuid=efa34f11-1800-0000-3a07-12ef0a0f0000 pid=3850 /usr/bin/bash guuid=51b2cec0-1700-0000-3a07-12ef050e0000 pid=3589->guuid=efa34f11-1800-0000-3a07-12ef0a0f0000 pid=3850 clone guuid=d231ab11-1800-0000-3a07-12ef0c0f0000 pid=3852 /usr/bin/rm delete-file guuid=51b2cec0-1700-0000-3a07-12ef050e0000 pid=3589->guuid=d231ab11-1800-0000-3a07-12ef0c0f0000 pid=3852 execve guuid=0d831612-1800-0000-3a07-12ef100f0000 pid=3856 /usr/bin/rm guuid=51b2cec0-1700-0000-3a07-12ef050e0000 pid=3589->guuid=0d831612-1800-0000-3a07-12ef100f0000 pid=3856 execve guuid=e5335e12-1800-0000-3a07-12ef120f0000 pid=3858 /usr/bin/wget net send-data guuid=51b2cec0-1700-0000-3a07-12ef050e0000 pid=3589->guuid=e5335e12-1800-0000-3a07-12ef120f0000 pid=3858 execve guuid=3907d914-1800-0000-3a07-12ef1c0f0000 pid=3868 /usr/bin/curl net send-data write-file guuid=51b2cec0-1700-0000-3a07-12ef050e0000 pid=3589->guuid=3907d914-1800-0000-3a07-12ef1c0f0000 pid=3868 execve guuid=d499291b-1800-0000-3a07-12ef2f0f0000 pid=3887 /usr/bin/chmod guuid=51b2cec0-1700-0000-3a07-12ef050e0000 pid=3589->guuid=d499291b-1800-0000-3a07-12ef2f0f0000 pid=3887 execve guuid=9d3b971b-1800-0000-3a07-12ef300f0000 pid=3888 /usr/bin/bash guuid=51b2cec0-1700-0000-3a07-12ef050e0000 pid=3589->guuid=9d3b971b-1800-0000-3a07-12ef300f0000 pid=3888 clone guuid=e689821c-1800-0000-3a07-12ef350f0000 pid=3893 /usr/bin/rm delete-file guuid=51b2cec0-1700-0000-3a07-12ef050e0000 pid=3589->guuid=e689821c-1800-0000-3a07-12ef350f0000 pid=3893 execve guuid=8469041d-1800-0000-3a07-12ef390f0000 pid=3897 /usr/bin/rm guuid=51b2cec0-1700-0000-3a07-12ef050e0000 pid=3589->guuid=8469041d-1800-0000-3a07-12ef390f0000 pid=3897 execve guuid=236ea51d-1800-0000-3a07-12ef3b0f0000 pid=3899 /usr/bin/wget net send-data guuid=51b2cec0-1700-0000-3a07-12ef050e0000 pid=3589->guuid=236ea51d-1800-0000-3a07-12ef3b0f0000 pid=3899 execve guuid=6c9fd527-1800-0000-3a07-12ef4d0f0000 pid=3917 /usr/bin/curl net send-data write-file guuid=51b2cec0-1700-0000-3a07-12ef050e0000 pid=3589->guuid=6c9fd527-1800-0000-3a07-12ef4d0f0000 pid=3917 execve guuid=67ffc82c-1800-0000-3a07-12ef5d0f0000 pid=3933 /usr/bin/chmod guuid=51b2cec0-1700-0000-3a07-12ef050e0000 pid=3589->guuid=67ffc82c-1800-0000-3a07-12ef5d0f0000 pid=3933 execve guuid=a8c9222d-1800-0000-3a07-12ef610f0000 pid=3937 /usr/bin/bash guuid=51b2cec0-1700-0000-3a07-12ef050e0000 pid=3589->guuid=a8c9222d-1800-0000-3a07-12ef610f0000 pid=3937 clone guuid=f8947d2d-1800-0000-3a07-12ef630f0000 pid=3939 /usr/bin/rm delete-file guuid=51b2cec0-1700-0000-3a07-12ef050e0000 pid=3589->guuid=f8947d2d-1800-0000-3a07-12ef630f0000 pid=3939 execve guuid=9d68f92d-1800-0000-3a07-12ef650f0000 pid=3941 /usr/bin/rm guuid=51b2cec0-1700-0000-3a07-12ef050e0000 pid=3589->guuid=9d68f92d-1800-0000-3a07-12ef650f0000 pid=3941 execve guuid=1b57762e-1800-0000-3a07-12ef670f0000 pid=3943 /usr/bin/wget net send-data guuid=51b2cec0-1700-0000-3a07-12ef050e0000 pid=3589->guuid=1b57762e-1800-0000-3a07-12ef670f0000 pid=3943 execve guuid=f0e62f32-1800-0000-3a07-12ef710f0000 pid=3953 /usr/bin/curl net send-data write-file guuid=51b2cec0-1700-0000-3a07-12ef050e0000 pid=3589->guuid=f0e62f32-1800-0000-3a07-12ef710f0000 pid=3953 execve guuid=52dc2337-1800-0000-3a07-12ef830f0000 pid=3971 /usr/bin/chmod guuid=51b2cec0-1700-0000-3a07-12ef050e0000 pid=3589->guuid=52dc2337-1800-0000-3a07-12ef830f0000 pid=3971 execve guuid=9e6ca637-1800-0000-3a07-12ef850f0000 pid=3973 /usr/bin/bash guuid=51b2cec0-1700-0000-3a07-12ef050e0000 pid=3589->guuid=9e6ca637-1800-0000-3a07-12ef850f0000 pid=3973 clone guuid=4f851238-1800-0000-3a07-12ef8a0f0000 pid=3978 /usr/bin/rm delete-file guuid=51b2cec0-1700-0000-3a07-12ef050e0000 pid=3589->guuid=4f851238-1800-0000-3a07-12ef8a0f0000 pid=3978 execve guuid=44ec8a38-1800-0000-3a07-12ef8c0f0000 pid=3980 /usr/bin/rm guuid=51b2cec0-1700-0000-3a07-12ef050e0000 pid=3589->guuid=44ec8a38-1800-0000-3a07-12ef8c0f0000 pid=3980 execve guuid=bc89f738-1800-0000-3a07-12ef900f0000 pid=3984 /usr/bin/wget net send-data guuid=51b2cec0-1700-0000-3a07-12ef050e0000 pid=3589->guuid=bc89f738-1800-0000-3a07-12ef900f0000 pid=3984 execve guuid=be60623c-1800-0000-3a07-12ef970f0000 pid=3991 /usr/bin/curl net send-data write-file guuid=51b2cec0-1700-0000-3a07-12ef050e0000 pid=3589->guuid=be60623c-1800-0000-3a07-12ef970f0000 pid=3991 execve guuid=f8dbab41-1800-0000-3a07-12efa70f0000 pid=4007 /usr/bin/chmod guuid=51b2cec0-1700-0000-3a07-12ef050e0000 pid=3589->guuid=f8dbab41-1800-0000-3a07-12efa70f0000 pid=4007 execve guuid=eff32542-1800-0000-3a07-12efa90f0000 pid=4009 /usr/bin/bash guuid=51b2cec0-1700-0000-3a07-12ef050e0000 pid=3589->guuid=eff32542-1800-0000-3a07-12efa90f0000 pid=4009 clone guuid=bbbddd42-1800-0000-3a07-12efae0f0000 pid=4014 /usr/bin/rm delete-file guuid=51b2cec0-1700-0000-3a07-12ef050e0000 pid=3589->guuid=bbbddd42-1800-0000-3a07-12efae0f0000 pid=4014 execve guuid=888c5543-1800-0000-3a07-12efb10f0000 pid=4017 /usr/bin/rm guuid=51b2cec0-1700-0000-3a07-12ef050e0000 pid=3589->guuid=888c5543-1800-0000-3a07-12efb10f0000 pid=4017 execve guuid=a06dbc43-1800-0000-3a07-12efb30f0000 pid=4019 /usr/bin/wget net send-data guuid=51b2cec0-1700-0000-3a07-12ef050e0000 pid=3589->guuid=a06dbc43-1800-0000-3a07-12efb30f0000 pid=4019 execve guuid=91029246-1800-0000-3a07-12efbe0f0000 pid=4030 /usr/bin/curl net send-data write-file guuid=51b2cec0-1700-0000-3a07-12ef050e0000 pid=3589->guuid=91029246-1800-0000-3a07-12efbe0f0000 pid=4030 execve guuid=ac601b4a-1800-0000-3a07-12efca0f0000 pid=4042 /usr/bin/chmod guuid=51b2cec0-1700-0000-3a07-12ef050e0000 pid=3589->guuid=ac601b4a-1800-0000-3a07-12efca0f0000 pid=4042 execve guuid=cb51664a-1800-0000-3a07-12efcb0f0000 pid=4043 /usr/bin/bash guuid=51b2cec0-1700-0000-3a07-12ef050e0000 pid=3589->guuid=cb51664a-1800-0000-3a07-12efcb0f0000 pid=4043 clone guuid=c7feb04a-1800-0000-3a07-12efd00f0000 pid=4048 /usr/bin/rm delete-file guuid=51b2cec0-1700-0000-3a07-12ef050e0000 pid=3589->guuid=c7feb04a-1800-0000-3a07-12efd00f0000 pid=4048 execve guuid=3671204b-1800-0000-3a07-12efd10f0000 pid=4049 /usr/bin/rm guuid=51b2cec0-1700-0000-3a07-12ef050e0000 pid=3589->guuid=3671204b-1800-0000-3a07-12efd10f0000 pid=4049 execve 9e33e6d7-6ac7-5a65-88f4-941337e56821 5.182.210.61:80 guuid=85a435c1-1700-0000-3a07-12ef060e0000 pid=3590->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=3713e6c4-1700-0000-3a07-12ef140e0000 pid=3604->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=14bd43cf-1700-0000-3a07-12ef340e0000 pid=3636 /usr/bin/bash guuid=caea10cf-1700-0000-3a07-12ef330e0000 pid=3635->guuid=14bd43cf-1700-0000-3a07-12ef340e0000 pid=3636 clone guuid=874941d0-1700-0000-3a07-12ef390e0000 pid=3641->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=9c0b25d3-1700-0000-3a07-12ef400e0000 pid=3648->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=bf2939da-1700-0000-3a07-12ef5a0e0000 pid=3674 /usr/bin/bash guuid=c64812da-1700-0000-3a07-12ef580e0000 pid=3672->guuid=bf2939da-1700-0000-3a07-12ef5a0e0000 pid=3674 clone guuid=b08046db-1700-0000-3a07-12ef5f0e0000 pid=3679->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=b6d074de-1700-0000-3a07-12ef6c0e0000 pid=3692->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=17dd49e5-1700-0000-3a07-12ef870e0000 pid=3719 /usr/bin/bash guuid=068b22e5-1700-0000-3a07-12ef860e0000 pid=3718->guuid=17dd49e5-1700-0000-3a07-12ef870e0000 pid=3719 clone guuid=914f79e6-1700-0000-3a07-12ef8a0e0000 pid=3722->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=76066bea-1700-0000-3a07-12ef920e0000 pid=3730->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=25acdff1-1700-0000-3a07-12efa50e0000 pid=3749 /usr/bin/bash guuid=e7d2b2f1-1700-0000-3a07-12efa30e0000 pid=3747->guuid=25acdff1-1700-0000-3a07-12efa50e0000 pid=3749 clone guuid=1de122f3-1700-0000-3a07-12efab0e0000 pid=3755->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=6becc5f6-1700-0000-3a07-12efb30e0000 pid=3763->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=a156cdfd-1700-0000-3a07-12efc20e0000 pid=3778 /usr/bin/bash guuid=4b1b8afd-1700-0000-3a07-12efc00e0000 pid=3776->guuid=a156cdfd-1700-0000-3a07-12efc20e0000 pid=3778 clone guuid=db1ff8fe-1700-0000-3a07-12efca0e0000 pid=3786->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=fe196d02-1800-0000-3a07-12efd50e0000 pid=3797->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=03870008-1800-0000-3a07-12efea0e0000 pid=3818 /usr/bin/bash guuid=da56dc07-1800-0000-3a07-12efe90e0000 pid=3817->guuid=03870008-1800-0000-3a07-12efea0e0000 pid=3818 clone guuid=19b8fe08-1800-0000-3a07-12eff00e0000 pid=3824->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=77471a0c-1800-0000-3a07-12eff70e0000 pid=3831->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=4a4e7711-1800-0000-3a07-12ef0b0f0000 pid=3851 /usr/bin/bash guuid=efa34f11-1800-0000-3a07-12ef0a0f0000 pid=3850->guuid=4a4e7711-1800-0000-3a07-12ef0b0f0000 pid=3851 clone guuid=e5335e12-1800-0000-3a07-12ef120f0000 pid=3858->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=3907d914-1800-0000-3a07-12ef1c0f0000 pid=3868->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=2825d91b-1800-0000-3a07-12ef340f0000 pid=3892 /usr/bin/bash guuid=9d3b971b-1800-0000-3a07-12ef300f0000 pid=3888->guuid=2825d91b-1800-0000-3a07-12ef340f0000 pid=3892 clone guuid=236ea51d-1800-0000-3a07-12ef3b0f0000 pid=3899->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=6c9fd527-1800-0000-3a07-12ef4d0f0000 pid=3917->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=7543482d-1800-0000-3a07-12ef620f0000 pid=3938 /usr/bin/bash guuid=a8c9222d-1800-0000-3a07-12ef610f0000 pid=3937->guuid=7543482d-1800-0000-3a07-12ef620f0000 pid=3938 clone guuid=1b57762e-1800-0000-3a07-12ef670f0000 pid=3943->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=f0e62f32-1800-0000-3a07-12ef710f0000 pid=3953->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=265fca37-1800-0000-3a07-12ef870f0000 pid=3975 /usr/bin/bash guuid=9e6ca637-1800-0000-3a07-12ef850f0000 pid=3973->guuid=265fca37-1800-0000-3a07-12ef870f0000 pid=3975 clone guuid=bc89f738-1800-0000-3a07-12ef900f0000 pid=3984->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=be60623c-1800-0000-3a07-12ef970f0000 pid=3991->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=05c9b242-1800-0000-3a07-12efac0f0000 pid=4012 /usr/bin/bash guuid=eff32542-1800-0000-3a07-12efa90f0000 pid=4009->guuid=05c9b242-1800-0000-3a07-12efac0f0000 pid=4012 clone guuid=a06dbc43-1800-0000-3a07-12efb30f0000 pid=4019->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=91029246-1800-0000-3a07-12efbe0f0000 pid=4030->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=87e4824a-1800-0000-3a07-12efcc0f0000 pid=4044 /usr/bin/bash guuid=cb51664a-1800-0000-3a07-12efcb0f0000 pid=4043->guuid=87e4824a-1800-0000-3a07-12efcc0f0000 pid=4044 clone
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/730b92b5efa23055eab5fdc74fe856c6d8e2b5bf6aaef645d2821947de21c524
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/730b92b5efa23055eab5fdc74fe856c6d8e2b5bf6aaef645d2821947de21c524/
Threat name:
Linux.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-07-25 12:02:21 UTC
File Type:
Text (Shell)
AV detection:
14 of 36 (38.89%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=omfzfnppuiyfl2vv7xdu72cwy3mofnn7nkxpmrosqimupxrbyusa._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260725-n7ne3awxey/
Behaviour
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.11
Link:
https://yomi.yoroi.company/submissions/730b92b5efa23055eab5fdc74fe856c6d8e2b5bf6aaef645d2821947de21c524

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments