🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 785df56f0e1cc810787a59e43b0287557aae2af3cd55c27c1b6d2a33ad4dcb4d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 785df56f0e1cc810787a59e43b0287557aae2af3cd55c27c1b6d2a33ad4dcb4d
SHA3-384 hash: 661c6cea604a0ad44b27d94a0a8290105ef66b4693ea44ecd174a21fac4b7d30a73ba8210384280ec45808d80b3d6e1f
SHA1 hash: 8134aebffec40a018da952fd538b3357df25c6c6
MD5 hash: fa6750a6508ab1de41d9f3374f7a79e8
humanhash: lake-glucose-comet-arkansas
File name:ok
Download: download sample
File size:1'608 bytes
First seen:2026-09-07 06:59:31 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 12:Uuf6uh+2iyB6Tx2QNg236ee1Pi6PUEvu06CJH6DN/6Y3ALwi6wsASVm4476GPNxY:n0LCZsqFAL5mTP7A+/CfXjQc
TLSH T1783141DE051019711503CE4E73B63548B29DAAEB289FC7E4991C1EAE934A3CCF265B0D
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://5.182.210.174/f89f8dn/an/an/a
http://5.182.210.174/23ecc4n/an/an/a
http://5.182.210.174/320ec1n/an/an/a
http://5.182.210.174/d033d3n/an/an/a
http://5.182.210.174/62ee2cn/an/an/a
http://5.182.210.174/300e42n/an/an/a
http://5.182.210.174/0f67bcn/an/an/a
http://5.182.210.174/fec5f5n/an/an/a
http://5.182.210.174/0774a2n/an/an/a
http://5.182.210.174/2ce907n/an/an/a
http://5.182.210.174/738615n/an/an/a
http://5.182.210.174/01655an/an/an/a

Intelligence

File Origin
# of uploads :
1
# of downloads :
53
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive mirai
Link:
https://www.filescan.io/uploads/6a9e61083b45a8d3bf5c7d85/reports/3725eb2b-0423-40be-8bd3-d09d45bb2ee5/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-09-07T04:48:00Z UTC
Last seen:
2026-09-07T05:05:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/785df56f0e1cc810787a59e43b0287557aae2af3cd55c27c1b6d2a33ad4dcb4d/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/5f5fd876-1465-475f-be22-91e0f647b619
Behavior Graph:
Download SVG
%3 guuid=928ca8fc-3800-0000-3a7a-9cb13d030000 pid=829 /usr/bin/sudo guuid=a9e45cfe-3800-0000-3a7a-9cb13e030000 pid=830 /tmp/sample.bin guuid=928ca8fc-3800-0000-3a7a-9cb13d030000 pid=829->guuid=a9e45cfe-3800-0000-3a7a-9cb13e030000 pid=830 execve guuid=955270ff-3800-0000-3a7a-9cb13f030000 pid=831 /usr/bin/wget net send-data guuid=a9e45cfe-3800-0000-3a7a-9cb13e030000 pid=830->guuid=955270ff-3800-0000-3a7a-9cb13f030000 pid=831 execve guuid=9359ad22-3a00-0000-3a7a-9cb140030000 pid=832 /usr/bin/curl net send-data write-file guuid=a9e45cfe-3800-0000-3a7a-9cb13e030000 pid=830->guuid=9359ad22-3a00-0000-3a7a-9cb140030000 pid=832 execve guuid=d8b7c130-3a00-0000-3a7a-9cb141030000 pid=833 /usr/bin/chmod guuid=a9e45cfe-3800-0000-3a7a-9cb13e030000 pid=830->guuid=d8b7c130-3a00-0000-3a7a-9cb141030000 pid=833 execve guuid=cfee3631-3a00-0000-3a7a-9cb142030000 pid=834 /usr/bin/bash guuid=a9e45cfe-3800-0000-3a7a-9cb13e030000 pid=830->guuid=cfee3631-3a00-0000-3a7a-9cb142030000 pid=834 clone guuid=16f49f31-3a00-0000-3a7a-9cb144030000 pid=836 /usr/bin/rm delete-file guuid=a9e45cfe-3800-0000-3a7a-9cb13e030000 pid=830->guuid=16f49f31-3a00-0000-3a7a-9cb144030000 pid=836 execve guuid=ecf3ff31-3a00-0000-3a7a-9cb145030000 pid=837 /usr/bin/rm guuid=a9e45cfe-3800-0000-3a7a-9cb13e030000 pid=830->guuid=ecf3ff31-3a00-0000-3a7a-9cb145030000 pid=837 execve guuid=40dafe32-3a00-0000-3a7a-9cb146030000 pid=838 /usr/bin/wget net send-data guuid=a9e45cfe-3800-0000-3a7a-9cb13e030000 pid=830->guuid=40dafe32-3a00-0000-3a7a-9cb146030000 pid=838 execve guuid=e51dec35-3a00-0000-3a7a-9cb147030000 pid=839 /usr/bin/curl net send-data write-file guuid=a9e45cfe-3800-0000-3a7a-9cb13e030000 pid=830->guuid=e51dec35-3a00-0000-3a7a-9cb147030000 pid=839 execve guuid=aefb093a-3a00-0000-3a7a-9cb148030000 pid=840 /usr/bin/chmod guuid=a9e45cfe-3800-0000-3a7a-9cb13e030000 pid=830->guuid=aefb093a-3a00-0000-3a7a-9cb148030000 pid=840 execve guuid=8dc1653a-3a00-0000-3a7a-9cb149030000 pid=841 /usr/bin/bash guuid=a9e45cfe-3800-0000-3a7a-9cb13e030000 pid=830->guuid=8dc1653a-3a00-0000-3a7a-9cb149030000 pid=841 clone guuid=82e4023b-3a00-0000-3a7a-9cb14b030000 pid=843 /usr/bin/rm delete-file guuid=a9e45cfe-3800-0000-3a7a-9cb13e030000 pid=830->guuid=82e4023b-3a00-0000-3a7a-9cb14b030000 pid=843 execve guuid=b026793b-3a00-0000-3a7a-9cb14c030000 pid=844 /usr/bin/rm guuid=a9e45cfe-3800-0000-3a7a-9cb13e030000 pid=830->guuid=b026793b-3a00-0000-3a7a-9cb14c030000 pid=844 execve guuid=1a86fe3b-3a00-0000-3a7a-9cb14d030000 pid=845 /usr/bin/wget net send-data guuid=a9e45cfe-3800-0000-3a7a-9cb13e030000 pid=830->guuid=1a86fe3b-3a00-0000-3a7a-9cb14d030000 pid=845 execve guuid=126c9e3f-3a00-0000-3a7a-9cb14e030000 pid=846 /usr/bin/curl net send-data write-file guuid=a9e45cfe-3800-0000-3a7a-9cb13e030000 pid=830->guuid=126c9e3f-3a00-0000-3a7a-9cb14e030000 pid=846 execve guuid=f4fb3e44-3a00-0000-3a7a-9cb14f030000 pid=847 /usr/bin/chmod guuid=a9e45cfe-3800-0000-3a7a-9cb13e030000 pid=830->guuid=f4fb3e44-3a00-0000-3a7a-9cb14f030000 pid=847 execve guuid=41a5c244-3a00-0000-3a7a-9cb150030000 pid=848 /usr/bin/bash guuid=a9e45cfe-3800-0000-3a7a-9cb13e030000 pid=830->guuid=41a5c244-3a00-0000-3a7a-9cb150030000 pid=848 clone guuid=1a228245-3a00-0000-3a7a-9cb152030000 pid=850 /usr/bin/rm delete-file guuid=a9e45cfe-3800-0000-3a7a-9cb13e030000 pid=830->guuid=1a228245-3a00-0000-3a7a-9cb152030000 pid=850 execve guuid=d01d3746-3a00-0000-3a7a-9cb153030000 pid=851 /usr/bin/rm guuid=a9e45cfe-3800-0000-3a7a-9cb13e030000 pid=830->guuid=d01d3746-3a00-0000-3a7a-9cb153030000 pid=851 execve guuid=8040fc46-3a00-0000-3a7a-9cb154030000 pid=852 /usr/bin/wget net send-data guuid=a9e45cfe-3800-0000-3a7a-9cb13e030000 pid=830->guuid=8040fc46-3a00-0000-3a7a-9cb154030000 pid=852 execve guuid=0c69274b-3a00-0000-3a7a-9cb155030000 pid=853 /usr/bin/curl net send-data write-file guuid=a9e45cfe-3800-0000-3a7a-9cb13e030000 pid=830->guuid=0c69274b-3a00-0000-3a7a-9cb155030000 pid=853 execve guuid=4110934f-3a00-0000-3a7a-9cb156030000 pid=854 /usr/bin/chmod guuid=a9e45cfe-3800-0000-3a7a-9cb13e030000 pid=830->guuid=4110934f-3a00-0000-3a7a-9cb156030000 pid=854 execve guuid=fe160050-3a00-0000-3a7a-9cb157030000 pid=855 /usr/bin/bash guuid=a9e45cfe-3800-0000-3a7a-9cb13e030000 pid=830->guuid=fe160050-3a00-0000-3a7a-9cb157030000 pid=855 clone guuid=d8535450-3a00-0000-3a7a-9cb159030000 pid=857 /usr/bin/rm delete-file guuid=a9e45cfe-3800-0000-3a7a-9cb13e030000 pid=830->guuid=d8535450-3a00-0000-3a7a-9cb159030000 pid=857 execve guuid=f62a0051-3a00-0000-3a7a-9cb15a030000 pid=858 /usr/bin/rm guuid=a9e45cfe-3800-0000-3a7a-9cb13e030000 pid=830->guuid=f62a0051-3a00-0000-3a7a-9cb15a030000 pid=858 execve guuid=d09f7751-3a00-0000-3a7a-9cb15b030000 pid=859 /usr/bin/wget net send-data guuid=a9e45cfe-3800-0000-3a7a-9cb13e030000 pid=830->guuid=d09f7751-3a00-0000-3a7a-9cb15b030000 pid=859 execve guuid=b9212657-3a00-0000-3a7a-9cb163030000 pid=867 /usr/bin/curl net send-data write-file guuid=a9e45cfe-3800-0000-3a7a-9cb13e030000 pid=830->guuid=b9212657-3a00-0000-3a7a-9cb163030000 pid=867 execve guuid=b025ac5d-3a00-0000-3a7a-9cb165030000 pid=869 /usr/bin/chmod guuid=a9e45cfe-3800-0000-3a7a-9cb13e030000 pid=830->guuid=b025ac5d-3a00-0000-3a7a-9cb165030000 pid=869 execve guuid=556f095e-3a00-0000-3a7a-9cb167030000 pid=871 /usr/bin/bash guuid=a9e45cfe-3800-0000-3a7a-9cb13e030000 pid=830->guuid=556f095e-3a00-0000-3a7a-9cb167030000 pid=871 clone guuid=4080575e-3a00-0000-3a7a-9cb169030000 pid=873 /usr/bin/rm delete-file guuid=a9e45cfe-3800-0000-3a7a-9cb13e030000 pid=830->guuid=4080575e-3a00-0000-3a7a-9cb169030000 pid=873 execve guuid=88c5ff5e-3a00-0000-3a7a-9cb16c030000 pid=876 /usr/bin/rm guuid=a9e45cfe-3800-0000-3a7a-9cb13e030000 pid=830->guuid=88c5ff5e-3a00-0000-3a7a-9cb16c030000 pid=876 execve guuid=c4009163-3a00-0000-3a7a-9cb170030000 pid=880 /usr/bin/wget net send-data guuid=a9e45cfe-3800-0000-3a7a-9cb13e030000 pid=830->guuid=c4009163-3a00-0000-3a7a-9cb170030000 pid=880 execve guuid=323c9a67-3a00-0000-3a7a-9cb178030000 pid=888 /usr/bin/curl net send-data write-file guuid=a9e45cfe-3800-0000-3a7a-9cb13e030000 pid=830->guuid=323c9a67-3a00-0000-3a7a-9cb178030000 pid=888 execve guuid=a4d1c46c-3a00-0000-3a7a-9cb184030000 pid=900 /usr/bin/chmod guuid=a9e45cfe-3800-0000-3a7a-9cb13e030000 pid=830->guuid=a4d1c46c-3a00-0000-3a7a-9cb184030000 pid=900 execve guuid=6fe05b6d-3a00-0000-3a7a-9cb186030000 pid=902 /usr/bin/bash guuid=a9e45cfe-3800-0000-3a7a-9cb13e030000 pid=830->guuid=6fe05b6d-3a00-0000-3a7a-9cb186030000 pid=902 clone guuid=931ba16d-3a00-0000-3a7a-9cb189030000 pid=905 /usr/bin/rm delete-file guuid=a9e45cfe-3800-0000-3a7a-9cb13e030000 pid=830->guuid=931ba16d-3a00-0000-3a7a-9cb189030000 pid=905 execve guuid=7a53076e-3a00-0000-3a7a-9cb18b030000 pid=907 /usr/bin/rm guuid=a9e45cfe-3800-0000-3a7a-9cb13e030000 pid=830->guuid=7a53076e-3a00-0000-3a7a-9cb18b030000 pid=907 execve guuid=74426c6e-3a00-0000-3a7a-9cb18d030000 pid=909 /usr/bin/wget net send-data guuid=a9e45cfe-3800-0000-3a7a-9cb13e030000 pid=830->guuid=74426c6e-3a00-0000-3a7a-9cb18d030000 pid=909 execve guuid=5fe07a71-3a00-0000-3a7a-9cb194030000 pid=916 /usr/bin/curl net send-data write-file guuid=a9e45cfe-3800-0000-3a7a-9cb13e030000 pid=830->guuid=5fe07a71-3a00-0000-3a7a-9cb194030000 pid=916 execve guuid=e277c178-3a00-0000-3a7a-9cb19e030000 pid=926 /usr/bin/chmod guuid=a9e45cfe-3800-0000-3a7a-9cb13e030000 pid=830->guuid=e277c178-3a00-0000-3a7a-9cb19e030000 pid=926 execve guuid=749d2879-3a00-0000-3a7a-9cb19f030000 pid=927 /usr/bin/bash guuid=a9e45cfe-3800-0000-3a7a-9cb13e030000 pid=830->guuid=749d2879-3a00-0000-3a7a-9cb19f030000 pid=927 clone guuid=389ea779-3a00-0000-3a7a-9cb1a2030000 pid=930 /usr/bin/rm delete-file guuid=a9e45cfe-3800-0000-3a7a-9cb13e030000 pid=830->guuid=389ea779-3a00-0000-3a7a-9cb1a2030000 pid=930 execve guuid=f9f61a7a-3a00-0000-3a7a-9cb1a4030000 pid=932 /usr/bin/rm guuid=a9e45cfe-3800-0000-3a7a-9cb13e030000 pid=830->guuid=f9f61a7a-3a00-0000-3a7a-9cb1a4030000 pid=932 execve guuid=10d7797a-3a00-0000-3a7a-9cb1a6030000 pid=934 /usr/bin/wget net send-data guuid=a9e45cfe-3800-0000-3a7a-9cb13e030000 pid=830->guuid=10d7797a-3a00-0000-3a7a-9cb1a6030000 pid=934 execve guuid=de0e287e-3a00-0000-3a7a-9cb1ac030000 pid=940 /usr/bin/curl net send-data write-file guuid=a9e45cfe-3800-0000-3a7a-9cb13e030000 pid=830->guuid=de0e287e-3a00-0000-3a7a-9cb1ac030000 pid=940 execve guuid=df759684-3a00-0000-3a7a-9cb1b6030000 pid=950 /usr/bin/chmod guuid=a9e45cfe-3800-0000-3a7a-9cb13e030000 pid=830->guuid=df759684-3a00-0000-3a7a-9cb1b6030000 pid=950 execve guuid=1ac20285-3a00-0000-3a7a-9cb1b8030000 pid=952 /usr/bin/bash guuid=a9e45cfe-3800-0000-3a7a-9cb13e030000 pid=830->guuid=1ac20285-3a00-0000-3a7a-9cb1b8030000 pid=952 clone guuid=e6e78c85-3a00-0000-3a7a-9cb1bb030000 pid=955 /usr/bin/rm delete-file guuid=a9e45cfe-3800-0000-3a7a-9cb13e030000 pid=830->guuid=e6e78c85-3a00-0000-3a7a-9cb1bb030000 pid=955 execve guuid=d877fa85-3a00-0000-3a7a-9cb1bc030000 pid=956 /usr/bin/rm guuid=a9e45cfe-3800-0000-3a7a-9cb13e030000 pid=830->guuid=d877fa85-3a00-0000-3a7a-9cb1bc030000 pid=956 execve guuid=91785f86-3a00-0000-3a7a-9cb1be030000 pid=958 /usr/bin/wget net send-data guuid=a9e45cfe-3800-0000-3a7a-9cb13e030000 pid=830->guuid=91785f86-3a00-0000-3a7a-9cb1be030000 pid=958 execve guuid=95debd8b-3a00-0000-3a7a-9cb1c4030000 pid=964 /usr/bin/curl net send-data write-file guuid=a9e45cfe-3800-0000-3a7a-9cb13e030000 pid=830->guuid=95debd8b-3a00-0000-3a7a-9cb1c4030000 pid=964 execve guuid=8a284d91-3a00-0000-3a7a-9cb1ce030000 pid=974 /usr/bin/chmod guuid=a9e45cfe-3800-0000-3a7a-9cb13e030000 pid=830->guuid=8a284d91-3a00-0000-3a7a-9cb1ce030000 pid=974 execve guuid=6cf29b91-3a00-0000-3a7a-9cb1cf030000 pid=975 /usr/bin/bash guuid=a9e45cfe-3800-0000-3a7a-9cb13e030000 pid=830->guuid=6cf29b91-3a00-0000-3a7a-9cb1cf030000 pid=975 clone guuid=94921592-3a00-0000-3a7a-9cb1d2030000 pid=978 /usr/bin/rm delete-file guuid=a9e45cfe-3800-0000-3a7a-9cb13e030000 pid=830->guuid=94921592-3a00-0000-3a7a-9cb1d2030000 pid=978 execve guuid=10cd0c93-3a00-0000-3a7a-9cb1d5030000 pid=981 /usr/bin/rm guuid=a9e45cfe-3800-0000-3a7a-9cb13e030000 pid=830->guuid=10cd0c93-3a00-0000-3a7a-9cb1d5030000 pid=981 execve guuid=e9427393-3a00-0000-3a7a-9cb1d6030000 pid=982 /usr/bin/wget net send-data guuid=a9e45cfe-3800-0000-3a7a-9cb13e030000 pid=830->guuid=e9427393-3a00-0000-3a7a-9cb1d6030000 pid=982 execve guuid=4a28cb96-3a00-0000-3a7a-9cb1de030000 pid=990 /usr/bin/curl net send-data write-file guuid=a9e45cfe-3800-0000-3a7a-9cb13e030000 pid=830->guuid=4a28cb96-3a00-0000-3a7a-9cb1de030000 pid=990 execve guuid=305c269b-3a00-0000-3a7a-9cb1e8030000 pid=1000 /usr/bin/chmod guuid=a9e45cfe-3800-0000-3a7a-9cb13e030000 pid=830->guuid=305c269b-3a00-0000-3a7a-9cb1e8030000 pid=1000 execve guuid=a47b819b-3a00-0000-3a7a-9cb1e9030000 pid=1001 /usr/bin/bash guuid=a9e45cfe-3800-0000-3a7a-9cb13e030000 pid=830->guuid=a47b819b-3a00-0000-3a7a-9cb1e9030000 pid=1001 clone guuid=c74ace9b-3a00-0000-3a7a-9cb1ec030000 pid=1004 /usr/bin/rm delete-file guuid=a9e45cfe-3800-0000-3a7a-9cb13e030000 pid=830->guuid=c74ace9b-3a00-0000-3a7a-9cb1ec030000 pid=1004 execve guuid=3c65209c-3a00-0000-3a7a-9cb1ee030000 pid=1006 /usr/bin/rm guuid=a9e45cfe-3800-0000-3a7a-9cb13e030000 pid=830->guuid=3c65209c-3a00-0000-3a7a-9cb1ee030000 pid=1006 execve guuid=865b8f9c-3a00-0000-3a7a-9cb1f0030000 pid=1008 /usr/bin/wget net send-data guuid=a9e45cfe-3800-0000-3a7a-9cb13e030000 pid=830->guuid=865b8f9c-3a00-0000-3a7a-9cb1f0030000 pid=1008 execve guuid=dcc508a1-3a00-0000-3a7a-9cb1f9030000 pid=1017 /usr/bin/curl net send-data write-file guuid=a9e45cfe-3800-0000-3a7a-9cb13e030000 pid=830->guuid=dcc508a1-3a00-0000-3a7a-9cb1f9030000 pid=1017 execve guuid=04ef53a5-3a00-0000-3a7a-9cb102040000 pid=1026 /usr/bin/chmod guuid=a9e45cfe-3800-0000-3a7a-9cb13e030000 pid=830->guuid=04ef53a5-3a00-0000-3a7a-9cb102040000 pid=1026 execve guuid=78d6d0a5-3a00-0000-3a7a-9cb104040000 pid=1028 /usr/bin/bash guuid=a9e45cfe-3800-0000-3a7a-9cb13e030000 pid=830->guuid=78d6d0a5-3a00-0000-3a7a-9cb104040000 pid=1028 clone guuid=d37320a6-3a00-0000-3a7a-9cb107040000 pid=1031 /usr/bin/rm delete-file guuid=a9e45cfe-3800-0000-3a7a-9cb13e030000 pid=830->guuid=d37320a6-3a00-0000-3a7a-9cb107040000 pid=1031 execve guuid=b49a81a6-3a00-0000-3a7a-9cb109040000 pid=1033 /usr/bin/rm guuid=a9e45cfe-3800-0000-3a7a-9cb13e030000 pid=830->guuid=b49a81a6-3a00-0000-3a7a-9cb109040000 pid=1033 execve guuid=05b4cca6-3a00-0000-3a7a-9cb10a040000 pid=1034 /usr/bin/wget net send-data guuid=a9e45cfe-3800-0000-3a7a-9cb13e030000 pid=830->guuid=05b4cca6-3a00-0000-3a7a-9cb10a040000 pid=1034 execve guuid=6b1057aa-3a00-0000-3a7a-9cb112040000 pid=1042 /usr/bin/curl net send-data write-file guuid=a9e45cfe-3800-0000-3a7a-9cb13e030000 pid=830->guuid=6b1057aa-3a00-0000-3a7a-9cb112040000 pid=1042 execve guuid=1ea514af-3a00-0000-3a7a-9cb11b040000 pid=1051 /usr/bin/chmod guuid=a9e45cfe-3800-0000-3a7a-9cb13e030000 pid=830->guuid=1ea514af-3a00-0000-3a7a-9cb11b040000 pid=1051 execve guuid=20e566af-3a00-0000-3a7a-9cb11d040000 pid=1053 /usr/bin/bash guuid=a9e45cfe-3800-0000-3a7a-9cb13e030000 pid=830->guuid=20e566af-3a00-0000-3a7a-9cb11d040000 pid=1053 clone guuid=6d26aeaf-3a00-0000-3a7a-9cb11f040000 pid=1055 /usr/bin/rm delete-file guuid=a9e45cfe-3800-0000-3a7a-9cb13e030000 pid=830->guuid=6d26aeaf-3a00-0000-3a7a-9cb11f040000 pid=1055 execve guuid=d84826b0-3a00-0000-3a7a-9cb121040000 pid=1057 /usr/bin/rm guuid=a9e45cfe-3800-0000-3a7a-9cb13e030000 pid=830->guuid=d84826b0-3a00-0000-3a7a-9cb121040000 pid=1057 execve 5b654972-c9e1-50d8-b372-2dc2a5b9ad66 5.182.210.174:80 guuid=955270ff-3800-0000-3a7a-9cb13f030000 pid=831->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=9359ad22-3a00-0000-3a7a-9cb140030000 pid=832->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=6daf6431-3a00-0000-3a7a-9cb143030000 pid=835 /usr/bin/bash guuid=cfee3631-3a00-0000-3a7a-9cb142030000 pid=834->guuid=6daf6431-3a00-0000-3a7a-9cb143030000 pid=835 clone guuid=40dafe32-3a00-0000-3a7a-9cb146030000 pid=838->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=e51dec35-3a00-0000-3a7a-9cb147030000 pid=839->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=e38e893a-3a00-0000-3a7a-9cb14a030000 pid=842 /usr/bin/bash guuid=8dc1653a-3a00-0000-3a7a-9cb149030000 pid=841->guuid=e38e893a-3a00-0000-3a7a-9cb14a030000 pid=842 clone guuid=1a86fe3b-3a00-0000-3a7a-9cb14d030000 pid=845->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=126c9e3f-3a00-0000-3a7a-9cb14e030000 pid=846->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=a4b7eb44-3a00-0000-3a7a-9cb151030000 pid=849 /usr/bin/bash guuid=41a5c244-3a00-0000-3a7a-9cb150030000 pid=848->guuid=a4b7eb44-3a00-0000-3a7a-9cb151030000 pid=849 clone guuid=8040fc46-3a00-0000-3a7a-9cb154030000 pid=852->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=0c69274b-3a00-0000-3a7a-9cb155030000 pid=853->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=a13d2d50-3a00-0000-3a7a-9cb158030000 pid=856 /usr/bin/bash guuid=fe160050-3a00-0000-3a7a-9cb157030000 pid=855->guuid=a13d2d50-3a00-0000-3a7a-9cb158030000 pid=856 clone guuid=d09f7751-3a00-0000-3a7a-9cb15b030000 pid=859->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=b9212657-3a00-0000-3a7a-9cb163030000 pid=867->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=664c1f5e-3a00-0000-3a7a-9cb168030000 pid=872 /usr/bin/bash guuid=556f095e-3a00-0000-3a7a-9cb167030000 pid=871->guuid=664c1f5e-3a00-0000-3a7a-9cb168030000 pid=872 clone guuid=c4009163-3a00-0000-3a7a-9cb170030000 pid=880->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=323c9a67-3a00-0000-3a7a-9cb178030000 pid=888->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=25fb7b6d-3a00-0000-3a7a-9cb188030000 pid=904 /usr/bin/bash guuid=6fe05b6d-3a00-0000-3a7a-9cb186030000 pid=902->guuid=25fb7b6d-3a00-0000-3a7a-9cb188030000 pid=904 clone guuid=74426c6e-3a00-0000-3a7a-9cb18d030000 pid=909->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=5fe07a71-3a00-0000-3a7a-9cb194030000 pid=916->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=cf544a79-3a00-0000-3a7a-9cb1a1030000 pid=929 /usr/bin/bash guuid=749d2879-3a00-0000-3a7a-9cb19f030000 pid=927->guuid=cf544a79-3a00-0000-3a7a-9cb1a1030000 pid=929 clone guuid=10d7797a-3a00-0000-3a7a-9cb1a6030000 pid=934->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=de0e287e-3a00-0000-3a7a-9cb1ac030000 pid=940->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=4fcd1b85-3a00-0000-3a7a-9cb1b9030000 pid=953 /usr/bin/bash guuid=1ac20285-3a00-0000-3a7a-9cb1b8030000 pid=952->guuid=4fcd1b85-3a00-0000-3a7a-9cb1b9030000 pid=953 clone guuid=91785f86-3a00-0000-3a7a-9cb1be030000 pid=958->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=95debd8b-3a00-0000-3a7a-9cb1c4030000 pid=964->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=3429e691-3a00-0000-3a7a-9cb1d1030000 pid=977 /usr/bin/bash guuid=6cf29b91-3a00-0000-3a7a-9cb1cf030000 pid=975->guuid=3429e691-3a00-0000-3a7a-9cb1d1030000 pid=977 clone guuid=e9427393-3a00-0000-3a7a-9cb1d6030000 pid=982->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=4a28cb96-3a00-0000-3a7a-9cb1de030000 pid=990->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=e9119d9b-3a00-0000-3a7a-9cb1ea030000 pid=1002 /usr/bin/bash guuid=a47b819b-3a00-0000-3a7a-9cb1e9030000 pid=1001->guuid=e9119d9b-3a00-0000-3a7a-9cb1ea030000 pid=1002 clone guuid=865b8f9c-3a00-0000-3a7a-9cb1f0030000 pid=1008->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=dcc508a1-3a00-0000-3a7a-9cb1f9030000 pid=1017->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=c596f9a5-3a00-0000-3a7a-9cb106040000 pid=1030 /usr/bin/bash guuid=78d6d0a5-3a00-0000-3a7a-9cb104040000 pid=1028->guuid=c596f9a5-3a00-0000-3a7a-9cb106040000 pid=1030 clone guuid=05b4cca6-3a00-0000-3a7a-9cb10a040000 pid=1034->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=6b1057aa-3a00-0000-3a7a-9cb112040000 pid=1042->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=badf85af-3a00-0000-3a7a-9cb11e040000 pid=1054 /usr/bin/bash guuid=20e566af-3a00-0000-3a7a-9cb11d040000 pid=1053->guuid=badf85af-3a00-0000-3a7a-9cb11e040000 pid=1054 clone
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/785df56f0e1cc810787a59e43b0287557aae2af3cd55c27c1b6d2a33ad4dcb4d
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/785df56f0e1cc810787a59e43b0287557aae2af3cd55c27c1b6d2a33ad4dcb4d/
Threat name:
Linux.Trojan.Egairtigado
Create hunting rule
Status:
Malicious
First seen:
2026-09-07 07:00:39 UTC
File Type:
Text (Shell)
AV detection:
13 of 24 (54.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pbo7k3yodteba6d2lhsdwauhkv5k4kxtzvk4e7a3nuvdhlknzngq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260907-hsvmya1ckh/
Behaviour
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.11
Link:
https://yomi.yoroi.company/submissions/785df56f0e1cc810787a59e43b0287557aae2af3cd55c27c1b6d2a33ad4dcb4d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 785df56f0e1cc810787a59e43b0287557aae2af3cd55c27c1b6d2a33ad4dcb4d

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3897671/
  
Delivery method
Distributed via web download

Comments