MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7986219bbfcd6e8a45027f7e6c424e7247b3e9f53033a5f8d2ba02697fcf8c47. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7986219bbfcd6e8a45027f7e6c424e7247b3e9f53033a5f8d2ba02697fcf8c47
SHA3-384 hash: 53238e7b2c2e8bdcd00f38eb82c6370256c2143042406d0dd67af15c485cc9a3ca404db6ae2ad63b886fe6fd17d99eb1
SHA1 hash: c28281671e9004cd01b75b21f9e3f4be49573a75
MD5 hash: ed6cb588b2cf84cbd080b7d79c38896b
humanhash: stairway-glucose-queen-leopard
File name:7986219bbfcd6e8a45027f7e6c424e7247b3e9f53033a5f8d2ba02697fcf8c47
Download: download sample
File size:1'608 bytes
First seen:2026-08-26 09:00:17 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 24:fDLrRd5YErHAwAkSZhmZT5slPyZkPk8ViGn:fDLrRd5YE0LqTWfViGn
TLSH T1E1310D8F24441A721407CD8E72A72998B24DA2EB285FE7D8CC484EF9878D78DF161B5D
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter EnthecSolutions
Tags:enthec sh
URLMalware sample (SHA256 hash)SignatureTags
http://5.182.210.174/7a0f48n/an/an/a
http://5.182.210.174/c19448n/an/an/a
http://5.182.210.174/7a6fb5n/an/an/a
http://5.182.210.174/de6ef4n/an/an/a
http://5.182.210.174/2cbefcn/an/an/a
http://5.182.210.174/a338f8n/an/an/a
http://5.182.210.174/2740b1n/an/an/a
http://5.182.210.174/2617fan/an/an/a
http://5.182.210.174/d4dc06n/an/an/a
http://5.182.210.174/5d049fn/an/an/a
http://5.182.210.174/f0ced6n/an/an/a
http://5.182.210.174/179e4dn/an/an/a

Intelligence

File Origin
# of uploads :
1
# of downloads :
86
Origin country :
CA CA
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive mirai
Link:
https://www.filescan.io/uploads/6a8eab2cc71c5df1c07c3dc9/reports/d696afa4-ae12-4b63-b33c-86941e5ffb76/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-08-26T07:24:00Z UTC
Last seen:
2026-08-26T08:47:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/7986219bbfcd6e8a45027f7e6c424e7247b3e9f53033a5f8d2ba02697fcf8c47/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/9e8d3efc-16e4-4c75-9d94-376d6c71a662
Behavior Graph:
Download SVG
%3 guuid=06e8a125-1900-0000-cc93-2c372e090000 pid=2350 /usr/bin/sudo guuid=1cc70528-1900-0000-cc93-2c3738090000 pid=2360 /tmp/sample.bin guuid=06e8a125-1900-0000-cc93-2c372e090000 pid=2350->guuid=1cc70528-1900-0000-cc93-2c3738090000 pid=2360 execve guuid=4e526928-1900-0000-cc93-2c373a090000 pid=2362 /usr/bin/wget net send-data guuid=1cc70528-1900-0000-cc93-2c3738090000 pid=2360->guuid=4e526928-1900-0000-cc93-2c373a090000 pid=2362 execve guuid=13487f2b-1900-0000-cc93-2c3744090000 pid=2372 /usr/bin/curl net send-data write-file guuid=1cc70528-1900-0000-cc93-2c3738090000 pid=2360->guuid=13487f2b-1900-0000-cc93-2c3744090000 pid=2372 execve guuid=5c0e5333-1900-0000-cc93-2c3750090000 pid=2384 /usr/bin/chmod guuid=1cc70528-1900-0000-cc93-2c3738090000 pid=2360->guuid=5c0e5333-1900-0000-cc93-2c3750090000 pid=2384 execve guuid=76bed433-1900-0000-cc93-2c3751090000 pid=2385 /usr/bin/bash guuid=1cc70528-1900-0000-cc93-2c3738090000 pid=2360->guuid=76bed433-1900-0000-cc93-2c3751090000 pid=2385 clone guuid=3ca53434-1900-0000-cc93-2c3754090000 pid=2388 /usr/bin/rm delete-file guuid=1cc70528-1900-0000-cc93-2c3738090000 pid=2360->guuid=3ca53434-1900-0000-cc93-2c3754090000 pid=2388 execve guuid=5c34b734-1900-0000-cc93-2c3756090000 pid=2390 /usr/bin/rm guuid=1cc70528-1900-0000-cc93-2c3738090000 pid=2360->guuid=5c34b734-1900-0000-cc93-2c3756090000 pid=2390 execve guuid=f0b11f35-1900-0000-cc93-2c3758090000 pid=2392 /usr/bin/wget net send-data guuid=1cc70528-1900-0000-cc93-2c3738090000 pid=2360->guuid=f0b11f35-1900-0000-cc93-2c3758090000 pid=2392 execve guuid=e78a5f38-1900-0000-cc93-2c375d090000 pid=2397 /usr/bin/curl net send-data write-file guuid=1cc70528-1900-0000-cc93-2c3738090000 pid=2360->guuid=e78a5f38-1900-0000-cc93-2c375d090000 pid=2397 execve guuid=0a6ccc3e-1900-0000-cc93-2c3770090000 pid=2416 /usr/bin/chmod guuid=1cc70528-1900-0000-cc93-2c3738090000 pid=2360->guuid=0a6ccc3e-1900-0000-cc93-2c3770090000 pid=2416 execve guuid=a468073f-1900-0000-cc93-2c3772090000 pid=2418 /usr/bin/bash guuid=1cc70528-1900-0000-cc93-2c3738090000 pid=2360->guuid=a468073f-1900-0000-cc93-2c3772090000 pid=2418 clone guuid=d8a2383f-1900-0000-cc93-2c3774090000 pid=2420 /usr/bin/rm delete-file guuid=1cc70528-1900-0000-cc93-2c3738090000 pid=2360->guuid=d8a2383f-1900-0000-cc93-2c3774090000 pid=2420 execve guuid=3b07783f-1900-0000-cc93-2c3776090000 pid=2422 /usr/bin/rm guuid=1cc70528-1900-0000-cc93-2c3738090000 pid=2360->guuid=3b07783f-1900-0000-cc93-2c3776090000 pid=2422 execve guuid=cf11b93f-1900-0000-cc93-2c3778090000 pid=2424 /usr/bin/wget net send-data guuid=1cc70528-1900-0000-cc93-2c3738090000 pid=2360->guuid=cf11b93f-1900-0000-cc93-2c3778090000 pid=2424 execve guuid=ff4c6e42-1900-0000-cc93-2c377e090000 pid=2430 /usr/bin/curl net send-data write-file guuid=1cc70528-1900-0000-cc93-2c3738090000 pid=2360->guuid=ff4c6e42-1900-0000-cc93-2c377e090000 pid=2430 execve guuid=0027f147-1900-0000-cc93-2c378e090000 pid=2446 /usr/bin/chmod guuid=1cc70528-1900-0000-cc93-2c3738090000 pid=2360->guuid=0027f147-1900-0000-cc93-2c378e090000 pid=2446 execve guuid=486b3848-1900-0000-cc93-2c3790090000 pid=2448 /usr/bin/bash guuid=1cc70528-1900-0000-cc93-2c3738090000 pid=2360->guuid=486b3848-1900-0000-cc93-2c3790090000 pid=2448 clone guuid=d3256e48-1900-0000-cc93-2c3792090000 pid=2450 /usr/bin/rm delete-file guuid=1cc70528-1900-0000-cc93-2c3738090000 pid=2360->guuid=d3256e48-1900-0000-cc93-2c3792090000 pid=2450 execve guuid=64abb348-1900-0000-cc93-2c3795090000 pid=2453 /usr/bin/rm guuid=1cc70528-1900-0000-cc93-2c3738090000 pid=2360->guuid=64abb348-1900-0000-cc93-2c3795090000 pid=2453 execve guuid=5e11f248-1900-0000-cc93-2c3796090000 pid=2454 /usr/bin/wget net send-data guuid=1cc70528-1900-0000-cc93-2c3738090000 pid=2360->guuid=5e11f248-1900-0000-cc93-2c3796090000 pid=2454 execve guuid=85259b4b-1900-0000-cc93-2c379b090000 pid=2459 /usr/bin/curl net send-data write-file guuid=1cc70528-1900-0000-cc93-2c3738090000 pid=2360->guuid=85259b4b-1900-0000-cc93-2c379b090000 pid=2459 execve guuid=24c93d52-1900-0000-cc93-2c37ac090000 pid=2476 /usr/bin/chmod guuid=1cc70528-1900-0000-cc93-2c3738090000 pid=2360->guuid=24c93d52-1900-0000-cc93-2c37ac090000 pid=2476 execve guuid=a7792b53-1900-0000-cc93-2c37b0090000 pid=2480 /usr/bin/bash guuid=1cc70528-1900-0000-cc93-2c3738090000 pid=2360->guuid=a7792b53-1900-0000-cc93-2c37b0090000 pid=2480 clone guuid=2e703354-1900-0000-cc93-2c37b4090000 pid=2484 /usr/bin/rm delete-file guuid=1cc70528-1900-0000-cc93-2c3738090000 pid=2360->guuid=2e703354-1900-0000-cc93-2c37b4090000 pid=2484 execve guuid=388f2c55-1900-0000-cc93-2c37b7090000 pid=2487 /usr/bin/rm guuid=1cc70528-1900-0000-cc93-2c3738090000 pid=2360->guuid=388f2c55-1900-0000-cc93-2c37b7090000 pid=2487 execve guuid=9a4c7555-1900-0000-cc93-2c37b8090000 pid=2488 /usr/bin/wget net send-data guuid=1cc70528-1900-0000-cc93-2c3738090000 pid=2360->guuid=9a4c7555-1900-0000-cc93-2c37b8090000 pid=2488 execve guuid=a3c51158-1900-0000-cc93-2c37c1090000 pid=2497 /usr/bin/curl net send-data write-file guuid=1cc70528-1900-0000-cc93-2c3738090000 pid=2360->guuid=a3c51158-1900-0000-cc93-2c37c1090000 pid=2497 execve guuid=5f42935e-1900-0000-cc93-2c37d8090000 pid=2520 /usr/bin/chmod guuid=1cc70528-1900-0000-cc93-2c3738090000 pid=2360->guuid=5f42935e-1900-0000-cc93-2c37d8090000 pid=2520 execve guuid=5dbddf5e-1900-0000-cc93-2c37da090000 pid=2522 /usr/bin/bash guuid=1cc70528-1900-0000-cc93-2c3738090000 pid=2360->guuid=5dbddf5e-1900-0000-cc93-2c37da090000 pid=2522 clone guuid=ad87165f-1900-0000-cc93-2c37dd090000 pid=2525 /usr/bin/rm delete-file guuid=1cc70528-1900-0000-cc93-2c3738090000 pid=2360->guuid=ad87165f-1900-0000-cc93-2c37dd090000 pid=2525 execve guuid=7ea1815f-1900-0000-cc93-2c37df090000 pid=2527 /usr/bin/rm guuid=1cc70528-1900-0000-cc93-2c3738090000 pid=2360->guuid=7ea1815f-1900-0000-cc93-2c37df090000 pid=2527 execve guuid=ea66fb5f-1900-0000-cc93-2c37e2090000 pid=2530 /usr/bin/wget net send-data guuid=1cc70528-1900-0000-cc93-2c3738090000 pid=2360->guuid=ea66fb5f-1900-0000-cc93-2c37e2090000 pid=2530 execve guuid=4e2a2563-1900-0000-cc93-2c37ef090000 pid=2543 /usr/bin/curl net send-data write-file guuid=1cc70528-1900-0000-cc93-2c3738090000 pid=2360->guuid=4e2a2563-1900-0000-cc93-2c37ef090000 pid=2543 execve guuid=2d610468-1900-0000-cc93-2c37040a0000 pid=2564 /usr/bin/chmod guuid=1cc70528-1900-0000-cc93-2c3738090000 pid=2360->guuid=2d610468-1900-0000-cc93-2c37040a0000 pid=2564 execve guuid=94d15368-1900-0000-cc93-2c37060a0000 pid=2566 /usr/bin/bash guuid=1cc70528-1900-0000-cc93-2c3738090000 pid=2360->guuid=94d15368-1900-0000-cc93-2c37060a0000 pid=2566 clone guuid=c54c8c68-1900-0000-cc93-2c37090a0000 pid=2569 /usr/bin/rm delete-file guuid=1cc70528-1900-0000-cc93-2c3738090000 pid=2360->guuid=c54c8c68-1900-0000-cc93-2c37090a0000 pid=2569 execve guuid=14e1e968-1900-0000-cc93-2c370b0a0000 pid=2571 /usr/bin/rm guuid=1cc70528-1900-0000-cc93-2c3738090000 pid=2360->guuid=14e1e968-1900-0000-cc93-2c370b0a0000 pid=2571 execve guuid=6ad42269-1900-0000-cc93-2c370c0a0000 pid=2572 /usr/bin/wget net send-data guuid=1cc70528-1900-0000-cc93-2c3738090000 pid=2360->guuid=6ad42269-1900-0000-cc93-2c370c0a0000 pid=2572 execve guuid=b0618d6b-1900-0000-cc93-2c37140a0000 pid=2580 /usr/bin/curl net send-data write-file guuid=1cc70528-1900-0000-cc93-2c3738090000 pid=2360->guuid=b0618d6b-1900-0000-cc93-2c37140a0000 pid=2580 execve guuid=b2850e71-1900-0000-cc93-2c372a0a0000 pid=2602 /usr/bin/chmod guuid=1cc70528-1900-0000-cc93-2c3738090000 pid=2360->guuid=b2850e71-1900-0000-cc93-2c372a0a0000 pid=2602 execve guuid=adf56c71-1900-0000-cc93-2c372c0a0000 pid=2604 /usr/bin/bash guuid=1cc70528-1900-0000-cc93-2c3738090000 pid=2360->guuid=adf56c71-1900-0000-cc93-2c372c0a0000 pid=2604 clone guuid=fbbda871-1900-0000-cc93-2c372f0a0000 pid=2607 /usr/bin/rm delete-file guuid=1cc70528-1900-0000-cc93-2c3738090000 pid=2360->guuid=fbbda871-1900-0000-cc93-2c372f0a0000 pid=2607 execve guuid=81e30272-1900-0000-cc93-2c37300a0000 pid=2608 /usr/bin/rm guuid=1cc70528-1900-0000-cc93-2c3738090000 pid=2360->guuid=81e30272-1900-0000-cc93-2c37300a0000 pid=2608 execve guuid=75038972-1900-0000-cc93-2c37320a0000 pid=2610 /usr/bin/wget net send-data guuid=1cc70528-1900-0000-cc93-2c3738090000 pid=2360->guuid=75038972-1900-0000-cc93-2c37320a0000 pid=2610 execve guuid=d6e2cf75-1900-0000-cc93-2c373f0a0000 pid=2623 /usr/bin/curl net send-data write-file guuid=1cc70528-1900-0000-cc93-2c3738090000 pid=2360->guuid=d6e2cf75-1900-0000-cc93-2c373f0a0000 pid=2623 execve guuid=3e69297a-1900-0000-cc93-2c374e0a0000 pid=2638 /usr/bin/chmod guuid=1cc70528-1900-0000-cc93-2c3738090000 pid=2360->guuid=3e69297a-1900-0000-cc93-2c374e0a0000 pid=2638 execve guuid=f143757a-1900-0000-cc93-2c37500a0000 pid=2640 /usr/bin/bash guuid=1cc70528-1900-0000-cc93-2c3738090000 pid=2360->guuid=f143757a-1900-0000-cc93-2c37500a0000 pid=2640 clone guuid=334db77a-1900-0000-cc93-2c37530a0000 pid=2643 /usr/bin/rm delete-file guuid=1cc70528-1900-0000-cc93-2c3738090000 pid=2360->guuid=334db77a-1900-0000-cc93-2c37530a0000 pid=2643 execve guuid=497f007b-1900-0000-cc93-2c37550a0000 pid=2645 /usr/bin/rm guuid=1cc70528-1900-0000-cc93-2c3738090000 pid=2360->guuid=497f007b-1900-0000-cc93-2c37550a0000 pid=2645 execve guuid=37144e7b-1900-0000-cc93-2c37570a0000 pid=2647 /usr/bin/wget net send-data guuid=1cc70528-1900-0000-cc93-2c3738090000 pid=2360->guuid=37144e7b-1900-0000-cc93-2c37570a0000 pid=2647 execve guuid=acf0997e-1900-0000-cc93-2c375f0a0000 pid=2655 /usr/bin/curl net send-data write-file guuid=1cc70528-1900-0000-cc93-2c3738090000 pid=2360->guuid=acf0997e-1900-0000-cc93-2c375f0a0000 pid=2655 execve guuid=c1a0e082-1900-0000-cc93-2c376d0a0000 pid=2669 /usr/bin/chmod guuid=1cc70528-1900-0000-cc93-2c3738090000 pid=2360->guuid=c1a0e082-1900-0000-cc93-2c376d0a0000 pid=2669 execve guuid=dfb13983-1900-0000-cc93-2c376f0a0000 pid=2671 /usr/bin/bash guuid=1cc70528-1900-0000-cc93-2c3738090000 pid=2360->guuid=dfb13983-1900-0000-cc93-2c376f0a0000 pid=2671 clone guuid=95549383-1900-0000-cc93-2c37720a0000 pid=2674 /usr/bin/rm delete-file guuid=1cc70528-1900-0000-cc93-2c3738090000 pid=2360->guuid=95549383-1900-0000-cc93-2c37720a0000 pid=2674 execve guuid=1b44df83-1900-0000-cc93-2c37740a0000 pid=2676 /usr/bin/rm guuid=1cc70528-1900-0000-cc93-2c3738090000 pid=2360->guuid=1b44df83-1900-0000-cc93-2c37740a0000 pid=2676 execve guuid=75ba4f84-1900-0000-cc93-2c37760a0000 pid=2678 /usr/bin/wget net send-data guuid=1cc70528-1900-0000-cc93-2c3738090000 pid=2360->guuid=75ba4f84-1900-0000-cc93-2c37760a0000 pid=2678 execve guuid=ac07b087-1900-0000-cc93-2c377e0a0000 pid=2686 /usr/bin/curl net send-data write-file guuid=1cc70528-1900-0000-cc93-2c3738090000 pid=2360->guuid=ac07b087-1900-0000-cc93-2c377e0a0000 pid=2686 execve guuid=c994178b-1900-0000-cc93-2c37870a0000 pid=2695 /usr/bin/chmod guuid=1cc70528-1900-0000-cc93-2c3738090000 pid=2360->guuid=c994178b-1900-0000-cc93-2c37870a0000 pid=2695 execve guuid=76ce638b-1900-0000-cc93-2c37880a0000 pid=2696 /usr/bin/bash guuid=1cc70528-1900-0000-cc93-2c3738090000 pid=2360->guuid=76ce638b-1900-0000-cc93-2c37880a0000 pid=2696 clone guuid=56f2a98b-1900-0000-cc93-2c378b0a0000 pid=2699 /usr/bin/rm delete-file guuid=1cc70528-1900-0000-cc93-2c3738090000 pid=2360->guuid=56f2a98b-1900-0000-cc93-2c378b0a0000 pid=2699 execve guuid=02acfd8b-1900-0000-cc93-2c378d0a0000 pid=2701 /usr/bin/rm guuid=1cc70528-1900-0000-cc93-2c3738090000 pid=2360->guuid=02acfd8b-1900-0000-cc93-2c378d0a0000 pid=2701 execve guuid=4882468c-1900-0000-cc93-2c378f0a0000 pid=2703 /usr/bin/wget net send-data guuid=1cc70528-1900-0000-cc93-2c3738090000 pid=2360->guuid=4882468c-1900-0000-cc93-2c378f0a0000 pid=2703 execve guuid=c1ed378f-1900-0000-cc93-2c37980a0000 pid=2712 /usr/bin/curl net send-data write-file guuid=1cc70528-1900-0000-cc93-2c3738090000 pid=2360->guuid=c1ed378f-1900-0000-cc93-2c37980a0000 pid=2712 execve guuid=7f53d093-1900-0000-cc93-2c379b0a0000 pid=2715 /usr/bin/chmod guuid=1cc70528-1900-0000-cc93-2c3738090000 pid=2360->guuid=7f53d093-1900-0000-cc93-2c379b0a0000 pid=2715 execve guuid=cc705994-1900-0000-cc93-2c379c0a0000 pid=2716 /usr/bin/bash guuid=1cc70528-1900-0000-cc93-2c3738090000 pid=2360->guuid=cc705994-1900-0000-cc93-2c379c0a0000 pid=2716 clone guuid=6a30a094-1900-0000-cc93-2c379e0a0000 pid=2718 /usr/bin/rm delete-file guuid=1cc70528-1900-0000-cc93-2c3738090000 pid=2360->guuid=6a30a094-1900-0000-cc93-2c379e0a0000 pid=2718 execve guuid=0313ff94-1900-0000-cc93-2c37a00a0000 pid=2720 /usr/bin/rm guuid=1cc70528-1900-0000-cc93-2c3738090000 pid=2360->guuid=0313ff94-1900-0000-cc93-2c37a00a0000 pid=2720 execve guuid=4e5b4c95-1900-0000-cc93-2c37a20a0000 pid=2722 /usr/bin/wget net send-data guuid=1cc70528-1900-0000-cc93-2c3738090000 pid=2360->guuid=4e5b4c95-1900-0000-cc93-2c37a20a0000 pid=2722 execve guuid=5b6e0098-1900-0000-cc93-2c37a70a0000 pid=2727 /usr/bin/curl net send-data write-file guuid=1cc70528-1900-0000-cc93-2c3738090000 pid=2360->guuid=5b6e0098-1900-0000-cc93-2c37a70a0000 pid=2727 execve guuid=0843619e-1900-0000-cc93-2c37b50a0000 pid=2741 /usr/bin/chmod guuid=1cc70528-1900-0000-cc93-2c3738090000 pid=2360->guuid=0843619e-1900-0000-cc93-2c37b50a0000 pid=2741 execve guuid=bf52a49e-1900-0000-cc93-2c37b70a0000 pid=2743 /usr/bin/bash guuid=1cc70528-1900-0000-cc93-2c3738090000 pid=2360->guuid=bf52a49e-1900-0000-cc93-2c37b70a0000 pid=2743 clone guuid=9a11e59e-1900-0000-cc93-2c37b90a0000 pid=2745 /usr/bin/rm delete-file guuid=1cc70528-1900-0000-cc93-2c3738090000 pid=2360->guuid=9a11e59e-1900-0000-cc93-2c37b90a0000 pid=2745 execve guuid=38d32f9f-1900-0000-cc93-2c37bb0a0000 pid=2747 /usr/bin/rm guuid=1cc70528-1900-0000-cc93-2c3738090000 pid=2360->guuid=38d32f9f-1900-0000-cc93-2c37bb0a0000 pid=2747 execve 5b654972-c9e1-50d8-b372-2dc2a5b9ad66 5.182.210.174:80 guuid=4e526928-1900-0000-cc93-2c373a090000 pid=2362->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=13487f2b-1900-0000-cc93-2c3744090000 pid=2372->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=d681f433-1900-0000-cc93-2c3753090000 pid=2387 /usr/bin/bash guuid=76bed433-1900-0000-cc93-2c3751090000 pid=2385->guuid=d681f433-1900-0000-cc93-2c3753090000 pid=2387 clone guuid=f0b11f35-1900-0000-cc93-2c3758090000 pid=2392->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=e78a5f38-1900-0000-cc93-2c375d090000 pid=2397->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=6d2f1d3f-1900-0000-cc93-2c3773090000 pid=2419 /usr/bin/bash guuid=a468073f-1900-0000-cc93-2c3772090000 pid=2418->guuid=6d2f1d3f-1900-0000-cc93-2c3773090000 pid=2419 clone guuid=cf11b93f-1900-0000-cc93-2c3778090000 pid=2424->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=ff4c6e42-1900-0000-cc93-2c377e090000 pid=2430->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=229a4d48-1900-0000-cc93-2c3791090000 pid=2449 /usr/bin/bash guuid=486b3848-1900-0000-cc93-2c3790090000 pid=2448->guuid=229a4d48-1900-0000-cc93-2c3791090000 pid=2449 clone guuid=5e11f248-1900-0000-cc93-2c3796090000 pid=2454->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=85259b4b-1900-0000-cc93-2c379b090000 pid=2459->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=1b559f53-1900-0000-cc93-2c37b2090000 pid=2482 /usr/bin/bash guuid=a7792b53-1900-0000-cc93-2c37b0090000 pid=2480->guuid=1b559f53-1900-0000-cc93-2c37b2090000 pid=2482 clone guuid=9a4c7555-1900-0000-cc93-2c37b8090000 pid=2488->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=a3c51158-1900-0000-cc93-2c37c1090000 pid=2497->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=f1caf25e-1900-0000-cc93-2c37db090000 pid=2523 /usr/bin/bash guuid=5dbddf5e-1900-0000-cc93-2c37da090000 pid=2522->guuid=f1caf25e-1900-0000-cc93-2c37db090000 pid=2523 clone guuid=ea66fb5f-1900-0000-cc93-2c37e2090000 pid=2530->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=4e2a2563-1900-0000-cc93-2c37ef090000 pid=2543->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=59b06a68-1900-0000-cc93-2c37070a0000 pid=2567 /usr/bin/bash guuid=94d15368-1900-0000-cc93-2c37060a0000 pid=2566->guuid=59b06a68-1900-0000-cc93-2c37070a0000 pid=2567 clone guuid=6ad42269-1900-0000-cc93-2c370c0a0000 pid=2572->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=b0618d6b-1900-0000-cc93-2c37140a0000 pid=2580->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=709e8671-1900-0000-cc93-2c372d0a0000 pid=2605 /usr/bin/bash guuid=adf56c71-1900-0000-cc93-2c372c0a0000 pid=2604->guuid=709e8671-1900-0000-cc93-2c372d0a0000 pid=2605 clone guuid=75038972-1900-0000-cc93-2c37320a0000 pid=2610->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=d6e2cf75-1900-0000-cc93-2c373f0a0000 pid=2623->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=cee4917a-1900-0000-cc93-2c37520a0000 pid=2642 /usr/bin/bash guuid=f143757a-1900-0000-cc93-2c37500a0000 pid=2640->guuid=cee4917a-1900-0000-cc93-2c37520a0000 pid=2642 clone guuid=37144e7b-1900-0000-cc93-2c37570a0000 pid=2647->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=acf0997e-1900-0000-cc93-2c375f0a0000 pid=2655->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=985f6783-1900-0000-cc93-2c37700a0000 pid=2672 /usr/bin/bash guuid=dfb13983-1900-0000-cc93-2c376f0a0000 pid=2671->guuid=985f6783-1900-0000-cc93-2c37700a0000 pid=2672 clone guuid=75ba4f84-1900-0000-cc93-2c37760a0000 pid=2678->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=ac07b087-1900-0000-cc93-2c377e0a0000 pid=2686->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=32b5838b-1900-0000-cc93-2c378a0a0000 pid=2698 /usr/bin/bash guuid=76ce638b-1900-0000-cc93-2c37880a0000 pid=2696->guuid=32b5838b-1900-0000-cc93-2c378a0a0000 pid=2698 clone guuid=4882468c-1900-0000-cc93-2c378f0a0000 pid=2703->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=c1ed378f-1900-0000-cc93-2c37980a0000 pid=2712->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=29ff7794-1900-0000-cc93-2c379d0a0000 pid=2717 /usr/bin/bash guuid=cc705994-1900-0000-cc93-2c379c0a0000 pid=2716->guuid=29ff7794-1900-0000-cc93-2c379d0a0000 pid=2717 clone guuid=4e5b4c95-1900-0000-cc93-2c37a20a0000 pid=2722->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=5b6e0098-1900-0000-cc93-2c37a70a0000 pid=2727->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=b473c09e-1900-0000-cc93-2c37b80a0000 pid=2744 /usr/bin/bash guuid=bf52a49e-1900-0000-cc93-2c37b70a0000 pid=2743->guuid=b473c09e-1900-0000-cc93-2c37b80a0000 pid=2744 clone
Score:
99%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/7986219bbfcd6e8a45027f7e6c424e7247b3e9f53033a5f8d2ba02697fcf8c47
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7986219bbfcd6e8a45027f7e6c424e7247b3e9f53033a5f8d2ba02697fcf8c47/
Threat name:
Linux.Downloader.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-08-26 09:00:34 UTC
File Type:
Text (Shell)
AV detection:
13 of 36 (36.11%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pgdcdg57zvxiuricp57gyqsoojd3h2pvgaz2l6gsxibgs76prrdq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260826-kyjhzace52/
Behaviour
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.11
Link:
https://yomi.yoroi.company/submissions/7986219bbfcd6e8a45027f7e6c424e7247b3e9f53033a5f8d2ba02697fcf8c47

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments