MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 79f4131147d3521eebd04c09c1e84d3bd1568982a217fbb8e162d1c958804fdf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 79f4131147d3521eebd04c09c1e84d3bd1568982a217fbb8e162d1c958804fdf
SHA3-384 hash: 1d8da4b11aac6a3fc4aaae9914fe9f1b37b4e55199dd21bbb28901255a2a127ad1cd0c26474b168f3a3002f2bf3d7c84
SHA1 hash: a6036cdb55a0d10d36b8e6881c8da0da6c79bcff
MD5 hash: 3abb2abbe588a8588afdb0212cbfd37f
humanhash: grey-carolina-lion-stairway
File name:skid.sh
Download: download sample
File size:1'144 bytes
First seen:2025-11-21 21:24:44 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 24:vlchflohuYJ3SmsYnL2FbWCJR205LcNIlT:vlchflohuK3S3YnLEb1JR205LHT
TLSH T1C92163CB11F6CD702CE2AF673279960934C8D0AB71EB5F58E8EC35E6448DE146480EA3
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://185.14.92.100/skid.mipsn/an/aelf ua-wget
http://185.14.92.100/skid.mpsln/an/aelf ua-wget
http://185.14.92.100/skid.x86n/an/aelf ua-wget
http://185.14.92.100/skid.ppcn/an/aelf ua-wget
http://185.14.92.100/skid.sparcn/an/aelf ua-wget
http://185.14.92.100/skid.arm4n/an/aelf ua-wget
http://185.14.92.100/skid.arm5n/an/aelf ua-wget
http://185.14.92.100/skid.arm6n/an/aelf ua-wget

Intelligence

File Origin
# of uploads :
1
# of downloads :
39
Origin country :
DE DE
Vendor Threat Intelligence
Detection(s):
Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-6.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive medusa mirai
Link:
https://www.filescan.io/uploads/6920d8c7eecb08e4aa440ee5/reports/6541c925-d946-4c4a-adf6-58168be86100/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2025-11-21T20:27:00Z UTC
Last seen:
2025-11-21T21:46:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/79f4131147d3521eebd04c09c1e84d3bd1568982a217fbb8e162d1c958804fdf/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/c1d67757-e6d7-4fc8-a8e4-83ab1102700b
Behavior Graph:
Download SVG
%3 guuid=ec57b3eb-1600-0000-6a1b-46deb40f0000 pid=4020 /usr/bin/sudo guuid=557b92ed-1600-0000-6a1b-46debd0f0000 pid=4029 /tmp/sample.bin guuid=ec57b3eb-1600-0000-6a1b-46deb40f0000 pid=4020->guuid=557b92ed-1600-0000-6a1b-46debd0f0000 pid=4029 execve guuid=c6f8e2ed-1600-0000-6a1b-46debe0f0000 pid=4030 /usr/bin/wget net send-data write-file guuid=557b92ed-1600-0000-6a1b-46debd0f0000 pid=4029->guuid=c6f8e2ed-1600-0000-6a1b-46debe0f0000 pid=4030 execve guuid=92e27bf2-1600-0000-6a1b-46decb0f0000 pid=4043 /usr/bin/chmod guuid=557b92ed-1600-0000-6a1b-46debd0f0000 pid=4029->guuid=92e27bf2-1600-0000-6a1b-46decb0f0000 pid=4043 execve guuid=bc7ebaf2-1600-0000-6a1b-46decc0f0000 pid=4044 /usr/bin/bash guuid=557b92ed-1600-0000-6a1b-46debd0f0000 pid=4029->guuid=bc7ebaf2-1600-0000-6a1b-46decc0f0000 pid=4044 clone guuid=17a358f3-1600-0000-6a1b-46dece0f0000 pid=4046 /usr/bin/rm delete-file guuid=557b92ed-1600-0000-6a1b-46debd0f0000 pid=4029->guuid=17a358f3-1600-0000-6a1b-46dece0f0000 pid=4046 execve guuid=c032a7f3-1600-0000-6a1b-46ded10f0000 pid=4049 /usr/bin/wget net send-data write-file guuid=557b92ed-1600-0000-6a1b-46debd0f0000 pid=4029->guuid=c032a7f3-1600-0000-6a1b-46ded10f0000 pid=4049 execve guuid=a48dcef6-1600-0000-6a1b-46dedf0f0000 pid=4063 /usr/bin/chmod guuid=557b92ed-1600-0000-6a1b-46debd0f0000 pid=4029->guuid=a48dcef6-1600-0000-6a1b-46dedf0f0000 pid=4063 execve guuid=6de72ef7-1600-0000-6a1b-46dee20f0000 pid=4066 /usr/bin/bash guuid=557b92ed-1600-0000-6a1b-46debd0f0000 pid=4029->guuid=6de72ef7-1600-0000-6a1b-46dee20f0000 pid=4066 clone guuid=bdfb9cf8-1600-0000-6a1b-46dee70f0000 pid=4071 /usr/bin/rm delete-file guuid=557b92ed-1600-0000-6a1b-46debd0f0000 pid=4029->guuid=bdfb9cf8-1600-0000-6a1b-46dee70f0000 pid=4071 execve guuid=e70aedf8-1600-0000-6a1b-46deea0f0000 pid=4074 /usr/bin/wget net send-data write-file guuid=557b92ed-1600-0000-6a1b-46debd0f0000 pid=4029->guuid=e70aedf8-1600-0000-6a1b-46deea0f0000 pid=4074 execve guuid=8345e6fb-1600-0000-6a1b-46def50f0000 pid=4085 /usr/bin/chmod guuid=557b92ed-1600-0000-6a1b-46debd0f0000 pid=4029->guuid=8345e6fb-1600-0000-6a1b-46def50f0000 pid=4085 execve guuid=f9dd2efc-1600-0000-6a1b-46def70f0000 pid=4087 /tmp/skid.x86 net guuid=557b92ed-1600-0000-6a1b-46debd0f0000 pid=4029->guuid=f9dd2efc-1600-0000-6a1b-46def70f0000 pid=4087 execve guuid=50a57efc-1600-0000-6a1b-46defb0f0000 pid=4091 /usr/bin/rm delete-file guuid=557b92ed-1600-0000-6a1b-46debd0f0000 pid=4029->guuid=50a57efc-1600-0000-6a1b-46defb0f0000 pid=4091 execve guuid=3b58d7fc-1600-0000-6a1b-46defc0f0000 pid=4092 /usr/bin/wget net send-data write-file guuid=557b92ed-1600-0000-6a1b-46debd0f0000 pid=4029->guuid=3b58d7fc-1600-0000-6a1b-46defc0f0000 pid=4092 execve guuid=0acfb4ff-1600-0000-6a1b-46de06100000 pid=4102 /usr/bin/chmod guuid=557b92ed-1600-0000-6a1b-46debd0f0000 pid=4029->guuid=0acfb4ff-1600-0000-6a1b-46de06100000 pid=4102 execve guuid=5ea91700-1700-0000-6a1b-46de08100000 pid=4104 /usr/bin/bash guuid=557b92ed-1600-0000-6a1b-46debd0f0000 pid=4029->guuid=5ea91700-1700-0000-6a1b-46de08100000 pid=4104 clone guuid=3ad18402-1700-0000-6a1b-46de11100000 pid=4113 /usr/bin/rm delete-file guuid=557b92ed-1600-0000-6a1b-46debd0f0000 pid=4029->guuid=3ad18402-1700-0000-6a1b-46de11100000 pid=4113 execve guuid=5fa4de02-1700-0000-6a1b-46de15100000 pid=4117 /usr/bin/wget net send-data write-file guuid=557b92ed-1600-0000-6a1b-46debd0f0000 pid=4029->guuid=5fa4de02-1700-0000-6a1b-46de15100000 pid=4117 execve guuid=e5b0e005-1700-0000-6a1b-46de1e100000 pid=4126 /usr/bin/chmod guuid=557b92ed-1600-0000-6a1b-46debd0f0000 pid=4029->guuid=e5b0e005-1700-0000-6a1b-46de1e100000 pid=4126 execve guuid=26933a06-1700-0000-6a1b-46de22100000 pid=4130 /usr/bin/bash guuid=557b92ed-1600-0000-6a1b-46debd0f0000 pid=4029->guuid=26933a06-1700-0000-6a1b-46de22100000 pid=4130 clone guuid=6a22e006-1700-0000-6a1b-46de27100000 pid=4135 /usr/bin/rm delete-file guuid=557b92ed-1600-0000-6a1b-46debd0f0000 pid=4029->guuid=6a22e006-1700-0000-6a1b-46de27100000 pid=4135 execve guuid=28ce2e07-1700-0000-6a1b-46de28100000 pid=4136 /usr/bin/wget net send-data write-file guuid=557b92ed-1600-0000-6a1b-46debd0f0000 pid=4029->guuid=28ce2e07-1700-0000-6a1b-46de28100000 pid=4136 execve guuid=42ff480a-1700-0000-6a1b-46de36100000 pid=4150 /usr/bin/chmod guuid=557b92ed-1600-0000-6a1b-46debd0f0000 pid=4029->guuid=42ff480a-1700-0000-6a1b-46de36100000 pid=4150 execve guuid=7735a60a-1700-0000-6a1b-46de3a100000 pid=4154 /usr/bin/bash guuid=557b92ed-1600-0000-6a1b-46debd0f0000 pid=4029->guuid=7735a60a-1700-0000-6a1b-46de3a100000 pid=4154 clone guuid=b1317c0c-1700-0000-6a1b-46de44100000 pid=4164 /usr/bin/rm delete-file guuid=557b92ed-1600-0000-6a1b-46debd0f0000 pid=4029->guuid=b1317c0c-1700-0000-6a1b-46de44100000 pid=4164 execve guuid=5126d60c-1700-0000-6a1b-46de45100000 pid=4165 /usr/bin/wget net send-data write-file guuid=557b92ed-1600-0000-6a1b-46debd0f0000 pid=4029->guuid=5126d60c-1700-0000-6a1b-46de45100000 pid=4165 execve guuid=2608e50f-1700-0000-6a1b-46de50100000 pid=4176 /usr/bin/chmod guuid=557b92ed-1600-0000-6a1b-46debd0f0000 pid=4029->guuid=2608e50f-1700-0000-6a1b-46de50100000 pid=4176 execve guuid=698c4d10-1700-0000-6a1b-46de53100000 pid=4179 /usr/bin/bash guuid=557b92ed-1600-0000-6a1b-46debd0f0000 pid=4029->guuid=698c4d10-1700-0000-6a1b-46de53100000 pid=4179 clone guuid=ebddf510-1700-0000-6a1b-46de57100000 pid=4183 /usr/bin/rm delete-file guuid=557b92ed-1600-0000-6a1b-46debd0f0000 pid=4029->guuid=ebddf510-1700-0000-6a1b-46de57100000 pid=4183 execve guuid=bd164411-1700-0000-6a1b-46de59100000 pid=4185 /usr/bin/wget net send-data write-file guuid=557b92ed-1600-0000-6a1b-46debd0f0000 pid=4029->guuid=bd164411-1700-0000-6a1b-46de59100000 pid=4185 execve guuid=37954a14-1700-0000-6a1b-46de61100000 pid=4193 /usr/bin/chmod guuid=557b92ed-1600-0000-6a1b-46debd0f0000 pid=4029->guuid=37954a14-1700-0000-6a1b-46de61100000 pid=4193 execve guuid=17239914-1700-0000-6a1b-46de64100000 pid=4196 /usr/bin/bash guuid=557b92ed-1600-0000-6a1b-46debd0f0000 pid=4029->guuid=17239914-1700-0000-6a1b-46de64100000 pid=4196 clone guuid=ea713e15-1700-0000-6a1b-46de6a100000 pid=4202 /usr/bin/rm delete-file guuid=557b92ed-1600-0000-6a1b-46debd0f0000 pid=4029->guuid=ea713e15-1700-0000-6a1b-46de6a100000 pid=4202 execve b1551a59-827b-5436-bbb4-a499073442b5 185.14.92.100:80 guuid=c6f8e2ed-1600-0000-6a1b-46debe0f0000 pid=4030->b1551a59-827b-5436-bbb4-a499073442b5 send: 137B guuid=c032a7f3-1600-0000-6a1b-46ded10f0000 pid=4049->b1551a59-827b-5436-bbb4-a499073442b5 send: 137B guuid=e70aedf8-1600-0000-6a1b-46deea0f0000 pid=4074->b1551a59-827b-5436-bbb4-a499073442b5 send: 136B b4bf20d4-f7c8-5c24-8830-c23364537aa4 8.8.4.4:53 guuid=f9dd2efc-1600-0000-6a1b-46def70f0000 pid=4087->b4bf20d4-f7c8-5c24-8830-c23364537aa4 con guuid=7c5667fc-1600-0000-6a1b-46def80f0000 pid=4088 /tmp/skid.x86 guuid=f9dd2efc-1600-0000-6a1b-46def70f0000 pid=4087->guuid=7c5667fc-1600-0000-6a1b-46def80f0000 pid=4088 clone guuid=47ab6ffc-1600-0000-6a1b-46def90f0000 pid=4089 /tmp/skid.x86 net send-data zombie guuid=7c5667fc-1600-0000-6a1b-46def80f0000 pid=4088->guuid=47ab6ffc-1600-0000-6a1b-46def90f0000 pid=4089 clone e225bfa4-8025-5ae8-9f60-b7ed9c2785a7 185.14.92.100:1111 guuid=47ab6ffc-1600-0000-6a1b-46def90f0000 pid=4089->e225bfa4-8025-5ae8-9f60-b7ed9c2785a7 send: 27B guuid=3b58d7fc-1600-0000-6a1b-46defc0f0000 pid=4092->b1551a59-827b-5436-bbb4-a499073442b5 send: 136B guuid=5fa4de02-1700-0000-6a1b-46de15100000 pid=4117->b1551a59-827b-5436-bbb4-a499073442b5 send: 138B guuid=28ce2e07-1700-0000-6a1b-46de28100000 pid=4136->b1551a59-827b-5436-bbb4-a499073442b5 send: 137B guuid=5126d60c-1700-0000-6a1b-46de45100000 pid=4165->b1551a59-827b-5436-bbb4-a499073442b5 send: 137B guuid=bd164411-1700-0000-6a1b-46de59100000 pid=4185->b1551a59-827b-5436-bbb4-a499073442b5 send: 137B
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/79f4131147d3521eebd04c09c1e84d3bd1568982a217fbb8e162d1c958804fdf
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/79f4131147d3521eebd04c09c1e84d3bd1568982a217fbb8e162d1c958804fdf/
Threat name:
Linux.Trojan.ShellLoader
Create hunting rule
Status:
Malicious
First seen:
2025-11-21 21:25:31 UTC
File Type:
Text (Shell)
AV detection:
17 of 24 (70.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ph2bgekh2njb526qjqe4d2cnhpivncmcuil7xohbmli4sweaj7pq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
defense_evasion discovery linux
Link:
https://tria.ge/reports/251121-z9tweavngy/
Behaviour
System Network Configuration Discovery
Writes file to tmp directory
Reads system network configuration
Reads system routing table
File and Directory Permissions Modification
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.42
Link:
https://yomi.yoroi.company/submissions/79f4131147d3521eebd04c09c1e84d3bd1568982a217fbb8e162d1c958804fdf

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts
Rule name:Linux_Shellscript_Downloader
Create hunting rule
Author:albertzsigovits
Description:Generic Approach to Shellscript downloaders

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 79f4131147d3521eebd04c09c1e84d3bd1568982a217fbb8e162d1c958804fdf

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3700480/
  
Delivery method
Distributed via web download

Comments