MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7aa95831b70b74e1c263b7d91bd718ab043e656da6e0ec0057df21a36e45824e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7aa95831b70b74e1c263b7d91bd718ab043e656da6e0ec0057df21a36e45824e
SHA3-384 hash: 696fdd4324c15a90393bb7dee5d473a49b1b4bab0d31deb6b655d390e26534f4cddd1ade6ed772233ba94024a91a61af
SHA1 hash: 7b2e3a27c09f4d53903a8ca4c88747fe703848e0
MD5 hash: b451890da03447b77f1b15cd17b49cbf
humanhash: moon-pizza-neptune-victor
File name:p
Download: download sample
File size:839 bytes
First seen:2026-07-17 06:30:11 UTC
Last seen:2026-07-18 03:43:37 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkapKCtXiWOCxhFmSCHKNjC0/0bs4CF0auD:kXCKysE2hi0ziQvZohaIHrEfnF/YL7
TLSH T17A01CECAD6604900406ADD5E22D791B0B871D3C7064B4F787F9DA43DFB9CE04B026F88
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://129.121.110.105/JHkPn/an/aua-wget
http://129.121.110.105/W8Hn/an/aua-wget
http://129.121.110.105/0KXsn/an/aua-wget
http://129.121.110.105/oNrIn/an/aua-wget
http://129.121.110.105/EpDn/an/aua-wget

Intelligence

File Origin
# of uploads :
3
# of downloads :
64
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive mirai
Link:
https://www.filescan.io/uploads/6a59cc262395465fe67cf17c/reports/8db92bcc-9d10-4915-a9e7-7da6c7d80538/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-07-17T04:11:00Z UTC
Last seen:
2026-07-17T05:09:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/7aa95831b70b74e1c263b7d91bd718ab043e656da6e0ec0057df21a36e45824e/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/057e1093-935e-4f8c-9ab8-cb1f371bd383
Behavior Graph:
Download SVG
%3 guuid=189e0486-1900-0000-85a1-6af62f140000 pid=5167 /usr/bin/sudo guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168 /tmp/sample.bin write-file guuid=189e0486-1900-0000-85a1-6af62f140000 pid=5167->guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168 execve guuid=4d1b4e88-1900-0000-85a1-6af631140000 pid=5169 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=4d1b4e88-1900-0000-85a1-6af631140000 pid=5169 execve guuid=5a076789-1900-0000-85a1-6af632140000 pid=5170 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=5a076789-1900-0000-85a1-6af632140000 pid=5170 execve guuid=821ddc89-1900-0000-85a1-6af633140000 pid=5171 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=821ddc89-1900-0000-85a1-6af633140000 pid=5171 execve guuid=10f5748a-1900-0000-85a1-6af634140000 pid=5172 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=10f5748a-1900-0000-85a1-6af634140000 pid=5172 execve guuid=424f2c8b-1900-0000-85a1-6af635140000 pid=5173 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=424f2c8b-1900-0000-85a1-6af635140000 pid=5173 execve guuid=b723de8b-1900-0000-85a1-6af636140000 pid=5174 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=b723de8b-1900-0000-85a1-6af636140000 pid=5174 execve guuid=b12fa28c-1900-0000-85a1-6af637140000 pid=5175 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=b12fa28c-1900-0000-85a1-6af637140000 pid=5175 execve guuid=d757308d-1900-0000-85a1-6af638140000 pid=5176 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=d757308d-1900-0000-85a1-6af638140000 pid=5176 execve guuid=187fd78d-1900-0000-85a1-6af639140000 pid=5177 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=187fd78d-1900-0000-85a1-6af639140000 pid=5177 execve guuid=93f67e8e-1900-0000-85a1-6af63a140000 pid=5178 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=93f67e8e-1900-0000-85a1-6af63a140000 pid=5178 execve guuid=be07fd8e-1900-0000-85a1-6af63b140000 pid=5179 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=be07fd8e-1900-0000-85a1-6af63b140000 pid=5179 execve guuid=25be768f-1900-0000-85a1-6af63c140000 pid=5180 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=25be768f-1900-0000-85a1-6af63c140000 pid=5180 execve guuid=51eae48f-1900-0000-85a1-6af63d140000 pid=5181 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=51eae48f-1900-0000-85a1-6af63d140000 pid=5181 execve guuid=455c5090-1900-0000-85a1-6af63e140000 pid=5182 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=455c5090-1900-0000-85a1-6af63e140000 pid=5182 execve guuid=049fba90-1900-0000-85a1-6af63f140000 pid=5183 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=049fba90-1900-0000-85a1-6af63f140000 pid=5183 execve guuid=26fa2491-1900-0000-85a1-6af640140000 pid=5184 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=26fa2491-1900-0000-85a1-6af640140000 pid=5184 execve guuid=924d8f91-1900-0000-85a1-6af641140000 pid=5185 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=924d8f91-1900-0000-85a1-6af641140000 pid=5185 execve guuid=178bf191-1900-0000-85a1-6af642140000 pid=5186 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=178bf191-1900-0000-85a1-6af642140000 pid=5186 execve guuid=a1485b92-1900-0000-85a1-6af643140000 pid=5187 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=a1485b92-1900-0000-85a1-6af643140000 pid=5187 execve guuid=04a5bb92-1900-0000-85a1-6af644140000 pid=5188 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=04a5bb92-1900-0000-85a1-6af644140000 pid=5188 execve guuid=7b152293-1900-0000-85a1-6af645140000 pid=5189 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=7b152293-1900-0000-85a1-6af645140000 pid=5189 execve guuid=5dec8d93-1900-0000-85a1-6af646140000 pid=5190 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=5dec8d93-1900-0000-85a1-6af646140000 pid=5190 execve guuid=b0f0f893-1900-0000-85a1-6af647140000 pid=5191 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=b0f0f893-1900-0000-85a1-6af647140000 pid=5191 execve guuid=d97f6194-1900-0000-85a1-6af648140000 pid=5192 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=d97f6194-1900-0000-85a1-6af648140000 pid=5192 execve guuid=ebd5c794-1900-0000-85a1-6af649140000 pid=5193 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=ebd5c794-1900-0000-85a1-6af649140000 pid=5193 execve guuid=96352a95-1900-0000-85a1-6af64a140000 pid=5194 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=96352a95-1900-0000-85a1-6af64a140000 pid=5194 execve guuid=fd449695-1900-0000-85a1-6af64b140000 pid=5195 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=fd449695-1900-0000-85a1-6af64b140000 pid=5195 execve guuid=aebafa95-1900-0000-85a1-6af64c140000 pid=5196 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=aebafa95-1900-0000-85a1-6af64c140000 pid=5196 execve guuid=2dfb5c96-1900-0000-85a1-6af64d140000 pid=5197 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=2dfb5c96-1900-0000-85a1-6af64d140000 pid=5197 execve guuid=b648c196-1900-0000-85a1-6af64e140000 pid=5198 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=b648c196-1900-0000-85a1-6af64e140000 pid=5198 execve guuid=570d2d97-1900-0000-85a1-6af64f140000 pid=5199 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=570d2d97-1900-0000-85a1-6af64f140000 pid=5199 execve guuid=4ec49a97-1900-0000-85a1-6af650140000 pid=5200 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=4ec49a97-1900-0000-85a1-6af650140000 pid=5200 execve guuid=0e18ff97-1900-0000-85a1-6af651140000 pid=5201 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=0e18ff97-1900-0000-85a1-6af651140000 pid=5201 execve guuid=cccb6498-1900-0000-85a1-6af652140000 pid=5202 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=cccb6498-1900-0000-85a1-6af652140000 pid=5202 execve guuid=ccad2899-1900-0000-85a1-6af653140000 pid=5203 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=ccad2899-1900-0000-85a1-6af653140000 pid=5203 execve guuid=04ed8e99-1900-0000-85a1-6af654140000 pid=5204 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=04ed8e99-1900-0000-85a1-6af654140000 pid=5204 execve guuid=a0c5f499-1900-0000-85a1-6af655140000 pid=5205 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=a0c5f499-1900-0000-85a1-6af655140000 pid=5205 execve guuid=b4ad9d9a-1900-0000-85a1-6af656140000 pid=5206 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=b4ad9d9a-1900-0000-85a1-6af656140000 pid=5206 execve guuid=cf83409b-1900-0000-85a1-6af657140000 pid=5207 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=cf83409b-1900-0000-85a1-6af657140000 pid=5207 execve guuid=4179c79b-1900-0000-85a1-6af658140000 pid=5208 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=4179c79b-1900-0000-85a1-6af658140000 pid=5208 execve guuid=a9d6779c-1900-0000-85a1-6af659140000 pid=5209 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=a9d6779c-1900-0000-85a1-6af659140000 pid=5209 execve guuid=51ec1a9d-1900-0000-85a1-6af65a140000 pid=5210 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=51ec1a9d-1900-0000-85a1-6af65a140000 pid=5210 execve guuid=bc1de99d-1900-0000-85a1-6af65b140000 pid=5211 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=bc1de99d-1900-0000-85a1-6af65b140000 pid=5211 execve guuid=33c9bd9e-1900-0000-85a1-6af65c140000 pid=5212 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=33c9bd9e-1900-0000-85a1-6af65c140000 pid=5212 execve guuid=30658b9f-1900-0000-85a1-6af65d140000 pid=5213 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=30658b9f-1900-0000-85a1-6af65d140000 pid=5213 execve guuid=5bf966a0-1900-0000-85a1-6af65e140000 pid=5214 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=5bf966a0-1900-0000-85a1-6af65e140000 pid=5214 execve guuid=c6be3aa1-1900-0000-85a1-6af65f140000 pid=5215 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=c6be3aa1-1900-0000-85a1-6af65f140000 pid=5215 execve guuid=98cc0ca2-1900-0000-85a1-6af660140000 pid=5216 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=98cc0ca2-1900-0000-85a1-6af660140000 pid=5216 execve guuid=bd81e2a2-1900-0000-85a1-6af661140000 pid=5217 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=bd81e2a2-1900-0000-85a1-6af661140000 pid=5217 execve guuid=5786a4a3-1900-0000-85a1-6af662140000 pid=5218 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=5786a4a3-1900-0000-85a1-6af662140000 pid=5218 execve guuid=0ea45ea4-1900-0000-85a1-6af663140000 pid=5219 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=0ea45ea4-1900-0000-85a1-6af663140000 pid=5219 execve guuid=8f1249a5-1900-0000-85a1-6af664140000 pid=5220 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=8f1249a5-1900-0000-85a1-6af664140000 pid=5220 execve guuid=7aa603a6-1900-0000-85a1-6af665140000 pid=5221 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=7aa603a6-1900-0000-85a1-6af665140000 pid=5221 execve guuid=a6f29aa6-1900-0000-85a1-6af666140000 pid=5222 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=a6f29aa6-1900-0000-85a1-6af666140000 pid=5222 execve guuid=57c622a7-1900-0000-85a1-6af667140000 pid=5223 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=57c622a7-1900-0000-85a1-6af667140000 pid=5223 execve guuid=fd2495a7-1900-0000-85a1-6af668140000 pid=5224 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=fd2495a7-1900-0000-85a1-6af668140000 pid=5224 execve guuid=91ef02a8-1900-0000-85a1-6af669140000 pid=5225 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=91ef02a8-1900-0000-85a1-6af669140000 pid=5225 execve guuid=bb8663a8-1900-0000-85a1-6af66a140000 pid=5226 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=bb8663a8-1900-0000-85a1-6af66a140000 pid=5226 execve guuid=fa4cc3a8-1900-0000-85a1-6af66b140000 pid=5227 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=fa4cc3a8-1900-0000-85a1-6af66b140000 pid=5227 execve guuid=11c321a9-1900-0000-85a1-6af66c140000 pid=5228 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=11c321a9-1900-0000-85a1-6af66c140000 pid=5228 execve guuid=b38492a9-1900-0000-85a1-6af66d140000 pid=5229 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=b38492a9-1900-0000-85a1-6af66d140000 pid=5229 execve guuid=c6ebffa9-1900-0000-85a1-6af66e140000 pid=5230 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=c6ebffa9-1900-0000-85a1-6af66e140000 pid=5230 execve guuid=da4871aa-1900-0000-85a1-6af66f140000 pid=5231 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=da4871aa-1900-0000-85a1-6af66f140000 pid=5231 execve guuid=4259d9aa-1900-0000-85a1-6af670140000 pid=5232 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=4259d9aa-1900-0000-85a1-6af670140000 pid=5232 execve guuid=5f9b3dab-1900-0000-85a1-6af671140000 pid=5233 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=5f9b3dab-1900-0000-85a1-6af671140000 pid=5233 execve guuid=8b61a3ab-1900-0000-85a1-6af672140000 pid=5234 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=8b61a3ab-1900-0000-85a1-6af672140000 pid=5234 execve guuid=4a5908ac-1900-0000-85a1-6af673140000 pid=5235 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=4a5908ac-1900-0000-85a1-6af673140000 pid=5235 execve guuid=ea566cac-1900-0000-85a1-6af674140000 pid=5236 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=ea566cac-1900-0000-85a1-6af674140000 pid=5236 execve guuid=7b8dd5ac-1900-0000-85a1-6af675140000 pid=5237 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=7b8dd5ac-1900-0000-85a1-6af675140000 pid=5237 execve guuid=106138ad-1900-0000-85a1-6af676140000 pid=5238 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=106138ad-1900-0000-85a1-6af676140000 pid=5238 execve guuid=04dca3ad-1900-0000-85a1-6af677140000 pid=5239 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=04dca3ad-1900-0000-85a1-6af677140000 pid=5239 execve guuid=62150fae-1900-0000-85a1-6af678140000 pid=5240 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=62150fae-1900-0000-85a1-6af678140000 pid=5240 execve guuid=06aa7eae-1900-0000-85a1-6af679140000 pid=5241 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=06aa7eae-1900-0000-85a1-6af679140000 pid=5241 execve guuid=8254f2ae-1900-0000-85a1-6af67a140000 pid=5242 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=8254f2ae-1900-0000-85a1-6af67a140000 pid=5242 execve guuid=9c0d63af-1900-0000-85a1-6af67b140000 pid=5243 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=9c0d63af-1900-0000-85a1-6af67b140000 pid=5243 execve guuid=43d6cfaf-1900-0000-85a1-6af67c140000 pid=5244 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=43d6cfaf-1900-0000-85a1-6af67c140000 pid=5244 execve guuid=f49147b0-1900-0000-85a1-6af67d140000 pid=5245 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=f49147b0-1900-0000-85a1-6af67d140000 pid=5245 execve guuid=0c16b5b0-1900-0000-85a1-6af67e140000 pid=5246 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=0c16b5b0-1900-0000-85a1-6af67e140000 pid=5246 execve guuid=3dc51eb1-1900-0000-85a1-6af67f140000 pid=5247 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=3dc51eb1-1900-0000-85a1-6af67f140000 pid=5247 execve guuid=6a5291b1-1900-0000-85a1-6af680140000 pid=5248 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=6a5291b1-1900-0000-85a1-6af680140000 pid=5248 execve guuid=3f61ffb1-1900-0000-85a1-6af681140000 pid=5249 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=3f61ffb1-1900-0000-85a1-6af681140000 pid=5249 execve guuid=8aed68b2-1900-0000-85a1-6af682140000 pid=5250 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=8aed68b2-1900-0000-85a1-6af682140000 pid=5250 execve guuid=5458d1b2-1900-0000-85a1-6af683140000 pid=5251 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=5458d1b2-1900-0000-85a1-6af683140000 pid=5251 execve guuid=51a63ab3-1900-0000-85a1-6af684140000 pid=5252 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=51a63ab3-1900-0000-85a1-6af684140000 pid=5252 execve guuid=46ba9eb3-1900-0000-85a1-6af685140000 pid=5253 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=46ba9eb3-1900-0000-85a1-6af685140000 pid=5253 execve guuid=d15702b4-1900-0000-85a1-6af686140000 pid=5254 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=d15702b4-1900-0000-85a1-6af686140000 pid=5254 execve guuid=5a1e6ab4-1900-0000-85a1-6af687140000 pid=5255 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=5a1e6ab4-1900-0000-85a1-6af687140000 pid=5255 execve guuid=cc3b35b5-1900-0000-85a1-6af688140000 pid=5256 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=cc3b35b5-1900-0000-85a1-6af688140000 pid=5256 execve guuid=d9baa2b5-1900-0000-85a1-6af689140000 pid=5257 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=d9baa2b5-1900-0000-85a1-6af689140000 pid=5257 execve guuid=25420fb6-1900-0000-85a1-6af68a140000 pid=5258 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=25420fb6-1900-0000-85a1-6af68a140000 pid=5258 execve guuid=4a3c7bb6-1900-0000-85a1-6af68b140000 pid=5259 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=4a3c7bb6-1900-0000-85a1-6af68b140000 pid=5259 execve guuid=197ce6b6-1900-0000-85a1-6af68c140000 pid=5260 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=197ce6b6-1900-0000-85a1-6af68c140000 pid=5260 execve guuid=776454b7-1900-0000-85a1-6af68d140000 pid=5261 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=776454b7-1900-0000-85a1-6af68d140000 pid=5261 execve guuid=cb1bc1b7-1900-0000-85a1-6af68e140000 pid=5262 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=cb1bc1b7-1900-0000-85a1-6af68e140000 pid=5262 execve guuid=d87d2db8-1900-0000-85a1-6af68f140000 pid=5263 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=d87d2db8-1900-0000-85a1-6af68f140000 pid=5263 execve guuid=529794b8-1900-0000-85a1-6af690140000 pid=5264 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=529794b8-1900-0000-85a1-6af690140000 pid=5264 execve guuid=a6c3feb8-1900-0000-85a1-6af691140000 pid=5265 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=a6c3feb8-1900-0000-85a1-6af691140000 pid=5265 execve guuid=625e70b9-1900-0000-85a1-6af692140000 pid=5266 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=625e70b9-1900-0000-85a1-6af692140000 pid=5266 execve guuid=55d2dab9-1900-0000-85a1-6af693140000 pid=5267 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=55d2dab9-1900-0000-85a1-6af693140000 pid=5267 execve guuid=eec747ba-1900-0000-85a1-6af694140000 pid=5268 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=eec747ba-1900-0000-85a1-6af694140000 pid=5268 execve guuid=caa9b0ba-1900-0000-85a1-6af695140000 pid=5269 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=caa9b0ba-1900-0000-85a1-6af695140000 pid=5269 execve guuid=39c924bb-1900-0000-85a1-6af696140000 pid=5270 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=39c924bb-1900-0000-85a1-6af696140000 pid=5270 execve guuid=08ad95bb-1900-0000-85a1-6af697140000 pid=5271 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=08ad95bb-1900-0000-85a1-6af697140000 pid=5271 execve guuid=cdc2febb-1900-0000-85a1-6af698140000 pid=5272 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=cdc2febb-1900-0000-85a1-6af698140000 pid=5272 execve guuid=481e6ebc-1900-0000-85a1-6af699140000 pid=5273 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=481e6ebc-1900-0000-85a1-6af699140000 pid=5273 execve guuid=f78ee9bc-1900-0000-85a1-6af69a140000 pid=5274 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=f78ee9bc-1900-0000-85a1-6af69a140000 pid=5274 execve guuid=c4c55fbd-1900-0000-85a1-6af69b140000 pid=5275 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=c4c55fbd-1900-0000-85a1-6af69b140000 pid=5275 execve guuid=f08dd3bd-1900-0000-85a1-6af69c140000 pid=5276 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=f08dd3bd-1900-0000-85a1-6af69c140000 pid=5276 execve guuid=60b55abe-1900-0000-85a1-6af69d140000 pid=5277 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=60b55abe-1900-0000-85a1-6af69d140000 pid=5277 execve guuid=801ee2be-1900-0000-85a1-6af69e140000 pid=5278 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=801ee2be-1900-0000-85a1-6af69e140000 pid=5278 execve guuid=aab36abf-1900-0000-85a1-6af69f140000 pid=5279 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=aab36abf-1900-0000-85a1-6af69f140000 pid=5279 execve guuid=ec42e9bf-1900-0000-85a1-6af6a0140000 pid=5280 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=ec42e9bf-1900-0000-85a1-6af6a0140000 pid=5280 execve guuid=3c6160c0-1900-0000-85a1-6af6a1140000 pid=5281 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=3c6160c0-1900-0000-85a1-6af6a1140000 pid=5281 execve guuid=e757d7c0-1900-0000-85a1-6af6a2140000 pid=5282 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=e757d7c0-1900-0000-85a1-6af6a2140000 pid=5282 execve guuid=01634ec1-1900-0000-85a1-6af6a3140000 pid=5283 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=01634ec1-1900-0000-85a1-6af6a3140000 pid=5283 execve guuid=f0e3bdc1-1900-0000-85a1-6af6a4140000 pid=5284 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=f0e3bdc1-1900-0000-85a1-6af6a4140000 pid=5284 execve guuid=57682dc2-1900-0000-85a1-6af6a5140000 pid=5285 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=57682dc2-1900-0000-85a1-6af6a5140000 pid=5285 execve guuid=d7f236c3-1900-0000-85a1-6af6a6140000 pid=5286 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=d7f236c3-1900-0000-85a1-6af6a6140000 pid=5286 execve guuid=128bb5c3-1900-0000-85a1-6af6a7140000 pid=5287 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=128bb5c3-1900-0000-85a1-6af6a7140000 pid=5287 execve guuid=c2a928c4-1900-0000-85a1-6af6a8140000 pid=5288 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=c2a928c4-1900-0000-85a1-6af6a8140000 pid=5288 execve guuid=02dd97c4-1900-0000-85a1-6af6a9140000 pid=5289 /usr/bin/ls guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=02dd97c4-1900-0000-85a1-6af6a9140000 pid=5289 execve guuid=5f0306c5-1900-0000-85a1-6af6aa140000 pid=5290 /usr/bin/rm guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=5f0306c5-1900-0000-85a1-6af6aa140000 pid=5290 execve guuid=2fb54fc5-1900-0000-85a1-6af6ab140000 pid=5291 /usr/bin/wget net send-data write-file guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=2fb54fc5-1900-0000-85a1-6af6ab140000 pid=5291 execve guuid=867268cb-1900-0000-85a1-6af6ac140000 pid=5292 /usr/bin/chmod guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=867268cb-1900-0000-85a1-6af6ac140000 pid=5292 execve guuid=7aabaecb-1900-0000-85a1-6af6ad140000 pid=5293 /usr/bin/dash guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=7aabaecb-1900-0000-85a1-6af6ad140000 pid=5293 clone guuid=8b2897cd-1900-0000-85a1-6af6af140000 pid=5295 /usr/bin/rm guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=8b2897cd-1900-0000-85a1-6af6af140000 pid=5295 execve guuid=2504e0cd-1900-0000-85a1-6af6b0140000 pid=5296 /usr/bin/wget net send-data write-file guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=2504e0cd-1900-0000-85a1-6af6b0140000 pid=5296 execve guuid=c36237d2-1900-0000-85a1-6af6b1140000 pid=5297 /usr/bin/chmod guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=c36237d2-1900-0000-85a1-6af6b1140000 pid=5297 execve guuid=a1da88d2-1900-0000-85a1-6af6b2140000 pid=5298 /usr/bin/dash guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=a1da88d2-1900-0000-85a1-6af6b2140000 pid=5298 clone guuid=1fbd31d3-1900-0000-85a1-6af6b4140000 pid=5300 /usr/bin/rm guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=1fbd31d3-1900-0000-85a1-6af6b4140000 pid=5300 execve guuid=144fb5d3-1900-0000-85a1-6af6b5140000 pid=5301 /usr/bin/wget net send-data write-file guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=144fb5d3-1900-0000-85a1-6af6b5140000 pid=5301 execve guuid=fb4a11d8-1900-0000-85a1-6af6b6140000 pid=5302 /usr/bin/chmod guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=fb4a11d8-1900-0000-85a1-6af6b6140000 pid=5302 execve guuid=05f062d8-1900-0000-85a1-6af6b7140000 pid=5303 /usr/bin/dash guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=05f062d8-1900-0000-85a1-6af6b7140000 pid=5303 clone guuid=de9efad8-1900-0000-85a1-6af6b9140000 pid=5305 /usr/bin/rm guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=de9efad8-1900-0000-85a1-6af6b9140000 pid=5305 execve guuid=511146d9-1900-0000-85a1-6af6ba140000 pid=5306 /usr/bin/wget net send-data write-file guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=511146d9-1900-0000-85a1-6af6ba140000 pid=5306 execve guuid=963a7cdd-1900-0000-85a1-6af6bb140000 pid=5307 /usr/bin/chmod guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=963a7cdd-1900-0000-85a1-6af6bb140000 pid=5307 execve guuid=6379c6dd-1900-0000-85a1-6af6bc140000 pid=5308 /usr/bin/dash guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=6379c6dd-1900-0000-85a1-6af6bc140000 pid=5308 clone guuid=498c6bde-1900-0000-85a1-6af6be140000 pid=5310 /usr/bin/rm guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=498c6bde-1900-0000-85a1-6af6be140000 pid=5310 execve guuid=c929b7de-1900-0000-85a1-6af6bf140000 pid=5311 /usr/bin/wget net send-data write-file guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=c929b7de-1900-0000-85a1-6af6bf140000 pid=5311 execve guuid=1f4c40e3-1900-0000-85a1-6af6c0140000 pid=5312 /usr/bin/chmod guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=1f4c40e3-1900-0000-85a1-6af6c0140000 pid=5312 execve guuid=32458ee3-1900-0000-85a1-6af6c1140000 pid=5313 /usr/bin/dash guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=32458ee3-1900-0000-85a1-6af6c1140000 pid=5313 clone guuid=785432e4-1900-0000-85a1-6af6c3140000 pid=5315 /usr/bin/rm delete-file guuid=8d220788-1900-0000-85a1-6af630140000 pid=5168->guuid=785432e4-1900-0000-85a1-6af6c3140000 pid=5315 execve 0b1ba66e-2f8f-542f-9f7c-00dd01da057c 129.121.110.105:80 guuid=2fb54fc5-1900-0000-85a1-6af6ab140000 pid=5291->0b1ba66e-2f8f-542f-9f7c-00dd01da057c send: 134B guuid=2504e0cd-1900-0000-85a1-6af6b0140000 pid=5296->0b1ba66e-2f8f-542f-9f7c-00dd01da057c send: 133B guuid=144fb5d3-1900-0000-85a1-6af6b5140000 pid=5301->0b1ba66e-2f8f-542f-9f7c-00dd01da057c send: 134B guuid=511146d9-1900-0000-85a1-6af6ba140000 pid=5306->0b1ba66e-2f8f-542f-9f7c-00dd01da057c send: 134B guuid=c929b7de-1900-0000-85a1-6af6bf140000 pid=5311->0b1ba66e-2f8f-542f-9f7c-00dd01da057c send: 133B
Score:
98%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/7aa95831b70b74e1c263b7d91bd718ab043e656da6e0ec0057df21a36e45824e
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7aa95831b70b74e1c263b7d91bd718ab043e656da6e0ec0057df21a36e45824e/
Threat name:
Document-HTML.Browser.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2026-07-17 06:31:11 UTC
File Type:
Text (Shell)
AV detection:
8 of 36 (22.22%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=pkuvqmnxbn2odqtdw7mrxvyyvmcd4zlnu3qoyacx34q2g3sfqjha._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260717-g92l5scz7l/
Behaviour
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
Enumerates running processes
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.26
Link:
https://yomi.yoroi.company/submissions/7aa95831b70b74e1c263b7d91bd718ab043e656da6e0ec0057df21a36e45824e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 7aa95831b70b74e1c263b7d91bd718ab043e656da6e0ec0057df21a36e45824e

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3887342/
  
Delivery method
Distributed via web download

Comments