MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7c5f2639ecc065e20c9b2513ba99f30ddf80ef4cdaa1b3eb6116a5247a407e53. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7c5f2639ecc065e20c9b2513ba99f30ddf80ef4cdaa1b3eb6116a5247a407e53
SHA3-384 hash: 004d33a1dee3da2e84d164fb9b5cdede2909adfd686014296c781d42610fe9be0816668aafed019a4370a725de5f2e55
SHA1 hash: 226a277643fd6c19bd280da08cd39641c30415cd
MD5 hash: 8b6f27a2a29411741b559c06cdb86f99
humanhash: nebraska-london-three-triple
File name:p
Download: download sample
File size:839 bytes
First seen:2026-06-23 12:18:44 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 24:kXCKysE2hi0ziQvZohaiX508yaayjRZG7:e9Qp+MsC508yvGRY7
TLSH T1FD016FD9C2509A10513DDE5D329B51A0B452C3CE068B0F747FDD593DFB9C904B066F94
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://129.121.114.124/jkLn/an/an/a
http://129.121.114.124/Q24In/an/an/a
http://129.121.114.124/ErtBn/an/an/a
http://129.121.114.124/JtOn/an/an/a
http://129.121.114.124/pFdYn/an/an/a

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive
Link:
https://www.filescan.io/uploads/6a3a79d562d0679105fd14de/reports/e454350b-fbd0-444e-9771-58f13b76bbf0/overview
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/1261de69-67e5-483d-b024-fb5a4f501ea4
Behavior Graph:
Download SVG
%3 guuid=c2212b53-1900-0000-8fce-b23f34140000 pid=5172 /usr/bin/sudo guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173 /tmp/sample.bin write-file guuid=c2212b53-1900-0000-8fce-b23f34140000 pid=5172->guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173 execve guuid=d3bfb656-1900-0000-8fce-b23f36140000 pid=5174 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=d3bfb656-1900-0000-8fce-b23f36140000 pid=5174 execve guuid=bc8d3758-1900-0000-8fce-b23f37140000 pid=5175 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=bc8d3758-1900-0000-8fce-b23f37140000 pid=5175 execve guuid=17824d59-1900-0000-8fce-b23f38140000 pid=5176 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=17824d59-1900-0000-8fce-b23f38140000 pid=5176 execve guuid=7648cc59-1900-0000-8fce-b23f39140000 pid=5177 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=7648cc59-1900-0000-8fce-b23f39140000 pid=5177 execve guuid=716c465a-1900-0000-8fce-b23f3a140000 pid=5178 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=716c465a-1900-0000-8fce-b23f3a140000 pid=5178 execve guuid=7bbbd55a-1900-0000-8fce-b23f3b140000 pid=5179 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=7bbbd55a-1900-0000-8fce-b23f3b140000 pid=5179 execve guuid=1cf4645b-1900-0000-8fce-b23f3c140000 pid=5180 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=1cf4645b-1900-0000-8fce-b23f3c140000 pid=5180 execve guuid=0977f65b-1900-0000-8fce-b23f3d140000 pid=5181 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=0977f65b-1900-0000-8fce-b23f3d140000 pid=5181 execve guuid=130b835c-1900-0000-8fce-b23f3e140000 pid=5182 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=130b835c-1900-0000-8fce-b23f3e140000 pid=5182 execve guuid=c970315d-1900-0000-8fce-b23f3f140000 pid=5183 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=c970315d-1900-0000-8fce-b23f3f140000 pid=5183 execve guuid=1ab6c75d-1900-0000-8fce-b23f40140000 pid=5184 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=1ab6c75d-1900-0000-8fce-b23f40140000 pid=5184 execve guuid=d4fc5a5e-1900-0000-8fce-b23f41140000 pid=5185 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=d4fc5a5e-1900-0000-8fce-b23f41140000 pid=5185 execve guuid=7e56f65e-1900-0000-8fce-b23f42140000 pid=5186 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=7e56f65e-1900-0000-8fce-b23f42140000 pid=5186 execve guuid=bca37d5f-1900-0000-8fce-b23f43140000 pid=5187 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=bca37d5f-1900-0000-8fce-b23f43140000 pid=5187 execve guuid=e0640a60-1900-0000-8fce-b23f44140000 pid=5188 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=e0640a60-1900-0000-8fce-b23f44140000 pid=5188 execve guuid=d6138e60-1900-0000-8fce-b23f45140000 pid=5189 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=d6138e60-1900-0000-8fce-b23f45140000 pid=5189 execve guuid=5b572461-1900-0000-8fce-b23f46140000 pid=5190 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=5b572461-1900-0000-8fce-b23f46140000 pid=5190 execve guuid=d829e961-1900-0000-8fce-b23f47140000 pid=5191 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=d829e961-1900-0000-8fce-b23f47140000 pid=5191 execve guuid=5b4e7f62-1900-0000-8fce-b23f48140000 pid=5192 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=5b4e7f62-1900-0000-8fce-b23f48140000 pid=5192 execve guuid=2f271e63-1900-0000-8fce-b23f49140000 pid=5193 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=2f271e63-1900-0000-8fce-b23f49140000 pid=5193 execve guuid=47b4b063-1900-0000-8fce-b23f4a140000 pid=5194 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=47b4b063-1900-0000-8fce-b23f4a140000 pid=5194 execve guuid=60f34a64-1900-0000-8fce-b23f4b140000 pid=5195 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=60f34a64-1900-0000-8fce-b23f4b140000 pid=5195 execve guuid=b6845a65-1900-0000-8fce-b23f4c140000 pid=5196 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=b6845a65-1900-0000-8fce-b23f4c140000 pid=5196 execve guuid=56a84666-1900-0000-8fce-b23f4d140000 pid=5197 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=56a84666-1900-0000-8fce-b23f4d140000 pid=5197 execve guuid=ec6ded66-1900-0000-8fce-b23f4e140000 pid=5198 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=ec6ded66-1900-0000-8fce-b23f4e140000 pid=5198 execve guuid=b0858967-1900-0000-8fce-b23f4f140000 pid=5199 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=b0858967-1900-0000-8fce-b23f4f140000 pid=5199 execve guuid=da5c4068-1900-0000-8fce-b23f50140000 pid=5200 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=da5c4068-1900-0000-8fce-b23f50140000 pid=5200 execve guuid=e95adb68-1900-0000-8fce-b23f51140000 pid=5201 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=e95adb68-1900-0000-8fce-b23f51140000 pid=5201 execve guuid=9be67869-1900-0000-8fce-b23f52140000 pid=5202 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=9be67869-1900-0000-8fce-b23f52140000 pid=5202 execve guuid=f58e036a-1900-0000-8fce-b23f53140000 pid=5203 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=f58e036a-1900-0000-8fce-b23f53140000 pid=5203 execve guuid=ff65126b-1900-0000-8fce-b23f54140000 pid=5204 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=ff65126b-1900-0000-8fce-b23f54140000 pid=5204 execve guuid=9256da6b-1900-0000-8fce-b23f55140000 pid=5205 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=9256da6b-1900-0000-8fce-b23f55140000 pid=5205 execve guuid=522f7f6c-1900-0000-8fce-b23f56140000 pid=5206 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=522f7f6c-1900-0000-8fce-b23f56140000 pid=5206 execve guuid=3354236d-1900-0000-8fce-b23f57140000 pid=5207 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=3354236d-1900-0000-8fce-b23f57140000 pid=5207 execve guuid=3c7dd36d-1900-0000-8fce-b23f58140000 pid=5208 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=3c7dd36d-1900-0000-8fce-b23f58140000 pid=5208 execve guuid=4f6d6c6e-1900-0000-8fce-b23f59140000 pid=5209 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=4f6d6c6e-1900-0000-8fce-b23f59140000 pid=5209 execve guuid=3c41046f-1900-0000-8fce-b23f5a140000 pid=5210 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=3c41046f-1900-0000-8fce-b23f5a140000 pid=5210 execve guuid=03a60470-1900-0000-8fce-b23f5b140000 pid=5211 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=03a60470-1900-0000-8fce-b23f5b140000 pid=5211 execve guuid=e6d90771-1900-0000-8fce-b23f5c140000 pid=5212 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=e6d90771-1900-0000-8fce-b23f5c140000 pid=5212 execve guuid=1e1dd971-1900-0000-8fce-b23f5d140000 pid=5213 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=1e1dd971-1900-0000-8fce-b23f5d140000 pid=5213 execve guuid=9f2e8772-1900-0000-8fce-b23f5e140000 pid=5214 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=9f2e8772-1900-0000-8fce-b23f5e140000 pid=5214 execve guuid=425b0774-1900-0000-8fce-b23f5f140000 pid=5215 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=425b0774-1900-0000-8fce-b23f5f140000 pid=5215 execve guuid=b447a674-1900-0000-8fce-b23f60140000 pid=5216 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=b447a674-1900-0000-8fce-b23f60140000 pid=5216 execve guuid=9a2a3f75-1900-0000-8fce-b23f61140000 pid=5217 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=9a2a3f75-1900-0000-8fce-b23f61140000 pid=5217 execve guuid=3a3cdb77-1900-0000-8fce-b23f62140000 pid=5218 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=3a3cdb77-1900-0000-8fce-b23f62140000 pid=5218 execve guuid=68516978-1900-0000-8fce-b23f63140000 pid=5219 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=68516978-1900-0000-8fce-b23f63140000 pid=5219 execve guuid=a406e978-1900-0000-8fce-b23f64140000 pid=5220 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=a406e978-1900-0000-8fce-b23f64140000 pid=5220 execve guuid=a9fb8179-1900-0000-8fce-b23f65140000 pid=5221 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=a9fb8179-1900-0000-8fce-b23f65140000 pid=5221 execve guuid=2f62167a-1900-0000-8fce-b23f66140000 pid=5222 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=2f62167a-1900-0000-8fce-b23f66140000 pid=5222 execve guuid=57ac907a-1900-0000-8fce-b23f67140000 pid=5223 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=57ac907a-1900-0000-8fce-b23f67140000 pid=5223 execve guuid=7a86107b-1900-0000-8fce-b23f68140000 pid=5224 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=7a86107b-1900-0000-8fce-b23f68140000 pid=5224 execve guuid=9545a97b-1900-0000-8fce-b23f69140000 pid=5225 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=9545a97b-1900-0000-8fce-b23f69140000 pid=5225 execve guuid=e232567c-1900-0000-8fce-b23f6a140000 pid=5226 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=e232567c-1900-0000-8fce-b23f6a140000 pid=5226 execve guuid=055dfa7c-1900-0000-8fce-b23f6b140000 pid=5227 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=055dfa7c-1900-0000-8fce-b23f6b140000 pid=5227 execve guuid=cd539f7d-1900-0000-8fce-b23f6c140000 pid=5228 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=cd539f7d-1900-0000-8fce-b23f6c140000 pid=5228 execve guuid=2ffe477e-1900-0000-8fce-b23f6d140000 pid=5229 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=2ffe477e-1900-0000-8fce-b23f6d140000 pid=5229 execve guuid=e076a87f-1900-0000-8fce-b23f6e140000 pid=5230 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=e076a87f-1900-0000-8fce-b23f6e140000 pid=5230 execve guuid=18ef4380-1900-0000-8fce-b23f6f140000 pid=5231 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=18ef4380-1900-0000-8fce-b23f6f140000 pid=5231 execve guuid=191fd380-1900-0000-8fce-b23f70140000 pid=5232 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=191fd380-1900-0000-8fce-b23f70140000 pid=5232 execve guuid=7e195a81-1900-0000-8fce-b23f71140000 pid=5233 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=7e195a81-1900-0000-8fce-b23f71140000 pid=5233 execve guuid=f081e781-1900-0000-8fce-b23f72140000 pid=5234 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=f081e781-1900-0000-8fce-b23f72140000 pid=5234 execve guuid=444f7d82-1900-0000-8fce-b23f73140000 pid=5235 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=444f7d82-1900-0000-8fce-b23f73140000 pid=5235 execve guuid=a4e51283-1900-0000-8fce-b23f74140000 pid=5236 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=a4e51283-1900-0000-8fce-b23f74140000 pid=5236 execve guuid=651d3184-1900-0000-8fce-b23f75140000 pid=5237 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=651d3184-1900-0000-8fce-b23f75140000 pid=5237 execve guuid=565fc884-1900-0000-8fce-b23f76140000 pid=5238 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=565fc884-1900-0000-8fce-b23f76140000 pid=5238 execve guuid=64a57285-1900-0000-8fce-b23f77140000 pid=5239 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=64a57285-1900-0000-8fce-b23f77140000 pid=5239 execve guuid=26910e86-1900-0000-8fce-b23f78140000 pid=5240 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=26910e86-1900-0000-8fce-b23f78140000 pid=5240 execve guuid=c7e5b186-1900-0000-8fce-b23f79140000 pid=5241 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=c7e5b186-1900-0000-8fce-b23f79140000 pid=5241 execve guuid=4be14687-1900-0000-8fce-b23f7a140000 pid=5242 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=4be14687-1900-0000-8fce-b23f7a140000 pid=5242 execve guuid=df78e687-1900-0000-8fce-b23f7b140000 pid=5243 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=df78e687-1900-0000-8fce-b23f7b140000 pid=5243 execve guuid=8d229e88-1900-0000-8fce-b23f7c140000 pid=5244 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=8d229e88-1900-0000-8fce-b23f7c140000 pid=5244 execve guuid=2e463189-1900-0000-8fce-b23f7d140000 pid=5245 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=2e463189-1900-0000-8fce-b23f7d140000 pid=5245 execve guuid=394e998a-1900-0000-8fce-b23f7e140000 pid=5246 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=394e998a-1900-0000-8fce-b23f7e140000 pid=5246 execve guuid=d093128b-1900-0000-8fce-b23f7f140000 pid=5247 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=d093128b-1900-0000-8fce-b23f7f140000 pid=5247 execve guuid=73a97c8b-1900-0000-8fce-b23f80140000 pid=5248 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=73a97c8b-1900-0000-8fce-b23f80140000 pid=5248 execve guuid=894a0a8c-1900-0000-8fce-b23f81140000 pid=5249 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=894a0a8c-1900-0000-8fce-b23f81140000 pid=5249 execve guuid=38869b8c-1900-0000-8fce-b23f82140000 pid=5250 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=38869b8c-1900-0000-8fce-b23f82140000 pid=5250 execve guuid=ae35528d-1900-0000-8fce-b23f83140000 pid=5251 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=ae35528d-1900-0000-8fce-b23f83140000 pid=5251 execve guuid=1be6078e-1900-0000-8fce-b23f84140000 pid=5252 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=1be6078e-1900-0000-8fce-b23f84140000 pid=5252 execve guuid=af2f1f8f-1900-0000-8fce-b23f85140000 pid=5253 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=af2f1f8f-1900-0000-8fce-b23f85140000 pid=5253 execve guuid=ec2abc8f-1900-0000-8fce-b23f86140000 pid=5254 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=ec2abc8f-1900-0000-8fce-b23f86140000 pid=5254 execve guuid=d0015490-1900-0000-8fce-b23f87140000 pid=5255 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=d0015490-1900-0000-8fce-b23f87140000 pid=5255 execve guuid=31b7ef90-1900-0000-8fce-b23f88140000 pid=5256 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=31b7ef90-1900-0000-8fce-b23f88140000 pid=5256 execve guuid=50878291-1900-0000-8fce-b23f89140000 pid=5257 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=50878291-1900-0000-8fce-b23f89140000 pid=5257 execve guuid=22de1a92-1900-0000-8fce-b23f8a140000 pid=5258 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=22de1a92-1900-0000-8fce-b23f8a140000 pid=5258 execve guuid=a510ad92-1900-0000-8fce-b23f8b140000 pid=5259 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=a510ad92-1900-0000-8fce-b23f8b140000 pid=5259 execve guuid=607d1793-1900-0000-8fce-b23f8c140000 pid=5260 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=607d1793-1900-0000-8fce-b23f8c140000 pid=5260 execve guuid=f2377a93-1900-0000-8fce-b23f8d140000 pid=5261 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=f2377a93-1900-0000-8fce-b23f8d140000 pid=5261 execve guuid=ebb84394-1900-0000-8fce-b23f8e140000 pid=5262 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=ebb84394-1900-0000-8fce-b23f8e140000 pid=5262 execve guuid=69f44e95-1900-0000-8fce-b23f8f140000 pid=5263 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=69f44e95-1900-0000-8fce-b23f8f140000 pid=5263 execve guuid=d99dfa95-1900-0000-8fce-b23f90140000 pid=5264 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=d99dfa95-1900-0000-8fce-b23f90140000 pid=5264 execve guuid=0315ab96-1900-0000-8fce-b23f91140000 pid=5265 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=0315ab96-1900-0000-8fce-b23f91140000 pid=5265 execve guuid=5fa73c97-1900-0000-8fce-b23f92140000 pid=5266 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=5fa73c97-1900-0000-8fce-b23f92140000 pid=5266 execve guuid=daccd097-1900-0000-8fce-b23f93140000 pid=5267 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=daccd097-1900-0000-8fce-b23f93140000 pid=5267 execve guuid=44e06c98-1900-0000-8fce-b23f94140000 pid=5268 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=44e06c98-1900-0000-8fce-b23f94140000 pid=5268 execve guuid=0e236399-1900-0000-8fce-b23f95140000 pid=5269 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=0e236399-1900-0000-8fce-b23f95140000 pid=5269 execve guuid=075a6c9a-1900-0000-8fce-b23f96140000 pid=5270 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=075a6c9a-1900-0000-8fce-b23f96140000 pid=5270 execve guuid=6f43039b-1900-0000-8fce-b23f97140000 pid=5271 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=6f43039b-1900-0000-8fce-b23f97140000 pid=5271 execve guuid=ea229e9b-1900-0000-8fce-b23f98140000 pid=5272 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=ea229e9b-1900-0000-8fce-b23f98140000 pid=5272 execve guuid=76232f9c-1900-0000-8fce-b23f99140000 pid=5273 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=76232f9c-1900-0000-8fce-b23f99140000 pid=5273 execve guuid=a4dec79c-1900-0000-8fce-b23f9a140000 pid=5274 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=a4dec79c-1900-0000-8fce-b23f9a140000 pid=5274 execve guuid=830e609d-1900-0000-8fce-b23f9b140000 pid=5275 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=830e609d-1900-0000-8fce-b23f9b140000 pid=5275 execve guuid=da7af99d-1900-0000-8fce-b23f9c140000 pid=5276 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=da7af99d-1900-0000-8fce-b23f9c140000 pid=5276 execve guuid=d9ff0e9f-1900-0000-8fce-b23f9d140000 pid=5277 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=d9ff0e9f-1900-0000-8fce-b23f9d140000 pid=5277 execve guuid=914aaa9f-1900-0000-8fce-b23f9e140000 pid=5278 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=914aaa9f-1900-0000-8fce-b23f9e140000 pid=5278 execve guuid=342545a0-1900-0000-8fce-b23f9f140000 pid=5279 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=342545a0-1900-0000-8fce-b23f9f140000 pid=5279 execve guuid=0dac34a1-1900-0000-8fce-b23fa0140000 pid=5280 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=0dac34a1-1900-0000-8fce-b23fa0140000 pid=5280 execve guuid=344e3ea3-1900-0000-8fce-b23fa1140000 pid=5281 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=344e3ea3-1900-0000-8fce-b23fa1140000 pid=5281 execve guuid=541119a6-1900-0000-8fce-b23fa2140000 pid=5282 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=541119a6-1900-0000-8fce-b23fa2140000 pid=5282 execve guuid=4fc0d5a8-1900-0000-8fce-b23fa3140000 pid=5283 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=4fc0d5a8-1900-0000-8fce-b23fa3140000 pid=5283 execve guuid=975105ad-1900-0000-8fce-b23fa4140000 pid=5284 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=975105ad-1900-0000-8fce-b23fa4140000 pid=5284 execve guuid=00c14dae-1900-0000-8fce-b23fa5140000 pid=5285 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=00c14dae-1900-0000-8fce-b23fa5140000 pid=5285 execve guuid=cf2547af-1900-0000-8fce-b23fa6140000 pid=5286 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=cf2547af-1900-0000-8fce-b23fa6140000 pid=5286 execve guuid=f26430b0-1900-0000-8fce-b23fa7140000 pid=5287 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=f26430b0-1900-0000-8fce-b23fa7140000 pid=5287 execve guuid=d57234b1-1900-0000-8fce-b23fa8140000 pid=5288 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=d57234b1-1900-0000-8fce-b23fa8140000 pid=5288 execve guuid=82b0d5b1-1900-0000-8fce-b23fa9140000 pid=5289 /usr/bin/ls guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=82b0d5b1-1900-0000-8fce-b23fa9140000 pid=5289 execve guuid=89f984b2-1900-0000-8fce-b23faa140000 pid=5290 /usr/bin/rm guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=89f984b2-1900-0000-8fce-b23faa140000 pid=5290 execve guuid=40186db3-1900-0000-8fce-b23fab140000 pid=5291 /usr/bin/wget net send-data write-file guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=40186db3-1900-0000-8fce-b23fab140000 pid=5291 execve guuid=acf2e7d2-1900-0000-8fce-b23fac140000 pid=5292 /usr/bin/chmod guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=acf2e7d2-1900-0000-8fce-b23fac140000 pid=5292 execve guuid=c88387d3-1900-0000-8fce-b23fad140000 pid=5293 /usr/bin/dash guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=c88387d3-1900-0000-8fce-b23fad140000 pid=5293 clone guuid=e1daa5d4-1900-0000-8fce-b23faf140000 pid=5295 /usr/bin/rm guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=e1daa5d4-1900-0000-8fce-b23faf140000 pid=5295 execve guuid=baece4d4-1900-0000-8fce-b23fb0140000 pid=5296 /usr/bin/wget net send-data write-file guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=baece4d4-1900-0000-8fce-b23fb0140000 pid=5296 execve guuid=89f537ee-1900-0000-8fce-b23fb1140000 pid=5297 /usr/bin/chmod guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=89f537ee-1900-0000-8fce-b23fb1140000 pid=5297 execve guuid=eef9caee-1900-0000-8fce-b23fb2140000 pid=5298 /usr/bin/dash guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=eef9caee-1900-0000-8fce-b23fb2140000 pid=5298 clone guuid=17d145f0-1900-0000-8fce-b23fb4140000 pid=5300 /usr/bin/rm guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=17d145f0-1900-0000-8fce-b23fb4140000 pid=5300 execve guuid=9fd8bcf0-1900-0000-8fce-b23fb5140000 pid=5301 /usr/bin/wget net send-data write-file guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=9fd8bcf0-1900-0000-8fce-b23fb5140000 pid=5301 execve guuid=04b90710-1a00-0000-8fce-b23fb6140000 pid=5302 /usr/bin/chmod guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=04b90710-1a00-0000-8fce-b23fb6140000 pid=5302 execve guuid=197f9210-1a00-0000-8fce-b23fb7140000 pid=5303 /usr/bin/dash guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=197f9210-1a00-0000-8fce-b23fb7140000 pid=5303 clone guuid=63a54411-1a00-0000-8fce-b23fb9140000 pid=5305 /usr/bin/rm guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=63a54411-1a00-0000-8fce-b23fb9140000 pid=5305 execve guuid=008dc911-1a00-0000-8fce-b23fba140000 pid=5306 /usr/bin/wget net send-data write-file guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=008dc911-1a00-0000-8fce-b23fba140000 pid=5306 execve guuid=d2ec4c32-1a00-0000-8fce-b23fbc140000 pid=5308 /usr/bin/chmod guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=d2ec4c32-1a00-0000-8fce-b23fbc140000 pid=5308 execve guuid=05c38832-1a00-0000-8fce-b23fbd140000 pid=5309 /usr/bin/dash guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=05c38832-1a00-0000-8fce-b23fbd140000 pid=5309 clone guuid=2ff40933-1a00-0000-8fce-b23fc1140000 pid=5313 /usr/bin/rm guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=2ff40933-1a00-0000-8fce-b23fc1140000 pid=5313 execve guuid=381b3b33-1a00-0000-8fce-b23fc2140000 pid=5314 /usr/bin/wget net send-data write-file guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=381b3b33-1a00-0000-8fce-b23fc2140000 pid=5314 execve guuid=f3c8b452-1a00-0000-8fce-b23fc7140000 pid=5319 /usr/bin/chmod guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=f3c8b452-1a00-0000-8fce-b23fc7140000 pid=5319 execve guuid=b0a43253-1a00-0000-8fce-b23fc8140000 pid=5320 /usr/bin/dash guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=b0a43253-1a00-0000-8fce-b23fc8140000 pid=5320 clone guuid=46166254-1a00-0000-8fce-b23fcc140000 pid=5324 /usr/bin/rm delete-file guuid=9a632756-1900-0000-8fce-b23f35140000 pid=5173->guuid=46166254-1a00-0000-8fce-b23fcc140000 pid=5324 execve 801186e6-5fe8-5959-a7b4-832d8d66e7aa 129.121.114.124:80 guuid=40186db3-1900-0000-8fce-b23fab140000 pid=5291->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 133B guuid=baece4d4-1900-0000-8fce-b23fb0140000 pid=5296->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 134B guuid=9fd8bcf0-1900-0000-8fce-b23fb5140000 pid=5301->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 134B guuid=008dc911-1a00-0000-8fce-b23fba140000 pid=5306->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 133B guuid=381b3b33-1a00-0000-8fce-b23fc2140000 pid=5314->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 134B
Score:
97%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/7c5f2639ecc065e20c9b2513ba99f30ddf80ef4cdaa1b3eb6116a5247a407e53
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7c5f2639ecc065e20c9b2513ba99f30ddf80ef4cdaa1b3eb6116a5247a407e53/
Verdict:
Malicious
Threat:
Family.MIRAI
Link:
https://tip.neiki.dev/file/7c5f2639ecc065e20c9b2513ba99f30ddf80ef4cdaa1b3eb6116a5247a407e53
Threat name:
Document-HTML.Downloader.Bash
Create hunting rule
Status:
Malicious
First seen:
2026-06-23 12:21:54 UTC
File Type:
Text (Shell)
AV detection:
10 of 36 (27.78%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=prpsmopmybs6ede3euj3vgptbxpyb32m3kq3h23bc2ssi6sapzjq._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
discovery linux
Link:
https://tria.ge/reports/260623-phgrnacx5l/
Behaviour
Reads runtime system information
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.29
Link:
https://yomi.yoroi.company/submissions/7c5f2639ecc065e20c9b2513ba99f30ddf80ef4cdaa1b3eb6116a5247a407e53

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 7c5f2639ecc065e20c9b2513ba99f30ddf80ef4cdaa1b3eb6116a5247a407e53

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3866369/
  
Delivery method
Distributed via web download

Comments