MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7ed7a1f09123fe8e0d776cfc7f31f7cbfe9afe26aa5ca19f124a6ccb15c97f52. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7ed7a1f09123fe8e0d776cfc7f31f7cbfe9afe26aa5ca19f124a6ccb15c97f52
SHA3-384 hash: 7c3c4f89b790f9daa3d8f65e4b2c50b9c65657775b3dd4b161a55bda09dc29a61491a97e6516c5ecd9949a3bb7577677
SHA1 hash: 978f8db54287e00db8ff0a381926d6fc94d0a91c
MD5 hash: c88bc22f9dd6afc2f4397dafec672ac2
humanhash: edward-neptune-lactose-autumn
File name:install.sh
Download: download sample
File size:69'241 bytes
First seen:2026-08-08 11:12:38 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 768:6OYwcTtmv50fiqfQO96/wtXPjUPDVcv4z/Ntrw1iqWgAVyUPVGTbf:9Yu0f3aDVcv4pqbf
TLSH T11E63A7B2B560C5703969C16C678B41503A49703B356C382874AFF42CBFDC658A1FABBE
TrID 41.1% (.SH) Linux/UNIX shell script (7000/1)
41.1% (.UCF) Xilinx User Constraints File (7000/1/3)
17.6% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh

Intelligence

File Origin
# of uploads :
1
# of downloads :
56
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
bash downloader evasive lolbin
Link:
https://www.filescan.io/uploads/6a770f5b1fbcbe6740851a92/reports/aa9479a0-933a-4b4f-8836-ed4403bd4c75/overview
Verdict:
Unknown
File Type:
unix shell
Link:
https://opentip.kaspersky.com/7ed7a1f09123fe8e0d776cfc7f31f7cbfe9afe26aa5ca19f124a6ccb15c97f52/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/99e22fd8-bed9-4392-90ac-fee3950f395e
Behavior Graph:
Download SVG
%3 guuid=4365cdd5-1600-0000-c5aa-42fe610c0000 pid=3169 /usr/bin/sudo guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173 /tmp/sample.bin write-config guuid=4365cdd5-1600-0000-c5aa-42fe610c0000 pid=3169->guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173 execve guuid=c9cf02d9-1600-0000-c5aa-42fe660c0000 pid=3174 /usr/bin/bash guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=c9cf02d9-1600-0000-c5aa-42fe660c0000 pid=3174 clone guuid=1e2beed9-1600-0000-c5aa-42fe680c0000 pid=3176 /usr/bin/basename guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=1e2beed9-1600-0000-c5aa-42fe680c0000 pid=3176 execve guuid=c45339da-1600-0000-c5aa-42fe690c0000 pid=3177 /usr/bin/id guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=c45339da-1600-0000-c5aa-42fe690c0000 pid=3177 execve guuid=68209adc-1600-0000-c5aa-42fe6f0c0000 pid=3183 /usr/bin/chattr guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=68209adc-1600-0000-c5aa-42fe6f0c0000 pid=3183 execve guuid=aea053dd-1600-0000-c5aa-42fe710c0000 pid=3185 /usr/bin/bash guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=aea053dd-1600-0000-c5aa-42fe710c0000 pid=3185 clone guuid=bd3d87e1-1600-0000-c5aa-42fe780c0000 pid=3192 /usr/bin/bash guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=bd3d87e1-1600-0000-c5aa-42fe780c0000 pid=3192 clone guuid=56d7d1e3-1600-0000-c5aa-42fe7f0c0000 pid=3199 /usr/bin/bash guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=56d7d1e3-1600-0000-c5aa-42fe7f0c0000 pid=3199 clone guuid=0d3f0be6-1600-0000-c5aa-42fe880c0000 pid=3208 /usr/bin/bash guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=0d3f0be6-1600-0000-c5aa-42fe880c0000 pid=3208 clone guuid=db2c86e8-1600-0000-c5aa-42fe930c0000 pid=3219 /usr/bin/bash guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=db2c86e8-1600-0000-c5aa-42fe930c0000 pid=3219 clone guuid=a3f34ded-1600-0000-c5aa-42fe950c0000 pid=3221 /usr/bin/bash guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=a3f34ded-1600-0000-c5aa-42fe950c0000 pid=3221 clone guuid=3eb291f0-1600-0000-c5aa-42fe970c0000 pid=3223 /usr/bin/bash guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=3eb291f0-1600-0000-c5aa-42fe970c0000 pid=3223 clone guuid=5ae54ff3-1600-0000-c5aa-42fe990c0000 pid=3225 /usr/bin/bash guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=5ae54ff3-1600-0000-c5aa-42fe990c0000 pid=3225 clone guuid=1229fcf5-1600-0000-c5aa-42fe9c0c0000 pid=3228 /usr/bin/bash guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=1229fcf5-1600-0000-c5aa-42fe9c0c0000 pid=3228 clone guuid=e8514cf8-1600-0000-c5aa-42fea20c0000 pid=3234 /usr/bin/bash guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=e8514cf8-1600-0000-c5aa-42fea20c0000 pid=3234 clone guuid=072c80fa-1600-0000-c5aa-42fea90c0000 pid=3241 /usr/bin/bash guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=072c80fa-1600-0000-c5aa-42fea90c0000 pid=3241 clone guuid=e5d9c8fc-1600-0000-c5aa-42feae0c0000 pid=3246 /usr/bin/bash guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=e5d9c8fc-1600-0000-c5aa-42feae0c0000 pid=3246 clone guuid=c0f501ff-1600-0000-c5aa-42feb50c0000 pid=3253 /usr/bin/bash guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=c0f501ff-1600-0000-c5aa-42feb50c0000 pid=3253 clone guuid=7fe75e01-1700-0000-c5aa-42febb0c0000 pid=3259 /usr/bin/bash guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=7fe75e01-1700-0000-c5aa-42febb0c0000 pid=3259 clone guuid=94b7b703-1700-0000-c5aa-42fec10c0000 pid=3265 /usr/bin/bash guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=94b7b703-1700-0000-c5aa-42fec10c0000 pid=3265 clone guuid=8ae51906-1700-0000-c5aa-42fec60c0000 pid=3270 /usr/bin/bash guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=8ae51906-1700-0000-c5aa-42fec60c0000 pid=3270 clone guuid=2eb51409-1700-0000-c5aa-42fed20c0000 pid=3282 /usr/bin/bash guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=2eb51409-1700-0000-c5aa-42fed20c0000 pid=3282 clone guuid=a13aa30b-1700-0000-c5aa-42fedb0c0000 pid=3291 /usr/bin/bash guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=a13aa30b-1700-0000-c5aa-42fedb0c0000 pid=3291 clone guuid=278d3b0f-1700-0000-c5aa-42fee70c0000 pid=3303 /usr/bin/bash guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=278d3b0f-1700-0000-c5aa-42fee70c0000 pid=3303 clone guuid=996a1813-1700-0000-c5aa-42fef10c0000 pid=3313 /usr/bin/bash guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=996a1813-1700-0000-c5aa-42fef10c0000 pid=3313 clone guuid=e62b8616-1700-0000-c5aa-42fefe0c0000 pid=3326 /usr/bin/bash guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=e62b8616-1700-0000-c5aa-42fefe0c0000 pid=3326 clone guuid=8d5fe219-1700-0000-c5aa-42fe0a0d0000 pid=3338 /usr/bin/bash guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=8d5fe219-1700-0000-c5aa-42fe0a0d0000 pid=3338 clone guuid=487b741d-1700-0000-c5aa-42fe150d0000 pid=3349 /usr/bin/bash guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=487b741d-1700-0000-c5aa-42fe150d0000 pid=3349 clone guuid=4fb62921-1700-0000-c5aa-42fe210d0000 pid=3361 /usr/bin/bash guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=4fb62921-1700-0000-c5aa-42fe210d0000 pid=3361 clone guuid=e98e2225-1700-0000-c5aa-42fe300d0000 pid=3376 /usr/bin/bash guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=e98e2225-1700-0000-c5aa-42fe300d0000 pid=3376 clone guuid=062b5129-1700-0000-c5aa-42fe3e0d0000 pid=3390 /usr/bin/bash guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=062b5129-1700-0000-c5aa-42fe3e0d0000 pid=3390 clone guuid=abc23e2d-1700-0000-c5aa-42fe4b0d0000 pid=3403 /usr/bin/bash guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=abc23e2d-1700-0000-c5aa-42fe4b0d0000 pid=3403 clone guuid=c667a730-1700-0000-c5aa-42fe560d0000 pid=3414 /usr/bin/bash guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=c667a730-1700-0000-c5aa-42fe560d0000 pid=3414 clone guuid=3c259535-1700-0000-c5aa-42fe660d0000 pid=3430 /usr/bin/bash guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=3c259535-1700-0000-c5aa-42fe660d0000 pid=3430 clone guuid=ccc0213a-1700-0000-c5aa-42fe680d0000 pid=3432 /usr/bin/bash guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=ccc0213a-1700-0000-c5aa-42fe680d0000 pid=3432 clone guuid=0f0eed3c-1700-0000-c5aa-42fe6d0d0000 pid=3437 /usr/bin/bash guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=0f0eed3c-1700-0000-c5aa-42fe6d0d0000 pid=3437 clone guuid=61a0783f-1700-0000-c5aa-42fe780d0000 pid=3448 /usr/bin/bash guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=61a0783f-1700-0000-c5aa-42fe780d0000 pid=3448 clone guuid=18145343-1700-0000-c5aa-42fe7c0d0000 pid=3452 /usr/bin/bash guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=18145343-1700-0000-c5aa-42fe7c0d0000 pid=3452 clone guuid=9945e145-1700-0000-c5aa-42fe7f0d0000 pid=3455 /usr/bin/bash guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=9945e145-1700-0000-c5aa-42fe7f0d0000 pid=3455 clone guuid=ff765848-1700-0000-c5aa-42fe840d0000 pid=3460 /usr/bin/bash guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=ff765848-1700-0000-c5aa-42fe840d0000 pid=3460 clone guuid=7dccd24a-1700-0000-c5aa-42fe890d0000 pid=3465 /usr/bin/bash guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=7dccd24a-1700-0000-c5aa-42fe890d0000 pid=3465 clone guuid=72a9594d-1700-0000-c5aa-42fe8f0d0000 pid=3471 /usr/bin/bash guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=72a9594d-1700-0000-c5aa-42fe8f0d0000 pid=3471 clone guuid=a5e73950-1700-0000-c5aa-42fe9c0d0000 pid=3484 /usr/bin/rm guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=a5e73950-1700-0000-c5aa-42fe9c0d0000 pid=3484 execve guuid=c65d7f50-1700-0000-c5aa-42fe9e0d0000 pid=3486 /usr/bin/chattr guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=c65d7f50-1700-0000-c5aa-42fe9e0d0000 pid=3486 execve guuid=07abd150-1700-0000-c5aa-42fe9f0d0000 pid=3487 /usr/bin/grep guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=07abd150-1700-0000-c5aa-42fe9f0d0000 pid=3487 execve guuid=ab152251-1700-0000-c5aa-42fea10d0000 pid=3489 /usr/bin/chattr guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=ab152251-1700-0000-c5aa-42fea10d0000 pid=3489 execve guuid=e18a6051-1700-0000-c5aa-42fea20d0000 pid=3490 /usr/bin/grep guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=e18a6051-1700-0000-c5aa-42fea20d0000 pid=3490 execve guuid=1944ab51-1700-0000-c5aa-42fea40d0000 pid=3492 /usr/bin/chattr guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=1944ab51-1700-0000-c5aa-42fea40d0000 pid=3492 execve guuid=990dea51-1700-0000-c5aa-42fea60d0000 pid=3494 /usr/bin/grep guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=990dea51-1700-0000-c5aa-42fea60d0000 pid=3494 execve guuid=b5943152-1700-0000-c5aa-42fea80d0000 pid=3496 /usr/bin/id guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=b5943152-1700-0000-c5aa-42fea80d0000 pid=3496 execve guuid=2d608152-1700-0000-c5aa-42feaa0d0000 pid=3498 /usr/bin/grep guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=2d608152-1700-0000-c5aa-42feaa0d0000 pid=3498 execve guuid=959acd52-1700-0000-c5aa-42fead0d0000 pid=3501 /usr/bin/grep guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=959acd52-1700-0000-c5aa-42fead0d0000 pid=3501 execve guuid=9a751653-1700-0000-c5aa-42feaf0d0000 pid=3503 /usr/bin/grep guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=9a751653-1700-0000-c5aa-42feaf0d0000 pid=3503 execve guuid=30b75f53-1700-0000-c5aa-42feb10d0000 pid=3505 /usr/bin/grep guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=30b75f53-1700-0000-c5aa-42feb10d0000 pid=3505 execve guuid=c09ba653-1700-0000-c5aa-42feb30d0000 pid=3507 /usr/bin/grep guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=c09ba653-1700-0000-c5aa-42feb30d0000 pid=3507 execve guuid=cef4f253-1700-0000-c5aa-42feb50d0000 pid=3509 /usr/bin/bash guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=cef4f253-1700-0000-c5aa-42feb50d0000 pid=3509 clone guuid=a58f6a56-1700-0000-c5aa-42febf0d0000 pid=3519 /usr/bin/bash guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=a58f6a56-1700-0000-c5aa-42febf0d0000 pid=3519 clone guuid=65cbbe5a-1700-0000-c5aa-42feca0d0000 pid=3530 /usr/bin/bash guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=65cbbe5a-1700-0000-c5aa-42feca0d0000 pid=3530 clone guuid=4294db5e-1700-0000-c5aa-42fed20d0000 pid=3538 /usr/bin/id guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=4294db5e-1700-0000-c5aa-42fed20d0000 pid=3538 execve guuid=0ea43c5f-1700-0000-c5aa-42fed30d0000 pid=3539 /usr/bin/grep guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=0ea43c5f-1700-0000-c5aa-42fed30d0000 pid=3539 execve guuid=5f862c6f-1700-0000-c5aa-42fed40d0000 pid=3540 /usr/bin/grep guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=5f862c6f-1700-0000-c5aa-42fed40d0000 pid=3540 execve guuid=329c0670-1700-0000-c5aa-42fed50d0000 pid=3541 /usr/bin/id guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=329c0670-1700-0000-c5aa-42fed50d0000 pid=3541 execve guuid=d7a55d71-1700-0000-c5aa-42fed80d0000 pid=3544 /usr/bin/grep guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=d7a55d71-1700-0000-c5aa-42fed80d0000 pid=3544 execve guuid=9e6f0172-1700-0000-c5aa-42fedb0d0000 pid=3547 /usr/bin/lsattr guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=9e6f0172-1700-0000-c5aa-42fedb0d0000 pid=3547 execve guuid=e3690a72-1700-0000-c5aa-42fedc0d0000 pid=3548 /usr/bin/grep guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=e3690a72-1700-0000-c5aa-42fedc0d0000 pid=3548 execve guuid=608c4b73-1700-0000-c5aa-42fedf0d0000 pid=3551 /usr/bin/bash guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=608c4b73-1700-0000-c5aa-42fedf0d0000 pid=3551 clone guuid=c1e45673-1700-0000-c5aa-42fee00d0000 pid=3552 /usr/bin/grep guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=c1e45673-1700-0000-c5aa-42fee00d0000 pid=3552 execve guuid=2b7bf373-1700-0000-c5aa-42fee30d0000 pid=3555 /usr/bin/bash guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=2b7bf373-1700-0000-c5aa-42fee30d0000 pid=3555 clone guuid=78e0fe73-1700-0000-c5aa-42fee40d0000 pid=3556 /usr/bin/grep guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=78e0fe73-1700-0000-c5aa-42fee40d0000 pid=3556 execve guuid=e19dc074-1700-0000-c5aa-42fee60d0000 pid=3558 /usr/bin/bash guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=e19dc074-1700-0000-c5aa-42fee60d0000 pid=3558 clone guuid=b45dc674-1700-0000-c5aa-42fee70d0000 pid=3559 /usr/bin/grep guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=b45dc674-1700-0000-c5aa-42fee70d0000 pid=3559 execve guuid=fbad8b75-1700-0000-c5aa-42feea0d0000 pid=3562 /usr/bin/bash guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=fbad8b75-1700-0000-c5aa-42feea0d0000 pid=3562 clone guuid=0df49475-1700-0000-c5aa-42feeb0d0000 pid=3563 /usr/bin/grep guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=0df49475-1700-0000-c5aa-42feeb0d0000 pid=3563 execve guuid=23442b76-1700-0000-c5aa-42feed0d0000 pid=3565 /usr/bin/bash guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=23442b76-1700-0000-c5aa-42feed0d0000 pid=3565 clone guuid=8ca83476-1700-0000-c5aa-42feee0d0000 pid=3566 /usr/bin/grep guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=8ca83476-1700-0000-c5aa-42feee0d0000 pid=3566 execve guuid=c79dd676-1700-0000-c5aa-42fef00d0000 pid=3568 /usr/bin/bash guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=c79dd676-1700-0000-c5aa-42fef00d0000 pid=3568 clone guuid=995ade76-1700-0000-c5aa-42fef10d0000 pid=3569 /usr/bin/grep guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=995ade76-1700-0000-c5aa-42fef10d0000 pid=3569 execve guuid=d7ba7c77-1700-0000-c5aa-42fef30d0000 pid=3571 /usr/bin/bash guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=d7ba7c77-1700-0000-c5aa-42fef30d0000 pid=3571 clone guuid=888d8577-1700-0000-c5aa-42fef40d0000 pid=3572 /usr/bin/grep guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=888d8577-1700-0000-c5aa-42fef40d0000 pid=3572 execve guuid=1e6b3178-1700-0000-c5aa-42fef60d0000 pid=3574 /usr/bin/bash guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=1e6b3178-1700-0000-c5aa-42fef60d0000 pid=3574 clone guuid=39443978-1700-0000-c5aa-42fef70d0000 pid=3575 /usr/bin/grep guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=39443978-1700-0000-c5aa-42fef70d0000 pid=3575 execve guuid=2ee0c678-1700-0000-c5aa-42fef90d0000 pid=3577 /usr/bin/bash guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=2ee0c678-1700-0000-c5aa-42fef90d0000 pid=3577 clone guuid=1df6d078-1700-0000-c5aa-42fefa0d0000 pid=3578 /usr/bin/grep guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=1df6d078-1700-0000-c5aa-42fefa0d0000 pid=3578 execve guuid=6e147c79-1700-0000-c5aa-42fefc0d0000 pid=3580 /usr/bin/bash guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=6e147c79-1700-0000-c5aa-42fefc0d0000 pid=3580 clone guuid=03138579-1700-0000-c5aa-42fefd0d0000 pid=3581 /usr/bin/grep guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=03138579-1700-0000-c5aa-42fefd0d0000 pid=3581 execve guuid=77e8247a-1700-0000-c5aa-42feff0d0000 pid=3583 /usr/bin/bash guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=77e8247a-1700-0000-c5aa-42feff0d0000 pid=3583 clone guuid=7d562e7a-1700-0000-c5aa-42fe000e0000 pid=3584 /usr/bin/grep guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=7d562e7a-1700-0000-c5aa-42fe000e0000 pid=3584 execve guuid=3d1ed07a-1700-0000-c5aa-42fe030e0000 pid=3587 /usr/bin/bash guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=3d1ed07a-1700-0000-c5aa-42fe030e0000 pid=3587 clone guuid=6d2fd77a-1700-0000-c5aa-42fe040e0000 pid=3588 /usr/bin/grep guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=6d2fd77a-1700-0000-c5aa-42fe040e0000 pid=3588 execve guuid=4077377b-1700-0000-c5aa-42fe050e0000 pid=3589 /usr/bin/bash guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=4077377b-1700-0000-c5aa-42fe050e0000 pid=3589 clone guuid=845f477b-1700-0000-c5aa-42fe070e0000 pid=3591 /usr/bin/grep guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=845f477b-1700-0000-c5aa-42fe070e0000 pid=3591 execve guuid=30259c7b-1700-0000-c5aa-42fe090e0000 pid=3593 /usr/bin/bash guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=30259c7b-1700-0000-c5aa-42fe090e0000 pid=3593 clone guuid=31eea17b-1700-0000-c5aa-42fe0a0e0000 pid=3594 /usr/bin/grep guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=31eea17b-1700-0000-c5aa-42fe0a0e0000 pid=3594 execve guuid=4e6d047c-1700-0000-c5aa-42fe0c0e0000 pid=3596 /usr/bin/bash guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=4e6d047c-1700-0000-c5aa-42fe0c0e0000 pid=3596 clone guuid=91160b7c-1700-0000-c5aa-42fe0e0e0000 pid=3598 /usr/bin/grep guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=91160b7c-1700-0000-c5aa-42fe0e0e0000 pid=3598 execve guuid=95de6a7c-1700-0000-c5aa-42fe100e0000 pid=3600 /usr/bin/bash guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=95de6a7c-1700-0000-c5aa-42fe100e0000 pid=3600 clone guuid=c5e2747c-1700-0000-c5aa-42fe110e0000 pid=3601 /usr/bin/grep guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=c5e2747c-1700-0000-c5aa-42fe110e0000 pid=3601 execve guuid=f800d57c-1700-0000-c5aa-42fe130e0000 pid=3603 /usr/bin/bash guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=f800d57c-1700-0000-c5aa-42fe130e0000 pid=3603 clone guuid=ae05dd7c-1700-0000-c5aa-42fe140e0000 pid=3604 /usr/bin/grep guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=ae05dd7c-1700-0000-c5aa-42fe140e0000 pid=3604 execve guuid=01c33d7d-1700-0000-c5aa-42fe160e0000 pid=3606 /usr/bin/bash guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=01c33d7d-1700-0000-c5aa-42fe160e0000 pid=3606 clone guuid=6f91447d-1700-0000-c5aa-42fe180e0000 pid=3608 /usr/bin/grep guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=6f91447d-1700-0000-c5aa-42fe180e0000 pid=3608 execve guuid=bbfd977d-1700-0000-c5aa-42fe1a0e0000 pid=3610 /usr/bin/bash guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=bbfd977d-1700-0000-c5aa-42fe1a0e0000 pid=3610 clone guuid=3a9aa17d-1700-0000-c5aa-42fe1b0e0000 pid=3611 /usr/bin/grep guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=3a9aa17d-1700-0000-c5aa-42fe1b0e0000 pid=3611 execve guuid=740f067e-1700-0000-c5aa-42fe1d0e0000 pid=3613 /usr/bin/bash guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=740f067e-1700-0000-c5aa-42fe1d0e0000 pid=3613 clone guuid=c0720d7e-1700-0000-c5aa-42fe1e0e0000 pid=3614 /usr/bin/grep guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=c0720d7e-1700-0000-c5aa-42fe1e0e0000 pid=3614 execve guuid=82fc797e-1700-0000-c5aa-42fe200e0000 pid=3616 /usr/bin/bash guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=82fc797e-1700-0000-c5aa-42fe200e0000 pid=3616 clone guuid=c892807e-1700-0000-c5aa-42fe210e0000 pid=3617 /usr/bin/grep guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=c892807e-1700-0000-c5aa-42fe210e0000 pid=3617 execve guuid=486ce57e-1700-0000-c5aa-42fe240e0000 pid=3620 /usr/bin/bash guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=486ce57e-1700-0000-c5aa-42fe240e0000 pid=3620 clone guuid=e975f07e-1700-0000-c5aa-42fe250e0000 pid=3621 /usr/bin/grep guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=e975f07e-1700-0000-c5aa-42fe250e0000 pid=3621 execve guuid=481d737f-1700-0000-c5aa-42fe270e0000 pid=3623 /usr/bin/cat write-config guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=481d737f-1700-0000-c5aa-42fe270e0000 pid=3623 execve guuid=f4f5c57f-1700-0000-c5aa-42fe290e0000 pid=3625 /usr/bin/bash guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=f4f5c57f-1700-0000-c5aa-42fe290e0000 pid=3625 clone guuid=cf936980-1700-0000-c5aa-42fe2c0e0000 pid=3628 /usr/bin/cp guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=cf936980-1700-0000-c5aa-42fe2c0e0000 pid=3628 execve guuid=caeafa80-1700-0000-c5aa-42fe2f0e0000 pid=3631 /usr/bin/chmod guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=caeafa80-1700-0000-c5aa-42fe2f0e0000 pid=3631 execve guuid=840f3e81-1700-0000-c5aa-42fe300e0000 pid=3632 /usr/bin/rm delete-file guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=840f3e81-1700-0000-c5aa-42fe300e0000 pid=3632 execve guuid=2fcf8481-1700-0000-c5aa-42fe320e0000 pid=3634 /usr/bin/grep guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=2fcf8481-1700-0000-c5aa-42fe320e0000 pid=3634 execve guuid=e4100a82-1700-0000-c5aa-42fe340e0000 pid=3636 /usr/bin/timeout guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=e4100a82-1700-0000-c5aa-42fe340e0000 pid=3636 execve guuid=54353284-1700-0000-c5aa-42fe3c0e0000 pid=3644 /usr/bin/id guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=54353284-1700-0000-c5aa-42fe3c0e0000 pid=3644 execve guuid=f88c8684-1700-0000-c5aa-42fe3f0e0000 pid=3647 /usr/bin/id guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=f88c8684-1700-0000-c5aa-42fe3f0e0000 pid=3647 execve guuid=643ddd84-1700-0000-c5aa-42fe410e0000 pid=3649 /usr/bin/kmod load-kernel-module guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=643ddd84-1700-0000-c5aa-42fe410e0000 pid=3649 execve guuid=37087a86-1700-0000-c5aa-42fe480e0000 pid=3656 /usr/bin/apt-cache write-file guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=37087a86-1700-0000-c5aa-42fe480e0000 pid=3656 execve guuid=8488bb5f-1800-0000-c5aa-42fe92100000 pid=4242 /usr/bin/apt-cache guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=8488bb5f-1800-0000-c5aa-42fe92100000 pid=4242 execve guuid=e6b11964-1800-0000-c5aa-42fea9100000 pid=4265 /usr/bin/timeout guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=e6b11964-1800-0000-c5aa-42fea9100000 pid=4265 execve guuid=6507e266-1800-0000-c5aa-42febb100000 pid=4283 /usr/bin/mkdir guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=6507e266-1800-0000-c5aa-42febb100000 pid=4283 execve guuid=e9e63d67-1800-0000-c5aa-42febd100000 pid=4285 /usr/bin/curl net guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=e9e63d67-1800-0000-c5aa-42febd100000 pid=4285 execve guuid=07cf88bd-1a00-0000-c5aa-42feae140000 pid=5294 /usr/bin/rm guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=07cf88bd-1a00-0000-c5aa-42feae140000 pid=5294 execve guuid=5f1cffbd-1a00-0000-c5aa-42feaf140000 pid=5295 /usr/bin/curl net guuid=a485d6d7-1600-0000-c5aa-42fe650c0000 pid=3173->guuid=5f1cffbd-1a00-0000-c5aa-42feaf140000 pid=5295 execve guuid=3ae951d9-1600-0000-c5aa-42fe670c0000 pid=3175 /usr/bin/dirname guuid=c9cf02d9-1600-0000-c5aa-42fe660c0000 pid=3174->guuid=3ae951d9-1600-0000-c5aa-42fe670c0000 pid=3175 execve guuid=993c72dd-1600-0000-c5aa-42fe720c0000 pid=3186 /usr/bin/pgrep guuid=aea053dd-1600-0000-c5aa-42fe710c0000 pid=3185->guuid=993c72dd-1600-0000-c5aa-42fe720c0000 pid=3186 execve guuid=f0a191e1-1600-0000-c5aa-42fe7a0c0000 pid=3194 /usr/bin/pgrep guuid=bd3d87e1-1600-0000-c5aa-42fe780c0000 pid=3192->guuid=f0a191e1-1600-0000-c5aa-42fe7a0c0000 pid=3194 execve guuid=5292dfe3-1600-0000-c5aa-42fe810c0000 pid=3201 /usr/bin/pgrep guuid=56d7d1e3-1600-0000-c5aa-42fe7f0c0000 pid=3199->guuid=5292dfe3-1600-0000-c5aa-42fe810c0000 pid=3201 execve guuid=5cd315e6-1600-0000-c5aa-42fe8a0c0000 pid=3210 /usr/bin/pgrep guuid=0d3f0be6-1600-0000-c5aa-42fe880c0000 pid=3208->guuid=5cd315e6-1600-0000-c5aa-42fe8a0c0000 pid=3210 execve guuid=c64192e8-1600-0000-c5aa-42fe940c0000 pid=3220 /usr/bin/pgrep guuid=db2c86e8-1600-0000-c5aa-42fe930c0000 pid=3219->guuid=c64192e8-1600-0000-c5aa-42fe940c0000 pid=3220 execve guuid=2ee666ed-1600-0000-c5aa-42fe960c0000 pid=3222 /usr/bin/pgrep guuid=a3f34ded-1600-0000-c5aa-42fe950c0000 pid=3221->guuid=2ee666ed-1600-0000-c5aa-42fe960c0000 pid=3222 execve guuid=f65fa0f0-1600-0000-c5aa-42fe980c0000 pid=3224 /usr/bin/pgrep guuid=3eb291f0-1600-0000-c5aa-42fe970c0000 pid=3223->guuid=f65fa0f0-1600-0000-c5aa-42fe980c0000 pid=3224 execve guuid=22fd5df3-1600-0000-c5aa-42fe9a0c0000 pid=3226 /usr/bin/pgrep guuid=5ae54ff3-1600-0000-c5aa-42fe990c0000 pid=3225->guuid=22fd5df3-1600-0000-c5aa-42fe9a0c0000 pid=3226 execve guuid=5e200af6-1600-0000-c5aa-42fe9d0c0000 pid=3229 /usr/bin/pgrep guuid=1229fcf5-1600-0000-c5aa-42fe9c0c0000 pid=3228->guuid=5e200af6-1600-0000-c5aa-42fe9d0c0000 pid=3229 execve guuid=85f555f8-1600-0000-c5aa-42fea30c0000 pid=3235 /usr/bin/pgrep guuid=e8514cf8-1600-0000-c5aa-42fea20c0000 pid=3234->guuid=85f555f8-1600-0000-c5aa-42fea30c0000 pid=3235 execve guuid=2f4a8efa-1600-0000-c5aa-42feaa0c0000 pid=3242 /usr/bin/pgrep guuid=072c80fa-1600-0000-c5aa-42fea90c0000 pid=3241->guuid=2f4a8efa-1600-0000-c5aa-42feaa0c0000 pid=3242 execve guuid=6289d4fc-1600-0000-c5aa-42feaf0c0000 pid=3247 /usr/bin/pgrep guuid=e5d9c8fc-1600-0000-c5aa-42feae0c0000 pid=3246->guuid=6289d4fc-1600-0000-c5aa-42feaf0c0000 pid=3247 execve guuid=d58a10ff-1600-0000-c5aa-42feb60c0000 pid=3254 /usr/bin/pgrep guuid=c0f501ff-1600-0000-c5aa-42feb50c0000 pid=3253->guuid=d58a10ff-1600-0000-c5aa-42feb60c0000 pid=3254 execve guuid=2b6c6a01-1700-0000-c5aa-42febc0c0000 pid=3260 /usr/bin/pgrep guuid=7fe75e01-1700-0000-c5aa-42febb0c0000 pid=3259->guuid=2b6c6a01-1700-0000-c5aa-42febc0c0000 pid=3260 execve guuid=9560c303-1700-0000-c5aa-42fec20c0000 pid=3266 /usr/bin/pgrep guuid=94b7b703-1700-0000-c5aa-42fec10c0000 pid=3265->guuid=9560c303-1700-0000-c5aa-42fec20c0000 pid=3266 execve guuid=80c22506-1700-0000-c5aa-42fec80c0000 pid=3272 /usr/bin/pgrep guuid=8ae51906-1700-0000-c5aa-42fec60c0000 pid=3270->guuid=80c22506-1700-0000-c5aa-42fec80c0000 pid=3272 execve guuid=9d1e2309-1700-0000-c5aa-42fed30c0000 pid=3283 /usr/bin/pgrep guuid=2eb51409-1700-0000-c5aa-42fed20c0000 pid=3282->guuid=9d1e2309-1700-0000-c5aa-42fed30c0000 pid=3283 execve guuid=ba1cb60b-1700-0000-c5aa-42fedd0c0000 pid=3293 /usr/bin/pgrep guuid=a13aa30b-1700-0000-c5aa-42fedb0c0000 pid=3291->guuid=ba1cb60b-1700-0000-c5aa-42fedd0c0000 pid=3293 execve guuid=2d73500f-1700-0000-c5aa-42fee80c0000 pid=3304 /usr/bin/pgrep guuid=278d3b0f-1700-0000-c5aa-42fee70c0000 pid=3303->guuid=2d73500f-1700-0000-c5aa-42fee80c0000 pid=3304 execve guuid=42e52913-1700-0000-c5aa-42fef30c0000 pid=3315 /usr/bin/pgrep guuid=996a1813-1700-0000-c5aa-42fef10c0000 pid=3313->guuid=42e52913-1700-0000-c5aa-42fef30c0000 pid=3315 execve guuid=ac629716-1700-0000-c5aa-42feff0c0000 pid=3327 /usr/bin/pgrep guuid=e62b8616-1700-0000-c5aa-42fefe0c0000 pid=3326->guuid=ac629716-1700-0000-c5aa-42feff0c0000 pid=3327 execve guuid=ea11f419-1700-0000-c5aa-42fe0b0d0000 pid=3339 /usr/bin/pgrep guuid=8d5fe219-1700-0000-c5aa-42fe0a0d0000 pid=3338->guuid=ea11f419-1700-0000-c5aa-42fe0b0d0000 pid=3339 execve guuid=c488881d-1700-0000-c5aa-42fe160d0000 pid=3350 /usr/bin/pgrep guuid=487b741d-1700-0000-c5aa-42fe150d0000 pid=3349->guuid=c488881d-1700-0000-c5aa-42fe160d0000 pid=3350 execve guuid=7f1e3f21-1700-0000-c5aa-42fe220d0000 pid=3362 /usr/bin/pgrep guuid=4fb62921-1700-0000-c5aa-42fe210d0000 pid=3361->guuid=7f1e3f21-1700-0000-c5aa-42fe220d0000 pid=3362 execve guuid=0d6d3425-1700-0000-c5aa-42fe310d0000 pid=3377 /usr/bin/pgrep guuid=e98e2225-1700-0000-c5aa-42fe300d0000 pid=3376->guuid=0d6d3425-1700-0000-c5aa-42fe310d0000 pid=3377 execve guuid=ac435e29-1700-0000-c5aa-42fe3f0d0000 pid=3391 /usr/bin/pgrep guuid=062b5129-1700-0000-c5aa-42fe3e0d0000 pid=3390->guuid=ac435e29-1700-0000-c5aa-42fe3f0d0000 pid=3391 execve guuid=f2f0522d-1700-0000-c5aa-42fe4c0d0000 pid=3404 /usr/bin/pgrep guuid=abc23e2d-1700-0000-c5aa-42fe4b0d0000 pid=3403->guuid=f2f0522d-1700-0000-c5aa-42fe4c0d0000 pid=3404 execve guuid=de0dba30-1700-0000-c5aa-42fe570d0000 pid=3415 /usr/bin/pgrep guuid=c667a730-1700-0000-c5aa-42fe560d0000 pid=3414->guuid=de0dba30-1700-0000-c5aa-42fe570d0000 pid=3415 execve guuid=6ad1d135-1700-0000-c5aa-42fe670d0000 pid=3431 /usr/bin/pgrep guuid=3c259535-1700-0000-c5aa-42fe660d0000 pid=3430->guuid=6ad1d135-1700-0000-c5aa-42fe670d0000 pid=3431 execve guuid=e4bf3b3a-1700-0000-c5aa-42fe690d0000 pid=3433 /usr/bin/pgrep guuid=ccc0213a-1700-0000-c5aa-42fe680d0000 pid=3432->guuid=e4bf3b3a-1700-0000-c5aa-42fe690d0000 pid=3433 execve guuid=1e38fc3c-1700-0000-c5aa-42fe6e0d0000 pid=3438 /usr/bin/pgrep guuid=0f0eed3c-1700-0000-c5aa-42fe6d0d0000 pid=3437->guuid=1e38fc3c-1700-0000-c5aa-42fe6e0d0000 pid=3438 execve guuid=26db843f-1700-0000-c5aa-42fe790d0000 pid=3449 /usr/bin/pgrep guuid=61a0783f-1700-0000-c5aa-42fe780d0000 pid=3448->guuid=26db843f-1700-0000-c5aa-42fe790d0000 pid=3449 execve guuid=e5266843-1700-0000-c5aa-42fe7d0d0000 pid=3453 /usr/bin/pgrep guuid=18145343-1700-0000-c5aa-42fe7c0d0000 pid=3452->guuid=e5266843-1700-0000-c5aa-42fe7d0d0000 pid=3453 execve guuid=22f9ed45-1700-0000-c5aa-42fe800d0000 pid=3456 /usr/bin/pgrep guuid=9945e145-1700-0000-c5aa-42fe7f0d0000 pid=3455->guuid=22f9ed45-1700-0000-c5aa-42fe800d0000 pid=3456 execve guuid=260a6348-1700-0000-c5aa-42fe850d0000 pid=3461 /usr/bin/pgrep guuid=ff765848-1700-0000-c5aa-42fe840d0000 pid=3460->guuid=260a6348-1700-0000-c5aa-42fe850d0000 pid=3461 execve guuid=f17ce24a-1700-0000-c5aa-42fe8a0d0000 pid=3466 /usr/bin/pgrep guuid=7dccd24a-1700-0000-c5aa-42fe890d0000 pid=3465->guuid=f17ce24a-1700-0000-c5aa-42fe8a0d0000 pid=3466 execve guuid=0fcc6a4d-1700-0000-c5aa-42fe900d0000 pid=3472 /usr/bin/pgrep guuid=72a9594d-1700-0000-c5aa-42fe8f0d0000 pid=3471->guuid=0fcc6a4d-1700-0000-c5aa-42fe900d0000 pid=3472 execve guuid=6f310454-1700-0000-c5aa-42feb70d0000 pid=3511 /usr/bin/pgrep guuid=cef4f253-1700-0000-c5aa-42feb50d0000 pid=3509->guuid=6f310454-1700-0000-c5aa-42feb70d0000 pid=3511 execve guuid=7a057556-1700-0000-c5aa-42fec10d0000 pid=3521 /usr/bin/pgrep guuid=a58f6a56-1700-0000-c5aa-42febf0d0000 pid=3519->guuid=7a057556-1700-0000-c5aa-42fec10d0000 pid=3521 execve guuid=d137d65a-1700-0000-c5aa-42fecb0d0000 pid=3531 /usr/bin/pgrep guuid=65cbbe5a-1700-0000-c5aa-42feca0d0000 pid=3530->guuid=d137d65a-1700-0000-c5aa-42fecb0d0000 pid=3531 execve guuid=b8beda7f-1700-0000-c5aa-42fe2a0e0000 pid=3626 /usr/bin/stat guuid=f4f5c57f-1700-0000-c5aa-42fe290e0000 pid=3625->guuid=b8beda7f-1700-0000-c5aa-42fe2a0e0000 pid=3626 execve guuid=39669f82-1700-0000-c5aa-42fe350e0000 pid=3637 /usr/bin/systemctl guuid=e4100a82-1700-0000-c5aa-42fe340e0000 pid=3636->guuid=39669f82-1700-0000-c5aa-42fe350e0000 pid=3637 execve guuid=10c57e88-1700-0000-c5aa-42fe540e0000 pid=3668 /usr/bin/dpkg guuid=37087a86-1700-0000-c5aa-42fe480e0000 pid=3656->guuid=10c57e88-1700-0000-c5aa-42fe540e0000 pid=3668 execve guuid=4a6cf488-1700-0000-c5aa-42fe580e0000 pid=3672 /usr/bin/dpkg guuid=37087a86-1700-0000-c5aa-42fe480e0000 pid=3656->guuid=4a6cf488-1700-0000-c5aa-42fe580e0000 pid=3672 execve guuid=8d49f98c-1700-0000-c5aa-42fe670e0000 pid=3687 /usr/bin/dpkg guuid=37087a86-1700-0000-c5aa-42fe480e0000 pid=3656->guuid=8d49f98c-1700-0000-c5aa-42fe670e0000 pid=3687 execve guuid=e7e595df-1700-0000-c5aa-42fe300f0000 pid=3888 /usr/bin/dpkg guuid=37087a86-1700-0000-c5aa-42fe480e0000 pid=3656->guuid=e7e595df-1700-0000-c5aa-42fe300f0000 pid=3888 execve guuid=2921405e-1800-0000-c5aa-42fe8c100000 pid=4236 /usr/bin/dpkg guuid=37087a86-1700-0000-c5aa-42fe480e0000 pid=3656->guuid=2921405e-1800-0000-c5aa-42fe8c100000 pid=4236 execve guuid=f22fd060-1800-0000-c5aa-42fe98100000 pid=4248 /usr/bin/dpkg guuid=8488bb5f-1800-0000-c5aa-42fe92100000 pid=4242->guuid=f22fd060-1800-0000-c5aa-42fe98100000 pid=4248 execve guuid=04f55b61-1800-0000-c5aa-42fe9c100000 pid=4252 /usr/bin/dpkg guuid=8488bb5f-1800-0000-c5aa-42fe92100000 pid=4242->guuid=04f55b61-1800-0000-c5aa-42fe9c100000 pid=4252 execve guuid=0b769864-1800-0000-c5aa-42feac100000 pid=4268 /usr/bin/apt-get guuid=e6b11964-1800-0000-c5aa-42fea9100000 pid=4265->guuid=0b769864-1800-0000-c5aa-42feac100000 pid=4268 execve guuid=ba9d4f66-1800-0000-c5aa-42feb6100000 pid=4278 /usr/bin/dpkg guuid=0b769864-1800-0000-c5aa-42feac100000 pid=4268->guuid=ba9d4f66-1800-0000-c5aa-42feb6100000 pid=4278 execve 954a60b5-8e85-5b88-b7db-4a00db4c2111 fix.unknower.win:80 guuid=e9e63d67-1800-0000-c5aa-42febd100000 pid=4285->954a60b5-8e85-5b88-b7db-4a00db4c2111 con guuid=e9e63d67-1800-0000-c5aa-42febd100000 pid=4298 /usr/bin/curl dns net send-data guuid=e9e63d67-1800-0000-c5aa-42febd100000 pid=4285->guuid=e9e63d67-1800-0000-c5aa-42febd100000 pid=4298 clone 4f6baed0-9587-596c-82b3-fd721afe4cc1 10.0.2.3:53 guuid=e9e63d67-1800-0000-c5aa-42febd100000 pid=4298->4f6baed0-9587-596c-82b3-fd721afe4cc1 send: 68B guuid=5f1cffbd-1a00-0000-c5aa-42feaf140000 pid=5295->954a60b5-8e85-5b88-b7db-4a00db4c2111 con guuid=5f1cffbd-1a00-0000-c5aa-42feaf140000 pid=5296 /usr/bin/curl dns net send-data guuid=5f1cffbd-1a00-0000-c5aa-42feaf140000 pid=5295->guuid=5f1cffbd-1a00-0000-c5aa-42feaf140000 pid=5296 clone guuid=5f1cffbd-1a00-0000-c5aa-42feaf140000 pid=5296->4f6baed0-9587-596c-82b3-fd721afe4cc1 send: 68B
Score:
2%
Verdict:
Benign
File Type:
SCRIPT
Link:
https://malprob.io/report/7ed7a1f09123fe8e0d776cfc7f31f7cbfe9afe26aa5ca19f124a6ccb15c97f52
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7ed7a1f09123fe8e0d776cfc7f31f7cbfe9afe26aa5ca19f124a6ccb15c97f52/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=p3l2d4erep7i4dlxnt6h6mpxzp7jv7rgvjokdhysjjwmwfojp5ja._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm discovery execution linux rootkit
Link:
https://tria.ge/reports/260808-nbpcgsej9y/
Behaviour
Software Deployment Tools
Enumerates kernel/hardware configuration
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
Reads CPU attributes
Enumerates running processes
Removes the immutable protection flag from a file
Loads a kernel module
Modifies the /etc/hosts DNS resolution file
Malware family:
XMRig
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/7ed7a1f09123/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.31
Link:
https://yomi.yoroi.company/submissions/7ed7a1f09123fe8e0d776cfc7f31f7cbfe9afe26aa5ca19f124a6ccb15c97f52

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:testlumma
Create hunting rule

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 7ed7a1f09123fe8e0d776cfc7f31f7cbfe9afe26aa5ca19f124a6ccb15c97f52

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3898981/
  
Delivery method
Distributed via web download

Comments