MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7f6a4ca56a7e18601ffcc7def9c4b3bfb1eb7ad143cc89d0c85dff367ee19302. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7f6a4ca56a7e18601ffcc7def9c4b3bfb1eb7ad143cc89d0c85dff367ee19302
SHA3-384 hash: f291c7251a6d12b9d539b54a86dbc1ac5903ea739b3a11fecadb106eeb0cf58771923e2084cf44f84c3124b8ac69f0c9
SHA1 hash: fc8824b541ff90bf390e4425bb213a3ffbd0475a
MD5 hash: b345b8e24e513bb4e8b8ef37a3aacf22
humanhash: mockingbird-snake-coffee-gee
File name:p
Download: download sample
File size:839 bytes
First seen:2026-08-03 18:55:19 UTC
Last seen:2026-08-04 08:19:39 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 24:kXCKysE2hi0ziQvZoha1SMiWOFKXeoXsI7:e9Qp+Ms1SNWiKXZXsI7
TLSH T1FF016BCAC320AD004059DA5E629B55E0B411D3CF154B0BB87F9C9D3DFB98804B127F98
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://129.121.114.124/Bm88n/an/aua-wget
http://129.121.114.124/C1WNn/an/aua-wget
http://129.121.114.124/muUn/an/aua-wget
http://129.121.114.124/KtjTn/an/aua-wget
http://129.121.114.124/QzFn/an/aua-wget

Intelligence

File Origin
# of uploads :
2
# of downloads :
65
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive mirai
Link:
https://www.filescan.io/uploads/6a70e419af2be774667f81e8/reports/a25e9266-42c0-4172-925f-c02dc0f3792c/overview
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/0fc763d9-71f6-4707-9a61-ffccf2681656
Behavior Graph:
Download SVG
%3 guuid=f0b4d4a6-1600-0000-cda3-82ef1b0e0000 pid=3611 /usr/bin/sudo guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620 /tmp/sample.bin write-file guuid=f0b4d4a6-1600-0000-cda3-82ef1b0e0000 pid=3611->guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620 execve guuid=4bce42a9-1600-0000-cda3-82ef260e0000 pid=3622 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=4bce42a9-1600-0000-cda3-82ef260e0000 pid=3622 execve guuid=7f46b4a9-1600-0000-cda3-82ef280e0000 pid=3624 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=7f46b4a9-1600-0000-cda3-82ef280e0000 pid=3624 execve guuid=b55a14aa-1600-0000-cda3-82ef2a0e0000 pid=3626 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=b55a14aa-1600-0000-cda3-82ef2a0e0000 pid=3626 execve guuid=c3d272aa-1600-0000-cda3-82ef2c0e0000 pid=3628 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=c3d272aa-1600-0000-cda3-82ef2c0e0000 pid=3628 execve guuid=657d0fab-1600-0000-cda3-82ef300e0000 pid=3632 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=657d0fab-1600-0000-cda3-82ef300e0000 pid=3632 execve guuid=82d881ab-1600-0000-cda3-82ef320e0000 pid=3634 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=82d881ab-1600-0000-cda3-82ef320e0000 pid=3634 execve guuid=3247f6ab-1600-0000-cda3-82ef340e0000 pid=3636 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=3247f6ab-1600-0000-cda3-82ef340e0000 pid=3636 execve guuid=19b36cac-1600-0000-cda3-82ef370e0000 pid=3639 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=19b36cac-1600-0000-cda3-82ef370e0000 pid=3639 execve guuid=b925ddac-1600-0000-cda3-82ef390e0000 pid=3641 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=b925ddac-1600-0000-cda3-82ef390e0000 pid=3641 execve guuid=38bc5ead-1600-0000-cda3-82ef3b0e0000 pid=3643 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=38bc5ead-1600-0000-cda3-82ef3b0e0000 pid=3643 execve guuid=1ce1c8ad-1600-0000-cda3-82ef3e0e0000 pid=3646 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=1ce1c8ad-1600-0000-cda3-82ef3e0e0000 pid=3646 execve guuid=91904bae-1600-0000-cda3-82ef400e0000 pid=3648 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=91904bae-1600-0000-cda3-82ef400e0000 pid=3648 execve guuid=3e24d6ae-1600-0000-cda3-82ef430e0000 pid=3651 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=3e24d6ae-1600-0000-cda3-82ef430e0000 pid=3651 execve guuid=7d8537af-1600-0000-cda3-82ef450e0000 pid=3653 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=7d8537af-1600-0000-cda3-82ef450e0000 pid=3653 execve guuid=2656e8af-1600-0000-cda3-82ef490e0000 pid=3657 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=2656e8af-1600-0000-cda3-82ef490e0000 pid=3657 execve guuid=f664c2b0-1600-0000-cda3-82ef4d0e0000 pid=3661 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=f664c2b0-1600-0000-cda3-82ef4d0e0000 pid=3661 execve guuid=aa8e9fb1-1600-0000-cda3-82ef560e0000 pid=3670 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=aa8e9fb1-1600-0000-cda3-82ef560e0000 pid=3670 execve guuid=1006f6b1-1600-0000-cda3-82ef580e0000 pid=3672 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=1006f6b1-1600-0000-cda3-82ef580e0000 pid=3672 execve guuid=f18989b3-1600-0000-cda3-82ef5f0e0000 pid=3679 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=f18989b3-1600-0000-cda3-82ef5f0e0000 pid=3679 execve guuid=64a3ecb3-1600-0000-cda3-82ef620e0000 pid=3682 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=64a3ecb3-1600-0000-cda3-82ef620e0000 pid=3682 execve guuid=808541b4-1600-0000-cda3-82ef650e0000 pid=3685 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=808541b4-1600-0000-cda3-82ef650e0000 pid=3685 execve guuid=a84d90b4-1600-0000-cda3-82ef680e0000 pid=3688 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=a84d90b4-1600-0000-cda3-82ef680e0000 pid=3688 execve guuid=010fe7b4-1600-0000-cda3-82ef6b0e0000 pid=3691 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=010fe7b4-1600-0000-cda3-82ef6b0e0000 pid=3691 execve guuid=9e1337b5-1600-0000-cda3-82ef6e0e0000 pid=3694 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=9e1337b5-1600-0000-cda3-82ef6e0e0000 pid=3694 execve guuid=abff87b5-1600-0000-cda3-82ef710e0000 pid=3697 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=abff87b5-1600-0000-cda3-82ef710e0000 pid=3697 execve guuid=1d3fdbb5-1600-0000-cda3-82ef740e0000 pid=3700 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=1d3fdbb5-1600-0000-cda3-82ef740e0000 pid=3700 execve guuid=51072bb6-1600-0000-cda3-82ef770e0000 pid=3703 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=51072bb6-1600-0000-cda3-82ef770e0000 pid=3703 execve guuid=437a7ab6-1600-0000-cda3-82ef7a0e0000 pid=3706 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=437a7ab6-1600-0000-cda3-82ef7a0e0000 pid=3706 execve guuid=7f4bc9b6-1600-0000-cda3-82ef7e0e0000 pid=3710 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=7f4bc9b6-1600-0000-cda3-82ef7e0e0000 pid=3710 execve guuid=a2231bb7-1600-0000-cda3-82ef820e0000 pid=3714 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=a2231bb7-1600-0000-cda3-82ef820e0000 pid=3714 execve guuid=5e656bb7-1600-0000-cda3-82ef850e0000 pid=3717 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=5e656bb7-1600-0000-cda3-82ef850e0000 pid=3717 execve guuid=d356bdb7-1600-0000-cda3-82ef880e0000 pid=3720 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=d356bdb7-1600-0000-cda3-82ef880e0000 pid=3720 execve guuid=ea5211b8-1600-0000-cda3-82ef8a0e0000 pid=3722 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=ea5211b8-1600-0000-cda3-82ef8a0e0000 pid=3722 execve guuid=c91a82b8-1600-0000-cda3-82ef900e0000 pid=3728 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=c91a82b8-1600-0000-cda3-82ef900e0000 pid=3728 execve guuid=94a270b9-1600-0000-cda3-82ef930e0000 pid=3731 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=94a270b9-1600-0000-cda3-82ef930e0000 pid=3731 execve guuid=67cf59ba-1600-0000-cda3-82ef940e0000 pid=3732 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=67cf59ba-1600-0000-cda3-82ef940e0000 pid=3732 execve guuid=51abcbba-1600-0000-cda3-82ef950e0000 pid=3733 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=51abcbba-1600-0000-cda3-82ef950e0000 pid=3733 execve guuid=512442bb-1600-0000-cda3-82ef960e0000 pid=3734 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=512442bb-1600-0000-cda3-82ef960e0000 pid=3734 execve guuid=f0a7b3bb-1600-0000-cda3-82ef970e0000 pid=3735 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=f0a7b3bb-1600-0000-cda3-82ef970e0000 pid=3735 execve guuid=436f27bc-1600-0000-cda3-82ef980e0000 pid=3736 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=436f27bc-1600-0000-cda3-82ef980e0000 pid=3736 execve guuid=37c879bc-1600-0000-cda3-82ef9b0e0000 pid=3739 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=37c879bc-1600-0000-cda3-82ef9b0e0000 pid=3739 execve guuid=e7cdd2bc-1600-0000-cda3-82ef9d0e0000 pid=3741 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=e7cdd2bc-1600-0000-cda3-82ef9d0e0000 pid=3741 execve guuid=f8d627bd-1600-0000-cda3-82efa00e0000 pid=3744 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=f8d627bd-1600-0000-cda3-82efa00e0000 pid=3744 execve guuid=f4ae7bbd-1600-0000-cda3-82efa20e0000 pid=3746 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=f4ae7bbd-1600-0000-cda3-82efa20e0000 pid=3746 execve guuid=a729d0bd-1600-0000-cda3-82efa40e0000 pid=3748 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=a729d0bd-1600-0000-cda3-82efa40e0000 pid=3748 execve guuid=2f3124be-1600-0000-cda3-82efa70e0000 pid=3751 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=2f3124be-1600-0000-cda3-82efa70e0000 pid=3751 execve guuid=5d497dbe-1600-0000-cda3-82efab0e0000 pid=3755 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=5d497dbe-1600-0000-cda3-82efab0e0000 pid=3755 execve guuid=bb2bd6be-1600-0000-cda3-82efac0e0000 pid=3756 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=bb2bd6be-1600-0000-cda3-82efac0e0000 pid=3756 execve guuid=e23532bf-1600-0000-cda3-82efad0e0000 pid=3757 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=e23532bf-1600-0000-cda3-82efad0e0000 pid=3757 execve guuid=89008cbf-1600-0000-cda3-82efae0e0000 pid=3758 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=89008cbf-1600-0000-cda3-82efae0e0000 pid=3758 execve guuid=a184eebf-1600-0000-cda3-82efaf0e0000 pid=3759 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=a184eebf-1600-0000-cda3-82efaf0e0000 pid=3759 execve guuid=fde74fc0-1600-0000-cda3-82efb00e0000 pid=3760 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=fde74fc0-1600-0000-cda3-82efb00e0000 pid=3760 execve guuid=da38b9c0-1600-0000-cda3-82efb30e0000 pid=3763 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=da38b9c0-1600-0000-cda3-82efb30e0000 pid=3763 execve guuid=b4ed14c1-1600-0000-cda3-82efb50e0000 pid=3765 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=b4ed14c1-1600-0000-cda3-82efb50e0000 pid=3765 execve guuid=699c6ac1-1600-0000-cda3-82efb90e0000 pid=3769 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=699c6ac1-1600-0000-cda3-82efb90e0000 pid=3769 execve guuid=f152bac1-1600-0000-cda3-82efbb0e0000 pid=3771 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=f152bac1-1600-0000-cda3-82efbb0e0000 pid=3771 execve guuid=e21b13c2-1600-0000-cda3-82efbe0e0000 pid=3774 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=e21b13c2-1600-0000-cda3-82efbe0e0000 pid=3774 execve guuid=5e6a66c2-1600-0000-cda3-82efc20e0000 pid=3778 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=5e6a66c2-1600-0000-cda3-82efc20e0000 pid=3778 execve guuid=4faaacc2-1600-0000-cda3-82efc40e0000 pid=3780 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=4faaacc2-1600-0000-cda3-82efc40e0000 pid=3780 execve guuid=465e02c3-1600-0000-cda3-82efc70e0000 pid=3783 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=465e02c3-1600-0000-cda3-82efc70e0000 pid=3783 execve guuid=4e3754c3-1600-0000-cda3-82efc90e0000 pid=3785 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=4e3754c3-1600-0000-cda3-82efc90e0000 pid=3785 execve guuid=a486a5c3-1600-0000-cda3-82efcc0e0000 pid=3788 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=a486a5c3-1600-0000-cda3-82efcc0e0000 pid=3788 execve guuid=0fdaf8c3-1600-0000-cda3-82efce0e0000 pid=3790 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=0fdaf8c3-1600-0000-cda3-82efce0e0000 pid=3790 execve guuid=4e814ac4-1600-0000-cda3-82efd00e0000 pid=3792 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=4e814ac4-1600-0000-cda3-82efd00e0000 pid=3792 execve guuid=1b699cc4-1600-0000-cda3-82efd40e0000 pid=3796 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=1b699cc4-1600-0000-cda3-82efd40e0000 pid=3796 execve guuid=5624f1c4-1600-0000-cda3-82efd80e0000 pid=3800 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=5624f1c4-1600-0000-cda3-82efd80e0000 pid=3800 execve guuid=12da4bc5-1600-0000-cda3-82efd90e0000 pid=3801 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=12da4bc5-1600-0000-cda3-82efd90e0000 pid=3801 execve guuid=c225adc5-1600-0000-cda3-82efdb0e0000 pid=3803 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=c225adc5-1600-0000-cda3-82efdb0e0000 pid=3803 execve guuid=54c100c6-1600-0000-cda3-82efdd0e0000 pid=3805 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=54c100c6-1600-0000-cda3-82efdd0e0000 pid=3805 execve guuid=bd715cc6-1600-0000-cda3-82efdf0e0000 pid=3807 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=bd715cc6-1600-0000-cda3-82efdf0e0000 pid=3807 execve guuid=b6adb3c6-1600-0000-cda3-82efe10e0000 pid=3809 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=b6adb3c6-1600-0000-cda3-82efe10e0000 pid=3809 execve guuid=b18108c7-1600-0000-cda3-82efe30e0000 pid=3811 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=b18108c7-1600-0000-cda3-82efe30e0000 pid=3811 execve guuid=55445ec7-1600-0000-cda3-82efe50e0000 pid=3813 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=55445ec7-1600-0000-cda3-82efe50e0000 pid=3813 execve guuid=989bb5c7-1600-0000-cda3-82efe80e0000 pid=3816 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=989bb5c7-1600-0000-cda3-82efe80e0000 pid=3816 execve guuid=83650ac8-1600-0000-cda3-82efec0e0000 pid=3820 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=83650ac8-1600-0000-cda3-82efec0e0000 pid=3820 execve guuid=8ad05fc8-1600-0000-cda3-82efef0e0000 pid=3823 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=8ad05fc8-1600-0000-cda3-82efef0e0000 pid=3823 execve guuid=736db3c8-1600-0000-cda3-82eff10e0000 pid=3825 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=736db3c8-1600-0000-cda3-82eff10e0000 pid=3825 execve guuid=4d4d06c9-1600-0000-cda3-82eff40e0000 pid=3828 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=4d4d06c9-1600-0000-cda3-82eff40e0000 pid=3828 execve guuid=675157c9-1600-0000-cda3-82eff80e0000 pid=3832 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=675157c9-1600-0000-cda3-82eff80e0000 pid=3832 execve guuid=b880acc9-1600-0000-cda3-82effc0e0000 pid=3836 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=b880acc9-1600-0000-cda3-82effc0e0000 pid=3836 execve guuid=9979ffc9-1600-0000-cda3-82effd0e0000 pid=3837 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=9979ffc9-1600-0000-cda3-82effd0e0000 pid=3837 execve guuid=c64152ca-1600-0000-cda3-82ef000f0000 pid=3840 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=c64152ca-1600-0000-cda3-82ef000f0000 pid=3840 execve guuid=2984e0ca-1600-0000-cda3-82ef030f0000 pid=3843 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=2984e0ca-1600-0000-cda3-82ef030f0000 pid=3843 execve guuid=8a9b5fcb-1600-0000-cda3-82ef060f0000 pid=3846 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=8a9b5fcb-1600-0000-cda3-82ef060f0000 pid=3846 execve guuid=6fd9d8cb-1600-0000-cda3-82ef0a0f0000 pid=3850 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=6fd9d8cb-1600-0000-cda3-82ef0a0f0000 pid=3850 execve guuid=409064cc-1600-0000-cda3-82ef0f0f0000 pid=3855 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=409064cc-1600-0000-cda3-82ef0f0f0000 pid=3855 execve guuid=d3bfdbcc-1600-0000-cda3-82ef140f0000 pid=3860 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=d3bfdbcc-1600-0000-cda3-82ef140f0000 pid=3860 execve guuid=22b053cd-1600-0000-cda3-82ef180f0000 pid=3864 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=22b053cd-1600-0000-cda3-82ef180f0000 pid=3864 execve guuid=6bdebccd-1600-0000-cda3-82ef1b0f0000 pid=3867 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=6bdebccd-1600-0000-cda3-82ef1b0f0000 pid=3867 execve guuid=92052fce-1600-0000-cda3-82ef1d0f0000 pid=3869 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=92052fce-1600-0000-cda3-82ef1d0f0000 pid=3869 execve guuid=b32593ce-1600-0000-cda3-82ef200f0000 pid=3872 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=b32593ce-1600-0000-cda3-82ef200f0000 pid=3872 execve guuid=273900cf-1600-0000-cda3-82ef230f0000 pid=3875 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=273900cf-1600-0000-cda3-82ef230f0000 pid=3875 execve guuid=371053cf-1600-0000-cda3-82ef250f0000 pid=3877 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=371053cf-1600-0000-cda3-82ef250f0000 pid=3877 execve guuid=f649cdcf-1600-0000-cda3-82ef260f0000 pid=3878 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=f649cdcf-1600-0000-cda3-82ef260f0000 pid=3878 execve guuid=815f4ad0-1600-0000-cda3-82ef270f0000 pid=3879 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=815f4ad0-1600-0000-cda3-82ef270f0000 pid=3879 execve guuid=2fdfb9d0-1600-0000-cda3-82ef290f0000 pid=3881 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=2fdfb9d0-1600-0000-cda3-82ef290f0000 pid=3881 execve guuid=59f30fd1-1600-0000-cda3-82ef2b0f0000 pid=3883 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=59f30fd1-1600-0000-cda3-82ef2b0f0000 pid=3883 execve guuid=af9b60d1-1600-0000-cda3-82ef2d0f0000 pid=3885 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=af9b60d1-1600-0000-cda3-82ef2d0f0000 pid=3885 execve guuid=9969b3d1-1600-0000-cda3-82ef300f0000 pid=3888 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=9969b3d1-1600-0000-cda3-82ef300f0000 pid=3888 execve guuid=f6f008d2-1600-0000-cda3-82ef320f0000 pid=3890 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=f6f008d2-1600-0000-cda3-82ef320f0000 pid=3890 execve guuid=e07c5ed2-1600-0000-cda3-82ef360f0000 pid=3894 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=e07c5ed2-1600-0000-cda3-82ef360f0000 pid=3894 execve guuid=9f67afd2-1600-0000-cda3-82ef370f0000 pid=3895 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=9f67afd2-1600-0000-cda3-82ef370f0000 pid=3895 execve guuid=90af44d3-1600-0000-cda3-82ef3a0f0000 pid=3898 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=90af44d3-1600-0000-cda3-82ef3a0f0000 pid=3898 execve guuid=9ab5dad3-1600-0000-cda3-82ef3f0f0000 pid=3903 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=9ab5dad3-1600-0000-cda3-82ef3f0f0000 pid=3903 execve guuid=3e4e60d5-1600-0000-cda3-82ef470f0000 pid=3911 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=3e4e60d5-1600-0000-cda3-82ef470f0000 pid=3911 execve guuid=2f1c52d6-1600-0000-cda3-82ef4f0f0000 pid=3919 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=2f1c52d6-1600-0000-cda3-82ef4f0f0000 pid=3919 execve guuid=5cb04fd7-1600-0000-cda3-82ef520f0000 pid=3922 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=5cb04fd7-1600-0000-cda3-82ef520f0000 pid=3922 execve guuid=719834d8-1600-0000-cda3-82ef560f0000 pid=3926 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=719834d8-1600-0000-cda3-82ef560f0000 pid=3926 execve guuid=ed1e92d8-1600-0000-cda3-82ef590f0000 pid=3929 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=ed1e92d8-1600-0000-cda3-82ef590f0000 pid=3929 execve guuid=d843e9d8-1600-0000-cda3-82ef5b0f0000 pid=3931 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=d843e9d8-1600-0000-cda3-82ef5b0f0000 pid=3931 execve guuid=09533fd9-1600-0000-cda3-82ef5e0f0000 pid=3934 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=09533fd9-1600-0000-cda3-82ef5e0f0000 pid=3934 execve guuid=25b594d9-1600-0000-cda3-82ef600f0000 pid=3936 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=25b594d9-1600-0000-cda3-82ef600f0000 pid=3936 execve guuid=aeaaead9-1600-0000-cda3-82ef620f0000 pid=3938 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=aeaaead9-1600-0000-cda3-82ef620f0000 pid=3938 execve guuid=bcda6eda-1600-0000-cda3-82ef650f0000 pid=3941 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=bcda6eda-1600-0000-cda3-82ef650f0000 pid=3941 execve guuid=c9e0e6da-1600-0000-cda3-82ef670f0000 pid=3943 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=c9e0e6da-1600-0000-cda3-82ef670f0000 pid=3943 execve guuid=8142d8db-1600-0000-cda3-82ef6c0f0000 pid=3948 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=8142d8db-1600-0000-cda3-82ef6c0f0000 pid=3948 execve guuid=9949bfdc-1600-0000-cda3-82ef6e0f0000 pid=3950 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=9949bfdc-1600-0000-cda3-82ef6e0f0000 pid=3950 execve guuid=f2fe75dd-1600-0000-cda3-82ef750f0000 pid=3957 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=f2fe75dd-1600-0000-cda3-82ef750f0000 pid=3957 execve guuid=9ee24ede-1600-0000-cda3-82ef780f0000 pid=3960 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=9ee24ede-1600-0000-cda3-82ef780f0000 pid=3960 execve guuid=a4c72adf-1600-0000-cda3-82ef7c0f0000 pid=3964 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=a4c72adf-1600-0000-cda3-82ef7c0f0000 pid=3964 execve guuid=3d0904e0-1600-0000-cda3-82ef800f0000 pid=3968 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=3d0904e0-1600-0000-cda3-82ef800f0000 pid=3968 execve guuid=3a4acce0-1600-0000-cda3-82ef840f0000 pid=3972 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=3a4acce0-1600-0000-cda3-82ef840f0000 pid=3972 execve guuid=4255a9e1-1600-0000-cda3-82ef880f0000 pid=3976 /usr/bin/ls guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=4255a9e1-1600-0000-cda3-82ef880f0000 pid=3976 execve guuid=183246e2-1600-0000-cda3-82ef8c0f0000 pid=3980 /usr/bin/rm guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=183246e2-1600-0000-cda3-82ef8c0f0000 pid=3980 execve guuid=96f9c0e2-1600-0000-cda3-82ef8f0f0000 pid=3983 /usr/bin/wget net send-data write-file guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=96f9c0e2-1600-0000-cda3-82ef8f0f0000 pid=3983 execve guuid=6fd7e9fe-1600-0000-cda3-82eff60f0000 pid=4086 /usr/bin/chmod guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=6fd7e9fe-1600-0000-cda3-82eff60f0000 pid=4086 execve guuid=040d34ff-1600-0000-cda3-82effa0f0000 pid=4090 /usr/bin/dash guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=040d34ff-1600-0000-cda3-82effa0f0000 pid=4090 clone guuid=476ed7ff-1600-0000-cda3-82effd0f0000 pid=4093 /usr/bin/rm guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=476ed7ff-1600-0000-cda3-82effd0f0000 pid=4093 execve guuid=a0581f00-1700-0000-cda3-82efff0f0000 pid=4095 /usr/bin/wget net send-data write-file guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=a0581f00-1700-0000-cda3-82efff0f0000 pid=4095 execve guuid=fe982f1a-1700-0000-cda3-82ef4e100000 pid=4174 /usr/bin/chmod guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=fe982f1a-1700-0000-cda3-82ef4e100000 pid=4174 execve guuid=04b4751a-1700-0000-cda3-82ef4f100000 pid=4175 /usr/bin/dash guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=04b4751a-1700-0000-cda3-82ef4f100000 pid=4175 clone guuid=6555211b-1700-0000-cda3-82ef54100000 pid=4180 /usr/bin/rm guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=6555211b-1700-0000-cda3-82ef54100000 pid=4180 execve guuid=bdbc661b-1700-0000-cda3-82ef58100000 pid=4184 /usr/bin/wget net send-data write-file guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=bdbc661b-1700-0000-cda3-82ef58100000 pid=4184 execve guuid=cf8ad233-1700-0000-cda3-82efb4100000 pid=4276 /usr/bin/chmod guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=cf8ad233-1700-0000-cda3-82efb4100000 pid=4276 execve guuid=18174234-1700-0000-cda3-82efb9100000 pid=4281 /usr/bin/dash guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=18174234-1700-0000-cda3-82efb9100000 pid=4281 clone guuid=ba625335-1700-0000-cda3-82efc0100000 pid=4288 /usr/bin/rm guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=ba625335-1700-0000-cda3-82efc0100000 pid=4288 execve guuid=a01ad835-1700-0000-cda3-82efc3100000 pid=4291 /usr/bin/wget net send-data write-file guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=a01ad835-1700-0000-cda3-82efc3100000 pid=4291 execve guuid=5eddfe53-1700-0000-cda3-82ef20110000 pid=4384 /usr/bin/chmod guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=5eddfe53-1700-0000-cda3-82ef20110000 pid=4384 execve guuid=494b8e54-1700-0000-cda3-82ef22110000 pid=4386 /usr/bin/dash guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=494b8e54-1700-0000-cda3-82ef22110000 pid=4386 clone guuid=992b1a56-1700-0000-cda3-82ef2c110000 pid=4396 /usr/bin/rm guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=992b1a56-1700-0000-cda3-82ef2c110000 pid=4396 execve guuid=ca65d456-1700-0000-cda3-82ef31110000 pid=4401 /usr/bin/wget net send-data write-file guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=ca65d456-1700-0000-cda3-82ef31110000 pid=4401 execve guuid=65217376-1700-0000-cda3-82efaa110000 pid=4522 /usr/bin/chmod guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=65217376-1700-0000-cda3-82efaa110000 pid=4522 execve guuid=d7e5b776-1700-0000-cda3-82efac110000 pid=4524 /usr/bin/dash guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=d7e5b776-1700-0000-cda3-82efac110000 pid=4524 clone guuid=cfa36077-1700-0000-cda3-82efb0110000 pid=4528 /usr/bin/rm delete-file guuid=2ff5f8a8-1600-0000-cda3-82ef240e0000 pid=3620->guuid=cfa36077-1700-0000-cda3-82efb0110000 pid=4528 execve 801186e6-5fe8-5959-a7b4-832d8d66e7aa 129.121.114.124:80 guuid=96f9c0e2-1600-0000-cda3-82ef8f0f0000 pid=3983->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 134B guuid=a0581f00-1700-0000-cda3-82efff0f0000 pid=4095->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 134B guuid=bdbc661b-1700-0000-cda3-82ef58100000 pid=4184->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 133B guuid=a01ad835-1700-0000-cda3-82efc3100000 pid=4291->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 134B guuid=ca65d456-1700-0000-cda3-82ef31110000 pid=4401->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 133B
Score:
92%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/7f6a4ca56a7e18601ffcc7def9c4b3bfb1eb7ad143cc89d0c85dff367ee19302
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7f6a4ca56a7e18601ffcc7def9c4b3bfb1eb7ad143cc89d0c85dff367ee19302/
Threat name:
Document-HTML.Downloader.Bash
Create hunting rule
Status:
Malicious
First seen:
2026-08-03 18:56:25 UTC
File Type:
Text (Shell)
AV detection:
11 of 36 (30.56%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=p5vezjlkpymgah74y7pptrftx6y6w6wripgitugilx7tm7xbsmba._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
discovery linux
Link:
https://tria.ge/reports/260803-xk1ljsyyav/
Behaviour
Reads runtime system information
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.26
Link:
https://yomi.yoroi.company/submissions/7f6a4ca56a7e18601ffcc7def9c4b3bfb1eb7ad143cc89d0c85dff367ee19302

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 7f6a4ca56a7e18601ffcc7def9c4b3bfb1eb7ad143cc89d0c85dff367ee19302

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3866369/
  
Delivery method
Distributed via web download

Comments