MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7fc87b548727d0d5cbef66216e496bb18b2b877075896fb7df181554e23b8e27. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7fc87b548727d0d5cbef66216e496bb18b2b877075896fb7df181554e23b8e27
SHA3-384 hash: 94b2e1d18ad1a0e8c1e05838961818564e176d1c420dd0896c3cfcc9f3ba9bfdf2f105b5990e11f40d9f1efca285ebdf
SHA1 hash: e0bcebe0b58c8d7888f67652aca6d90eb953a133
MD5 hash: 3e4f5d17ce09176d920ebb02f7890671
humanhash: eleven-north-kitten-winner
File name:7fc87b548727d0d5cbef66216e496bb18b2b877075896fb7df181554e23b8e27
Download: download sample
File size:1'608 bytes
First seen:2026-08-26 09:00:26 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 24:rLITGn7XBnxAZftf0ZRs0C3S3eDVXKY7h:QTGn7xxefmZRsL7h
TLSH T15D316CDE01145A315102CE8E7376264CB58DE6E72D9FC7E4D8090EEE92887CCF265B9E
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter EnthecSolutions
Tags:enthec sh
URLMalware sample (SHA256 hash)SignatureTags
http://5.182.210.174/c007b8n/an/an/a
http://5.182.210.174/7e7bdcn/an/an/a
http://5.182.210.174/be60a2n/an/an/a
http://5.182.210.174/4dacfen/an/an/a
http://5.182.210.174/081d44n/an/an/a
http://5.182.210.174/ebbd92n/an/an/a
http://5.182.210.174/b18380n/an/an/a
http://5.182.210.174/ca115dn/an/an/a
http://5.182.210.174/052ccbn/an/an/a
http://5.182.210.174/f4ac6fn/an/an/a
http://5.182.210.174/965a58n/an/an/a
http://5.182.210.174/144714n/an/an/a

Intelligence

File Origin
# of uploads :
1
# of downloads :
87
Origin country :
CA CA
Vendor Threat Intelligence
No detections
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-08-24T10:50:00Z UTC
Last seen:
2026-08-27T06:40:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/7fc87b548727d0d5cbef66216e496bb18b2b877075896fb7df181554e23b8e27/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/82cfb593-11e6-4726-a12d-1dd4dc04349a
Behavior Graph:
Download SVG
%3 guuid=c20b2575-1800-0000-9aec-759085080000 pid=2181 /usr/bin/sudo guuid=1431a678-1800-0000-9aec-759087080000 pid=2183 /tmp/sample.bin guuid=c20b2575-1800-0000-9aec-759085080000 pid=2181->guuid=1431a678-1800-0000-9aec-759087080000 pid=2183 execve guuid=1bd03b7a-1800-0000-9aec-759088080000 pid=2184 /usr/bin/wget net send-data guuid=1431a678-1800-0000-9aec-759087080000 pid=2183->guuid=1bd03b7a-1800-0000-9aec-759088080000 pid=2184 execve guuid=c8897d83-1800-0000-9aec-759090080000 pid=2192 /usr/bin/curl net send-data write-file guuid=1431a678-1800-0000-9aec-759087080000 pid=2183->guuid=c8897d83-1800-0000-9aec-759090080000 pid=2192 execve guuid=de02b888-1800-0000-9aec-75909b080000 pid=2203 /usr/bin/chmod guuid=1431a678-1800-0000-9aec-759087080000 pid=2183->guuid=de02b888-1800-0000-9aec-75909b080000 pid=2203 execve guuid=874ef688-1800-0000-9aec-75909d080000 pid=2205 /usr/bin/bash guuid=1431a678-1800-0000-9aec-759087080000 pid=2183->guuid=874ef688-1800-0000-9aec-75909d080000 pid=2205 clone guuid=1d074589-1800-0000-9aec-75909f080000 pid=2207 /usr/bin/rm delete-file guuid=1431a678-1800-0000-9aec-759087080000 pid=2183->guuid=1d074589-1800-0000-9aec-75909f080000 pid=2207 execve guuid=5b38bc89-1800-0000-9aec-7590a1080000 pid=2209 /usr/bin/rm guuid=1431a678-1800-0000-9aec-759087080000 pid=2183->guuid=5b38bc89-1800-0000-9aec-7590a1080000 pid=2209 execve guuid=d339148a-1800-0000-9aec-7590a4080000 pid=2212 /usr/bin/wget net send-data guuid=1431a678-1800-0000-9aec-759087080000 pid=2183->guuid=d339148a-1800-0000-9aec-7590a4080000 pid=2212 execve guuid=f2b7fd8c-1800-0000-9aec-7590a9080000 pid=2217 /usr/bin/curl net send-data write-file guuid=1431a678-1800-0000-9aec-759087080000 pid=2183->guuid=f2b7fd8c-1800-0000-9aec-7590a9080000 pid=2217 execve guuid=73622697-1800-0000-9aec-7590bc080000 pid=2236 /usr/bin/chmod guuid=1431a678-1800-0000-9aec-759087080000 pid=2183->guuid=73622697-1800-0000-9aec-7590bc080000 pid=2236 execve guuid=d61fa397-1800-0000-9aec-7590bd080000 pid=2237 /usr/bin/bash guuid=1431a678-1800-0000-9aec-759087080000 pid=2183->guuid=d61fa397-1800-0000-9aec-7590bd080000 pid=2237 clone guuid=3ec5fb97-1800-0000-9aec-7590c0080000 pid=2240 /usr/bin/rm delete-file guuid=1431a678-1800-0000-9aec-759087080000 pid=2183->guuid=3ec5fb97-1800-0000-9aec-7590c0080000 pid=2240 execve guuid=8e995598-1800-0000-9aec-7590c1080000 pid=2241 /usr/bin/rm guuid=1431a678-1800-0000-9aec-759087080000 pid=2183->guuid=8e995598-1800-0000-9aec-7590c1080000 pid=2241 execve guuid=4a3ca798-1800-0000-9aec-7590c2080000 pid=2242 /usr/bin/wget net send-data guuid=1431a678-1800-0000-9aec-759087080000 pid=2183->guuid=4a3ca798-1800-0000-9aec-7590c2080000 pid=2242 execve guuid=b9fe389b-1800-0000-9aec-7590c9080000 pid=2249 /usr/bin/curl net send-data write-file guuid=1431a678-1800-0000-9aec-759087080000 pid=2183->guuid=b9fe389b-1800-0000-9aec-7590c9080000 pid=2249 execve guuid=952293a2-1800-0000-9aec-7590da080000 pid=2266 /usr/bin/chmod guuid=1431a678-1800-0000-9aec-759087080000 pid=2183->guuid=952293a2-1800-0000-9aec-7590da080000 pid=2266 execve guuid=e2afd5a2-1800-0000-9aec-7590dc080000 pid=2268 /usr/bin/bash guuid=1431a678-1800-0000-9aec-759087080000 pid=2183->guuid=e2afd5a2-1800-0000-9aec-7590dc080000 pid=2268 clone guuid=c24e19a3-1800-0000-9aec-7590df080000 pid=2271 /usr/bin/rm delete-file guuid=1431a678-1800-0000-9aec-759087080000 pid=2183->guuid=c24e19a3-1800-0000-9aec-7590df080000 pid=2271 execve guuid=4fad95a3-1800-0000-9aec-7590e2080000 pid=2274 /usr/bin/rm guuid=1431a678-1800-0000-9aec-759087080000 pid=2183->guuid=4fad95a3-1800-0000-9aec-7590e2080000 pid=2274 execve guuid=308402a4-1800-0000-9aec-7590e4080000 pid=2276 /usr/bin/wget net send-data guuid=1431a678-1800-0000-9aec-759087080000 pid=2183->guuid=308402a4-1800-0000-9aec-7590e4080000 pid=2276 execve guuid=67cea5a7-1800-0000-9aec-7590ed080000 pid=2285 /usr/bin/curl net send-data write-file guuid=1431a678-1800-0000-9aec-759087080000 pid=2183->guuid=67cea5a7-1800-0000-9aec-7590ed080000 pid=2285 execve guuid=6eb37fb1-1800-0000-9aec-759000090000 pid=2304 /usr/bin/chmod guuid=1431a678-1800-0000-9aec-759087080000 pid=2183->guuid=6eb37fb1-1800-0000-9aec-759000090000 pid=2304 execve guuid=1f3344b2-1800-0000-9aec-759001090000 pid=2305 /usr/bin/bash guuid=1431a678-1800-0000-9aec-759087080000 pid=2183->guuid=1f3344b2-1800-0000-9aec-759001090000 pid=2305 clone guuid=1d6dfdb2-1800-0000-9aec-759004090000 pid=2308 /usr/bin/rm delete-file guuid=1431a678-1800-0000-9aec-759087080000 pid=2183->guuid=1d6dfdb2-1800-0000-9aec-759004090000 pid=2308 execve guuid=8f4044b3-1800-0000-9aec-759005090000 pid=2309 /usr/bin/rm guuid=1431a678-1800-0000-9aec-759087080000 pid=2183->guuid=8f4044b3-1800-0000-9aec-759005090000 pid=2309 execve guuid=098b81b3-1800-0000-9aec-759007090000 pid=2311 /usr/bin/wget net send-data guuid=1431a678-1800-0000-9aec-759087080000 pid=2183->guuid=098b81b3-1800-0000-9aec-759007090000 pid=2311 execve guuid=d2c8b7b6-1800-0000-9aec-75900e090000 pid=2318 /usr/bin/curl net send-data write-file guuid=1431a678-1800-0000-9aec-759087080000 pid=2183->guuid=d2c8b7b6-1800-0000-9aec-75900e090000 pid=2318 execve guuid=665dcdc1-1800-0000-9aec-759022090000 pid=2338 /usr/bin/chmod guuid=1431a678-1800-0000-9aec-759087080000 pid=2183->guuid=665dcdc1-1800-0000-9aec-759022090000 pid=2338 execve guuid=9c0f34c2-1800-0000-9aec-759024090000 pid=2340 /usr/bin/bash guuid=1431a678-1800-0000-9aec-759087080000 pid=2183->guuid=9c0f34c2-1800-0000-9aec-759024090000 pid=2340 clone guuid=e1a684c2-1800-0000-9aec-759026090000 pid=2342 /usr/bin/rm delete-file guuid=1431a678-1800-0000-9aec-759087080000 pid=2183->guuid=e1a684c2-1800-0000-9aec-759026090000 pid=2342 execve guuid=ac94f7c2-1800-0000-9aec-759027090000 pid=2343 /usr/bin/rm guuid=1431a678-1800-0000-9aec-759087080000 pid=2183->guuid=ac94f7c2-1800-0000-9aec-759027090000 pid=2343 execve guuid=19277fc3-1800-0000-9aec-759028090000 pid=2344 /usr/bin/wget net send-data guuid=1431a678-1800-0000-9aec-759087080000 pid=2183->guuid=19277fc3-1800-0000-9aec-759028090000 pid=2344 execve guuid=6700e8c7-1800-0000-9aec-75902f090000 pid=2351 /usr/bin/curl net send-data write-file guuid=1431a678-1800-0000-9aec-759087080000 pid=2183->guuid=6700e8c7-1800-0000-9aec-75902f090000 pid=2351 execve guuid=379910ce-1800-0000-9aec-75903f090000 pid=2367 /usr/bin/chmod guuid=1431a678-1800-0000-9aec-759087080000 pid=2183->guuid=379910ce-1800-0000-9aec-75903f090000 pid=2367 execve guuid=0eb45fce-1800-0000-9aec-759040090000 pid=2368 /usr/bin/bash guuid=1431a678-1800-0000-9aec-759087080000 pid=2183->guuid=0eb45fce-1800-0000-9aec-759040090000 pid=2368 clone guuid=cf7b92ce-1800-0000-9aec-759043090000 pid=2371 /usr/bin/rm delete-file guuid=1431a678-1800-0000-9aec-759087080000 pid=2183->guuid=cf7b92ce-1800-0000-9aec-759043090000 pid=2371 execve guuid=a3a7cfce-1800-0000-9aec-759044090000 pid=2372 /usr/bin/rm guuid=1431a678-1800-0000-9aec-759087080000 pid=2183->guuid=a3a7cfce-1800-0000-9aec-759044090000 pid=2372 execve guuid=8de917cf-1800-0000-9aec-759045090000 pid=2373 /usr/bin/wget net send-data guuid=1431a678-1800-0000-9aec-759087080000 pid=2183->guuid=8de917cf-1800-0000-9aec-759045090000 pid=2373 execve guuid=4548fad3-1800-0000-9aec-759050090000 pid=2384 /usr/bin/curl net send-data write-file guuid=1431a678-1800-0000-9aec-759087080000 pid=2183->guuid=4548fad3-1800-0000-9aec-759050090000 pid=2384 execve guuid=e33baad8-1800-0000-9aec-75905c090000 pid=2396 /usr/bin/chmod guuid=1431a678-1800-0000-9aec-759087080000 pid=2183->guuid=e33baad8-1800-0000-9aec-75905c090000 pid=2396 execve guuid=334ce9d8-1800-0000-9aec-75905e090000 pid=2398 /usr/bin/bash guuid=1431a678-1800-0000-9aec-759087080000 pid=2183->guuid=334ce9d8-1800-0000-9aec-75905e090000 pid=2398 clone guuid=0cc51bd9-1800-0000-9aec-759061090000 pid=2401 /usr/bin/rm delete-file guuid=1431a678-1800-0000-9aec-759087080000 pid=2183->guuid=0cc51bd9-1800-0000-9aec-759061090000 pid=2401 execve guuid=d5065dd9-1800-0000-9aec-759063090000 pid=2403 /usr/bin/rm guuid=1431a678-1800-0000-9aec-759087080000 pid=2183->guuid=d5065dd9-1800-0000-9aec-759063090000 pid=2403 execve guuid=accfb2d9-1800-0000-9aec-759065090000 pid=2405 /usr/bin/wget net send-data guuid=1431a678-1800-0000-9aec-759087080000 pid=2183->guuid=accfb2d9-1800-0000-9aec-759065090000 pid=2405 execve guuid=e77ab6dc-1800-0000-9aec-75906d090000 pid=2413 /usr/bin/curl net send-data write-file guuid=1431a678-1800-0000-9aec-759087080000 pid=2183->guuid=e77ab6dc-1800-0000-9aec-75906d090000 pid=2413 execve guuid=58ef92e0-1800-0000-9aec-759077090000 pid=2423 /usr/bin/chmod guuid=1431a678-1800-0000-9aec-759087080000 pid=2183->guuid=58ef92e0-1800-0000-9aec-759077090000 pid=2423 execve guuid=5a58dee0-1800-0000-9aec-759078090000 pid=2424 /usr/bin/bash guuid=1431a678-1800-0000-9aec-759087080000 pid=2183->guuid=5a58dee0-1800-0000-9aec-759078090000 pid=2424 clone guuid=213e3ee1-1800-0000-9aec-75907b090000 pid=2427 /usr/bin/rm delete-file guuid=1431a678-1800-0000-9aec-759087080000 pid=2183->guuid=213e3ee1-1800-0000-9aec-75907b090000 pid=2427 execve guuid=0524b9e1-1800-0000-9aec-75907e090000 pid=2430 /usr/bin/rm guuid=1431a678-1800-0000-9aec-759087080000 pid=2183->guuid=0524b9e1-1800-0000-9aec-75907e090000 pid=2430 execve guuid=dd762ae2-1800-0000-9aec-75907f090000 pid=2431 /usr/bin/wget net send-data guuid=1431a678-1800-0000-9aec-759087080000 pid=2183->guuid=dd762ae2-1800-0000-9aec-75907f090000 pid=2431 execve guuid=374ffce4-1800-0000-9aec-759087090000 pid=2439 /usr/bin/curl net send-data write-file guuid=1431a678-1800-0000-9aec-759087080000 pid=2183->guuid=374ffce4-1800-0000-9aec-759087090000 pid=2439 execve guuid=cd76c1e9-1800-0000-9aec-759095090000 pid=2453 /usr/bin/chmod guuid=1431a678-1800-0000-9aec-759087080000 pid=2183->guuid=cd76c1e9-1800-0000-9aec-759095090000 pid=2453 execve guuid=c3031eea-1800-0000-9aec-759097090000 pid=2455 /usr/bin/bash guuid=1431a678-1800-0000-9aec-759087080000 pid=2183->guuid=c3031eea-1800-0000-9aec-759097090000 pid=2455 clone guuid=788b58ea-1800-0000-9aec-75909a090000 pid=2458 /usr/bin/rm delete-file guuid=1431a678-1800-0000-9aec-759087080000 pid=2183->guuid=788b58ea-1800-0000-9aec-75909a090000 pid=2458 execve guuid=c06dbeea-1800-0000-9aec-75909b090000 pid=2459 /usr/bin/rm guuid=1431a678-1800-0000-9aec-759087080000 pid=2183->guuid=c06dbeea-1800-0000-9aec-75909b090000 pid=2459 execve guuid=291f17eb-1800-0000-9aec-75909d090000 pid=2461 /usr/bin/wget net send-data guuid=1431a678-1800-0000-9aec-759087080000 pid=2183->guuid=291f17eb-1800-0000-9aec-75909d090000 pid=2461 execve guuid=824e7ced-1800-0000-9aec-7590a3090000 pid=2467 /usr/bin/curl net send-data write-file guuid=1431a678-1800-0000-9aec-759087080000 pid=2183->guuid=824e7ced-1800-0000-9aec-7590a3090000 pid=2467 execve guuid=e8de65f1-1800-0000-9aec-7590ab090000 pid=2475 /usr/bin/chmod guuid=1431a678-1800-0000-9aec-759087080000 pid=2183->guuid=e8de65f1-1800-0000-9aec-7590ab090000 pid=2475 execve guuid=150ca4f1-1800-0000-9aec-7590ad090000 pid=2477 /usr/bin/bash guuid=1431a678-1800-0000-9aec-759087080000 pid=2183->guuid=150ca4f1-1800-0000-9aec-7590ad090000 pid=2477 clone guuid=8f66d9f1-1800-0000-9aec-7590af090000 pid=2479 /usr/bin/rm delete-file guuid=1431a678-1800-0000-9aec-759087080000 pid=2183->guuid=8f66d9f1-1800-0000-9aec-7590af090000 pid=2479 execve guuid=cef022f2-1800-0000-9aec-7590b1090000 pid=2481 /usr/bin/rm guuid=1431a678-1800-0000-9aec-759087080000 pid=2183->guuid=cef022f2-1800-0000-9aec-7590b1090000 pid=2481 execve guuid=4a8f60f2-1800-0000-9aec-7590b3090000 pid=2483 /usr/bin/wget net send-data guuid=1431a678-1800-0000-9aec-759087080000 pid=2183->guuid=4a8f60f2-1800-0000-9aec-7590b3090000 pid=2483 execve guuid=e4ed09f5-1800-0000-9aec-7590ba090000 pid=2490 /usr/bin/curl net send-data write-file guuid=1431a678-1800-0000-9aec-759087080000 pid=2183->guuid=e4ed09f5-1800-0000-9aec-7590ba090000 pid=2490 execve guuid=cd71c1fa-1800-0000-9aec-7590c5090000 pid=2501 /usr/bin/chmod guuid=1431a678-1800-0000-9aec-759087080000 pid=2183->guuid=cd71c1fa-1800-0000-9aec-7590c5090000 pid=2501 execve guuid=1e8624fb-1800-0000-9aec-7590c7090000 pid=2503 /usr/bin/bash guuid=1431a678-1800-0000-9aec-759087080000 pid=2183->guuid=1e8624fb-1800-0000-9aec-7590c7090000 pid=2503 clone guuid=ebf676fb-1800-0000-9aec-7590ca090000 pid=2506 /usr/bin/rm delete-file guuid=1431a678-1800-0000-9aec-759087080000 pid=2183->guuid=ebf676fb-1800-0000-9aec-7590ca090000 pid=2506 execve guuid=5f8b08fc-1800-0000-9aec-7590cd090000 pid=2509 /usr/bin/rm guuid=1431a678-1800-0000-9aec-759087080000 pid=2183->guuid=5f8b08fc-1800-0000-9aec-7590cd090000 pid=2509 execve guuid=7bd554fc-1800-0000-9aec-7590cf090000 pid=2511 /usr/bin/wget net send-data guuid=1431a678-1800-0000-9aec-759087080000 pid=2183->guuid=7bd554fc-1800-0000-9aec-7590cf090000 pid=2511 execve guuid=761c2dff-1800-0000-9aec-7590d8090000 pid=2520 /usr/bin/curl net send-data write-file guuid=1431a678-1800-0000-9aec-759087080000 pid=2183->guuid=761c2dff-1800-0000-9aec-7590d8090000 pid=2520 execve guuid=36159a02-1900-0000-9aec-7590e3090000 pid=2531 /usr/bin/chmod guuid=1431a678-1800-0000-9aec-759087080000 pid=2183->guuid=36159a02-1900-0000-9aec-7590e3090000 pid=2531 execve guuid=774efb02-1900-0000-9aec-7590e5090000 pid=2533 /usr/bin/bash guuid=1431a678-1800-0000-9aec-759087080000 pid=2183->guuid=774efb02-1900-0000-9aec-7590e5090000 pid=2533 clone guuid=bd853303-1900-0000-9aec-7590e7090000 pid=2535 /usr/bin/rm delete-file guuid=1431a678-1800-0000-9aec-759087080000 pid=2183->guuid=bd853303-1900-0000-9aec-7590e7090000 pid=2535 execve guuid=964b7f03-1900-0000-9aec-7590e9090000 pid=2537 /usr/bin/rm guuid=1431a678-1800-0000-9aec-759087080000 pid=2183->guuid=964b7f03-1900-0000-9aec-7590e9090000 pid=2537 execve 5b654972-c9e1-50d8-b372-2dc2a5b9ad66 5.182.210.174:80 guuid=1bd03b7a-1800-0000-9aec-759088080000 pid=2184->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=c8897d83-1800-0000-9aec-759090080000 pid=2192->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=f9fb0a89-1800-0000-9aec-75909e080000 pid=2206 /usr/bin/bash guuid=874ef688-1800-0000-9aec-75909d080000 pid=2205->guuid=f9fb0a89-1800-0000-9aec-75909e080000 pid=2206 clone guuid=d339148a-1800-0000-9aec-7590a4080000 pid=2212->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=f2b7fd8c-1800-0000-9aec-7590a9080000 pid=2217->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=b51bd297-1800-0000-9aec-7590bf080000 pid=2239 /usr/bin/bash guuid=d61fa397-1800-0000-9aec-7590bd080000 pid=2237->guuid=b51bd297-1800-0000-9aec-7590bf080000 pid=2239 clone guuid=4a3ca798-1800-0000-9aec-7590c2080000 pid=2242->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=b9fe389b-1800-0000-9aec-7590c9080000 pid=2249->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=8a0aefa2-1800-0000-9aec-7590de080000 pid=2270 /usr/bin/bash guuid=e2afd5a2-1800-0000-9aec-7590dc080000 pid=2268->guuid=8a0aefa2-1800-0000-9aec-7590de080000 pid=2270 clone guuid=308402a4-1800-0000-9aec-7590e4080000 pid=2276->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=67cea5a7-1800-0000-9aec-7590ed080000 pid=2285->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=cdc39eb2-1800-0000-9aec-759002090000 pid=2306 /usr/bin/bash guuid=1f3344b2-1800-0000-9aec-759001090000 pid=2305->guuid=cdc39eb2-1800-0000-9aec-759002090000 pid=2306 clone guuid=098b81b3-1800-0000-9aec-759007090000 pid=2311->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=d2c8b7b6-1800-0000-9aec-75900e090000 pid=2318->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=403855c2-1800-0000-9aec-759025090000 pid=2341 /usr/bin/bash guuid=9c0f34c2-1800-0000-9aec-759024090000 pid=2340->guuid=403855c2-1800-0000-9aec-759025090000 pid=2341 clone guuid=19277fc3-1800-0000-9aec-759028090000 pid=2344->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=6700e8c7-1800-0000-9aec-75902f090000 pid=2351->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=a05373ce-1800-0000-9aec-759042090000 pid=2370 /usr/bin/bash guuid=0eb45fce-1800-0000-9aec-759040090000 pid=2368->guuid=a05373ce-1800-0000-9aec-759042090000 pid=2370 clone guuid=8de917cf-1800-0000-9aec-759045090000 pid=2373->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=4548fad3-1800-0000-9aec-759050090000 pid=2384->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=6b68fdd8-1800-0000-9aec-759060090000 pid=2400 /usr/bin/bash guuid=334ce9d8-1800-0000-9aec-75905e090000 pid=2398->guuid=6b68fdd8-1800-0000-9aec-759060090000 pid=2400 clone guuid=accfb2d9-1800-0000-9aec-759065090000 pid=2405->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=e77ab6dc-1800-0000-9aec-75906d090000 pid=2413->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=92880de1-1800-0000-9aec-75907a090000 pid=2426 /usr/bin/bash guuid=5a58dee0-1800-0000-9aec-759078090000 pid=2424->guuid=92880de1-1800-0000-9aec-75907a090000 pid=2426 clone guuid=dd762ae2-1800-0000-9aec-75907f090000 pid=2431->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=374ffce4-1800-0000-9aec-759087090000 pid=2439->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=661e35ea-1800-0000-9aec-759098090000 pid=2456 /usr/bin/bash guuid=c3031eea-1800-0000-9aec-759097090000 pid=2455->guuid=661e35ea-1800-0000-9aec-759098090000 pid=2456 clone guuid=291f17eb-1800-0000-9aec-75909d090000 pid=2461->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=824e7ced-1800-0000-9aec-7590a3090000 pid=2467->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=e01ab8f1-1800-0000-9aec-7590ae090000 pid=2478 /usr/bin/bash guuid=150ca4f1-1800-0000-9aec-7590ad090000 pid=2477->guuid=e01ab8f1-1800-0000-9aec-7590ae090000 pid=2478 clone guuid=4a8f60f2-1800-0000-9aec-7590b3090000 pid=2483->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=e4ed09f5-1800-0000-9aec-7590ba090000 pid=2490->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=009b47fb-1800-0000-9aec-7590c9090000 pid=2505 /usr/bin/bash guuid=1e8624fb-1800-0000-9aec-7590c7090000 pid=2503->guuid=009b47fb-1800-0000-9aec-7590c9090000 pid=2505 clone guuid=7bd554fc-1800-0000-9aec-7590cf090000 pid=2511->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=761c2dff-1800-0000-9aec-7590d8090000 pid=2520->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=af661503-1900-0000-9aec-7590e6090000 pid=2534 /usr/bin/bash guuid=774efb02-1900-0000-9aec-7590e5090000 pid=2533->guuid=af661503-1900-0000-9aec-7590e6090000 pid=2534 clone
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/7fc87b548727d0d5cbef66216e496bb18b2b877075896fb7df181554e23b8e27
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7fc87b548727d0d5cbef66216e496bb18b2b877075896fb7df181554e23b8e27/
Threat name:
Linux.Downloader.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-08-24 15:16:39 UTC
File Type:
Text (Shell)
AV detection:
14 of 36 (38.89%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=p7ehwvehe7inls7pmyqw4sllwgfsxb3qowew7n67dakvjyr3rytq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260826-kyk2ssbk6s/
Behaviour
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.11
Link:
https://yomi.yoroi.company/submissions/7fc87b548727d0d5cbef66216e496bb18b2b877075896fb7df181554e23b8e27

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments