🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 87215b3e53c7cdcc76e7688eac0eb652562766d475c4a08ce10a9b8fef9fdcf0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 87215b3e53c7cdcc76e7688eac0eb652562766d475c4a08ce10a9b8fef9fdcf0
SHA3-384 hash: f93c8eb581893dc49e510387005ff9d02f20b4ad5835e85ccbdb2a82b0e68db0e35d1a7671260186e4ce07c7a3ffe9ba
SHA1 hash: 193bd4f80a079d96482175a285153a8dfff8708b
MD5 hash: b4e81349241d5ae4123336f3791dc622
humanhash: green-delaware-hot-oklahoma
File name:ok
Download: download sample
File size:1'608 bytes
First seen:2026-09-03 09:26:58 UTC
Last seen:2026-09-03 13:41:10 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 12:UWUG6WUcZXPab6aBRa16aHTeGQB6QB7DM36MNbNV6lJtJDUA8L6UA84a0aox62AQ:lqQPzeLL9YjOreSJhxjA3I6L8T
TLSH T1DD3122CE00182A315012CD8E7362744CB68DA9FB599FC7F4ED581EAD868928CF296F59
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://5.182.210.174/b41b8fn/an/an/a
http://5.182.210.174/0a90dan/an/an/a
http://5.182.210.174/b84245n/an/an/a
http://5.182.210.174/ce2c4fn/an/an/a
http://5.182.210.174/bfdf6cn/an/an/a
http://5.182.210.174/09685dn/an/an/a
http://5.182.210.174/cc63b0n/an/an/a
http://5.182.210.174/0a1d1cn/an/an/a
http://5.182.210.174/90c31en/an/an/a
http://5.182.210.174/176054n/an/an/a
http://5.182.210.174/b5d748n/an/an/a
http://5.182.210.174/a3493cn/an/an/a

Intelligence

File Origin
# of uploads :
2
# of downloads :
61
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive mirai
Link:
https://www.filescan.io/uploads/6a993d73bb6aacbcf3b3c47b/reports/b8c0531f-df83-4cf6-8e21-06e7d86b826f/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-09-03T07:27:00Z UTC
Last seen:
2026-09-03T08:44:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/87215b3e53c7cdcc76e7688eac0eb652562766d475c4a08ce10a9b8fef9fdcf0/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/51cf5ada-a015-4096-a17b-78b52b3296a4
Behavior Graph:
Download SVG
%3 guuid=d52b78f9-1600-0000-3df3-5fdbf70d0000 pid=3575 /usr/bin/sudo guuid=08ff51fc-1600-0000-3df3-5fdbfd0d0000 pid=3581 /tmp/sample.bin guuid=d52b78f9-1600-0000-3df3-5fdbf70d0000 pid=3575->guuid=08ff51fc-1600-0000-3df3-5fdbfd0d0000 pid=3581 execve guuid=5d924dfd-1600-0000-3df3-5fdb020e0000 pid=3586 /usr/bin/wget net send-data guuid=08ff51fc-1600-0000-3df3-5fdbfd0d0000 pid=3581->guuid=5d924dfd-1600-0000-3df3-5fdb020e0000 pid=3586 execve guuid=88b5f802-1700-0000-3df3-5fdb1f0e0000 pid=3615 /usr/bin/curl net send-data write-file guuid=08ff51fc-1600-0000-3df3-5fdbfd0d0000 pid=3581->guuid=88b5f802-1700-0000-3df3-5fdb1f0e0000 pid=3615 execve guuid=ede3740b-1700-0000-3df3-5fdb3d0e0000 pid=3645 /usr/bin/chmod guuid=08ff51fc-1600-0000-3df3-5fdbfd0d0000 pid=3581->guuid=ede3740b-1700-0000-3df3-5fdb3d0e0000 pid=3645 execve guuid=4ca5a90b-1700-0000-3df3-5fdb3e0e0000 pid=3646 /usr/bin/bash guuid=08ff51fc-1600-0000-3df3-5fdbfd0d0000 pid=3581->guuid=4ca5a90b-1700-0000-3df3-5fdb3e0e0000 pid=3646 clone guuid=d426d90b-1700-0000-3df3-5fdb410e0000 pid=3649 /usr/bin/rm delete-file guuid=08ff51fc-1600-0000-3df3-5fdbfd0d0000 pid=3581->guuid=d426d90b-1700-0000-3df3-5fdb410e0000 pid=3649 execve guuid=008b160c-1700-0000-3df3-5fdb430e0000 pid=3651 /usr/bin/rm guuid=08ff51fc-1600-0000-3df3-5fdbfd0d0000 pid=3581->guuid=008b160c-1700-0000-3df3-5fdb430e0000 pid=3651 execve guuid=2a254e0c-1700-0000-3df3-5fdb440e0000 pid=3652 /usr/bin/wget net send-data guuid=08ff51fc-1600-0000-3df3-5fdbfd0d0000 pid=3581->guuid=2a254e0c-1700-0000-3df3-5fdb440e0000 pid=3652 execve guuid=bc79dd0e-1700-0000-3df3-5fdb500e0000 pid=3664 /usr/bin/curl net send-data write-file guuid=08ff51fc-1600-0000-3df3-5fdbfd0d0000 pid=3581->guuid=bc79dd0e-1700-0000-3df3-5fdb500e0000 pid=3664 execve guuid=6f0aaf14-1700-0000-3df3-5fdb660e0000 pid=3686 /usr/bin/chmod guuid=08ff51fc-1600-0000-3df3-5fdbfd0d0000 pid=3581->guuid=6f0aaf14-1700-0000-3df3-5fdb660e0000 pid=3686 execve guuid=27482515-1700-0000-3df3-5fdb6a0e0000 pid=3690 /usr/bin/bash guuid=08ff51fc-1600-0000-3df3-5fdbfd0d0000 pid=3581->guuid=27482515-1700-0000-3df3-5fdb6a0e0000 pid=3690 clone guuid=b1c56e15-1700-0000-3df3-5fdb6e0e0000 pid=3694 /usr/bin/rm delete-file guuid=08ff51fc-1600-0000-3df3-5fdbfd0d0000 pid=3581->guuid=b1c56e15-1700-0000-3df3-5fdb6e0e0000 pid=3694 execve guuid=658efc15-1700-0000-3df3-5fdb720e0000 pid=3698 /usr/bin/rm guuid=08ff51fc-1600-0000-3df3-5fdbfd0d0000 pid=3581->guuid=658efc15-1700-0000-3df3-5fdb720e0000 pid=3698 execve guuid=e2745e16-1700-0000-3df3-5fdb750e0000 pid=3701 /usr/bin/wget net send-data guuid=08ff51fc-1600-0000-3df3-5fdbfd0d0000 pid=3581->guuid=e2745e16-1700-0000-3df3-5fdb750e0000 pid=3701 execve guuid=c2ebbf19-1700-0000-3df3-5fdb820e0000 pid=3714 /usr/bin/curl net send-data write-file guuid=08ff51fc-1600-0000-3df3-5fdbfd0d0000 pid=3581->guuid=c2ebbf19-1700-0000-3df3-5fdb820e0000 pid=3714 execve guuid=79f4e91e-1700-0000-3df3-5fdb8c0e0000 pid=3724 /usr/bin/chmod guuid=08ff51fc-1600-0000-3df3-5fdbfd0d0000 pid=3581->guuid=79f4e91e-1700-0000-3df3-5fdb8c0e0000 pid=3724 execve guuid=56335e1f-1700-0000-3df3-5fdb8f0e0000 pid=3727 /usr/bin/bash guuid=08ff51fc-1600-0000-3df3-5fdbfd0d0000 pid=3581->guuid=56335e1f-1700-0000-3df3-5fdb8f0e0000 pid=3727 clone guuid=853be71f-1700-0000-3df3-5fdb910e0000 pid=3729 /usr/bin/rm delete-file guuid=08ff51fc-1600-0000-3df3-5fdbfd0d0000 pid=3581->guuid=853be71f-1700-0000-3df3-5fdb910e0000 pid=3729 execve guuid=8f7b5220-1700-0000-3df3-5fdb920e0000 pid=3730 /usr/bin/rm guuid=08ff51fc-1600-0000-3df3-5fdbfd0d0000 pid=3581->guuid=8f7b5220-1700-0000-3df3-5fdb920e0000 pid=3730 execve guuid=7147b820-1700-0000-3df3-5fdb930e0000 pid=3731 /usr/bin/wget net send-data guuid=08ff51fc-1600-0000-3df3-5fdbfd0d0000 pid=3581->guuid=7147b820-1700-0000-3df3-5fdb930e0000 pid=3731 execve guuid=8625a824-1700-0000-3df3-5fdb9d0e0000 pid=3741 /usr/bin/curl net send-data write-file guuid=08ff51fc-1600-0000-3df3-5fdbfd0d0000 pid=3581->guuid=8625a824-1700-0000-3df3-5fdb9d0e0000 pid=3741 execve guuid=93986729-1700-0000-3df3-5fdba90e0000 pid=3753 /usr/bin/chmod guuid=08ff51fc-1600-0000-3df3-5fdbfd0d0000 pid=3581->guuid=93986729-1700-0000-3df3-5fdba90e0000 pid=3753 execve guuid=1d423c2a-1700-0000-3df3-5fdbad0e0000 pid=3757 /usr/bin/bash guuid=08ff51fc-1600-0000-3df3-5fdbfd0d0000 pid=3581->guuid=1d423c2a-1700-0000-3df3-5fdbad0e0000 pid=3757 clone guuid=1fac322b-1700-0000-3df3-5fdbb00e0000 pid=3760 /usr/bin/rm delete-file guuid=08ff51fc-1600-0000-3df3-5fdbfd0d0000 pid=3581->guuid=1fac322b-1700-0000-3df3-5fdbb00e0000 pid=3760 execve guuid=4616c32b-1700-0000-3df3-5fdbb40e0000 pid=3764 /usr/bin/rm guuid=08ff51fc-1600-0000-3df3-5fdbfd0d0000 pid=3581->guuid=4616c32b-1700-0000-3df3-5fdbb40e0000 pid=3764 execve guuid=cd43242c-1700-0000-3df3-5fdbb70e0000 pid=3767 /usr/bin/wget net send-data guuid=08ff51fc-1600-0000-3df3-5fdbfd0d0000 pid=3581->guuid=cd43242c-1700-0000-3df3-5fdbb70e0000 pid=3767 execve guuid=d9c4802e-1700-0000-3df3-5fdbc30e0000 pid=3779 /usr/bin/curl net send-data write-file guuid=08ff51fc-1600-0000-3df3-5fdbfd0d0000 pid=3581->guuid=d9c4802e-1700-0000-3df3-5fdbc30e0000 pid=3779 execve guuid=6b490232-1700-0000-3df3-5fdbd50e0000 pid=3797 /usr/bin/chmod guuid=08ff51fc-1600-0000-3df3-5fdbfd0d0000 pid=3581->guuid=6b490232-1700-0000-3df3-5fdbd50e0000 pid=3797 execve guuid=36844332-1700-0000-3df3-5fdbd60e0000 pid=3798 /usr/bin/bash guuid=08ff51fc-1600-0000-3df3-5fdbfd0d0000 pid=3581->guuid=36844332-1700-0000-3df3-5fdbd60e0000 pid=3798 clone guuid=a88f8232-1700-0000-3df3-5fdbdb0e0000 pid=3803 /usr/bin/rm delete-file guuid=08ff51fc-1600-0000-3df3-5fdbfd0d0000 pid=3581->guuid=a88f8232-1700-0000-3df3-5fdbdb0e0000 pid=3803 execve guuid=cb5ed432-1700-0000-3df3-5fdbdd0e0000 pid=3805 /usr/bin/rm guuid=08ff51fc-1600-0000-3df3-5fdbfd0d0000 pid=3581->guuid=cb5ed432-1700-0000-3df3-5fdbdd0e0000 pid=3805 execve guuid=97f12033-1700-0000-3df3-5fdbde0e0000 pid=3806 /usr/bin/wget net send-data guuid=08ff51fc-1600-0000-3df3-5fdbfd0d0000 pid=3581->guuid=97f12033-1700-0000-3df3-5fdbde0e0000 pid=3806 execve guuid=10d79635-1700-0000-3df3-5fdbeb0e0000 pid=3819 /usr/bin/curl net send-data write-file guuid=08ff51fc-1600-0000-3df3-5fdbfd0d0000 pid=3581->guuid=10d79635-1700-0000-3df3-5fdbeb0e0000 pid=3819 execve guuid=6adec138-1700-0000-3df3-5fdbf50e0000 pid=3829 /usr/bin/chmod guuid=08ff51fc-1600-0000-3df3-5fdbfd0d0000 pid=3581->guuid=6adec138-1700-0000-3df3-5fdbf50e0000 pid=3829 execve guuid=410e2639-1700-0000-3df3-5fdbf60e0000 pid=3830 /usr/bin/bash guuid=08ff51fc-1600-0000-3df3-5fdbfd0d0000 pid=3581->guuid=410e2639-1700-0000-3df3-5fdbf60e0000 pid=3830 clone guuid=b4eb6a39-1700-0000-3df3-5fdbfb0e0000 pid=3835 /usr/bin/rm delete-file guuid=08ff51fc-1600-0000-3df3-5fdbfd0d0000 pid=3581->guuid=b4eb6a39-1700-0000-3df3-5fdbfb0e0000 pid=3835 execve guuid=b381c739-1700-0000-3df3-5fdbfc0e0000 pid=3836 /usr/bin/rm guuid=08ff51fc-1600-0000-3df3-5fdbfd0d0000 pid=3581->guuid=b381c739-1700-0000-3df3-5fdbfc0e0000 pid=3836 execve guuid=71c70e3a-1700-0000-3df3-5fdbff0e0000 pid=3839 /usr/bin/wget net send-data guuid=08ff51fc-1600-0000-3df3-5fdbfd0d0000 pid=3581->guuid=71c70e3a-1700-0000-3df3-5fdbff0e0000 pid=3839 execve guuid=02176f3c-1700-0000-3df3-5fdb0c0f0000 pid=3852 /usr/bin/curl net send-data write-file guuid=08ff51fc-1600-0000-3df3-5fdbfd0d0000 pid=3581->guuid=02176f3c-1700-0000-3df3-5fdb0c0f0000 pid=3852 execve guuid=a450f53f-1700-0000-3df3-5fdb1d0f0000 pid=3869 /usr/bin/chmod guuid=08ff51fc-1600-0000-3df3-5fdbfd0d0000 pid=3581->guuid=a450f53f-1700-0000-3df3-5fdb1d0f0000 pid=3869 execve guuid=af834440-1700-0000-3df3-5fdb1e0f0000 pid=3870 /usr/bin/bash guuid=08ff51fc-1600-0000-3df3-5fdbfd0d0000 pid=3581->guuid=af834440-1700-0000-3df3-5fdb1e0f0000 pid=3870 clone guuid=962a8640-1700-0000-3df3-5fdb210f0000 pid=3873 /usr/bin/rm delete-file guuid=08ff51fc-1600-0000-3df3-5fdbfd0d0000 pid=3581->guuid=962a8640-1700-0000-3df3-5fdb210f0000 pid=3873 execve guuid=6472e340-1700-0000-3df3-5fdb230f0000 pid=3875 /usr/bin/rm guuid=08ff51fc-1600-0000-3df3-5fdbfd0d0000 pid=3581->guuid=6472e340-1700-0000-3df3-5fdb230f0000 pid=3875 execve guuid=2bb83b41-1700-0000-3df3-5fdb260f0000 pid=3878 /usr/bin/wget net send-data guuid=08ff51fc-1600-0000-3df3-5fdbfd0d0000 pid=3581->guuid=2bb83b41-1700-0000-3df3-5fdb260f0000 pid=3878 execve guuid=653ab743-1700-0000-3df3-5fdb330f0000 pid=3891 /usr/bin/curl net send-data write-file guuid=08ff51fc-1600-0000-3df3-5fdbfd0d0000 pid=3581->guuid=653ab743-1700-0000-3df3-5fdb330f0000 pid=3891 execve guuid=ecaa2247-1700-0000-3df3-5fdb420f0000 pid=3906 /usr/bin/chmod guuid=08ff51fc-1600-0000-3df3-5fdbfd0d0000 pid=3581->guuid=ecaa2247-1700-0000-3df3-5fdb420f0000 pid=3906 execve guuid=871c6247-1700-0000-3df3-5fdb440f0000 pid=3908 /usr/bin/bash guuid=08ff51fc-1600-0000-3df3-5fdbfd0d0000 pid=3581->guuid=871c6247-1700-0000-3df3-5fdb440f0000 pid=3908 clone guuid=ab96a547-1700-0000-3df3-5fdb470f0000 pid=3911 /usr/bin/rm delete-file guuid=08ff51fc-1600-0000-3df3-5fdbfd0d0000 pid=3581->guuid=ab96a547-1700-0000-3df3-5fdb470f0000 pid=3911 execve guuid=b49c0648-1700-0000-3df3-5fdb490f0000 pid=3913 /usr/bin/rm guuid=08ff51fc-1600-0000-3df3-5fdbfd0d0000 pid=3581->guuid=b49c0648-1700-0000-3df3-5fdb490f0000 pid=3913 execve guuid=2d275548-1700-0000-3df3-5fdb4b0f0000 pid=3915 /usr/bin/wget net send-data guuid=08ff51fc-1600-0000-3df3-5fdbfd0d0000 pid=3581->guuid=2d275548-1700-0000-3df3-5fdb4b0f0000 pid=3915 execve guuid=46a4024b-1700-0000-3df3-5fdb560f0000 pid=3926 /usr/bin/curl net send-data write-file guuid=08ff51fc-1600-0000-3df3-5fdbfd0d0000 pid=3581->guuid=46a4024b-1700-0000-3df3-5fdb560f0000 pid=3926 execve guuid=70a12450-1700-0000-3df3-5fdb6e0f0000 pid=3950 /usr/bin/chmod guuid=08ff51fc-1600-0000-3df3-5fdbfd0d0000 pid=3581->guuid=70a12450-1700-0000-3df3-5fdb6e0f0000 pid=3950 execve guuid=11a65b50-1700-0000-3df3-5fdb700f0000 pid=3952 /usr/bin/bash guuid=08ff51fc-1600-0000-3df3-5fdbfd0d0000 pid=3581->guuid=11a65b50-1700-0000-3df3-5fdb700f0000 pid=3952 clone guuid=de668550-1700-0000-3df3-5fdb720f0000 pid=3954 /usr/bin/rm delete-file guuid=08ff51fc-1600-0000-3df3-5fdbfd0d0000 pid=3581->guuid=de668550-1700-0000-3df3-5fdb720f0000 pid=3954 execve guuid=9c42c150-1700-0000-3df3-5fdb740f0000 pid=3956 /usr/bin/rm guuid=08ff51fc-1600-0000-3df3-5fdbfd0d0000 pid=3581->guuid=9c42c150-1700-0000-3df3-5fdb740f0000 pid=3956 execve guuid=7f63f750-1700-0000-3df3-5fdb750f0000 pid=3957 /usr/bin/wget net send-data guuid=08ff51fc-1600-0000-3df3-5fdbfd0d0000 pid=3581->guuid=7f63f750-1700-0000-3df3-5fdb750f0000 pid=3957 execve guuid=82806753-1700-0000-3df3-5fdb7e0f0000 pid=3966 /usr/bin/curl net send-data write-file guuid=08ff51fc-1600-0000-3df3-5fdbfd0d0000 pid=3581->guuid=82806753-1700-0000-3df3-5fdb7e0f0000 pid=3966 execve guuid=b35b1a57-1700-0000-3df3-5fdb8b0f0000 pid=3979 /usr/bin/chmod guuid=08ff51fc-1600-0000-3df3-5fdbfd0d0000 pid=3581->guuid=b35b1a57-1700-0000-3df3-5fdb8b0f0000 pid=3979 execve guuid=44f38f57-1700-0000-3df3-5fdb8e0f0000 pid=3982 /usr/bin/bash guuid=08ff51fc-1600-0000-3df3-5fdbfd0d0000 pid=3581->guuid=44f38f57-1700-0000-3df3-5fdb8e0f0000 pid=3982 clone guuid=2863c857-1700-0000-3df3-5fdb910f0000 pid=3985 /usr/bin/rm delete-file guuid=08ff51fc-1600-0000-3df3-5fdbfd0d0000 pid=3581->guuid=2863c857-1700-0000-3df3-5fdb910f0000 pid=3985 execve guuid=a87f0558-1700-0000-3df3-5fdb930f0000 pid=3987 /usr/bin/rm guuid=08ff51fc-1600-0000-3df3-5fdbfd0d0000 pid=3581->guuid=a87f0558-1700-0000-3df3-5fdb930f0000 pid=3987 execve guuid=59313e58-1700-0000-3df3-5fdb950f0000 pid=3989 /usr/bin/wget net send-data guuid=08ff51fc-1600-0000-3df3-5fdbfd0d0000 pid=3581->guuid=59313e58-1700-0000-3df3-5fdb950f0000 pid=3989 execve guuid=63c1fc5c-1700-0000-3df3-5fdbae0f0000 pid=4014 /usr/bin/curl net send-data write-file guuid=08ff51fc-1600-0000-3df3-5fdbfd0d0000 pid=3581->guuid=63c1fc5c-1700-0000-3df3-5fdbae0f0000 pid=4014 execve guuid=5698a260-1700-0000-3df3-5fdbbd0f0000 pid=4029 /usr/bin/chmod guuid=08ff51fc-1600-0000-3df3-5fdbfd0d0000 pid=3581->guuid=5698a260-1700-0000-3df3-5fdbbd0f0000 pid=4029 execve guuid=a871e160-1700-0000-3df3-5fdbbe0f0000 pid=4030 /usr/bin/bash guuid=08ff51fc-1600-0000-3df3-5fdbfd0d0000 pid=3581->guuid=a871e160-1700-0000-3df3-5fdbbe0f0000 pid=4030 clone guuid=f2891d61-1700-0000-3df3-5fdbc10f0000 pid=4033 /usr/bin/rm delete-file guuid=08ff51fc-1600-0000-3df3-5fdbfd0d0000 pid=3581->guuid=f2891d61-1700-0000-3df3-5fdbc10f0000 pid=4033 execve guuid=77fb7e61-1700-0000-3df3-5fdbc30f0000 pid=4035 /usr/bin/rm guuid=08ff51fc-1600-0000-3df3-5fdbfd0d0000 pid=3581->guuid=77fb7e61-1700-0000-3df3-5fdbc30f0000 pid=4035 execve guuid=d6dedd61-1700-0000-3df3-5fdbc40f0000 pid=4036 /usr/bin/wget net send-data guuid=08ff51fc-1600-0000-3df3-5fdbfd0d0000 pid=3581->guuid=d6dedd61-1700-0000-3df3-5fdbc40f0000 pid=4036 execve guuid=90953465-1700-0000-3df3-5fdbd20f0000 pid=4050 /usr/bin/curl net send-data write-file guuid=08ff51fc-1600-0000-3df3-5fdbfd0d0000 pid=3581->guuid=90953465-1700-0000-3df3-5fdbd20f0000 pid=4050 execve guuid=3d436b6a-1700-0000-3df3-5fdbdf0f0000 pid=4063 /usr/bin/chmod guuid=08ff51fc-1600-0000-3df3-5fdbfd0d0000 pid=3581->guuid=3d436b6a-1700-0000-3df3-5fdbdf0f0000 pid=4063 execve guuid=2bd0a76a-1700-0000-3df3-5fdbe00f0000 pid=4064 /usr/bin/bash guuid=08ff51fc-1600-0000-3df3-5fdbfd0d0000 pid=3581->guuid=2bd0a76a-1700-0000-3df3-5fdbe00f0000 pid=4064 clone guuid=eb06df6a-1700-0000-3df3-5fdbe20f0000 pid=4066 /usr/bin/rm delete-file guuid=08ff51fc-1600-0000-3df3-5fdbfd0d0000 pid=3581->guuid=eb06df6a-1700-0000-3df3-5fdbe20f0000 pid=4066 execve guuid=d9f3206b-1700-0000-3df3-5fdbe40f0000 pid=4068 /usr/bin/rm guuid=08ff51fc-1600-0000-3df3-5fdbfd0d0000 pid=3581->guuid=d9f3206b-1700-0000-3df3-5fdbe40f0000 pid=4068 execve 5b654972-c9e1-50d8-b372-2dc2a5b9ad66 5.182.210.174:80 guuid=5d924dfd-1600-0000-3df3-5fdb020e0000 pid=3586->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=88b5f802-1700-0000-3df3-5fdb1f0e0000 pid=3615->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=7068be0b-1700-0000-3df3-5fdb400e0000 pid=3648 /usr/bin/bash guuid=4ca5a90b-1700-0000-3df3-5fdb3e0e0000 pid=3646->guuid=7068be0b-1700-0000-3df3-5fdb400e0000 pid=3648 clone guuid=2a254e0c-1700-0000-3df3-5fdb440e0000 pid=3652->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=bc79dd0e-1700-0000-3df3-5fdb500e0000 pid=3664->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=fe3e4315-1700-0000-3df3-5fdb6b0e0000 pid=3691 /usr/bin/bash guuid=27482515-1700-0000-3df3-5fdb6a0e0000 pid=3690->guuid=fe3e4315-1700-0000-3df3-5fdb6b0e0000 pid=3691 clone guuid=e2745e16-1700-0000-3df3-5fdb750e0000 pid=3701->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=c2ebbf19-1700-0000-3df3-5fdb820e0000 pid=3714->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=f6c5821f-1700-0000-3df3-5fdb900e0000 pid=3728 /usr/bin/bash guuid=56335e1f-1700-0000-3df3-5fdb8f0e0000 pid=3727->guuid=f6c5821f-1700-0000-3df3-5fdb900e0000 pid=3728 clone guuid=7147b820-1700-0000-3df3-5fdb930e0000 pid=3731->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=8625a824-1700-0000-3df3-5fdb9d0e0000 pid=3741->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=b2cd152b-1700-0000-3df3-5fdbae0e0000 pid=3758 /usr/bin/bash guuid=1d423c2a-1700-0000-3df3-5fdbad0e0000 pid=3757->guuid=b2cd152b-1700-0000-3df3-5fdbae0e0000 pid=3758 clone guuid=cd43242c-1700-0000-3df3-5fdbb70e0000 pid=3767->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=d9c4802e-1700-0000-3df3-5fdbc30e0000 pid=3779->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=5d785a32-1700-0000-3df3-5fdbd70e0000 pid=3799 /usr/bin/bash guuid=36844332-1700-0000-3df3-5fdbd60e0000 pid=3798->guuid=5d785a32-1700-0000-3df3-5fdbd70e0000 pid=3799 clone guuid=97f12033-1700-0000-3df3-5fdbde0e0000 pid=3806->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=10d79635-1700-0000-3df3-5fdbeb0e0000 pid=3819->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=e2bd4639-1700-0000-3df3-5fdbfa0e0000 pid=3834 /usr/bin/bash guuid=410e2639-1700-0000-3df3-5fdbf60e0000 pid=3830->guuid=e2bd4639-1700-0000-3df3-5fdbfa0e0000 pid=3834 clone guuid=71c70e3a-1700-0000-3df3-5fdbff0e0000 pid=3839->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=02176f3c-1700-0000-3df3-5fdb0c0f0000 pid=3852->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=03a66440-1700-0000-3df3-5fdb200f0000 pid=3872 /usr/bin/bash guuid=af834440-1700-0000-3df3-5fdb1e0f0000 pid=3870->guuid=03a66440-1700-0000-3df3-5fdb200f0000 pid=3872 clone guuid=2bb83b41-1700-0000-3df3-5fdb260f0000 pid=3878->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=653ab743-1700-0000-3df3-5fdb330f0000 pid=3891->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=3f788047-1700-0000-3df3-5fdb460f0000 pid=3910 /usr/bin/bash guuid=871c6247-1700-0000-3df3-5fdb440f0000 pid=3908->guuid=3f788047-1700-0000-3df3-5fdb460f0000 pid=3910 clone guuid=2d275548-1700-0000-3df3-5fdb4b0f0000 pid=3915->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=46a4024b-1700-0000-3df3-5fdb560f0000 pid=3926->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=52ee6d50-1700-0000-3df3-5fdb710f0000 pid=3953 /usr/bin/bash guuid=11a65b50-1700-0000-3df3-5fdb700f0000 pid=3952->guuid=52ee6d50-1700-0000-3df3-5fdb710f0000 pid=3953 clone guuid=7f63f750-1700-0000-3df3-5fdb750f0000 pid=3957->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=82806753-1700-0000-3df3-5fdb7e0f0000 pid=3966->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=f4a2a557-1700-0000-3df3-5fdb8f0f0000 pid=3983 /usr/bin/bash guuid=44f38f57-1700-0000-3df3-5fdb8e0f0000 pid=3982->guuid=f4a2a557-1700-0000-3df3-5fdb8f0f0000 pid=3983 clone guuid=59313e58-1700-0000-3df3-5fdb950f0000 pid=3989->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=63c1fc5c-1700-0000-3df3-5fdbae0f0000 pid=4014->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=bf1ef560-1700-0000-3df3-5fdbc00f0000 pid=4032 /usr/bin/bash guuid=a871e160-1700-0000-3df3-5fdbbe0f0000 pid=4030->guuid=bf1ef560-1700-0000-3df3-5fdbc00f0000 pid=4032 clone guuid=d6dedd61-1700-0000-3df3-5fdbc40f0000 pid=4036->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=90953465-1700-0000-3df3-5fdbd20f0000 pid=4050->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=05a9bc6a-1700-0000-3df3-5fdbe10f0000 pid=4065 /usr/bin/bash guuid=2bd0a76a-1700-0000-3df3-5fdbe00f0000 pid=4064->guuid=05a9bc6a-1700-0000-3df3-5fdbe10f0000 pid=4065 clone
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/87215b3e53c7cdcc76e7688eac0eb652562766d475c4a08ce10a9b8fef9fdcf0
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/87215b3e53c7cdcc76e7688eac0eb652562766d475c4a08ce10a9b8fef9fdcf0/
Threat name:
Linux.Trojan.Egairtigado
Create hunting rule
Status:
Malicious
First seen:
2026-09-03 09:27:29 UTC
File Type:
Text (Shell)
AV detection:
13 of 24 (54.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=q4qvwpsty7g4y5xhnchkydvwkjlcozwuoxckbdhbbkny73473tya._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260903-levybsel6x/
Behaviour
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.11
Link:
https://yomi.yoroi.company/submissions/87215b3e53c7cdcc76e7688eac0eb652562766d475c4a08ce10a9b8fef9fdcf0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 87215b3e53c7cdcc76e7688eac0eb652562766d475c4a08ce10a9b8fef9fdcf0

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3897671/
  
Delivery method
Distributed via web download

Comments