MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 88d6da6160516cbaaebbdce25620e141deec7ef9cf91b0f1b06fde96e9ee2073. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 88d6da6160516cbaaebbdce25620e141deec7ef9cf91b0f1b06fde96e9ee2073
SHA3-384 hash: e790aec51757ccc59e537042ea13c8a85e85125eabdce34282542e1f57181a04eee851bd1493bb8babd0bb9165b10666
SHA1 hash: cc27c20e40bce0dd3b1fb22cbd6794b2d64d1578
MD5 hash: 8593602b1172dc83a6e5fa18867cdf69
humanhash: alanine-yellow-oxygen-seventeen
File name:ok
Download: download sample
File size:1'608 bytes
First seen:2026-08-26 07:48:27 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 24:bmmKOsrGz4fa49fCoXoXgzJgFcA5n09xv:bmGK9fCFXUkn03
TLSH T15731B6DA00542A319503CE9E73723548728EA9E72CAFC7D4D9480DEA92882CDF261F5F
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://5.182.210.174/b21d50n/an/an/a
http://5.182.210.174/6828a8n/an/an/a
http://5.182.210.174/3dd7afn/an/an/a
http://5.182.210.174/7ebbbfn/an/an/a
http://5.182.210.174/c0dbb1n/an/an/a
http://5.182.210.174/79dcffn/an/an/a
http://5.182.210.174/c66bd2n/an/an/a
http://5.182.210.174/950f12n/an/an/a
http://5.182.210.174/78cd01n/an/an/a
http://5.182.210.174/e62562n/an/an/a
http://5.182.210.174/6c2e1dn/an/an/a
http://5.182.210.174/1e4166n/an/an/a

Intelligence

File Origin
# of uploads :
1
# of downloads :
58
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/6191b1c0-1bb8-4689-bbd6-ce9779664636
Behavior Graph:
Download SVG
%3 guuid=3cfaeb18-1700-0000-f4fb-d67d060c0000 pid=3078 /usr/bin/sudo guuid=8fa17d1a-1700-0000-f4fb-d67d0c0c0000 pid=3084 /tmp/sample.bin guuid=3cfaeb18-1700-0000-f4fb-d67d060c0000 pid=3078->guuid=8fa17d1a-1700-0000-f4fb-d67d0c0c0000 pid=3084 execve guuid=904ffb1a-1700-0000-f4fb-d67d0d0c0000 pid=3085 /usr/bin/wget net send-data guuid=8fa17d1a-1700-0000-f4fb-d67d0c0c0000 pid=3084->guuid=904ffb1a-1700-0000-f4fb-d67d0d0c0000 pid=3085 execve guuid=a1c8e01f-1700-0000-f4fb-d67d180c0000 pid=3096 /usr/bin/curl net send-data write-file guuid=8fa17d1a-1700-0000-f4fb-d67d0c0c0000 pid=3084->guuid=a1c8e01f-1700-0000-f4fb-d67d180c0000 pid=3096 execve guuid=02f26b29-1700-0000-f4fb-d67d190c0000 pid=3097 /usr/bin/chmod guuid=8fa17d1a-1700-0000-f4fb-d67d0c0c0000 pid=3084->guuid=02f26b29-1700-0000-f4fb-d67d190c0000 pid=3097 execve guuid=9581d629-1700-0000-f4fb-d67d1a0c0000 pid=3098 /usr/bin/bash guuid=8fa17d1a-1700-0000-f4fb-d67d0c0c0000 pid=3084->guuid=9581d629-1700-0000-f4fb-d67d1a0c0000 pid=3098 clone guuid=f6253b2a-1700-0000-f4fb-d67d1c0c0000 pid=3100 /usr/bin/rm delete-file guuid=8fa17d1a-1700-0000-f4fb-d67d0c0c0000 pid=3084->guuid=f6253b2a-1700-0000-f4fb-d67d1c0c0000 pid=3100 execve guuid=edaf922a-1700-0000-f4fb-d67d1d0c0000 pid=3101 /usr/bin/rm guuid=8fa17d1a-1700-0000-f4fb-d67d0c0c0000 pid=3084->guuid=edaf922a-1700-0000-f4fb-d67d1d0c0000 pid=3101 execve guuid=09c8f02a-1700-0000-f4fb-d67d1e0c0000 pid=3102 /usr/bin/wget net send-data guuid=8fa17d1a-1700-0000-f4fb-d67d0c0c0000 pid=3084->guuid=09c8f02a-1700-0000-f4fb-d67d1e0c0000 pid=3102 execve guuid=1a0f862d-1700-0000-f4fb-d67d1f0c0000 pid=3103 /usr/bin/curl net send-data write-file guuid=8fa17d1a-1700-0000-f4fb-d67d0c0c0000 pid=3084->guuid=1a0f862d-1700-0000-f4fb-d67d1f0c0000 pid=3103 execve guuid=bad73e31-1700-0000-f4fb-d67d200c0000 pid=3104 /usr/bin/chmod guuid=8fa17d1a-1700-0000-f4fb-d67d0c0c0000 pid=3084->guuid=bad73e31-1700-0000-f4fb-d67d200c0000 pid=3104 execve guuid=d71d9731-1700-0000-f4fb-d67d210c0000 pid=3105 /usr/bin/bash guuid=8fa17d1a-1700-0000-f4fb-d67d0c0c0000 pid=3084->guuid=d71d9731-1700-0000-f4fb-d67d210c0000 pid=3105 clone guuid=f37dfa31-1700-0000-f4fb-d67d230c0000 pid=3107 /usr/bin/rm delete-file guuid=8fa17d1a-1700-0000-f4fb-d67d0c0c0000 pid=3084->guuid=f37dfa31-1700-0000-f4fb-d67d230c0000 pid=3107 execve guuid=f3785332-1700-0000-f4fb-d67d240c0000 pid=3108 /usr/bin/rm guuid=8fa17d1a-1700-0000-f4fb-d67d0c0c0000 pid=3084->guuid=f3785332-1700-0000-f4fb-d67d240c0000 pid=3108 execve guuid=bae29c32-1700-0000-f4fb-d67d250c0000 pid=3109 /usr/bin/wget net send-data guuid=8fa17d1a-1700-0000-f4fb-d67d0c0c0000 pid=3084->guuid=bae29c32-1700-0000-f4fb-d67d250c0000 pid=3109 execve guuid=4f279536-1700-0000-f4fb-d67d2d0c0000 pid=3117 /usr/bin/curl net send-data write-file guuid=8fa17d1a-1700-0000-f4fb-d67d0c0c0000 pid=3084->guuid=4f279536-1700-0000-f4fb-d67d2d0c0000 pid=3117 execve guuid=538f223b-1700-0000-f4fb-d67d350c0000 pid=3125 /usr/bin/chmod guuid=8fa17d1a-1700-0000-f4fb-d67d0c0c0000 pid=3084->guuid=538f223b-1700-0000-f4fb-d67d350c0000 pid=3125 execve guuid=d428743b-1700-0000-f4fb-d67d360c0000 pid=3126 /usr/bin/bash guuid=8fa17d1a-1700-0000-f4fb-d67d0c0c0000 pid=3084->guuid=d428743b-1700-0000-f4fb-d67d360c0000 pid=3126 clone guuid=a442b03b-1700-0000-f4fb-d67d380c0000 pid=3128 /usr/bin/rm delete-file guuid=8fa17d1a-1700-0000-f4fb-d67d0c0c0000 pid=3084->guuid=a442b03b-1700-0000-f4fb-d67d380c0000 pid=3128 execve guuid=23bbf33b-1700-0000-f4fb-d67d3a0c0000 pid=3130 /usr/bin/rm guuid=8fa17d1a-1700-0000-f4fb-d67d0c0c0000 pid=3084->guuid=23bbf33b-1700-0000-f4fb-d67d3a0c0000 pid=3130 execve guuid=f6f6373c-1700-0000-f4fb-d67d3b0c0000 pid=3131 /usr/bin/wget net send-data guuid=8fa17d1a-1700-0000-f4fb-d67d0c0c0000 pid=3084->guuid=f6f6373c-1700-0000-f4fb-d67d3b0c0000 pid=3131 execve guuid=eb77bc3e-1700-0000-f4fb-d67d420c0000 pid=3138 /usr/bin/curl net send-data write-file guuid=8fa17d1a-1700-0000-f4fb-d67d0c0c0000 pid=3084->guuid=eb77bc3e-1700-0000-f4fb-d67d420c0000 pid=3138 execve guuid=d728e642-1700-0000-f4fb-d67d430c0000 pid=3139 /usr/bin/chmod guuid=8fa17d1a-1700-0000-f4fb-d67d0c0c0000 pid=3084->guuid=d728e642-1700-0000-f4fb-d67d430c0000 pid=3139 execve guuid=45743f43-1700-0000-f4fb-d67d440c0000 pid=3140 /usr/bin/bash guuid=8fa17d1a-1700-0000-f4fb-d67d0c0c0000 pid=3084->guuid=45743f43-1700-0000-f4fb-d67d440c0000 pid=3140 clone guuid=27d68143-1700-0000-f4fb-d67d460c0000 pid=3142 /usr/bin/rm delete-file guuid=8fa17d1a-1700-0000-f4fb-d67d0c0c0000 pid=3084->guuid=27d68143-1700-0000-f4fb-d67d460c0000 pid=3142 execve guuid=bb4dd843-1700-0000-f4fb-d67d470c0000 pid=3143 /usr/bin/rm guuid=8fa17d1a-1700-0000-f4fb-d67d0c0c0000 pid=3084->guuid=bb4dd843-1700-0000-f4fb-d67d470c0000 pid=3143 execve guuid=9bcb2444-1700-0000-f4fb-d67d480c0000 pid=3144 /usr/bin/wget net send-data guuid=8fa17d1a-1700-0000-f4fb-d67d0c0c0000 pid=3084->guuid=9bcb2444-1700-0000-f4fb-d67d480c0000 pid=3144 execve guuid=af0ba446-1700-0000-f4fb-d67d4c0c0000 pid=3148 /usr/bin/curl net send-data write-file guuid=8fa17d1a-1700-0000-f4fb-d67d0c0c0000 pid=3084->guuid=af0ba446-1700-0000-f4fb-d67d4c0c0000 pid=3148 execve guuid=68796f4a-1700-0000-f4fb-d67d580c0000 pid=3160 /usr/bin/chmod guuid=8fa17d1a-1700-0000-f4fb-d67d0c0c0000 pid=3084->guuid=68796f4a-1700-0000-f4fb-d67d580c0000 pid=3160 execve guuid=8085aa4a-1700-0000-f4fb-d67d5a0c0000 pid=3162 /usr/bin/bash guuid=8fa17d1a-1700-0000-f4fb-d67d0c0c0000 pid=3084->guuid=8085aa4a-1700-0000-f4fb-d67d5a0c0000 pid=3162 clone guuid=36bee24a-1700-0000-f4fb-d67d5c0c0000 pid=3164 /usr/bin/rm delete-file guuid=8fa17d1a-1700-0000-f4fb-d67d0c0c0000 pid=3084->guuid=36bee24a-1700-0000-f4fb-d67d5c0c0000 pid=3164 execve guuid=957c204b-1700-0000-f4fb-d67d5e0c0000 pid=3166 /usr/bin/rm guuid=8fa17d1a-1700-0000-f4fb-d67d0c0c0000 pid=3084->guuid=957c204b-1700-0000-f4fb-d67d5e0c0000 pid=3166 execve guuid=15c5634b-1700-0000-f4fb-d67d600c0000 pid=3168 /usr/bin/wget net send-data guuid=8fa17d1a-1700-0000-f4fb-d67d0c0c0000 pid=3084->guuid=15c5634b-1700-0000-f4fb-d67d600c0000 pid=3168 execve guuid=9882be4d-1700-0000-f4fb-d67d650c0000 pid=3173 /usr/bin/curl net send-data write-file guuid=8fa17d1a-1700-0000-f4fb-d67d0c0c0000 pid=3084->guuid=9882be4d-1700-0000-f4fb-d67d650c0000 pid=3173 execve guuid=badfa452-1700-0000-f4fb-d67d6d0c0000 pid=3181 /usr/bin/chmod guuid=8fa17d1a-1700-0000-f4fb-d67d0c0c0000 pid=3084->guuid=badfa452-1700-0000-f4fb-d67d6d0c0000 pid=3181 execve guuid=aaf7dd52-1700-0000-f4fb-d67d6e0c0000 pid=3182 /usr/bin/bash guuid=8fa17d1a-1700-0000-f4fb-d67d0c0c0000 pid=3084->guuid=aaf7dd52-1700-0000-f4fb-d67d6e0c0000 pid=3182 clone guuid=02ab0e53-1700-0000-f4fb-d67d710c0000 pid=3185 /usr/bin/rm delete-file guuid=8fa17d1a-1700-0000-f4fb-d67d0c0c0000 pid=3084->guuid=02ab0e53-1700-0000-f4fb-d67d710c0000 pid=3185 execve guuid=675a4e53-1700-0000-f4fb-d67d730c0000 pid=3187 /usr/bin/rm guuid=8fa17d1a-1700-0000-f4fb-d67d0c0c0000 pid=3084->guuid=675a4e53-1700-0000-f4fb-d67d730c0000 pid=3187 execve guuid=e9b28953-1700-0000-f4fb-d67d750c0000 pid=3189 /usr/bin/wget net send-data guuid=8fa17d1a-1700-0000-f4fb-d67d0c0c0000 pid=3084->guuid=e9b28953-1700-0000-f4fb-d67d750c0000 pid=3189 execve guuid=c22f1456-1700-0000-f4fb-d67d7f0c0000 pid=3199 /usr/bin/curl net send-data write-file guuid=8fa17d1a-1700-0000-f4fb-d67d0c0c0000 pid=3084->guuid=c22f1456-1700-0000-f4fb-d67d7f0c0000 pid=3199 execve guuid=22b02b5b-1700-0000-f4fb-d67d900c0000 pid=3216 /usr/bin/chmod guuid=8fa17d1a-1700-0000-f4fb-d67d0c0c0000 pid=3084->guuid=22b02b5b-1700-0000-f4fb-d67d900c0000 pid=3216 execve guuid=f36c9d5b-1700-0000-f4fb-d67d930c0000 pid=3219 /usr/bin/bash guuid=8fa17d1a-1700-0000-f4fb-d67d0c0c0000 pid=3084->guuid=f36c9d5b-1700-0000-f4fb-d67d930c0000 pid=3219 clone guuid=b97dd95b-1700-0000-f4fb-d67d960c0000 pid=3222 /usr/bin/rm delete-file guuid=8fa17d1a-1700-0000-f4fb-d67d0c0c0000 pid=3084->guuid=b97dd95b-1700-0000-f4fb-d67d960c0000 pid=3222 execve guuid=37af195c-1700-0000-f4fb-d67d970c0000 pid=3223 /usr/bin/rm guuid=8fa17d1a-1700-0000-f4fb-d67d0c0c0000 pid=3084->guuid=37af195c-1700-0000-f4fb-d67d970c0000 pid=3223 execve guuid=ad7a5e5c-1700-0000-f4fb-d67d990c0000 pid=3225 /usr/bin/wget net send-data guuid=8fa17d1a-1700-0000-f4fb-d67d0c0c0000 pid=3084->guuid=ad7a5e5c-1700-0000-f4fb-d67d990c0000 pid=3225 execve guuid=80ff135f-1700-0000-f4fb-d67da20c0000 pid=3234 /usr/bin/curl net send-data write-file guuid=8fa17d1a-1700-0000-f4fb-d67d0c0c0000 pid=3084->guuid=80ff135f-1700-0000-f4fb-d67da20c0000 pid=3234 execve guuid=bd528162-1700-0000-f4fb-d67db10c0000 pid=3249 /usr/bin/chmod guuid=8fa17d1a-1700-0000-f4fb-d67d0c0c0000 pid=3084->guuid=bd528162-1700-0000-f4fb-d67db10c0000 pid=3249 execve guuid=129fc462-1700-0000-f4fb-d67db30c0000 pid=3251 /usr/bin/bash guuid=8fa17d1a-1700-0000-f4fb-d67d0c0c0000 pid=3084->guuid=129fc462-1700-0000-f4fb-d67db30c0000 pid=3251 clone guuid=2ab1f862-1700-0000-f4fb-d67db50c0000 pid=3253 /usr/bin/rm delete-file guuid=8fa17d1a-1700-0000-f4fb-d67d0c0c0000 pid=3084->guuid=2ab1f862-1700-0000-f4fb-d67db50c0000 pid=3253 execve guuid=b1243663-1700-0000-f4fb-d67db80c0000 pid=3256 /usr/bin/rm guuid=8fa17d1a-1700-0000-f4fb-d67d0c0c0000 pid=3084->guuid=b1243663-1700-0000-f4fb-d67db80c0000 pid=3256 execve guuid=a8b27263-1700-0000-f4fb-d67db90c0000 pid=3257 /usr/bin/wget net send-data guuid=8fa17d1a-1700-0000-f4fb-d67d0c0c0000 pid=3084->guuid=a8b27263-1700-0000-f4fb-d67db90c0000 pid=3257 execve guuid=99a02a66-1700-0000-f4fb-d67dc10c0000 pid=3265 /usr/bin/curl net send-data write-file guuid=8fa17d1a-1700-0000-f4fb-d67d0c0c0000 pid=3084->guuid=99a02a66-1700-0000-f4fb-d67dc10c0000 pid=3265 execve guuid=a6508b6c-1700-0000-f4fb-d67dc30c0000 pid=3267 /usr/bin/chmod guuid=8fa17d1a-1700-0000-f4fb-d67d0c0c0000 pid=3084->guuid=a6508b6c-1700-0000-f4fb-d67dc30c0000 pid=3267 execve guuid=394ae56c-1700-0000-f4fb-d67dc40c0000 pid=3268 /usr/bin/bash guuid=8fa17d1a-1700-0000-f4fb-d67d0c0c0000 pid=3084->guuid=394ae56c-1700-0000-f4fb-d67dc40c0000 pid=3268 clone guuid=ec28476d-1700-0000-f4fb-d67dc70c0000 pid=3271 /usr/bin/rm delete-file guuid=8fa17d1a-1700-0000-f4fb-d67d0c0c0000 pid=3084->guuid=ec28476d-1700-0000-f4fb-d67dc70c0000 pid=3271 execve guuid=02d1926d-1700-0000-f4fb-d67dc90c0000 pid=3273 /usr/bin/rm guuid=8fa17d1a-1700-0000-f4fb-d67d0c0c0000 pid=3084->guuid=02d1926d-1700-0000-f4fb-d67dc90c0000 pid=3273 execve guuid=9a0ad56d-1700-0000-f4fb-d67dcb0c0000 pid=3275 /usr/bin/wget net send-data guuid=8fa17d1a-1700-0000-f4fb-d67d0c0c0000 pid=3084->guuid=9a0ad56d-1700-0000-f4fb-d67dcb0c0000 pid=3275 execve guuid=42ab2271-1700-0000-f4fb-d67dd40c0000 pid=3284 /usr/bin/curl net send-data write-file guuid=8fa17d1a-1700-0000-f4fb-d67d0c0c0000 pid=3084->guuid=42ab2271-1700-0000-f4fb-d67dd40c0000 pid=3284 execve guuid=8977b778-1700-0000-f4fb-d67de30c0000 pid=3299 /usr/bin/chmod guuid=8fa17d1a-1700-0000-f4fb-d67d0c0c0000 pid=3084->guuid=8977b778-1700-0000-f4fb-d67de30c0000 pid=3299 execve guuid=29450679-1700-0000-f4fb-d67de40c0000 pid=3300 /usr/bin/bash guuid=8fa17d1a-1700-0000-f4fb-d67d0c0c0000 pid=3084->guuid=29450679-1700-0000-f4fb-d67de40c0000 pid=3300 clone guuid=38ac4979-1700-0000-f4fb-d67de60c0000 pid=3302 /usr/bin/rm delete-file guuid=8fa17d1a-1700-0000-f4fb-d67d0c0c0000 pid=3084->guuid=38ac4979-1700-0000-f4fb-d67de60c0000 pid=3302 execve guuid=ce489179-1700-0000-f4fb-d67de70c0000 pid=3303 /usr/bin/rm guuid=8fa17d1a-1700-0000-f4fb-d67d0c0c0000 pid=3084->guuid=ce489179-1700-0000-f4fb-d67de70c0000 pid=3303 execve guuid=18c2d579-1700-0000-f4fb-d67de80c0000 pid=3304 /usr/bin/wget net send-data guuid=8fa17d1a-1700-0000-f4fb-d67d0c0c0000 pid=3084->guuid=18c2d579-1700-0000-f4fb-d67de80c0000 pid=3304 execve guuid=da155a7c-1700-0000-f4fb-d67ded0c0000 pid=3309 /usr/bin/curl net send-data write-file guuid=8fa17d1a-1700-0000-f4fb-d67d0c0c0000 pid=3084->guuid=da155a7c-1700-0000-f4fb-d67ded0c0000 pid=3309 execve guuid=6b97c27f-1700-0000-f4fb-d67df70c0000 pid=3319 /usr/bin/chmod guuid=8fa17d1a-1700-0000-f4fb-d67d0c0c0000 pid=3084->guuid=6b97c27f-1700-0000-f4fb-d67df70c0000 pid=3319 execve guuid=2aa51280-1700-0000-f4fb-d67df90c0000 pid=3321 /usr/bin/bash guuid=8fa17d1a-1700-0000-f4fb-d67d0c0c0000 pid=3084->guuid=2aa51280-1700-0000-f4fb-d67df90c0000 pid=3321 clone guuid=35e95580-1700-0000-f4fb-d67dfd0c0000 pid=3325 /usr/bin/rm delete-file guuid=8fa17d1a-1700-0000-f4fb-d67d0c0c0000 pid=3084->guuid=35e95580-1700-0000-f4fb-d67dfd0c0000 pid=3325 execve guuid=207fa080-1700-0000-f4fb-d67dff0c0000 pid=3327 /usr/bin/rm guuid=8fa17d1a-1700-0000-f4fb-d67d0c0c0000 pid=3084->guuid=207fa080-1700-0000-f4fb-d67dff0c0000 pid=3327 execve guuid=cef0f080-1700-0000-f4fb-d67d010d0000 pid=3329 /usr/bin/wget net send-data guuid=8fa17d1a-1700-0000-f4fb-d67d0c0c0000 pid=3084->guuid=cef0f080-1700-0000-f4fb-d67d010d0000 pid=3329 execve guuid=ec7d5f83-1700-0000-f4fb-d67d0b0d0000 pid=3339 /usr/bin/curl net send-data write-file guuid=8fa17d1a-1700-0000-f4fb-d67d0c0c0000 pid=3084->guuid=ec7d5f83-1700-0000-f4fb-d67d0b0d0000 pid=3339 execve guuid=64ed1b88-1700-0000-f4fb-d67d1c0d0000 pid=3356 /usr/bin/chmod guuid=8fa17d1a-1700-0000-f4fb-d67d0c0c0000 pid=3084->guuid=64ed1b88-1700-0000-f4fb-d67d1c0d0000 pid=3356 execve guuid=708c6288-1700-0000-f4fb-d67d1e0d0000 pid=3358 /usr/bin/bash guuid=8fa17d1a-1700-0000-f4fb-d67d0c0c0000 pid=3084->guuid=708c6288-1700-0000-f4fb-d67d1e0d0000 pid=3358 clone guuid=fb0fa088-1700-0000-f4fb-d67d210d0000 pid=3361 /usr/bin/rm delete-file guuid=8fa17d1a-1700-0000-f4fb-d67d0c0c0000 pid=3084->guuid=fb0fa088-1700-0000-f4fb-d67d210d0000 pid=3361 execve guuid=885fe988-1700-0000-f4fb-d67d230d0000 pid=3363 /usr/bin/rm guuid=8fa17d1a-1700-0000-f4fb-d67d0c0c0000 pid=3084->guuid=885fe988-1700-0000-f4fb-d67d230d0000 pid=3363 execve 5b654972-c9e1-50d8-b372-2dc2a5b9ad66 5.182.210.174:80 guuid=904ffb1a-1700-0000-f4fb-d67d0d0c0000 pid=3085->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=a1c8e01f-1700-0000-f4fb-d67d180c0000 pid=3096->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=ccecf629-1700-0000-f4fb-d67d1b0c0000 pid=3099 /usr/bin/bash guuid=9581d629-1700-0000-f4fb-d67d1a0c0000 pid=3098->guuid=ccecf629-1700-0000-f4fb-d67d1b0c0000 pid=3099 clone guuid=09c8f02a-1700-0000-f4fb-d67d1e0c0000 pid=3102->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=1a0f862d-1700-0000-f4fb-d67d1f0c0000 pid=3103->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=2d7ab731-1700-0000-f4fb-d67d220c0000 pid=3106 /usr/bin/bash guuid=d71d9731-1700-0000-f4fb-d67d210c0000 pid=3105->guuid=2d7ab731-1700-0000-f4fb-d67d220c0000 pid=3106 clone guuid=bae29c32-1700-0000-f4fb-d67d250c0000 pid=3109->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=4f279536-1700-0000-f4fb-d67d2d0c0000 pid=3117->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=79918e3b-1700-0000-f4fb-d67d370c0000 pid=3127 /usr/bin/bash guuid=d428743b-1700-0000-f4fb-d67d360c0000 pid=3126->guuid=79918e3b-1700-0000-f4fb-d67d370c0000 pid=3127 clone guuid=f6f6373c-1700-0000-f4fb-d67d3b0c0000 pid=3131->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=eb77bc3e-1700-0000-f4fb-d67d420c0000 pid=3138->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=c0ae5c43-1700-0000-f4fb-d67d450c0000 pid=3141 /usr/bin/bash guuid=45743f43-1700-0000-f4fb-d67d440c0000 pid=3140->guuid=c0ae5c43-1700-0000-f4fb-d67d450c0000 pid=3141 clone guuid=9bcb2444-1700-0000-f4fb-d67d480c0000 pid=3144->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=af0ba446-1700-0000-f4fb-d67d4c0c0000 pid=3148->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=0ee8c44a-1700-0000-f4fb-d67d5b0c0000 pid=3163 /usr/bin/bash guuid=8085aa4a-1700-0000-f4fb-d67d5a0c0000 pid=3162->guuid=0ee8c44a-1700-0000-f4fb-d67d5b0c0000 pid=3163 clone guuid=15c5634b-1700-0000-f4fb-d67d600c0000 pid=3168->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=9882be4d-1700-0000-f4fb-d67d650c0000 pid=3173->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=612ef252-1700-0000-f4fb-d67d700c0000 pid=3184 /usr/bin/bash guuid=aaf7dd52-1700-0000-f4fb-d67d6e0c0000 pid=3182->guuid=612ef252-1700-0000-f4fb-d67d700c0000 pid=3184 clone guuid=e9b28953-1700-0000-f4fb-d67d750c0000 pid=3189->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=c22f1456-1700-0000-f4fb-d67d7f0c0000 pid=3199->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=b046ba5b-1700-0000-f4fb-d67d940c0000 pid=3220 /usr/bin/bash guuid=f36c9d5b-1700-0000-f4fb-d67d930c0000 pid=3219->guuid=b046ba5b-1700-0000-f4fb-d67d940c0000 pid=3220 clone guuid=ad7a5e5c-1700-0000-f4fb-d67d990c0000 pid=3225->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=80ff135f-1700-0000-f4fb-d67da20c0000 pid=3234->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=c9b6d762-1700-0000-f4fb-d67db40c0000 pid=3252 /usr/bin/bash guuid=129fc462-1700-0000-f4fb-d67db30c0000 pid=3251->guuid=c9b6d762-1700-0000-f4fb-d67db40c0000 pid=3252 clone guuid=a8b27263-1700-0000-f4fb-d67db90c0000 pid=3257->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=99a02a66-1700-0000-f4fb-d67dc10c0000 pid=3265->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=00bc056d-1700-0000-f4fb-d67dc50c0000 pid=3269 /usr/bin/bash guuid=394ae56c-1700-0000-f4fb-d67dc40c0000 pid=3268->guuid=00bc056d-1700-0000-f4fb-d67dc50c0000 pid=3269 clone guuid=9a0ad56d-1700-0000-f4fb-d67dcb0c0000 pid=3275->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=42ab2271-1700-0000-f4fb-d67dd40c0000 pid=3284->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=a7f52179-1700-0000-f4fb-d67de50c0000 pid=3301 /usr/bin/bash guuid=29450679-1700-0000-f4fb-d67de40c0000 pid=3300->guuid=a7f52179-1700-0000-f4fb-d67de50c0000 pid=3301 clone guuid=18c2d579-1700-0000-f4fb-d67de80c0000 pid=3304->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=da155a7c-1700-0000-f4fb-d67ded0c0000 pid=3309->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=2ec73080-1700-0000-f4fb-d67dfb0c0000 pid=3323 /usr/bin/bash guuid=2aa51280-1700-0000-f4fb-d67df90c0000 pid=3321->guuid=2ec73080-1700-0000-f4fb-d67dfb0c0000 pid=3323 clone guuid=cef0f080-1700-0000-f4fb-d67d010d0000 pid=3329->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=ec7d5f83-1700-0000-f4fb-d67d0b0d0000 pid=3339->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=9fc67a88-1700-0000-f4fb-d67d200d0000 pid=3360 /usr/bin/bash guuid=708c6288-1700-0000-f4fb-d67d1e0d0000 pid=3358->guuid=9fc67a88-1700-0000-f4fb-d67d200d0000 pid=3360 clone
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/88d6da6160516cbaaebbdce25620e141deec7ef9cf91b0f1b06fde96e9ee2073
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/88d6da6160516cbaaebbdce25620e141deec7ef9cf91b0f1b06fde96e9ee2073/
Gathering data
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rdlnuylakfwlvlv33trfmihbihpoy7xzz6i3b4nqn7pjn2poebzq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260826-jnrk6aal5s/
Behaviour
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.11
Link:
https://yomi.yoroi.company/submissions/88d6da6160516cbaaebbdce25620e141deec7ef9cf91b0f1b06fde96e9ee2073

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 88d6da6160516cbaaebbdce25620e141deec7ef9cf91b0f1b06fde96e9ee2073

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3897671/
  
Delivery method
Distributed via web download

Comments