🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8e51bf24dfd69bcc6e4f6677fd813a55a39523a0d5528263b8cf43dec5597863. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8e51bf24dfd69bcc6e4f6677fd813a55a39523a0d5528263b8cf43dec5597863
SHA3-384 hash: 7cefebedde88e95ed03f9c2c8a95eea1d1c428558f430d26522fb3a5c018975f4cb237f55cf9dc50fd6d3b763b4e90cc
SHA1 hash: 5c945b65218d8508aff01d4972f7827ce0c8796f
MD5 hash: 0071f274ac936cd4a51245d6a7b41eda
humanhash: bravo-cat-stairway-july
File name:p
Download: download sample
File size:835 bytes
First seen:2026-07-12 12:22:37 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkavCfpzj7CUk/1aFCs7jxCtZNSClauD:kXCKysE2hi0ziQvZohavAz315bN4Sk7
TLSH T1CF01A6CA85C0EE00506A8A5E72E76290F821D3CE054A0B687F9C5D7EFBC8905F066EC8
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://129.121.114.124/v9EBn/an/aelf ua-wget
http://129.121.114.124/Qcln/an/aelf ua-wget
http://129.121.114.124/uckn/an/aelf ua-wget
http://129.121.114.124/82D6n/an/aelf ua-wget
http://129.121.114.124/AfNn/an/aelf ua-wget

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive
Link:
https://www.filescan.io/uploads/6a53873e3809b8ba45124fce/reports/7c6d4240-698e-4a12-9956-c66cce6845dc/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-07-12T10:32:00Z UTC
Last seen:
2026-07-13T20:16:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/8e51bf24dfd69bcc6e4f6677fd813a55a39523a0d5528263b8cf43dec5597863/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/df2e641e-3549-406c-9c72-dbaa62cf7d5b
Behavior Graph:
Download SVG
%3 guuid=b9adc979-1900-0000-7b36-f12c080f0000 pid=3848 /usr/bin/sudo guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869 /tmp/sample.bin write-file guuid=b9adc979-1900-0000-7b36-f12c080f0000 pid=3848->guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869 execve guuid=6616d67d-1900-0000-7b36-f12c1e0f0000 pid=3870 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=6616d67d-1900-0000-7b36-f12c1e0f0000 pid=3870 execve guuid=f579fb7e-1900-0000-7b36-f12c220f0000 pid=3874 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=f579fb7e-1900-0000-7b36-f12c220f0000 pid=3874 execve guuid=fa69907f-1900-0000-7b36-f12c250f0000 pid=3877 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=fa69907f-1900-0000-7b36-f12c250f0000 pid=3877 execve guuid=85432180-1900-0000-7b36-f12c290f0000 pid=3881 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=85432180-1900-0000-7b36-f12c290f0000 pid=3881 execve guuid=5594c080-1900-0000-7b36-f12c2c0f0000 pid=3884 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=5594c080-1900-0000-7b36-f12c2c0f0000 pid=3884 execve guuid=04393781-1900-0000-7b36-f12c2f0f0000 pid=3887 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=04393781-1900-0000-7b36-f12c2f0f0000 pid=3887 execve guuid=aa66e981-1900-0000-7b36-f12c320f0000 pid=3890 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=aa66e981-1900-0000-7b36-f12c320f0000 pid=3890 execve guuid=2ce29a82-1900-0000-7b36-f12c330f0000 pid=3891 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=2ce29a82-1900-0000-7b36-f12c330f0000 pid=3891 execve guuid=914b5983-1900-0000-7b36-f12c370f0000 pid=3895 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=914b5983-1900-0000-7b36-f12c370f0000 pid=3895 execve guuid=d63c0484-1900-0000-7b36-f12c380f0000 pid=3896 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=d63c0484-1900-0000-7b36-f12c380f0000 pid=3896 execve guuid=973a7584-1900-0000-7b36-f12c3b0f0000 pid=3899 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=973a7584-1900-0000-7b36-f12c3b0f0000 pid=3899 execve guuid=3ae1d484-1900-0000-7b36-f12c3d0f0000 pid=3901 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=3ae1d484-1900-0000-7b36-f12c3d0f0000 pid=3901 execve guuid=7a2f4385-1900-0000-7b36-f12c410f0000 pid=3905 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=7a2f4385-1900-0000-7b36-f12c410f0000 pid=3905 execve guuid=3e4ebd85-1900-0000-7b36-f12c420f0000 pid=3906 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=3e4ebd85-1900-0000-7b36-f12c420f0000 pid=3906 execve guuid=c0402e86-1900-0000-7b36-f12c460f0000 pid=3910 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=c0402e86-1900-0000-7b36-f12c460f0000 pid=3910 execve guuid=74dcb586-1900-0000-7b36-f12c4a0f0000 pid=3914 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=74dcb586-1900-0000-7b36-f12c4a0f0000 pid=3914 execve guuid=40275787-1900-0000-7b36-f12c4c0f0000 pid=3916 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=40275787-1900-0000-7b36-f12c4c0f0000 pid=3916 execve guuid=def3e487-1900-0000-7b36-f12c4e0f0000 pid=3918 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=def3e487-1900-0000-7b36-f12c4e0f0000 pid=3918 execve guuid=128c8888-1900-0000-7b36-f12c510f0000 pid=3921 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=128c8888-1900-0000-7b36-f12c510f0000 pid=3921 execve guuid=4e942589-1900-0000-7b36-f12c540f0000 pid=3924 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=4e942589-1900-0000-7b36-f12c540f0000 pid=3924 execve guuid=b75ebf89-1900-0000-7b36-f12c570f0000 pid=3927 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=b75ebf89-1900-0000-7b36-f12c570f0000 pid=3927 execve guuid=19b94f8a-1900-0000-7b36-f12c5a0f0000 pid=3930 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=19b94f8a-1900-0000-7b36-f12c5a0f0000 pid=3930 execve guuid=a1e2ac8a-1900-0000-7b36-f12c5c0f0000 pid=3932 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=a1e2ac8a-1900-0000-7b36-f12c5c0f0000 pid=3932 execve guuid=4c4f368b-1900-0000-7b36-f12c600f0000 pid=3936 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=4c4f368b-1900-0000-7b36-f12c600f0000 pid=3936 execve guuid=4ba19e8b-1900-0000-7b36-f12c630f0000 pid=3939 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=4ba19e8b-1900-0000-7b36-f12c630f0000 pid=3939 execve guuid=f054528c-1900-0000-7b36-f12c660f0000 pid=3942 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=f054528c-1900-0000-7b36-f12c660f0000 pid=3942 execve guuid=a3b6d68c-1900-0000-7b36-f12c680f0000 pid=3944 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=a3b6d68c-1900-0000-7b36-f12c680f0000 pid=3944 execve guuid=3c44898d-1900-0000-7b36-f12c6b0f0000 pid=3947 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=3c44898d-1900-0000-7b36-f12c6b0f0000 pid=3947 execve guuid=e25c0d8e-1900-0000-7b36-f12c6d0f0000 pid=3949 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=e25c0d8e-1900-0000-7b36-f12c6d0f0000 pid=3949 execve guuid=3ff3868e-1900-0000-7b36-f12c710f0000 pid=3953 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=3ff3868e-1900-0000-7b36-f12c710f0000 pid=3953 execve guuid=c228ff8e-1900-0000-7b36-f12c750f0000 pid=3957 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=c228ff8e-1900-0000-7b36-f12c750f0000 pid=3957 execve guuid=479e7e8f-1900-0000-7b36-f12c770f0000 pid=3959 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=479e7e8f-1900-0000-7b36-f12c770f0000 pid=3959 execve guuid=472a1090-1900-0000-7b36-f12c7c0f0000 pid=3964 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=472a1090-1900-0000-7b36-f12c7c0f0000 pid=3964 execve guuid=3eb16a90-1900-0000-7b36-f12c7d0f0000 pid=3965 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=3eb16a90-1900-0000-7b36-f12c7d0f0000 pid=3965 execve guuid=e1f95791-1900-0000-7b36-f12c820f0000 pid=3970 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=e1f95791-1900-0000-7b36-f12c820f0000 pid=3970 execve guuid=bd0ef191-1900-0000-7b36-f12c860f0000 pid=3974 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=bd0ef191-1900-0000-7b36-f12c860f0000 pid=3974 execve guuid=ce4c5e92-1900-0000-7b36-f12c880f0000 pid=3976 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=ce4c5e92-1900-0000-7b36-f12c880f0000 pid=3976 execve guuid=9878fd92-1900-0000-7b36-f12c8b0f0000 pid=3979 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=9878fd92-1900-0000-7b36-f12c8b0f0000 pid=3979 execve guuid=a3f26493-1900-0000-7b36-f12c8f0f0000 pid=3983 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=a3f26493-1900-0000-7b36-f12c8f0f0000 pid=3983 execve guuid=0ef30794-1900-0000-7b36-f12c940f0000 pid=3988 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=0ef30794-1900-0000-7b36-f12c940f0000 pid=3988 execve guuid=d6306594-1900-0000-7b36-f12c960f0000 pid=3990 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=d6306594-1900-0000-7b36-f12c960f0000 pid=3990 execve guuid=0662c194-1900-0000-7b36-f12c980f0000 pid=3992 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=0662c194-1900-0000-7b36-f12c980f0000 pid=3992 execve guuid=c1a41595-1900-0000-7b36-f12c9a0f0000 pid=3994 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=c1a41595-1900-0000-7b36-f12c9a0f0000 pid=3994 execve guuid=ff7e6f95-1900-0000-7b36-f12c9c0f0000 pid=3996 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=ff7e6f95-1900-0000-7b36-f12c9c0f0000 pid=3996 execve guuid=3c87ce95-1900-0000-7b36-f12c9e0f0000 pid=3998 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=3c87ce95-1900-0000-7b36-f12c9e0f0000 pid=3998 execve guuid=abc43696-1900-0000-7b36-f12ca10f0000 pid=4001 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=abc43696-1900-0000-7b36-f12ca10f0000 pid=4001 execve guuid=49c9a196-1900-0000-7b36-f12ca20f0000 pid=4002 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=49c9a196-1900-0000-7b36-f12ca20f0000 pid=4002 execve guuid=31b90597-1900-0000-7b36-f12ca40f0000 pid=4004 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=31b90597-1900-0000-7b36-f12ca40f0000 pid=4004 execve guuid=05cf5d97-1900-0000-7b36-f12ca50f0000 pid=4005 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=05cf5d97-1900-0000-7b36-f12ca50f0000 pid=4005 execve guuid=14dbc197-1900-0000-7b36-f12ca90f0000 pid=4009 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=14dbc197-1900-0000-7b36-f12ca90f0000 pid=4009 execve guuid=14532698-1900-0000-7b36-f12caa0f0000 pid=4010 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=14532698-1900-0000-7b36-f12caa0f0000 pid=4010 execve guuid=907d8a98-1900-0000-7b36-f12cae0f0000 pid=4014 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=907d8a98-1900-0000-7b36-f12cae0f0000 pid=4014 execve guuid=ea50e198-1900-0000-7b36-f12cb00f0000 pid=4016 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=ea50e198-1900-0000-7b36-f12cb00f0000 pid=4016 execve guuid=e2ae3f99-1900-0000-7b36-f12cb30f0000 pid=4019 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=e2ae3f99-1900-0000-7b36-f12cb30f0000 pid=4019 execve guuid=ad229a99-1900-0000-7b36-f12cb60f0000 pid=4022 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=ad229a99-1900-0000-7b36-f12cb60f0000 pid=4022 execve guuid=16aafe99-1900-0000-7b36-f12cba0f0000 pid=4026 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=16aafe99-1900-0000-7b36-f12cba0f0000 pid=4026 execve guuid=d9775a9a-1900-0000-7b36-f12cbd0f0000 pid=4029 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=d9775a9a-1900-0000-7b36-f12cbd0f0000 pid=4029 execve guuid=fea5b89a-1900-0000-7b36-f12cbf0f0000 pid=4031 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=fea5b89a-1900-0000-7b36-f12cbf0f0000 pid=4031 execve guuid=3f5b079b-1900-0000-7b36-f12cc10f0000 pid=4033 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=3f5b079b-1900-0000-7b36-f12cc10f0000 pid=4033 execve guuid=9ff7599b-1900-0000-7b36-f12cc40f0000 pid=4036 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=9ff7599b-1900-0000-7b36-f12cc40f0000 pid=4036 execve guuid=db05b39b-1900-0000-7b36-f12cc60f0000 pid=4038 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=db05b39b-1900-0000-7b36-f12cc60f0000 pid=4038 execve guuid=177b0c9c-1900-0000-7b36-f12cc90f0000 pid=4041 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=177b0c9c-1900-0000-7b36-f12cc90f0000 pid=4041 execve guuid=a4cd669c-1900-0000-7b36-f12cca0f0000 pid=4042 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=a4cd669c-1900-0000-7b36-f12cca0f0000 pid=4042 execve guuid=a658e09c-1900-0000-7b36-f12cce0f0000 pid=4046 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=a658e09c-1900-0000-7b36-f12cce0f0000 pid=4046 execve guuid=30315c9d-1900-0000-7b36-f12cd10f0000 pid=4049 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=30315c9d-1900-0000-7b36-f12cd10f0000 pid=4049 execve guuid=aa56ba9d-1900-0000-7b36-f12cd50f0000 pid=4053 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=aa56ba9d-1900-0000-7b36-f12cd50f0000 pid=4053 execve guuid=189d279e-1900-0000-7b36-f12cd70f0000 pid=4055 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=189d279e-1900-0000-7b36-f12cd70f0000 pid=4055 execve guuid=4a428a9e-1900-0000-7b36-f12cdb0f0000 pid=4059 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=4a428a9e-1900-0000-7b36-f12cdb0f0000 pid=4059 execve guuid=93e5df9e-1900-0000-7b36-f12cdd0f0000 pid=4061 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=93e5df9e-1900-0000-7b36-f12cdd0f0000 pid=4061 execve guuid=2060379f-1900-0000-7b36-f12ce00f0000 pid=4064 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=2060379f-1900-0000-7b36-f12ce00f0000 pid=4064 execve guuid=33a68b9f-1900-0000-7b36-f12ce30f0000 pid=4067 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=33a68b9f-1900-0000-7b36-f12ce30f0000 pid=4067 execve guuid=5927ec9f-1900-0000-7b36-f12ce50f0000 pid=4069 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=5927ec9f-1900-0000-7b36-f12ce50f0000 pid=4069 execve guuid=46c447a0-1900-0000-7b36-f12ce80f0000 pid=4072 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=46c447a0-1900-0000-7b36-f12ce80f0000 pid=4072 execve guuid=525ea2a0-1900-0000-7b36-f12cea0f0000 pid=4074 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=525ea2a0-1900-0000-7b36-f12cea0f0000 pid=4074 execve guuid=6677fda0-1900-0000-7b36-f12cec0f0000 pid=4076 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=6677fda0-1900-0000-7b36-f12cec0f0000 pid=4076 execve guuid=b3ff60a1-1900-0000-7b36-f12cee0f0000 pid=4078 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=b3ff60a1-1900-0000-7b36-f12cee0f0000 pid=4078 execve guuid=3e0bbda1-1900-0000-7b36-f12cf20f0000 pid=4082 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=3e0bbda1-1900-0000-7b36-f12cf20f0000 pid=4082 execve guuid=48661ea2-1900-0000-7b36-f12cf60f0000 pid=4086 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=48661ea2-1900-0000-7b36-f12cf60f0000 pid=4086 execve guuid=a0367ca2-1900-0000-7b36-f12cf80f0000 pid=4088 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=a0367ca2-1900-0000-7b36-f12cf80f0000 pid=4088 execve guuid=5de0dca2-1900-0000-7b36-f12cfa0f0000 pid=4090 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=5de0dca2-1900-0000-7b36-f12cfa0f0000 pid=4090 execve guuid=5ac23da3-1900-0000-7b36-f12cfd0f0000 pid=4093 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=5ac23da3-1900-0000-7b36-f12cfd0f0000 pid=4093 execve guuid=a4db9da3-1900-0000-7b36-f12cff0f0000 pid=4095 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=a4db9da3-1900-0000-7b36-f12cff0f0000 pid=4095 execve guuid=0d2600a4-1900-0000-7b36-f12c02100000 pid=4098 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=0d2600a4-1900-0000-7b36-f12c02100000 pid=4098 execve guuid=a0e55fa4-1900-0000-7b36-f12c04100000 pid=4100 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=a0e55fa4-1900-0000-7b36-f12c04100000 pid=4100 execve guuid=bda6c1a4-1900-0000-7b36-f12c08100000 pid=4104 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=bda6c1a4-1900-0000-7b36-f12c08100000 pid=4104 execve guuid=ac871da5-1900-0000-7b36-f12c09100000 pid=4105 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=ac871da5-1900-0000-7b36-f12c09100000 pid=4105 execve guuid=6bf5a7a5-1900-0000-7b36-f12c0d100000 pid=4109 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=6bf5a7a5-1900-0000-7b36-f12c0d100000 pid=4109 execve guuid=2f3907a6-1900-0000-7b36-f12c10100000 pid=4112 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=2f3907a6-1900-0000-7b36-f12c10100000 pid=4112 execve guuid=97f56ca6-1900-0000-7b36-f12c12100000 pid=4114 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=97f56ca6-1900-0000-7b36-f12c12100000 pid=4114 execve guuid=b1e2cca6-1900-0000-7b36-f12c15100000 pid=4117 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=b1e2cca6-1900-0000-7b36-f12c15100000 pid=4117 execve guuid=9d2f85a7-1900-0000-7b36-f12c18100000 pid=4120 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=9d2f85a7-1900-0000-7b36-f12c18100000 pid=4120 execve guuid=de0fe1a7-1900-0000-7b36-f12c1a100000 pid=4122 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=de0fe1a7-1900-0000-7b36-f12c1a100000 pid=4122 execve guuid=b6d551a8-1900-0000-7b36-f12c1b100000 pid=4123 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=b6d551a8-1900-0000-7b36-f12c1b100000 pid=4123 execve guuid=9efaa9a8-1900-0000-7b36-f12c1f100000 pid=4127 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=9efaa9a8-1900-0000-7b36-f12c1f100000 pid=4127 execve guuid=fee924a9-1900-0000-7b36-f12c23100000 pid=4131 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=fee924a9-1900-0000-7b36-f12c23100000 pid=4131 execve guuid=643581a9-1900-0000-7b36-f12c25100000 pid=4133 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=643581a9-1900-0000-7b36-f12c25100000 pid=4133 execve guuid=670be3a9-1900-0000-7b36-f12c27100000 pid=4135 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=670be3a9-1900-0000-7b36-f12c27100000 pid=4135 execve guuid=e83b44aa-1900-0000-7b36-f12c29100000 pid=4137 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=e83b44aa-1900-0000-7b36-f12c29100000 pid=4137 execve guuid=240ea9aa-1900-0000-7b36-f12c2c100000 pid=4140 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=240ea9aa-1900-0000-7b36-f12c2c100000 pid=4140 execve guuid=b04918ab-1900-0000-7b36-f12c2f100000 pid=4143 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=b04918ab-1900-0000-7b36-f12c2f100000 pid=4143 execve guuid=720a79ab-1900-0000-7b36-f12c31100000 pid=4145 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=720a79ab-1900-0000-7b36-f12c31100000 pid=4145 execve guuid=362efdab-1900-0000-7b36-f12c32100000 pid=4146 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=362efdab-1900-0000-7b36-f12c32100000 pid=4146 execve guuid=684b67ac-1900-0000-7b36-f12c36100000 pid=4150 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=684b67ac-1900-0000-7b36-f12c36100000 pid=4150 execve guuid=91fbddac-1900-0000-7b36-f12c37100000 pid=4151 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=91fbddac-1900-0000-7b36-f12c37100000 pid=4151 execve guuid=da6f6bad-1900-0000-7b36-f12c3b100000 pid=4155 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=da6f6bad-1900-0000-7b36-f12c3b100000 pid=4155 execve guuid=da06c9ad-1900-0000-7b36-f12c3e100000 pid=4158 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=da06c9ad-1900-0000-7b36-f12c3e100000 pid=4158 execve guuid=a0012cae-1900-0000-7b36-f12c42100000 pid=4162 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=a0012cae-1900-0000-7b36-f12c42100000 pid=4162 execve guuid=784296ae-1900-0000-7b36-f12c43100000 pid=4163 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=784296ae-1900-0000-7b36-f12c43100000 pid=4163 execve guuid=72a505af-1900-0000-7b36-f12c47100000 pid=4167 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=72a505af-1900-0000-7b36-f12c47100000 pid=4167 execve guuid=20685eaf-1900-0000-7b36-f12c49100000 pid=4169 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=20685eaf-1900-0000-7b36-f12c49100000 pid=4169 execve guuid=e4ecb2af-1900-0000-7b36-f12c4b100000 pid=4171 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=e4ecb2af-1900-0000-7b36-f12c4b100000 pid=4171 execve guuid=e78f09b0-1900-0000-7b36-f12c4f100000 pid=4175 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=e78f09b0-1900-0000-7b36-f12c4f100000 pid=4175 execve guuid=9c875eb0-1900-0000-7b36-f12c50100000 pid=4176 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=9c875eb0-1900-0000-7b36-f12c50100000 pid=4176 execve guuid=25fad0b0-1900-0000-7b36-f12c54100000 pid=4180 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=25fad0b0-1900-0000-7b36-f12c54100000 pid=4180 execve guuid=de7a5cb1-1900-0000-7b36-f12c57100000 pid=4183 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=de7a5cb1-1900-0000-7b36-f12c57100000 pid=4183 execve guuid=1dfab6b1-1900-0000-7b36-f12c5b100000 pid=4187 /usr/bin/ls guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=1dfab6b1-1900-0000-7b36-f12c5b100000 pid=4187 execve guuid=18b613b2-1900-0000-7b36-f12c5d100000 pid=4189 /usr/bin/rm guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=18b613b2-1900-0000-7b36-f12c5d100000 pid=4189 execve guuid=da6859b2-1900-0000-7b36-f12c60100000 pid=4192 /usr/bin/wget net send-data write-file guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=da6859b2-1900-0000-7b36-f12c60100000 pid=4192 execve guuid=eb7b76bf-1900-0000-7b36-f12c7d100000 pid=4221 /usr/bin/chmod guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=eb7b76bf-1900-0000-7b36-f12c7d100000 pid=4221 execve guuid=0451b7bf-1900-0000-7b36-f12c81100000 pid=4225 /tmp/v9EB guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=0451b7bf-1900-0000-7b36-f12c81100000 pid=4225 execve guuid=43918bc0-1900-0000-7b36-f12c86100000 pid=4230 /usr/bin/rm guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=43918bc0-1900-0000-7b36-f12c86100000 pid=4230 execve guuid=93cbd8c0-1900-0000-7b36-f12c87100000 pid=4231 /usr/bin/wget net send-data write-file guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=93cbd8c0-1900-0000-7b36-f12c87100000 pid=4231 execve guuid=feb13ace-1900-0000-7b36-f12caf100000 pid=4271 /usr/bin/chmod guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=feb13ace-1900-0000-7b36-f12caf100000 pid=4271 execve guuid=c4e3dace-1900-0000-7b36-f12cb1100000 pid=4273 /tmp/Qcl guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=c4e3dace-1900-0000-7b36-f12cb1100000 pid=4273 execve guuid=534706d0-1900-0000-7b36-f12cb6100000 pid=4278 /usr/bin/rm guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=534706d0-1900-0000-7b36-f12cb6100000 pid=4278 execve guuid=4a0760d0-1900-0000-7b36-f12cb7100000 pid=4279 /usr/bin/wget net send-data write-file guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=4a0760d0-1900-0000-7b36-f12cb7100000 pid=4279 execve guuid=c23cacdd-1900-0000-7b36-f12cf1100000 pid=4337 /usr/bin/chmod guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=c23cacdd-1900-0000-7b36-f12cf1100000 pid=4337 execve guuid=f22a2bde-1900-0000-7b36-f12cf3100000 pid=4339 /tmp/uck guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=f22a2bde-1900-0000-7b36-f12cf3100000 pid=4339 execve guuid=c94520e0-1900-0000-7b36-f12cf9100000 pid=4345 /usr/bin/rm guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=c94520e0-1900-0000-7b36-f12cf9100000 pid=4345 execve guuid=9cc663e0-1900-0000-7b36-f12cfa100000 pid=4346 /usr/bin/wget net send-data write-file guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=9cc663e0-1900-0000-7b36-f12cfa100000 pid=4346 execve guuid=953114ed-1900-0000-7b36-f12c22110000 pid=4386 /usr/bin/chmod guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=953114ed-1900-0000-7b36-f12c22110000 pid=4386 execve guuid=f55b65ed-1900-0000-7b36-f12c24110000 pid=4388 /tmp/82D6 guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=f55b65ed-1900-0000-7b36-f12c24110000 pid=4388 execve guuid=b8d444ef-1900-0000-7b36-f12c29110000 pid=4393 /usr/bin/rm guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=b8d444ef-1900-0000-7b36-f12c29110000 pid=4393 execve guuid=3b0483ef-1900-0000-7b36-f12c2b110000 pid=4395 /usr/bin/wget net send-data write-file guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=3b0483ef-1900-0000-7b36-f12c2b110000 pid=4395 execve guuid=039d93fb-1900-0000-7b36-f12c53110000 pid=4435 /usr/bin/chmod guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=039d93fb-1900-0000-7b36-f12c53110000 pid=4435 execve guuid=000bfdfb-1900-0000-7b36-f12c57110000 pid=4439 /tmp/AfN guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=000bfdfb-1900-0000-7b36-f12c57110000 pid=4439 execve guuid=99d1bbfc-1900-0000-7b36-f12c5c110000 pid=4444 /usr/bin/rm delete-file guuid=661c8e7d-1900-0000-7b36-f12c1d0f0000 pid=3869->guuid=99d1bbfc-1900-0000-7b36-f12c5c110000 pid=4444 execve 801186e6-5fe8-5959-a7b4-832d8d66e7aa 129.121.114.124:80 guuid=da6859b2-1900-0000-7b36-f12c60100000 pid=4192->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 134B guuid=93cbd8c0-1900-0000-7b36-f12c87100000 pid=4231->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 133B guuid=4a0760d0-1900-0000-7b36-f12cb7100000 pid=4279->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 133B guuid=9cc663e0-1900-0000-7b36-f12cfa100000 pid=4346->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 134B guuid=3b0483ef-1900-0000-7b36-f12c2b110000 pid=4395->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 133B
Score:
97%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/8e51bf24dfd69bcc6e4f6677fd813a55a39523a0d5528263b8cf43dec5597863
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8e51bf24dfd69bcc6e4f6677fd813a55a39523a0d5528263b8cf43dec5597863/
Threat name:
Document-HTML.Downloader.Bash
Create hunting rule
Status:
Malicious
First seen:
2026-07-12 12:23:34 UTC
File Type:
Text (Shell)
AV detection:
14 of 38 (36.84%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rzi36jg722n4y3spmz373aj2kwrzki5a2vjiey5yz5b55rkzpbrq._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
discovery linux
Link:
https://tria.ge/reports/260712-pknmzsbx71/
Behaviour
Reads runtime system information
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.26
Link:
https://yomi.yoroi.company/submissions/8e51bf24dfd69bcc6e4f6677fd813a55a39523a0d5528263b8cf43dec5597863

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 8e51bf24dfd69bcc6e4f6677fd813a55a39523a0d5528263b8cf43dec5597863

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3866369/
  
Delivery method
Distributed via web download

Comments