🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 92cdb958563751c3d0aafb083f1be5e52d7cdb7209282db6c7d573d4b60b0d1e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 92cdb958563751c3d0aafb083f1be5e52d7cdb7209282db6c7d573d4b60b0d1e
SHA3-384 hash: 515369015fe8f36abe6a942ac3ba52c5af4b38ed94320a609352e7459975c96f81a7f8b58966394470a34954a3be9f31
SHA1 hash: a5fa7ba507ff5fbcc0c41f0a8c569fa5d0f536a6
MD5 hash: 5fbb735415636689f598e39d4d339f56
humanhash: fourteen-pasta-fanta-bulldog
File name:ok
Download: download sample
File size:1'608 bytes
First seen:2026-08-26 03:35:25 UTC
Last seen:2026-08-26 16:13:48 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 24:XagTL90jd73tEEPLNF80MVR6dsfskJk0py:pTL9wB3tEEPAwdsfZm0py
TLSH T168318D9A09155E315103CD9E72BA3548B28EA1FB289FD3E4CD590EEE934C3CCF161B5A
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://5.182.210.174/d649edn/an/an/a
http://5.182.210.174/8ef4dbn/an/an/a
http://5.182.210.174/e24232n/an/an/a
http://5.182.210.174/c10f26n/an/an/a
http://5.182.210.174/993c07n/an/an/a
http://5.182.210.174/1508f3n/an/an/a
http://5.182.210.174/3b3847n/an/an/a
http://5.182.210.174/8a420fn/an/an/a
http://5.182.210.174/e87d26n/an/an/a
http://5.182.210.174/c6c7abn/an/an/a
http://5.182.210.174/7a2201n/an/an/a
http://5.182.210.174/190f55n/an/an/a

Intelligence

File Origin
# of uploads :
3
# of downloads :
47
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive mirai
Link:
https://www.filescan.io/uploads/6a8e5f2dec2f554d48f27d4a/reports/a75b799b-d4af-449b-b935-1fc05dc93d79/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-08-26T02:45:00Z UTC
Last seen:
2026-08-27T18:07:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/92cdb958563751c3d0aafb083f1be5e52d7cdb7209282db6c7d573d4b60b0d1e/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/dd6d2c3b-bc72-49cc-bac5-1aa56067c630
Behavior Graph:
Download SVG
%3 guuid=b24fca07-1700-0000-3fc7-e28d970e0000 pid=3735 /usr/bin/sudo guuid=d2b5dc0b-1700-0000-3fc7-e28da50e0000 pid=3749 /tmp/sample.bin guuid=b24fca07-1700-0000-3fc7-e28d970e0000 pid=3735->guuid=d2b5dc0b-1700-0000-3fc7-e28da50e0000 pid=3749 execve guuid=f47bee0c-1700-0000-3fc7-e28dab0e0000 pid=3755 /usr/bin/wget net send-data guuid=d2b5dc0b-1700-0000-3fc7-e28da50e0000 pid=3749->guuid=f47bee0c-1700-0000-3fc7-e28dab0e0000 pid=3755 execve guuid=eb694712-1700-0000-3fc7-e28dbd0e0000 pid=3773 /usr/bin/curl net send-data write-file guuid=d2b5dc0b-1700-0000-3fc7-e28da50e0000 pid=3749->guuid=eb694712-1700-0000-3fc7-e28dbd0e0000 pid=3773 execve guuid=ce404920-1700-0000-3fc7-e28dd00e0000 pid=3792 /usr/bin/chmod guuid=d2b5dc0b-1700-0000-3fc7-e28da50e0000 pid=3749->guuid=ce404920-1700-0000-3fc7-e28dd00e0000 pid=3792 execve guuid=7b5c8320-1700-0000-3fc7-e28dd10e0000 pid=3793 /usr/bin/bash guuid=d2b5dc0b-1700-0000-3fc7-e28da50e0000 pid=3749->guuid=7b5c8320-1700-0000-3fc7-e28dd10e0000 pid=3793 clone guuid=d2c3c920-1700-0000-3fc7-e28dd40e0000 pid=3796 /usr/bin/rm delete-file guuid=d2b5dc0b-1700-0000-3fc7-e28da50e0000 pid=3749->guuid=d2c3c920-1700-0000-3fc7-e28dd40e0000 pid=3796 execve guuid=87ca0921-1700-0000-3fc7-e28dd60e0000 pid=3798 /usr/bin/rm guuid=d2b5dc0b-1700-0000-3fc7-e28da50e0000 pid=3749->guuid=87ca0921-1700-0000-3fc7-e28dd60e0000 pid=3798 execve guuid=39d94721-1700-0000-3fc7-e28dd70e0000 pid=3799 /usr/bin/wget net send-data guuid=d2b5dc0b-1700-0000-3fc7-e28da50e0000 pid=3749->guuid=39d94721-1700-0000-3fc7-e28dd70e0000 pid=3799 execve guuid=4f91db23-1700-0000-3fc7-e28ddb0e0000 pid=3803 /usr/bin/curl net send-data write-file guuid=d2b5dc0b-1700-0000-3fc7-e28da50e0000 pid=3749->guuid=4f91db23-1700-0000-3fc7-e28ddb0e0000 pid=3803 execve guuid=a8355d28-1700-0000-3fc7-e28df50e0000 pid=3829 /usr/bin/chmod guuid=d2b5dc0b-1700-0000-3fc7-e28da50e0000 pid=3749->guuid=a8355d28-1700-0000-3fc7-e28df50e0000 pid=3829 execve guuid=12629a28-1700-0000-3fc7-e28df70e0000 pid=3831 /usr/bin/bash guuid=d2b5dc0b-1700-0000-3fc7-e28da50e0000 pid=3749->guuid=12629a28-1700-0000-3fc7-e28df70e0000 pid=3831 clone guuid=50cbc728-1700-0000-3fc7-e28dfa0e0000 pid=3834 /usr/bin/rm delete-file guuid=d2b5dc0b-1700-0000-3fc7-e28da50e0000 pid=3749->guuid=50cbc728-1700-0000-3fc7-e28dfa0e0000 pid=3834 execve guuid=3e900929-1700-0000-3fc7-e28dfc0e0000 pid=3836 /usr/bin/rm guuid=d2b5dc0b-1700-0000-3fc7-e28da50e0000 pid=3749->guuid=3e900929-1700-0000-3fc7-e28dfc0e0000 pid=3836 execve guuid=9b0b4729-1700-0000-3fc7-e28dfe0e0000 pid=3838 /usr/bin/wget net send-data guuid=d2b5dc0b-1700-0000-3fc7-e28da50e0000 pid=3749->guuid=9b0b4729-1700-0000-3fc7-e28dfe0e0000 pid=3838 execve guuid=2cb9ab2b-1700-0000-3fc7-e28d0a0f0000 pid=3850 /usr/bin/curl net send-data write-file guuid=d2b5dc0b-1700-0000-3fc7-e28da50e0000 pid=3749->guuid=2cb9ab2b-1700-0000-3fc7-e28d0a0f0000 pid=3850 execve guuid=2dedc42e-1700-0000-3fc7-e28d1c0f0000 pid=3868 /usr/bin/chmod guuid=d2b5dc0b-1700-0000-3fc7-e28da50e0000 pid=3749->guuid=2dedc42e-1700-0000-3fc7-e28d1c0f0000 pid=3868 execve guuid=bd25042f-1700-0000-3fc7-e28d1d0f0000 pid=3869 /usr/bin/bash guuid=d2b5dc0b-1700-0000-3fc7-e28da50e0000 pid=3749->guuid=bd25042f-1700-0000-3fc7-e28d1d0f0000 pid=3869 clone guuid=be7e2f2f-1700-0000-3fc7-e28d220f0000 pid=3874 /usr/bin/rm delete-file guuid=d2b5dc0b-1700-0000-3fc7-e28da50e0000 pid=3749->guuid=be7e2f2f-1700-0000-3fc7-e28d220f0000 pid=3874 execve guuid=ace3752f-1700-0000-3fc7-e28d230f0000 pid=3875 /usr/bin/rm guuid=d2b5dc0b-1700-0000-3fc7-e28da50e0000 pid=3749->guuid=ace3752f-1700-0000-3fc7-e28d230f0000 pid=3875 execve guuid=7be4b02f-1700-0000-3fc7-e28d250f0000 pid=3877 /usr/bin/wget net send-data guuid=d2b5dc0b-1700-0000-3fc7-e28da50e0000 pid=3749->guuid=7be4b02f-1700-0000-3fc7-e28d250f0000 pid=3877 execve guuid=79cd1c32-1700-0000-3fc7-e28d2d0f0000 pid=3885 /usr/bin/curl net send-data write-file guuid=d2b5dc0b-1700-0000-3fc7-e28da50e0000 pid=3749->guuid=79cd1c32-1700-0000-3fc7-e28d2d0f0000 pid=3885 execve guuid=8851e935-1700-0000-3fc7-e28d420f0000 pid=3906 /usr/bin/chmod guuid=d2b5dc0b-1700-0000-3fc7-e28da50e0000 pid=3749->guuid=8851e935-1700-0000-3fc7-e28d420f0000 pid=3906 execve guuid=b2833336-1700-0000-3fc7-e28d440f0000 pid=3908 /usr/bin/bash guuid=d2b5dc0b-1700-0000-3fc7-e28da50e0000 pid=3749->guuid=b2833336-1700-0000-3fc7-e28d440f0000 pid=3908 clone guuid=a6ad7036-1700-0000-3fc7-e28d460f0000 pid=3910 /usr/bin/rm delete-file guuid=d2b5dc0b-1700-0000-3fc7-e28da50e0000 pid=3749->guuid=a6ad7036-1700-0000-3fc7-e28d460f0000 pid=3910 execve guuid=f9ceba36-1700-0000-3fc7-e28d480f0000 pid=3912 /usr/bin/rm guuid=d2b5dc0b-1700-0000-3fc7-e28da50e0000 pid=3749->guuid=f9ceba36-1700-0000-3fc7-e28d480f0000 pid=3912 execve guuid=13c8f936-1700-0000-3fc7-e28d4a0f0000 pid=3914 /usr/bin/wget net send-data guuid=d2b5dc0b-1700-0000-3fc7-e28da50e0000 pid=3749->guuid=13c8f936-1700-0000-3fc7-e28d4a0f0000 pid=3914 execve guuid=4d56c539-1700-0000-3fc7-e28d530f0000 pid=3923 /usr/bin/curl net send-data write-file guuid=d2b5dc0b-1700-0000-3fc7-e28da50e0000 pid=3749->guuid=4d56c539-1700-0000-3fc7-e28d530f0000 pid=3923 execve guuid=88faec3d-1700-0000-3fc7-e28d610f0000 pid=3937 /usr/bin/chmod guuid=d2b5dc0b-1700-0000-3fc7-e28da50e0000 pid=3749->guuid=88faec3d-1700-0000-3fc7-e28d610f0000 pid=3937 execve guuid=f459e03e-1700-0000-3fc7-e28d680f0000 pid=3944 /usr/bin/bash guuid=d2b5dc0b-1700-0000-3fc7-e28da50e0000 pid=3749->guuid=f459e03e-1700-0000-3fc7-e28d680f0000 pid=3944 clone guuid=794d7f3f-1700-0000-3fc7-e28d6c0f0000 pid=3948 /usr/bin/rm delete-file guuid=d2b5dc0b-1700-0000-3fc7-e28da50e0000 pid=3749->guuid=794d7f3f-1700-0000-3fc7-e28d6c0f0000 pid=3948 execve guuid=8e692840-1700-0000-3fc7-e28d700f0000 pid=3952 /usr/bin/rm guuid=d2b5dc0b-1700-0000-3fc7-e28da50e0000 pid=3749->guuid=8e692840-1700-0000-3fc7-e28d700f0000 pid=3952 execve guuid=4d7ac040-1700-0000-3fc7-e28d730f0000 pid=3955 /usr/bin/wget net send-data guuid=d2b5dc0b-1700-0000-3fc7-e28da50e0000 pid=3749->guuid=4d7ac040-1700-0000-3fc7-e28d730f0000 pid=3955 execve guuid=05359a44-1700-0000-3fc7-e28d820f0000 pid=3970 /usr/bin/curl net send-data write-file guuid=d2b5dc0b-1700-0000-3fc7-e28da50e0000 pid=3749->guuid=05359a44-1700-0000-3fc7-e28d820f0000 pid=3970 execve guuid=f56d3a4b-1700-0000-3fc7-e28d9f0f0000 pid=3999 /usr/bin/chmod guuid=d2b5dc0b-1700-0000-3fc7-e28da50e0000 pid=3749->guuid=f56d3a4b-1700-0000-3fc7-e28d9f0f0000 pid=3999 execve guuid=6e8d784b-1700-0000-3fc7-e28da00f0000 pid=4000 /usr/bin/bash guuid=d2b5dc0b-1700-0000-3fc7-e28da50e0000 pid=3749->guuid=6e8d784b-1700-0000-3fc7-e28da00f0000 pid=4000 clone guuid=b0d6a24b-1700-0000-3fc7-e28da20f0000 pid=4002 /usr/bin/rm delete-file guuid=d2b5dc0b-1700-0000-3fc7-e28da50e0000 pid=3749->guuid=b0d6a24b-1700-0000-3fc7-e28da20f0000 pid=4002 execve guuid=411bdf4b-1700-0000-3fc7-e28da30f0000 pid=4003 /usr/bin/rm guuid=d2b5dc0b-1700-0000-3fc7-e28da50e0000 pid=3749->guuid=411bdf4b-1700-0000-3fc7-e28da30f0000 pid=4003 execve guuid=974e204c-1700-0000-3fc7-e28da40f0000 pid=4004 /usr/bin/wget net send-data guuid=d2b5dc0b-1700-0000-3fc7-e28da50e0000 pid=3749->guuid=974e204c-1700-0000-3fc7-e28da40f0000 pid=4004 execve guuid=9cea8b4e-1700-0000-3fc7-e28dac0f0000 pid=4012 /usr/bin/curl net send-data write-file guuid=d2b5dc0b-1700-0000-3fc7-e28da50e0000 pid=3749->guuid=9cea8b4e-1700-0000-3fc7-e28dac0f0000 pid=4012 execve guuid=5f9ce751-1700-0000-3fc7-e28dba0f0000 pid=4026 /usr/bin/chmod guuid=d2b5dc0b-1700-0000-3fc7-e28da50e0000 pid=3749->guuid=5f9ce751-1700-0000-3fc7-e28dba0f0000 pid=4026 execve guuid=8e622752-1700-0000-3fc7-e28dbc0f0000 pid=4028 /usr/bin/bash guuid=d2b5dc0b-1700-0000-3fc7-e28da50e0000 pid=3749->guuid=8e622752-1700-0000-3fc7-e28dbc0f0000 pid=4028 clone guuid=dfa48252-1700-0000-3fc7-e28dbf0f0000 pid=4031 /usr/bin/rm delete-file guuid=d2b5dc0b-1700-0000-3fc7-e28da50e0000 pid=3749->guuid=dfa48252-1700-0000-3fc7-e28dbf0f0000 pid=4031 execve guuid=fd45c452-1700-0000-3fc7-e28dc10f0000 pid=4033 /usr/bin/rm guuid=d2b5dc0b-1700-0000-3fc7-e28da50e0000 pid=3749->guuid=fd45c452-1700-0000-3fc7-e28dc10f0000 pid=4033 execve guuid=83fa0553-1700-0000-3fc7-e28dc30f0000 pid=4035 /usr/bin/wget net send-data guuid=d2b5dc0b-1700-0000-3fc7-e28da50e0000 pid=3749->guuid=83fa0553-1700-0000-3fc7-e28dc30f0000 pid=4035 execve guuid=1fc47855-1700-0000-3fc7-e28dd00f0000 pid=4048 /usr/bin/curl net send-data write-file guuid=d2b5dc0b-1700-0000-3fc7-e28da50e0000 pid=3749->guuid=1fc47855-1700-0000-3fc7-e28dd00f0000 pid=4048 execve guuid=9296da58-1700-0000-3fc7-e28de40f0000 pid=4068 /usr/bin/chmod guuid=d2b5dc0b-1700-0000-3fc7-e28da50e0000 pid=3749->guuid=9296da58-1700-0000-3fc7-e28de40f0000 pid=4068 execve guuid=fa4c1b59-1700-0000-3fc7-e28de60f0000 pid=4070 /usr/bin/bash guuid=d2b5dc0b-1700-0000-3fc7-e28da50e0000 pid=3749->guuid=fa4c1b59-1700-0000-3fc7-e28de60f0000 pid=4070 clone guuid=64475259-1700-0000-3fc7-e28de90f0000 pid=4073 /usr/bin/rm delete-file guuid=d2b5dc0b-1700-0000-3fc7-e28da50e0000 pid=3749->guuid=64475259-1700-0000-3fc7-e28de90f0000 pid=4073 execve guuid=77939159-1700-0000-3fc7-e28deb0f0000 pid=4075 /usr/bin/rm guuid=d2b5dc0b-1700-0000-3fc7-e28da50e0000 pid=3749->guuid=77939159-1700-0000-3fc7-e28deb0f0000 pid=4075 execve guuid=fd72ee59-1700-0000-3fc7-e28dee0f0000 pid=4078 /usr/bin/wget net send-data guuid=d2b5dc0b-1700-0000-3fc7-e28da50e0000 pid=3749->guuid=fd72ee59-1700-0000-3fc7-e28dee0f0000 pid=4078 execve guuid=11a5ac5c-1700-0000-3fc7-e28df80f0000 pid=4088 /usr/bin/curl net send-data write-file guuid=d2b5dc0b-1700-0000-3fc7-e28da50e0000 pid=3749->guuid=11a5ac5c-1700-0000-3fc7-e28df80f0000 pid=4088 execve guuid=30354764-1700-0000-3fc7-e28d10100000 pid=4112 /usr/bin/chmod guuid=d2b5dc0b-1700-0000-3fc7-e28da50e0000 pid=3749->guuid=30354764-1700-0000-3fc7-e28d10100000 pid=4112 execve guuid=53bffa64-1700-0000-3fc7-e28d15100000 pid=4117 /usr/bin/bash guuid=d2b5dc0b-1700-0000-3fc7-e28da50e0000 pid=3749->guuid=53bffa64-1700-0000-3fc7-e28d15100000 pid=4117 clone guuid=e7779365-1700-0000-3fc7-e28d1b100000 pid=4123 /usr/bin/rm delete-file guuid=d2b5dc0b-1700-0000-3fc7-e28da50e0000 pid=3749->guuid=e7779365-1700-0000-3fc7-e28d1b100000 pid=4123 execve guuid=8d143666-1700-0000-3fc7-e28d1f100000 pid=4127 /usr/bin/rm guuid=d2b5dc0b-1700-0000-3fc7-e28da50e0000 pid=3749->guuid=8d143666-1700-0000-3fc7-e28d1f100000 pid=4127 execve guuid=6fe1cd66-1700-0000-3fc7-e28d22100000 pid=4130 /usr/bin/wget net send-data guuid=d2b5dc0b-1700-0000-3fc7-e28da50e0000 pid=3749->guuid=6fe1cd66-1700-0000-3fc7-e28d22100000 pid=4130 execve guuid=dd8e7a6a-1700-0000-3fc7-e28d30100000 pid=4144 /usr/bin/curl net send-data write-file guuid=d2b5dc0b-1700-0000-3fc7-e28da50e0000 pid=3749->guuid=dd8e7a6a-1700-0000-3fc7-e28d30100000 pid=4144 execve guuid=544beb6e-1700-0000-3fc7-e28d3e100000 pid=4158 /usr/bin/chmod guuid=d2b5dc0b-1700-0000-3fc7-e28da50e0000 pid=3749->guuid=544beb6e-1700-0000-3fc7-e28d3e100000 pid=4158 execve guuid=f1a1816f-1700-0000-3fc7-e28d41100000 pid=4161 /usr/bin/bash guuid=d2b5dc0b-1700-0000-3fc7-e28da50e0000 pid=3749->guuid=f1a1816f-1700-0000-3fc7-e28d41100000 pid=4161 clone guuid=d4a1c86f-1700-0000-3fc7-e28d44100000 pid=4164 /usr/bin/rm delete-file guuid=d2b5dc0b-1700-0000-3fc7-e28da50e0000 pid=3749->guuid=d4a1c86f-1700-0000-3fc7-e28d44100000 pid=4164 execve guuid=d77f5370-1700-0000-3fc7-e28d47100000 pid=4167 /usr/bin/rm guuid=d2b5dc0b-1700-0000-3fc7-e28da50e0000 pid=3749->guuid=d77f5370-1700-0000-3fc7-e28d47100000 pid=4167 execve guuid=f4a6a070-1700-0000-3fc7-e28d4b100000 pid=4171 /usr/bin/wget net send-data guuid=d2b5dc0b-1700-0000-3fc7-e28da50e0000 pid=3749->guuid=f4a6a070-1700-0000-3fc7-e28d4b100000 pid=4171 execve guuid=64392a73-1700-0000-3fc7-e28d59100000 pid=4185 /usr/bin/curl net send-data write-file guuid=d2b5dc0b-1700-0000-3fc7-e28da50e0000 pid=3749->guuid=64392a73-1700-0000-3fc7-e28d59100000 pid=4185 execve guuid=9f55b678-1700-0000-3fc7-e28d6e100000 pid=4206 /usr/bin/chmod guuid=d2b5dc0b-1700-0000-3fc7-e28da50e0000 pid=3749->guuid=9f55b678-1700-0000-3fc7-e28d6e100000 pid=4206 execve guuid=d52d2a79-1700-0000-3fc7-e28d70100000 pid=4208 /usr/bin/bash guuid=d2b5dc0b-1700-0000-3fc7-e28da50e0000 pid=3749->guuid=d52d2a79-1700-0000-3fc7-e28d70100000 pid=4208 clone guuid=cea88979-1700-0000-3fc7-e28d75100000 pid=4213 /usr/bin/rm delete-file guuid=d2b5dc0b-1700-0000-3fc7-e28da50e0000 pid=3749->guuid=cea88979-1700-0000-3fc7-e28d75100000 pid=4213 execve guuid=8471077a-1700-0000-3fc7-e28d79100000 pid=4217 /usr/bin/rm guuid=d2b5dc0b-1700-0000-3fc7-e28da50e0000 pid=3749->guuid=8471077a-1700-0000-3fc7-e28d79100000 pid=4217 execve guuid=4e9e257c-1700-0000-3fc7-e28d82100000 pid=4226 /usr/bin/wget net send-data guuid=d2b5dc0b-1700-0000-3fc7-e28da50e0000 pid=3749->guuid=4e9e257c-1700-0000-3fc7-e28d82100000 pid=4226 execve guuid=25034880-1700-0000-3fc7-e28d95100000 pid=4245 /usr/bin/curl net send-data write-file guuid=d2b5dc0b-1700-0000-3fc7-e28da50e0000 pid=3749->guuid=25034880-1700-0000-3fc7-e28d95100000 pid=4245 execve guuid=58404186-1700-0000-3fc7-e28db2100000 pid=4274 /usr/bin/chmod guuid=d2b5dc0b-1700-0000-3fc7-e28da50e0000 pid=3749->guuid=58404186-1700-0000-3fc7-e28db2100000 pid=4274 execve guuid=9417e286-1700-0000-3fc7-e28db4100000 pid=4276 /usr/bin/bash guuid=d2b5dc0b-1700-0000-3fc7-e28da50e0000 pid=3749->guuid=9417e286-1700-0000-3fc7-e28db4100000 pid=4276 clone guuid=63dd0f87-1700-0000-3fc7-e28db7100000 pid=4279 /usr/bin/rm delete-file guuid=d2b5dc0b-1700-0000-3fc7-e28da50e0000 pid=3749->guuid=63dd0f87-1700-0000-3fc7-e28db7100000 pid=4279 execve guuid=1d234c87-1700-0000-3fc7-e28db8100000 pid=4280 /usr/bin/rm guuid=d2b5dc0b-1700-0000-3fc7-e28da50e0000 pid=3749->guuid=1d234c87-1700-0000-3fc7-e28db8100000 pid=4280 execve 5b654972-c9e1-50d8-b372-2dc2a5b9ad66 5.182.210.174:80 guuid=f47bee0c-1700-0000-3fc7-e28dab0e0000 pid=3755->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=eb694712-1700-0000-3fc7-e28dbd0e0000 pid=3773->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=cc989720-1700-0000-3fc7-e28dd30e0000 pid=3795 /usr/bin/bash guuid=7b5c8320-1700-0000-3fc7-e28dd10e0000 pid=3793->guuid=cc989720-1700-0000-3fc7-e28dd30e0000 pid=3795 clone guuid=39d94721-1700-0000-3fc7-e28dd70e0000 pid=3799->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=4f91db23-1700-0000-3fc7-e28ddb0e0000 pid=3803->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=d9dcac28-1700-0000-3fc7-e28df80e0000 pid=3832 /usr/bin/bash guuid=12629a28-1700-0000-3fc7-e28df70e0000 pid=3831->guuid=d9dcac28-1700-0000-3fc7-e28df80e0000 pid=3832 clone guuid=9b0b4729-1700-0000-3fc7-e28dfe0e0000 pid=3838->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=2cb9ab2b-1700-0000-3fc7-e28d0a0f0000 pid=3850->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=3b78182f-1700-0000-3fc7-e28d1e0f0000 pid=3870 /usr/bin/bash guuid=bd25042f-1700-0000-3fc7-e28d1d0f0000 pid=3869->guuid=3b78182f-1700-0000-3fc7-e28d1e0f0000 pid=3870 clone guuid=7be4b02f-1700-0000-3fc7-e28d250f0000 pid=3877->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=79cd1c32-1700-0000-3fc7-e28d2d0f0000 pid=3885->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=088a4936-1700-0000-3fc7-e28d450f0000 pid=3909 /usr/bin/bash guuid=b2833336-1700-0000-3fc7-e28d440f0000 pid=3908->guuid=088a4936-1700-0000-3fc7-e28d450f0000 pid=3909 clone guuid=13c8f936-1700-0000-3fc7-e28d4a0f0000 pid=3914->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=4d56c539-1700-0000-3fc7-e28d530f0000 pid=3923->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=02c9343f-1700-0000-3fc7-e28d6a0f0000 pid=3946 /usr/bin/bash guuid=f459e03e-1700-0000-3fc7-e28d680f0000 pid=3944->guuid=02c9343f-1700-0000-3fc7-e28d6a0f0000 pid=3946 clone guuid=4d7ac040-1700-0000-3fc7-e28d730f0000 pid=3955->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=05359a44-1700-0000-3fc7-e28d820f0000 pid=3970->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=07708c4b-1700-0000-3fc7-e28da10f0000 pid=4001 /usr/bin/bash guuid=6e8d784b-1700-0000-3fc7-e28da00f0000 pid=4000->guuid=07708c4b-1700-0000-3fc7-e28da10f0000 pid=4001 clone guuid=974e204c-1700-0000-3fc7-e28da40f0000 pid=4004->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=9cea8b4e-1700-0000-3fc7-e28dac0f0000 pid=4012->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=9cad3b52-1700-0000-3fc7-e28dbd0f0000 pid=4029 /usr/bin/bash guuid=8e622752-1700-0000-3fc7-e28dbc0f0000 pid=4028->guuid=9cad3b52-1700-0000-3fc7-e28dbd0f0000 pid=4029 clone guuid=83fa0553-1700-0000-3fc7-e28dc30f0000 pid=4035->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=1fc47855-1700-0000-3fc7-e28dd00f0000 pid=4048->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=ba5e3359-1700-0000-3fc7-e28de80f0000 pid=4072 /usr/bin/bash guuid=fa4c1b59-1700-0000-3fc7-e28de60f0000 pid=4070->guuid=ba5e3359-1700-0000-3fc7-e28de80f0000 pid=4072 clone guuid=fd72ee59-1700-0000-3fc7-e28dee0f0000 pid=4078->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=11a5ac5c-1700-0000-3fc7-e28df80f0000 pid=4088->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=32853265-1700-0000-3fc7-e28d17100000 pid=4119 /usr/bin/bash guuid=53bffa64-1700-0000-3fc7-e28d15100000 pid=4117->guuid=32853265-1700-0000-3fc7-e28d17100000 pid=4119 clone guuid=6fe1cd66-1700-0000-3fc7-e28d22100000 pid=4130->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=dd8e7a6a-1700-0000-3fc7-e28d30100000 pid=4144->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=332fa06f-1700-0000-3fc7-e28d42100000 pid=4162 /usr/bin/bash guuid=f1a1816f-1700-0000-3fc7-e28d41100000 pid=4161->guuid=332fa06f-1700-0000-3fc7-e28d42100000 pid=4162 clone guuid=f4a6a070-1700-0000-3fc7-e28d4b100000 pid=4171->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=64392a73-1700-0000-3fc7-e28d59100000 pid=4185->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=e80c5779-1700-0000-3fc7-e28d74100000 pid=4212 /usr/bin/bash guuid=d52d2a79-1700-0000-3fc7-e28d70100000 pid=4208->guuid=e80c5779-1700-0000-3fc7-e28d74100000 pid=4212 clone guuid=4e9e257c-1700-0000-3fc7-e28d82100000 pid=4226->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=25034880-1700-0000-3fc7-e28d95100000 pid=4245->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=906af986-1700-0000-3fc7-e28db5100000 pid=4277 /usr/bin/bash guuid=9417e286-1700-0000-3fc7-e28db4100000 pid=4276->guuid=906af986-1700-0000-3fc7-e28db5100000 pid=4277 clone
Score:
99%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/92cdb958563751c3d0aafb083f1be5e52d7cdb7209282db6c7d573d4b60b0d1e
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/92cdb958563751c3d0aafb083f1be5e52d7cdb7209282db6c7d573d4b60b0d1e/
Threat name:
Linux.Trojan.Egairtigado
Create hunting rule
Status:
Malicious
First seen:
2026-08-26 03:36:35 UTC
File Type:
Text (Shell)
AV detection:
13 of 24 (54.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=slg3swcwg5i4hufk7med6g7f4uwxzw3sbeuc3nwh2vz5jnqlbupa._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260826-d51mhabe96/
Behaviour
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.11
Link:
https://yomi.yoroi.company/submissions/92cdb958563751c3d0aafb083f1be5e52d7cdb7209282db6c7d573d4b60b0d1e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 92cdb958563751c3d0aafb083f1be5e52d7cdb7209282db6c7d573d4b60b0d1e

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3897671/
  
Delivery method
Distributed via web download

Comments