MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 941bae04b8307eff2faa47f60c59298717d218e06c4e716ff576dc9cf0363ddb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 941bae04b8307eff2faa47f60c59298717d218e06c4e716ff576dc9cf0363ddb
SHA3-384 hash: 533a2a342a21979a9700dd3aba69fd3c702d0cd526547c4b292f7b11e79df03eb3498074a3ff7a722055d4266b0cb216
SHA1 hash: 87f75ccce73b499013e72bac644f174f21d82027
MD5 hash: dceeadcf0b77afca511c5a8caf653b0f
humanhash: connecticut-south-alabama-twenty
File name:p
Download: download sample
File size:839 bytes
First seen:2026-07-21 01:52:36 UTC
Last seen:2026-07-21 14:40:51 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 24:kXCKysE2hi0ziQvZoha1a8UnMar2jF7727:e9Qp+MsxUnMaKjVC7
TLSH T15801ABCAD250951085699A1E669762E0B430C3C6169B0B687FACD83DEB9CE14F16AF88
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://129.121.110.105/jttn/an/aua-wget
http://129.121.110.105/gwFn/an/aua-wget
http://129.121.110.105/MENGn/an/aua-wget
http://129.121.110.105/Fzukn/an/aua-wget
http://129.121.110.105/HCgxn/an/aua-wget

Intelligence

File Origin
# of uploads :
2
# of downloads :
119
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive mirai
Link:
https://www.filescan.io/uploads/6a5ed11daff11fa68b937733/reports/f3b73759-5b58-4ec4-8bb2-b221d17cb72a/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-07-20T23:29:00Z UTC
Last seen:
2026-07-20T23:50:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan-Downloader.Shell.Agent.a
Link:
https://opentip.kaspersky.com/941bae04b8307eff2faa47f60c59298717d218e06c4e716ff576dc9cf0363ddb/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/db23ba62-73f2-40f7-88e5-092ee50c183e
Behavior Graph:
Download SVG
%3 guuid=e134cbc5-1600-0000-01c4-ef06150c0000 pid=3093 /usr/bin/sudo guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094 /tmp/sample.bin write-file guuid=e134cbc5-1600-0000-01c4-ef06150c0000 pid=3093->guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094 execve guuid=2d0933c9-1600-0000-01c4-ef06170c0000 pid=3095 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=2d0933c9-1600-0000-01c4-ef06170c0000 pid=3095 execve guuid=edf519ca-1600-0000-01c4-ef06180c0000 pid=3096 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=edf519ca-1600-0000-01c4-ef06180c0000 pid=3096 execve guuid=99f19eca-1600-0000-01c4-ef06190c0000 pid=3097 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=99f19eca-1600-0000-01c4-ef06190c0000 pid=3097 execve guuid=874509cb-1600-0000-01c4-ef061a0c0000 pid=3098 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=874509cb-1600-0000-01c4-ef061a0c0000 pid=3098 execve guuid=511672cb-1600-0000-01c4-ef061b0c0000 pid=3099 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=511672cb-1600-0000-01c4-ef061b0c0000 pid=3099 execve guuid=3878cbcb-1600-0000-01c4-ef061c0c0000 pid=3100 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=3878cbcb-1600-0000-01c4-ef061c0c0000 pid=3100 execve guuid=43222fcc-1600-0000-01c4-ef061d0c0000 pid=3101 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=43222fcc-1600-0000-01c4-ef061d0c0000 pid=3101 execve guuid=101d8fcc-1600-0000-01c4-ef061e0c0000 pid=3102 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=101d8fcc-1600-0000-01c4-ef061e0c0000 pid=3102 execve guuid=1ce0f0cc-1600-0000-01c4-ef061f0c0000 pid=3103 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=1ce0f0cc-1600-0000-01c4-ef061f0c0000 pid=3103 execve guuid=805f50cd-1600-0000-01c4-ef06200c0000 pid=3104 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=805f50cd-1600-0000-01c4-ef06200c0000 pid=3104 execve guuid=bef4adcd-1600-0000-01c4-ef06210c0000 pid=3105 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=bef4adcd-1600-0000-01c4-ef06210c0000 pid=3105 execve guuid=820f19ce-1600-0000-01c4-ef06220c0000 pid=3106 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=820f19ce-1600-0000-01c4-ef06220c0000 pid=3106 execve guuid=4c188ace-1600-0000-01c4-ef06230c0000 pid=3107 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=4c188ace-1600-0000-01c4-ef06230c0000 pid=3107 execve guuid=9ae726cf-1600-0000-01c4-ef06240c0000 pid=3108 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=9ae726cf-1600-0000-01c4-ef06240c0000 pid=3108 execve guuid=8917b3cf-1600-0000-01c4-ef06250c0000 pid=3109 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=8917b3cf-1600-0000-01c4-ef06250c0000 pid=3109 execve guuid=f9df40d0-1600-0000-01c4-ef06260c0000 pid=3110 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=f9df40d0-1600-0000-01c4-ef06260c0000 pid=3110 execve guuid=ef13d3d0-1600-0000-01c4-ef06270c0000 pid=3111 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=ef13d3d0-1600-0000-01c4-ef06270c0000 pid=3111 execve guuid=c3406dd1-1600-0000-01c4-ef06280c0000 pid=3112 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=c3406dd1-1600-0000-01c4-ef06280c0000 pid=3112 execve guuid=59c010d2-1600-0000-01c4-ef06290c0000 pid=3113 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=59c010d2-1600-0000-01c4-ef06290c0000 pid=3113 execve guuid=5b6dafd2-1600-0000-01c4-ef062a0c0000 pid=3114 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=5b6dafd2-1600-0000-01c4-ef062a0c0000 pid=3114 execve guuid=c5e13fd3-1600-0000-01c4-ef062b0c0000 pid=3115 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=c5e13fd3-1600-0000-01c4-ef062b0c0000 pid=3115 execve guuid=6922d7d3-1600-0000-01c4-ef062c0c0000 pid=3116 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=6922d7d3-1600-0000-01c4-ef062c0c0000 pid=3116 execve guuid=85e962d4-1600-0000-01c4-ef062d0c0000 pid=3117 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=85e962d4-1600-0000-01c4-ef062d0c0000 pid=3117 execve guuid=6370f3d4-1600-0000-01c4-ef062e0c0000 pid=3118 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=6370f3d4-1600-0000-01c4-ef062e0c0000 pid=3118 execve guuid=60c795d5-1600-0000-01c4-ef062f0c0000 pid=3119 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=60c795d5-1600-0000-01c4-ef062f0c0000 pid=3119 execve guuid=27512bd6-1600-0000-01c4-ef06300c0000 pid=3120 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=27512bd6-1600-0000-01c4-ef06300c0000 pid=3120 execve guuid=2e79d0d6-1600-0000-01c4-ef06310c0000 pid=3121 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=2e79d0d6-1600-0000-01c4-ef06310c0000 pid=3121 execve guuid=51845ad7-1600-0000-01c4-ef06320c0000 pid=3122 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=51845ad7-1600-0000-01c4-ef06320c0000 pid=3122 execve guuid=a12cded7-1600-0000-01c4-ef06340c0000 pid=3124 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=a12cded7-1600-0000-01c4-ef06340c0000 pid=3124 execve guuid=48536fd8-1600-0000-01c4-ef06350c0000 pid=3125 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=48536fd8-1600-0000-01c4-ef06350c0000 pid=3125 execve guuid=ad95efd8-1600-0000-01c4-ef06360c0000 pid=3126 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=ad95efd8-1600-0000-01c4-ef06360c0000 pid=3126 execve guuid=23275fd9-1600-0000-01c4-ef06380c0000 pid=3128 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=23275fd9-1600-0000-01c4-ef06380c0000 pid=3128 execve guuid=3d1fbbd9-1600-0000-01c4-ef063a0c0000 pid=3130 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=3d1fbbd9-1600-0000-01c4-ef063a0c0000 pid=3130 execve guuid=a7b04bda-1600-0000-01c4-ef063d0c0000 pid=3133 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=a7b04bda-1600-0000-01c4-ef063d0c0000 pid=3133 execve guuid=fb08f0da-1600-0000-01c4-ef06400c0000 pid=3136 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=fb08f0da-1600-0000-01c4-ef06400c0000 pid=3136 execve guuid=a4c8aedb-1600-0000-01c4-ef06420c0000 pid=3138 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=a4c8aedb-1600-0000-01c4-ef06420c0000 pid=3138 execve guuid=028372dc-1600-0000-01c4-ef06450c0000 pid=3141 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=028372dc-1600-0000-01c4-ef06450c0000 pid=3141 execve guuid=feed33dd-1600-0000-01c4-ef06480c0000 pid=3144 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=feed33dd-1600-0000-01c4-ef06480c0000 pid=3144 execve guuid=355a9ddd-1600-0000-01c4-ef064a0c0000 pid=3146 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=355a9ddd-1600-0000-01c4-ef064a0c0000 pid=3146 execve guuid=e0f204de-1600-0000-01c4-ef064c0c0000 pid=3148 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=e0f204de-1600-0000-01c4-ef064c0c0000 pid=3148 execve guuid=b09580de-1600-0000-01c4-ef064e0c0000 pid=3150 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=b09580de-1600-0000-01c4-ef064e0c0000 pid=3150 execve guuid=49c204df-1600-0000-01c4-ef064f0c0000 pid=3151 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=49c204df-1600-0000-01c4-ef064f0c0000 pid=3151 execve guuid=e21875df-1600-0000-01c4-ef06510c0000 pid=3153 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=e21875df-1600-0000-01c4-ef06510c0000 pid=3153 execve guuid=20f0dddf-1600-0000-01c4-ef06530c0000 pid=3155 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=20f0dddf-1600-0000-01c4-ef06530c0000 pid=3155 execve guuid=2b7044e0-1600-0000-01c4-ef06550c0000 pid=3157 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=2b7044e0-1600-0000-01c4-ef06550c0000 pid=3157 execve guuid=d3f4aee0-1600-0000-01c4-ef06570c0000 pid=3159 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=d3f4aee0-1600-0000-01c4-ef06570c0000 pid=3159 execve guuid=86191ce1-1600-0000-01c4-ef065a0c0000 pid=3162 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=86191ce1-1600-0000-01c4-ef065a0c0000 pid=3162 execve guuid=0822abe1-1600-0000-01c4-ef065b0c0000 pid=3163 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=0822abe1-1600-0000-01c4-ef065b0c0000 pid=3163 execve guuid=925629e2-1600-0000-01c4-ef065c0c0000 pid=3164 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=925629e2-1600-0000-01c4-ef065c0c0000 pid=3164 execve guuid=0948d6e2-1600-0000-01c4-ef065d0c0000 pid=3165 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=0948d6e2-1600-0000-01c4-ef065d0c0000 pid=3165 execve guuid=8a0b9be3-1600-0000-01c4-ef065e0c0000 pid=3166 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=8a0b9be3-1600-0000-01c4-ef065e0c0000 pid=3166 execve guuid=03d46de4-1600-0000-01c4-ef065f0c0000 pid=3167 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=03d46de4-1600-0000-01c4-ef065f0c0000 pid=3167 execve guuid=bbed2ae5-1600-0000-01c4-ef06600c0000 pid=3168 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=bbed2ae5-1600-0000-01c4-ef06600c0000 pid=3168 execve guuid=c24310e6-1600-0000-01c4-ef06610c0000 pid=3169 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=c24310e6-1600-0000-01c4-ef06610c0000 pid=3169 execve guuid=4357d2e6-1600-0000-01c4-ef06620c0000 pid=3170 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=4357d2e6-1600-0000-01c4-ef06620c0000 pid=3170 execve guuid=acdc92e7-1600-0000-01c4-ef06630c0000 pid=3171 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=acdc92e7-1600-0000-01c4-ef06630c0000 pid=3171 execve guuid=698437e8-1600-0000-01c4-ef06640c0000 pid=3172 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=698437e8-1600-0000-01c4-ef06640c0000 pid=3172 execve guuid=0739eee8-1600-0000-01c4-ef06660c0000 pid=3174 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=0739eee8-1600-0000-01c4-ef06660c0000 pid=3174 execve guuid=4986a6e9-1600-0000-01c4-ef06670c0000 pid=3175 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=4986a6e9-1600-0000-01c4-ef06670c0000 pid=3175 execve guuid=0e3e43ea-1600-0000-01c4-ef066a0c0000 pid=3178 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=0e3e43ea-1600-0000-01c4-ef066a0c0000 pid=3178 execve guuid=92a0d3ea-1600-0000-01c4-ef066e0c0000 pid=3182 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=92a0d3ea-1600-0000-01c4-ef066e0c0000 pid=3182 execve guuid=d4172ceb-1600-0000-01c4-ef06700c0000 pid=3184 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=d4172ceb-1600-0000-01c4-ef06700c0000 pid=3184 execve guuid=28f78beb-1600-0000-01c4-ef06720c0000 pid=3186 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=28f78beb-1600-0000-01c4-ef06720c0000 pid=3186 execve guuid=9932e9eb-1600-0000-01c4-ef06730c0000 pid=3187 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=9932e9eb-1600-0000-01c4-ef06730c0000 pid=3187 execve guuid=98b345ec-1600-0000-01c4-ef06760c0000 pid=3190 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=98b345ec-1600-0000-01c4-ef06760c0000 pid=3190 execve guuid=5f83a6ec-1600-0000-01c4-ef06780c0000 pid=3192 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=5f83a6ec-1600-0000-01c4-ef06780c0000 pid=3192 execve guuid=d49c04ed-1600-0000-01c4-ef067b0c0000 pid=3195 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=d49c04ed-1600-0000-01c4-ef067b0c0000 pid=3195 execve guuid=de7068ed-1600-0000-01c4-ef067d0c0000 pid=3197 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=de7068ed-1600-0000-01c4-ef067d0c0000 pid=3197 execve guuid=e413f9ed-1600-0000-01c4-ef067e0c0000 pid=3198 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=e413f9ed-1600-0000-01c4-ef067e0c0000 pid=3198 execve guuid=9ab45dee-1600-0000-01c4-ef06800c0000 pid=3200 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=9ab45dee-1600-0000-01c4-ef06800c0000 pid=3200 execve guuid=366d42ef-1600-0000-01c4-ef06810c0000 pid=3201 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=366d42ef-1600-0000-01c4-ef06810c0000 pid=3201 execve guuid=d72dbfef-1600-0000-01c4-ef06830c0000 pid=3203 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=d72dbfef-1600-0000-01c4-ef06830c0000 pid=3203 execve guuid=e5bf26f0-1600-0000-01c4-ef06860c0000 pid=3206 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=e5bf26f0-1600-0000-01c4-ef06860c0000 pid=3206 execve guuid=0e5a8ef0-1600-0000-01c4-ef06890c0000 pid=3209 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=0e5a8ef0-1600-0000-01c4-ef06890c0000 pid=3209 execve guuid=00fff0f0-1600-0000-01c4-ef068b0c0000 pid=3211 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=00fff0f0-1600-0000-01c4-ef068b0c0000 pid=3211 execve guuid=2cd353f1-1600-0000-01c4-ef068c0c0000 pid=3212 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=2cd353f1-1600-0000-01c4-ef068c0c0000 pid=3212 execve guuid=e2e1c0f1-1600-0000-01c4-ef068d0c0000 pid=3213 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=e2e1c0f1-1600-0000-01c4-ef068d0c0000 pid=3213 execve guuid=4a1c30f2-1600-0000-01c4-ef068e0c0000 pid=3214 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=4a1c30f2-1600-0000-01c4-ef068e0c0000 pid=3214 execve guuid=f7cf97f2-1600-0000-01c4-ef068f0c0000 pid=3215 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=f7cf97f2-1600-0000-01c4-ef068f0c0000 pid=3215 execve guuid=b84204f3-1600-0000-01c4-ef06900c0000 pid=3216 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=b84204f3-1600-0000-01c4-ef06900c0000 pid=3216 execve guuid=0ddfeaf3-1600-0000-01c4-ef06910c0000 pid=3217 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=0ddfeaf3-1600-0000-01c4-ef06910c0000 pid=3217 execve guuid=28795ef4-1600-0000-01c4-ef06930c0000 pid=3219 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=28795ef4-1600-0000-01c4-ef06930c0000 pid=3219 execve guuid=50feccf4-1600-0000-01c4-ef06940c0000 pid=3220 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=50feccf4-1600-0000-01c4-ef06940c0000 pid=3220 execve guuid=84c666f5-1600-0000-01c4-ef06950c0000 pid=3221 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=84c666f5-1600-0000-01c4-ef06950c0000 pid=3221 execve guuid=6af4f6f5-1600-0000-01c4-ef06960c0000 pid=3222 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=6af4f6f5-1600-0000-01c4-ef06960c0000 pid=3222 execve guuid=47be8bf6-1600-0000-01c4-ef06980c0000 pid=3224 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=47be8bf6-1600-0000-01c4-ef06980c0000 pid=3224 execve guuid=82660af7-1600-0000-01c4-ef069a0c0000 pid=3226 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=82660af7-1600-0000-01c4-ef069a0c0000 pid=3226 execve guuid=86e68df7-1600-0000-01c4-ef069b0c0000 pid=3227 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=86e68df7-1600-0000-01c4-ef069b0c0000 pid=3227 execve guuid=fc8003f8-1600-0000-01c4-ef069d0c0000 pid=3229 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=fc8003f8-1600-0000-01c4-ef069d0c0000 pid=3229 execve guuid=ff116cf8-1600-0000-01c4-ef069f0c0000 pid=3231 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=ff116cf8-1600-0000-01c4-ef069f0c0000 pid=3231 execve guuid=e37fd7f8-1600-0000-01c4-ef06a20c0000 pid=3234 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=e37fd7f8-1600-0000-01c4-ef06a20c0000 pid=3234 execve guuid=0cad3df9-1600-0000-01c4-ef06a50c0000 pid=3237 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=0cad3df9-1600-0000-01c4-ef06a50c0000 pid=3237 execve guuid=ce429bf9-1600-0000-01c4-ef06a70c0000 pid=3239 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=ce429bf9-1600-0000-01c4-ef06a70c0000 pid=3239 execve guuid=13b3fcf9-1600-0000-01c4-ef06a90c0000 pid=3241 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=13b3fcf9-1600-0000-01c4-ef06a90c0000 pid=3241 execve guuid=2f5b8ffa-1600-0000-01c4-ef06ad0c0000 pid=3245 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=2f5b8ffa-1600-0000-01c4-ef06ad0c0000 pid=3245 execve guuid=524cecfa-1600-0000-01c4-ef06af0c0000 pid=3247 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=524cecfa-1600-0000-01c4-ef06af0c0000 pid=3247 execve guuid=46dd50fb-1600-0000-01c4-ef06b10c0000 pid=3249 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=46dd50fb-1600-0000-01c4-ef06b10c0000 pid=3249 execve guuid=33e5b5fb-1600-0000-01c4-ef06b40c0000 pid=3252 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=33e5b5fb-1600-0000-01c4-ef06b40c0000 pid=3252 execve guuid=8fc417fc-1600-0000-01c4-ef06b60c0000 pid=3254 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=8fc417fc-1600-0000-01c4-ef06b60c0000 pid=3254 execve guuid=95237dfc-1600-0000-01c4-ef06b80c0000 pid=3256 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=95237dfc-1600-0000-01c4-ef06b80c0000 pid=3256 execve guuid=6d76e6fc-1600-0000-01c4-ef06b90c0000 pid=3257 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=6d76e6fc-1600-0000-01c4-ef06b90c0000 pid=3257 execve guuid=57454cfd-1600-0000-01c4-ef06bb0c0000 pid=3259 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=57454cfd-1600-0000-01c4-ef06bb0c0000 pid=3259 execve guuid=7c12c9fd-1600-0000-01c4-ef06bc0c0000 pid=3260 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=7c12c9fd-1600-0000-01c4-ef06bc0c0000 pid=3260 execve guuid=876147fe-1600-0000-01c4-ef06bd0c0000 pid=3261 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=876147fe-1600-0000-01c4-ef06bd0c0000 pid=3261 execve guuid=33fcbffe-1600-0000-01c4-ef06be0c0000 pid=3262 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=33fcbffe-1600-0000-01c4-ef06be0c0000 pid=3262 execve guuid=b3ac39ff-1600-0000-01c4-ef06bf0c0000 pid=3263 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=b3ac39ff-1600-0000-01c4-ef06bf0c0000 pid=3263 execve guuid=78c8b5ff-1600-0000-01c4-ef06c00c0000 pid=3264 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=78c8b5ff-1600-0000-01c4-ef06c00c0000 pid=3264 execve guuid=dd902800-1700-0000-01c4-ef06c10c0000 pid=3265 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=dd902800-1700-0000-01c4-ef06c10c0000 pid=3265 execve guuid=c9949e00-1700-0000-01c4-ef06c20c0000 pid=3266 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=c9949e00-1700-0000-01c4-ef06c20c0000 pid=3266 execve guuid=26491a01-1700-0000-01c4-ef06c40c0000 pid=3268 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=26491a01-1700-0000-01c4-ef06c40c0000 pid=3268 execve guuid=d4e8c101-1700-0000-01c4-ef06c70c0000 pid=3271 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=d4e8c101-1700-0000-01c4-ef06c70c0000 pid=3271 execve guuid=e3e03f02-1700-0000-01c4-ef06c90c0000 pid=3273 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=e3e03f02-1700-0000-01c4-ef06c90c0000 pid=3273 execve guuid=9dd2c602-1700-0000-01c4-ef06cb0c0000 pid=3275 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=9dd2c602-1700-0000-01c4-ef06cb0c0000 pid=3275 execve guuid=5a603803-1700-0000-01c4-ef06cd0c0000 pid=3277 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=5a603803-1700-0000-01c4-ef06cd0c0000 pid=3277 execve guuid=37a3ab03-1700-0000-01c4-ef06cf0c0000 pid=3279 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=37a3ab03-1700-0000-01c4-ef06cf0c0000 pid=3279 execve guuid=8e682204-1700-0000-01c4-ef06d10c0000 pid=3281 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=8e682204-1700-0000-01c4-ef06d10c0000 pid=3281 execve guuid=43819c04-1700-0000-01c4-ef06d30c0000 pid=3283 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=43819c04-1700-0000-01c4-ef06d30c0000 pid=3283 execve guuid=65201c05-1700-0000-01c4-ef06d50c0000 pid=3285 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=65201c05-1700-0000-01c4-ef06d50c0000 pid=3285 execve guuid=71149005-1700-0000-01c4-ef06d70c0000 pid=3287 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=71149005-1700-0000-01c4-ef06d70c0000 pid=3287 execve guuid=067a0606-1700-0000-01c4-ef06d90c0000 pid=3289 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=067a0606-1700-0000-01c4-ef06d90c0000 pid=3289 execve guuid=894b7e06-1700-0000-01c4-ef06dc0c0000 pid=3292 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=894b7e06-1700-0000-01c4-ef06dc0c0000 pid=3292 execve guuid=53b7f106-1700-0000-01c4-ef06dd0c0000 pid=3293 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=53b7f106-1700-0000-01c4-ef06dd0c0000 pid=3293 execve guuid=bf616207-1700-0000-01c4-ef06df0c0000 pid=3295 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=bf616207-1700-0000-01c4-ef06df0c0000 pid=3295 execve guuid=9eabd707-1700-0000-01c4-ef06e10c0000 pid=3297 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=9eabd707-1700-0000-01c4-ef06e10c0000 pid=3297 execve guuid=51af5008-1700-0000-01c4-ef06e30c0000 pid=3299 /usr/bin/ls guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=51af5008-1700-0000-01c4-ef06e30c0000 pid=3299 execve guuid=4e4ecb08-1700-0000-01c4-ef06e50c0000 pid=3301 /usr/bin/rm guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=4e4ecb08-1700-0000-01c4-ef06e50c0000 pid=3301 execve guuid=529a1e09-1700-0000-01c4-ef06e60c0000 pid=3302 /usr/bin/wget net send-data write-file guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=529a1e09-1700-0000-01c4-ef06e60c0000 pid=3302 execve guuid=2b9b390f-1700-0000-01c4-ef06f20c0000 pid=3314 /usr/bin/chmod guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=2b9b390f-1700-0000-01c4-ef06f20c0000 pid=3314 execve guuid=7b42910f-1700-0000-01c4-ef06f40c0000 pid=3316 /usr/bin/dash guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=7b42910f-1700-0000-01c4-ef06f40c0000 pid=3316 clone guuid=16324d10-1700-0000-01c4-ef06f80c0000 pid=3320 /usr/bin/rm guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=16324d10-1700-0000-01c4-ef06f80c0000 pid=3320 execve guuid=4037a110-1700-0000-01c4-ef06fa0c0000 pid=3322 /usr/bin/wget net send-data write-file guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=4037a110-1700-0000-01c4-ef06fa0c0000 pid=3322 execve guuid=17d29815-1700-0000-01c4-ef06060d0000 pid=3334 /usr/bin/chmod guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=17d29815-1700-0000-01c4-ef06060d0000 pid=3334 execve guuid=4c84fd15-1700-0000-01c4-ef06080d0000 pid=3336 /usr/bin/dash guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=4c84fd15-1700-0000-01c4-ef06080d0000 pid=3336 clone guuid=792aae16-1700-0000-01c4-ef060c0d0000 pid=3340 /usr/bin/rm guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=792aae16-1700-0000-01c4-ef060c0d0000 pid=3340 execve guuid=8bc0fc16-1700-0000-01c4-ef060e0d0000 pid=3342 /usr/bin/wget net send-data write-file guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=8bc0fc16-1700-0000-01c4-ef060e0d0000 pid=3342 execve guuid=52eddb1b-1700-0000-01c4-ef06170d0000 pid=3351 /usr/bin/chmod guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=52eddb1b-1700-0000-01c4-ef06170d0000 pid=3351 execve guuid=fa5c3c1c-1700-0000-01c4-ef06190d0000 pid=3353 /usr/bin/dash guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=fa5c3c1c-1700-0000-01c4-ef06190d0000 pid=3353 clone guuid=895df71c-1700-0000-01c4-ef061d0d0000 pid=3357 /usr/bin/rm guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=895df71c-1700-0000-01c4-ef061d0d0000 pid=3357 execve guuid=39e2421d-1700-0000-01c4-ef061f0d0000 pid=3359 /usr/bin/wget net send-data write-file guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=39e2421d-1700-0000-01c4-ef061f0d0000 pid=3359 execve guuid=67cea424-1700-0000-01c4-ef062f0d0000 pid=3375 /usr/bin/chmod guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=67cea424-1700-0000-01c4-ef062f0d0000 pid=3375 execve guuid=9c0de424-1700-0000-01c4-ef06300d0000 pid=3376 /usr/bin/dash guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=9c0de424-1700-0000-01c4-ef06300d0000 pid=3376 clone guuid=a5436425-1700-0000-01c4-ef06320d0000 pid=3378 /usr/bin/rm guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=a5436425-1700-0000-01c4-ef06320d0000 pid=3378 execve guuid=d9cd9825-1700-0000-01c4-ef06330d0000 pid=3379 /usr/bin/wget net send-data write-file guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=d9cd9825-1700-0000-01c4-ef06330d0000 pid=3379 execve guuid=8d4e8e2b-1700-0000-01c4-ef06450d0000 pid=3397 /usr/bin/chmod guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=8d4e8e2b-1700-0000-01c4-ef06450d0000 pid=3397 execve guuid=05cecb2b-1700-0000-01c4-ef06470d0000 pid=3399 /usr/bin/dash guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=05cecb2b-1700-0000-01c4-ef06470d0000 pid=3399 clone guuid=2d29422c-1700-0000-01c4-ef064a0d0000 pid=3402 /usr/bin/rm delete-file guuid=66f7cfc8-1600-0000-01c4-ef06160c0000 pid=3094->guuid=2d29422c-1700-0000-01c4-ef064a0d0000 pid=3402 execve 0b1ba66e-2f8f-542f-9f7c-00dd01da057c 129.121.110.105:80 guuid=529a1e09-1700-0000-01c4-ef06e60c0000 pid=3302->0b1ba66e-2f8f-542f-9f7c-00dd01da057c send: 133B guuid=4037a110-1700-0000-01c4-ef06fa0c0000 pid=3322->0b1ba66e-2f8f-542f-9f7c-00dd01da057c send: 133B guuid=8bc0fc16-1700-0000-01c4-ef060e0d0000 pid=3342->0b1ba66e-2f8f-542f-9f7c-00dd01da057c send: 134B guuid=39e2421d-1700-0000-01c4-ef061f0d0000 pid=3359->0b1ba66e-2f8f-542f-9f7c-00dd01da057c send: 134B guuid=d9cd9825-1700-0000-01c4-ef06330d0000 pid=3379->0b1ba66e-2f8f-542f-9f7c-00dd01da057c send: 134B
Score:
96%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/941bae04b8307eff2faa47f60c59298717d218e06c4e716ff576dc9cf0363ddb
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/941bae04b8307eff2faa47f60c59298717d218e06c4e716ff576dc9cf0363ddb/
Threat name:
Document-HTML.Browser.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2026-07-21 01:53:48 UTC
File Type:
Text (Shell)
AV detection:
8 of 36 (22.22%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=sqn24bfygb7p6l5ki73aywjjq4l5eghanrhhc37vo3ojz4bwhxnq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery execution linux persistence privilege_escalation
Link:
https://tria.ge/reports/260721-ca9q9aby9r/
Behaviour
Enumerates kernel/hardware configuration
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
Creates/modifies Cron job
Enumerates running processes
Modifies rc script
Modifies systemd
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.26
Link:
https://yomi.yoroi.company/submissions/941bae04b8307eff2faa47f60c59298717d218e06c4e716ff576dc9cf0363ddb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 941bae04b8307eff2faa47f60c59298717d218e06c4e716ff576dc9cf0363ddb

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3887342/
  
Delivery method
Distributed via web download

Comments