🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 98b611f76688d044be307474b3b84fab26e47a1b7ba5a0efc8dd7033e48e6d6a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 98b611f76688d044be307474b3b84fab26e47a1b7ba5a0efc8dd7033e48e6d6a
SHA3-384 hash: e0aa17d0e1dae586fe46744137891a264ee07f6581f459aa8f2737138c9fc9b2e67663c701ac4d96c741f364c44276a1
SHA1 hash: 2b65a3fc3822acf49a09fac2e89d5c366c83b91c
MD5 hash: d9a91341fe7c7544a5cc669267202a1d
humanhash: potato-idaho-delta-eight
File name:ok
Download: download sample
File size:1'608 bytes
First seen:2026-08-05 06:12:29 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 24:oQyEIjkQCFjNeVBQzNd7u5lM3qYv2aI/6K:aEIjkQeAVBQzl1Q6K
TLSH T1AD3149FF0211AA231500CA0BF3B514595644D5DE7E9BE7E8FE4C6C29B24E18C72B9E47
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://45.135.194.70/90222an/an/aua-wget
http://45.135.194.70/d2593an/an/aua-wget
http://45.135.194.70/e1d96dn/an/aua-wget
http://45.135.194.70/35dde7n/an/aua-wget
http://45.135.194.70/973ef6n/an/aua-wget
http://45.135.194.70/b08330n/an/aua-wget
http://45.135.194.70/428e4bn/an/aua-wget
http://45.135.194.70/5b5269n/an/aua-wget
http://45.135.194.70/468c35n/an/aua-wget
http://45.135.194.70/671ca7n/an/aua-wget
http://45.135.194.70/ffde1cn/an/aua-wget
http://45.135.194.70/02c2abn/an/aua-wget

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive
Link:
https://www.filescan.io/uploads/6a72d48951170fa6a7fda029/reports/a0a613d5-e680-48fe-8c1f-4bd24de0b655/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-08-05T04:24:00Z UTC
Last seen:
2026-08-05T04:40:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/98b611f76688d044be307474b3b84fab26e47a1b7ba5a0efc8dd7033e48e6d6a/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/5633bb5b-b33e-4f5e-89d1-7105133fe881
Behavior Graph:
Download SVG
%3 guuid=0980d185-1600-0000-eb50-7628520c0000 pid=3154 /usr/bin/sudo guuid=27ec4887-1600-0000-eb50-7628580c0000 pid=3160 /tmp/sample.bin guuid=0980d185-1600-0000-eb50-7628520c0000 pid=3154->guuid=27ec4887-1600-0000-eb50-7628580c0000 pid=3160 execve guuid=62b29887-1600-0000-eb50-76285a0c0000 pid=3162 /usr/bin/wget net send-data guuid=27ec4887-1600-0000-eb50-7628580c0000 pid=3160->guuid=62b29887-1600-0000-eb50-76285a0c0000 pid=3162 execve guuid=c0e30a8f-1600-0000-eb50-76286f0c0000 pid=3183 /usr/bin/curl net send-data write-file guuid=27ec4887-1600-0000-eb50-7628580c0000 pid=3160->guuid=c0e30a8f-1600-0000-eb50-76286f0c0000 pid=3183 execve guuid=90db1c99-1600-0000-eb50-7628870c0000 pid=3207 /usr/bin/chmod guuid=27ec4887-1600-0000-eb50-7628580c0000 pid=3160->guuid=90db1c99-1600-0000-eb50-7628870c0000 pid=3207 execve guuid=cda57499-1600-0000-eb50-7628890c0000 pid=3209 /usr/bin/bash guuid=27ec4887-1600-0000-eb50-7628580c0000 pid=3160->guuid=cda57499-1600-0000-eb50-7628890c0000 pid=3209 clone guuid=d678be99-1600-0000-eb50-76288b0c0000 pid=3211 /usr/bin/rm delete-file guuid=27ec4887-1600-0000-eb50-7628580c0000 pid=3160->guuid=d678be99-1600-0000-eb50-76288b0c0000 pid=3211 execve guuid=bed0189a-1600-0000-eb50-76288c0c0000 pid=3212 /usr/bin/rm guuid=27ec4887-1600-0000-eb50-7628580c0000 pid=3160->guuid=bed0189a-1600-0000-eb50-76288c0c0000 pid=3212 execve guuid=2ad2729a-1600-0000-eb50-76288d0c0000 pid=3213 /usr/bin/wget net send-data guuid=27ec4887-1600-0000-eb50-7628580c0000 pid=3160->guuid=2ad2729a-1600-0000-eb50-76288d0c0000 pid=3213 execve guuid=bd88fc9f-1600-0000-eb50-76288e0c0000 pid=3214 /usr/bin/curl net send-data write-file guuid=27ec4887-1600-0000-eb50-7628580c0000 pid=3160->guuid=bd88fc9f-1600-0000-eb50-76288e0c0000 pid=3214 execve guuid=fb7f54a8-1600-0000-eb50-76289d0c0000 pid=3229 /usr/bin/chmod guuid=27ec4887-1600-0000-eb50-7628580c0000 pid=3160->guuid=fb7f54a8-1600-0000-eb50-76289d0c0000 pid=3229 execve guuid=d5d5cba8-1600-0000-eb50-7628a00c0000 pid=3232 /usr/bin/bash guuid=27ec4887-1600-0000-eb50-7628580c0000 pid=3160->guuid=d5d5cba8-1600-0000-eb50-7628a00c0000 pid=3232 clone guuid=d5981da9-1600-0000-eb50-7628a30c0000 pid=3235 /usr/bin/rm delete-file guuid=27ec4887-1600-0000-eb50-7628580c0000 pid=3160->guuid=d5981da9-1600-0000-eb50-7628a30c0000 pid=3235 execve guuid=7c2663a9-1600-0000-eb50-7628a50c0000 pid=3237 /usr/bin/rm guuid=27ec4887-1600-0000-eb50-7628580c0000 pid=3160->guuid=7c2663a9-1600-0000-eb50-7628a50c0000 pid=3237 execve guuid=2039e7a9-1600-0000-eb50-7628a60c0000 pid=3238 /usr/bin/wget net send-data guuid=27ec4887-1600-0000-eb50-7628580c0000 pid=3160->guuid=2039e7a9-1600-0000-eb50-7628a60c0000 pid=3238 execve guuid=f54d3ab1-1600-0000-eb50-7628b30c0000 pid=3251 /usr/bin/curl net send-data write-file guuid=27ec4887-1600-0000-eb50-7628580c0000 pid=3160->guuid=f54d3ab1-1600-0000-eb50-7628b30c0000 pid=3251 execve guuid=18bc73be-1600-0000-eb50-7628dd0c0000 pid=3293 /usr/bin/chmod guuid=27ec4887-1600-0000-eb50-7628580c0000 pid=3160->guuid=18bc73be-1600-0000-eb50-7628dd0c0000 pid=3293 execve guuid=e9d60bbf-1600-0000-eb50-7628e10c0000 pid=3297 /usr/bin/bash guuid=27ec4887-1600-0000-eb50-7628580c0000 pid=3160->guuid=e9d60bbf-1600-0000-eb50-7628e10c0000 pid=3297 clone guuid=81ba7ebf-1600-0000-eb50-7628e50c0000 pid=3301 /usr/bin/rm delete-file guuid=27ec4887-1600-0000-eb50-7628580c0000 pid=3160->guuid=81ba7ebf-1600-0000-eb50-7628e50c0000 pid=3301 execve guuid=1efa21c0-1600-0000-eb50-7628e90c0000 pid=3305 /usr/bin/rm guuid=27ec4887-1600-0000-eb50-7628580c0000 pid=3160->guuid=1efa21c0-1600-0000-eb50-7628e90c0000 pid=3305 execve guuid=1006bac0-1600-0000-eb50-7628ed0c0000 pid=3309 /usr/bin/wget net send-data guuid=27ec4887-1600-0000-eb50-7628580c0000 pid=3160->guuid=1006bac0-1600-0000-eb50-7628ed0c0000 pid=3309 execve guuid=9b90b0c6-1600-0000-eb50-7628040d0000 pid=3332 /usr/bin/curl net send-data write-file guuid=27ec4887-1600-0000-eb50-7628580c0000 pid=3160->guuid=9b90b0c6-1600-0000-eb50-7628040d0000 pid=3332 execve guuid=8610d9cc-1600-0000-eb50-7628150d0000 pid=3349 /usr/bin/chmod guuid=27ec4887-1600-0000-eb50-7628580c0000 pid=3160->guuid=8610d9cc-1600-0000-eb50-7628150d0000 pid=3349 execve guuid=4ac00ecd-1600-0000-eb50-7628160d0000 pid=3350 /usr/bin/bash guuid=27ec4887-1600-0000-eb50-7628580c0000 pid=3160->guuid=4ac00ecd-1600-0000-eb50-7628160d0000 pid=3350 clone guuid=3f3a3bcd-1600-0000-eb50-7628190d0000 pid=3353 /usr/bin/rm delete-file guuid=27ec4887-1600-0000-eb50-7628580c0000 pid=3160->guuid=3f3a3bcd-1600-0000-eb50-7628190d0000 pid=3353 execve guuid=f22b73cd-1600-0000-eb50-76281a0d0000 pid=3354 /usr/bin/rm guuid=27ec4887-1600-0000-eb50-7628580c0000 pid=3160->guuid=f22b73cd-1600-0000-eb50-76281a0d0000 pid=3354 execve guuid=3e04a6cd-1600-0000-eb50-76281b0d0000 pid=3355 /usr/bin/wget net send-data guuid=27ec4887-1600-0000-eb50-7628580c0000 pid=3160->guuid=3e04a6cd-1600-0000-eb50-76281b0d0000 pid=3355 execve guuid=8aa501d4-1600-0000-eb50-76282f0d0000 pid=3375 /usr/bin/curl net send-data write-file guuid=27ec4887-1600-0000-eb50-7628580c0000 pid=3160->guuid=8aa501d4-1600-0000-eb50-76282f0d0000 pid=3375 execve guuid=77ba6ddc-1600-0000-eb50-7628470d0000 pid=3399 /usr/bin/chmod guuid=27ec4887-1600-0000-eb50-7628580c0000 pid=3160->guuid=77ba6ddc-1600-0000-eb50-7628470d0000 pid=3399 execve guuid=2be2d5dc-1600-0000-eb50-7628480d0000 pid=3400 /usr/bin/bash guuid=27ec4887-1600-0000-eb50-7628580c0000 pid=3160->guuid=2be2d5dc-1600-0000-eb50-7628480d0000 pid=3400 clone guuid=a60b11dd-1600-0000-eb50-76284a0d0000 pid=3402 /usr/bin/rm delete-file guuid=27ec4887-1600-0000-eb50-7628580c0000 pid=3160->guuid=a60b11dd-1600-0000-eb50-76284a0d0000 pid=3402 execve guuid=e97157dd-1600-0000-eb50-76284b0d0000 pid=3403 /usr/bin/rm guuid=27ec4887-1600-0000-eb50-7628580c0000 pid=3160->guuid=e97157dd-1600-0000-eb50-76284b0d0000 pid=3403 execve guuid=343e98dd-1600-0000-eb50-76284c0d0000 pid=3404 /usr/bin/wget net send-data guuid=27ec4887-1600-0000-eb50-7628580c0000 pid=3160->guuid=343e98dd-1600-0000-eb50-76284c0d0000 pid=3404 execve guuid=8ebb50e2-1600-0000-eb50-76285c0d0000 pid=3420 /usr/bin/curl net send-data write-file guuid=27ec4887-1600-0000-eb50-7628580c0000 pid=3160->guuid=8ebb50e2-1600-0000-eb50-76285c0d0000 pid=3420 execve guuid=4c199be8-1600-0000-eb50-76286b0d0000 pid=3435 /usr/bin/chmod guuid=27ec4887-1600-0000-eb50-7628580c0000 pid=3160->guuid=4c199be8-1600-0000-eb50-76286b0d0000 pid=3435 execve guuid=1945d5e8-1600-0000-eb50-76286d0d0000 pid=3437 /usr/bin/bash guuid=27ec4887-1600-0000-eb50-7628580c0000 pid=3160->guuid=1945d5e8-1600-0000-eb50-76286d0d0000 pid=3437 clone guuid=5e7e02e9-1600-0000-eb50-7628700d0000 pid=3440 /usr/bin/rm delete-file guuid=27ec4887-1600-0000-eb50-7628580c0000 pid=3160->guuid=5e7e02e9-1600-0000-eb50-7628700d0000 pid=3440 execve guuid=62993ee9-1600-0000-eb50-7628710d0000 pid=3441 /usr/bin/rm guuid=27ec4887-1600-0000-eb50-7628580c0000 pid=3160->guuid=62993ee9-1600-0000-eb50-7628710d0000 pid=3441 execve guuid=5bad87e9-1600-0000-eb50-7628730d0000 pid=3443 /usr/bin/wget net send-data guuid=27ec4887-1600-0000-eb50-7628580c0000 pid=3160->guuid=5bad87e9-1600-0000-eb50-7628730d0000 pid=3443 execve guuid=814135ee-1600-0000-eb50-7628790d0000 pid=3449 /usr/bin/curl net send-data write-file guuid=27ec4887-1600-0000-eb50-7628580c0000 pid=3160->guuid=814135ee-1600-0000-eb50-7628790d0000 pid=3449 execve guuid=7edaa3f4-1600-0000-eb50-7628860d0000 pid=3462 /usr/bin/chmod guuid=27ec4887-1600-0000-eb50-7628580c0000 pid=3160->guuid=7edaa3f4-1600-0000-eb50-7628860d0000 pid=3462 execve guuid=aa74ebf4-1600-0000-eb50-7628880d0000 pid=3464 /usr/bin/bash guuid=27ec4887-1600-0000-eb50-7628580c0000 pid=3160->guuid=aa74ebf4-1600-0000-eb50-7628880d0000 pid=3464 clone guuid=266522f5-1600-0000-eb50-76288b0d0000 pid=3467 /usr/bin/rm delete-file guuid=27ec4887-1600-0000-eb50-7628580c0000 pid=3160->guuid=266522f5-1600-0000-eb50-76288b0d0000 pid=3467 execve guuid=50cd70f5-1600-0000-eb50-76288d0d0000 pid=3469 /usr/bin/rm guuid=27ec4887-1600-0000-eb50-7628580c0000 pid=3160->guuid=50cd70f5-1600-0000-eb50-76288d0d0000 pid=3469 execve guuid=e94dabf5-1600-0000-eb50-76288f0d0000 pid=3471 /usr/bin/wget net send-data guuid=27ec4887-1600-0000-eb50-7628580c0000 pid=3160->guuid=e94dabf5-1600-0000-eb50-76288f0d0000 pid=3471 execve guuid=3a863bfa-1600-0000-eb50-7628a30d0000 pid=3491 /usr/bin/curl net send-data write-file guuid=27ec4887-1600-0000-eb50-7628580c0000 pid=3160->guuid=3a863bfa-1600-0000-eb50-7628a30d0000 pid=3491 execve guuid=9524f006-1700-0000-eb50-7628c50d0000 pid=3525 /usr/bin/chmod guuid=27ec4887-1600-0000-eb50-7628580c0000 pid=3160->guuid=9524f006-1700-0000-eb50-7628c50d0000 pid=3525 execve guuid=b5332807-1700-0000-eb50-7628c70d0000 pid=3527 /usr/bin/bash guuid=27ec4887-1600-0000-eb50-7628580c0000 pid=3160->guuid=b5332807-1700-0000-eb50-7628c70d0000 pid=3527 clone guuid=ec5c6007-1700-0000-eb50-7628ca0d0000 pid=3530 /usr/bin/rm delete-file guuid=27ec4887-1600-0000-eb50-7628580c0000 pid=3160->guuid=ec5c6007-1700-0000-eb50-7628ca0d0000 pid=3530 execve guuid=4506b307-1700-0000-eb50-7628cb0d0000 pid=3531 /usr/bin/rm guuid=27ec4887-1600-0000-eb50-7628580c0000 pid=3160->guuid=4506b307-1700-0000-eb50-7628cb0d0000 pid=3531 execve guuid=85dd4508-1700-0000-eb50-7628ce0d0000 pid=3534 /usr/bin/wget net send-data guuid=27ec4887-1600-0000-eb50-7628580c0000 pid=3160->guuid=85dd4508-1700-0000-eb50-7628ce0d0000 pid=3534 execve guuid=70c6150d-1700-0000-eb50-7628d80d0000 pid=3544 /usr/bin/curl net send-data write-file guuid=27ec4887-1600-0000-eb50-7628580c0000 pid=3160->guuid=70c6150d-1700-0000-eb50-7628d80d0000 pid=3544 execve guuid=95777213-1700-0000-eb50-7628ef0d0000 pid=3567 /usr/bin/chmod guuid=27ec4887-1600-0000-eb50-7628580c0000 pid=3160->guuid=95777213-1700-0000-eb50-7628ef0d0000 pid=3567 execve guuid=5ffec413-1700-0000-eb50-7628f10d0000 pid=3569 /usr/bin/bash guuid=27ec4887-1600-0000-eb50-7628580c0000 pid=3160->guuid=5ffec413-1700-0000-eb50-7628f10d0000 pid=3569 clone guuid=70673314-1700-0000-eb50-7628f50d0000 pid=3573 /usr/bin/rm delete-file guuid=27ec4887-1600-0000-eb50-7628580c0000 pid=3160->guuid=70673314-1700-0000-eb50-7628f50d0000 pid=3573 execve guuid=9cc49814-1700-0000-eb50-7628f70d0000 pid=3575 /usr/bin/rm guuid=27ec4887-1600-0000-eb50-7628580c0000 pid=3160->guuid=9cc49814-1700-0000-eb50-7628f70d0000 pid=3575 execve guuid=6d333315-1700-0000-eb50-7628f90d0000 pid=3577 /usr/bin/wget net send-data guuid=27ec4887-1600-0000-eb50-7628580c0000 pid=3160->guuid=6d333315-1700-0000-eb50-7628f90d0000 pid=3577 execve guuid=b35f6d1a-1700-0000-eb50-76280e0e0000 pid=3598 /usr/bin/curl net send-data write-file guuid=27ec4887-1600-0000-eb50-7628580c0000 pid=3160->guuid=b35f6d1a-1700-0000-eb50-76280e0e0000 pid=3598 execve guuid=4d21c521-1700-0000-eb50-7628270e0000 pid=3623 /usr/bin/chmod guuid=27ec4887-1600-0000-eb50-7628580c0000 pid=3160->guuid=4d21c521-1700-0000-eb50-7628270e0000 pid=3623 execve guuid=1f0f9422-1700-0000-eb50-76282a0e0000 pid=3626 /usr/bin/bash guuid=27ec4887-1600-0000-eb50-7628580c0000 pid=3160->guuid=1f0f9422-1700-0000-eb50-76282a0e0000 pid=3626 clone guuid=b9ca3023-1700-0000-eb50-76282e0e0000 pid=3630 /usr/bin/rm delete-file guuid=27ec4887-1600-0000-eb50-7628580c0000 pid=3160->guuid=b9ca3023-1700-0000-eb50-76282e0e0000 pid=3630 execve guuid=701bf323-1700-0000-eb50-7628320e0000 pid=3634 /usr/bin/rm guuid=27ec4887-1600-0000-eb50-7628580c0000 pid=3160->guuid=701bf323-1700-0000-eb50-7628320e0000 pid=3634 execve guuid=a1e55e24-1700-0000-eb50-7628340e0000 pid=3636 /usr/bin/wget net send-data guuid=27ec4887-1600-0000-eb50-7628580c0000 pid=3160->guuid=a1e55e24-1700-0000-eb50-7628340e0000 pid=3636 execve guuid=6bd86c29-1700-0000-eb50-76284b0e0000 pid=3659 /usr/bin/curl net send-data write-file guuid=27ec4887-1600-0000-eb50-7628580c0000 pid=3160->guuid=6bd86c29-1700-0000-eb50-76284b0e0000 pid=3659 execve guuid=fe5b9f2f-1700-0000-eb50-76286c0e0000 pid=3692 /usr/bin/chmod guuid=27ec4887-1600-0000-eb50-7628580c0000 pid=3160->guuid=fe5b9f2f-1700-0000-eb50-76286c0e0000 pid=3692 execve guuid=3fa1d42f-1700-0000-eb50-76286e0e0000 pid=3694 /usr/bin/bash guuid=27ec4887-1600-0000-eb50-7628580c0000 pid=3160->guuid=3fa1d42f-1700-0000-eb50-76286e0e0000 pid=3694 clone guuid=1fd40e30-1700-0000-eb50-7628700e0000 pid=3696 /usr/bin/rm delete-file guuid=27ec4887-1600-0000-eb50-7628580c0000 pid=3160->guuid=1fd40e30-1700-0000-eb50-7628700e0000 pid=3696 execve guuid=cebefb34-1700-0000-eb50-7628720e0000 pid=3698 /usr/bin/rm guuid=27ec4887-1600-0000-eb50-7628580c0000 pid=3160->guuid=cebefb34-1700-0000-eb50-7628720e0000 pid=3698 execve guuid=80836b35-1700-0000-eb50-7628740e0000 pid=3700 /usr/bin/wget net send-data guuid=27ec4887-1600-0000-eb50-7628580c0000 pid=3160->guuid=80836b35-1700-0000-eb50-7628740e0000 pid=3700 execve guuid=d2cd803a-1700-0000-eb50-7628850e0000 pid=3717 /usr/bin/curl net send-data write-file guuid=27ec4887-1600-0000-eb50-7628580c0000 pid=3160->guuid=d2cd803a-1700-0000-eb50-7628850e0000 pid=3717 execve guuid=4f6bfd3f-1700-0000-eb50-76289f0e0000 pid=3743 /usr/bin/chmod guuid=27ec4887-1600-0000-eb50-7628580c0000 pid=3160->guuid=4f6bfd3f-1700-0000-eb50-76289f0e0000 pid=3743 execve guuid=81353840-1700-0000-eb50-7628a20e0000 pid=3746 /usr/bin/bash guuid=27ec4887-1600-0000-eb50-7628580c0000 pid=3160->guuid=81353840-1700-0000-eb50-7628a20e0000 pid=3746 clone guuid=a6596b40-1700-0000-eb50-7628a40e0000 pid=3748 /usr/bin/rm delete-file guuid=27ec4887-1600-0000-eb50-7628580c0000 pid=3160->guuid=a6596b40-1700-0000-eb50-7628a40e0000 pid=3748 execve guuid=75fea940-1700-0000-eb50-7628a80e0000 pid=3752 /usr/bin/rm guuid=27ec4887-1600-0000-eb50-7628580c0000 pid=3160->guuid=75fea940-1700-0000-eb50-7628a80e0000 pid=3752 execve 31ae31d1-82f1-53e4-9741-df532413b27c 45.135.194.70:80 guuid=62b29887-1600-0000-eb50-76285a0c0000 pid=3162->31ae31d1-82f1-53e4-9741-df532413b27c send: 134B guuid=c0e30a8f-1600-0000-eb50-76286f0c0000 pid=3183->31ae31d1-82f1-53e4-9741-df532413b27c send: 83B guuid=91968d99-1600-0000-eb50-76288a0c0000 pid=3210 /usr/bin/bash guuid=cda57499-1600-0000-eb50-7628890c0000 pid=3209->guuid=91968d99-1600-0000-eb50-76288a0c0000 pid=3210 clone guuid=2ad2729a-1600-0000-eb50-76288d0c0000 pid=3213->31ae31d1-82f1-53e4-9741-df532413b27c send: 134B guuid=bd88fc9f-1600-0000-eb50-76288e0c0000 pid=3214->31ae31d1-82f1-53e4-9741-df532413b27c send: 83B guuid=3074e7a8-1600-0000-eb50-7628a10c0000 pid=3233 /usr/bin/bash guuid=d5d5cba8-1600-0000-eb50-7628a00c0000 pid=3232->guuid=3074e7a8-1600-0000-eb50-7628a10c0000 pid=3233 clone guuid=2039e7a9-1600-0000-eb50-7628a60c0000 pid=3238->31ae31d1-82f1-53e4-9741-df532413b27c send: 134B guuid=f54d3ab1-1600-0000-eb50-7628b30c0000 pid=3251->31ae31d1-82f1-53e4-9741-df532413b27c send: 83B guuid=0d0c45bf-1600-0000-eb50-7628e30c0000 pid=3299 /usr/bin/bash guuid=e9d60bbf-1600-0000-eb50-7628e10c0000 pid=3297->guuid=0d0c45bf-1600-0000-eb50-7628e30c0000 pid=3299 clone guuid=1006bac0-1600-0000-eb50-7628ed0c0000 pid=3309->31ae31d1-82f1-53e4-9741-df532413b27c send: 134B guuid=9b90b0c6-1600-0000-eb50-7628040d0000 pid=3332->31ae31d1-82f1-53e4-9741-df532413b27c send: 83B guuid=af7a20cd-1600-0000-eb50-7628180d0000 pid=3352 /usr/bin/bash guuid=4ac00ecd-1600-0000-eb50-7628160d0000 pid=3350->guuid=af7a20cd-1600-0000-eb50-7628180d0000 pid=3352 clone guuid=3e04a6cd-1600-0000-eb50-76281b0d0000 pid=3355->31ae31d1-82f1-53e4-9741-df532413b27c send: 134B guuid=8aa501d4-1600-0000-eb50-76282f0d0000 pid=3375->31ae31d1-82f1-53e4-9741-df532413b27c send: 83B guuid=2bd2ecdc-1600-0000-eb50-7628490d0000 pid=3401 /usr/bin/bash guuid=2be2d5dc-1600-0000-eb50-7628480d0000 pid=3400->guuid=2bd2ecdc-1600-0000-eb50-7628490d0000 pid=3401 clone guuid=343e98dd-1600-0000-eb50-76284c0d0000 pid=3404->31ae31d1-82f1-53e4-9741-df532413b27c send: 134B guuid=8ebb50e2-1600-0000-eb50-76285c0d0000 pid=3420->31ae31d1-82f1-53e4-9741-df532413b27c send: 83B guuid=f799eae8-1600-0000-eb50-76286e0d0000 pid=3438 /usr/bin/bash guuid=1945d5e8-1600-0000-eb50-76286d0d0000 pid=3437->guuid=f799eae8-1600-0000-eb50-76286e0d0000 pid=3438 clone guuid=5bad87e9-1600-0000-eb50-7628730d0000 pid=3443->31ae31d1-82f1-53e4-9741-df532413b27c send: 134B guuid=814135ee-1600-0000-eb50-7628790d0000 pid=3449->31ae31d1-82f1-53e4-9741-df532413b27c send: 83B guuid=378803f5-1600-0000-eb50-7628890d0000 pid=3465 /usr/bin/bash guuid=aa74ebf4-1600-0000-eb50-7628880d0000 pid=3464->guuid=378803f5-1600-0000-eb50-7628890d0000 pid=3465 clone guuid=e94dabf5-1600-0000-eb50-76288f0d0000 pid=3471->31ae31d1-82f1-53e4-9741-df532413b27c send: 134B guuid=3a863bfa-1600-0000-eb50-7628a30d0000 pid=3491->31ae31d1-82f1-53e4-9741-df532413b27c send: 83B guuid=23ee3c07-1700-0000-eb50-7628c90d0000 pid=3529 /usr/bin/bash guuid=b5332807-1700-0000-eb50-7628c70d0000 pid=3527->guuid=23ee3c07-1700-0000-eb50-7628c90d0000 pid=3529 clone guuid=85dd4508-1700-0000-eb50-7628ce0d0000 pid=3534->31ae31d1-82f1-53e4-9741-df532413b27c send: 134B guuid=70c6150d-1700-0000-eb50-7628d80d0000 pid=3544->31ae31d1-82f1-53e4-9741-df532413b27c send: 83B guuid=96c3fc13-1700-0000-eb50-7628f30d0000 pid=3571 /usr/bin/bash guuid=5ffec413-1700-0000-eb50-7628f10d0000 pid=3569->guuid=96c3fc13-1700-0000-eb50-7628f30d0000 pid=3571 clone guuid=6d333315-1700-0000-eb50-7628f90d0000 pid=3577->31ae31d1-82f1-53e4-9741-df532413b27c send: 134B guuid=b35f6d1a-1700-0000-eb50-76280e0e0000 pid=3598->31ae31d1-82f1-53e4-9741-df532413b27c send: 83B guuid=d8c4d022-1700-0000-eb50-76282c0e0000 pid=3628 /usr/bin/bash guuid=1f0f9422-1700-0000-eb50-76282a0e0000 pid=3626->guuid=d8c4d022-1700-0000-eb50-76282c0e0000 pid=3628 clone guuid=a1e55e24-1700-0000-eb50-7628340e0000 pid=3636->31ae31d1-82f1-53e4-9741-df532413b27c send: 134B guuid=6bd86c29-1700-0000-eb50-76284b0e0000 pid=3659->31ae31d1-82f1-53e4-9741-df532413b27c send: 83B guuid=9b34f72f-1700-0000-eb50-76286f0e0000 pid=3695 /usr/bin/bash guuid=3fa1d42f-1700-0000-eb50-76286e0e0000 pid=3694->guuid=9b34f72f-1700-0000-eb50-76286f0e0000 pid=3695 clone guuid=80836b35-1700-0000-eb50-7628740e0000 pid=3700->31ae31d1-82f1-53e4-9741-df532413b27c send: 134B guuid=d2cd803a-1700-0000-eb50-7628850e0000 pid=3717->31ae31d1-82f1-53e4-9741-df532413b27c send: 83B guuid=02dd4b40-1700-0000-eb50-7628a30e0000 pid=3747 /usr/bin/bash guuid=81353840-1700-0000-eb50-7628a20e0000 pid=3746->guuid=02dd4b40-1700-0000-eb50-7628a30e0000 pid=3747 clone
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/98b611f76688d044be307474b3b84fab26e47a1b7ba5a0efc8dd7033e48e6d6a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/98b611f76688d044be307474b3b84fab26e47a1b7ba5a0efc8dd7033e48e6d6a/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-08-05 06:13:37 UTC
File Type:
Text (Shell)
AV detection:
12 of 24 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=tc3bd53grdiejprqor2lhocpvmtoi6q3pos2b36i3vydhzeonvva._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260805-gyh1naef89/
Behaviour
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.11
Link:
https://yomi.yoroi.company/submissions/98b611f76688d044be307474b3b84fab26e47a1b7ba5a0efc8dd7033e48e6d6a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 98b611f76688d044be307474b3b84fab26e47a1b7ba5a0efc8dd7033e48e6d6a

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3897027/
  
Delivery method
Distributed via web download

Comments