MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9a36fac93aeaf804d2671f270ce0105ef0db4ee4c2a32ce4ce4076c587344888. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9a36fac93aeaf804d2671f270ce0105ef0db4ee4c2a32ce4ce4076c587344888
SHA3-384 hash: 982008c73793312361f346fa7537009868050600ddb299b6d97b28fd2a1beab5aa92bc7a551a5906fabd23d2af5774cf
SHA1 hash: 24baff273e7f5f0b4c47ce1d069a8a49dec36971
MD5 hash: d2e95f0d02f6efbf4493b5eb22d9c4c1
humanhash: princess-dakota-cola-foxtrot
File name:ok
Download: download sample
File size:1'620 bytes
First seen:2026-06-11 08:49:30 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 24:HvFHO7+sxdKs+qi+wTysvpJzCe6lQf+YCZ:Hg7+sx0qzwTysOlQf+tZ
TLSH T1DF31A8AB4F193A8D1900DDAA7364218CF124E5DB208FE7D4FE4C847DA2C9559325AE4B
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://45.205.1.59/caa275n/an/aelf ua-wge
http://45.205.1.59/f01921n/an/aelf ua-wge
http://45.205.1.59/ec5282n/an/aelf ua-wge
http://45.205.1.59/d8525dn/an/aelf ua-wge
http://45.205.1.59/63cba2n/an/aelf ua-wge
http://45.205.1.59/4dc442n/an/aelf ua-wge
http://45.205.1.59/50c7a6n/an/aelf ua-wge
http://45.205.1.59/82b2c0n/an/aelf ua-wge
http://45.205.1.59/e44d32n/an/aelf ua-wge
http://45.205.1.59/3f5b35n/an/aelf ua-wge
http://45.205.1.59/a8db4dn/an/aelf ua-wge
http://45.205.1.59/f554e9n/an/aelf ua-wge

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive
Link:
https://www.filescan.io/uploads/6a2a76a18161ac6cb55efef1/reports/1ce41272-2400-4a29-bd86-bcce97024f72/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-06-11T05:57:00Z UTC
Last seen:
2026-06-12T18:38:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan-Downloader.Shell.Agent.a
Link:
https://opentip.kaspersky.com/9a36fac93aeaf804d2671f270ce0105ef0db4ee4c2a32ce4ce4076c587344888/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/646cc712-c986-4aac-a52a-767e9b5d5c2d
Behavior Graph:
Download SVG
%3 guuid=92508986-1700-0000-a237-5537f80a0000 pid=2808 /usr/bin/sudo guuid=e3064789-1700-0000-a237-5537000b0000 pid=2816 /tmp/sample.bin guuid=92508986-1700-0000-a237-5537f80a0000 pid=2808->guuid=e3064789-1700-0000-a237-5537000b0000 pid=2816 execve guuid=79d5e989-1700-0000-a237-5537020b0000 pid=2818 /usr/bin/wget net send-data guuid=e3064789-1700-0000-a237-5537000b0000 pid=2816->guuid=79d5e989-1700-0000-a237-5537020b0000 pid=2818 execve guuid=799458a6-1700-0000-a237-5537410b0000 pid=2881 /usr/bin/curl net send-data write-file guuid=e3064789-1700-0000-a237-5537000b0000 pid=2816->guuid=799458a6-1700-0000-a237-5537410b0000 pid=2881 execve guuid=e4a27ac4-1700-0000-a237-55377b0b0000 pid=2939 /usr/bin/chmod guuid=e3064789-1700-0000-a237-5537000b0000 pid=2816->guuid=e4a27ac4-1700-0000-a237-55377b0b0000 pid=2939 execve guuid=a9f2d3c4-1700-0000-a237-55377c0b0000 pid=2940 /usr/bin/bash guuid=e3064789-1700-0000-a237-5537000b0000 pid=2816->guuid=a9f2d3c4-1700-0000-a237-55377c0b0000 pid=2940 clone guuid=a50727c5-1700-0000-a237-55377e0b0000 pid=2942 /usr/bin/rm delete-file guuid=e3064789-1700-0000-a237-5537000b0000 pid=2816->guuid=a50727c5-1700-0000-a237-55377e0b0000 pid=2942 execve guuid=359783c5-1700-0000-a237-55377f0b0000 pid=2943 /usr/bin/rm guuid=e3064789-1700-0000-a237-5537000b0000 pid=2816->guuid=359783c5-1700-0000-a237-55377f0b0000 pid=2943 execve guuid=294b00c6-1700-0000-a237-5537800b0000 pid=2944 /usr/bin/wget net send-data guuid=e3064789-1700-0000-a237-5537000b0000 pid=2816->guuid=294b00c6-1700-0000-a237-5537800b0000 pid=2944 execve guuid=696717e0-1700-0000-a237-5537bc0b0000 pid=3004 /usr/bin/curl net send-data write-file guuid=e3064789-1700-0000-a237-5537000b0000 pid=2816->guuid=696717e0-1700-0000-a237-5537bc0b0000 pid=3004 execve guuid=53fc4efb-1700-0000-a237-5537fb0b0000 pid=3067 /usr/bin/chmod guuid=e3064789-1700-0000-a237-5537000b0000 pid=2816->guuid=53fc4efb-1700-0000-a237-5537fb0b0000 pid=3067 execve guuid=d8b093fb-1700-0000-a237-5537fd0b0000 pid=3069 /usr/bin/bash guuid=e3064789-1700-0000-a237-5537000b0000 pid=2816->guuid=d8b093fb-1700-0000-a237-5537fd0b0000 pid=3069 clone guuid=41dbd2fb-1700-0000-a237-5537000c0000 pid=3072 /usr/bin/rm delete-file guuid=e3064789-1700-0000-a237-5537000b0000 pid=2816->guuid=41dbd2fb-1700-0000-a237-5537000c0000 pid=3072 execve guuid=350f3afc-1700-0000-a237-5537020c0000 pid=3074 /usr/bin/rm guuid=e3064789-1700-0000-a237-5537000b0000 pid=2816->guuid=350f3afc-1700-0000-a237-5537020c0000 pid=3074 execve guuid=44ada1fc-1700-0000-a237-5537040c0000 pid=3076 /usr/bin/wget net send-data guuid=e3064789-1700-0000-a237-5537000b0000 pid=2816->guuid=44ada1fc-1700-0000-a237-5537040c0000 pid=3076 execve guuid=703e6416-1800-0000-a237-55373e0c0000 pid=3134 /usr/bin/curl net send-data write-file guuid=e3064789-1700-0000-a237-5537000b0000 pid=2816->guuid=703e6416-1800-0000-a237-55373e0c0000 pid=3134 execve guuid=f817f731-1800-0000-a237-5537750c0000 pid=3189 /usr/bin/chmod guuid=e3064789-1700-0000-a237-5537000b0000 pid=2816->guuid=f817f731-1800-0000-a237-5537750c0000 pid=3189 execve guuid=02915832-1800-0000-a237-5537760c0000 pid=3190 /usr/bin/bash guuid=e3064789-1700-0000-a237-5537000b0000 pid=2816->guuid=02915832-1800-0000-a237-5537760c0000 pid=3190 clone guuid=1450a932-1800-0000-a237-5537780c0000 pid=3192 /usr/bin/rm delete-file guuid=e3064789-1700-0000-a237-5537000b0000 pid=2816->guuid=1450a932-1800-0000-a237-5537780c0000 pid=3192 execve guuid=b0631633-1800-0000-a237-5537790c0000 pid=3193 /usr/bin/rm guuid=e3064789-1700-0000-a237-5537000b0000 pid=2816->guuid=b0631633-1800-0000-a237-5537790c0000 pid=3193 execve guuid=0c097133-1800-0000-a237-55377a0c0000 pid=3194 /usr/bin/wget net send-data guuid=e3064789-1700-0000-a237-5537000b0000 pid=2816->guuid=0c097133-1800-0000-a237-55377a0c0000 pid=3194 execve guuid=3b0e674d-1800-0000-a237-55379f0c0000 pid=3231 /usr/bin/curl net send-data write-file guuid=e3064789-1700-0000-a237-5537000b0000 pid=2816->guuid=3b0e674d-1800-0000-a237-55379f0c0000 pid=3231 execve guuid=1286956c-1800-0000-a237-5537b50c0000 pid=3253 /usr/bin/chmod guuid=e3064789-1700-0000-a237-5537000b0000 pid=2816->guuid=1286956c-1800-0000-a237-5537b50c0000 pid=3253 execve guuid=314bf76c-1800-0000-a237-5537b60c0000 pid=3254 /usr/bin/bash guuid=e3064789-1700-0000-a237-5537000b0000 pid=2816->guuid=314bf76c-1800-0000-a237-5537b60c0000 pid=3254 clone guuid=39b06b6d-1800-0000-a237-5537b80c0000 pid=3256 /usr/bin/rm delete-file guuid=e3064789-1700-0000-a237-5537000b0000 pid=2816->guuid=39b06b6d-1800-0000-a237-5537b80c0000 pid=3256 execve guuid=ac48c26d-1800-0000-a237-5537b90c0000 pid=3257 /usr/bin/rm guuid=e3064789-1700-0000-a237-5537000b0000 pid=2816->guuid=ac48c26d-1800-0000-a237-5537b90c0000 pid=3257 execve guuid=130d106e-1800-0000-a237-5537ba0c0000 pid=3258 /usr/bin/wget net send-data guuid=e3064789-1700-0000-a237-5537000b0000 pid=2816->guuid=130d106e-1800-0000-a237-5537ba0c0000 pid=3258 execve guuid=002bb887-1800-0000-a237-5537f00c0000 pid=3312 /usr/bin/curl net send-data write-file guuid=e3064789-1700-0000-a237-5537000b0000 pid=2816->guuid=002bb887-1800-0000-a237-5537f00c0000 pid=3312 execve guuid=0fe2cba3-1800-0000-a237-5537210d0000 pid=3361 /usr/bin/chmod guuid=e3064789-1700-0000-a237-5537000b0000 pid=2816->guuid=0fe2cba3-1800-0000-a237-5537210d0000 pid=3361 execve guuid=62d135a4-1800-0000-a237-5537230d0000 pid=3363 /usr/bin/bash guuid=e3064789-1700-0000-a237-5537000b0000 pid=2816->guuid=62d135a4-1800-0000-a237-5537230d0000 pid=3363 clone guuid=a2047aa4-1800-0000-a237-5537260d0000 pid=3366 /usr/bin/rm delete-file guuid=e3064789-1700-0000-a237-5537000b0000 pid=2816->guuid=a2047aa4-1800-0000-a237-5537260d0000 pid=3366 execve guuid=2292dca4-1800-0000-a237-5537270d0000 pid=3367 /usr/bin/rm guuid=e3064789-1700-0000-a237-5537000b0000 pid=2816->guuid=2292dca4-1800-0000-a237-5537270d0000 pid=3367 execve guuid=e4b438a5-1800-0000-a237-5537290d0000 pid=3369 /usr/bin/wget net send-data guuid=e3064789-1700-0000-a237-5537000b0000 pid=2816->guuid=e4b438a5-1800-0000-a237-5537290d0000 pid=3369 execve guuid=5e8aeabe-1800-0000-a237-5537610d0000 pid=3425 /usr/bin/curl net send-data write-file guuid=e3064789-1700-0000-a237-5537000b0000 pid=2816->guuid=5e8aeabe-1800-0000-a237-5537610d0000 pid=3425 execve guuid=726492d9-1800-0000-a237-5537b10d0000 pid=3505 /usr/bin/chmod guuid=e3064789-1700-0000-a237-5537000b0000 pid=2816->guuid=726492d9-1800-0000-a237-5537b10d0000 pid=3505 execve guuid=2a3c22da-1800-0000-a237-5537b30d0000 pid=3507 /usr/bin/bash guuid=e3064789-1700-0000-a237-5537000b0000 pid=2816->guuid=2a3c22da-1800-0000-a237-5537b30d0000 pid=3507 clone guuid=a7838eda-1800-0000-a237-5537b60d0000 pid=3510 /usr/bin/rm delete-file guuid=e3064789-1700-0000-a237-5537000b0000 pid=2816->guuid=a7838eda-1800-0000-a237-5537b60d0000 pid=3510 execve guuid=20b2feda-1800-0000-a237-5537b80d0000 pid=3512 /usr/bin/rm guuid=e3064789-1700-0000-a237-5537000b0000 pid=2816->guuid=20b2feda-1800-0000-a237-5537b80d0000 pid=3512 execve guuid=1c454cdb-1800-0000-a237-5537ba0d0000 pid=3514 /usr/bin/wget net send-data guuid=e3064789-1700-0000-a237-5537000b0000 pid=2816->guuid=1c454cdb-1800-0000-a237-5537ba0d0000 pid=3514 execve guuid=883da4f4-1800-0000-a237-5537e80d0000 pid=3560 /usr/bin/curl net send-data write-file guuid=e3064789-1700-0000-a237-5537000b0000 pid=2816->guuid=883da4f4-1800-0000-a237-5537e80d0000 pid=3560 execve guuid=2f3a8910-1900-0000-a237-55371e0e0000 pid=3614 /usr/bin/chmod guuid=e3064789-1700-0000-a237-5537000b0000 pid=2816->guuid=2f3a8910-1900-0000-a237-55371e0e0000 pid=3614 execve guuid=c867d610-1900-0000-a237-5537200e0000 pid=3616 /usr/bin/bash guuid=e3064789-1700-0000-a237-5537000b0000 pid=2816->guuid=c867d610-1900-0000-a237-5537200e0000 pid=3616 clone guuid=c8e16111-1900-0000-a237-5537230e0000 pid=3619 /usr/bin/rm delete-file guuid=e3064789-1700-0000-a237-5537000b0000 pid=2816->guuid=c8e16111-1900-0000-a237-5537230e0000 pid=3619 execve guuid=fecdb311-1900-0000-a237-5537250e0000 pid=3621 /usr/bin/rm guuid=e3064789-1700-0000-a237-5537000b0000 pid=2816->guuid=fecdb311-1900-0000-a237-5537250e0000 pid=3621 execve guuid=8ea81e12-1900-0000-a237-5537270e0000 pid=3623 /usr/bin/wget net send-data guuid=e3064789-1700-0000-a237-5537000b0000 pid=2816->guuid=8ea81e12-1900-0000-a237-5537270e0000 pid=3623 execve guuid=7214022d-1900-0000-a237-5537630e0000 pid=3683 /usr/bin/curl net send-data write-file guuid=e3064789-1700-0000-a237-5537000b0000 pid=2816->guuid=7214022d-1900-0000-a237-5537630e0000 pid=3683 execve guuid=7a52b74c-1900-0000-a237-5537970e0000 pid=3735 /usr/bin/chmod guuid=e3064789-1700-0000-a237-5537000b0000 pid=2816->guuid=7a52b74c-1900-0000-a237-5537970e0000 pid=3735 execve guuid=5174274d-1900-0000-a237-5537990e0000 pid=3737 /usr/bin/bash guuid=e3064789-1700-0000-a237-5537000b0000 pid=2816->guuid=5174274d-1900-0000-a237-5537990e0000 pid=3737 clone guuid=b439724d-1900-0000-a237-55379c0e0000 pid=3740 /usr/bin/rm delete-file guuid=e3064789-1700-0000-a237-5537000b0000 pid=2816->guuid=b439724d-1900-0000-a237-55379c0e0000 pid=3740 execve guuid=e4d3d04d-1900-0000-a237-55379e0e0000 pid=3742 /usr/bin/rm guuid=e3064789-1700-0000-a237-5537000b0000 pid=2816->guuid=e4d3d04d-1900-0000-a237-55379e0e0000 pid=3742 execve guuid=ed3b324e-1900-0000-a237-5537a00e0000 pid=3744 /usr/bin/wget net send-data guuid=e3064789-1700-0000-a237-5537000b0000 pid=2816->guuid=ed3b324e-1900-0000-a237-5537a00e0000 pid=3744 execve guuid=7622aa68-1900-0000-a237-5537040f0000 pid=3844 /usr/bin/curl net send-data write-file guuid=e3064789-1700-0000-a237-5537000b0000 pid=2816->guuid=7622aa68-1900-0000-a237-5537040f0000 pid=3844 execve guuid=d0ef0c86-1900-0000-a237-55375e0f0000 pid=3934 /usr/bin/chmod guuid=e3064789-1700-0000-a237-5537000b0000 pid=2816->guuid=d0ef0c86-1900-0000-a237-55375e0f0000 pid=3934 execve guuid=dfa5ba86-1900-0000-a237-5537610f0000 pid=3937 /usr/bin/bash guuid=e3064789-1700-0000-a237-5537000b0000 pid=2816->guuid=dfa5ba86-1900-0000-a237-5537610f0000 pid=3937 clone guuid=a7006287-1900-0000-a237-5537630f0000 pid=3939 /usr/bin/rm delete-file guuid=e3064789-1700-0000-a237-5537000b0000 pid=2816->guuid=a7006287-1900-0000-a237-5537630f0000 pid=3939 execve guuid=2028fa87-1900-0000-a237-5537640f0000 pid=3940 /usr/bin/rm guuid=e3064789-1700-0000-a237-5537000b0000 pid=2816->guuid=2028fa87-1900-0000-a237-5537640f0000 pid=3940 execve guuid=44567b88-1900-0000-a237-5537660f0000 pid=3942 /usr/bin/wget net send-data guuid=e3064789-1700-0000-a237-5537000b0000 pid=2816->guuid=44567b88-1900-0000-a237-5537660f0000 pid=3942 execve guuid=cee019a3-1900-0000-a237-5537c10f0000 pid=4033 /usr/bin/curl net send-data write-file guuid=e3064789-1700-0000-a237-5537000b0000 pid=2816->guuid=cee019a3-1900-0000-a237-5537c10f0000 pid=4033 execve guuid=d2cab9bd-1900-0000-a237-553714100000 pid=4116 /usr/bin/chmod guuid=e3064789-1700-0000-a237-5537000b0000 pid=2816->guuid=d2cab9bd-1900-0000-a237-553714100000 pid=4116 execve guuid=ca5604be-1900-0000-a237-553715100000 pid=4117 /usr/bin/bash guuid=e3064789-1700-0000-a237-5537000b0000 pid=2816->guuid=ca5604be-1900-0000-a237-553715100000 pid=4117 clone guuid=7c7546be-1900-0000-a237-553719100000 pid=4121 /usr/bin/rm delete-file guuid=e3064789-1700-0000-a237-5537000b0000 pid=2816->guuid=7c7546be-1900-0000-a237-553719100000 pid=4121 execve guuid=a17d91be-1900-0000-a237-55371a100000 pid=4122 /usr/bin/rm guuid=e3064789-1700-0000-a237-5537000b0000 pid=2816->guuid=a17d91be-1900-0000-a237-55371a100000 pid=4122 execve guuid=025be6be-1900-0000-a237-55371c100000 pid=4124 /usr/bin/wget net send-data guuid=e3064789-1700-0000-a237-5537000b0000 pid=2816->guuid=025be6be-1900-0000-a237-55371c100000 pid=4124 execve guuid=129a04d9-1900-0000-a237-55376d100000 pid=4205 /usr/bin/curl net send-data write-file guuid=e3064789-1700-0000-a237-5537000b0000 pid=2816->guuid=129a04d9-1900-0000-a237-55376d100000 pid=4205 execve guuid=284e0bf6-1900-0000-a237-5537d7100000 pid=4311 /usr/bin/chmod guuid=e3064789-1700-0000-a237-5537000b0000 pid=2816->guuid=284e0bf6-1900-0000-a237-5537d7100000 pid=4311 execve guuid=7dc74ef6-1900-0000-a237-5537d8100000 pid=4312 /usr/bin/bash guuid=e3064789-1700-0000-a237-5537000b0000 pid=2816->guuid=7dc74ef6-1900-0000-a237-5537d8100000 pid=4312 clone guuid=43d6b5f6-1900-0000-a237-5537db100000 pid=4315 /usr/bin/rm delete-file guuid=e3064789-1700-0000-a237-5537000b0000 pid=2816->guuid=43d6b5f6-1900-0000-a237-5537db100000 pid=4315 execve guuid=2b5612f7-1900-0000-a237-5537dd100000 pid=4317 /usr/bin/rm guuid=e3064789-1700-0000-a237-5537000b0000 pid=2816->guuid=2b5612f7-1900-0000-a237-5537dd100000 pid=4317 execve guuid=00fa58f7-1900-0000-a237-5537e1100000 pid=4321 /usr/bin/wget net send-data guuid=e3064789-1700-0000-a237-5537000b0000 pid=2816->guuid=00fa58f7-1900-0000-a237-5537e1100000 pid=4321 execve guuid=0d1afd11-1a00-0000-a237-553744110000 pid=4420 /usr/bin/curl net send-data write-file guuid=e3064789-1700-0000-a237-5537000b0000 pid=2816->guuid=0d1afd11-1a00-0000-a237-553744110000 pid=4420 execve guuid=feaadd2d-1a00-0000-a237-5537ab110000 pid=4523 /usr/bin/chmod guuid=e3064789-1700-0000-a237-5537000b0000 pid=2816->guuid=feaadd2d-1a00-0000-a237-5537ab110000 pid=4523 execve guuid=849c4b2e-1a00-0000-a237-5537ad110000 pid=4525 /usr/bin/bash guuid=e3064789-1700-0000-a237-5537000b0000 pid=2816->guuid=849c4b2e-1a00-0000-a237-5537ad110000 pid=4525 clone guuid=502d982e-1a00-0000-a237-5537b2110000 pid=4530 /usr/bin/rm delete-file guuid=e3064789-1700-0000-a237-5537000b0000 pid=2816->guuid=502d982e-1a00-0000-a237-5537b2110000 pid=4530 execve guuid=fc84e32e-1a00-0000-a237-5537b3110000 pid=4531 /usr/bin/rm guuid=e3064789-1700-0000-a237-5537000b0000 pid=2816->guuid=fc84e32e-1a00-0000-a237-5537b3110000 pid=4531 execve c66e9db5-1465-5188-8e8d-233eabfef671 45.205.1.59:80 guuid=79d5e989-1700-0000-a237-5537020b0000 pid=2818->c66e9db5-1465-5188-8e8d-233eabfef671 send: 132B guuid=799458a6-1700-0000-a237-5537410b0000 pid=2881->c66e9db5-1465-5188-8e8d-233eabfef671 send: 81B guuid=4f7ef3c4-1700-0000-a237-55377d0b0000 pid=2941 /usr/bin/bash guuid=a9f2d3c4-1700-0000-a237-55377c0b0000 pid=2940->guuid=4f7ef3c4-1700-0000-a237-55377d0b0000 pid=2941 clone guuid=294b00c6-1700-0000-a237-5537800b0000 pid=2944->c66e9db5-1465-5188-8e8d-233eabfef671 send: 132B guuid=696717e0-1700-0000-a237-5537bc0b0000 pid=3004->c66e9db5-1465-5188-8e8d-233eabfef671 send: 81B guuid=c419abfb-1700-0000-a237-5537fe0b0000 pid=3070 /usr/bin/bash guuid=d8b093fb-1700-0000-a237-5537fd0b0000 pid=3069->guuid=c419abfb-1700-0000-a237-5537fe0b0000 pid=3070 clone guuid=44ada1fc-1700-0000-a237-5537040c0000 pid=3076->c66e9db5-1465-5188-8e8d-233eabfef671 send: 132B guuid=703e6416-1800-0000-a237-55373e0c0000 pid=3134->c66e9db5-1465-5188-8e8d-233eabfef671 send: 81B guuid=fe4f7b32-1800-0000-a237-5537770c0000 pid=3191 /usr/bin/bash guuid=02915832-1800-0000-a237-5537760c0000 pid=3190->guuid=fe4f7b32-1800-0000-a237-5537770c0000 pid=3191 clone guuid=0c097133-1800-0000-a237-55377a0c0000 pid=3194->c66e9db5-1465-5188-8e8d-233eabfef671 send: 132B guuid=3b0e674d-1800-0000-a237-55379f0c0000 pid=3231->c66e9db5-1465-5188-8e8d-233eabfef671 send: 81B guuid=4f801d6d-1800-0000-a237-5537b70c0000 pid=3255 /usr/bin/bash guuid=314bf76c-1800-0000-a237-5537b60c0000 pid=3254->guuid=4f801d6d-1800-0000-a237-5537b70c0000 pid=3255 clone guuid=130d106e-1800-0000-a237-5537ba0c0000 pid=3258->c66e9db5-1465-5188-8e8d-233eabfef671 send: 132B guuid=002bb887-1800-0000-a237-5537f00c0000 pid=3312->c66e9db5-1465-5188-8e8d-233eabfef671 send: 81B guuid=aaba58a4-1800-0000-a237-5537250d0000 pid=3365 /usr/bin/bash guuid=62d135a4-1800-0000-a237-5537230d0000 pid=3363->guuid=aaba58a4-1800-0000-a237-5537250d0000 pid=3365 clone guuid=e4b438a5-1800-0000-a237-5537290d0000 pid=3369->c66e9db5-1465-5188-8e8d-233eabfef671 send: 132B guuid=5e8aeabe-1800-0000-a237-5537610d0000 pid=3425->c66e9db5-1465-5188-8e8d-233eabfef671 send: 81B guuid=c31d5ada-1800-0000-a237-5537b50d0000 pid=3509 /usr/bin/bash guuid=2a3c22da-1800-0000-a237-5537b30d0000 pid=3507->guuid=c31d5ada-1800-0000-a237-5537b50d0000 pid=3509 clone guuid=1c454cdb-1800-0000-a237-5537ba0d0000 pid=3514->c66e9db5-1465-5188-8e8d-233eabfef671 send: 132B guuid=883da4f4-1800-0000-a237-5537e80d0000 pid=3560->c66e9db5-1465-5188-8e8d-233eabfef671 send: 81B guuid=ce811c11-1900-0000-a237-5537210e0000 pid=3617 /usr/bin/bash guuid=c867d610-1900-0000-a237-5537200e0000 pid=3616->guuid=ce811c11-1900-0000-a237-5537210e0000 pid=3617 clone guuid=8ea81e12-1900-0000-a237-5537270e0000 pid=3623->c66e9db5-1465-5188-8e8d-233eabfef671 send: 132B guuid=7214022d-1900-0000-a237-5537630e0000 pid=3683->c66e9db5-1465-5188-8e8d-233eabfef671 send: 81B guuid=8dd9454d-1900-0000-a237-55379a0e0000 pid=3738 /usr/bin/bash guuid=5174274d-1900-0000-a237-5537990e0000 pid=3737->guuid=8dd9454d-1900-0000-a237-55379a0e0000 pid=3738 clone guuid=ed3b324e-1900-0000-a237-5537a00e0000 pid=3744->c66e9db5-1465-5188-8e8d-233eabfef671 send: 132B guuid=7622aa68-1900-0000-a237-5537040f0000 pid=3844->c66e9db5-1465-5188-8e8d-233eabfef671 send: 81B guuid=1c80fd86-1900-0000-a237-5537620f0000 pid=3938 /usr/bin/bash guuid=dfa5ba86-1900-0000-a237-5537610f0000 pid=3937->guuid=1c80fd86-1900-0000-a237-5537620f0000 pid=3938 clone guuid=44567b88-1900-0000-a237-5537660f0000 pid=3942->c66e9db5-1465-5188-8e8d-233eabfef671 send: 132B guuid=cee019a3-1900-0000-a237-5537c10f0000 pid=4033->c66e9db5-1465-5188-8e8d-233eabfef671 send: 81B guuid=16cd28be-1900-0000-a237-553717100000 pid=4119 /usr/bin/bash guuid=ca5604be-1900-0000-a237-553715100000 pid=4117->guuid=16cd28be-1900-0000-a237-553717100000 pid=4119 clone guuid=025be6be-1900-0000-a237-55371c100000 pid=4124->c66e9db5-1465-5188-8e8d-233eabfef671 send: 132B guuid=129a04d9-1900-0000-a237-55376d100000 pid=4205->c66e9db5-1465-5188-8e8d-233eabfef671 send: 81B guuid=16cc83f6-1900-0000-a237-5537d9100000 pid=4313 /usr/bin/bash guuid=7dc74ef6-1900-0000-a237-5537d8100000 pid=4312->guuid=16cc83f6-1900-0000-a237-5537d9100000 pid=4313 clone guuid=00fa58f7-1900-0000-a237-5537e1100000 pid=4321->c66e9db5-1465-5188-8e8d-233eabfef671 send: 132B guuid=0d1afd11-1a00-0000-a237-553744110000 pid=4420->c66e9db5-1465-5188-8e8d-233eabfef671 send: 81B guuid=caf3702e-1a00-0000-a237-5537ae110000 pid=4526 /usr/bin/bash guuid=849c4b2e-1a00-0000-a237-5537ad110000 pid=4525->guuid=caf3702e-1a00-0000-a237-5537ae110000 pid=4526 clone
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/9a36fac93aeaf804d2671f270ce0105ef0db4ee4c2a32ce4ce4076c587344888
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9a36fac93aeaf804d2671f270ce0105ef0db4ee4c2a32ce4ce4076c587344888/
Verdict:
Malicious
Threat:
Family.MIRAI
Link:
https://tip.neiki.dev/file/9a36fac93aeaf804d2671f270ce0105ef0db4ee4c2a32ce4ce4076c587344888
Threat name:
Script.Downloader.Malgent
Create hunting rule
Status:
Malicious
First seen:
2026-06-11 08:50:57 UTC
File Type:
Text (Shell)
AV detection:
12 of 23 (52.17%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ti3pvsj25l4ajuthd4tqzyaql3ynwtxeykrszzgoib3mlbzujcea._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260611-krb6babw7q/
Behaviour
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.11
Link:
https://yomi.yoroi.company/submissions/9a36fac93aeaf804d2671f270ce0105ef0db4ee4c2a32ce4ce4076c587344888

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 9a36fac93aeaf804d2671f270ce0105ef0db4ee4c2a32ce4ce4076c587344888

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3859834/
  
Delivery method
Distributed via web download

Comments