🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9bc1079e4922b6bcb22defd973170b7e3cb406957adf3ce6dec3478183b496a0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9bc1079e4922b6bcb22defd973170b7e3cb406957adf3ce6dec3478183b496a0
SHA3-384 hash: dc40e4f25c331d2465c5e208cc8f588cb8cf03560ce696fb40bc3415bdd1462509256e9f4919ec13b91912c89ea08b9a
SHA1 hash: da5acd5f5ce697cf7b427ff49ded85ca1103c66c
MD5 hash: 9ef585d5b752d264b68a9b83108f6fc7
humanhash: ohio-red-indigo-ten
File name:9bc1079e4922b6bcb22defd973170b7e3cb406957adf3ce6dec3478183b496a0
Download: download sample
File size:1'608 bytes
First seen:2026-08-30 12:30:18 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 24:cXeLUF8UF5FnFad6weQjHLpFNVNahZLBQwB:3n0rQjEhQwB
TLSH T1E43192CA01201E724113DD4D73B23048728DA5EB2D5FD7E4D85D5EFA828878CF1A0B5E
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter EnthecSolutions
Tags:enthec sh
URLMalware sample (SHA256 hash)SignatureTags
http://5.182.210.174/4a0c85n/an/an/a
http://5.182.210.174/56b24bn/an/an/a
http://5.182.210.174/7e3764n/an/an/a
http://5.182.210.174/dd577dn/an/an/a
http://5.182.210.174/c47ea1n/an/an/a
http://5.182.210.174/e58807n/an/an/a
http://5.182.210.174/eaa1ean/an/an/a
http://5.182.210.174/0d2458n/an/an/a
http://5.182.210.174/934302n/an/an/a
http://5.182.210.174/083585n/an/an/a
http://5.182.210.174/c0159an/an/an/a
http://5.182.210.174/661230n/an/an/a

Intelligence

File Origin
# of uploads :
1
# of downloads :
69
Origin country :
CA CA
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive mirai
Link:
https://www.filescan.io/uploads/6a94228d892df4914ea55071/reports/ace7f367-a83b-495c-aa62-61e71fde7cc5/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-08-28T09:53:00Z UTC
Last seen:
2026-08-31T07:51:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/9bc1079e4922b6bcb22defd973170b7e3cb406957adf3ce6dec3478183b496a0/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/79f0330f-da48-4255-888a-e27aafe63fe5
Behavior Graph:
Download SVG
%3 guuid=a5a2c627-1700-0000-2a45-8771d40c0000 pid=3284 /usr/bin/sudo guuid=9806cb2b-1700-0000-2a45-8771df0c0000 pid=3295 /tmp/sample.bin guuid=a5a2c627-1700-0000-2a45-8771d40c0000 pid=3284->guuid=9806cb2b-1700-0000-2a45-8771df0c0000 pid=3295 execve guuid=e0771b2c-1700-0000-2a45-8771e20c0000 pid=3298 /usr/bin/wget net send-data guuid=9806cb2b-1700-0000-2a45-8771df0c0000 pid=3295->guuid=e0771b2c-1700-0000-2a45-8771e20c0000 pid=3298 execve guuid=cb88462f-1700-0000-2a45-8771ee0c0000 pid=3310 /usr/bin/curl net send-data write-file guuid=9806cb2b-1700-0000-2a45-8771df0c0000 pid=3295->guuid=cb88462f-1700-0000-2a45-8771ee0c0000 pid=3310 execve guuid=a686d737-1700-0000-2a45-87710a0d0000 pid=3338 /usr/bin/chmod guuid=9806cb2b-1700-0000-2a45-8771df0c0000 pid=3295->guuid=a686d737-1700-0000-2a45-87710a0d0000 pid=3338 execve guuid=b7401b38-1700-0000-2a45-87710c0d0000 pid=3340 /usr/bin/bash guuid=9806cb2b-1700-0000-2a45-8771df0c0000 pid=3295->guuid=b7401b38-1700-0000-2a45-87710c0d0000 pid=3340 clone guuid=af69b338-1700-0000-2a45-87710f0d0000 pid=3343 /usr/bin/rm delete-file guuid=9806cb2b-1700-0000-2a45-8771df0c0000 pid=3295->guuid=af69b338-1700-0000-2a45-87710f0d0000 pid=3343 execve guuid=0628f738-1700-0000-2a45-8771110d0000 pid=3345 /usr/bin/rm guuid=9806cb2b-1700-0000-2a45-8771df0c0000 pid=3295->guuid=0628f738-1700-0000-2a45-8771110d0000 pid=3345 execve guuid=903a4739-1700-0000-2a45-8771120d0000 pid=3346 /usr/bin/wget net send-data guuid=9806cb2b-1700-0000-2a45-8771df0c0000 pid=3295->guuid=903a4739-1700-0000-2a45-8771120d0000 pid=3346 execve guuid=7193e73b-1700-0000-2a45-87711c0d0000 pid=3356 /usr/bin/curl net send-data write-file guuid=9806cb2b-1700-0000-2a45-8771df0c0000 pid=3295->guuid=7193e73b-1700-0000-2a45-87711c0d0000 pid=3356 execve guuid=9a4df241-1700-0000-2a45-87712f0d0000 pid=3375 /usr/bin/chmod guuid=9806cb2b-1700-0000-2a45-8771df0c0000 pid=3295->guuid=9a4df241-1700-0000-2a45-87712f0d0000 pid=3375 execve guuid=694a2c42-1700-0000-2a45-8771310d0000 pid=3377 /usr/bin/bash guuid=9806cb2b-1700-0000-2a45-8771df0c0000 pid=3295->guuid=694a2c42-1700-0000-2a45-8771310d0000 pid=3377 clone guuid=234c6c42-1700-0000-2a45-8771370d0000 pid=3383 /usr/bin/rm delete-file guuid=9806cb2b-1700-0000-2a45-8771df0c0000 pid=3295->guuid=234c6c42-1700-0000-2a45-8771370d0000 pid=3383 execve guuid=5aa40143-1700-0000-2a45-8771380d0000 pid=3384 /usr/bin/rm guuid=9806cb2b-1700-0000-2a45-8771df0c0000 pid=3295->guuid=5aa40143-1700-0000-2a45-8771380d0000 pid=3384 execve guuid=66337a43-1700-0000-2a45-8771390d0000 pid=3385 /usr/bin/wget net send-data guuid=9806cb2b-1700-0000-2a45-8771df0c0000 pid=3295->guuid=66337a43-1700-0000-2a45-8771390d0000 pid=3385 execve guuid=df5cd745-1700-0000-2a45-87713a0d0000 pid=3386 /usr/bin/curl net send-data write-file guuid=9806cb2b-1700-0000-2a45-8771df0c0000 pid=3295->guuid=df5cd745-1700-0000-2a45-87713a0d0000 pid=3386 execve guuid=92f31a4a-1700-0000-2a45-8771430d0000 pid=3395 /usr/bin/chmod guuid=9806cb2b-1700-0000-2a45-8771df0c0000 pid=3295->guuid=92f31a4a-1700-0000-2a45-8771430d0000 pid=3395 execve guuid=64135f4a-1700-0000-2a45-8771450d0000 pid=3397 /usr/bin/bash guuid=9806cb2b-1700-0000-2a45-8771df0c0000 pid=3295->guuid=64135f4a-1700-0000-2a45-8771450d0000 pid=3397 clone guuid=df1bde4a-1700-0000-2a45-8771480d0000 pid=3400 /usr/bin/rm delete-file guuid=9806cb2b-1700-0000-2a45-8771df0c0000 pid=3295->guuid=df1bde4a-1700-0000-2a45-8771480d0000 pid=3400 execve guuid=ef542c4b-1700-0000-2a45-8771490d0000 pid=3401 /usr/bin/rm guuid=9806cb2b-1700-0000-2a45-8771df0c0000 pid=3295->guuid=ef542c4b-1700-0000-2a45-8771490d0000 pid=3401 execve guuid=918a724b-1700-0000-2a45-87714b0d0000 pid=3403 /usr/bin/wget net send-data guuid=9806cb2b-1700-0000-2a45-8771df0c0000 pid=3295->guuid=918a724b-1700-0000-2a45-87714b0d0000 pid=3403 execve guuid=2e81714e-1700-0000-2a45-87714f0d0000 pid=3407 /usr/bin/curl net send-data write-file guuid=9806cb2b-1700-0000-2a45-8771df0c0000 pid=3295->guuid=2e81714e-1700-0000-2a45-87714f0d0000 pid=3407 execve guuid=ddb3b152-1700-0000-2a45-8771540d0000 pid=3412 /usr/bin/chmod guuid=9806cb2b-1700-0000-2a45-8771df0c0000 pid=3295->guuid=ddb3b152-1700-0000-2a45-8771540d0000 pid=3412 execve guuid=924b1453-1700-0000-2a45-8771560d0000 pid=3414 /usr/bin/bash guuid=9806cb2b-1700-0000-2a45-8771df0c0000 pid=3295->guuid=924b1453-1700-0000-2a45-8771560d0000 pid=3414 clone guuid=a86e7253-1700-0000-2a45-8771590d0000 pid=3417 /usr/bin/rm delete-file guuid=9806cb2b-1700-0000-2a45-8771df0c0000 pid=3295->guuid=a86e7253-1700-0000-2a45-8771590d0000 pid=3417 execve guuid=377de353-1700-0000-2a45-87715a0d0000 pid=3418 /usr/bin/rm guuid=9806cb2b-1700-0000-2a45-8771df0c0000 pid=3295->guuid=377de353-1700-0000-2a45-87715a0d0000 pid=3418 execve guuid=74057954-1700-0000-2a45-87715b0d0000 pid=3419 /usr/bin/wget net send-data guuid=9806cb2b-1700-0000-2a45-8771df0c0000 pid=3295->guuid=74057954-1700-0000-2a45-87715b0d0000 pid=3419 execve guuid=a8d96a58-1700-0000-2a45-87715e0d0000 pid=3422 /usr/bin/curl net send-data write-file guuid=9806cb2b-1700-0000-2a45-8771df0c0000 pid=3295->guuid=a8d96a58-1700-0000-2a45-87715e0d0000 pid=3422 execve guuid=8f59325c-1700-0000-2a45-8771680d0000 pid=3432 /usr/bin/chmod guuid=9806cb2b-1700-0000-2a45-8771df0c0000 pid=3295->guuid=8f59325c-1700-0000-2a45-8771680d0000 pid=3432 execve guuid=3faa9c5c-1700-0000-2a45-8771690d0000 pid=3433 /usr/bin/bash guuid=9806cb2b-1700-0000-2a45-8771df0c0000 pid=3295->guuid=3faa9c5c-1700-0000-2a45-8771690d0000 pid=3433 clone guuid=a5c9d55c-1700-0000-2a45-87716b0d0000 pid=3435 /usr/bin/rm delete-file guuid=9806cb2b-1700-0000-2a45-8771df0c0000 pid=3295->guuid=a5c9d55c-1700-0000-2a45-87716b0d0000 pid=3435 execve guuid=1f99255d-1700-0000-2a45-87716c0d0000 pid=3436 /usr/bin/rm guuid=9806cb2b-1700-0000-2a45-8771df0c0000 pid=3295->guuid=1f99255d-1700-0000-2a45-87716c0d0000 pid=3436 execve guuid=75ff985d-1700-0000-2a45-87716d0d0000 pid=3437 /usr/bin/wget net send-data guuid=9806cb2b-1700-0000-2a45-8771df0c0000 pid=3295->guuid=75ff985d-1700-0000-2a45-87716d0d0000 pid=3437 execve guuid=32446660-1700-0000-2a45-87716e0d0000 pid=3438 /usr/bin/curl net send-data write-file guuid=9806cb2b-1700-0000-2a45-8771df0c0000 pid=3295->guuid=32446660-1700-0000-2a45-87716e0d0000 pid=3438 execve guuid=4e4ab169-1700-0000-2a45-8771780d0000 pid=3448 /usr/bin/chmod guuid=9806cb2b-1700-0000-2a45-8771df0c0000 pid=3295->guuid=4e4ab169-1700-0000-2a45-8771780d0000 pid=3448 execve guuid=421ff869-1700-0000-2a45-87717a0d0000 pid=3450 /usr/bin/bash guuid=9806cb2b-1700-0000-2a45-8771df0c0000 pid=3295->guuid=421ff869-1700-0000-2a45-87717a0d0000 pid=3450 clone guuid=f59d4e6a-1700-0000-2a45-87717d0d0000 pid=3453 /usr/bin/rm delete-file guuid=9806cb2b-1700-0000-2a45-8771df0c0000 pid=3295->guuid=f59d4e6a-1700-0000-2a45-87717d0d0000 pid=3453 execve guuid=4809bc6a-1700-0000-2a45-87717f0d0000 pid=3455 /usr/bin/rm guuid=9806cb2b-1700-0000-2a45-8771df0c0000 pid=3295->guuid=4809bc6a-1700-0000-2a45-87717f0d0000 pid=3455 execve guuid=42f01a6b-1700-0000-2a45-8771810d0000 pid=3457 /usr/bin/wget net send-data guuid=9806cb2b-1700-0000-2a45-8771df0c0000 pid=3295->guuid=42f01a6b-1700-0000-2a45-8771810d0000 pid=3457 execve guuid=9d969b6e-1700-0000-2a45-8771870d0000 pid=3463 /usr/bin/curl net send-data write-file guuid=9806cb2b-1700-0000-2a45-8771df0c0000 pid=3295->guuid=9d969b6e-1700-0000-2a45-8771870d0000 pid=3463 execve guuid=00058a77-1700-0000-2a45-87719e0d0000 pid=3486 /usr/bin/chmod guuid=9806cb2b-1700-0000-2a45-8771df0c0000 pid=3295->guuid=00058a77-1700-0000-2a45-87719e0d0000 pid=3486 execve guuid=bd00db77-1700-0000-2a45-8771a00d0000 pid=3488 /usr/bin/bash guuid=9806cb2b-1700-0000-2a45-8771df0c0000 pid=3295->guuid=bd00db77-1700-0000-2a45-8771a00d0000 pid=3488 clone guuid=e1f72b78-1700-0000-2a45-8771a20d0000 pid=3490 /usr/bin/rm delete-file guuid=9806cb2b-1700-0000-2a45-8771df0c0000 pid=3295->guuid=e1f72b78-1700-0000-2a45-8771a20d0000 pid=3490 execve guuid=c3289078-1700-0000-2a45-8771a30d0000 pid=3491 /usr/bin/rm guuid=9806cb2b-1700-0000-2a45-8771df0c0000 pid=3295->guuid=c3289078-1700-0000-2a45-8771a30d0000 pid=3491 execve guuid=4faaf278-1700-0000-2a45-8771a50d0000 pid=3493 /usr/bin/wget net send-data guuid=9806cb2b-1700-0000-2a45-8771df0c0000 pid=3295->guuid=4faaf278-1700-0000-2a45-8771a50d0000 pid=3493 execve guuid=7965d37b-1700-0000-2a45-8771ad0d0000 pid=3501 /usr/bin/curl net send-data write-file guuid=9806cb2b-1700-0000-2a45-8771df0c0000 pid=3295->guuid=7965d37b-1700-0000-2a45-8771ad0d0000 pid=3501 execve guuid=9b5aeb86-1700-0000-2a45-8771c00d0000 pid=3520 /usr/bin/chmod guuid=9806cb2b-1700-0000-2a45-8771df0c0000 pid=3295->guuid=9b5aeb86-1700-0000-2a45-8771c00d0000 pid=3520 execve guuid=ff196787-1700-0000-2a45-8771c40d0000 pid=3524 /usr/bin/bash guuid=9806cb2b-1700-0000-2a45-8771df0c0000 pid=3295->guuid=ff196787-1700-0000-2a45-8771c40d0000 pid=3524 clone guuid=17fece87-1700-0000-2a45-8771c70d0000 pid=3527 /usr/bin/rm delete-file guuid=9806cb2b-1700-0000-2a45-8771df0c0000 pid=3295->guuid=17fece87-1700-0000-2a45-8771c70d0000 pid=3527 execve guuid=44043f88-1700-0000-2a45-8771ca0d0000 pid=3530 /usr/bin/rm guuid=9806cb2b-1700-0000-2a45-8771df0c0000 pid=3295->guuid=44043f88-1700-0000-2a45-8771ca0d0000 pid=3530 execve guuid=9bfcb188-1700-0000-2a45-8771cc0d0000 pid=3532 /usr/bin/wget net send-data guuid=9806cb2b-1700-0000-2a45-8771df0c0000 pid=3295->guuid=9bfcb188-1700-0000-2a45-8771cc0d0000 pid=3532 execve guuid=a3b2d18b-1700-0000-2a45-8771d40d0000 pid=3540 /usr/bin/curl net send-data write-file guuid=9806cb2b-1700-0000-2a45-8771df0c0000 pid=3295->guuid=a3b2d18b-1700-0000-2a45-8771d40d0000 pid=3540 execve guuid=502f9b8f-1700-0000-2a45-8771df0d0000 pid=3551 /usr/bin/chmod guuid=9806cb2b-1700-0000-2a45-8771df0c0000 pid=3295->guuid=502f9b8f-1700-0000-2a45-8771df0d0000 pid=3551 execve guuid=75b7e88f-1700-0000-2a45-8771e00d0000 pid=3552 /usr/bin/bash guuid=9806cb2b-1700-0000-2a45-8771df0c0000 pid=3295->guuid=75b7e88f-1700-0000-2a45-8771e00d0000 pid=3552 clone guuid=9fc32690-1700-0000-2a45-8771e20d0000 pid=3554 /usr/bin/rm delete-file guuid=9806cb2b-1700-0000-2a45-8771df0c0000 pid=3295->guuid=9fc32690-1700-0000-2a45-8771e20d0000 pid=3554 execve guuid=0da16f90-1700-0000-2a45-8771e60d0000 pid=3558 /usr/bin/rm guuid=9806cb2b-1700-0000-2a45-8771df0c0000 pid=3295->guuid=0da16f90-1700-0000-2a45-8771e60d0000 pid=3558 execve guuid=c3d8c390-1700-0000-2a45-8771e70d0000 pid=3559 /usr/bin/wget net send-data guuid=9806cb2b-1700-0000-2a45-8771df0c0000 pid=3295->guuid=c3d8c390-1700-0000-2a45-8771e70d0000 pid=3559 execve guuid=c2e14993-1700-0000-2a45-8771ee0d0000 pid=3566 /usr/bin/curl net send-data write-file guuid=9806cb2b-1700-0000-2a45-8771df0c0000 pid=3295->guuid=c2e14993-1700-0000-2a45-8771ee0d0000 pid=3566 execve guuid=f808a497-1700-0000-2a45-8771f90d0000 pid=3577 /usr/bin/chmod guuid=9806cb2b-1700-0000-2a45-8771df0c0000 pid=3295->guuid=f808a497-1700-0000-2a45-8771f90d0000 pid=3577 execve guuid=6f6d0998-1700-0000-2a45-8771fb0d0000 pid=3579 /usr/bin/bash guuid=9806cb2b-1700-0000-2a45-8771df0c0000 pid=3295->guuid=6f6d0998-1700-0000-2a45-8771fb0d0000 pid=3579 clone guuid=17d65b98-1700-0000-2a45-8771fe0d0000 pid=3582 /usr/bin/rm delete-file guuid=9806cb2b-1700-0000-2a45-8771df0c0000 pid=3295->guuid=17d65b98-1700-0000-2a45-8771fe0d0000 pid=3582 execve guuid=6861bd98-1700-0000-2a45-8771000e0000 pid=3584 /usr/bin/rm guuid=9806cb2b-1700-0000-2a45-8771df0c0000 pid=3295->guuid=6861bd98-1700-0000-2a45-8771000e0000 pid=3584 execve guuid=2df02499-1700-0000-2a45-8771010e0000 pid=3585 /usr/bin/wget net send-data guuid=9806cb2b-1700-0000-2a45-8771df0c0000 pid=3295->guuid=2df02499-1700-0000-2a45-8771010e0000 pid=3585 execve guuid=0498229c-1700-0000-2a45-87710c0e0000 pid=3596 /usr/bin/curl net send-data write-file guuid=9806cb2b-1700-0000-2a45-8771df0c0000 pid=3295->guuid=0498229c-1700-0000-2a45-87710c0e0000 pid=3596 execve guuid=56a7efa3-1700-0000-2a45-87711b0e0000 pid=3611 /usr/bin/chmod guuid=9806cb2b-1700-0000-2a45-8771df0c0000 pid=3295->guuid=56a7efa3-1700-0000-2a45-87711b0e0000 pid=3611 execve guuid=a49c7da4-1700-0000-2a45-87711c0e0000 pid=3612 /usr/bin/bash guuid=9806cb2b-1700-0000-2a45-8771df0c0000 pid=3295->guuid=a49c7da4-1700-0000-2a45-87711c0e0000 pid=3612 clone guuid=36da12a5-1700-0000-2a45-87711f0e0000 pid=3615 /usr/bin/rm delete-file guuid=9806cb2b-1700-0000-2a45-8771df0c0000 pid=3295->guuid=36da12a5-1700-0000-2a45-87711f0e0000 pid=3615 execve guuid=02cfb8a5-1700-0000-2a45-8771200e0000 pid=3616 /usr/bin/rm guuid=9806cb2b-1700-0000-2a45-8771df0c0000 pid=3295->guuid=02cfb8a5-1700-0000-2a45-8771200e0000 pid=3616 execve guuid=238e5ba6-1700-0000-2a45-8771220e0000 pid=3618 /usr/bin/wget net send-data guuid=9806cb2b-1700-0000-2a45-8771df0c0000 pid=3295->guuid=238e5ba6-1700-0000-2a45-8771220e0000 pid=3618 execve guuid=6f5e0faa-1700-0000-2a45-8771240e0000 pid=3620 /usr/bin/curl net send-data write-file guuid=9806cb2b-1700-0000-2a45-8771df0c0000 pid=3295->guuid=6f5e0faa-1700-0000-2a45-8771240e0000 pid=3620 execve guuid=dc5773b0-1700-0000-2a45-8771250e0000 pid=3621 /usr/bin/chmod guuid=9806cb2b-1700-0000-2a45-8771df0c0000 pid=3295->guuid=dc5773b0-1700-0000-2a45-8771250e0000 pid=3621 execve guuid=1c2be8b0-1700-0000-2a45-8771260e0000 pid=3622 /usr/bin/bash guuid=9806cb2b-1700-0000-2a45-8771df0c0000 pid=3295->guuid=1c2be8b0-1700-0000-2a45-8771260e0000 pid=3622 clone guuid=6d991ab1-1700-0000-2a45-8771280e0000 pid=3624 /usr/bin/rm delete-file guuid=9806cb2b-1700-0000-2a45-8771df0c0000 pid=3295->guuid=6d991ab1-1700-0000-2a45-8771280e0000 pid=3624 execve guuid=dc0297b1-1700-0000-2a45-8771290e0000 pid=3625 /usr/bin/rm guuid=9806cb2b-1700-0000-2a45-8771df0c0000 pid=3295->guuid=dc0297b1-1700-0000-2a45-8771290e0000 pid=3625 execve 5b654972-c9e1-50d8-b372-2dc2a5b9ad66 5.182.210.174:80 guuid=e0771b2c-1700-0000-2a45-8771e20c0000 pid=3298->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=cb88462f-1700-0000-2a45-8771ee0c0000 pid=3310->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=4c053938-1700-0000-2a45-87710d0d0000 pid=3341 /usr/bin/bash guuid=b7401b38-1700-0000-2a45-87710c0d0000 pid=3340->guuid=4c053938-1700-0000-2a45-87710d0d0000 pid=3341 clone guuid=903a4739-1700-0000-2a45-8771120d0000 pid=3346->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=7193e73b-1700-0000-2a45-87711c0d0000 pid=3356->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=68564042-1700-0000-2a45-8771340d0000 pid=3380 /usr/bin/bash guuid=694a2c42-1700-0000-2a45-8771310d0000 pid=3377->guuid=68564042-1700-0000-2a45-8771340d0000 pid=3380 clone guuid=66337a43-1700-0000-2a45-8771390d0000 pid=3385->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=df5cd745-1700-0000-2a45-87713a0d0000 pid=3386->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=d4e28e4a-1700-0000-2a45-8771460d0000 pid=3398 /usr/bin/bash guuid=64135f4a-1700-0000-2a45-8771450d0000 pid=3397->guuid=d4e28e4a-1700-0000-2a45-8771460d0000 pid=3398 clone guuid=918a724b-1700-0000-2a45-87714b0d0000 pid=3403->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=2e81714e-1700-0000-2a45-87714f0d0000 pid=3407->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=540f2d53-1700-0000-2a45-8771570d0000 pid=3415 /usr/bin/bash guuid=924b1453-1700-0000-2a45-8771560d0000 pid=3414->guuid=540f2d53-1700-0000-2a45-8771570d0000 pid=3415 clone guuid=74057954-1700-0000-2a45-87715b0d0000 pid=3419->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=a8d96a58-1700-0000-2a45-87715e0d0000 pid=3422->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=ee0cb55c-1700-0000-2a45-87716a0d0000 pid=3434 /usr/bin/bash guuid=3faa9c5c-1700-0000-2a45-8771690d0000 pid=3433->guuid=ee0cb55c-1700-0000-2a45-87716a0d0000 pid=3434 clone guuid=75ff985d-1700-0000-2a45-87716d0d0000 pid=3437->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=32446660-1700-0000-2a45-87716e0d0000 pid=3438->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=32b1206a-1700-0000-2a45-87717c0d0000 pid=3452 /usr/bin/bash guuid=421ff869-1700-0000-2a45-87717a0d0000 pid=3450->guuid=32b1206a-1700-0000-2a45-87717c0d0000 pid=3452 clone guuid=42f01a6b-1700-0000-2a45-8771810d0000 pid=3457->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=9d969b6e-1700-0000-2a45-8771870d0000 pid=3463->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=3ceefa77-1700-0000-2a45-8771a10d0000 pid=3489 /usr/bin/bash guuid=bd00db77-1700-0000-2a45-8771a00d0000 pid=3488->guuid=3ceefa77-1700-0000-2a45-8771a10d0000 pid=3489 clone guuid=4faaf278-1700-0000-2a45-8771a50d0000 pid=3493->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=7965d37b-1700-0000-2a45-8771ad0d0000 pid=3501->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=426c9287-1700-0000-2a45-8771c50d0000 pid=3525 /usr/bin/bash guuid=ff196787-1700-0000-2a45-8771c40d0000 pid=3524->guuid=426c9287-1700-0000-2a45-8771c50d0000 pid=3525 clone guuid=9bfcb188-1700-0000-2a45-8771cc0d0000 pid=3532->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=a3b2d18b-1700-0000-2a45-8771d40d0000 pid=3540->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=00140590-1700-0000-2a45-8771e10d0000 pid=3553 /usr/bin/bash guuid=75b7e88f-1700-0000-2a45-8771e00d0000 pid=3552->guuid=00140590-1700-0000-2a45-8771e10d0000 pid=3553 clone guuid=c3d8c390-1700-0000-2a45-8771e70d0000 pid=3559->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=c2e14993-1700-0000-2a45-8771ee0d0000 pid=3566->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=1ed42c98-1700-0000-2a45-8771fc0d0000 pid=3580 /usr/bin/bash guuid=6f6d0998-1700-0000-2a45-8771fb0d0000 pid=3579->guuid=1ed42c98-1700-0000-2a45-8771fc0d0000 pid=3580 clone guuid=2df02499-1700-0000-2a45-8771010e0000 pid=3585->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=0498229c-1700-0000-2a45-87710c0e0000 pid=3596->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=4bb1c3a4-1700-0000-2a45-87711d0e0000 pid=3613 /usr/bin/bash guuid=a49c7da4-1700-0000-2a45-87711c0e0000 pid=3612->guuid=4bb1c3a4-1700-0000-2a45-87711d0e0000 pid=3613 clone guuid=238e5ba6-1700-0000-2a45-8771220e0000 pid=3618->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=6f5e0faa-1700-0000-2a45-8771240e0000 pid=3620->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=67c4feb0-1700-0000-2a45-8771270e0000 pid=3623 /usr/bin/bash guuid=1c2be8b0-1700-0000-2a45-8771260e0000 pid=3622->guuid=67c4feb0-1700-0000-2a45-8771270e0000 pid=3623 clone
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/9bc1079e4922b6bcb22defd973170b7e3cb406957adf3ce6dec3478183b496a0
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9bc1079e4922b6bcb22defd973170b7e3cb406957adf3ce6dec3478183b496a0/
Threat name:
Linux.Trojan.Multiverze
Create hunting rule
Status:
Malicious
First seen:
2026-08-28 21:02:43 UTC
File Type:
Text (Shell)
AV detection:
17 of 38 (44.74%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=tpaqphsjek3lzmrn57mxgfylpy6libuvplptzzw6yndyda5us2qa._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260830-pplzystcpd/
Behaviour
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.11
Link:
https://yomi.yoroi.company/submissions/9bc1079e4922b6bcb22defd973170b7e3cb406957adf3ce6dec3478183b496a0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments