MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9d9df4e7758835df049369977be0a0b0ac1b5e2dc5cd28cb5f759bc4a28bdbca. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9d9df4e7758835df049369977be0a0b0ac1b5e2dc5cd28cb5f759bc4a28bdbca
SHA3-384 hash: 8caf8194870652fb23e39e65d2e3b5ade28dedc1ddbfcb21d129b925a7503906165b229eabdf66330c8349bfba935f2d
SHA1 hash: f152781363f6497569e2d84ffa47b62780a2a689
MD5 hash: 4e9dad47c0681e589285bf52cc330328
humanhash: alpha-twelve-dakota-fourteen
File name:9d9df4e7758835df049369977be0a0b0ac1b5e2dc5cd28cb5f759bc4a28bdbca
Download: download sample
File size:1'608 bytes
First seen:2026-08-27 06:25:32 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 12:UvT6vZ0I1mx6mTCi7NFI6NFEcmLD4OLN6V6srxDScr46Scrqt3WI6W7AQ4Nt6Nbw:ygmIwPhmLDBa0crScrihTtsNDAsU+sqF
TLSH T16031649E94142E710042CE8E73B23648B1CDA5E7198FD3E499490EAE53CC78CFA61F5C
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter cybersecproject
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://5.182.210.174/26f10en/an/an/a
http://5.182.210.174/a386d9n/an/an/a
http://5.182.210.174/997e92n/an/an/a
http://5.182.210.174/d94f18n/an/an/a
http://5.182.210.174/b090d2n/an/an/a
http://5.182.210.174/0ef2b1n/an/an/a
http://5.182.210.174/99fe7bn/an/an/a
http://5.182.210.174/dd9a27n/an/an/a
http://5.182.210.174/a626e1n/an/an/a
http://5.182.210.174/7dfb11n/an/an/a
http://5.182.210.174/8e2badn/an/an/a
http://5.182.210.174/358868n/an/an/a

Intelligence

File Origin
# of uploads :
1
# of downloads :
66
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive mirai
Link:
https://www.filescan.io/uploads/6a8fd88636668a3a60091230/reports/bbc5ea58-bacd-4365-92c8-59a9dda0c498/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-08-27T06:01:00Z UTC
Last seen:
2026-08-27T06:37:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/9d9df4e7758835df049369977be0a0b0ac1b5e2dc5cd28cb5f759bc4a28bdbca/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/4ed10038-e385-42e9-b383-c14a2094e624
Behavior Graph:
Download SVG
%3 guuid=396217ec-1600-0000-9f2a-ff62150c0000 pid=3093 /usr/bin/sudo guuid=9e3cdbf0-1600-0000-9f2a-ff62160c0000 pid=3094 /tmp/sample.bin guuid=396217ec-1600-0000-9f2a-ff62150c0000 pid=3093->guuid=9e3cdbf0-1600-0000-9f2a-ff62160c0000 pid=3094 execve guuid=bf5302f2-1600-0000-9f2a-ff62170c0000 pid=3095 /usr/bin/wget net send-data guuid=9e3cdbf0-1600-0000-9f2a-ff62160c0000 pid=3094->guuid=bf5302f2-1600-0000-9f2a-ff62170c0000 pid=3095 execve guuid=469ba1fa-1600-0000-9f2a-ff62180c0000 pid=3096 /usr/bin/curl net send-data write-file guuid=9e3cdbf0-1600-0000-9f2a-ff62160c0000 pid=3094->guuid=469ba1fa-1600-0000-9f2a-ff62180c0000 pid=3096 execve guuid=03fd9204-1700-0000-9f2a-ff621f0c0000 pid=3103 /usr/bin/chmod guuid=9e3cdbf0-1600-0000-9f2a-ff62160c0000 pid=3094->guuid=03fd9204-1700-0000-9f2a-ff621f0c0000 pid=3103 execve guuid=f9c8ce04-1700-0000-9f2a-ff62200c0000 pid=3104 /usr/bin/bash guuid=9e3cdbf0-1600-0000-9f2a-ff62160c0000 pid=3094->guuid=f9c8ce04-1700-0000-9f2a-ff62200c0000 pid=3104 clone guuid=4122fd04-1700-0000-9f2a-ff62230c0000 pid=3107 /usr/bin/rm delete-file guuid=9e3cdbf0-1600-0000-9f2a-ff62160c0000 pid=3094->guuid=4122fd04-1700-0000-9f2a-ff62230c0000 pid=3107 execve guuid=7f743705-1700-0000-9f2a-ff62240c0000 pid=3108 /usr/bin/rm guuid=9e3cdbf0-1600-0000-9f2a-ff62160c0000 pid=3094->guuid=7f743705-1700-0000-9f2a-ff62240c0000 pid=3108 execve guuid=09b76f05-1700-0000-9f2a-ff62250c0000 pid=3109 /usr/bin/wget net send-data guuid=9e3cdbf0-1600-0000-9f2a-ff62160c0000 pid=3094->guuid=09b76f05-1700-0000-9f2a-ff62250c0000 pid=3109 execve guuid=ac240208-1700-0000-9f2a-ff622a0c0000 pid=3114 /usr/bin/curl net send-data write-file guuid=9e3cdbf0-1600-0000-9f2a-ff62160c0000 pid=3094->guuid=ac240208-1700-0000-9f2a-ff622a0c0000 pid=3114 execve guuid=d8d7240e-1700-0000-9f2a-ff62350c0000 pid=3125 /usr/bin/chmod guuid=9e3cdbf0-1600-0000-9f2a-ff62160c0000 pid=3094->guuid=d8d7240e-1700-0000-9f2a-ff62350c0000 pid=3125 execve guuid=afe9840e-1700-0000-9f2a-ff62360c0000 pid=3126 /usr/bin/bash guuid=9e3cdbf0-1600-0000-9f2a-ff62160c0000 pid=3094->guuid=afe9840e-1700-0000-9f2a-ff62360c0000 pid=3126 clone guuid=11c2d40e-1700-0000-9f2a-ff62380c0000 pid=3128 /usr/bin/rm delete-file guuid=9e3cdbf0-1600-0000-9f2a-ff62160c0000 pid=3094->guuid=11c2d40e-1700-0000-9f2a-ff62380c0000 pid=3128 execve guuid=5daa380f-1700-0000-9f2a-ff62390c0000 pid=3129 /usr/bin/rm guuid=9e3cdbf0-1600-0000-9f2a-ff62160c0000 pid=3094->guuid=5daa380f-1700-0000-9f2a-ff62390c0000 pid=3129 execve guuid=5f14a00f-1700-0000-9f2a-ff623a0c0000 pid=3130 /usr/bin/wget net send-data guuid=9e3cdbf0-1600-0000-9f2a-ff62160c0000 pid=3094->guuid=5f14a00f-1700-0000-9f2a-ff623a0c0000 pid=3130 execve guuid=4bdc0513-1700-0000-9f2a-ff623c0c0000 pid=3132 /usr/bin/curl net send-data write-file guuid=9e3cdbf0-1600-0000-9f2a-ff62160c0000 pid=3094->guuid=4bdc0513-1700-0000-9f2a-ff623c0c0000 pid=3132 execve guuid=f81b9e19-1700-0000-9f2a-ff624a0c0000 pid=3146 /usr/bin/chmod guuid=9e3cdbf0-1600-0000-9f2a-ff62160c0000 pid=3094->guuid=f81b9e19-1700-0000-9f2a-ff624a0c0000 pid=3146 execve guuid=dbaa441a-1700-0000-9f2a-ff624c0c0000 pid=3148 /usr/bin/bash guuid=9e3cdbf0-1600-0000-9f2a-ff62160c0000 pid=3094->guuid=dbaa441a-1700-0000-9f2a-ff624c0c0000 pid=3148 clone guuid=432dcc1a-1700-0000-9f2a-ff624f0c0000 pid=3151 /usr/bin/rm delete-file guuid=9e3cdbf0-1600-0000-9f2a-ff62160c0000 pid=3094->guuid=432dcc1a-1700-0000-9f2a-ff624f0c0000 pid=3151 execve guuid=c7d06d1b-1700-0000-9f2a-ff62520c0000 pid=3154 /usr/bin/rm guuid=9e3cdbf0-1600-0000-9f2a-ff62160c0000 pid=3094->guuid=c7d06d1b-1700-0000-9f2a-ff62520c0000 pid=3154 execve guuid=a5620d1c-1700-0000-9f2a-ff62550c0000 pid=3157 /usr/bin/wget net send-data guuid=9e3cdbf0-1600-0000-9f2a-ff62160c0000 pid=3094->guuid=a5620d1c-1700-0000-9f2a-ff62550c0000 pid=3157 execve guuid=1f12a61f-1700-0000-9f2a-ff625b0c0000 pid=3163 /usr/bin/curl net send-data write-file guuid=9e3cdbf0-1600-0000-9f2a-ff62160c0000 pid=3094->guuid=1f12a61f-1700-0000-9f2a-ff625b0c0000 pid=3163 execve guuid=11977c24-1700-0000-9f2a-ff62640c0000 pid=3172 /usr/bin/chmod guuid=9e3cdbf0-1600-0000-9f2a-ff62160c0000 pid=3094->guuid=11977c24-1700-0000-9f2a-ff62640c0000 pid=3172 execve guuid=5bacd624-1700-0000-9f2a-ff62650c0000 pid=3173 /usr/bin/bash guuid=9e3cdbf0-1600-0000-9f2a-ff62160c0000 pid=3094->guuid=5bacd624-1700-0000-9f2a-ff62650c0000 pid=3173 clone guuid=db1e2825-1700-0000-9f2a-ff62680c0000 pid=3176 /usr/bin/rm delete-file guuid=9e3cdbf0-1600-0000-9f2a-ff62160c0000 pid=3094->guuid=db1e2825-1700-0000-9f2a-ff62680c0000 pid=3176 execve guuid=b7cb8125-1700-0000-9f2a-ff62690c0000 pid=3177 /usr/bin/rm guuid=9e3cdbf0-1600-0000-9f2a-ff62160c0000 pid=3094->guuid=b7cb8125-1700-0000-9f2a-ff62690c0000 pid=3177 execve guuid=4d74d225-1700-0000-9f2a-ff626b0c0000 pid=3179 /usr/bin/wget net send-data guuid=9e3cdbf0-1600-0000-9f2a-ff62160c0000 pid=3094->guuid=4d74d225-1700-0000-9f2a-ff626b0c0000 pid=3179 execve guuid=c7ca7229-1700-0000-9f2a-ff62710c0000 pid=3185 /usr/bin/curl net send-data write-file guuid=9e3cdbf0-1600-0000-9f2a-ff62160c0000 pid=3094->guuid=c7ca7229-1700-0000-9f2a-ff62710c0000 pid=3185 execve guuid=0675fb2e-1700-0000-9f2a-ff627c0c0000 pid=3196 /usr/bin/chmod guuid=9e3cdbf0-1600-0000-9f2a-ff62160c0000 pid=3094->guuid=0675fb2e-1700-0000-9f2a-ff627c0c0000 pid=3196 execve guuid=73ec602f-1700-0000-9f2a-ff627d0c0000 pid=3197 /usr/bin/bash guuid=9e3cdbf0-1600-0000-9f2a-ff62160c0000 pid=3094->guuid=73ec602f-1700-0000-9f2a-ff627d0c0000 pid=3197 clone guuid=77d3b82f-1700-0000-9f2a-ff62800c0000 pid=3200 /usr/bin/rm delete-file guuid=9e3cdbf0-1600-0000-9f2a-ff62160c0000 pid=3094->guuid=77d3b82f-1700-0000-9f2a-ff62800c0000 pid=3200 execve guuid=192e1430-1700-0000-9f2a-ff62810c0000 pid=3201 /usr/bin/rm guuid=9e3cdbf0-1600-0000-9f2a-ff62160c0000 pid=3094->guuid=192e1430-1700-0000-9f2a-ff62810c0000 pid=3201 execve guuid=33ca6830-1700-0000-9f2a-ff62820c0000 pid=3202 /usr/bin/wget net send-data guuid=9e3cdbf0-1600-0000-9f2a-ff62160c0000 pid=3094->guuid=33ca6830-1700-0000-9f2a-ff62820c0000 pid=3202 execve guuid=7c934b33-1700-0000-9f2a-ff62890c0000 pid=3209 /usr/bin/curl net send-data write-file guuid=9e3cdbf0-1600-0000-9f2a-ff62160c0000 pid=3094->guuid=7c934b33-1700-0000-9f2a-ff62890c0000 pid=3209 execve guuid=350ee037-1700-0000-9f2a-ff62910c0000 pid=3217 /usr/bin/chmod guuid=9e3cdbf0-1600-0000-9f2a-ff62160c0000 pid=3094->guuid=350ee037-1700-0000-9f2a-ff62910c0000 pid=3217 execve guuid=a22a2138-1700-0000-9f2a-ff62930c0000 pid=3219 /usr/bin/bash guuid=9e3cdbf0-1600-0000-9f2a-ff62160c0000 pid=3094->guuid=a22a2138-1700-0000-9f2a-ff62930c0000 pid=3219 clone guuid=acad5438-1700-0000-9f2a-ff62950c0000 pid=3221 /usr/bin/rm delete-file guuid=9e3cdbf0-1600-0000-9f2a-ff62160c0000 pid=3094->guuid=acad5438-1700-0000-9f2a-ff62950c0000 pid=3221 execve guuid=97f49638-1700-0000-9f2a-ff62960c0000 pid=3222 /usr/bin/rm guuid=9e3cdbf0-1600-0000-9f2a-ff62160c0000 pid=3094->guuid=97f49638-1700-0000-9f2a-ff62960c0000 pid=3222 execve guuid=bbbbd938-1700-0000-9f2a-ff62970c0000 pid=3223 /usr/bin/wget net send-data guuid=9e3cdbf0-1600-0000-9f2a-ff62160c0000 pid=3094->guuid=bbbbd938-1700-0000-9f2a-ff62970c0000 pid=3223 execve guuid=c4472e3d-1700-0000-9f2a-ff629a0c0000 pid=3226 /usr/bin/curl net send-data write-file guuid=9e3cdbf0-1600-0000-9f2a-ff62160c0000 pid=3094->guuid=c4472e3d-1700-0000-9f2a-ff629a0c0000 pid=3226 execve guuid=51490341-1700-0000-9f2a-ff629e0c0000 pid=3230 /usr/bin/chmod guuid=9e3cdbf0-1600-0000-9f2a-ff62160c0000 pid=3094->guuid=51490341-1700-0000-9f2a-ff629e0c0000 pid=3230 execve guuid=da716c41-1700-0000-9f2a-ff62a00c0000 pid=3232 /usr/bin/bash guuid=9e3cdbf0-1600-0000-9f2a-ff62160c0000 pid=3094->guuid=da716c41-1700-0000-9f2a-ff62a00c0000 pid=3232 clone guuid=8dd3b641-1700-0000-9f2a-ff62a20c0000 pid=3234 /usr/bin/rm delete-file guuid=9e3cdbf0-1600-0000-9f2a-ff62160c0000 pid=3094->guuid=8dd3b641-1700-0000-9f2a-ff62a20c0000 pid=3234 execve guuid=23b51d42-1700-0000-9f2a-ff62a40c0000 pid=3236 /usr/bin/rm guuid=9e3cdbf0-1600-0000-9f2a-ff62160c0000 pid=3094->guuid=23b51d42-1700-0000-9f2a-ff62a40c0000 pid=3236 execve guuid=f8407c42-1700-0000-9f2a-ff62a50c0000 pid=3237 /usr/bin/wget net send-data guuid=9e3cdbf0-1600-0000-9f2a-ff62160c0000 pid=3094->guuid=f8407c42-1700-0000-9f2a-ff62a50c0000 pid=3237 execve guuid=c7206d45-1700-0000-9f2a-ff62aa0c0000 pid=3242 /usr/bin/curl net send-data write-file guuid=9e3cdbf0-1600-0000-9f2a-ff62160c0000 pid=3094->guuid=c7206d45-1700-0000-9f2a-ff62aa0c0000 pid=3242 execve guuid=f0e1bb4b-1700-0000-9f2a-ff62b40c0000 pid=3252 /usr/bin/chmod guuid=9e3cdbf0-1600-0000-9f2a-ff62160c0000 pid=3094->guuid=f0e1bb4b-1700-0000-9f2a-ff62b40c0000 pid=3252 execve guuid=389f324c-1700-0000-9f2a-ff62b60c0000 pid=3254 /usr/bin/bash guuid=9e3cdbf0-1600-0000-9f2a-ff62160c0000 pid=3094->guuid=389f324c-1700-0000-9f2a-ff62b60c0000 pid=3254 clone guuid=27717b4c-1700-0000-9f2a-ff62b80c0000 pid=3256 /usr/bin/rm delete-file guuid=9e3cdbf0-1600-0000-9f2a-ff62160c0000 pid=3094->guuid=27717b4c-1700-0000-9f2a-ff62b80c0000 pid=3256 execve guuid=6ddfed4c-1700-0000-9f2a-ff62b90c0000 pid=3257 /usr/bin/rm guuid=9e3cdbf0-1600-0000-9f2a-ff62160c0000 pid=3094->guuid=6ddfed4c-1700-0000-9f2a-ff62b90c0000 pid=3257 execve guuid=5285574d-1700-0000-9f2a-ff62bb0c0000 pid=3259 /usr/bin/wget net send-data guuid=9e3cdbf0-1600-0000-9f2a-ff62160c0000 pid=3094->guuid=5285574d-1700-0000-9f2a-ff62bb0c0000 pid=3259 execve guuid=d31d7350-1700-0000-9f2a-ff62c10c0000 pid=3265 /usr/bin/curl net send-data write-file guuid=9e3cdbf0-1600-0000-9f2a-ff62160c0000 pid=3094->guuid=d31d7350-1700-0000-9f2a-ff62c10c0000 pid=3265 execve guuid=b85d7857-1700-0000-9f2a-ff62cf0c0000 pid=3279 /usr/bin/chmod guuid=9e3cdbf0-1600-0000-9f2a-ff62160c0000 pid=3094->guuid=b85d7857-1700-0000-9f2a-ff62cf0c0000 pid=3279 execve guuid=0758e157-1700-0000-9f2a-ff62d10c0000 pid=3281 /usr/bin/bash guuid=9e3cdbf0-1600-0000-9f2a-ff62160c0000 pid=3094->guuid=0758e157-1700-0000-9f2a-ff62d10c0000 pid=3281 clone guuid=55d52a58-1700-0000-9f2a-ff62d40c0000 pid=3284 /usr/bin/rm delete-file guuid=9e3cdbf0-1600-0000-9f2a-ff62160c0000 pid=3094->guuid=55d52a58-1700-0000-9f2a-ff62d40c0000 pid=3284 execve guuid=50cde158-1700-0000-9f2a-ff62d80c0000 pid=3288 /usr/bin/rm guuid=9e3cdbf0-1600-0000-9f2a-ff62160c0000 pid=3094->guuid=50cde158-1700-0000-9f2a-ff62d80c0000 pid=3288 execve guuid=10325e59-1700-0000-9f2a-ff62d90c0000 pid=3289 /usr/bin/wget net send-data guuid=9e3cdbf0-1600-0000-9f2a-ff62160c0000 pid=3094->guuid=10325e59-1700-0000-9f2a-ff62d90c0000 pid=3289 execve guuid=71cc565c-1700-0000-9f2a-ff62e10c0000 pid=3297 /usr/bin/curl net send-data write-file guuid=9e3cdbf0-1600-0000-9f2a-ff62160c0000 pid=3094->guuid=71cc565c-1700-0000-9f2a-ff62e10c0000 pid=3297 execve guuid=b41dea5f-1700-0000-9f2a-ff62ea0c0000 pid=3306 /usr/bin/chmod guuid=9e3cdbf0-1600-0000-9f2a-ff62160c0000 pid=3094->guuid=b41dea5f-1700-0000-9f2a-ff62ea0c0000 pid=3306 execve guuid=8fba3460-1700-0000-9f2a-ff62ec0c0000 pid=3308 /usr/bin/bash guuid=9e3cdbf0-1600-0000-9f2a-ff62160c0000 pid=3094->guuid=8fba3460-1700-0000-9f2a-ff62ec0c0000 pid=3308 clone guuid=c68f6960-1700-0000-9f2a-ff62ef0c0000 pid=3311 /usr/bin/rm delete-file guuid=9e3cdbf0-1600-0000-9f2a-ff62160c0000 pid=3094->guuid=c68f6960-1700-0000-9f2a-ff62ef0c0000 pid=3311 execve guuid=4214b860-1700-0000-9f2a-ff62f10c0000 pid=3313 /usr/bin/rm guuid=9e3cdbf0-1600-0000-9f2a-ff62160c0000 pid=3094->guuid=4214b860-1700-0000-9f2a-ff62f10c0000 pid=3313 execve guuid=23b3f760-1700-0000-9f2a-ff62f20c0000 pid=3314 /usr/bin/wget net send-data guuid=9e3cdbf0-1600-0000-9f2a-ff62160c0000 pid=3094->guuid=23b3f760-1700-0000-9f2a-ff62f20c0000 pid=3314 execve guuid=0bbbb863-1700-0000-9f2a-ff62fc0c0000 pid=3324 /usr/bin/curl net send-data write-file guuid=9e3cdbf0-1600-0000-9f2a-ff62160c0000 pid=3094->guuid=0bbbb863-1700-0000-9f2a-ff62fc0c0000 pid=3324 execve guuid=8ca2686a-1700-0000-9f2a-ff620e0d0000 pid=3342 /usr/bin/chmod guuid=9e3cdbf0-1600-0000-9f2a-ff62160c0000 pid=3094->guuid=8ca2686a-1700-0000-9f2a-ff620e0d0000 pid=3342 execve guuid=4c7af86a-1700-0000-9f2a-ff62100d0000 pid=3344 /usr/bin/bash guuid=9e3cdbf0-1600-0000-9f2a-ff62160c0000 pid=3094->guuid=4c7af86a-1700-0000-9f2a-ff62100d0000 pid=3344 clone guuid=a719696b-1700-0000-9f2a-ff62130d0000 pid=3347 /usr/bin/rm delete-file guuid=9e3cdbf0-1600-0000-9f2a-ff62160c0000 pid=3094->guuid=a719696b-1700-0000-9f2a-ff62130d0000 pid=3347 execve guuid=635bce6b-1700-0000-9f2a-ff62160d0000 pid=3350 /usr/bin/rm guuid=9e3cdbf0-1600-0000-9f2a-ff62160c0000 pid=3094->guuid=635bce6b-1700-0000-9f2a-ff62160d0000 pid=3350 execve guuid=0a2f106c-1700-0000-9f2a-ff62170d0000 pid=3351 /usr/bin/wget net send-data guuid=9e3cdbf0-1600-0000-9f2a-ff62160c0000 pid=3094->guuid=0a2f106c-1700-0000-9f2a-ff62170d0000 pid=3351 execve guuid=34ac306f-1700-0000-9f2a-ff62210d0000 pid=3361 /usr/bin/curl net send-data write-file guuid=9e3cdbf0-1600-0000-9f2a-ff62160c0000 pid=3094->guuid=34ac306f-1700-0000-9f2a-ff62210d0000 pid=3361 execve guuid=4dc6d472-1700-0000-9f2a-ff622e0d0000 pid=3374 /usr/bin/chmod guuid=9e3cdbf0-1600-0000-9f2a-ff62160c0000 pid=3094->guuid=4dc6d472-1700-0000-9f2a-ff622e0d0000 pid=3374 execve guuid=2a651473-1700-0000-9f2a-ff622f0d0000 pid=3375 /usr/bin/bash guuid=9e3cdbf0-1600-0000-9f2a-ff62160c0000 pid=3094->guuid=2a651473-1700-0000-9f2a-ff622f0d0000 pid=3375 clone guuid=3fdf4a73-1700-0000-9f2a-ff62320d0000 pid=3378 /usr/bin/rm delete-file guuid=9e3cdbf0-1600-0000-9f2a-ff62160c0000 pid=3094->guuid=3fdf4a73-1700-0000-9f2a-ff62320d0000 pid=3378 execve guuid=cb2f9c73-1700-0000-9f2a-ff62340d0000 pid=3380 /usr/bin/rm guuid=9e3cdbf0-1600-0000-9f2a-ff62160c0000 pid=3094->guuid=cb2f9c73-1700-0000-9f2a-ff62340d0000 pid=3380 execve 5b654972-c9e1-50d8-b372-2dc2a5b9ad66 5.182.210.174:80 guuid=bf5302f2-1600-0000-9f2a-ff62170c0000 pid=3095->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=469ba1fa-1600-0000-9f2a-ff62180c0000 pid=3096->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=f769e304-1700-0000-9f2a-ff62220c0000 pid=3106 /usr/bin/bash guuid=f9c8ce04-1700-0000-9f2a-ff62200c0000 pid=3104->guuid=f769e304-1700-0000-9f2a-ff62220c0000 pid=3106 clone guuid=09b76f05-1700-0000-9f2a-ff62250c0000 pid=3109->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=ac240208-1700-0000-9f2a-ff622a0c0000 pid=3114->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=e650a60e-1700-0000-9f2a-ff62370c0000 pid=3127 /usr/bin/bash guuid=afe9840e-1700-0000-9f2a-ff62360c0000 pid=3126->guuid=e650a60e-1700-0000-9f2a-ff62370c0000 pid=3127 clone guuid=5f14a00f-1700-0000-9f2a-ff623a0c0000 pid=3130->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=4bdc0513-1700-0000-9f2a-ff623c0c0000 pid=3132->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=5d17821a-1700-0000-9f2a-ff624d0c0000 pid=3149 /usr/bin/bash guuid=dbaa441a-1700-0000-9f2a-ff624c0c0000 pid=3148->guuid=5d17821a-1700-0000-9f2a-ff624d0c0000 pid=3149 clone guuid=a5620d1c-1700-0000-9f2a-ff62550c0000 pid=3157->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=1f12a61f-1700-0000-9f2a-ff625b0c0000 pid=3163->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=5189f924-1700-0000-9f2a-ff62660c0000 pid=3174 /usr/bin/bash guuid=5bacd624-1700-0000-9f2a-ff62650c0000 pid=3173->guuid=5189f924-1700-0000-9f2a-ff62660c0000 pid=3174 clone guuid=4d74d225-1700-0000-9f2a-ff626b0c0000 pid=3179->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=c7ca7229-1700-0000-9f2a-ff62710c0000 pid=3185->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=07667f2f-1700-0000-9f2a-ff627e0c0000 pid=3198 /usr/bin/bash guuid=73ec602f-1700-0000-9f2a-ff627d0c0000 pid=3197->guuid=07667f2f-1700-0000-9f2a-ff627e0c0000 pid=3198 clone guuid=33ca6830-1700-0000-9f2a-ff62820c0000 pid=3202->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=7c934b33-1700-0000-9f2a-ff62890c0000 pid=3209->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=bd583638-1700-0000-9f2a-ff62940c0000 pid=3220 /usr/bin/bash guuid=a22a2138-1700-0000-9f2a-ff62930c0000 pid=3219->guuid=bd583638-1700-0000-9f2a-ff62940c0000 pid=3220 clone guuid=bbbbd938-1700-0000-9f2a-ff62970c0000 pid=3223->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=c4472e3d-1700-0000-9f2a-ff629a0c0000 pid=3226->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=aa4b8b41-1700-0000-9f2a-ff62a10c0000 pid=3233 /usr/bin/bash guuid=da716c41-1700-0000-9f2a-ff62a00c0000 pid=3232->guuid=aa4b8b41-1700-0000-9f2a-ff62a10c0000 pid=3233 clone guuid=f8407c42-1700-0000-9f2a-ff62a50c0000 pid=3237->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=c7206d45-1700-0000-9f2a-ff62aa0c0000 pid=3242->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=0c5e564c-1700-0000-9f2a-ff62b70c0000 pid=3255 /usr/bin/bash guuid=389f324c-1700-0000-9f2a-ff62b60c0000 pid=3254->guuid=0c5e564c-1700-0000-9f2a-ff62b70c0000 pid=3255 clone guuid=5285574d-1700-0000-9f2a-ff62bb0c0000 pid=3259->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=d31d7350-1700-0000-9f2a-ff62c10c0000 pid=3265->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=138d0658-1700-0000-9f2a-ff62d30c0000 pid=3283 /usr/bin/bash guuid=0758e157-1700-0000-9f2a-ff62d10c0000 pid=3281->guuid=138d0658-1700-0000-9f2a-ff62d30c0000 pid=3283 clone guuid=10325e59-1700-0000-9f2a-ff62d90c0000 pid=3289->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=71cc565c-1700-0000-9f2a-ff62e10c0000 pid=3297->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=dea94a60-1700-0000-9f2a-ff62ed0c0000 pid=3309 /usr/bin/bash guuid=8fba3460-1700-0000-9f2a-ff62ec0c0000 pid=3308->guuid=dea94a60-1700-0000-9f2a-ff62ed0c0000 pid=3309 clone guuid=23b3f760-1700-0000-9f2a-ff62f20c0000 pid=3314->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=0bbbb863-1700-0000-9f2a-ff62fc0c0000 pid=3324->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=464f336b-1700-0000-9f2a-ff62110d0000 pid=3345 /usr/bin/bash guuid=4c7af86a-1700-0000-9f2a-ff62100d0000 pid=3344->guuid=464f336b-1700-0000-9f2a-ff62110d0000 pid=3345 clone guuid=0a2f106c-1700-0000-9f2a-ff62170d0000 pid=3351->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=34ac306f-1700-0000-9f2a-ff62210d0000 pid=3361->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=37c02a73-1700-0000-9f2a-ff62310d0000 pid=3377 /usr/bin/bash guuid=2a651473-1700-0000-9f2a-ff622f0d0000 pid=3375->guuid=37c02a73-1700-0000-9f2a-ff62310d0000 pid=3377 clone
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/9d9df4e7758835df049369977be0a0b0ac1b5e2dc5cd28cb5f759bc4a28bdbca
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9d9df4e7758835df049369977be0a0b0ac1b5e2dc5cd28cb5f759bc4a28bdbca/
Threat name:
Linux.Downloader.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-08-27 06:26:23 UTC
File Type:
Text (Shell)
AV detection:
13 of 36 (36.11%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=two7jz3vra256betnglxxyfawcwbwxrnyxgsrs27own4jiul3pfa._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260827-g7aewagd57/
Behaviour
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.11
Link:
https://yomi.yoroi.company/submissions/9d9df4e7758835df049369977be0a0b0ac1b5e2dc5cd28cb5f759bc4a28bdbca

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments