🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9da127fee206763018ef62aaf8ac54629bf1bae614ca6908eccc7f811bcc0403. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9da127fee206763018ef62aaf8ac54629bf1bae614ca6908eccc7f811bcc0403
SHA3-384 hash: 78356cba3992a9108d0ec161d13982d452655d96abbf81910b0776ebf574a5436ad63d561db29757cb17aa0bfcce508f
SHA1 hash: 6fb6f560cfcd54866d9a249450aebdf932135aa2
MD5 hash: 312967ed23fbea9fe74f5612946da939
humanhash: five-high-michigan-autumn
File name:ok
Download: download sample
File size:1'608 bytes
First seen:2026-08-28 15:08:11 UTC
Last seen:2026-08-28 18:23:01 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 24:o6DDq9wJG5p8OnYxJ/x6+O7BDsIsAXIsbtw8SG5GzIF:odtEZIJScr
TLSH T14F3167CB042099315103D99E7273354C629EB1FB385FDBE5EC585DDD82886CCF256B4A
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://5.182.210.174/448af6n/an/an/a
http://5.182.210.174/792600n/an/an/a
http://5.182.210.174/2ca395n/an/an/a
http://5.182.210.174/c81fb8n/an/an/a
http://5.182.210.174/aeb0e2n/an/an/a
http://5.182.210.174/0c8238n/an/an/a
http://5.182.210.174/159745n/an/an/a
http://5.182.210.174/cee65dn/an/an/a
http://5.182.210.174/3f1acbn/an/an/a
http://5.182.210.174/bb5ac6n/an/an/a
http://5.182.210.174/8f86b7n/an/an/a
http://5.182.210.174/5c1ac3n/an/an/a

Intelligence

File Origin
# of uploads :
2
# of downloads :
58
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-08-28T13:17:00Z UTC
Last seen:
2026-08-29T20:13:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/9da127fee206763018ef62aaf8ac54629bf1bae614ca6908eccc7f811bcc0403/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/4c223d6e-3d58-4838-9d5b-b7c10b1e6faa
Behavior Graph:
Download SVG
%3 guuid=b903eff6-1b00-0000-1281-c3c9e6080000 pid=2278 /usr/bin/sudo guuid=7ce1b1fa-1b00-0000-1281-c3c9ef080000 pid=2287 /tmp/sample.bin guuid=b903eff6-1b00-0000-1281-c3c9e6080000 pid=2278->guuid=7ce1b1fa-1b00-0000-1281-c3c9ef080000 pid=2287 execve guuid=32ff67fb-1b00-0000-1281-c3c9f1080000 pid=2289 /usr/bin/wget net send-data guuid=7ce1b1fa-1b00-0000-1281-c3c9ef080000 pid=2287->guuid=32ff67fb-1b00-0000-1281-c3c9f1080000 pid=2289 execve guuid=3866a4ff-1b00-0000-1281-c3c9fa080000 pid=2298 /usr/bin/curl net send-data write-file guuid=7ce1b1fa-1b00-0000-1281-c3c9ef080000 pid=2287->guuid=3866a4ff-1b00-0000-1281-c3c9fa080000 pid=2298 execve guuid=0d0a3f0c-1c00-0000-1281-c3c907090000 pid=2311 /usr/bin/chmod guuid=7ce1b1fa-1b00-0000-1281-c3c9ef080000 pid=2287->guuid=0d0a3f0c-1c00-0000-1281-c3c907090000 pid=2311 execve guuid=c11eb50c-1c00-0000-1281-c3c908090000 pid=2312 /usr/bin/bash guuid=7ce1b1fa-1b00-0000-1281-c3c9ef080000 pid=2287->guuid=c11eb50c-1c00-0000-1281-c3c908090000 pid=2312 clone guuid=e21a370d-1c00-0000-1281-c3c90b090000 pid=2315 /usr/bin/rm delete-file guuid=7ce1b1fa-1b00-0000-1281-c3c9ef080000 pid=2287->guuid=e21a370d-1c00-0000-1281-c3c90b090000 pid=2315 execve guuid=4aa5a30d-1c00-0000-1281-c3c90c090000 pid=2316 /usr/bin/rm guuid=7ce1b1fa-1b00-0000-1281-c3c9ef080000 pid=2287->guuid=4aa5a30d-1c00-0000-1281-c3c90c090000 pid=2316 execve guuid=f3e70e0e-1c00-0000-1281-c3c90e090000 pid=2318 /usr/bin/wget net send-data guuid=7ce1b1fa-1b00-0000-1281-c3c9ef080000 pid=2287->guuid=f3e70e0e-1c00-0000-1281-c3c90e090000 pid=2318 execve guuid=8be34112-1c00-0000-1281-c3c914090000 pid=2324 /usr/bin/curl net send-data write-file guuid=7ce1b1fa-1b00-0000-1281-c3c9ef080000 pid=2287->guuid=8be34112-1c00-0000-1281-c3c914090000 pid=2324 execve guuid=db60311a-1c00-0000-1281-c3c922090000 pid=2338 /usr/bin/chmod guuid=7ce1b1fa-1b00-0000-1281-c3c9ef080000 pid=2287->guuid=db60311a-1c00-0000-1281-c3c922090000 pid=2338 execve guuid=7499051b-1c00-0000-1281-c3c924090000 pid=2340 /usr/bin/bash guuid=7ce1b1fa-1b00-0000-1281-c3c9ef080000 pid=2287->guuid=7499051b-1c00-0000-1281-c3c924090000 pid=2340 clone guuid=892bb21b-1c00-0000-1281-c3c928090000 pid=2344 /usr/bin/rm delete-file guuid=7ce1b1fa-1b00-0000-1281-c3c9ef080000 pid=2287->guuid=892bb21b-1c00-0000-1281-c3c928090000 pid=2344 execve guuid=b5d6791c-1c00-0000-1281-c3c92b090000 pid=2347 /usr/bin/rm guuid=7ce1b1fa-1b00-0000-1281-c3c9ef080000 pid=2287->guuid=b5d6791c-1c00-0000-1281-c3c92b090000 pid=2347 execve guuid=aee35c1e-1c00-0000-1281-c3c930090000 pid=2352 /usr/bin/wget net send-data guuid=7ce1b1fa-1b00-0000-1281-c3c9ef080000 pid=2287->guuid=aee35c1e-1c00-0000-1281-c3c930090000 pid=2352 execve guuid=d2195c24-1c00-0000-1281-c3c939090000 pid=2361 /usr/bin/curl net send-data write-file guuid=7ce1b1fa-1b00-0000-1281-c3c9ef080000 pid=2287->guuid=d2195c24-1c00-0000-1281-c3c939090000 pid=2361 execve guuid=f3123b2d-1c00-0000-1281-c3c94d090000 pid=2381 /usr/bin/chmod guuid=7ce1b1fa-1b00-0000-1281-c3c9ef080000 pid=2287->guuid=f3123b2d-1c00-0000-1281-c3c94d090000 pid=2381 execve guuid=29a7b12d-1c00-0000-1281-c3c94f090000 pid=2383 /usr/bin/bash guuid=7ce1b1fa-1b00-0000-1281-c3c9ef080000 pid=2287->guuid=29a7b12d-1c00-0000-1281-c3c94f090000 pid=2383 clone guuid=27b4f92d-1c00-0000-1281-c3c951090000 pid=2385 /usr/bin/rm delete-file guuid=7ce1b1fa-1b00-0000-1281-c3c9ef080000 pid=2287->guuid=27b4f92d-1c00-0000-1281-c3c951090000 pid=2385 execve guuid=d5f0412e-1c00-0000-1281-c3c952090000 pid=2386 /usr/bin/rm guuid=7ce1b1fa-1b00-0000-1281-c3c9ef080000 pid=2287->guuid=d5f0412e-1c00-0000-1281-c3c952090000 pid=2386 execve guuid=b43c892e-1c00-0000-1281-c3c954090000 pid=2388 /usr/bin/wget net send-data guuid=7ce1b1fa-1b00-0000-1281-c3c9ef080000 pid=2287->guuid=b43c892e-1c00-0000-1281-c3c954090000 pid=2388 execve guuid=c080b231-1c00-0000-1281-c3c959090000 pid=2393 /usr/bin/curl net send-data write-file guuid=7ce1b1fa-1b00-0000-1281-c3c9ef080000 pid=2287->guuid=c080b231-1c00-0000-1281-c3c959090000 pid=2393 execve guuid=2dc54e36-1c00-0000-1281-c3c962090000 pid=2402 /usr/bin/chmod guuid=7ce1b1fa-1b00-0000-1281-c3c9ef080000 pid=2287->guuid=2dc54e36-1c00-0000-1281-c3c962090000 pid=2402 execve guuid=684bcc36-1c00-0000-1281-c3c964090000 pid=2404 /usr/bin/bash guuid=7ce1b1fa-1b00-0000-1281-c3c9ef080000 pid=2287->guuid=684bcc36-1c00-0000-1281-c3c964090000 pid=2404 clone guuid=eb563837-1c00-0000-1281-c3c967090000 pid=2407 /usr/bin/rm delete-file guuid=7ce1b1fa-1b00-0000-1281-c3c9ef080000 pid=2287->guuid=eb563837-1c00-0000-1281-c3c967090000 pid=2407 execve guuid=d933b037-1c00-0000-1281-c3c969090000 pid=2409 /usr/bin/rm guuid=7ce1b1fa-1b00-0000-1281-c3c9ef080000 pid=2287->guuid=d933b037-1c00-0000-1281-c3c969090000 pid=2409 execve guuid=1b172a38-1c00-0000-1281-c3c96b090000 pid=2411 /usr/bin/wget net send-data guuid=7ce1b1fa-1b00-0000-1281-c3c9ef080000 pid=2287->guuid=1b172a38-1c00-0000-1281-c3c96b090000 pid=2411 execve guuid=c47b173b-1c00-0000-1281-c3c971090000 pid=2417 /usr/bin/curl net send-data write-file guuid=7ce1b1fa-1b00-0000-1281-c3c9ef080000 pid=2287->guuid=c47b173b-1c00-0000-1281-c3c971090000 pid=2417 execve guuid=08ec5e3f-1c00-0000-1281-c3c97b090000 pid=2427 /usr/bin/chmod guuid=7ce1b1fa-1b00-0000-1281-c3c9ef080000 pid=2287->guuid=08ec5e3f-1c00-0000-1281-c3c97b090000 pid=2427 execve guuid=4d60c63f-1c00-0000-1281-c3c97c090000 pid=2428 /usr/bin/bash guuid=7ce1b1fa-1b00-0000-1281-c3c9ef080000 pid=2287->guuid=4d60c63f-1c00-0000-1281-c3c97c090000 pid=2428 clone guuid=c67f8240-1c00-0000-1281-c3c97f090000 pid=2431 /usr/bin/rm delete-file guuid=7ce1b1fa-1b00-0000-1281-c3c9ef080000 pid=2287->guuid=c67f8240-1c00-0000-1281-c3c97f090000 pid=2431 execve guuid=2bb0d940-1c00-0000-1281-c3c981090000 pid=2433 /usr/bin/rm guuid=7ce1b1fa-1b00-0000-1281-c3c9ef080000 pid=2287->guuid=2bb0d940-1c00-0000-1281-c3c981090000 pid=2433 execve guuid=52e13e41-1c00-0000-1281-c3c983090000 pid=2435 /usr/bin/wget net send-data guuid=7ce1b1fa-1b00-0000-1281-c3c9ef080000 pid=2287->guuid=52e13e41-1c00-0000-1281-c3c983090000 pid=2435 execve guuid=f8b0aa44-1c00-0000-1281-c3c98b090000 pid=2443 /usr/bin/curl net send-data write-file guuid=7ce1b1fa-1b00-0000-1281-c3c9ef080000 pid=2287->guuid=f8b0aa44-1c00-0000-1281-c3c98b090000 pid=2443 execve guuid=07720149-1c00-0000-1281-c3c996090000 pid=2454 /usr/bin/chmod guuid=7ce1b1fa-1b00-0000-1281-c3c9ef080000 pid=2287->guuid=07720149-1c00-0000-1281-c3c996090000 pid=2454 execve guuid=8fe18b49-1c00-0000-1281-c3c998090000 pid=2456 /usr/bin/bash guuid=7ce1b1fa-1b00-0000-1281-c3c9ef080000 pid=2287->guuid=8fe18b49-1c00-0000-1281-c3c998090000 pid=2456 clone guuid=c887d649-1c00-0000-1281-c3c99a090000 pid=2458 /usr/bin/rm delete-file guuid=7ce1b1fa-1b00-0000-1281-c3c9ef080000 pid=2287->guuid=c887d649-1c00-0000-1281-c3c99a090000 pid=2458 execve guuid=b2437e4a-1c00-0000-1281-c3c99b090000 pid=2459 /usr/bin/rm guuid=7ce1b1fa-1b00-0000-1281-c3c9ef080000 pid=2287->guuid=b2437e4a-1c00-0000-1281-c3c99b090000 pid=2459 execve guuid=4c0e124b-1c00-0000-1281-c3c99d090000 pid=2461 /usr/bin/wget net send-data guuid=7ce1b1fa-1b00-0000-1281-c3c9ef080000 pid=2287->guuid=4c0e124b-1c00-0000-1281-c3c99d090000 pid=2461 execve guuid=cc604c4e-1c00-0000-1281-c3c9a3090000 pid=2467 /usr/bin/curl net send-data write-file guuid=7ce1b1fa-1b00-0000-1281-c3c9ef080000 pid=2287->guuid=cc604c4e-1c00-0000-1281-c3c9a3090000 pid=2467 execve guuid=97117252-1c00-0000-1281-c3c9ae090000 pid=2478 /usr/bin/chmod guuid=7ce1b1fa-1b00-0000-1281-c3c9ef080000 pid=2287->guuid=97117252-1c00-0000-1281-c3c9ae090000 pid=2478 execve guuid=2260cd52-1c00-0000-1281-c3c9af090000 pid=2479 /usr/bin/bash guuid=7ce1b1fa-1b00-0000-1281-c3c9ef080000 pid=2287->guuid=2260cd52-1c00-0000-1281-c3c9af090000 pid=2479 clone guuid=5cd71c53-1c00-0000-1281-c3c9b2090000 pid=2482 /usr/bin/rm delete-file guuid=7ce1b1fa-1b00-0000-1281-c3c9ef080000 pid=2287->guuid=5cd71c53-1c00-0000-1281-c3c9b2090000 pid=2482 execve guuid=af547753-1c00-0000-1281-c3c9b3090000 pid=2483 /usr/bin/rm guuid=7ce1b1fa-1b00-0000-1281-c3c9ef080000 pid=2287->guuid=af547753-1c00-0000-1281-c3c9b3090000 pid=2483 execve guuid=0d83bc53-1c00-0000-1281-c3c9b5090000 pid=2485 /usr/bin/wget net send-data guuid=7ce1b1fa-1b00-0000-1281-c3c9ef080000 pid=2287->guuid=0d83bc53-1c00-0000-1281-c3c9b5090000 pid=2485 execve guuid=daccf056-1c00-0000-1281-c3c9ba090000 pid=2490 /usr/bin/curl net send-data write-file guuid=7ce1b1fa-1b00-0000-1281-c3c9ef080000 pid=2287->guuid=daccf056-1c00-0000-1281-c3c9ba090000 pid=2490 execve guuid=d8173f60-1c00-0000-1281-c3c9dd090000 pid=2525 /usr/bin/chmod guuid=7ce1b1fa-1b00-0000-1281-c3c9ef080000 pid=2287->guuid=d8173f60-1c00-0000-1281-c3c9dd090000 pid=2525 execve guuid=177b7d60-1c00-0000-1281-c3c9de090000 pid=2526 /usr/bin/bash guuid=7ce1b1fa-1b00-0000-1281-c3c9ef080000 pid=2287->guuid=177b7d60-1c00-0000-1281-c3c9de090000 pid=2526 clone guuid=ff5db160-1c00-0000-1281-c3c9e0090000 pid=2528 /usr/bin/rm delete-file guuid=7ce1b1fa-1b00-0000-1281-c3c9ef080000 pid=2287->guuid=ff5db160-1c00-0000-1281-c3c9e0090000 pid=2528 execve guuid=5cd2f360-1c00-0000-1281-c3c9e2090000 pid=2530 /usr/bin/rm guuid=7ce1b1fa-1b00-0000-1281-c3c9ef080000 pid=2287->guuid=5cd2f360-1c00-0000-1281-c3c9e2090000 pid=2530 execve guuid=314d3161-1c00-0000-1281-c3c9e3090000 pid=2531 /usr/bin/wget net send-data guuid=7ce1b1fa-1b00-0000-1281-c3c9ef080000 pid=2287->guuid=314d3161-1c00-0000-1281-c3c9e3090000 pid=2531 execve guuid=3c1e6765-1c00-0000-1281-c3c9ed090000 pid=2541 /usr/bin/curl net send-data write-file guuid=7ce1b1fa-1b00-0000-1281-c3c9ef080000 pid=2287->guuid=3c1e6765-1c00-0000-1281-c3c9ed090000 pid=2541 execve guuid=7df9526b-1c00-0000-1281-c3c9f9090000 pid=2553 /usr/bin/chmod guuid=7ce1b1fa-1b00-0000-1281-c3c9ef080000 pid=2287->guuid=7df9526b-1c00-0000-1281-c3c9f9090000 pid=2553 execve guuid=15d8016c-1c00-0000-1281-c3c9fc090000 pid=2556 /usr/bin/bash guuid=7ce1b1fa-1b00-0000-1281-c3c9ef080000 pid=2287->guuid=15d8016c-1c00-0000-1281-c3c9fc090000 pid=2556 clone guuid=a01ce76c-1c00-0000-1281-c3c9000a0000 pid=2560 /usr/bin/rm delete-file guuid=7ce1b1fa-1b00-0000-1281-c3c9ef080000 pid=2287->guuid=a01ce76c-1c00-0000-1281-c3c9000a0000 pid=2560 execve guuid=b3bffe6d-1c00-0000-1281-c3c9040a0000 pid=2564 /usr/bin/rm guuid=7ce1b1fa-1b00-0000-1281-c3c9ef080000 pid=2287->guuid=b3bffe6d-1c00-0000-1281-c3c9040a0000 pid=2564 execve guuid=e855196f-1c00-0000-1281-c3c9080a0000 pid=2568 /usr/bin/wget net send-data guuid=7ce1b1fa-1b00-0000-1281-c3c9ef080000 pid=2287->guuid=e855196f-1c00-0000-1281-c3c9080a0000 pid=2568 execve guuid=cbd65f74-1c00-0000-1281-c3c9120a0000 pid=2578 /usr/bin/curl net send-data write-file guuid=7ce1b1fa-1b00-0000-1281-c3c9ef080000 pid=2287->guuid=cbd65f74-1c00-0000-1281-c3c9120a0000 pid=2578 execve guuid=62e7837a-1c00-0000-1281-c3c91b0a0000 pid=2587 /usr/bin/chmod guuid=7ce1b1fa-1b00-0000-1281-c3c9ef080000 pid=2287->guuid=62e7837a-1c00-0000-1281-c3c91b0a0000 pid=2587 execve guuid=2728d67a-1c00-0000-1281-c3c91d0a0000 pid=2589 /usr/bin/bash guuid=7ce1b1fa-1b00-0000-1281-c3c9ef080000 pid=2287->guuid=2728d67a-1c00-0000-1281-c3c91d0a0000 pid=2589 clone guuid=1342337b-1c00-0000-1281-c3c9200a0000 pid=2592 /usr/bin/rm delete-file guuid=7ce1b1fa-1b00-0000-1281-c3c9ef080000 pid=2287->guuid=1342337b-1c00-0000-1281-c3c9200a0000 pid=2592 execve guuid=f427a57b-1c00-0000-1281-c3c9210a0000 pid=2593 /usr/bin/rm guuid=7ce1b1fa-1b00-0000-1281-c3c9ef080000 pid=2287->guuid=f427a57b-1c00-0000-1281-c3c9210a0000 pid=2593 execve guuid=ce7d067c-1c00-0000-1281-c3c9230a0000 pid=2595 /usr/bin/wget net send-data guuid=7ce1b1fa-1b00-0000-1281-c3c9ef080000 pid=2287->guuid=ce7d067c-1c00-0000-1281-c3c9230a0000 pid=2595 execve guuid=a02e227f-1c00-0000-1281-c3c92c0a0000 pid=2604 /usr/bin/curl net send-data write-file guuid=7ce1b1fa-1b00-0000-1281-c3c9ef080000 pid=2287->guuid=a02e227f-1c00-0000-1281-c3c92c0a0000 pid=2604 execve guuid=b58ffb83-1c00-0000-1281-c3c9380a0000 pid=2616 /usr/bin/chmod guuid=7ce1b1fa-1b00-0000-1281-c3c9ef080000 pid=2287->guuid=b58ffb83-1c00-0000-1281-c3c9380a0000 pid=2616 execve guuid=ff146684-1c00-0000-1281-c3c9390a0000 pid=2617 /usr/bin/bash guuid=7ce1b1fa-1b00-0000-1281-c3c9ef080000 pid=2287->guuid=ff146684-1c00-0000-1281-c3c9390a0000 pid=2617 clone guuid=09fbca84-1c00-0000-1281-c3c93c0a0000 pid=2620 /usr/bin/rm delete-file guuid=7ce1b1fa-1b00-0000-1281-c3c9ef080000 pid=2287->guuid=09fbca84-1c00-0000-1281-c3c93c0a0000 pid=2620 execve guuid=55753b85-1c00-0000-1281-c3c93e0a0000 pid=2622 /usr/bin/rm guuid=7ce1b1fa-1b00-0000-1281-c3c9ef080000 pid=2287->guuid=55753b85-1c00-0000-1281-c3c93e0a0000 pid=2622 execve guuid=6bdaad85-1c00-0000-1281-c3c9400a0000 pid=2624 /usr/bin/wget net send-data guuid=7ce1b1fa-1b00-0000-1281-c3c9ef080000 pid=2287->guuid=6bdaad85-1c00-0000-1281-c3c9400a0000 pid=2624 execve guuid=8a07bb88-1c00-0000-1281-c3c9470a0000 pid=2631 /usr/bin/curl net send-data write-file guuid=7ce1b1fa-1b00-0000-1281-c3c9ef080000 pid=2287->guuid=8a07bb88-1c00-0000-1281-c3c9470a0000 pid=2631 execve guuid=c478968d-1c00-0000-1281-c3c9530a0000 pid=2643 /usr/bin/chmod guuid=7ce1b1fa-1b00-0000-1281-c3c9ef080000 pid=2287->guuid=c478968d-1c00-0000-1281-c3c9530a0000 pid=2643 execve guuid=18e7168e-1c00-0000-1281-c3c9550a0000 pid=2645 /usr/bin/bash guuid=7ce1b1fa-1b00-0000-1281-c3c9ef080000 pid=2287->guuid=18e7168e-1c00-0000-1281-c3c9550a0000 pid=2645 clone guuid=14107b8e-1c00-0000-1281-c3c9580a0000 pid=2648 /usr/bin/rm delete-file guuid=7ce1b1fa-1b00-0000-1281-c3c9ef080000 pid=2287->guuid=14107b8e-1c00-0000-1281-c3c9580a0000 pid=2648 execve guuid=a41d048f-1c00-0000-1281-c3c95a0a0000 pid=2650 /usr/bin/rm guuid=7ce1b1fa-1b00-0000-1281-c3c9ef080000 pid=2287->guuid=a41d048f-1c00-0000-1281-c3c95a0a0000 pid=2650 execve 5b654972-c9e1-50d8-b372-2dc2a5b9ad66 5.182.210.174:80 guuid=32ff67fb-1b00-0000-1281-c3c9f1080000 pid=2289->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=3866a4ff-1b00-0000-1281-c3c9fa080000 pid=2298->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=45b8db0c-1c00-0000-1281-c3c909090000 pid=2313 /usr/bin/bash guuid=c11eb50c-1c00-0000-1281-c3c908090000 pid=2312->guuid=45b8db0c-1c00-0000-1281-c3c909090000 pid=2313 clone guuid=f3e70e0e-1c00-0000-1281-c3c90e090000 pid=2318->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=8be34112-1c00-0000-1281-c3c914090000 pid=2324->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=6823581b-1c00-0000-1281-c3c926090000 pid=2342 /usr/bin/bash guuid=7499051b-1c00-0000-1281-c3c924090000 pid=2340->guuid=6823581b-1c00-0000-1281-c3c926090000 pid=2342 clone guuid=aee35c1e-1c00-0000-1281-c3c930090000 pid=2352->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=d2195c24-1c00-0000-1281-c3c939090000 pid=2361->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=8f90d82d-1c00-0000-1281-c3c950090000 pid=2384 /usr/bin/bash guuid=29a7b12d-1c00-0000-1281-c3c94f090000 pid=2383->guuid=8f90d82d-1c00-0000-1281-c3c950090000 pid=2384 clone guuid=b43c892e-1c00-0000-1281-c3c954090000 pid=2388->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=c080b231-1c00-0000-1281-c3c959090000 pid=2393->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=7030f136-1c00-0000-1281-c3c966090000 pid=2406 /usr/bin/bash guuid=684bcc36-1c00-0000-1281-c3c964090000 pid=2404->guuid=7030f136-1c00-0000-1281-c3c966090000 pid=2406 clone guuid=1b172a38-1c00-0000-1281-c3c96b090000 pid=2411->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=c47b173b-1c00-0000-1281-c3c971090000 pid=2417->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=adc8ef3f-1c00-0000-1281-c3c97d090000 pid=2429 /usr/bin/bash guuid=4d60c63f-1c00-0000-1281-c3c97c090000 pid=2428->guuid=adc8ef3f-1c00-0000-1281-c3c97d090000 pid=2429 clone guuid=52e13e41-1c00-0000-1281-c3c983090000 pid=2435->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=f8b0aa44-1c00-0000-1281-c3c98b090000 pid=2443->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=32dda849-1c00-0000-1281-c3c999090000 pid=2457 /usr/bin/bash guuid=8fe18b49-1c00-0000-1281-c3c998090000 pid=2456->guuid=32dda849-1c00-0000-1281-c3c999090000 pid=2457 clone guuid=4c0e124b-1c00-0000-1281-c3c99d090000 pid=2461->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=cc604c4e-1c00-0000-1281-c3c9a3090000 pid=2467->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=faa6f952-1c00-0000-1281-c3c9b1090000 pid=2481 /usr/bin/bash guuid=2260cd52-1c00-0000-1281-c3c9af090000 pid=2479->guuid=faa6f952-1c00-0000-1281-c3c9b1090000 pid=2481 clone guuid=0d83bc53-1c00-0000-1281-c3c9b5090000 pid=2485->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=daccf056-1c00-0000-1281-c3c9ba090000 pid=2490->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=5fdd9160-1c00-0000-1281-c3c9df090000 pid=2527 /usr/bin/bash guuid=177b7d60-1c00-0000-1281-c3c9de090000 pid=2526->guuid=5fdd9160-1c00-0000-1281-c3c9df090000 pid=2527 clone guuid=314d3161-1c00-0000-1281-c3c9e3090000 pid=2531->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=3c1e6765-1c00-0000-1281-c3c9ed090000 pid=2541->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=5bf5336c-1c00-0000-1281-c3c9fd090000 pid=2557 /usr/bin/bash guuid=15d8016c-1c00-0000-1281-c3c9fc090000 pid=2556->guuid=5bf5336c-1c00-0000-1281-c3c9fd090000 pid=2557 clone guuid=e855196f-1c00-0000-1281-c3c9080a0000 pid=2568->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=cbd65f74-1c00-0000-1281-c3c9120a0000 pid=2578->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=11a3087b-1c00-0000-1281-c3c91e0a0000 pid=2590 /usr/bin/bash guuid=2728d67a-1c00-0000-1281-c3c91d0a0000 pid=2589->guuid=11a3087b-1c00-0000-1281-c3c91e0a0000 pid=2590 clone guuid=ce7d067c-1c00-0000-1281-c3c9230a0000 pid=2595->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=a02e227f-1c00-0000-1281-c3c92c0a0000 pid=2604->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=98a48d84-1c00-0000-1281-c3c93b0a0000 pid=2619 /usr/bin/bash guuid=ff146684-1c00-0000-1281-c3c9390a0000 pid=2617->guuid=98a48d84-1c00-0000-1281-c3c93b0a0000 pid=2619 clone guuid=6bdaad85-1c00-0000-1281-c3c9400a0000 pid=2624->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=8a07bb88-1c00-0000-1281-c3c9470a0000 pid=2631->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=9c39448e-1c00-0000-1281-c3c9560a0000 pid=2646 /usr/bin/bash guuid=18e7168e-1c00-0000-1281-c3c9550a0000 pid=2645->guuid=9c39448e-1c00-0000-1281-c3c9560a0000 pid=2646 clone
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/9da127fee206763018ef62aaf8ac54629bf1bae614ca6908eccc7f811bcc0403
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9da127fee206763018ef62aaf8ac54629bf1bae614ca6908eccc7f811bcc0403/
Threat name:
Linux.Trojan.Egairtigado
Create hunting rule
Status:
Malicious
First seen:
2026-08-28 15:09:20 UTC
File Type:
Text (Shell)
AV detection:
13 of 24 (54.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=twqsp7xcaz3daghpmkvprlcumkn7doxgctfgschmzr7ycg6maqbq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260828-sh2cvayzez/
Behaviour
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.11
Link:
https://yomi.yoroi.company/submissions/9da127fee206763018ef62aaf8ac54629bf1bae614ca6908eccc7f811bcc0403

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 9da127fee206763018ef62aaf8ac54629bf1bae614ca6908eccc7f811bcc0403

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3897671/
  
Delivery method
Distributed via web download

Comments