MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9f125d9a2259508929f3d321a1db86d7ee381d404ec34be44c096ebbc736b6eb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9f125d9a2259508929f3d321a1db86d7ee381d404ec34be44c096ebbc736b6eb
SHA3-384 hash: 762c55351dd8d6da9bb6d617d548bf3ddb748632dfcbf603461b65bdc36907b36a2e591b39ed25167ac27fdc4bf7dcd1
SHA1 hash: ba022b75133742449e75284df7180592df98aa3c
MD5 hash: 2c027dc77ba6fbc27104f6d185fa45b0
humanhash: uranus-alaska-oven-eighteen
File name:ok
Download: download sample
File size:1'608 bytes
First seen:2026-08-24 20:42:52 UTC
Last seen:2026-08-25 01:17:31 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 12:UBMV76BMJ7vk6H7ZsgUg6KL6KPt8uNt6TAxicn6Iix6Ii29s7X76lBuwM6q1576J:+MVsMJ7ZRpYk29kjUXXXPQkUv7m
TLSH T11B31709E04142A716402C99E7363354C669DE2FB2D9FD7D0EC4E4EA983897CCF1A1F49
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://5.182.210.174/5f549fn/an/an/a
http://5.182.210.174/cc514cn/an/an/a
http://5.182.210.174/7855e7n/an/an/a
http://5.182.210.174/aa5b43n/an/an/a
http://5.182.210.174/7186e1n/an/an/a
http://5.182.210.174/004460n/an/an/a
http://5.182.210.174/63ebdcn/an/an/a
http://5.182.210.174/a377b4n/an/an/a
http://5.182.210.174/5e217cn/an/an/a
http://5.182.210.174/afcc8an/an/an/a
http://5.182.210.174/73bf87n/an/an/a
http://5.182.210.174/bc82cen/an/an/a

Intelligence

File Origin
# of uploads :
2
# of downloads :
43
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive mirai
Link:
https://www.filescan.io/uploads/6a8cace100523ae639670a20/reports/38708ed2-de9b-421e-b746-a766a87433c2/overview
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/a35af891-cd8e-413e-8def-03900c4fb770
Behavior Graph:
Download SVG
%3 guuid=97154af7-1600-0000-7db4-f5f3680d0000 pid=3432 /usr/bin/sudo guuid=1279f1fa-1600-0000-7db4-f5f3730d0000 pid=3443 /tmp/sample.bin guuid=97154af7-1600-0000-7db4-f5f3680d0000 pid=3432->guuid=1279f1fa-1600-0000-7db4-f5f3730d0000 pid=3443 execve guuid=d4387dfb-1600-0000-7db4-f5f3760d0000 pid=3446 /usr/bin/wget net send-data guuid=1279f1fa-1600-0000-7db4-f5f3730d0000 pid=3443->guuid=d4387dfb-1600-0000-7db4-f5f3760d0000 pid=3446 execve guuid=d10f1b02-1700-0000-7db4-f5f3850d0000 pid=3461 /usr/bin/curl net send-data write-file guuid=1279f1fa-1600-0000-7db4-f5f3730d0000 pid=3443->guuid=d10f1b02-1700-0000-7db4-f5f3850d0000 pid=3461 execve guuid=15f5c30a-1700-0000-7db4-f5f39a0d0000 pid=3482 /usr/bin/chmod guuid=1279f1fa-1600-0000-7db4-f5f3730d0000 pid=3443->guuid=15f5c30a-1700-0000-7db4-f5f39a0d0000 pid=3482 execve guuid=5723040b-1700-0000-7db4-f5f39c0d0000 pid=3484 /usr/bin/bash guuid=1279f1fa-1600-0000-7db4-f5f3730d0000 pid=3443->guuid=5723040b-1700-0000-7db4-f5f39c0d0000 pid=3484 clone guuid=8437410b-1700-0000-7db4-f5f39e0d0000 pid=3486 /usr/bin/rm delete-file guuid=1279f1fa-1600-0000-7db4-f5f3730d0000 pid=3443->guuid=8437410b-1700-0000-7db4-f5f39e0d0000 pid=3486 execve guuid=88ec940b-1700-0000-7db4-f5f39f0d0000 pid=3487 /usr/bin/rm guuid=1279f1fa-1600-0000-7db4-f5f3730d0000 pid=3443->guuid=88ec940b-1700-0000-7db4-f5f39f0d0000 pid=3487 execve guuid=203fed0b-1700-0000-7db4-f5f3a00d0000 pid=3488 /usr/bin/wget net send-data guuid=1279f1fa-1600-0000-7db4-f5f3730d0000 pid=3443->guuid=203fed0b-1700-0000-7db4-f5f3a00d0000 pid=3488 execve guuid=3fcb9b0e-1700-0000-7db4-f5f3a60d0000 pid=3494 /usr/bin/curl net send-data write-file guuid=1279f1fa-1600-0000-7db4-f5f3730d0000 pid=3443->guuid=3fcb9b0e-1700-0000-7db4-f5f3a60d0000 pid=3494 execve guuid=77aad613-1700-0000-7db4-f5f3b90d0000 pid=3513 /usr/bin/chmod guuid=1279f1fa-1600-0000-7db4-f5f3730d0000 pid=3443->guuid=77aad613-1700-0000-7db4-f5f3b90d0000 pid=3513 execve guuid=4f872814-1700-0000-7db4-f5f3bd0d0000 pid=3517 /usr/bin/bash guuid=1279f1fa-1600-0000-7db4-f5f3730d0000 pid=3443->guuid=4f872814-1700-0000-7db4-f5f3bd0d0000 pid=3517 clone guuid=15797914-1700-0000-7db4-f5f3c00d0000 pid=3520 /usr/bin/rm delete-file guuid=1279f1fa-1600-0000-7db4-f5f3730d0000 pid=3443->guuid=15797914-1700-0000-7db4-f5f3c00d0000 pid=3520 execve guuid=c2dbee14-1700-0000-7db4-f5f3c20d0000 pid=3522 /usr/bin/rm guuid=1279f1fa-1600-0000-7db4-f5f3730d0000 pid=3443->guuid=c2dbee14-1700-0000-7db4-f5f3c20d0000 pid=3522 execve guuid=a6065d15-1700-0000-7db4-f5f3c50d0000 pid=3525 /usr/bin/wget net send-data guuid=1279f1fa-1600-0000-7db4-f5f3730d0000 pid=3443->guuid=a6065d15-1700-0000-7db4-f5f3c50d0000 pid=3525 execve guuid=d2b23118-1700-0000-7db4-f5f3cd0d0000 pid=3533 /usr/bin/curl net send-data write-file guuid=1279f1fa-1600-0000-7db4-f5f3730d0000 pid=3443->guuid=d2b23118-1700-0000-7db4-f5f3cd0d0000 pid=3533 execve guuid=6926381d-1700-0000-7db4-f5f3dc0d0000 pid=3548 /usr/bin/chmod guuid=1279f1fa-1600-0000-7db4-f5f3730d0000 pid=3443->guuid=6926381d-1700-0000-7db4-f5f3dc0d0000 pid=3548 execve guuid=c3a2841d-1700-0000-7db4-f5f3dd0d0000 pid=3549 /usr/bin/bash guuid=1279f1fa-1600-0000-7db4-f5f3730d0000 pid=3443->guuid=c3a2841d-1700-0000-7db4-f5f3dd0d0000 pid=3549 clone guuid=8125c81d-1700-0000-7db4-f5f3e20d0000 pid=3554 /usr/bin/rm delete-file guuid=1279f1fa-1600-0000-7db4-f5f3730d0000 pid=3443->guuid=8125c81d-1700-0000-7db4-f5f3e20d0000 pid=3554 execve guuid=d70a251e-1700-0000-7db4-f5f3e30d0000 pid=3555 /usr/bin/rm guuid=1279f1fa-1600-0000-7db4-f5f3730d0000 pid=3443->guuid=d70a251e-1700-0000-7db4-f5f3e30d0000 pid=3555 execve guuid=e61a781e-1700-0000-7db4-f5f3e40d0000 pid=3556 /usr/bin/wget net send-data guuid=1279f1fa-1600-0000-7db4-f5f3730d0000 pid=3443->guuid=e61a781e-1700-0000-7db4-f5f3e40d0000 pid=3556 execve guuid=e2c22421-1700-0000-7db4-f5f3eb0d0000 pid=3563 /usr/bin/curl net send-data write-file guuid=1279f1fa-1600-0000-7db4-f5f3730d0000 pid=3443->guuid=e2c22421-1700-0000-7db4-f5f3eb0d0000 pid=3563 execve guuid=7387cc25-1700-0000-7db4-f5f3ec0d0000 pid=3564 /usr/bin/chmod guuid=1279f1fa-1600-0000-7db4-f5f3730d0000 pid=3443->guuid=7387cc25-1700-0000-7db4-f5f3ec0d0000 pid=3564 execve guuid=20292d26-1700-0000-7db4-f5f3ed0d0000 pid=3565 /usr/bin/bash guuid=1279f1fa-1600-0000-7db4-f5f3730d0000 pid=3443->guuid=20292d26-1700-0000-7db4-f5f3ed0d0000 pid=3565 clone guuid=42b99126-1700-0000-7db4-f5f3ef0d0000 pid=3567 /usr/bin/rm delete-file guuid=1279f1fa-1600-0000-7db4-f5f3730d0000 pid=3443->guuid=42b99126-1700-0000-7db4-f5f3ef0d0000 pid=3567 execve guuid=814df126-1700-0000-7db4-f5f3f00d0000 pid=3568 /usr/bin/rm guuid=1279f1fa-1600-0000-7db4-f5f3730d0000 pid=3443->guuid=814df126-1700-0000-7db4-f5f3f00d0000 pid=3568 execve guuid=9a4a6027-1700-0000-7db4-f5f3f10d0000 pid=3569 /usr/bin/wget net send-data guuid=1279f1fa-1600-0000-7db4-f5f3730d0000 pid=3443->guuid=9a4a6027-1700-0000-7db4-f5f3f10d0000 pid=3569 execve guuid=2427522a-1700-0000-7db4-f5f3f20d0000 pid=3570 /usr/bin/curl net send-data write-file guuid=1279f1fa-1600-0000-7db4-f5f3730d0000 pid=3443->guuid=2427522a-1700-0000-7db4-f5f3f20d0000 pid=3570 execve guuid=53ea4f2e-1700-0000-7db4-f5f3fd0d0000 pid=3581 /usr/bin/chmod guuid=1279f1fa-1600-0000-7db4-f5f3730d0000 pid=3443->guuid=53ea4f2e-1700-0000-7db4-f5f3fd0d0000 pid=3581 execve guuid=e017ac2e-1700-0000-7db4-f5f3fe0d0000 pid=3582 /usr/bin/bash guuid=1279f1fa-1600-0000-7db4-f5f3730d0000 pid=3443->guuid=e017ac2e-1700-0000-7db4-f5f3fe0d0000 pid=3582 clone guuid=e5e8122f-1700-0000-7db4-f5f3010e0000 pid=3585 /usr/bin/rm delete-file guuid=1279f1fa-1600-0000-7db4-f5f3730d0000 pid=3443->guuid=e5e8122f-1700-0000-7db4-f5f3010e0000 pid=3585 execve guuid=e28a552f-1700-0000-7db4-f5f3030e0000 pid=3587 /usr/bin/rm guuid=1279f1fa-1600-0000-7db4-f5f3730d0000 pid=3443->guuid=e28a552f-1700-0000-7db4-f5f3030e0000 pid=3587 execve guuid=0760982f-1700-0000-7db4-f5f3040e0000 pid=3588 /usr/bin/wget net send-data guuid=1279f1fa-1600-0000-7db4-f5f3730d0000 pid=3443->guuid=0760982f-1700-0000-7db4-f5f3040e0000 pid=3588 execve guuid=b811ba32-1700-0000-7db4-f5f3050e0000 pid=3589 /usr/bin/curl net send-data write-file guuid=1279f1fa-1600-0000-7db4-f5f3730d0000 pid=3443->guuid=b811ba32-1700-0000-7db4-f5f3050e0000 pid=3589 execve guuid=1bf66539-1700-0000-7db4-f5f3120e0000 pid=3602 /usr/bin/chmod guuid=1279f1fa-1600-0000-7db4-f5f3730d0000 pid=3443->guuid=1bf66539-1700-0000-7db4-f5f3120e0000 pid=3602 execve guuid=9d5fa939-1700-0000-7db4-f5f3140e0000 pid=3604 /usr/bin/bash guuid=1279f1fa-1600-0000-7db4-f5f3730d0000 pid=3443->guuid=9d5fa939-1700-0000-7db4-f5f3140e0000 pid=3604 clone guuid=3479e739-1700-0000-7db4-f5f3160e0000 pid=3606 /usr/bin/rm delete-file guuid=1279f1fa-1600-0000-7db4-f5f3730d0000 pid=3443->guuid=3479e739-1700-0000-7db4-f5f3160e0000 pid=3606 execve guuid=8ccb6f3a-1700-0000-7db4-f5f3180e0000 pid=3608 /usr/bin/rm guuid=1279f1fa-1600-0000-7db4-f5f3730d0000 pid=3443->guuid=8ccb6f3a-1700-0000-7db4-f5f3180e0000 pid=3608 execve guuid=a606e43a-1700-0000-7db4-f5f31a0e0000 pid=3610 /usr/bin/wget net send-data guuid=1279f1fa-1600-0000-7db4-f5f3730d0000 pid=3443->guuid=a606e43a-1700-0000-7db4-f5f31a0e0000 pid=3610 execve guuid=94a0593e-1700-0000-7db4-f5f3260e0000 pid=3622 /usr/bin/curl net send-data write-file guuid=1279f1fa-1600-0000-7db4-f5f3730d0000 pid=3443->guuid=94a0593e-1700-0000-7db4-f5f3260e0000 pid=3622 execve guuid=5c087f4a-1700-0000-7db4-f5f3440e0000 pid=3652 /usr/bin/chmod guuid=1279f1fa-1600-0000-7db4-f5f3730d0000 pid=3443->guuid=5c087f4a-1700-0000-7db4-f5f3440e0000 pid=3652 execve guuid=69370e4b-1700-0000-7db4-f5f3490e0000 pid=3657 /usr/bin/bash guuid=1279f1fa-1600-0000-7db4-f5f3730d0000 pid=3443->guuid=69370e4b-1700-0000-7db4-f5f3490e0000 pid=3657 clone guuid=773d9f4b-1700-0000-7db4-f5f34c0e0000 pid=3660 /usr/bin/rm delete-file guuid=1279f1fa-1600-0000-7db4-f5f3730d0000 pid=3443->guuid=773d9f4b-1700-0000-7db4-f5f34c0e0000 pid=3660 execve guuid=26b04e4c-1700-0000-7db4-f5f3500e0000 pid=3664 /usr/bin/rm guuid=1279f1fa-1600-0000-7db4-f5f3730d0000 pid=3443->guuid=26b04e4c-1700-0000-7db4-f5f3500e0000 pid=3664 execve guuid=a090f54c-1700-0000-7db4-f5f3550e0000 pid=3669 /usr/bin/wget net send-data guuid=1279f1fa-1600-0000-7db4-f5f3730d0000 pid=3443->guuid=a090f54c-1700-0000-7db4-f5f3550e0000 pid=3669 execve guuid=5d37e050-1700-0000-7db4-f5f3600e0000 pid=3680 /usr/bin/curl net send-data write-file guuid=1279f1fa-1600-0000-7db4-f5f3730d0000 pid=3443->guuid=5d37e050-1700-0000-7db4-f5f3600e0000 pid=3680 execve guuid=35d3a854-1700-0000-7db4-f5f3680e0000 pid=3688 /usr/bin/chmod guuid=1279f1fa-1600-0000-7db4-f5f3730d0000 pid=3443->guuid=35d3a854-1700-0000-7db4-f5f3680e0000 pid=3688 execve guuid=fca30355-1700-0000-7db4-f5f3690e0000 pid=3689 /usr/bin/bash guuid=1279f1fa-1600-0000-7db4-f5f3730d0000 pid=3443->guuid=fca30355-1700-0000-7db4-f5f3690e0000 pid=3689 clone guuid=a4985655-1700-0000-7db4-f5f36c0e0000 pid=3692 /usr/bin/rm delete-file guuid=1279f1fa-1600-0000-7db4-f5f3730d0000 pid=3443->guuid=a4985655-1700-0000-7db4-f5f36c0e0000 pid=3692 execve guuid=d513b855-1700-0000-7db4-f5f36e0e0000 pid=3694 /usr/bin/rm guuid=1279f1fa-1600-0000-7db4-f5f3730d0000 pid=3443->guuid=d513b855-1700-0000-7db4-f5f36e0e0000 pid=3694 execve guuid=ae7b1156-1700-0000-7db4-f5f36f0e0000 pid=3695 /usr/bin/wget net send-data guuid=1279f1fa-1600-0000-7db4-f5f3730d0000 pid=3443->guuid=ae7b1156-1700-0000-7db4-f5f36f0e0000 pid=3695 execve guuid=f2462b59-1700-0000-7db4-f5f3750e0000 pid=3701 /usr/bin/curl net send-data write-file guuid=1279f1fa-1600-0000-7db4-f5f3730d0000 pid=3443->guuid=f2462b59-1700-0000-7db4-f5f3750e0000 pid=3701 execve guuid=f516c15d-1700-0000-7db4-f5f38b0e0000 pid=3723 /usr/bin/chmod guuid=1279f1fa-1600-0000-7db4-f5f3730d0000 pid=3443->guuid=f516c15d-1700-0000-7db4-f5f38b0e0000 pid=3723 execve guuid=d1bc0b5e-1700-0000-7db4-f5f38e0e0000 pid=3726 /usr/bin/bash guuid=1279f1fa-1600-0000-7db4-f5f3730d0000 pid=3443->guuid=d1bc0b5e-1700-0000-7db4-f5f38e0e0000 pid=3726 clone guuid=ac22555e-1700-0000-7db4-f5f3920e0000 pid=3730 /usr/bin/rm delete-file guuid=1279f1fa-1600-0000-7db4-f5f3730d0000 pid=3443->guuid=ac22555e-1700-0000-7db4-f5f3920e0000 pid=3730 execve guuid=d514b95e-1700-0000-7db4-f5f3950e0000 pid=3733 /usr/bin/rm guuid=1279f1fa-1600-0000-7db4-f5f3730d0000 pid=3443->guuid=d514b95e-1700-0000-7db4-f5f3950e0000 pid=3733 execve guuid=45bf0c5f-1700-0000-7db4-f5f3980e0000 pid=3736 /usr/bin/wget net send-data guuid=1279f1fa-1600-0000-7db4-f5f3730d0000 pid=3443->guuid=45bf0c5f-1700-0000-7db4-f5f3980e0000 pid=3736 execve guuid=a6a9a061-1700-0000-7db4-f5f3a40e0000 pid=3748 /usr/bin/curl net send-data write-file guuid=1279f1fa-1600-0000-7db4-f5f3730d0000 pid=3443->guuid=a6a9a061-1700-0000-7db4-f5f3a40e0000 pid=3748 execve guuid=1c753865-1700-0000-7db4-f5f3b20e0000 pid=3762 /usr/bin/chmod guuid=1279f1fa-1600-0000-7db4-f5f3730d0000 pid=3443->guuid=1c753865-1700-0000-7db4-f5f3b20e0000 pid=3762 execve guuid=a310ae65-1700-0000-7db4-f5f3b50e0000 pid=3765 /usr/bin/bash guuid=1279f1fa-1600-0000-7db4-f5f3730d0000 pid=3443->guuid=a310ae65-1700-0000-7db4-f5f3b50e0000 pid=3765 clone guuid=4f3aef65-1700-0000-7db4-f5f3b70e0000 pid=3767 /usr/bin/rm delete-file guuid=1279f1fa-1600-0000-7db4-f5f3730d0000 pid=3443->guuid=4f3aef65-1700-0000-7db4-f5f3b70e0000 pid=3767 execve guuid=22259266-1700-0000-7db4-f5f3b80e0000 pid=3768 /usr/bin/rm guuid=1279f1fa-1600-0000-7db4-f5f3730d0000 pid=3443->guuid=22259266-1700-0000-7db4-f5f3b80e0000 pid=3768 execve guuid=7ededb66-1700-0000-7db4-f5f3b90e0000 pid=3769 /usr/bin/wget net send-data guuid=1279f1fa-1600-0000-7db4-f5f3730d0000 pid=3443->guuid=7ededb66-1700-0000-7db4-f5f3b90e0000 pid=3769 execve guuid=2315ae69-1700-0000-7db4-f5f3be0e0000 pid=3774 /usr/bin/curl net send-data write-file guuid=1279f1fa-1600-0000-7db4-f5f3730d0000 pid=3443->guuid=2315ae69-1700-0000-7db4-f5f3be0e0000 pid=3774 execve guuid=2e04276f-1700-0000-7db4-f5f3d10e0000 pid=3793 /usr/bin/chmod guuid=1279f1fa-1600-0000-7db4-f5f3730d0000 pid=3443->guuid=2e04276f-1700-0000-7db4-f5f3d10e0000 pid=3793 execve guuid=e2f0646f-1700-0000-7db4-f5f3d30e0000 pid=3795 /usr/bin/bash guuid=1279f1fa-1600-0000-7db4-f5f3730d0000 pid=3443->guuid=e2f0646f-1700-0000-7db4-f5f3d30e0000 pid=3795 clone guuid=88dc996f-1700-0000-7db4-f5f3d60e0000 pid=3798 /usr/bin/rm delete-file guuid=1279f1fa-1600-0000-7db4-f5f3730d0000 pid=3443->guuid=88dc996f-1700-0000-7db4-f5f3d60e0000 pid=3798 execve guuid=1eadd56f-1700-0000-7db4-f5f3d80e0000 pid=3800 /usr/bin/rm guuid=1279f1fa-1600-0000-7db4-f5f3730d0000 pid=3443->guuid=1eadd56f-1700-0000-7db4-f5f3d80e0000 pid=3800 execve guuid=72f03070-1700-0000-7db4-f5f3da0e0000 pid=3802 /usr/bin/wget net send-data guuid=1279f1fa-1600-0000-7db4-f5f3730d0000 pid=3443->guuid=72f03070-1700-0000-7db4-f5f3da0e0000 pid=3802 execve guuid=0cadef72-1700-0000-7db4-f5f3e80e0000 pid=3816 /usr/bin/curl net send-data write-file guuid=1279f1fa-1600-0000-7db4-f5f3730d0000 pid=3443->guuid=0cadef72-1700-0000-7db4-f5f3e80e0000 pid=3816 execve guuid=dc722877-1700-0000-7db4-f5f3f90e0000 pid=3833 /usr/bin/chmod guuid=1279f1fa-1600-0000-7db4-f5f3730d0000 pid=3443->guuid=dc722877-1700-0000-7db4-f5f3f90e0000 pid=3833 execve guuid=64156677-1700-0000-7db4-f5f3fa0e0000 pid=3834 /usr/bin/bash guuid=1279f1fa-1600-0000-7db4-f5f3730d0000 pid=3443->guuid=64156677-1700-0000-7db4-f5f3fa0e0000 pid=3834 clone guuid=bbf69477-1700-0000-7db4-f5f3ff0e0000 pid=3839 /usr/bin/rm delete-file guuid=1279f1fa-1600-0000-7db4-f5f3730d0000 pid=3443->guuid=bbf69477-1700-0000-7db4-f5f3ff0e0000 pid=3839 execve guuid=9965dc77-1700-0000-7db4-f5f3000f0000 pid=3840 /usr/bin/rm guuid=1279f1fa-1600-0000-7db4-f5f3730d0000 pid=3443->guuid=9965dc77-1700-0000-7db4-f5f3000f0000 pid=3840 execve 5b654972-c9e1-50d8-b372-2dc2a5b9ad66 5.182.210.174:80 guuid=d4387dfb-1600-0000-7db4-f5f3760d0000 pid=3446->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=d10f1b02-1700-0000-7db4-f5f3850d0000 pid=3461->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=3ee2190b-1700-0000-7db4-f5f39d0d0000 pid=3485 /usr/bin/bash guuid=5723040b-1700-0000-7db4-f5f39c0d0000 pid=3484->guuid=3ee2190b-1700-0000-7db4-f5f39d0d0000 pid=3485 clone guuid=203fed0b-1700-0000-7db4-f5f3a00d0000 pid=3488->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=3fcb9b0e-1700-0000-7db4-f5f3a60d0000 pid=3494->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=30de4714-1700-0000-7db4-f5f3be0d0000 pid=3518 /usr/bin/bash guuid=4f872814-1700-0000-7db4-f5f3bd0d0000 pid=3517->guuid=30de4714-1700-0000-7db4-f5f3be0d0000 pid=3518 clone guuid=a6065d15-1700-0000-7db4-f5f3c50d0000 pid=3525->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=d2b23118-1700-0000-7db4-f5f3cd0d0000 pid=3533->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=61619c1d-1700-0000-7db4-f5f3de0d0000 pid=3550 /usr/bin/bash guuid=c3a2841d-1700-0000-7db4-f5f3dd0d0000 pid=3549->guuid=61619c1d-1700-0000-7db4-f5f3de0d0000 pid=3550 clone guuid=e61a781e-1700-0000-7db4-f5f3e40d0000 pid=3556->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=e2c22421-1700-0000-7db4-f5f3eb0d0000 pid=3563->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=cfbb4926-1700-0000-7db4-f5f3ee0d0000 pid=3566 /usr/bin/bash guuid=20292d26-1700-0000-7db4-f5f3ed0d0000 pid=3565->guuid=cfbb4926-1700-0000-7db4-f5f3ee0d0000 pid=3566 clone guuid=9a4a6027-1700-0000-7db4-f5f3f10d0000 pid=3569->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=2427522a-1700-0000-7db4-f5f3f20d0000 pid=3570->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=6a14ed2e-1700-0000-7db4-f5f3000e0000 pid=3584 /usr/bin/bash guuid=e017ac2e-1700-0000-7db4-f5f3fe0d0000 pid=3582->guuid=6a14ed2e-1700-0000-7db4-f5f3000e0000 pid=3584 clone guuid=0760982f-1700-0000-7db4-f5f3040e0000 pid=3588->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=b811ba32-1700-0000-7db4-f5f3050e0000 pid=3589->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=d393c139-1700-0000-7db4-f5f3150e0000 pid=3605 /usr/bin/bash guuid=9d5fa939-1700-0000-7db4-f5f3140e0000 pid=3604->guuid=d393c139-1700-0000-7db4-f5f3150e0000 pid=3605 clone guuid=a606e43a-1700-0000-7db4-f5f31a0e0000 pid=3610->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=94a0593e-1700-0000-7db4-f5f3260e0000 pid=3622->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=a07f4a4b-1700-0000-7db4-f5f34a0e0000 pid=3658 /usr/bin/bash guuid=69370e4b-1700-0000-7db4-f5f3490e0000 pid=3657->guuid=a07f4a4b-1700-0000-7db4-f5f34a0e0000 pid=3658 clone guuid=a090f54c-1700-0000-7db4-f5f3550e0000 pid=3669->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=5d37e050-1700-0000-7db4-f5f3600e0000 pid=3680->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=517f3155-1700-0000-7db4-f5f36b0e0000 pid=3691 /usr/bin/bash guuid=fca30355-1700-0000-7db4-f5f3690e0000 pid=3689->guuid=517f3155-1700-0000-7db4-f5f36b0e0000 pid=3691 clone guuid=ae7b1156-1700-0000-7db4-f5f36f0e0000 pid=3695->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=f2462b59-1700-0000-7db4-f5f3750e0000 pid=3701->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=4d1e225e-1700-0000-7db4-f5f38f0e0000 pid=3727 /usr/bin/bash guuid=d1bc0b5e-1700-0000-7db4-f5f38e0e0000 pid=3726->guuid=4d1e225e-1700-0000-7db4-f5f38f0e0000 pid=3727 clone guuid=45bf0c5f-1700-0000-7db4-f5f3980e0000 pid=3736->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=a6a9a061-1700-0000-7db4-f5f3a40e0000 pid=3748->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=eb4fc565-1700-0000-7db4-f5f3b60e0000 pid=3766 /usr/bin/bash guuid=a310ae65-1700-0000-7db4-f5f3b50e0000 pid=3765->guuid=eb4fc565-1700-0000-7db4-f5f3b60e0000 pid=3766 clone guuid=7ededb66-1700-0000-7db4-f5f3b90e0000 pid=3769->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=2315ae69-1700-0000-7db4-f5f3be0e0000 pid=3774->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=3e697c6f-1700-0000-7db4-f5f3d40e0000 pid=3796 /usr/bin/bash guuid=e2f0646f-1700-0000-7db4-f5f3d30e0000 pid=3795->guuid=3e697c6f-1700-0000-7db4-f5f3d40e0000 pid=3796 clone guuid=72f03070-1700-0000-7db4-f5f3da0e0000 pid=3802->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=0cadef72-1700-0000-7db4-f5f3e80e0000 pid=3816->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=26f37a77-1700-0000-7db4-f5f3fd0e0000 pid=3837 /usr/bin/bash guuid=64156677-1700-0000-7db4-f5f3fa0e0000 pid=3834->guuid=26f37a77-1700-0000-7db4-f5f3fd0e0000 pid=3837 clone
Score:
99%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/9f125d9a2259508929f3d321a1db86d7ee381d404ec34be44c096ebbc736b6eb
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9f125d9a2259508929f3d321a1db86d7ee381d404ec34be44c096ebbc736b6eb/
Threat name:
Linux.Downloader.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-08-24 20:43:17 UTC
File Type:
Text (Shell)
AV detection:
13 of 36 (36.11%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=t4jf3grclfiiskpt2mq2dw4g27xdqhkaj3buxzcmbfxlxrzww3vq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260824-zhm9jsyyfy/
Behaviour
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.11
Link:
https://yomi.yoroi.company/submissions/9f125d9a2259508929f3d321a1db86d7ee381d404ec34be44c096ebbc736b6eb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 9f125d9a2259508929f3d321a1db86d7ee381d404ec34be44c096ebbc736b6eb

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3897671/
  
Delivery method
Distributed via web download

Comments