MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9f1a43a5f3d643b88f3f2626d0e0c3b2484478d5343e1a016fa0a3fc3fc4a821. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9f1a43a5f3d643b88f3f2626d0e0c3b2484478d5343e1a016fa0a3fc3fc4a821
SHA3-384 hash: e8906e596027773ca8abed1dd5c8d8ac4bf4a6008a7af336c1742f6e3b4372182c4cf2740dbc2d2f396d30a2126837cc
SHA1 hash: 16ba918fdd8a1e0a9b184177bfa6c760071404e3
MD5 hash: b385e7b3356ef4ef9589798c27b8db5a
humanhash: rugby-washington-pizza-twelve
File name:1.sh
Download: download sample
File size:2'929 bytes
First seen:2026-07-14 06:56:25 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 48:i8Be9Behml8BeLBenEl8BeEBeCXl8BeYBeePl8Bea/BeazvZl8Bea5BeaFvjl8Bc:i8BKBgml8BIBuEl8B1BpXl8BdBBPl8Bu
TLSH T1FB517FD733110E712D667BABFDBD8E2C3182A0D158D32FC458EC38A562CDE88B446A43
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter BlinkzSec
URLMalware sample (SHA256 hash)SignatureTags
http://94.154.43.70/hiddenbin/Space.arcn/an/aelf ua-wget
http://94.154.43.70/hiddenbin/Space.x86n/an/aelf ua-wget
http://94.154.43.70/hiddenbin/Space.x86_64n/an/aelf ua-wget
http://94.154.43.70/hiddenbin/Space.i686n/an/aelf ua-wget
http://94.154.43.70/hiddenbin/Space.mipsn/an/aelf ua-wget
http://94.154.43.70/hiddenbin/Space.mips64n/an/aelf ua-wget
http://94.154.43.70/hiddenbin/Space.mpsln/an/aelf ua-wget
http://94.154.43.70/hiddenbin/Space.armn/an/aelf ua-wget
http://94.154.43.70/hiddenbin/Space.arm5n/an/aelf ua-wget
http://94.154.43.70/hiddenbin/Space.arm6n/an/aelf ua-wget
http://94.154.43.70/hiddenbin/Space.arm7n/an/aelf ua-wget
http://94.154.43.70/hiddenbin/Space.ppcn/an/aelf ua-wget
http://94.154.43.70/hiddenbin/Space.sparcn/an/aelf ua-wget
http://94.154.43.70/hiddenbin/Space.m68kn/an/aelf ua-wget
http://94.154.43.70/hiddenbin/Space.sh4n/an/aelf ua-wget

Intelligence

File Origin
# of uploads :
1
# of downloads :
48
Origin country :
DK DK
Vendor Threat Intelligence
No detections
Detection(s):
Sanesecurity.Malware.30790.LX.BOT.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Linux.Downloader-29.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
File Type:
unix shell
First seen:
2026-07-08T01:53:00Z UTC
Last seen:
2026-07-08T02:27:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/9f1a43a5f3d643b88f3f2626d0e0c3b2484478d5343e1a016fa0a3fc3fc4a821/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/de526064-6982-461a-aa68-d163d4c803dd
Behavior Graph:
Download SVG
%3 guuid=189c8ab9-2100-0000-3ec2-f4d5b4130000 pid=5044 /usr/bin/sudo guuid=a82a23bf-2100-0000-3ec2-f4d5bd130000 pid=5053 /tmp/sample.bin guuid=189c8ab9-2100-0000-3ec2-f4d5b4130000 pid=5044->guuid=a82a23bf-2100-0000-3ec2-f4d5bd130000 pid=5053 execve guuid=4d40e0bf-2100-0000-3ec2-f4d5be130000 pid=5054 /usr/bin/cp guuid=a82a23bf-2100-0000-3ec2-f4d5bd130000 pid=5053->guuid=4d40e0bf-2100-0000-3ec2-f4d5be130000 pid=5054 execve guuid=0cf9bbcd-2100-0000-3ec2-f4d5c8130000 pid=5064 /usr/bin/wget net send-data guuid=a82a23bf-2100-0000-3ec2-f4d5bd130000 pid=5053->guuid=0cf9bbcd-2100-0000-3ec2-f4d5c8130000 pid=5064 execve guuid=4bf138d8-2100-0000-3ec2-f4d5d0130000 pid=5072 /usr/bin/curl net send-data write-file guuid=a82a23bf-2100-0000-3ec2-f4d5bd130000 pid=5053->guuid=4bf138d8-2100-0000-3ec2-f4d5d0130000 pid=5072 execve guuid=b491b0e5-2100-0000-3ec2-f4d5e4130000 pid=5092 /usr/bin/cat guuid=a82a23bf-2100-0000-3ec2-f4d5bd130000 pid=5053->guuid=b491b0e5-2100-0000-3ec2-f4d5e4130000 pid=5092 execve guuid=ba7bfee6-2100-0000-3ec2-f4d5e7130000 pid=5095 /usr/bin/chmod guuid=a82a23bf-2100-0000-3ec2-f4d5bd130000 pid=5053->guuid=ba7bfee6-2100-0000-3ec2-f4d5e7130000 pid=5095 execve guuid=6357b9e7-2100-0000-3ec2-f4d5e8130000 pid=5096 /usr/bin/bash guuid=a82a23bf-2100-0000-3ec2-f4d5bd130000 pid=5053->guuid=6357b9e7-2100-0000-3ec2-f4d5e8130000 pid=5096 clone guuid=7f044be8-2100-0000-3ec2-f4d5ea130000 pid=5098 /usr/bin/wget net send-data guuid=a82a23bf-2100-0000-3ec2-f4d5bd130000 pid=5053->guuid=7f044be8-2100-0000-3ec2-f4d5ea130000 pid=5098 execve guuid=2df8daeb-2100-0000-3ec2-f4d5f0130000 pid=5104 /usr/bin/curl net send-data write-file guuid=a82a23bf-2100-0000-3ec2-f4d5bd130000 pid=5053->guuid=2df8daeb-2100-0000-3ec2-f4d5f0130000 pid=5104 execve guuid=8493c8f7-2100-0000-3ec2-f4d5ff130000 pid=5119 /usr/bin/cat guuid=a82a23bf-2100-0000-3ec2-f4d5bd130000 pid=5053->guuid=8493c8f7-2100-0000-3ec2-f4d5ff130000 pid=5119 execve guuid=f8d68df8-2100-0000-3ec2-f4d501140000 pid=5121 /usr/bin/chmod guuid=a82a23bf-2100-0000-3ec2-f4d5bd130000 pid=5053->guuid=f8d68df8-2100-0000-3ec2-f4d501140000 pid=5121 execve guuid=e1275ef9-2100-0000-3ec2-f4d504140000 pid=5124 /usr/bin/bash guuid=a82a23bf-2100-0000-3ec2-f4d5bd130000 pid=5053->guuid=e1275ef9-2100-0000-3ec2-f4d504140000 pid=5124 clone guuid=b40eb9f9-2100-0000-3ec2-f4d505140000 pid=5125 /usr/bin/wget net send-data guuid=a82a23bf-2100-0000-3ec2-f4d5bd130000 pid=5053->guuid=b40eb9f9-2100-0000-3ec2-f4d505140000 pid=5125 execve guuid=40182bfe-2100-0000-3ec2-f4d50c140000 pid=5132 /usr/bin/curl net send-data write-file guuid=a82a23bf-2100-0000-3ec2-f4d5bd130000 pid=5053->guuid=40182bfe-2100-0000-3ec2-f4d50c140000 pid=5132 execve guuid=513c0d05-2200-0000-3ec2-f4d514140000 pid=5140 /usr/bin/cat guuid=a82a23bf-2100-0000-3ec2-f4d5bd130000 pid=5053->guuid=513c0d05-2200-0000-3ec2-f4d514140000 pid=5140 execve guuid=6a724306-2200-0000-3ec2-f4d517140000 pid=5143 /usr/bin/chmod guuid=a82a23bf-2100-0000-3ec2-f4d5bd130000 pid=5053->guuid=6a724306-2200-0000-3ec2-f4d517140000 pid=5143 execve guuid=c6971407-2200-0000-3ec2-f4d518140000 pid=5144 /usr/bin/bash guuid=a82a23bf-2100-0000-3ec2-f4d5bd130000 pid=5053->guuid=c6971407-2200-0000-3ec2-f4d518140000 pid=5144 clone guuid=c8598607-2200-0000-3ec2-f4d51a140000 pid=5146 /usr/bin/wget net send-data guuid=a82a23bf-2100-0000-3ec2-f4d5bd130000 pid=5053->guuid=c8598607-2200-0000-3ec2-f4d51a140000 pid=5146 execve guuid=8b3f080b-2200-0000-3ec2-f4d521140000 pid=5153 /usr/bin/curl net send-data write-file guuid=a82a23bf-2100-0000-3ec2-f4d5bd130000 pid=5053->guuid=8b3f080b-2200-0000-3ec2-f4d521140000 pid=5153 execve guuid=90d77610-2200-0000-3ec2-f4d533140000 pid=5171 /usr/bin/cat guuid=a82a23bf-2100-0000-3ec2-f4d5bd130000 pid=5053->guuid=90d77610-2200-0000-3ec2-f4d533140000 pid=5171 execve guuid=29ff8011-2200-0000-3ec2-f4d538140000 pid=5176 /usr/bin/chmod guuid=a82a23bf-2100-0000-3ec2-f4d5bd130000 pid=5053->guuid=29ff8011-2200-0000-3ec2-f4d538140000 pid=5176 execve guuid=cd1dfc11-2200-0000-3ec2-f4d539140000 pid=5177 /usr/bin/bash guuid=a82a23bf-2100-0000-3ec2-f4d5bd130000 pid=5053->guuid=cd1dfc11-2200-0000-3ec2-f4d539140000 pid=5177 clone guuid=c29a3e12-2200-0000-3ec2-f4d53c140000 pid=5180 /usr/bin/wget net send-data guuid=a82a23bf-2100-0000-3ec2-f4d5bd130000 pid=5053->guuid=c29a3e12-2200-0000-3ec2-f4d53c140000 pid=5180 execve guuid=e7968615-2200-0000-3ec2-f4d54b140000 pid=5195 /usr/bin/curl net send-data write-file guuid=a82a23bf-2100-0000-3ec2-f4d5bd130000 pid=5053->guuid=e7968615-2200-0000-3ec2-f4d54b140000 pid=5195 execve guuid=bbaf531a-2200-0000-3ec2-f4d557140000 pid=5207 /usr/bin/cat guuid=a82a23bf-2100-0000-3ec2-f4d5bd130000 pid=5053->guuid=bbaf531a-2200-0000-3ec2-f4d557140000 pid=5207 execve guuid=7331161b-2200-0000-3ec2-f4d558140000 pid=5208 /usr/bin/chmod guuid=a82a23bf-2100-0000-3ec2-f4d5bd130000 pid=5053->guuid=7331161b-2200-0000-3ec2-f4d558140000 pid=5208 execve guuid=0860b41b-2200-0000-3ec2-f4d559140000 pid=5209 /usr/bin/bash guuid=a82a23bf-2100-0000-3ec2-f4d5bd130000 pid=5053->guuid=0860b41b-2200-0000-3ec2-f4d559140000 pid=5209 clone guuid=78abf41b-2200-0000-3ec2-f4d55a140000 pid=5210 /usr/bin/wget net send-data guuid=a82a23bf-2100-0000-3ec2-f4d5bd130000 pid=5053->guuid=78abf41b-2200-0000-3ec2-f4d55a140000 pid=5210 execve guuid=0203891f-2200-0000-3ec2-f4d55b140000 pid=5211 /usr/bin/curl net send-data write-file guuid=a82a23bf-2100-0000-3ec2-f4d5bd130000 pid=5053->guuid=0203891f-2200-0000-3ec2-f4d55b140000 pid=5211 execve guuid=652d5f27-2200-0000-3ec2-f4d55c140000 pid=5212 /usr/bin/cat guuid=a82a23bf-2100-0000-3ec2-f4d5bd130000 pid=5053->guuid=652d5f27-2200-0000-3ec2-f4d55c140000 pid=5212 execve guuid=620af827-2200-0000-3ec2-f4d55d140000 pid=5213 /usr/bin/chmod guuid=a82a23bf-2100-0000-3ec2-f4d5bd130000 pid=5053->guuid=620af827-2200-0000-3ec2-f4d55d140000 pid=5213 execve guuid=ab6e7928-2200-0000-3ec2-f4d55e140000 pid=5214 /usr/bin/bash guuid=a82a23bf-2100-0000-3ec2-f4d5bd130000 pid=5053->guuid=ab6e7928-2200-0000-3ec2-f4d55e140000 pid=5214 clone guuid=a722ce28-2200-0000-3ec2-f4d55f140000 pid=5215 /usr/bin/wget net send-data guuid=a82a23bf-2100-0000-3ec2-f4d5bd130000 pid=5053->guuid=a722ce28-2200-0000-3ec2-f4d55f140000 pid=5215 execve guuid=c1df9d2b-2200-0000-3ec2-f4d560140000 pid=5216 /usr/bin/curl net send-data write-file guuid=a82a23bf-2100-0000-3ec2-f4d5bd130000 pid=5053->guuid=c1df9d2b-2200-0000-3ec2-f4d560140000 pid=5216 execve guuid=21b53230-2200-0000-3ec2-f4d561140000 pid=5217 /usr/bin/cat guuid=a82a23bf-2100-0000-3ec2-f4d5bd130000 pid=5053->guuid=21b53230-2200-0000-3ec2-f4d561140000 pid=5217 execve guuid=e0d2f230-2200-0000-3ec2-f4d562140000 pid=5218 /usr/bin/chmod guuid=a82a23bf-2100-0000-3ec2-f4d5bd130000 pid=5053->guuid=e0d2f230-2200-0000-3ec2-f4d562140000 pid=5218 execve guuid=6650f031-2200-0000-3ec2-f4d563140000 pid=5219 /usr/bin/bash guuid=a82a23bf-2100-0000-3ec2-f4d5bd130000 pid=5053->guuid=6650f031-2200-0000-3ec2-f4d563140000 pid=5219 clone guuid=be045232-2200-0000-3ec2-f4d564140000 pid=5220 /usr/bin/wget net send-data guuid=a82a23bf-2100-0000-3ec2-f4d5bd130000 pid=5053->guuid=be045232-2200-0000-3ec2-f4d564140000 pid=5220 execve guuid=0258dd35-2200-0000-3ec2-f4d565140000 pid=5221 /usr/bin/curl net send-data write-file guuid=a82a23bf-2100-0000-3ec2-f4d5bd130000 pid=5053->guuid=0258dd35-2200-0000-3ec2-f4d565140000 pid=5221 execve guuid=8e84c13b-2200-0000-3ec2-f4d566140000 pid=5222 /usr/bin/cat guuid=a82a23bf-2100-0000-3ec2-f4d5bd130000 pid=5053->guuid=8e84c13b-2200-0000-3ec2-f4d566140000 pid=5222 execve guuid=8756783c-2200-0000-3ec2-f4d567140000 pid=5223 /usr/bin/chmod guuid=a82a23bf-2100-0000-3ec2-f4d5bd130000 pid=5053->guuid=8756783c-2200-0000-3ec2-f4d567140000 pid=5223 execve guuid=05243e3d-2200-0000-3ec2-f4d568140000 pid=5224 /usr/bin/bash guuid=a82a23bf-2100-0000-3ec2-f4d5bd130000 pid=5053->guuid=05243e3d-2200-0000-3ec2-f4d568140000 pid=5224 clone guuid=b235943d-2200-0000-3ec2-f4d569140000 pid=5225 /usr/bin/wget net send-data guuid=a82a23bf-2100-0000-3ec2-f4d5bd130000 pid=5053->guuid=b235943d-2200-0000-3ec2-f4d569140000 pid=5225 execve guuid=f848da40-2200-0000-3ec2-f4d56a140000 pid=5226 /usr/bin/curl net send-data write-file guuid=a82a23bf-2100-0000-3ec2-f4d5bd130000 pid=5053->guuid=f848da40-2200-0000-3ec2-f4d56a140000 pid=5226 execve guuid=f44be951-2200-0000-3ec2-f4d56e140000 pid=5230 /usr/bin/cat guuid=a82a23bf-2100-0000-3ec2-f4d5bd130000 pid=5053->guuid=f44be951-2200-0000-3ec2-f4d56e140000 pid=5230 execve guuid=be267552-2200-0000-3ec2-f4d56f140000 pid=5231 /usr/bin/chmod guuid=a82a23bf-2100-0000-3ec2-f4d5bd130000 pid=5053->guuid=be267552-2200-0000-3ec2-f4d56f140000 pid=5231 execve guuid=b56dc752-2200-0000-3ec2-f4d570140000 pid=5232 /usr/bin/bash guuid=a82a23bf-2100-0000-3ec2-f4d5bd130000 pid=5053->guuid=b56dc752-2200-0000-3ec2-f4d570140000 pid=5232 clone guuid=9025fd52-2200-0000-3ec2-f4d571140000 pid=5233 /usr/bin/wget net send-data guuid=a82a23bf-2100-0000-3ec2-f4d5bd130000 pid=5053->guuid=9025fd52-2200-0000-3ec2-f4d571140000 pid=5233 execve guuid=a6138355-2200-0000-3ec2-f4d574140000 pid=5236 /usr/bin/curl net send-data write-file guuid=a82a23bf-2100-0000-3ec2-f4d5bd130000 pid=5053->guuid=a6138355-2200-0000-3ec2-f4d574140000 pid=5236 execve guuid=02898c5d-2200-0000-3ec2-f4d57b140000 pid=5243 /usr/bin/cat guuid=a82a23bf-2100-0000-3ec2-f4d5bd130000 pid=5053->guuid=02898c5d-2200-0000-3ec2-f4d57b140000 pid=5243 execve guuid=038ef85d-2200-0000-3ec2-f4d57c140000 pid=5244 /usr/bin/chmod guuid=a82a23bf-2100-0000-3ec2-f4d5bd130000 pid=5053->guuid=038ef85d-2200-0000-3ec2-f4d57c140000 pid=5244 execve guuid=c9a7555e-2200-0000-3ec2-f4d57d140000 pid=5245 /usr/bin/bash guuid=a82a23bf-2100-0000-3ec2-f4d5bd130000 pid=5053->guuid=c9a7555e-2200-0000-3ec2-f4d57d140000 pid=5245 clone guuid=2a92895e-2200-0000-3ec2-f4d57e140000 pid=5246 /usr/bin/wget net send-data guuid=a82a23bf-2100-0000-3ec2-f4d5bd130000 pid=5053->guuid=2a92895e-2200-0000-3ec2-f4d57e140000 pid=5246 execve guuid=6afa4761-2200-0000-3ec2-f4d57f140000 pid=5247 /usr/bin/curl net send-data write-file guuid=a82a23bf-2100-0000-3ec2-f4d5bd130000 pid=5053->guuid=6afa4761-2200-0000-3ec2-f4d57f140000 pid=5247 execve guuid=ec3fc065-2200-0000-3ec2-f4d580140000 pid=5248 /usr/bin/cat guuid=a82a23bf-2100-0000-3ec2-f4d5bd130000 pid=5053->guuid=ec3fc065-2200-0000-3ec2-f4d580140000 pid=5248 execve guuid=8da35c66-2200-0000-3ec2-f4d581140000 pid=5249 /usr/bin/chmod guuid=a82a23bf-2100-0000-3ec2-f4d5bd130000 pid=5053->guuid=8da35c66-2200-0000-3ec2-f4d581140000 pid=5249 execve guuid=f975e266-2200-0000-3ec2-f4d582140000 pid=5250 /usr/bin/bash guuid=a82a23bf-2100-0000-3ec2-f4d5bd130000 pid=5053->guuid=f975e266-2200-0000-3ec2-f4d582140000 pid=5250 clone guuid=d9231b67-2200-0000-3ec2-f4d583140000 pid=5251 /usr/bin/wget net send-data guuid=a82a23bf-2100-0000-3ec2-f4d5bd130000 pid=5053->guuid=d9231b67-2200-0000-3ec2-f4d583140000 pid=5251 execve guuid=b997116a-2200-0000-3ec2-f4d584140000 pid=5252 /usr/bin/curl net send-data write-file guuid=a82a23bf-2100-0000-3ec2-f4d5bd130000 pid=5053->guuid=b997116a-2200-0000-3ec2-f4d584140000 pid=5252 execve guuid=8a5e516f-2200-0000-3ec2-f4d585140000 pid=5253 /usr/bin/cat guuid=a82a23bf-2100-0000-3ec2-f4d5bd130000 pid=5053->guuid=8a5e516f-2200-0000-3ec2-f4d585140000 pid=5253 execve guuid=77e7bb6f-2200-0000-3ec2-f4d586140000 pid=5254 /usr/bin/chmod guuid=a82a23bf-2100-0000-3ec2-f4d5bd130000 pid=5053->guuid=77e7bb6f-2200-0000-3ec2-f4d586140000 pid=5254 execve guuid=95d62370-2200-0000-3ec2-f4d587140000 pid=5255 /usr/bin/bash guuid=a82a23bf-2100-0000-3ec2-f4d5bd130000 pid=5053->guuid=95d62370-2200-0000-3ec2-f4d587140000 pid=5255 clone guuid=a4214271-2200-0000-3ec2-f4d588140000 pid=5256 /usr/bin/wget net send-data guuid=a82a23bf-2100-0000-3ec2-f4d5bd130000 pid=5053->guuid=a4214271-2200-0000-3ec2-f4d588140000 pid=5256 execve guuid=cc3d9574-2200-0000-3ec2-f4d589140000 pid=5257 /usr/bin/curl net send-data write-file guuid=a82a23bf-2100-0000-3ec2-f4d5bd130000 pid=5053->guuid=cc3d9574-2200-0000-3ec2-f4d589140000 pid=5257 execve guuid=f5077e79-2200-0000-3ec2-f4d58a140000 pid=5258 /usr/bin/cat guuid=a82a23bf-2100-0000-3ec2-f4d5bd130000 pid=5053->guuid=f5077e79-2200-0000-3ec2-f4d58a140000 pid=5258 execve guuid=000be779-2200-0000-3ec2-f4d58b140000 pid=5259 /usr/bin/chmod guuid=a82a23bf-2100-0000-3ec2-f4d5bd130000 pid=5053->guuid=000be779-2200-0000-3ec2-f4d58b140000 pid=5259 execve guuid=ebcf3b7a-2200-0000-3ec2-f4d58c140000 pid=5260 /usr/bin/bash guuid=a82a23bf-2100-0000-3ec2-f4d5bd130000 pid=5053->guuid=ebcf3b7a-2200-0000-3ec2-f4d58c140000 pid=5260 clone guuid=82bc667a-2200-0000-3ec2-f4d58d140000 pid=5261 /usr/bin/wget net send-data guuid=a82a23bf-2100-0000-3ec2-f4d5bd130000 pid=5053->guuid=82bc667a-2200-0000-3ec2-f4d58d140000 pid=5261 execve guuid=7a50df7c-2200-0000-3ec2-f4d58e140000 pid=5262 /usr/bin/curl net send-data write-file guuid=a82a23bf-2100-0000-3ec2-f4d5bd130000 pid=5053->guuid=7a50df7c-2200-0000-3ec2-f4d58e140000 pid=5262 execve guuid=e1296380-2200-0000-3ec2-f4d58f140000 pid=5263 /usr/bin/cat guuid=a82a23bf-2100-0000-3ec2-f4d5bd130000 pid=5053->guuid=e1296380-2200-0000-3ec2-f4d58f140000 pid=5263 execve guuid=5044c880-2200-0000-3ec2-f4d590140000 pid=5264 /usr/bin/chmod guuid=a82a23bf-2100-0000-3ec2-f4d5bd130000 pid=5053->guuid=5044c880-2200-0000-3ec2-f4d590140000 pid=5264 execve guuid=54015081-2200-0000-3ec2-f4d591140000 pid=5265 /usr/bin/bash guuid=a82a23bf-2100-0000-3ec2-f4d5bd130000 pid=5053->guuid=54015081-2200-0000-3ec2-f4d591140000 pid=5265 clone guuid=7ae58d81-2200-0000-3ec2-f4d592140000 pid=5266 /usr/bin/wget net send-data guuid=a82a23bf-2100-0000-3ec2-f4d5bd130000 pid=5053->guuid=7ae58d81-2200-0000-3ec2-f4d592140000 pid=5266 execve guuid=39fd7584-2200-0000-3ec2-f4d593140000 pid=5267 /usr/bin/curl net send-data write-file guuid=a82a23bf-2100-0000-3ec2-f4d5bd130000 pid=5053->guuid=39fd7584-2200-0000-3ec2-f4d593140000 pid=5267 execve guuid=fa262b89-2200-0000-3ec2-f4d594140000 pid=5268 /usr/bin/cat guuid=a82a23bf-2100-0000-3ec2-f4d5bd130000 pid=5053->guuid=fa262b89-2200-0000-3ec2-f4d594140000 pid=5268 execve guuid=202c8389-2200-0000-3ec2-f4d595140000 pid=5269 /usr/bin/chmod guuid=a82a23bf-2100-0000-3ec2-f4d5bd130000 pid=5053->guuid=202c8389-2200-0000-3ec2-f4d595140000 pid=5269 execve guuid=2f46e489-2200-0000-3ec2-f4d596140000 pid=5270 /usr/bin/bash guuid=a82a23bf-2100-0000-3ec2-f4d5bd130000 pid=5053->guuid=2f46e489-2200-0000-3ec2-f4d596140000 pid=5270 clone 332eea57-4360-50e8-a1e4-417d4b73ab70 94.154.43.70:80 guuid=0cf9bbcd-2100-0000-3ec2-f4d5c8130000 pid=5064->332eea57-4360-50e8-a1e4-417d4b73ab70 send: 146B guuid=4bf138d8-2100-0000-3ec2-f4d5d0130000 pid=5072->332eea57-4360-50e8-a1e4-417d4b73ab70 send: 95B guuid=7f044be8-2100-0000-3ec2-f4d5ea130000 pid=5098->332eea57-4360-50e8-a1e4-417d4b73ab70 send: 146B guuid=2df8daeb-2100-0000-3ec2-f4d5f0130000 pid=5104->332eea57-4360-50e8-a1e4-417d4b73ab70 send: 95B guuid=b40eb9f9-2100-0000-3ec2-f4d505140000 pid=5125->332eea57-4360-50e8-a1e4-417d4b73ab70 send: 149B guuid=40182bfe-2100-0000-3ec2-f4d50c140000 pid=5132->332eea57-4360-50e8-a1e4-417d4b73ab70 send: 98B guuid=c8598607-2200-0000-3ec2-f4d51a140000 pid=5146->332eea57-4360-50e8-a1e4-417d4b73ab70 send: 147B guuid=8b3f080b-2200-0000-3ec2-f4d521140000 pid=5153->332eea57-4360-50e8-a1e4-417d4b73ab70 send: 96B guuid=c29a3e12-2200-0000-3ec2-f4d53c140000 pid=5180->332eea57-4360-50e8-a1e4-417d4b73ab70 send: 147B guuid=e7968615-2200-0000-3ec2-f4d54b140000 pid=5195->332eea57-4360-50e8-a1e4-417d4b73ab70 send: 96B guuid=78abf41b-2200-0000-3ec2-f4d55a140000 pid=5210->332eea57-4360-50e8-a1e4-417d4b73ab70 send: 149B guuid=0203891f-2200-0000-3ec2-f4d55b140000 pid=5211->332eea57-4360-50e8-a1e4-417d4b73ab70 send: 98B guuid=a722ce28-2200-0000-3ec2-f4d55f140000 pid=5215->332eea57-4360-50e8-a1e4-417d4b73ab70 send: 147B guuid=c1df9d2b-2200-0000-3ec2-f4d560140000 pid=5216->332eea57-4360-50e8-a1e4-417d4b73ab70 send: 96B guuid=be045232-2200-0000-3ec2-f4d564140000 pid=5220->332eea57-4360-50e8-a1e4-417d4b73ab70 send: 146B guuid=0258dd35-2200-0000-3ec2-f4d565140000 pid=5221->332eea57-4360-50e8-a1e4-417d4b73ab70 send: 95B guuid=b235943d-2200-0000-3ec2-f4d569140000 pid=5225->332eea57-4360-50e8-a1e4-417d4b73ab70 send: 147B guuid=f848da40-2200-0000-3ec2-f4d56a140000 pid=5226->332eea57-4360-50e8-a1e4-417d4b73ab70 send: 96B guuid=9025fd52-2200-0000-3ec2-f4d571140000 pid=5233->332eea57-4360-50e8-a1e4-417d4b73ab70 send: 147B guuid=a6138355-2200-0000-3ec2-f4d574140000 pid=5236->332eea57-4360-50e8-a1e4-417d4b73ab70 send: 96B guuid=2a92895e-2200-0000-3ec2-f4d57e140000 pid=5246->332eea57-4360-50e8-a1e4-417d4b73ab70 send: 147B guuid=6afa4761-2200-0000-3ec2-f4d57f140000 pid=5247->332eea57-4360-50e8-a1e4-417d4b73ab70 send: 96B guuid=d9231b67-2200-0000-3ec2-f4d583140000 pid=5251->332eea57-4360-50e8-a1e4-417d4b73ab70 send: 146B guuid=b997116a-2200-0000-3ec2-f4d584140000 pid=5252->332eea57-4360-50e8-a1e4-417d4b73ab70 send: 95B guuid=a4214271-2200-0000-3ec2-f4d588140000 pid=5256->332eea57-4360-50e8-a1e4-417d4b73ab70 send: 148B guuid=cc3d9574-2200-0000-3ec2-f4d589140000 pid=5257->332eea57-4360-50e8-a1e4-417d4b73ab70 send: 97B guuid=82bc667a-2200-0000-3ec2-f4d58d140000 pid=5261->332eea57-4360-50e8-a1e4-417d4b73ab70 send: 147B guuid=7a50df7c-2200-0000-3ec2-f4d58e140000 pid=5262->332eea57-4360-50e8-a1e4-417d4b73ab70 send: 96B guuid=7ae58d81-2200-0000-3ec2-f4d592140000 pid=5266->332eea57-4360-50e8-a1e4-417d4b73ab70 send: 146B guuid=39fd7584-2200-0000-3ec2-f4d593140000 pid=5267->332eea57-4360-50e8-a1e4-417d4b73ab70 send: 95B
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/9f1a43a5f3d643b88f3f2626d0e0c3b2484478d5343e1a016fa0a3fc3fc4a821
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9f1a43a5f3d643b88f3f2626d0e0c3b2484478d5343e1a016fa0a3fc3fc4a821/
Threat name:
Linux.Downloader.Medusa
Create hunting rule
Status:
Malicious
First seen:
2026-07-09 21:22:11 UTC
File Type:
Text (Shell)
AV detection:
22 of 36 (61.11%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=t4nehjpt2zb3rdz7eytnbygdwjeei6gvgq7bualpucr7yp6evaqq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260714-hrb47saw7w/
Behaviour
Reads runtime system information
System Network Configuration Discovery
Writes file to tmp directory
Checks CPU configuration
File and Directory Permissions Modification
Executes dropped EXE
Malware family:
Mirai
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/9f1a43a5f3d6/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.16
Link:
https://yomi.yoroi.company/submissions/9f1a43a5f3d643b88f3f2626d0e0c3b2484478d5343e1a016fa0a3fc3fc4a821

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Linux_Shellscript_Downloader
Create hunting rule
Author:albertzsigovits
Description:Generic Approach to Shellscript downloaders
Rule name:MAL_Linux_IoT_MultiArch_BotnetLoader_Generic
Create hunting rule
Author:Anish Bogati
Description:Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:MalwareBazaar sample lilin.sh

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 9f1a43a5f3d643b88f3f2626d0e0c3b2484478d5343e1a016fa0a3fc3fc4a821

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3886188/
  
Delivery method
Distributed via web download

Comments