MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a51580aade05f548b87eaf1dd98e4004330dbdcd8822a6405588944c57a8d33a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a51580aade05f548b87eaf1dd98e4004330dbdcd8822a6405588944c57a8d33a
SHA3-384 hash: c95a49c1de8692d14d95cdebb23738d357062f5d32ee652923356a2d1120dfbd1be509ea51cf01c8ee947d34b78e8efe
SHA1 hash: 418469b90afbade1081e050b10a0a23ad90f3302
MD5 hash: 8bf1b48138aecfd39dd241f7f515578a
humanhash: yankee-island-alanine-beer
File name:p
Download: download sample
File size:835 bytes
First seen:2026-08-02 02:15:14 UTC
Last seen:2026-08-02 14:55:07 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 24:kXCKysE2hi0ziQvZohaxMmF2AFuN1i0Xsj7d/tTlGN7:e9Qp+MsxvF2AIwPjhtTlM7
TLSH T19B016BC693649910801A995E22E651E1FC31C3C7254E4F787F9C682DABDCE14F16BF98
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://129.121.110.105/rEon/an/aua-wget
http://129.121.110.105/dmZ8n/an/aua-wget
http://129.121.110.105/hjAWn/an/aua-wget
http://129.121.110.105/Nkgn/an/aua-wget
http://129.121.110.105/4Aon/an/aua-wget

Intelligence

File Origin
# of uploads :
3
# of downloads :
60
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Gathering data
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive mirai
Link:
https://www.filescan.io/uploads/6a6ea8b35f27751f782b13fb/reports/13bf4ebf-39ca-420c-bf1f-5f66054ba565/overview
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/a9823dde-f5eb-42a9-ac4f-a5d13b4f5154
Behavior Graph:
Download SVG
%3 guuid=4c21692d-1a00-0000-4294-7a4753070000 pid=1875 /usr/bin/sudo guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878 /tmp/sample.bin write-file guuid=4c21692d-1a00-0000-4294-7a4753070000 pid=1875->guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878 execve guuid=8d499e31-1a00-0000-4294-7a4758070000 pid=1880 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=8d499e31-1a00-0000-4294-7a4758070000 pid=1880 execve guuid=44b13833-1a00-0000-4294-7a475b070000 pid=1883 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=44b13833-1a00-0000-4294-7a475b070000 pid=1883 execve guuid=b6c3e733-1a00-0000-4294-7a475d070000 pid=1885 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=b6c3e733-1a00-0000-4294-7a475d070000 pid=1885 execve guuid=81fbd634-1a00-0000-4294-7a475f070000 pid=1887 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=81fbd634-1a00-0000-4294-7a475f070000 pid=1887 execve guuid=ed15a235-1a00-0000-4294-7a4761070000 pid=1889 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=ed15a235-1a00-0000-4294-7a4761070000 pid=1889 execve guuid=05559636-1a00-0000-4294-7a4762070000 pid=1890 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=05559636-1a00-0000-4294-7a4762070000 pid=1890 execve guuid=b74e5a37-1a00-0000-4294-7a4763070000 pid=1891 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=b74e5a37-1a00-0000-4294-7a4763070000 pid=1891 execve guuid=e3ce0538-1a00-0000-4294-7a4765070000 pid=1893 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=e3ce0538-1a00-0000-4294-7a4765070000 pid=1893 execve guuid=78b1a538-1a00-0000-4294-7a4767070000 pid=1895 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=78b1a538-1a00-0000-4294-7a4767070000 pid=1895 execve guuid=90bf2f39-1a00-0000-4294-7a4769070000 pid=1897 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=90bf2f39-1a00-0000-4294-7a4769070000 pid=1897 execve guuid=0139cb39-1a00-0000-4294-7a476b070000 pid=1899 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=0139cb39-1a00-0000-4294-7a476b070000 pid=1899 execve guuid=24fc843a-1a00-0000-4294-7a476e070000 pid=1902 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=24fc843a-1a00-0000-4294-7a476e070000 pid=1902 execve guuid=1dbe1b3b-1a00-0000-4294-7a476f070000 pid=1903 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=1dbe1b3b-1a00-0000-4294-7a476f070000 pid=1903 execve guuid=ba43a93b-1a00-0000-4294-7a4770070000 pid=1904 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=ba43a93b-1a00-0000-4294-7a4770070000 pid=1904 execve guuid=e9a0953c-1a00-0000-4294-7a4771070000 pid=1905 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=e9a0953c-1a00-0000-4294-7a4771070000 pid=1905 execve guuid=138f683d-1a00-0000-4294-7a4772070000 pid=1906 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=138f683d-1a00-0000-4294-7a4772070000 pid=1906 execve guuid=19f83a3e-1a00-0000-4294-7a4773070000 pid=1907 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=19f83a3e-1a00-0000-4294-7a4773070000 pid=1907 execve guuid=172c283f-1a00-0000-4294-7a4774070000 pid=1908 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=172c283f-1a00-0000-4294-7a4774070000 pid=1908 execve guuid=531c1d40-1a00-0000-4294-7a4775070000 pid=1909 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=531c1d40-1a00-0000-4294-7a4775070000 pid=1909 execve guuid=2f0b5b41-1a00-0000-4294-7a4776070000 pid=1910 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=2f0b5b41-1a00-0000-4294-7a4776070000 pid=1910 execve guuid=226f4142-1a00-0000-4294-7a4777070000 pid=1911 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=226f4142-1a00-0000-4294-7a4777070000 pid=1911 execve guuid=374f1843-1a00-0000-4294-7a4778070000 pid=1912 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=374f1843-1a00-0000-4294-7a4778070000 pid=1912 execve guuid=42594144-1a00-0000-4294-7a4779070000 pid=1913 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=42594144-1a00-0000-4294-7a4779070000 pid=1913 execve guuid=3bb1ce44-1a00-0000-4294-7a477a070000 pid=1914 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=3bb1ce44-1a00-0000-4294-7a477a070000 pid=1914 execve guuid=45ba5545-1a00-0000-4294-7a477b070000 pid=1915 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=45ba5545-1a00-0000-4294-7a477b070000 pid=1915 execve guuid=39fef645-1a00-0000-4294-7a477c070000 pid=1916 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=39fef645-1a00-0000-4294-7a477c070000 pid=1916 execve guuid=5e8ed346-1a00-0000-4294-7a477d070000 pid=1917 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=5e8ed346-1a00-0000-4294-7a477d070000 pid=1917 execve guuid=27667247-1a00-0000-4294-7a477e070000 pid=1918 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=27667247-1a00-0000-4294-7a477e070000 pid=1918 execve guuid=48fc5549-1a00-0000-4294-7a477f070000 pid=1919 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=48fc5549-1a00-0000-4294-7a477f070000 pid=1919 execve guuid=e2fe9d4a-1a00-0000-4294-7a4780070000 pid=1920 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=e2fe9d4a-1a00-0000-4294-7a4780070000 pid=1920 execve guuid=b6666c4b-1a00-0000-4294-7a4781070000 pid=1921 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=b6666c4b-1a00-0000-4294-7a4781070000 pid=1921 execve guuid=c221104c-1a00-0000-4294-7a4782070000 pid=1922 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=c221104c-1a00-0000-4294-7a4782070000 pid=1922 execve guuid=5a86d24c-1a00-0000-4294-7a4783070000 pid=1923 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=5a86d24c-1a00-0000-4294-7a4783070000 pid=1923 execve guuid=8449884d-1a00-0000-4294-7a4784070000 pid=1924 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=8449884d-1a00-0000-4294-7a4784070000 pid=1924 execve guuid=73d9474e-1a00-0000-4294-7a4785070000 pid=1925 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=73d9474e-1a00-0000-4294-7a4785070000 pid=1925 execve guuid=ce3b494f-1a00-0000-4294-7a4786070000 pid=1926 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=ce3b494f-1a00-0000-4294-7a4786070000 pid=1926 execve guuid=2ef99c50-1a00-0000-4294-7a4787070000 pid=1927 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=2ef99c50-1a00-0000-4294-7a4787070000 pid=1927 execve guuid=32bc5351-1a00-0000-4294-7a4788070000 pid=1928 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=32bc5351-1a00-0000-4294-7a4788070000 pid=1928 execve guuid=f1b66152-1a00-0000-4294-7a4789070000 pid=1929 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=f1b66152-1a00-0000-4294-7a4789070000 pid=1929 execve guuid=d1e6a753-1a00-0000-4294-7a478a070000 pid=1930 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=d1e6a753-1a00-0000-4294-7a478a070000 pid=1930 execve guuid=b1176955-1a00-0000-4294-7a478b070000 pid=1931 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=b1176955-1a00-0000-4294-7a478b070000 pid=1931 execve guuid=d3ea4d58-1a00-0000-4294-7a478c070000 pid=1932 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=d3ea4d58-1a00-0000-4294-7a478c070000 pid=1932 execve guuid=2b693a5a-1a00-0000-4294-7a478d070000 pid=1933 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=2b693a5a-1a00-0000-4294-7a478d070000 pid=1933 execve guuid=358ea85b-1a00-0000-4294-7a478e070000 pid=1934 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=358ea85b-1a00-0000-4294-7a478e070000 pid=1934 execve guuid=89e2965c-1a00-0000-4294-7a478f070000 pid=1935 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=89e2965c-1a00-0000-4294-7a478f070000 pid=1935 execve guuid=f77a635d-1a00-0000-4294-7a4790070000 pid=1936 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=f77a635d-1a00-0000-4294-7a4790070000 pid=1936 execve guuid=c597675f-1a00-0000-4294-7a4791070000 pid=1937 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=c597675f-1a00-0000-4294-7a4791070000 pid=1937 execve guuid=16e12c60-1a00-0000-4294-7a4792070000 pid=1938 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=16e12c60-1a00-0000-4294-7a4792070000 pid=1938 execve guuid=781ff460-1a00-0000-4294-7a4793070000 pid=1939 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=781ff460-1a00-0000-4294-7a4793070000 pid=1939 execve guuid=91c99461-1a00-0000-4294-7a4795070000 pid=1941 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=91c99461-1a00-0000-4294-7a4795070000 pid=1941 execve guuid=f5e76462-1a00-0000-4294-7a4796070000 pid=1942 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=f5e76462-1a00-0000-4294-7a4796070000 pid=1942 execve guuid=0b52c963-1a00-0000-4294-7a4797070000 pid=1943 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=0b52c963-1a00-0000-4294-7a4797070000 pid=1943 execve guuid=3d9c5c65-1a00-0000-4294-7a479a070000 pid=1946 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=3d9c5c65-1a00-0000-4294-7a479a070000 pid=1946 execve guuid=6da04266-1a00-0000-4294-7a479b070000 pid=1947 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=6da04266-1a00-0000-4294-7a479b070000 pid=1947 execve guuid=0fb3a867-1a00-0000-4294-7a479e070000 pid=1950 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=0fb3a867-1a00-0000-4294-7a479e070000 pid=1950 execve guuid=b6376c68-1a00-0000-4294-7a47a1070000 pid=1953 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=b6376c68-1a00-0000-4294-7a47a1070000 pid=1953 execve guuid=bd0fea69-1a00-0000-4294-7a47a2070000 pid=1954 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=bd0fea69-1a00-0000-4294-7a47a2070000 pid=1954 execve guuid=c726e36a-1a00-0000-4294-7a47a3070000 pid=1955 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=c726e36a-1a00-0000-4294-7a47a3070000 pid=1955 execve guuid=767cba6b-1a00-0000-4294-7a47a4070000 pid=1956 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=767cba6b-1a00-0000-4294-7a47a4070000 pid=1956 execve guuid=a16a526d-1a00-0000-4294-7a47a6070000 pid=1958 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=a16a526d-1a00-0000-4294-7a47a6070000 pid=1958 execve guuid=ba7aac6e-1a00-0000-4294-7a47a7070000 pid=1959 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=ba7aac6e-1a00-0000-4294-7a47a7070000 pid=1959 execve guuid=ba87c56f-1a00-0000-4294-7a47a9070000 pid=1961 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=ba87c56f-1a00-0000-4294-7a47a9070000 pid=1961 execve guuid=f5a86770-1a00-0000-4294-7a47aa070000 pid=1962 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=f5a86770-1a00-0000-4294-7a47aa070000 pid=1962 execve guuid=d3de6571-1a00-0000-4294-7a47ad070000 pid=1965 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=d3de6571-1a00-0000-4294-7a47ad070000 pid=1965 execve guuid=05ebab72-1a00-0000-4294-7a47af070000 pid=1967 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=05ebab72-1a00-0000-4294-7a47af070000 pid=1967 execve guuid=19a77c74-1a00-0000-4294-7a47b3070000 pid=1971 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=19a77c74-1a00-0000-4294-7a47b3070000 pid=1971 execve guuid=1e147f75-1a00-0000-4294-7a47b6070000 pid=1974 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=1e147f75-1a00-0000-4294-7a47b6070000 pid=1974 execve guuid=60610e76-1a00-0000-4294-7a47b7070000 pid=1975 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=60610e76-1a00-0000-4294-7a47b7070000 pid=1975 execve guuid=c0ceb876-1a00-0000-4294-7a47b9070000 pid=1977 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=c0ceb876-1a00-0000-4294-7a47b9070000 pid=1977 execve guuid=da7cf577-1a00-0000-4294-7a47bb070000 pid=1979 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=da7cf577-1a00-0000-4294-7a47bb070000 pid=1979 execve guuid=987eef78-1a00-0000-4294-7a47bc070000 pid=1980 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=987eef78-1a00-0000-4294-7a47bc070000 pid=1980 execve guuid=2c5fd57a-1a00-0000-4294-7a47bd070000 pid=1981 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=2c5fd57a-1a00-0000-4294-7a47bd070000 pid=1981 execve guuid=58c88a7c-1a00-0000-4294-7a47be070000 pid=1982 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=58c88a7c-1a00-0000-4294-7a47be070000 pid=1982 execve guuid=e7e0537d-1a00-0000-4294-7a47bf070000 pid=1983 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=e7e0537d-1a00-0000-4294-7a47bf070000 pid=1983 execve guuid=cd7f077e-1a00-0000-4294-7a47c1070000 pid=1985 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=cd7f077e-1a00-0000-4294-7a47c1070000 pid=1985 execve guuid=0c7fb97e-1a00-0000-4294-7a47c2070000 pid=1986 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=0c7fb97e-1a00-0000-4294-7a47c2070000 pid=1986 execve guuid=3e9e647f-1a00-0000-4294-7a47c3070000 pid=1987 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=3e9e647f-1a00-0000-4294-7a47c3070000 pid=1987 execve guuid=ed4b1c80-1a00-0000-4294-7a47c5070000 pid=1989 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=ed4b1c80-1a00-0000-4294-7a47c5070000 pid=1989 execve guuid=3498f880-1a00-0000-4294-7a47c7070000 pid=1991 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=3498f880-1a00-0000-4294-7a47c7070000 pid=1991 execve guuid=63a41482-1a00-0000-4294-7a47ca070000 pid=1994 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=63a41482-1a00-0000-4294-7a47ca070000 pid=1994 execve guuid=4c68fc83-1a00-0000-4294-7a47cc070000 pid=1996 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=4c68fc83-1a00-0000-4294-7a47cc070000 pid=1996 execve guuid=61844485-1a00-0000-4294-7a47ce070000 pid=1998 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=61844485-1a00-0000-4294-7a47ce070000 pid=1998 execve guuid=73221f86-1a00-0000-4294-7a47d0070000 pid=2000 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=73221f86-1a00-0000-4294-7a47d0070000 pid=2000 execve guuid=13d10087-1a00-0000-4294-7a47d3070000 pid=2003 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=13d10087-1a00-0000-4294-7a47d3070000 pid=2003 execve guuid=98b5bf87-1a00-0000-4294-7a47d5070000 pid=2005 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=98b5bf87-1a00-0000-4294-7a47d5070000 pid=2005 execve guuid=54524988-1a00-0000-4294-7a47d7070000 pid=2007 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=54524988-1a00-0000-4294-7a47d7070000 pid=2007 execve guuid=322a4289-1a00-0000-4294-7a47d9070000 pid=2009 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=322a4289-1a00-0000-4294-7a47d9070000 pid=2009 execve guuid=63f47d8a-1a00-0000-4294-7a47db070000 pid=2011 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=63f47d8a-1a00-0000-4294-7a47db070000 pid=2011 execve guuid=88cccc8b-1a00-0000-4294-7a47dc070000 pid=2012 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=88cccc8b-1a00-0000-4294-7a47dc070000 pid=2012 execve guuid=5159c68c-1a00-0000-4294-7a47dd070000 pid=2013 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=5159c68c-1a00-0000-4294-7a47dd070000 pid=2013 execve guuid=4e22df8d-1a00-0000-4294-7a47df070000 pid=2015 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=4e22df8d-1a00-0000-4294-7a47df070000 pid=2015 execve guuid=66cd2c8f-1a00-0000-4294-7a47e1070000 pid=2017 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=66cd2c8f-1a00-0000-4294-7a47e1070000 pid=2017 execve guuid=55aef191-1a00-0000-4294-7a47e5070000 pid=2021 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=55aef191-1a00-0000-4294-7a47e5070000 pid=2021 execve guuid=db512a93-1a00-0000-4294-7a47e6070000 pid=2022 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=db512a93-1a00-0000-4294-7a47e6070000 pid=2022 execve guuid=e3d59f94-1a00-0000-4294-7a47e8070000 pid=2024 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=e3d59f94-1a00-0000-4294-7a47e8070000 pid=2024 execve guuid=96d4a095-1a00-0000-4294-7a47ea070000 pid=2026 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=96d4a095-1a00-0000-4294-7a47ea070000 pid=2026 execve guuid=0e456a96-1a00-0000-4294-7a47eb070000 pid=2027 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=0e456a96-1a00-0000-4294-7a47eb070000 pid=2027 execve guuid=09181e97-1a00-0000-4294-7a47ec070000 pid=2028 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=09181e97-1a00-0000-4294-7a47ec070000 pid=2028 execve guuid=414ce297-1a00-0000-4294-7a47ed070000 pid=2029 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=414ce297-1a00-0000-4294-7a47ed070000 pid=2029 execve guuid=9bed9f98-1a00-0000-4294-7a47ee070000 pid=2030 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=9bed9f98-1a00-0000-4294-7a47ee070000 pid=2030 execve guuid=6ff3db99-1a00-0000-4294-7a47f0070000 pid=2032 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=6ff3db99-1a00-0000-4294-7a47f0070000 pid=2032 execve guuid=d1a9a69a-1a00-0000-4294-7a47f2070000 pid=2034 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=d1a9a69a-1a00-0000-4294-7a47f2070000 pid=2034 execve guuid=30a1609b-1a00-0000-4294-7a47f3070000 pid=2035 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=30a1609b-1a00-0000-4294-7a47f3070000 pid=2035 execve guuid=8df50b9c-1a00-0000-4294-7a47f5070000 pid=2037 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=8df50b9c-1a00-0000-4294-7a47f5070000 pid=2037 execve guuid=e553c69c-1a00-0000-4294-7a47f6070000 pid=2038 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=e553c69c-1a00-0000-4294-7a47f6070000 pid=2038 execve guuid=8f62299e-1a00-0000-4294-7a47f7070000 pid=2039 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=8f62299e-1a00-0000-4294-7a47f7070000 pid=2039 execve guuid=3b90009f-1a00-0000-4294-7a47f8070000 pid=2040 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=3b90009f-1a00-0000-4294-7a47f8070000 pid=2040 execve guuid=e76730a0-1a00-0000-4294-7a47f9070000 pid=2041 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=e76730a0-1a00-0000-4294-7a47f9070000 pid=2041 execve guuid=0b25cea2-1a00-0000-4294-7a47fa070000 pid=2042 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=0b25cea2-1a00-0000-4294-7a47fa070000 pid=2042 execve guuid=870bc6a3-1a00-0000-4294-7a47fd070000 pid=2045 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=870bc6a3-1a00-0000-4294-7a47fd070000 pid=2045 execve guuid=a9339ba5-1a00-0000-4294-7a47ff070000 pid=2047 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=a9339ba5-1a00-0000-4294-7a47ff070000 pid=2047 execve guuid=10b5eaa6-1a00-0000-4294-7a4701080000 pid=2049 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=10b5eaa6-1a00-0000-4294-7a4701080000 pid=2049 execve guuid=6399a6a8-1a00-0000-4294-7a4702080000 pid=2050 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=6399a6a8-1a00-0000-4294-7a4702080000 pid=2050 execve guuid=03b090a9-1a00-0000-4294-7a4705080000 pid=2053 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=03b090a9-1a00-0000-4294-7a4705080000 pid=2053 execve guuid=eecd88aa-1a00-0000-4294-7a4709080000 pid=2057 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=eecd88aa-1a00-0000-4294-7a4709080000 pid=2057 execve guuid=d5d77eab-1a00-0000-4294-7a470b080000 pid=2059 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=d5d77eab-1a00-0000-4294-7a470b080000 pid=2059 execve guuid=729541ac-1a00-0000-4294-7a470c080000 pid=2060 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=729541ac-1a00-0000-4294-7a470c080000 pid=2060 execve guuid=9c1c29ad-1a00-0000-4294-7a470d080000 pid=2061 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=9c1c29ad-1a00-0000-4294-7a470d080000 pid=2061 execve guuid=b29f01ae-1a00-0000-4294-7a470e080000 pid=2062 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=b29f01ae-1a00-0000-4294-7a470e080000 pid=2062 execve guuid=454751b0-1a00-0000-4294-7a470f080000 pid=2063 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=454751b0-1a00-0000-4294-7a470f080000 pid=2063 execve guuid=e8c068b2-1a00-0000-4294-7a4711080000 pid=2065 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=e8c068b2-1a00-0000-4294-7a4711080000 pid=2065 execve guuid=344e44b3-1a00-0000-4294-7a4712080000 pid=2066 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=344e44b3-1a00-0000-4294-7a4712080000 pid=2066 execve guuid=e53832b4-1a00-0000-4294-7a4713080000 pid=2067 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=e53832b4-1a00-0000-4294-7a4713080000 pid=2067 execve guuid=4d4c2cb5-1a00-0000-4294-7a4714080000 pid=2068 /usr/bin/ls guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=4d4c2cb5-1a00-0000-4294-7a4714080000 pid=2068 execve guuid=9c2272b6-1a00-0000-4294-7a4715080000 pid=2069 /usr/bin/rm guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=9c2272b6-1a00-0000-4294-7a4715080000 pid=2069 execve guuid=8df129b7-1a00-0000-4294-7a4716080000 pid=2070 /usr/bin/wget net send-data write-file guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=8df129b7-1a00-0000-4294-7a4716080000 pid=2070 execve guuid=d9f0b9cb-1a00-0000-4294-7a4722080000 pid=2082 /usr/bin/chmod guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=d9f0b9cb-1a00-0000-4294-7a4722080000 pid=2082 execve guuid=a9861ecc-1a00-0000-4294-7a4724080000 pid=2084 /usr/bin/dash guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=a9861ecc-1a00-0000-4294-7a4724080000 pid=2084 clone guuid=0a965dcd-1a00-0000-4294-7a4727080000 pid=2087 /usr/bin/rm guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=0a965dcd-1a00-0000-4294-7a4727080000 pid=2087 execve guuid=0e94b9cd-1a00-0000-4294-7a4729080000 pid=2089 /usr/bin/wget net send-data write-file guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=0e94b9cd-1a00-0000-4294-7a4729080000 pid=2089 execve guuid=2cc49bd9-1a00-0000-4294-7a472f080000 pid=2095 /usr/bin/chmod guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=2cc49bd9-1a00-0000-4294-7a472f080000 pid=2095 execve guuid=112d7edb-1a00-0000-4294-7a4733080000 pid=2099 /usr/bin/dash guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=112d7edb-1a00-0000-4294-7a4733080000 pid=2099 clone guuid=5d62c8dd-1a00-0000-4294-7a4736080000 pid=2102 /usr/bin/rm guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=5d62c8dd-1a00-0000-4294-7a4736080000 pid=2102 execve guuid=5c6989de-1a00-0000-4294-7a4737080000 pid=2103 /usr/bin/wget net send-data write-file guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=5c6989de-1a00-0000-4294-7a4737080000 pid=2103 execve guuid=96a447e6-1a00-0000-4294-7a473e080000 pid=2110 /usr/bin/chmod guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=96a447e6-1a00-0000-4294-7a473e080000 pid=2110 execve guuid=a3ee9ae6-1a00-0000-4294-7a4740080000 pid=2112 /usr/bin/dash guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=a3ee9ae6-1a00-0000-4294-7a4740080000 pid=2112 clone guuid=13fccae7-1a00-0000-4294-7a4744080000 pid=2116 /usr/bin/rm guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=13fccae7-1a00-0000-4294-7a4744080000 pid=2116 execve guuid=129e22e8-1a00-0000-4294-7a4745080000 pid=2117 /usr/bin/wget net send-data write-file guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=129e22e8-1a00-0000-4294-7a4745080000 pid=2117 execve guuid=25c2cfee-1a00-0000-4294-7a474c080000 pid=2124 /usr/bin/chmod guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=25c2cfee-1a00-0000-4294-7a474c080000 pid=2124 execve guuid=74a5b9ef-1a00-0000-4294-7a474e080000 pid=2126 /usr/bin/dash guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=74a5b9ef-1a00-0000-4294-7a474e080000 pid=2126 clone guuid=dc0e39f2-1a00-0000-4294-7a4750080000 pid=2128 /usr/bin/rm guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=dc0e39f2-1a00-0000-4294-7a4750080000 pid=2128 execve guuid=95936bf3-1a00-0000-4294-7a4752080000 pid=2130 /usr/bin/wget net send-data write-file guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=95936bf3-1a00-0000-4294-7a4752080000 pid=2130 execve guuid=c5a74cfa-1a00-0000-4294-7a475a080000 pid=2138 /usr/bin/chmod guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=c5a74cfa-1a00-0000-4294-7a475a080000 pid=2138 execve guuid=f9f539fb-1a00-0000-4294-7a475c080000 pid=2140 /usr/bin/dash guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=f9f539fb-1a00-0000-4294-7a475c080000 pid=2140 clone guuid=93527bfc-1a00-0000-4294-7a475f080000 pid=2143 /usr/bin/rm delete-file guuid=c7a1e130-1a00-0000-4294-7a4756070000 pid=1878->guuid=93527bfc-1a00-0000-4294-7a475f080000 pid=2143 execve 0b1ba66e-2f8f-542f-9f7c-00dd01da057c 129.121.110.105:80 guuid=8df129b7-1a00-0000-4294-7a4716080000 pid=2070->0b1ba66e-2f8f-542f-9f7c-00dd01da057c send: 133B guuid=0e94b9cd-1a00-0000-4294-7a4729080000 pid=2089->0b1ba66e-2f8f-542f-9f7c-00dd01da057c send: 134B guuid=5c6989de-1a00-0000-4294-7a4737080000 pid=2103->0b1ba66e-2f8f-542f-9f7c-00dd01da057c send: 134B guuid=129e22e8-1a00-0000-4294-7a4745080000 pid=2117->0b1ba66e-2f8f-542f-9f7c-00dd01da057c send: 133B guuid=95936bf3-1a00-0000-4294-7a4752080000 pid=2130->0b1ba66e-2f8f-542f-9f7c-00dd01da057c send: 133B
Score:
99%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/a51580aade05f548b87eaf1dd98e4004330dbdcd8822a6405588944c57a8d33a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a51580aade05f548b87eaf1dd98e4004330dbdcd8822a6405588944c57a8d33a/
Gathering data
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=uukybkw6ax2urod6v4o5tdsaaqzq3ponrarkmqcvrckeyv5i2m5a._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery execution linux persistence privilege_escalation
Link:
https://tria.ge/reports/260802-cpvwmssclb/
Behaviour
Enumerates kernel/hardware configuration
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
Creates/modifies Cron job
Enumerates running processes
Modifies rc script
Modifies systemd
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.26
Link:
https://yomi.yoroi.company/submissions/a51580aade05f548b87eaf1dd98e4004330dbdcd8822a6405588944c57a8d33a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh a51580aade05f548b87eaf1dd98e4004330dbdcd8822a6405588944c57a8d33a

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3887342/
  
Delivery method
Distributed via web download

Comments