🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a5c1403a73d8b5c78ce1bb397e09c4c8b7bc7edd82eb747e001a113a21a1919d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a5c1403a73d8b5c78ce1bb397e09c4c8b7bc7edd82eb747e001a113a21a1919d
SHA3-384 hash: 6faacb4c286ceeac4bfbe245bd6f36e4789158e62bb8cb0f4b287bcc23b218952a6cc8553d529ac4090ec3aa83f0422b
SHA1 hash: 62224c466e394acefaf879e4f0950097284de47e
MD5 hash: 1a53bcdc23877ce61564ad1d666cec34
humanhash: sink-mountain-snake-rugby
File name:ok
Download: download sample
File size:1'608 bytes
First seen:2026-08-27 09:44:44 UTC
Last seen:2026-08-28 04:09:38 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 24:L262MHZK/ltPX4cif/R/Iavu83BArbq81c2PdtUXEjCUr:LFl3z/R/IDXhLUuCUr
TLSH T1A6317E9A02204B311102DA9D73B2358DB58DE2E71D8FC7C4895A1FB9828C7DCF661B49
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://5.182.210.174/ba0aden/an/an/a
http://5.182.210.174/70f3f7n/an/an/a
http://5.182.210.174/f88bf3n/an/an/a
http://5.182.210.174/1c0e8dn/an/an/a
http://5.182.210.174/830c06n/an/an/a
http://5.182.210.174/51bcf8n/an/an/a
http://5.182.210.174/66f78en/an/an/a
http://5.182.210.174/f203e8n/an/an/a
http://5.182.210.174/608d5fn/an/an/a
http://5.182.210.174/83abe1n/an/an/a
http://5.182.210.174/faf100n/an/an/a
http://5.182.210.174/201f39n/an/an/a

Intelligence

File Origin
# of uploads :
3
# of downloads :
61
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-08-27T07:53:00Z UTC
Last seen:
2026-08-27T08:08:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/a5c1403a73d8b5c78ce1bb397e09c4c8b7bc7edd82eb747e001a113a21a1919d/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/5b47dc17-0d10-4ead-854e-1ad7d41b6664
Behavior Graph:
Download SVG
%3 guuid=ad8ab6c4-1800-0000-cf72-1d8fb1080000 pid=2225 /usr/bin/sudo guuid=d5e085c7-1800-0000-cf72-1d8fb4080000 pid=2228 /tmp/sample.bin guuid=ad8ab6c4-1800-0000-cf72-1d8fb1080000 pid=2225->guuid=d5e085c7-1800-0000-cf72-1d8fb4080000 pid=2228 execve guuid=09f661c8-1800-0000-cf72-1d8fb6080000 pid=2230 /usr/bin/wget net send-data guuid=d5e085c7-1800-0000-cf72-1d8fb4080000 pid=2228->guuid=09f661c8-1800-0000-cf72-1d8fb6080000 pid=2230 execve guuid=cf78acce-1800-0000-cf72-1d8fc5080000 pid=2245 /usr/bin/curl net send-data write-file guuid=d5e085c7-1800-0000-cf72-1d8fb4080000 pid=2228->guuid=cf78acce-1800-0000-cf72-1d8fc5080000 pid=2245 execve guuid=51db93d8-1800-0000-cf72-1d8fd6080000 pid=2262 /usr/bin/chmod guuid=d5e085c7-1800-0000-cf72-1d8fb4080000 pid=2228->guuid=51db93d8-1800-0000-cf72-1d8fd6080000 pid=2262 execve guuid=f0f1ebd8-1800-0000-cf72-1d8fd7080000 pid=2263 /usr/bin/bash guuid=d5e085c7-1800-0000-cf72-1d8fb4080000 pid=2228->guuid=f0f1ebd8-1800-0000-cf72-1d8fd7080000 pid=2263 clone guuid=6cdb3dd9-1800-0000-cf72-1d8fd9080000 pid=2265 /usr/bin/rm delete-file guuid=d5e085c7-1800-0000-cf72-1d8fb4080000 pid=2228->guuid=6cdb3dd9-1800-0000-cf72-1d8fd9080000 pid=2265 execve guuid=e48699d9-1800-0000-cf72-1d8fda080000 pid=2266 /usr/bin/rm guuid=d5e085c7-1800-0000-cf72-1d8fb4080000 pid=2228->guuid=e48699d9-1800-0000-cf72-1d8fda080000 pid=2266 execve guuid=609becd9-1800-0000-cf72-1d8fdb080000 pid=2267 /usr/bin/wget net send-data guuid=d5e085c7-1800-0000-cf72-1d8fb4080000 pid=2228->guuid=609becd9-1800-0000-cf72-1d8fdb080000 pid=2267 execve guuid=036590dc-1800-0000-cf72-1d8fe4080000 pid=2276 /usr/bin/curl net send-data write-file guuid=d5e085c7-1800-0000-cf72-1d8fb4080000 pid=2228->guuid=036590dc-1800-0000-cf72-1d8fe4080000 pid=2276 execve guuid=3d94dde2-1800-0000-cf72-1d8ff2080000 pid=2290 /usr/bin/chmod guuid=d5e085c7-1800-0000-cf72-1d8fb4080000 pid=2228->guuid=3d94dde2-1800-0000-cf72-1d8ff2080000 pid=2290 execve guuid=a6e73fe3-1800-0000-cf72-1d8ff3080000 pid=2291 /usr/bin/bash guuid=d5e085c7-1800-0000-cf72-1d8fb4080000 pid=2228->guuid=a6e73fe3-1800-0000-cf72-1d8ff3080000 pid=2291 clone guuid=6320b6e3-1800-0000-cf72-1d8ff6080000 pid=2294 /usr/bin/rm delete-file guuid=d5e085c7-1800-0000-cf72-1d8fb4080000 pid=2228->guuid=6320b6e3-1800-0000-cf72-1d8ff6080000 pid=2294 execve guuid=e28922e4-1800-0000-cf72-1d8ff7080000 pid=2295 /usr/bin/rm guuid=d5e085c7-1800-0000-cf72-1d8fb4080000 pid=2228->guuid=e28922e4-1800-0000-cf72-1d8ff7080000 pid=2295 execve guuid=d7f486e4-1800-0000-cf72-1d8ffa080000 pid=2298 /usr/bin/wget net send-data guuid=d5e085c7-1800-0000-cf72-1d8fb4080000 pid=2228->guuid=d7f486e4-1800-0000-cf72-1d8ffa080000 pid=2298 execve guuid=f3c537e7-1800-0000-cf72-1d8f01090000 pid=2305 /usr/bin/curl net send-data write-file guuid=d5e085c7-1800-0000-cf72-1d8fb4080000 pid=2228->guuid=f3c537e7-1800-0000-cf72-1d8f01090000 pid=2305 execve guuid=1e1567ef-1800-0000-cf72-1d8f14090000 pid=2324 /usr/bin/chmod guuid=d5e085c7-1800-0000-cf72-1d8fb4080000 pid=2228->guuid=1e1567ef-1800-0000-cf72-1d8f14090000 pid=2324 execve guuid=69d9b3ef-1800-0000-cf72-1d8f17090000 pid=2327 /usr/bin/bash guuid=d5e085c7-1800-0000-cf72-1d8fb4080000 pid=2228->guuid=69d9b3ef-1800-0000-cf72-1d8f17090000 pid=2327 clone guuid=e2bcf3ef-1800-0000-cf72-1d8f19090000 pid=2329 /usr/bin/rm delete-file guuid=d5e085c7-1800-0000-cf72-1d8fb4080000 pid=2228->guuid=e2bcf3ef-1800-0000-cf72-1d8f19090000 pid=2329 execve guuid=818f45f0-1800-0000-cf72-1d8f1a090000 pid=2330 /usr/bin/rm guuid=d5e085c7-1800-0000-cf72-1d8fb4080000 pid=2228->guuid=818f45f0-1800-0000-cf72-1d8f1a090000 pid=2330 execve guuid=d5518df0-1800-0000-cf72-1d8f1c090000 pid=2332 /usr/bin/wget net send-data guuid=d5e085c7-1800-0000-cf72-1d8fb4080000 pid=2228->guuid=d5518df0-1800-0000-cf72-1d8f1c090000 pid=2332 execve guuid=f039d4f3-1800-0000-cf72-1d8f23090000 pid=2339 /usr/bin/curl net send-data write-file guuid=d5e085c7-1800-0000-cf72-1d8fb4080000 pid=2228->guuid=f039d4f3-1800-0000-cf72-1d8f23090000 pid=2339 execve guuid=f2b5aff7-1800-0000-cf72-1d8f30090000 pid=2352 /usr/bin/chmod guuid=d5e085c7-1800-0000-cf72-1d8fb4080000 pid=2228->guuid=f2b5aff7-1800-0000-cf72-1d8f30090000 pid=2352 execve guuid=a588f5f7-1800-0000-cf72-1d8f31090000 pid=2353 /usr/bin/bash guuid=d5e085c7-1800-0000-cf72-1d8fb4080000 pid=2228->guuid=a588f5f7-1800-0000-cf72-1d8f31090000 pid=2353 clone guuid=5ddf2df8-1800-0000-cf72-1d8f34090000 pid=2356 /usr/bin/rm delete-file guuid=d5e085c7-1800-0000-cf72-1d8fb4080000 pid=2228->guuid=5ddf2df8-1800-0000-cf72-1d8f34090000 pid=2356 execve guuid=bbdf73f8-1800-0000-cf72-1d8f35090000 pid=2357 /usr/bin/rm guuid=d5e085c7-1800-0000-cf72-1d8fb4080000 pid=2228->guuid=bbdf73f8-1800-0000-cf72-1d8f35090000 pid=2357 execve guuid=a5c7b3f8-1800-0000-cf72-1d8f36090000 pid=2358 /usr/bin/wget net send-data guuid=d5e085c7-1800-0000-cf72-1d8fb4080000 pid=2228->guuid=a5c7b3f8-1800-0000-cf72-1d8f36090000 pid=2358 execve guuid=a2755ffb-1800-0000-cf72-1d8f3e090000 pid=2366 /usr/bin/curl net send-data write-file guuid=d5e085c7-1800-0000-cf72-1d8fb4080000 pid=2228->guuid=a2755ffb-1800-0000-cf72-1d8f3e090000 pid=2366 execve guuid=39fe9701-1900-0000-cf72-1d8f4c090000 pid=2380 /usr/bin/chmod guuid=d5e085c7-1800-0000-cf72-1d8fb4080000 pid=2228->guuid=39fe9701-1900-0000-cf72-1d8f4c090000 pid=2380 execve guuid=88cbde01-1900-0000-cf72-1d8f4e090000 pid=2382 /usr/bin/bash guuid=d5e085c7-1800-0000-cf72-1d8fb4080000 pid=2228->guuid=88cbde01-1900-0000-cf72-1d8f4e090000 pid=2382 clone guuid=eab70f02-1900-0000-cf72-1d8f51090000 pid=2385 /usr/bin/rm delete-file guuid=d5e085c7-1800-0000-cf72-1d8fb4080000 pid=2228->guuid=eab70f02-1900-0000-cf72-1d8f51090000 pid=2385 execve guuid=42b24a02-1900-0000-cf72-1d8f53090000 pid=2387 /usr/bin/rm guuid=d5e085c7-1800-0000-cf72-1d8fb4080000 pid=2228->guuid=42b24a02-1900-0000-cf72-1d8f53090000 pid=2387 execve guuid=446aa402-1900-0000-cf72-1d8f55090000 pid=2389 /usr/bin/wget net send-data guuid=d5e085c7-1800-0000-cf72-1d8fb4080000 pid=2228->guuid=446aa402-1900-0000-cf72-1d8f55090000 pid=2389 execve guuid=91bc2c05-1900-0000-cf72-1d8f5c090000 pid=2396 /usr/bin/curl net send-data write-file guuid=d5e085c7-1800-0000-cf72-1d8fb4080000 pid=2228->guuid=91bc2c05-1900-0000-cf72-1d8f5c090000 pid=2396 execve guuid=e233e009-1900-0000-cf72-1d8f68090000 pid=2408 /usr/bin/chmod guuid=d5e085c7-1800-0000-cf72-1d8fb4080000 pid=2228->guuid=e233e009-1900-0000-cf72-1d8f68090000 pid=2408 execve guuid=a3ce640a-1900-0000-cf72-1d8f6a090000 pid=2410 /usr/bin/bash guuid=d5e085c7-1800-0000-cf72-1d8fb4080000 pid=2228->guuid=a3ce640a-1900-0000-cf72-1d8f6a090000 pid=2410 clone guuid=6cb8b10a-1900-0000-cf72-1d8f6d090000 pid=2413 /usr/bin/rm delete-file guuid=d5e085c7-1800-0000-cf72-1d8fb4080000 pid=2228->guuid=6cb8b10a-1900-0000-cf72-1d8f6d090000 pid=2413 execve guuid=26442d0b-1900-0000-cf72-1d8f6e090000 pid=2414 /usr/bin/rm guuid=d5e085c7-1800-0000-cf72-1d8fb4080000 pid=2228->guuid=26442d0b-1900-0000-cf72-1d8f6e090000 pid=2414 execve guuid=3644a70b-1900-0000-cf72-1d8f71090000 pid=2417 /usr/bin/wget net send-data guuid=d5e085c7-1800-0000-cf72-1d8fb4080000 pid=2228->guuid=3644a70b-1900-0000-cf72-1d8f71090000 pid=2417 execve guuid=c182450e-1900-0000-cf72-1d8f75090000 pid=2421 /usr/bin/curl net send-data write-file guuid=d5e085c7-1800-0000-cf72-1d8fb4080000 pid=2228->guuid=c182450e-1900-0000-cf72-1d8f75090000 pid=2421 execve guuid=087e5212-1900-0000-cf72-1d8f80090000 pid=2432 /usr/bin/chmod guuid=d5e085c7-1800-0000-cf72-1d8fb4080000 pid=2228->guuid=087e5212-1900-0000-cf72-1d8f80090000 pid=2432 execve guuid=ae3cc212-1900-0000-cf72-1d8f81090000 pid=2433 /usr/bin/bash guuid=d5e085c7-1800-0000-cf72-1d8fb4080000 pid=2228->guuid=ae3cc212-1900-0000-cf72-1d8f81090000 pid=2433 clone guuid=2e945d13-1900-0000-cf72-1d8f84090000 pid=2436 /usr/bin/rm delete-file guuid=d5e085c7-1800-0000-cf72-1d8fb4080000 pid=2228->guuid=2e945d13-1900-0000-cf72-1d8f84090000 pid=2436 execve guuid=e1f3be13-1900-0000-cf72-1d8f86090000 pid=2438 /usr/bin/rm guuid=d5e085c7-1800-0000-cf72-1d8fb4080000 pid=2228->guuid=e1f3be13-1900-0000-cf72-1d8f86090000 pid=2438 execve guuid=ecbe3d14-1900-0000-cf72-1d8f88090000 pid=2440 /usr/bin/wget net send-data guuid=d5e085c7-1800-0000-cf72-1d8fb4080000 pid=2228->guuid=ecbe3d14-1900-0000-cf72-1d8f88090000 pid=2440 execve guuid=5bdb4117-1900-0000-cf72-1d8f91090000 pid=2449 /usr/bin/curl net send-data write-file guuid=d5e085c7-1800-0000-cf72-1d8fb4080000 pid=2228->guuid=5bdb4117-1900-0000-cf72-1d8f91090000 pid=2449 execve guuid=f4f51c1c-1900-0000-cf72-1d8f9e090000 pid=2462 /usr/bin/chmod guuid=d5e085c7-1800-0000-cf72-1d8fb4080000 pid=2228->guuid=f4f51c1c-1900-0000-cf72-1d8f9e090000 pid=2462 execve guuid=63028f1c-1900-0000-cf72-1d8fa0090000 pid=2464 /usr/bin/bash guuid=d5e085c7-1800-0000-cf72-1d8fb4080000 pid=2228->guuid=63028f1c-1900-0000-cf72-1d8fa0090000 pid=2464 clone guuid=68aae91c-1900-0000-cf72-1d8fa2090000 pid=2466 /usr/bin/rm delete-file guuid=d5e085c7-1800-0000-cf72-1d8fb4080000 pid=2228->guuid=68aae91c-1900-0000-cf72-1d8fa2090000 pid=2466 execve guuid=3cbc601d-1900-0000-cf72-1d8fa5090000 pid=2469 /usr/bin/rm guuid=d5e085c7-1800-0000-cf72-1d8fb4080000 pid=2228->guuid=3cbc601d-1900-0000-cf72-1d8fa5090000 pid=2469 execve guuid=60fad61d-1900-0000-cf72-1d8fa7090000 pid=2471 /usr/bin/wget net send-data guuid=d5e085c7-1800-0000-cf72-1d8fb4080000 pid=2228->guuid=60fad61d-1900-0000-cf72-1d8fa7090000 pid=2471 execve guuid=15d0f620-1900-0000-cf72-1d8fae090000 pid=2478 /usr/bin/curl net send-data write-file guuid=d5e085c7-1800-0000-cf72-1d8fb4080000 pid=2228->guuid=15d0f620-1900-0000-cf72-1d8fae090000 pid=2478 execve guuid=34ba4626-1900-0000-cf72-1d8fb7090000 pid=2487 /usr/bin/chmod guuid=d5e085c7-1800-0000-cf72-1d8fb4080000 pid=2228->guuid=34ba4626-1900-0000-cf72-1d8fb7090000 pid=2487 execve guuid=ce3b9226-1900-0000-cf72-1d8fb9090000 pid=2489 /usr/bin/bash guuid=d5e085c7-1800-0000-cf72-1d8fb4080000 pid=2228->guuid=ce3b9226-1900-0000-cf72-1d8fb9090000 pid=2489 clone guuid=2416da26-1900-0000-cf72-1d8fbb090000 pid=2491 /usr/bin/rm delete-file guuid=d5e085c7-1800-0000-cf72-1d8fb4080000 pid=2228->guuid=2416da26-1900-0000-cf72-1d8fbb090000 pid=2491 execve guuid=70952c27-1900-0000-cf72-1d8fbd090000 pid=2493 /usr/bin/rm guuid=d5e085c7-1800-0000-cf72-1d8fb4080000 pid=2228->guuid=70952c27-1900-0000-cf72-1d8fbd090000 pid=2493 execve guuid=d84f8327-1900-0000-cf72-1d8fbf090000 pid=2495 /usr/bin/wget net send-data guuid=d5e085c7-1800-0000-cf72-1d8fb4080000 pid=2228->guuid=d84f8327-1900-0000-cf72-1d8fbf090000 pid=2495 execve guuid=945b402a-1900-0000-cf72-1d8fc4090000 pid=2500 /usr/bin/curl net send-data write-file guuid=d5e085c7-1800-0000-cf72-1d8fb4080000 pid=2228->guuid=945b402a-1900-0000-cf72-1d8fc4090000 pid=2500 execve guuid=ba4abb32-1900-0000-cf72-1d8fd0090000 pid=2512 /usr/bin/chmod guuid=d5e085c7-1800-0000-cf72-1d8fb4080000 pid=2228->guuid=ba4abb32-1900-0000-cf72-1d8fd0090000 pid=2512 execve guuid=7634c433-1900-0000-cf72-1d8fd3090000 pid=2515 /usr/bin/bash guuid=d5e085c7-1800-0000-cf72-1d8fb4080000 pid=2228->guuid=7634c433-1900-0000-cf72-1d8fd3090000 pid=2515 clone guuid=bb729734-1900-0000-cf72-1d8fd7090000 pid=2519 /usr/bin/rm delete-file guuid=d5e085c7-1800-0000-cf72-1d8fb4080000 pid=2228->guuid=bb729734-1900-0000-cf72-1d8fd7090000 pid=2519 execve guuid=c03ba035-1900-0000-cf72-1d8fda090000 pid=2522 /usr/bin/rm guuid=d5e085c7-1800-0000-cf72-1d8fb4080000 pid=2228->guuid=c03ba035-1900-0000-cf72-1d8fda090000 pid=2522 execve guuid=471afd36-1900-0000-cf72-1d8fde090000 pid=2526 /usr/bin/wget net send-data guuid=d5e085c7-1800-0000-cf72-1d8fb4080000 pid=2228->guuid=471afd36-1900-0000-cf72-1d8fde090000 pid=2526 execve guuid=3a403c41-1900-0000-cf72-1d8ff1090000 pid=2545 /usr/bin/curl net send-data write-file guuid=d5e085c7-1800-0000-cf72-1d8fb4080000 pid=2228->guuid=3a403c41-1900-0000-cf72-1d8ff1090000 pid=2545 execve guuid=98213b4a-1900-0000-cf72-1d8f070a0000 pid=2567 /usr/bin/chmod guuid=d5e085c7-1800-0000-cf72-1d8fb4080000 pid=2228->guuid=98213b4a-1900-0000-cf72-1d8f070a0000 pid=2567 execve guuid=b515c54b-1900-0000-cf72-1d8f0b0a0000 pid=2571 /usr/bin/bash guuid=d5e085c7-1800-0000-cf72-1d8fb4080000 pid=2228->guuid=b515c54b-1900-0000-cf72-1d8f0b0a0000 pid=2571 clone guuid=34745b4d-1900-0000-cf72-1d8f110a0000 pid=2577 /usr/bin/rm delete-file guuid=d5e085c7-1800-0000-cf72-1d8fb4080000 pid=2228->guuid=34745b4d-1900-0000-cf72-1d8f110a0000 pid=2577 execve guuid=2dd2b84e-1900-0000-cf72-1d8f160a0000 pid=2582 /usr/bin/rm guuid=d5e085c7-1800-0000-cf72-1d8fb4080000 pid=2228->guuid=2dd2b84e-1900-0000-cf72-1d8f160a0000 pid=2582 execve guuid=6cb33550-1900-0000-cf72-1d8f1b0a0000 pid=2587 /usr/bin/wget net send-data guuid=d5e085c7-1800-0000-cf72-1d8fb4080000 pid=2228->guuid=6cb33550-1900-0000-cf72-1d8f1b0a0000 pid=2587 execve guuid=0793ed53-1900-0000-cf72-1d8f240a0000 pid=2596 /usr/bin/curl net send-data write-file guuid=d5e085c7-1800-0000-cf72-1d8fb4080000 pid=2228->guuid=0793ed53-1900-0000-cf72-1d8f240a0000 pid=2596 execve guuid=0e597f5e-1900-0000-cf72-1d8f330a0000 pid=2611 /usr/bin/chmod guuid=d5e085c7-1800-0000-cf72-1d8fb4080000 pid=2228->guuid=0e597f5e-1900-0000-cf72-1d8f330a0000 pid=2611 execve guuid=7b20fb5e-1900-0000-cf72-1d8f350a0000 pid=2613 /usr/bin/bash guuid=d5e085c7-1800-0000-cf72-1d8fb4080000 pid=2228->guuid=7b20fb5e-1900-0000-cf72-1d8f350a0000 pid=2613 clone guuid=cdf65a5f-1900-0000-cf72-1d8f370a0000 pid=2615 /usr/bin/rm delete-file guuid=d5e085c7-1800-0000-cf72-1d8fb4080000 pid=2228->guuid=cdf65a5f-1900-0000-cf72-1d8f370a0000 pid=2615 execve guuid=c193b65f-1900-0000-cf72-1d8f380a0000 pid=2616 /usr/bin/rm guuid=d5e085c7-1800-0000-cf72-1d8fb4080000 pid=2228->guuid=c193b65f-1900-0000-cf72-1d8f380a0000 pid=2616 execve 5b654972-c9e1-50d8-b372-2dc2a5b9ad66 5.182.210.174:80 guuid=09f661c8-1800-0000-cf72-1d8fb6080000 pid=2230->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=cf78acce-1800-0000-cf72-1d8fc5080000 pid=2245->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=e97f0ad9-1800-0000-cf72-1d8fd8080000 pid=2264 /usr/bin/bash guuid=f0f1ebd8-1800-0000-cf72-1d8fd7080000 pid=2263->guuid=e97f0ad9-1800-0000-cf72-1d8fd8080000 pid=2264 clone guuid=609becd9-1800-0000-cf72-1d8fdb080000 pid=2267->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=036590dc-1800-0000-cf72-1d8fe4080000 pid=2276->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=e3ea5de3-1800-0000-cf72-1d8ff4080000 pid=2292 /usr/bin/bash guuid=a6e73fe3-1800-0000-cf72-1d8ff3080000 pid=2291->guuid=e3ea5de3-1800-0000-cf72-1d8ff4080000 pid=2292 clone guuid=d7f486e4-1800-0000-cf72-1d8ffa080000 pid=2298->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=f3c537e7-1800-0000-cf72-1d8f01090000 pid=2305->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=a939c7ef-1800-0000-cf72-1d8f18090000 pid=2328 /usr/bin/bash guuid=69d9b3ef-1800-0000-cf72-1d8f17090000 pid=2327->guuid=a939c7ef-1800-0000-cf72-1d8f18090000 pid=2328 clone guuid=d5518df0-1800-0000-cf72-1d8f1c090000 pid=2332->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=f039d4f3-1800-0000-cf72-1d8f23090000 pid=2339->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=aafd09f8-1800-0000-cf72-1d8f32090000 pid=2354 /usr/bin/bash guuid=a588f5f7-1800-0000-cf72-1d8f31090000 pid=2353->guuid=aafd09f8-1800-0000-cf72-1d8f32090000 pid=2354 clone guuid=a5c7b3f8-1800-0000-cf72-1d8f36090000 pid=2358->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=a2755ffb-1800-0000-cf72-1d8f3e090000 pid=2366->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=ed37f301-1900-0000-cf72-1d8f50090000 pid=2384 /usr/bin/bash guuid=88cbde01-1900-0000-cf72-1d8f4e090000 pid=2382->guuid=ed37f301-1900-0000-cf72-1d8f50090000 pid=2384 clone guuid=446aa402-1900-0000-cf72-1d8f55090000 pid=2389->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=91bc2c05-1900-0000-cf72-1d8f5c090000 pid=2396->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=4140840a-1900-0000-cf72-1d8f6b090000 pid=2411 /usr/bin/bash guuid=a3ce640a-1900-0000-cf72-1d8f6a090000 pid=2410->guuid=4140840a-1900-0000-cf72-1d8f6b090000 pid=2411 clone guuid=3644a70b-1900-0000-cf72-1d8f71090000 pid=2417->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=c182450e-1900-0000-cf72-1d8f75090000 pid=2421->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=4414ea12-1900-0000-cf72-1d8f82090000 pid=2434 /usr/bin/bash guuid=ae3cc212-1900-0000-cf72-1d8f81090000 pid=2433->guuid=4414ea12-1900-0000-cf72-1d8f82090000 pid=2434 clone guuid=ecbe3d14-1900-0000-cf72-1d8f88090000 pid=2440->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=5bdb4117-1900-0000-cf72-1d8f91090000 pid=2449->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=56a0b41c-1900-0000-cf72-1d8fa1090000 pid=2465 /usr/bin/bash guuid=63028f1c-1900-0000-cf72-1d8fa0090000 pid=2464->guuid=56a0b41c-1900-0000-cf72-1d8fa1090000 pid=2465 clone guuid=60fad61d-1900-0000-cf72-1d8fa7090000 pid=2471->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=15d0f620-1900-0000-cf72-1d8fae090000 pid=2478->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=cc27ab26-1900-0000-cf72-1d8fba090000 pid=2490 /usr/bin/bash guuid=ce3b9226-1900-0000-cf72-1d8fb9090000 pid=2489->guuid=cc27ab26-1900-0000-cf72-1d8fba090000 pid=2490 clone guuid=d84f8327-1900-0000-cf72-1d8fbf090000 pid=2495->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=945b402a-1900-0000-cf72-1d8fc4090000 pid=2500->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=33372634-1900-0000-cf72-1d8fd5090000 pid=2517 /usr/bin/bash guuid=7634c433-1900-0000-cf72-1d8fd3090000 pid=2515->guuid=33372634-1900-0000-cf72-1d8fd5090000 pid=2517 clone guuid=471afd36-1900-0000-cf72-1d8fde090000 pid=2526->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=3a403c41-1900-0000-cf72-1d8ff1090000 pid=2545->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=d098d14c-1900-0000-cf72-1d8f0f0a0000 pid=2575 /usr/bin/bash guuid=b515c54b-1900-0000-cf72-1d8f0b0a0000 pid=2571->guuid=d098d14c-1900-0000-cf72-1d8f0f0a0000 pid=2575 clone guuid=6cb33550-1900-0000-cf72-1d8f1b0a0000 pid=2587->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=0793ed53-1900-0000-cf72-1d8f240a0000 pid=2596->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=63b3215f-1900-0000-cf72-1d8f360a0000 pid=2614 /usr/bin/bash guuid=7b20fb5e-1900-0000-cf72-1d8f350a0000 pid=2613->guuid=63b3215f-1900-0000-cf72-1d8f360a0000 pid=2614 clone
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/a5c1403a73d8b5c78ce1bb397e09c4c8b7bc7edd82eb747e001a113a21a1919d
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a5c1403a73d8b5c78ce1bb397e09c4c8b7bc7edd82eb747e001a113a21a1919d/
Threat name:
Linux.Trojan.Multiverze
Create hunting rule
Status:
Malicious
First seen:
2026-08-27 09:45:24 UTC
File Type:
Text (Shell)
AV detection:
13 of 24 (54.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=uxauaott3c24pdhbxm4x4coezc33y7w5qlvxi7qadiituinbsgoq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260827-lq7q9s1whv/
Behaviour
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.11
Link:
https://yomi.yoroi.company/submissions/a5c1403a73d8b5c78ce1bb397e09c4c8b7bc7edd82eb747e001a113a21a1919d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh a5c1403a73d8b5c78ce1bb397e09c4c8b7bc7edd82eb747e001a113a21a1919d

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3897671/
  
Delivery method
Distributed via web download

Comments