MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a6d87ca41c596e3f8a06ce4cc6105cc2e5a133fca49da4d78d16116f298dd931. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a6d87ca41c596e3f8a06ce4cc6105cc2e5a133fca49da4d78d16116f298dd931
SHA3-384 hash: 1cedbb4bc1ed1f5b1e2314ddbc1cdaa9fb5301f0218c402d2432895dc0f1210e4515725adb7f50f2c8cf5d260e31fb8a
SHA1 hash: 2a8c9ac171adc7b489e77373aac45606f54cd0c6
MD5 hash: 182d3a073ea8eb042ed39ad83029fd7c
humanhash: potato-fish-september-oven
File name:p
Download: download sample
File size:835 bytes
First seen:2026-08-09 19:47:44 UTC
Last seen:2026-08-10 05:29:18 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkaqCouPtC9W/+CCsFDCVKnvbRaC1rYauD:kXCKysE2hi0ziQvZohaq+VnWSDSPn7
TLSH T1DD016BD69250AA104069D95E62D666D0F431C3C6454B0FB8BF9C942FAB9CE04B026F98
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://129.121.110.105/VOgAn/an/aua-wget
http://129.121.110.105/vJBn/an/aua-wget
http://129.121.110.105/sCyn/an/aua-wget
http://129.121.110.105/ZTMen/an/aua-wget
http://129.121.110.105/JPOn/an/aua-wget

Intelligence

File Origin
# of uploads :
2
# of downloads :
47
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive mirai
Link:
https://www.filescan.io/uploads/6a78d98c0ebf10d943f111fe/reports/b369abbb-d33b-4c2c-9cb8-406e706b1e21/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-08-09T17:49:00Z UTC
Last seen:
2026-08-09T18:36:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/a6d87ca41c596e3f8a06ce4cc6105cc2e5a133fca49da4d78d16116f298dd931/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/595ea398-057d-4a9d-98a9-ba519245b4ef
Behavior Graph:
Download SVG
%3 guuid=dac93905-1700-0000-0e33-259f770c0000 pid=3191 /usr/bin/sudo guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200 /tmp/sample.bin write-file guuid=dac93905-1700-0000-0e33-259f770c0000 pid=3191->guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200 execve guuid=d8b76108-1700-0000-0e33-259f820c0000 pid=3202 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=d8b76108-1700-0000-0e33-259f820c0000 pid=3202 execve guuid=dc26d508-1700-0000-0e33-259f830c0000 pid=3203 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=dc26d508-1700-0000-0e33-259f830c0000 pid=3203 execve guuid=0cb77e09-1700-0000-0e33-259f840c0000 pid=3204 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=0cb77e09-1700-0000-0e33-259f840c0000 pid=3204 execve guuid=a0eb200a-1700-0000-0e33-259f850c0000 pid=3205 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=a0eb200a-1700-0000-0e33-259f850c0000 pid=3205 execve guuid=a311a20a-1700-0000-0e33-259f870c0000 pid=3207 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=a311a20a-1700-0000-0e33-259f870c0000 pid=3207 execve guuid=658b200b-1700-0000-0e33-259f890c0000 pid=3209 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=658b200b-1700-0000-0e33-259f890c0000 pid=3209 execve guuid=4ed1a80b-1700-0000-0e33-259f8b0c0000 pid=3211 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=4ed1a80b-1700-0000-0e33-259f8b0c0000 pid=3211 execve guuid=6fdb230c-1700-0000-0e33-259f8d0c0000 pid=3213 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=6fdb230c-1700-0000-0e33-259f8d0c0000 pid=3213 execve guuid=3df79e0c-1700-0000-0e33-259f8f0c0000 pid=3215 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=3df79e0c-1700-0000-0e33-259f8f0c0000 pid=3215 execve guuid=d5d21f0d-1700-0000-0e33-259f910c0000 pid=3217 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=d5d21f0d-1700-0000-0e33-259f910c0000 pid=3217 execve guuid=d40fcd0d-1700-0000-0e33-259f920c0000 pid=3218 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=d40fcd0d-1700-0000-0e33-259f920c0000 pid=3218 execve guuid=226b920e-1700-0000-0e33-259f930c0000 pid=3219 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=226b920e-1700-0000-0e33-259f930c0000 pid=3219 execve guuid=169a590f-1700-0000-0e33-259f940c0000 pid=3220 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=169a590f-1700-0000-0e33-259f940c0000 pid=3220 execve guuid=4f782310-1700-0000-0e33-259f950c0000 pid=3221 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=4f782310-1700-0000-0e33-259f950c0000 pid=3221 execve guuid=3d2edb10-1700-0000-0e33-259f960c0000 pid=3222 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=3d2edb10-1700-0000-0e33-259f960c0000 pid=3222 execve guuid=00faa011-1700-0000-0e33-259f970c0000 pid=3223 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=00faa011-1700-0000-0e33-259f970c0000 pid=3223 execve guuid=943a7412-1700-0000-0e33-259f980c0000 pid=3224 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=943a7412-1700-0000-0e33-259f980c0000 pid=3224 execve guuid=f9ea3e13-1700-0000-0e33-259f990c0000 pid=3225 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=f9ea3e13-1700-0000-0e33-259f990c0000 pid=3225 execve guuid=53921214-1700-0000-0e33-259f9a0c0000 pid=3226 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=53921214-1700-0000-0e33-259f9a0c0000 pid=3226 execve guuid=0efbdc14-1700-0000-0e33-259f9b0c0000 pid=3227 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=0efbdc14-1700-0000-0e33-259f9b0c0000 pid=3227 execve guuid=6132aa15-1700-0000-0e33-259f9c0c0000 pid=3228 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=6132aa15-1700-0000-0e33-259f9c0c0000 pid=3228 execve guuid=63397f16-1700-0000-0e33-259f9d0c0000 pid=3229 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=63397f16-1700-0000-0e33-259f9d0c0000 pid=3229 execve guuid=1e804c17-1700-0000-0e33-259f9e0c0000 pid=3230 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=1e804c17-1700-0000-0e33-259f9e0c0000 pid=3230 execve guuid=9e0a0318-1700-0000-0e33-259f9f0c0000 pid=3231 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=9e0a0318-1700-0000-0e33-259f9f0c0000 pid=3231 execve guuid=19bcc518-1700-0000-0e33-259fa00c0000 pid=3232 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=19bcc518-1700-0000-0e33-259fa00c0000 pid=3232 execve guuid=abefc519-1700-0000-0e33-259fa10c0000 pid=3233 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=abefc519-1700-0000-0e33-259fa10c0000 pid=3233 execve guuid=c644851a-1700-0000-0e33-259fa20c0000 pid=3234 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=c644851a-1700-0000-0e33-259fa20c0000 pid=3234 execve guuid=47df3e1b-1700-0000-0e33-259fa40c0000 pid=3236 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=47df3e1b-1700-0000-0e33-259fa40c0000 pid=3236 execve guuid=39fe271c-1700-0000-0e33-259fa50c0000 pid=3237 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=39fe271c-1700-0000-0e33-259fa50c0000 pid=3237 execve guuid=9b7dee1c-1700-0000-0e33-259fa60c0000 pid=3238 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=9b7dee1c-1700-0000-0e33-259fa60c0000 pid=3238 execve guuid=37fb951d-1700-0000-0e33-259fa80c0000 pid=3240 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=37fb951d-1700-0000-0e33-259fa80c0000 pid=3240 execve guuid=ae06351e-1700-0000-0e33-259fab0c0000 pid=3243 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=ae06351e-1700-0000-0e33-259fab0c0000 pid=3243 execve guuid=4d9ddc1e-1700-0000-0e33-259fad0c0000 pid=3245 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=4d9ddc1e-1700-0000-0e33-259fad0c0000 pid=3245 execve guuid=5217861f-1700-0000-0e33-259fb00c0000 pid=3248 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=5217861f-1700-0000-0e33-259fb00c0000 pid=3248 execve guuid=214c1f20-1700-0000-0e33-259fb20c0000 pid=3250 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=214c1f20-1700-0000-0e33-259fb20c0000 pid=3250 execve guuid=57bec220-1700-0000-0e33-259fb50c0000 pid=3253 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=57bec220-1700-0000-0e33-259fb50c0000 pid=3253 execve guuid=1dfe5921-1700-0000-0e33-259fb70c0000 pid=3255 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=1dfe5921-1700-0000-0e33-259fb70c0000 pid=3255 execve guuid=3111f921-1700-0000-0e33-259fb80c0000 pid=3256 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=3111f921-1700-0000-0e33-259fb80c0000 pid=3256 execve guuid=9cc57f22-1700-0000-0e33-259fb90c0000 pid=3257 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=9cc57f22-1700-0000-0e33-259fb90c0000 pid=3257 execve guuid=eaddde22-1700-0000-0e33-259fba0c0000 pid=3258 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=eaddde22-1700-0000-0e33-259fba0c0000 pid=3258 execve guuid=45a34b23-1700-0000-0e33-259fbb0c0000 pid=3259 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=45a34b23-1700-0000-0e33-259fbb0c0000 pid=3259 execve guuid=f8c1b323-1700-0000-0e33-259fbc0c0000 pid=3260 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=f8c1b323-1700-0000-0e33-259fbc0c0000 pid=3260 execve guuid=1a832e24-1700-0000-0e33-259fbd0c0000 pid=3261 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=1a832e24-1700-0000-0e33-259fbd0c0000 pid=3261 execve guuid=c8639d24-1700-0000-0e33-259fbe0c0000 pid=3262 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=c8639d24-1700-0000-0e33-259fbe0c0000 pid=3262 execve guuid=3b175125-1700-0000-0e33-259fbf0c0000 pid=3263 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=3b175125-1700-0000-0e33-259fbf0c0000 pid=3263 execve guuid=27e7d025-1700-0000-0e33-259fc00c0000 pid=3264 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=27e7d025-1700-0000-0e33-259fc00c0000 pid=3264 execve guuid=0c036426-1700-0000-0e33-259fc10c0000 pid=3265 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=0c036426-1700-0000-0e33-259fc10c0000 pid=3265 execve guuid=66841327-1700-0000-0e33-259fc20c0000 pid=3266 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=66841327-1700-0000-0e33-259fc20c0000 pid=3266 execve guuid=d45fb027-1700-0000-0e33-259fc40c0000 pid=3268 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=d45fb027-1700-0000-0e33-259fc40c0000 pid=3268 execve guuid=b3064428-1700-0000-0e33-259fc50c0000 pid=3269 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=b3064428-1700-0000-0e33-259fc50c0000 pid=3269 execve guuid=cebdd328-1700-0000-0e33-259fc60c0000 pid=3270 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=cebdd328-1700-0000-0e33-259fc60c0000 pid=3270 execve guuid=4b888e29-1700-0000-0e33-259fc70c0000 pid=3271 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=4b888e29-1700-0000-0e33-259fc70c0000 pid=3271 execve guuid=e26d472a-1700-0000-0e33-259fca0c0000 pid=3274 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=e26d472a-1700-0000-0e33-259fca0c0000 pid=3274 execve guuid=8ddaf62a-1700-0000-0e33-259fcc0c0000 pid=3276 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=8ddaf62a-1700-0000-0e33-259fcc0c0000 pid=3276 execve guuid=e7b9702b-1700-0000-0e33-259fcf0c0000 pid=3279 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=e7b9702b-1700-0000-0e33-259fcf0c0000 pid=3279 execve guuid=32ba422c-1700-0000-0e33-259fd00c0000 pid=3280 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=32ba422c-1700-0000-0e33-259fd00c0000 pid=3280 execve guuid=c1201b2d-1700-0000-0e33-259fd20c0000 pid=3282 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=c1201b2d-1700-0000-0e33-259fd20c0000 pid=3282 execve guuid=5b25ef2d-1700-0000-0e33-259fd30c0000 pid=3283 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=5b25ef2d-1700-0000-0e33-259fd30c0000 pid=3283 execve guuid=4213b52e-1700-0000-0e33-259fd50c0000 pid=3285 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=4213b52e-1700-0000-0e33-259fd50c0000 pid=3285 execve guuid=0294982f-1700-0000-0e33-259fd60c0000 pid=3286 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=0294982f-1700-0000-0e33-259fd60c0000 pid=3286 execve guuid=41199e30-1700-0000-0e33-259fd70c0000 pid=3287 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=41199e30-1700-0000-0e33-259fd70c0000 pid=3287 execve guuid=bdaf8031-1700-0000-0e33-259fd80c0000 pid=3288 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=bdaf8031-1700-0000-0e33-259fd80c0000 pid=3288 execve guuid=20b85832-1700-0000-0e33-259fd90c0000 pid=3289 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=20b85832-1700-0000-0e33-259fd90c0000 pid=3289 execve guuid=b4ca4533-1700-0000-0e33-259fda0c0000 pid=3290 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=b4ca4533-1700-0000-0e33-259fda0c0000 pid=3290 execve guuid=845d0434-1700-0000-0e33-259fdc0c0000 pid=3292 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=845d0434-1700-0000-0e33-259fdc0c0000 pid=3292 execve guuid=4899d034-1700-0000-0e33-259fdd0c0000 pid=3293 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=4899d034-1700-0000-0e33-259fdd0c0000 pid=3293 execve guuid=6d2a9c35-1700-0000-0e33-259fdf0c0000 pid=3295 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=6d2a9c35-1700-0000-0e33-259fdf0c0000 pid=3295 execve guuid=3a986536-1700-0000-0e33-259fe00c0000 pid=3296 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=3a986536-1700-0000-0e33-259fe00c0000 pid=3296 execve guuid=027f2237-1700-0000-0e33-259fe20c0000 pid=3298 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=027f2237-1700-0000-0e33-259fe20c0000 pid=3298 execve guuid=0372e337-1700-0000-0e33-259fe30c0000 pid=3299 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=0372e337-1700-0000-0e33-259fe30c0000 pid=3299 execve guuid=4fd9b738-1700-0000-0e33-259fe50c0000 pid=3301 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=4fd9b738-1700-0000-0e33-259fe50c0000 pid=3301 execve guuid=3a6c5139-1700-0000-0e33-259fe70c0000 pid=3303 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=3a6c5139-1700-0000-0e33-259fe70c0000 pid=3303 execve guuid=8be0d839-1700-0000-0e33-259fe90c0000 pid=3305 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=8be0d839-1700-0000-0e33-259fe90c0000 pid=3305 execve guuid=0f20543a-1700-0000-0e33-259feb0c0000 pid=3307 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=0f20543a-1700-0000-0e33-259feb0c0000 pid=3307 execve guuid=6df5e93a-1700-0000-0e33-259fed0c0000 pid=3309 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=6df5e93a-1700-0000-0e33-259fed0c0000 pid=3309 execve guuid=2679463b-1700-0000-0e33-259fee0c0000 pid=3310 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=2679463b-1700-0000-0e33-259fee0c0000 pid=3310 execve guuid=f4ada23b-1700-0000-0e33-259ff00c0000 pid=3312 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=f4ada23b-1700-0000-0e33-259ff00c0000 pid=3312 execve guuid=092bf93b-1700-0000-0e33-259ff10c0000 pid=3313 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=092bf93b-1700-0000-0e33-259ff10c0000 pid=3313 execve guuid=62af513c-1700-0000-0e33-259ff30c0000 pid=3315 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=62af513c-1700-0000-0e33-259ff30c0000 pid=3315 execve guuid=f52cad3c-1700-0000-0e33-259ff40c0000 pid=3316 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=f52cad3c-1700-0000-0e33-259ff40c0000 pid=3316 execve guuid=f26e033d-1700-0000-0e33-259ff60c0000 pid=3318 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=f26e033d-1700-0000-0e33-259ff60c0000 pid=3318 execve guuid=a94d5e3d-1700-0000-0e33-259ff70c0000 pid=3319 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=a94d5e3d-1700-0000-0e33-259ff70c0000 pid=3319 execve guuid=35e0b23d-1700-0000-0e33-259ff80c0000 pid=3320 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=35e0b23d-1700-0000-0e33-259ff80c0000 pid=3320 execve guuid=d98e0c3e-1700-0000-0e33-259ffa0c0000 pid=3322 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=d98e0c3e-1700-0000-0e33-259ffa0c0000 pid=3322 execve guuid=7dfb613e-1700-0000-0e33-259ffb0c0000 pid=3323 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=7dfb613e-1700-0000-0e33-259ffb0c0000 pid=3323 execve guuid=4d9abb3e-1700-0000-0e33-259ffd0c0000 pid=3325 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=4d9abb3e-1700-0000-0e33-259ffd0c0000 pid=3325 execve guuid=3b3c163f-1700-0000-0e33-259fff0c0000 pid=3327 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=3b3c163f-1700-0000-0e33-259fff0c0000 pid=3327 execve guuid=48f96d3f-1700-0000-0e33-259f000d0000 pid=3328 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=48f96d3f-1700-0000-0e33-259f000d0000 pid=3328 execve guuid=37a0c33f-1700-0000-0e33-259f010d0000 pid=3329 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=37a0c33f-1700-0000-0e33-259f010d0000 pid=3329 execve guuid=d7063440-1700-0000-0e33-259f030d0000 pid=3331 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=d7063440-1700-0000-0e33-259f030d0000 pid=3331 execve guuid=d0448c40-1700-0000-0e33-259f050d0000 pid=3333 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=d0448c40-1700-0000-0e33-259f050d0000 pid=3333 execve guuid=cf54e640-1700-0000-0e33-259f060d0000 pid=3334 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=cf54e640-1700-0000-0e33-259f060d0000 pid=3334 execve guuid=dbe23c41-1700-0000-0e33-259f080d0000 pid=3336 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=dbe23c41-1700-0000-0e33-259f080d0000 pid=3336 execve guuid=78a89541-1700-0000-0e33-259f090d0000 pid=3337 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=78a89541-1700-0000-0e33-259f090d0000 pid=3337 execve guuid=ba72ed41-1700-0000-0e33-259f0a0d0000 pid=3338 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=ba72ed41-1700-0000-0e33-259f0a0d0000 pid=3338 execve guuid=e52d4942-1700-0000-0e33-259f0b0d0000 pid=3339 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=e52d4942-1700-0000-0e33-259f0b0d0000 pid=3339 execve guuid=d5fa1e43-1700-0000-0e33-259f0d0d0000 pid=3341 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=d5fa1e43-1700-0000-0e33-259f0d0d0000 pid=3341 execve guuid=b0849143-1700-0000-0e33-259f0e0d0000 pid=3342 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=b0849143-1700-0000-0e33-259f0e0d0000 pid=3342 execve guuid=42164744-1700-0000-0e33-259f110d0000 pid=3345 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=42164744-1700-0000-0e33-259f110d0000 pid=3345 execve guuid=5de6b044-1700-0000-0e33-259f130d0000 pid=3347 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=5de6b044-1700-0000-0e33-259f130d0000 pid=3347 execve guuid=9d7e1645-1700-0000-0e33-259f160d0000 pid=3350 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=9d7e1645-1700-0000-0e33-259f160d0000 pid=3350 execve guuid=5c5c8345-1700-0000-0e33-259f180d0000 pid=3352 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=5c5c8345-1700-0000-0e33-259f180d0000 pid=3352 execve guuid=77660646-1700-0000-0e33-259f1b0d0000 pid=3355 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=77660646-1700-0000-0e33-259f1b0d0000 pid=3355 execve guuid=e7b58346-1700-0000-0e33-259f1d0d0000 pid=3357 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=e7b58346-1700-0000-0e33-259f1d0d0000 pid=3357 execve guuid=04d33147-1700-0000-0e33-259f1e0d0000 pid=3358 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=04d33147-1700-0000-0e33-259f1e0d0000 pid=3358 execve guuid=a4f1f047-1700-0000-0e33-259f200d0000 pid=3360 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=a4f1f047-1700-0000-0e33-259f200d0000 pid=3360 execve guuid=6f879848-1700-0000-0e33-259f220d0000 pid=3362 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=6f879848-1700-0000-0e33-259f220d0000 pid=3362 execve guuid=48e13b49-1700-0000-0e33-259f260d0000 pid=3366 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=48e13b49-1700-0000-0e33-259f260d0000 pid=3366 execve guuid=7d42d049-1700-0000-0e33-259f280d0000 pid=3368 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=7d42d049-1700-0000-0e33-259f280d0000 pid=3368 execve guuid=f0c43e4c-1700-0000-0e33-259f2d0d0000 pid=3373 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=f0c43e4c-1700-0000-0e33-259f2d0d0000 pid=3373 execve guuid=cb75cc4e-1700-0000-0e33-259f340d0000 pid=3380 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=cb75cc4e-1700-0000-0e33-259f340d0000 pid=3380 execve guuid=7971ef4f-1700-0000-0e33-259f360d0000 pid=3382 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=7971ef4f-1700-0000-0e33-259f360d0000 pid=3382 execve guuid=21fc8d50-1700-0000-0e33-259f370d0000 pid=3383 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=21fc8d50-1700-0000-0e33-259f370d0000 pid=3383 execve guuid=d11c0151-1700-0000-0e33-259f380d0000 pid=3384 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=d11c0151-1700-0000-0e33-259f380d0000 pid=3384 execve guuid=e4748051-1700-0000-0e33-259f390d0000 pid=3385 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=e4748051-1700-0000-0e33-259f390d0000 pid=3385 execve guuid=7aafec51-1700-0000-0e33-259f3c0d0000 pid=3388 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=7aafec51-1700-0000-0e33-259f3c0d0000 pid=3388 execve guuid=d84e4e52-1700-0000-0e33-259f3e0d0000 pid=3390 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=d84e4e52-1700-0000-0e33-259f3e0d0000 pid=3390 execve guuid=ada7b652-1700-0000-0e33-259f410d0000 pid=3393 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=ada7b652-1700-0000-0e33-259f410d0000 pid=3393 execve guuid=97d21853-1700-0000-0e33-259f430d0000 pid=3395 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=97d21853-1700-0000-0e33-259f430d0000 pid=3395 execve guuid=f27a8153-1700-0000-0e33-259f460d0000 pid=3398 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=f27a8153-1700-0000-0e33-259f460d0000 pid=3398 execve guuid=ba2fe353-1700-0000-0e33-259f480d0000 pid=3400 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=ba2fe353-1700-0000-0e33-259f480d0000 pid=3400 execve guuid=5c1a6854-1700-0000-0e33-259f4b0d0000 pid=3403 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=5c1a6854-1700-0000-0e33-259f4b0d0000 pid=3403 execve guuid=3a9cd354-1700-0000-0e33-259f4d0d0000 pid=3405 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=3a9cd354-1700-0000-0e33-259f4d0d0000 pid=3405 execve guuid=5ba53e55-1700-0000-0e33-259f500d0000 pid=3408 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=5ba53e55-1700-0000-0e33-259f500d0000 pid=3408 execve guuid=ec50ae55-1700-0000-0e33-259f520d0000 pid=3410 /usr/bin/ls guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=ec50ae55-1700-0000-0e33-259f520d0000 pid=3410 execve guuid=2f6f1856-1700-0000-0e33-259f540d0000 pid=3412 /usr/bin/rm guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=2f6f1856-1700-0000-0e33-259f540d0000 pid=3412 execve guuid=fe4d5c56-1700-0000-0e33-259f560d0000 pid=3414 /usr/bin/wget net send-data write-file guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=fe4d5c56-1700-0000-0e33-259f560d0000 pid=3414 execve guuid=64c4e85d-1700-0000-0e33-259f630d0000 pid=3427 /usr/bin/chmod guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=64c4e85d-1700-0000-0e33-259f630d0000 pid=3427 execve guuid=446e245e-1700-0000-0e33-259f640d0000 pid=3428 /usr/bin/dash guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=446e245e-1700-0000-0e33-259f640d0000 pid=3428 clone guuid=3282bd5e-1700-0000-0e33-259f680d0000 pid=3432 /usr/bin/rm guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=3282bd5e-1700-0000-0e33-259f680d0000 pid=3432 execve guuid=63a2fc5e-1700-0000-0e33-259f6a0d0000 pid=3434 /usr/bin/wget net send-data write-file guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=63a2fc5e-1700-0000-0e33-259f6a0d0000 pid=3434 execve guuid=d1303463-1700-0000-0e33-259f790d0000 pid=3449 /usr/bin/chmod guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=d1303463-1700-0000-0e33-259f790d0000 pid=3449 execve guuid=71ac9463-1700-0000-0e33-259f7c0d0000 pid=3452 /usr/bin/dash guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=71ac9463-1700-0000-0e33-259f7c0d0000 pid=3452 clone guuid=89c9df65-1700-0000-0e33-259f850d0000 pid=3461 /usr/bin/rm guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=89c9df65-1700-0000-0e33-259f850d0000 pid=3461 execve guuid=9ab23366-1700-0000-0e33-259f870d0000 pid=3463 /usr/bin/wget net send-data write-file guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=9ab23366-1700-0000-0e33-259f870d0000 pid=3463 execve guuid=7cef416b-1700-0000-0e33-259f980d0000 pid=3480 /usr/bin/chmod guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=7cef416b-1700-0000-0e33-259f980d0000 pid=3480 execve guuid=5f82816b-1700-0000-0e33-259f9a0d0000 pid=3482 /usr/bin/dash guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=5f82816b-1700-0000-0e33-259f9a0d0000 pid=3482 clone guuid=f3f4506c-1700-0000-0e33-259f9e0d0000 pid=3486 /usr/bin/rm guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=f3f4506c-1700-0000-0e33-259f9e0d0000 pid=3486 execve guuid=b590a56c-1700-0000-0e33-259fa10d0000 pid=3489 /usr/bin/wget net send-data write-file guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=b590a56c-1700-0000-0e33-259fa10d0000 pid=3489 execve guuid=90d84271-1700-0000-0e33-259faf0d0000 pid=3503 /usr/bin/chmod guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=90d84271-1700-0000-0e33-259faf0d0000 pid=3503 execve guuid=b6e37871-1700-0000-0e33-259fb00d0000 pid=3504 /usr/bin/dash guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=b6e37871-1700-0000-0e33-259fb00d0000 pid=3504 clone guuid=96910e72-1700-0000-0e33-259fb40d0000 pid=3508 /usr/bin/rm guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=96910e72-1700-0000-0e33-259fb40d0000 pid=3508 execve guuid=6edb5f72-1700-0000-0e33-259fb50d0000 pid=3509 /usr/bin/wget net send-data write-file guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=6edb5f72-1700-0000-0e33-259fb50d0000 pid=3509 execve guuid=0d15b676-1700-0000-0e33-259fbe0d0000 pid=3518 /usr/bin/chmod guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=0d15b676-1700-0000-0e33-259fbe0d0000 pid=3518 execve guuid=4fb5f776-1700-0000-0e33-259fbf0d0000 pid=3519 /usr/bin/dash guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=4fb5f776-1700-0000-0e33-259fbf0d0000 pid=3519 clone guuid=52cca877-1700-0000-0e33-259fc10d0000 pid=3521 /usr/bin/rm delete-file guuid=edb22508-1700-0000-0e33-259f800c0000 pid=3200->guuid=52cca877-1700-0000-0e33-259fc10d0000 pid=3521 execve 0b1ba66e-2f8f-542f-9f7c-00dd01da057c 129.121.110.105:80 guuid=fe4d5c56-1700-0000-0e33-259f560d0000 pid=3414->0b1ba66e-2f8f-542f-9f7c-00dd01da057c send: 134B guuid=63a2fc5e-1700-0000-0e33-259f6a0d0000 pid=3434->0b1ba66e-2f8f-542f-9f7c-00dd01da057c send: 133B guuid=9ab23366-1700-0000-0e33-259f870d0000 pid=3463->0b1ba66e-2f8f-542f-9f7c-00dd01da057c send: 133B guuid=b590a56c-1700-0000-0e33-259fa10d0000 pid=3489->0b1ba66e-2f8f-542f-9f7c-00dd01da057c send: 134B guuid=6edb5f72-1700-0000-0e33-259fb50d0000 pid=3509->0b1ba66e-2f8f-542f-9f7c-00dd01da057c send: 133B
Score:
97%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/a6d87ca41c596e3f8a06ce4cc6105cc2e5a133fca49da4d78d16116f298dd931
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a6d87ca41c596e3f8a06ce4cc6105cc2e5a133fca49da4d78d16116f298dd931/
Threat name:
Document-HTML.Trojan.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2026-08-09 19:48:35 UTC
File Type:
Text (Shell)
AV detection:
11 of 24 (45.83%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=u3mhzja4lfxd7cqgzzgmmec4yls2cm74uso2jv4ncyiw6kmn3eyq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
defense_evasion discovery execution linux persistence privilege_escalation
Link:
https://tria.ge/reports/260809-yjb28scb82/
Behaviour
Enumerates kernel/hardware configuration
Reads runtime system information
Writes file to tmp directory
Creates/modifies Cron job
Enumerates running processes
Modifies rc script
Modifies systemd
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.26
Link:
https://yomi.yoroi.company/submissions/a6d87ca41c596e3f8a06ce4cc6105cc2e5a133fca49da4d78d16116f298dd931

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh a6d87ca41c596e3f8a06ce4cc6105cc2e5a133fca49da4d78d16116f298dd931

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3887342/
  
Delivery method
Distributed via web download

Comments