MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a88aa9d6b0dc066a618ee48e4b488a13a007e4e95512b8caa138c85b7d26b710. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a88aa9d6b0dc066a618ee48e4b488a13a007e4e95512b8caa138c85b7d26b710
SHA3-384 hash: d5ccbf453913bb330f45506b68ac16dc7da4c6867ce96b4af8b71da46d14c248bb9b9aa33a5a7d270729198ce7deda04
SHA1 hash: d96f64e62aeaac259e02ab1e8a2f6ed3dd1c2e68
MD5 hash: bb1a55950cc19379d7c1d912097dfa6d
humanhash: high-carbon-november-winner
File name:a88aa9d6b0dc066a618ee48e4b488a13a007e4e95512b8caa138c85b7d26b710
Download: download sample
File size:1'608 bytes
First seen:2026-08-22 19:30:20 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 24:+bCsb1yJopps3TTE/e6e1qtpe7KLcJ2yAt4bbHIj:+bXbsopaUYJ2yRbbHIj
TLSH T184316F9F51201A320402CE4EB7B7750CB68DE1FB2D5FCBD0D8498EAA86586CCF221B59
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter EnthecSolutions
Tags:enthec sh
URLMalware sample (SHA256 hash)SignatureTags
http://5.182.210.174/50e296n/an/an/a
http://5.182.210.174/5628cfn/an/an/a
http://5.182.210.174/d8dd31n/an/an/a
http://5.182.210.174/1b1c6cn/an/an/a
http://5.182.210.174/a8d22en/an/an/a
http://5.182.210.174/89c042n/an/an/a
http://5.182.210.174/d5096en/an/an/a
http://5.182.210.174/f9d820n/an/an/a
http://5.182.210.174/982635n/an/an/a
http://5.182.210.174/70ada6n/an/an/a
http://5.182.210.174/a83071n/an/an/a
http://5.182.210.174/e65081n/an/an/a

Intelligence

File Origin
# of uploads :
1
# of downloads :
48
Origin country :
CA CA
Vendor Threat Intelligence
No detections
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/42caaf50-efbd-4476-977c-3c98be2d862d
Behavior Graph:
Download SVG
%3 guuid=42568f90-1900-0000-618f-dc942d0c0000 pid=3117 /usr/bin/sudo guuid=661aa295-1900-0000-618f-dc94330c0000 pid=3123 /tmp/sample.bin guuid=42568f90-1900-0000-618f-dc942d0c0000 pid=3117->guuid=661aa295-1900-0000-618f-dc94330c0000 pid=3123 execve guuid=0f870f98-1900-0000-618f-dc94360c0000 pid=3126 /usr/bin/wget net send-data guuid=661aa295-1900-0000-618f-dc94330c0000 pid=3123->guuid=0f870f98-1900-0000-618f-dc94360c0000 pid=3126 execve guuid=3454f9a6-1900-0000-618f-dc94410c0000 pid=3137 /usr/bin/curl net send-data write-file guuid=661aa295-1900-0000-618f-dc94330c0000 pid=3123->guuid=3454f9a6-1900-0000-618f-dc94410c0000 pid=3137 execve guuid=b81d78bd-1900-0000-618f-dc944e0c0000 pid=3150 /usr/bin/chmod guuid=661aa295-1900-0000-618f-dc94330c0000 pid=3123->guuid=b81d78bd-1900-0000-618f-dc944e0c0000 pid=3150 execve guuid=8042ecbd-1900-0000-618f-dc944f0c0000 pid=3151 /usr/bin/bash guuid=661aa295-1900-0000-618f-dc94330c0000 pid=3123->guuid=8042ecbd-1900-0000-618f-dc944f0c0000 pid=3151 clone guuid=96a53ebe-1900-0000-618f-dc94510c0000 pid=3153 /usr/bin/rm delete-file guuid=661aa295-1900-0000-618f-dc94330c0000 pid=3123->guuid=96a53ebe-1900-0000-618f-dc94510c0000 pid=3153 execve guuid=242cabbe-1900-0000-618f-dc94520c0000 pid=3154 /usr/bin/rm guuid=661aa295-1900-0000-618f-dc94330c0000 pid=3123->guuid=242cabbe-1900-0000-618f-dc94520c0000 pid=3154 execve guuid=e8ff23bf-1900-0000-618f-dc94540c0000 pid=3156 /usr/bin/wget net send-data guuid=661aa295-1900-0000-618f-dc94330c0000 pid=3123->guuid=e8ff23bf-1900-0000-618f-dc94540c0000 pid=3156 execve guuid=0c11bfc5-1900-0000-618f-dc945b0c0000 pid=3163 /usr/bin/curl net send-data write-file guuid=661aa295-1900-0000-618f-dc94330c0000 pid=3123->guuid=0c11bfc5-1900-0000-618f-dc945b0c0000 pid=3163 execve guuid=4ca201cc-1900-0000-618f-dc94670c0000 pid=3175 /usr/bin/chmod guuid=661aa295-1900-0000-618f-dc94330c0000 pid=3123->guuid=4ca201cc-1900-0000-618f-dc94670c0000 pid=3175 execve guuid=c8626dcc-1900-0000-618f-dc94690c0000 pid=3177 /usr/bin/bash guuid=661aa295-1900-0000-618f-dc94330c0000 pid=3123->guuid=c8626dcc-1900-0000-618f-dc94690c0000 pid=3177 clone guuid=e6b5c4cc-1900-0000-618f-dc946c0c0000 pid=3180 /usr/bin/rm delete-file guuid=661aa295-1900-0000-618f-dc94330c0000 pid=3123->guuid=e6b5c4cc-1900-0000-618f-dc946c0c0000 pid=3180 execve guuid=04502acd-1900-0000-618f-dc946e0c0000 pid=3182 /usr/bin/rm guuid=661aa295-1900-0000-618f-dc94330c0000 pid=3123->guuid=04502acd-1900-0000-618f-dc946e0c0000 pid=3182 execve guuid=097b96cd-1900-0000-618f-dc94700c0000 pid=3184 /usr/bin/wget net send-data guuid=661aa295-1900-0000-618f-dc94330c0000 pid=3123->guuid=097b96cd-1900-0000-618f-dc94700c0000 pid=3184 execve guuid=31e839d2-1900-0000-618f-dc94760c0000 pid=3190 /usr/bin/curl net send-data write-file guuid=661aa295-1900-0000-618f-dc94330c0000 pid=3123->guuid=31e839d2-1900-0000-618f-dc94760c0000 pid=3190 execve guuid=b8f158d8-1900-0000-618f-dc947e0c0000 pid=3198 /usr/bin/chmod guuid=661aa295-1900-0000-618f-dc94330c0000 pid=3123->guuid=b8f158d8-1900-0000-618f-dc947e0c0000 pid=3198 execve guuid=eb2fd3d8-1900-0000-618f-dc947f0c0000 pid=3199 /usr/bin/bash guuid=661aa295-1900-0000-618f-dc94330c0000 pid=3123->guuid=eb2fd3d8-1900-0000-618f-dc947f0c0000 pid=3199 clone guuid=f15840d9-1900-0000-618f-dc94810c0000 pid=3201 /usr/bin/rm delete-file guuid=661aa295-1900-0000-618f-dc94330c0000 pid=3123->guuid=f15840d9-1900-0000-618f-dc94810c0000 pid=3201 execve guuid=dca5b8d9-1900-0000-618f-dc94820c0000 pid=3202 /usr/bin/rm guuid=661aa295-1900-0000-618f-dc94330c0000 pid=3123->guuid=dca5b8d9-1900-0000-618f-dc94820c0000 pid=3202 execve guuid=f35135da-1900-0000-618f-dc94830c0000 pid=3203 /usr/bin/wget net send-data guuid=661aa295-1900-0000-618f-dc94330c0000 pid=3123->guuid=f35135da-1900-0000-618f-dc94830c0000 pid=3203 execve guuid=54a223dd-1900-0000-618f-dc948b0c0000 pid=3211 /usr/bin/curl net send-data write-file guuid=661aa295-1900-0000-618f-dc94330c0000 pid=3123->guuid=54a223dd-1900-0000-618f-dc948b0c0000 pid=3211 execve guuid=f3f232e3-1900-0000-618f-dc94980c0000 pid=3224 /usr/bin/chmod guuid=661aa295-1900-0000-618f-dc94330c0000 pid=3123->guuid=f3f232e3-1900-0000-618f-dc94980c0000 pid=3224 execve guuid=9dc488e3-1900-0000-618f-dc949a0c0000 pid=3226 /usr/bin/bash guuid=661aa295-1900-0000-618f-dc94330c0000 pid=3123->guuid=9dc488e3-1900-0000-618f-dc949a0c0000 pid=3226 clone guuid=a1a1d3e3-1900-0000-618f-dc949d0c0000 pid=3229 /usr/bin/rm delete-file guuid=661aa295-1900-0000-618f-dc94330c0000 pid=3123->guuid=a1a1d3e3-1900-0000-618f-dc949d0c0000 pid=3229 execve guuid=7b941ce4-1900-0000-618f-dc949e0c0000 pid=3230 /usr/bin/rm guuid=661aa295-1900-0000-618f-dc94330c0000 pid=3123->guuid=7b941ce4-1900-0000-618f-dc949e0c0000 pid=3230 execve guuid=dfab81e4-1900-0000-618f-dc94a00c0000 pid=3232 /usr/bin/wget net send-data guuid=661aa295-1900-0000-618f-dc94330c0000 pid=3123->guuid=dfab81e4-1900-0000-618f-dc94a00c0000 pid=3232 execve guuid=d7bc8be7-1900-0000-618f-dc94a40c0000 pid=3236 /usr/bin/curl net send-data write-file guuid=661aa295-1900-0000-618f-dc94330c0000 pid=3123->guuid=d7bc8be7-1900-0000-618f-dc94a40c0000 pid=3236 execve guuid=d14ff6ec-1900-0000-618f-dc94a50c0000 pid=3237 /usr/bin/chmod guuid=661aa295-1900-0000-618f-dc94330c0000 pid=3123->guuid=d14ff6ec-1900-0000-618f-dc94a50c0000 pid=3237 execve guuid=ebbb49ed-1900-0000-618f-dc94a60c0000 pid=3238 /usr/bin/bash guuid=661aa295-1900-0000-618f-dc94330c0000 pid=3123->guuid=ebbb49ed-1900-0000-618f-dc94a60c0000 pid=3238 clone guuid=e3acb7ed-1900-0000-618f-dc94a80c0000 pid=3240 /usr/bin/rm delete-file guuid=661aa295-1900-0000-618f-dc94330c0000 pid=3123->guuid=e3acb7ed-1900-0000-618f-dc94a80c0000 pid=3240 execve guuid=e6b03aee-1900-0000-618f-dc94a90c0000 pid=3241 /usr/bin/rm guuid=661aa295-1900-0000-618f-dc94330c0000 pid=3123->guuid=e6b03aee-1900-0000-618f-dc94a90c0000 pid=3241 execve guuid=f3b9c3ee-1900-0000-618f-dc94aa0c0000 pid=3242 /usr/bin/wget net send-data guuid=661aa295-1900-0000-618f-dc94330c0000 pid=3123->guuid=f3b9c3ee-1900-0000-618f-dc94aa0c0000 pid=3242 execve guuid=53d809f2-1900-0000-618f-dc94ae0c0000 pid=3246 /usr/bin/curl net send-data write-file guuid=661aa295-1900-0000-618f-dc94330c0000 pid=3123->guuid=53d809f2-1900-0000-618f-dc94ae0c0000 pid=3246 execve guuid=21eda6fa-1900-0000-618f-dc94be0c0000 pid=3262 /usr/bin/chmod guuid=661aa295-1900-0000-618f-dc94330c0000 pid=3123->guuid=21eda6fa-1900-0000-618f-dc94be0c0000 pid=3262 execve guuid=885b2efb-1900-0000-618f-dc94bf0c0000 pid=3263 /usr/bin/bash guuid=661aa295-1900-0000-618f-dc94330c0000 pid=3123->guuid=885b2efb-1900-0000-618f-dc94bf0c0000 pid=3263 clone guuid=4d3d14fc-1900-0000-618f-dc94c20c0000 pid=3266 /usr/bin/rm delete-file guuid=661aa295-1900-0000-618f-dc94330c0000 pid=3123->guuid=4d3d14fc-1900-0000-618f-dc94c20c0000 pid=3266 execve guuid=eb38f1fc-1900-0000-618f-dc94c40c0000 pid=3268 /usr/bin/rm guuid=661aa295-1900-0000-618f-dc94330c0000 pid=3123->guuid=eb38f1fc-1900-0000-618f-dc94c40c0000 pid=3268 execve guuid=5d5256fd-1900-0000-618f-dc94c60c0000 pid=3270 /usr/bin/wget net send-data guuid=661aa295-1900-0000-618f-dc94330c0000 pid=3123->guuid=5d5256fd-1900-0000-618f-dc94c60c0000 pid=3270 execve guuid=3615a200-1a00-0000-618f-dc94cc0c0000 pid=3276 /usr/bin/curl net send-data write-file guuid=661aa295-1900-0000-618f-dc94330c0000 pid=3123->guuid=3615a200-1a00-0000-618f-dc94cc0c0000 pid=3276 execve guuid=30b55006-1a00-0000-618f-dc94d50c0000 pid=3285 /usr/bin/chmod guuid=661aa295-1900-0000-618f-dc94330c0000 pid=3123->guuid=30b55006-1a00-0000-618f-dc94d50c0000 pid=3285 execve guuid=b2e1cf06-1a00-0000-618f-dc94d60c0000 pid=3286 /usr/bin/bash guuid=661aa295-1900-0000-618f-dc94330c0000 pid=3123->guuid=b2e1cf06-1a00-0000-618f-dc94d60c0000 pid=3286 clone guuid=7dacb407-1a00-0000-618f-dc94d90c0000 pid=3289 /usr/bin/rm delete-file guuid=661aa295-1900-0000-618f-dc94330c0000 pid=3123->guuid=7dacb407-1a00-0000-618f-dc94d90c0000 pid=3289 execve guuid=61863b08-1a00-0000-618f-dc94db0c0000 pid=3291 /usr/bin/rm guuid=661aa295-1900-0000-618f-dc94330c0000 pid=3123->guuid=61863b08-1a00-0000-618f-dc94db0c0000 pid=3291 execve guuid=4ff3b308-1a00-0000-618f-dc94dc0c0000 pid=3292 /usr/bin/wget net send-data guuid=661aa295-1900-0000-618f-dc94330c0000 pid=3123->guuid=4ff3b308-1a00-0000-618f-dc94dc0c0000 pid=3292 execve guuid=e042080e-1a00-0000-618f-dc94e50c0000 pid=3301 /usr/bin/curl net send-data write-file guuid=661aa295-1900-0000-618f-dc94330c0000 pid=3123->guuid=e042080e-1a00-0000-618f-dc94e50c0000 pid=3301 execve guuid=baa1fe12-1a00-0000-618f-dc94e90c0000 pid=3305 /usr/bin/chmod guuid=661aa295-1900-0000-618f-dc94330c0000 pid=3123->guuid=baa1fe12-1a00-0000-618f-dc94e90c0000 pid=3305 execve guuid=81b14713-1a00-0000-618f-dc94eb0c0000 pid=3307 /usr/bin/bash guuid=661aa295-1900-0000-618f-dc94330c0000 pid=3123->guuid=81b14713-1a00-0000-618f-dc94eb0c0000 pid=3307 clone guuid=f1ba8413-1a00-0000-618f-dc94ed0c0000 pid=3309 /usr/bin/rm delete-file guuid=661aa295-1900-0000-618f-dc94330c0000 pid=3123->guuid=f1ba8413-1a00-0000-618f-dc94ed0c0000 pid=3309 execve guuid=64d5ca13-1a00-0000-618f-dc94ef0c0000 pid=3311 /usr/bin/rm guuid=661aa295-1900-0000-618f-dc94330c0000 pid=3123->guuid=64d5ca13-1a00-0000-618f-dc94ef0c0000 pid=3311 execve guuid=49da0d14-1a00-0000-618f-dc94f00c0000 pid=3312 /usr/bin/wget net send-data guuid=661aa295-1900-0000-618f-dc94330c0000 pid=3123->guuid=49da0d14-1a00-0000-618f-dc94f00c0000 pid=3312 execve guuid=65a3b116-1a00-0000-618f-dc94f80c0000 pid=3320 /usr/bin/curl net send-data write-file guuid=661aa295-1900-0000-618f-dc94330c0000 pid=3123->guuid=65a3b116-1a00-0000-618f-dc94f80c0000 pid=3320 execve guuid=39bfa41b-1a00-0000-618f-dc94010d0000 pid=3329 /usr/bin/chmod guuid=661aa295-1900-0000-618f-dc94330c0000 pid=3123->guuid=39bfa41b-1a00-0000-618f-dc94010d0000 pid=3329 execve guuid=2886161c-1a00-0000-618f-dc94030d0000 pid=3331 /usr/bin/bash guuid=661aa295-1900-0000-618f-dc94330c0000 pid=3123->guuid=2886161c-1a00-0000-618f-dc94030d0000 pid=3331 clone guuid=20c9541c-1a00-0000-618f-dc94060d0000 pid=3334 /usr/bin/rm delete-file guuid=661aa295-1900-0000-618f-dc94330c0000 pid=3123->guuid=20c9541c-1a00-0000-618f-dc94060d0000 pid=3334 execve guuid=e236ad1c-1a00-0000-618f-dc94080d0000 pid=3336 /usr/bin/rm guuid=661aa295-1900-0000-618f-dc94330c0000 pid=3123->guuid=e236ad1c-1a00-0000-618f-dc94080d0000 pid=3336 execve guuid=e3ef011d-1a00-0000-618f-dc940a0d0000 pid=3338 /usr/bin/wget net send-data guuid=661aa295-1900-0000-618f-dc94330c0000 pid=3123->guuid=e3ef011d-1a00-0000-618f-dc940a0d0000 pid=3338 execve guuid=c72ea520-1a00-0000-618f-dc94130d0000 pid=3347 /usr/bin/curl net send-data write-file guuid=661aa295-1900-0000-618f-dc94330c0000 pid=3123->guuid=c72ea520-1a00-0000-618f-dc94130d0000 pid=3347 execve guuid=d3d3942b-1a00-0000-618f-dc942e0d0000 pid=3374 /usr/bin/chmod guuid=661aa295-1900-0000-618f-dc94330c0000 pid=3123->guuid=d3d3942b-1a00-0000-618f-dc942e0d0000 pid=3374 execve guuid=307e772c-1a00-0000-618f-dc94310d0000 pid=3377 /usr/bin/bash guuid=661aa295-1900-0000-618f-dc94330c0000 pid=3123->guuid=307e772c-1a00-0000-618f-dc94310d0000 pid=3377 clone guuid=15d8102d-1a00-0000-618f-dc94340d0000 pid=3380 /usr/bin/rm delete-file guuid=661aa295-1900-0000-618f-dc94330c0000 pid=3123->guuid=15d8102d-1a00-0000-618f-dc94340d0000 pid=3380 execve guuid=6bf2072e-1a00-0000-618f-dc94380d0000 pid=3384 /usr/bin/rm guuid=661aa295-1900-0000-618f-dc94330c0000 pid=3123->guuid=6bf2072e-1a00-0000-618f-dc94380d0000 pid=3384 execve guuid=a037bf2e-1a00-0000-618f-dc943a0d0000 pid=3386 /usr/bin/wget net send-data guuid=661aa295-1900-0000-618f-dc94330c0000 pid=3123->guuid=a037bf2e-1a00-0000-618f-dc943a0d0000 pid=3386 execve guuid=cf978133-1a00-0000-618f-dc94460d0000 pid=3398 /usr/bin/curl net send-data write-file guuid=661aa295-1900-0000-618f-dc94330c0000 pid=3123->guuid=cf978133-1a00-0000-618f-dc94460d0000 pid=3398 execve guuid=b5577c38-1a00-0000-618f-dc94540d0000 pid=3412 /usr/bin/chmod guuid=661aa295-1900-0000-618f-dc94330c0000 pid=3123->guuid=b5577c38-1a00-0000-618f-dc94540d0000 pid=3412 execve guuid=d44cdd38-1a00-0000-618f-dc94570d0000 pid=3415 /usr/bin/bash guuid=661aa295-1900-0000-618f-dc94330c0000 pid=3123->guuid=d44cdd38-1a00-0000-618f-dc94570d0000 pid=3415 clone guuid=1a8f2139-1a00-0000-618f-dc94590d0000 pid=3417 /usr/bin/rm delete-file guuid=661aa295-1900-0000-618f-dc94330c0000 pid=3123->guuid=1a8f2139-1a00-0000-618f-dc94590d0000 pid=3417 execve guuid=152fc439-1a00-0000-618f-dc945c0d0000 pid=3420 /usr/bin/rm guuid=661aa295-1900-0000-618f-dc94330c0000 pid=3123->guuid=152fc439-1a00-0000-618f-dc945c0d0000 pid=3420 execve guuid=8ad80a3a-1a00-0000-618f-dc945e0d0000 pid=3422 /usr/bin/wget net send-data guuid=661aa295-1900-0000-618f-dc94330c0000 pid=3123->guuid=8ad80a3a-1a00-0000-618f-dc945e0d0000 pid=3422 execve guuid=851aac3c-1a00-0000-618f-dc94670d0000 pid=3431 /usr/bin/curl net send-data write-file guuid=661aa295-1900-0000-618f-dc94330c0000 pid=3123->guuid=851aac3c-1a00-0000-618f-dc94670d0000 pid=3431 execve guuid=abb3c441-1a00-0000-618f-dc94730d0000 pid=3443 /usr/bin/chmod guuid=661aa295-1900-0000-618f-dc94330c0000 pid=3123->guuid=abb3c441-1a00-0000-618f-dc94730d0000 pid=3443 execve guuid=a3e41342-1a00-0000-618f-dc94740d0000 pid=3444 /usr/bin/bash guuid=661aa295-1900-0000-618f-dc94330c0000 pid=3123->guuid=a3e41342-1a00-0000-618f-dc94740d0000 pid=3444 clone guuid=ec004a42-1a00-0000-618f-dc94770d0000 pid=3447 /usr/bin/rm delete-file guuid=661aa295-1900-0000-618f-dc94330c0000 pid=3123->guuid=ec004a42-1a00-0000-618f-dc94770d0000 pid=3447 execve guuid=73078542-1a00-0000-618f-dc94790d0000 pid=3449 /usr/bin/rm guuid=661aa295-1900-0000-618f-dc94330c0000 pid=3123->guuid=73078542-1a00-0000-618f-dc94790d0000 pid=3449 execve 5b654972-c9e1-50d8-b372-2dc2a5b9ad66 5.182.210.174:80 guuid=0f870f98-1900-0000-618f-dc94360c0000 pid=3126->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=3454f9a6-1900-0000-618f-dc94410c0000 pid=3137->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=de8d0dbe-1900-0000-618f-dc94500c0000 pid=3152 /usr/bin/bash guuid=8042ecbd-1900-0000-618f-dc944f0c0000 pid=3151->guuid=de8d0dbe-1900-0000-618f-dc94500c0000 pid=3152 clone guuid=e8ff23bf-1900-0000-618f-dc94540c0000 pid=3156->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=0c11bfc5-1900-0000-618f-dc945b0c0000 pid=3163->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=993793cc-1900-0000-618f-dc946a0c0000 pid=3178 /usr/bin/bash guuid=c8626dcc-1900-0000-618f-dc94690c0000 pid=3177->guuid=993793cc-1900-0000-618f-dc946a0c0000 pid=3178 clone guuid=097b96cd-1900-0000-618f-dc94700c0000 pid=3184->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=31e839d2-1900-0000-618f-dc94760c0000 pid=3190->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=a20807d9-1900-0000-618f-dc94800c0000 pid=3200 /usr/bin/bash guuid=eb2fd3d8-1900-0000-618f-dc947f0c0000 pid=3199->guuid=a20807d9-1900-0000-618f-dc94800c0000 pid=3200 clone guuid=f35135da-1900-0000-618f-dc94830c0000 pid=3203->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=54a223dd-1900-0000-618f-dc948b0c0000 pid=3211->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=7b71aae3-1900-0000-618f-dc949b0c0000 pid=3227 /usr/bin/bash guuid=9dc488e3-1900-0000-618f-dc949a0c0000 pid=3226->guuid=7b71aae3-1900-0000-618f-dc949b0c0000 pid=3227 clone guuid=dfab81e4-1900-0000-618f-dc94a00c0000 pid=3232->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=d7bc8be7-1900-0000-618f-dc94a40c0000 pid=3236->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=c0bc6eed-1900-0000-618f-dc94a70c0000 pid=3239 /usr/bin/bash guuid=ebbb49ed-1900-0000-618f-dc94a60c0000 pid=3238->guuid=c0bc6eed-1900-0000-618f-dc94a70c0000 pid=3239 clone guuid=f3b9c3ee-1900-0000-618f-dc94aa0c0000 pid=3242->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=53d809f2-1900-0000-618f-dc94ae0c0000 pid=3246->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=76258dfb-1900-0000-618f-dc94c00c0000 pid=3264 /usr/bin/bash guuid=885b2efb-1900-0000-618f-dc94bf0c0000 pid=3263->guuid=76258dfb-1900-0000-618f-dc94c00c0000 pid=3264 clone guuid=5d5256fd-1900-0000-618f-dc94c60c0000 pid=3270->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=3615a200-1a00-0000-618f-dc94cc0c0000 pid=3276->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=ca874e07-1a00-0000-618f-dc94d70c0000 pid=3287 /usr/bin/bash guuid=b2e1cf06-1a00-0000-618f-dc94d60c0000 pid=3286->guuid=ca874e07-1a00-0000-618f-dc94d70c0000 pid=3287 clone guuid=4ff3b308-1a00-0000-618f-dc94dc0c0000 pid=3292->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=e042080e-1a00-0000-618f-dc94e50c0000 pid=3301->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=ae105d13-1a00-0000-618f-dc94ec0c0000 pid=3308 /usr/bin/bash guuid=81b14713-1a00-0000-618f-dc94eb0c0000 pid=3307->guuid=ae105d13-1a00-0000-618f-dc94ec0c0000 pid=3308 clone guuid=49da0d14-1a00-0000-618f-dc94f00c0000 pid=3312->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=65a3b116-1a00-0000-618f-dc94f80c0000 pid=3320->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=d81d311c-1a00-0000-618f-dc94050d0000 pid=3333 /usr/bin/bash guuid=2886161c-1a00-0000-618f-dc94030d0000 pid=3331->guuid=d81d311c-1a00-0000-618f-dc94050d0000 pid=3333 clone guuid=e3ef011d-1a00-0000-618f-dc940a0d0000 pid=3338->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=c72ea520-1a00-0000-618f-dc94130d0000 pid=3347->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=9e7db22c-1a00-0000-618f-dc94320d0000 pid=3378 /usr/bin/bash guuid=307e772c-1a00-0000-618f-dc94310d0000 pid=3377->guuid=9e7db22c-1a00-0000-618f-dc94320d0000 pid=3378 clone guuid=a037bf2e-1a00-0000-618f-dc943a0d0000 pid=3386->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=cf978133-1a00-0000-618f-dc94460d0000 pid=3398->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=8ad5f638-1a00-0000-618f-dc94580d0000 pid=3416 /usr/bin/bash guuid=d44cdd38-1a00-0000-618f-dc94570d0000 pid=3415->guuid=8ad5f638-1a00-0000-618f-dc94580d0000 pid=3416 clone guuid=8ad80a3a-1a00-0000-618f-dc945e0d0000 pid=3422->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=851aac3c-1a00-0000-618f-dc94670d0000 pid=3431->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=9b382c42-1a00-0000-618f-dc94760d0000 pid=3446 /usr/bin/bash guuid=a3e41342-1a00-0000-618f-dc94740d0000 pid=3444->guuid=9b382c42-1a00-0000-618f-dc94760d0000 pid=3446 clone
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/a88aa9d6b0dc066a618ee48e4b488a13a007e4e95512b8caa138c85b7d26b710
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a88aa9d6b0dc066a618ee48e4b488a13a007e4e95512b8caa138c85b7d26b710/
Threat name:
Linux.Trojan.Egairtigado
Create hunting rule
Status:
Malicious
First seen:
2026-08-20 23:44:14 UTC
File Type:
Text (Shell)
AV detection:
14 of 24 (58.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vcfktvvq3qdguymo4shewsekcoqapzhjkujlrsvbhdefw7jgw4ia._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260822-x8hqmsydjb/
Behaviour
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.11
Link:
https://yomi.yoroi.company/submissions/a88aa9d6b0dc066a618ee48e4b488a13a007e4e95512b8caa138c85b7d26b710

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments