MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a95ea59943cdc97693ea9b9d54e722cc617dc2a577a7b82b352a664b8d1bfdbf. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a95ea59943cdc97693ea9b9d54e722cc617dc2a577a7b82b352a664b8d1bfdbf
SHA3-384 hash: dc14038c05e09c656c660fdbfe57ce1c379a07569c31821799384dfb02b8721876eb17b9b4551df0618b256b6c602fbe
SHA1 hash: fa0047030f69e2cf26b25412a7692eea18b45b55
MD5 hash: 367fd98d3260db966e7d09a02fb9a00a
humanhash: wyoming-carpet-east-undress
File name:ok
Download: download sample
File size:1'608 bytes
First seen:2026-08-29 08:50:15 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 24:71vU1XaL/tvrvILq+MhOosJMGhIOF8mjBa4Ftx/hxv:71vU+TZpOosKUF8WBnD
TLSH T133316BDF0410AA325103C98E77B33548728EA5F72CAFD6E5C8488EAA92496CCF165F5D
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://5.182.210.174/825812n/an/an/a
http://5.182.210.174/884fffn/an/an/a
http://5.182.210.174/d2c0a1n/an/an/a
http://5.182.210.174/a8d8acn/an/an/a
http://5.182.210.174/b9fa16n/an/an/a
http://5.182.210.174/c9e029n/an/an/a
http://5.182.210.174/85b8d4n/an/an/a
http://5.182.210.174/5a6de3n/an/an/a
http://5.182.210.174/21442dn/an/an/a
http://5.182.210.174/6078ecn/an/an/a
http://5.182.210.174/540356n/an/an/a
http://5.182.210.174/e1022an/an/an/a

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive mirai
Link:
https://www.filescan.io/uploads/6a929d48eafd7dd402a6f3cd/reports/28947dcd-95b3-4b82-bd61-7242417b4c97/overview
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/d6dbfd8e-2921-4a90-8d89-27a785c0288a
Behavior Graph:
Download SVG
%3 guuid=e0c098e3-1500-0000-9a11-28f5b00c0000 pid=3248 /usr/bin/sudo guuid=430a6ce5-1500-0000-9a11-28f5b30c0000 pid=3251 /tmp/sample.bin guuid=e0c098e3-1500-0000-9a11-28f5b00c0000 pid=3248->guuid=430a6ce5-1500-0000-9a11-28f5b30c0000 pid=3251 execve guuid=3ce9e0e5-1500-0000-9a11-28f5b50c0000 pid=3253 /usr/bin/wget net send-data guuid=430a6ce5-1500-0000-9a11-28f5b30c0000 pid=3251->guuid=3ce9e0e5-1500-0000-9a11-28f5b50c0000 pid=3253 execve guuid=3970b4eb-1500-0000-9a11-28f5c60c0000 pid=3270 /usr/bin/curl net send-data write-file guuid=430a6ce5-1500-0000-9a11-28f5b30c0000 pid=3251->guuid=3970b4eb-1500-0000-9a11-28f5c60c0000 pid=3270 execve guuid=37e17bf3-1500-0000-9a11-28f5d70c0000 pid=3287 /usr/bin/chmod guuid=430a6ce5-1500-0000-9a11-28f5b30c0000 pid=3251->guuid=37e17bf3-1500-0000-9a11-28f5d70c0000 pid=3287 execve guuid=be900df4-1500-0000-9a11-28f5d90c0000 pid=3289 /usr/bin/bash guuid=430a6ce5-1500-0000-9a11-28f5b30c0000 pid=3251->guuid=be900df4-1500-0000-9a11-28f5d90c0000 pid=3289 clone guuid=413d7ff4-1500-0000-9a11-28f5dc0c0000 pid=3292 /usr/bin/rm delete-file guuid=430a6ce5-1500-0000-9a11-28f5b30c0000 pid=3251->guuid=413d7ff4-1500-0000-9a11-28f5dc0c0000 pid=3292 execve guuid=d033f5f4-1500-0000-9a11-28f5de0c0000 pid=3294 /usr/bin/rm guuid=430a6ce5-1500-0000-9a11-28f5b30c0000 pid=3251->guuid=d033f5f4-1500-0000-9a11-28f5de0c0000 pid=3294 execve guuid=a64a5ef5-1500-0000-9a11-28f5e00c0000 pid=3296 /usr/bin/wget net send-data guuid=430a6ce5-1500-0000-9a11-28f5b30c0000 pid=3251->guuid=a64a5ef5-1500-0000-9a11-28f5e00c0000 pid=3296 execve guuid=66f1a3f9-1500-0000-9a11-28f5ee0c0000 pid=3310 /usr/bin/curl net send-data write-file guuid=430a6ce5-1500-0000-9a11-28f5b30c0000 pid=3251->guuid=66f1a3f9-1500-0000-9a11-28f5ee0c0000 pid=3310 execve guuid=8967eafe-1500-0000-9a11-28f5fa0c0000 pid=3322 /usr/bin/chmod guuid=430a6ce5-1500-0000-9a11-28f5b30c0000 pid=3251->guuid=8967eafe-1500-0000-9a11-28f5fa0c0000 pid=3322 execve guuid=5ee24bff-1500-0000-9a11-28f5fc0c0000 pid=3324 /usr/bin/bash guuid=430a6ce5-1500-0000-9a11-28f5b30c0000 pid=3251->guuid=5ee24bff-1500-0000-9a11-28f5fc0c0000 pid=3324 clone guuid=709994ff-1500-0000-9a11-28f5ff0c0000 pid=3327 /usr/bin/rm delete-file guuid=430a6ce5-1500-0000-9a11-28f5b30c0000 pid=3251->guuid=709994ff-1500-0000-9a11-28f5ff0c0000 pid=3327 execve guuid=b743e4ff-1500-0000-9a11-28f5000d0000 pid=3328 /usr/bin/rm guuid=430a6ce5-1500-0000-9a11-28f5b30c0000 pid=3251->guuid=b743e4ff-1500-0000-9a11-28f5000d0000 pid=3328 execve guuid=622e2e00-1600-0000-9a11-28f5020d0000 pid=3330 /usr/bin/wget net send-data guuid=430a6ce5-1500-0000-9a11-28f5b30c0000 pid=3251->guuid=622e2e00-1600-0000-9a11-28f5020d0000 pid=3330 execve guuid=3bce9e02-1600-0000-9a11-28f50c0d0000 pid=3340 /usr/bin/curl net send-data write-file guuid=430a6ce5-1500-0000-9a11-28f5b30c0000 pid=3251->guuid=3bce9e02-1600-0000-9a11-28f50c0d0000 pid=3340 execve guuid=80f48806-1600-0000-9a11-28f51d0d0000 pid=3357 /usr/bin/chmod guuid=430a6ce5-1500-0000-9a11-28f5b30c0000 pid=3251->guuid=80f48806-1600-0000-9a11-28f51d0d0000 pid=3357 execve guuid=3922c406-1600-0000-9a11-28f51f0d0000 pid=3359 /usr/bin/bash guuid=430a6ce5-1500-0000-9a11-28f5b30c0000 pid=3251->guuid=3922c406-1600-0000-9a11-28f51f0d0000 pid=3359 clone guuid=5b8ff306-1600-0000-9a11-28f5210d0000 pid=3361 /usr/bin/rm delete-file guuid=430a6ce5-1500-0000-9a11-28f5b30c0000 pid=3251->guuid=5b8ff306-1600-0000-9a11-28f5210d0000 pid=3361 execve guuid=c1293407-1600-0000-9a11-28f5230d0000 pid=3363 /usr/bin/rm guuid=430a6ce5-1500-0000-9a11-28f5b30c0000 pid=3251->guuid=c1293407-1600-0000-9a11-28f5230d0000 pid=3363 execve guuid=48917407-1600-0000-9a11-28f5250d0000 pid=3365 /usr/bin/wget net send-data guuid=430a6ce5-1500-0000-9a11-28f5b30c0000 pid=3251->guuid=48917407-1600-0000-9a11-28f5250d0000 pid=3365 execve guuid=08dace09-1600-0000-9a11-28f52f0d0000 pid=3375 /usr/bin/curl net send-data write-file guuid=430a6ce5-1500-0000-9a11-28f5b30c0000 pid=3251->guuid=08dace09-1600-0000-9a11-28f52f0d0000 pid=3375 execve guuid=4fba5b10-1600-0000-9a11-28f5400d0000 pid=3392 /usr/bin/chmod guuid=430a6ce5-1500-0000-9a11-28f5b30c0000 pid=3251->guuid=4fba5b10-1600-0000-9a11-28f5400d0000 pid=3392 execve guuid=3a119a10-1600-0000-9a11-28f5410d0000 pid=3393 /usr/bin/bash guuid=430a6ce5-1500-0000-9a11-28f5b30c0000 pid=3251->guuid=3a119a10-1600-0000-9a11-28f5410d0000 pid=3393 clone guuid=51c5d210-1600-0000-9a11-28f5430d0000 pid=3395 /usr/bin/rm delete-file guuid=430a6ce5-1500-0000-9a11-28f5b30c0000 pid=3251->guuid=51c5d210-1600-0000-9a11-28f5430d0000 pid=3395 execve guuid=46471011-1600-0000-9a11-28f5440d0000 pid=3396 /usr/bin/rm guuid=430a6ce5-1500-0000-9a11-28f5b30c0000 pid=3251->guuid=46471011-1600-0000-9a11-28f5440d0000 pid=3396 execve guuid=e5994b11-1600-0000-9a11-28f5450d0000 pid=3397 /usr/bin/wget net send-data guuid=430a6ce5-1500-0000-9a11-28f5b30c0000 pid=3251->guuid=e5994b11-1600-0000-9a11-28f5450d0000 pid=3397 execve guuid=2bbda213-1600-0000-9a11-28f5490d0000 pid=3401 /usr/bin/curl net send-data write-file guuid=430a6ce5-1500-0000-9a11-28f5b30c0000 pid=3251->guuid=2bbda213-1600-0000-9a11-28f5490d0000 pid=3401 execve guuid=51577217-1600-0000-9a11-28f5540d0000 pid=3412 /usr/bin/chmod guuid=430a6ce5-1500-0000-9a11-28f5b30c0000 pid=3251->guuid=51577217-1600-0000-9a11-28f5540d0000 pid=3412 execve guuid=b111dd17-1600-0000-9a11-28f5550d0000 pid=3413 /usr/bin/bash guuid=430a6ce5-1500-0000-9a11-28f5b30c0000 pid=3251->guuid=b111dd17-1600-0000-9a11-28f5550d0000 pid=3413 clone guuid=1a6d3918-1600-0000-9a11-28f5570d0000 pid=3415 /usr/bin/rm delete-file guuid=430a6ce5-1500-0000-9a11-28f5b30c0000 pid=3251->guuid=1a6d3918-1600-0000-9a11-28f5570d0000 pid=3415 execve guuid=41359518-1600-0000-9a11-28f5590d0000 pid=3417 /usr/bin/rm guuid=430a6ce5-1500-0000-9a11-28f5b30c0000 pid=3251->guuid=41359518-1600-0000-9a11-28f5590d0000 pid=3417 execve guuid=ddfef918-1600-0000-9a11-28f55a0d0000 pid=3418 /usr/bin/wget net send-data guuid=430a6ce5-1500-0000-9a11-28f5b30c0000 pid=3251->guuid=ddfef918-1600-0000-9a11-28f55a0d0000 pid=3418 execve guuid=a414c51b-1600-0000-9a11-28f5610d0000 pid=3425 /usr/bin/curl net send-data write-file guuid=430a6ce5-1500-0000-9a11-28f5b30c0000 pid=3251->guuid=a414c51b-1600-0000-9a11-28f5610d0000 pid=3425 execve guuid=de6b6921-1600-0000-9a11-28f5690d0000 pid=3433 /usr/bin/chmod guuid=430a6ce5-1500-0000-9a11-28f5b30c0000 pid=3251->guuid=de6b6921-1600-0000-9a11-28f5690d0000 pid=3433 execve guuid=696cd621-1600-0000-9a11-28f56c0d0000 pid=3436 /usr/bin/bash guuid=430a6ce5-1500-0000-9a11-28f5b30c0000 pid=3251->guuid=696cd621-1600-0000-9a11-28f56c0d0000 pid=3436 clone guuid=b8db3b22-1600-0000-9a11-28f56f0d0000 pid=3439 /usr/bin/rm delete-file guuid=430a6ce5-1500-0000-9a11-28f5b30c0000 pid=3251->guuid=b8db3b22-1600-0000-9a11-28f56f0d0000 pid=3439 execve guuid=8a5ea422-1600-0000-9a11-28f5720d0000 pid=3442 /usr/bin/rm guuid=430a6ce5-1500-0000-9a11-28f5b30c0000 pid=3251->guuid=8a5ea422-1600-0000-9a11-28f5720d0000 pid=3442 execve guuid=d52c1623-1600-0000-9a11-28f5750d0000 pid=3445 /usr/bin/wget net send-data guuid=430a6ce5-1500-0000-9a11-28f5b30c0000 pid=3251->guuid=d52c1623-1600-0000-9a11-28f5750d0000 pid=3445 execve guuid=e6074926-1600-0000-9a11-28f5790d0000 pid=3449 /usr/bin/curl net send-data write-file guuid=430a6ce5-1500-0000-9a11-28f5b30c0000 pid=3251->guuid=e6074926-1600-0000-9a11-28f5790d0000 pid=3449 execve guuid=89a0f12b-1600-0000-9a11-28f5830d0000 pid=3459 /usr/bin/chmod guuid=430a6ce5-1500-0000-9a11-28f5b30c0000 pid=3251->guuid=89a0f12b-1600-0000-9a11-28f5830d0000 pid=3459 execve guuid=f736532c-1600-0000-9a11-28f5860d0000 pid=3462 /usr/bin/bash guuid=430a6ce5-1500-0000-9a11-28f5b30c0000 pid=3251->guuid=f736532c-1600-0000-9a11-28f5860d0000 pid=3462 clone guuid=67589e2c-1600-0000-9a11-28f5890d0000 pid=3465 /usr/bin/rm delete-file guuid=430a6ce5-1500-0000-9a11-28f5b30c0000 pid=3251->guuid=67589e2c-1600-0000-9a11-28f5890d0000 pid=3465 execve guuid=63ee022d-1600-0000-9a11-28f58c0d0000 pid=3468 /usr/bin/rm guuid=430a6ce5-1500-0000-9a11-28f5b30c0000 pid=3251->guuid=63ee022d-1600-0000-9a11-28f58c0d0000 pid=3468 execve guuid=65206b2d-1600-0000-9a11-28f58f0d0000 pid=3471 /usr/bin/wget net send-data guuid=430a6ce5-1500-0000-9a11-28f5b30c0000 pid=3251->guuid=65206b2d-1600-0000-9a11-28f58f0d0000 pid=3471 execve guuid=267b4c30-1600-0000-9a11-28f59b0d0000 pid=3483 /usr/bin/curl net send-data write-file guuid=430a6ce5-1500-0000-9a11-28f5b30c0000 pid=3251->guuid=267b4c30-1600-0000-9a11-28f59b0d0000 pid=3483 execve guuid=84a25c35-1600-0000-9a11-28f5a80d0000 pid=3496 /usr/bin/chmod guuid=430a6ce5-1500-0000-9a11-28f5b30c0000 pid=3251->guuid=84a25c35-1600-0000-9a11-28f5a80d0000 pid=3496 execve guuid=473f9435-1600-0000-9a11-28f5aa0d0000 pid=3498 /usr/bin/bash guuid=430a6ce5-1500-0000-9a11-28f5b30c0000 pid=3251->guuid=473f9435-1600-0000-9a11-28f5aa0d0000 pid=3498 clone guuid=183fc035-1600-0000-9a11-28f5ac0d0000 pid=3500 /usr/bin/rm delete-file guuid=430a6ce5-1500-0000-9a11-28f5b30c0000 pid=3251->guuid=183fc035-1600-0000-9a11-28f5ac0d0000 pid=3500 execve guuid=accafb35-1600-0000-9a11-28f5ad0d0000 pid=3501 /usr/bin/rm guuid=430a6ce5-1500-0000-9a11-28f5b30c0000 pid=3251->guuid=accafb35-1600-0000-9a11-28f5ad0d0000 pid=3501 execve guuid=2baf3536-1600-0000-9a11-28f5af0d0000 pid=3503 /usr/bin/wget net send-data guuid=430a6ce5-1500-0000-9a11-28f5b30c0000 pid=3251->guuid=2baf3536-1600-0000-9a11-28f5af0d0000 pid=3503 execve guuid=fcc6b138-1600-0000-9a11-28f5b80d0000 pid=3512 /usr/bin/curl net send-data write-file guuid=430a6ce5-1500-0000-9a11-28f5b30c0000 pid=3251->guuid=fcc6b138-1600-0000-9a11-28f5b80d0000 pid=3512 execve guuid=f92c633d-1600-0000-9a11-28f5c50d0000 pid=3525 /usr/bin/chmod guuid=430a6ce5-1500-0000-9a11-28f5b30c0000 pid=3251->guuid=f92c633d-1600-0000-9a11-28f5c50d0000 pid=3525 execve guuid=c88fa33d-1600-0000-9a11-28f5c70d0000 pid=3527 /usr/bin/bash guuid=430a6ce5-1500-0000-9a11-28f5b30c0000 pid=3251->guuid=c88fa33d-1600-0000-9a11-28f5c70d0000 pid=3527 clone guuid=9286d43d-1600-0000-9a11-28f5ca0d0000 pid=3530 /usr/bin/rm delete-file guuid=430a6ce5-1500-0000-9a11-28f5b30c0000 pid=3251->guuid=9286d43d-1600-0000-9a11-28f5ca0d0000 pid=3530 execve guuid=e56e0c3e-1600-0000-9a11-28f5cb0d0000 pid=3531 /usr/bin/rm guuid=430a6ce5-1500-0000-9a11-28f5b30c0000 pid=3251->guuid=e56e0c3e-1600-0000-9a11-28f5cb0d0000 pid=3531 execve guuid=5eba473e-1600-0000-9a11-28f5cd0d0000 pid=3533 /usr/bin/wget net send-data guuid=430a6ce5-1500-0000-9a11-28f5b30c0000 pid=3251->guuid=5eba473e-1600-0000-9a11-28f5cd0d0000 pid=3533 execve guuid=c5fae340-1600-0000-9a11-28f5d60d0000 pid=3542 /usr/bin/curl net send-data write-file guuid=430a6ce5-1500-0000-9a11-28f5b30c0000 pid=3251->guuid=c5fae340-1600-0000-9a11-28f5d60d0000 pid=3542 execve guuid=e105ae45-1600-0000-9a11-28f5e10d0000 pid=3553 /usr/bin/chmod guuid=430a6ce5-1500-0000-9a11-28f5b30c0000 pid=3251->guuid=e105ae45-1600-0000-9a11-28f5e10d0000 pid=3553 execve guuid=9fbfea45-1600-0000-9a11-28f5e20d0000 pid=3554 /usr/bin/bash guuid=430a6ce5-1500-0000-9a11-28f5b30c0000 pid=3251->guuid=9fbfea45-1600-0000-9a11-28f5e20d0000 pid=3554 clone guuid=032a2046-1600-0000-9a11-28f5e50d0000 pid=3557 /usr/bin/rm delete-file guuid=430a6ce5-1500-0000-9a11-28f5b30c0000 pid=3251->guuid=032a2046-1600-0000-9a11-28f5e50d0000 pid=3557 execve guuid=b3a66246-1600-0000-9a11-28f5e60d0000 pid=3558 /usr/bin/rm guuid=430a6ce5-1500-0000-9a11-28f5b30c0000 pid=3251->guuid=b3a66246-1600-0000-9a11-28f5e60d0000 pid=3558 execve guuid=d6d4a046-1600-0000-9a11-28f5e80d0000 pid=3560 /usr/bin/wget net send-data guuid=430a6ce5-1500-0000-9a11-28f5b30c0000 pid=3251->guuid=d6d4a046-1600-0000-9a11-28f5e80d0000 pid=3560 execve guuid=1d27c349-1600-0000-9a11-28f5f00d0000 pid=3568 /usr/bin/curl net send-data write-file guuid=430a6ce5-1500-0000-9a11-28f5b30c0000 pid=3251->guuid=1d27c349-1600-0000-9a11-28f5f00d0000 pid=3568 execve guuid=d9df0b4f-1600-0000-9a11-28f5020e0000 pid=3586 /usr/bin/chmod guuid=430a6ce5-1500-0000-9a11-28f5b30c0000 pid=3251->guuid=d9df0b4f-1600-0000-9a11-28f5020e0000 pid=3586 execve guuid=cf6d424f-1600-0000-9a11-28f5030e0000 pid=3587 /usr/bin/bash guuid=430a6ce5-1500-0000-9a11-28f5b30c0000 pid=3251->guuid=cf6d424f-1600-0000-9a11-28f5030e0000 pid=3587 clone guuid=f7a1734f-1600-0000-9a11-28f5050e0000 pid=3589 /usr/bin/rm delete-file guuid=430a6ce5-1500-0000-9a11-28f5b30c0000 pid=3251->guuid=f7a1734f-1600-0000-9a11-28f5050e0000 pid=3589 execve guuid=c727b04f-1600-0000-9a11-28f5060e0000 pid=3590 /usr/bin/rm guuid=430a6ce5-1500-0000-9a11-28f5b30c0000 pid=3251->guuid=c727b04f-1600-0000-9a11-28f5060e0000 pid=3590 execve guuid=038de64f-1600-0000-9a11-28f50a0e0000 pid=3594 /usr/bin/wget net send-data guuid=430a6ce5-1500-0000-9a11-28f5b30c0000 pid=3251->guuid=038de64f-1600-0000-9a11-28f50a0e0000 pid=3594 execve guuid=281e4a52-1600-0000-9a11-28f5130e0000 pid=3603 /usr/bin/curl net send-data write-file guuid=430a6ce5-1500-0000-9a11-28f5b30c0000 pid=3251->guuid=281e4a52-1600-0000-9a11-28f5130e0000 pid=3603 execve guuid=b7625b55-1600-0000-9a11-28f5210e0000 pid=3617 /usr/bin/chmod guuid=430a6ce5-1500-0000-9a11-28f5b30c0000 pid=3251->guuid=b7625b55-1600-0000-9a11-28f5210e0000 pid=3617 execve guuid=fefa9d55-1600-0000-9a11-28f5230e0000 pid=3619 /usr/bin/bash guuid=430a6ce5-1500-0000-9a11-28f5b30c0000 pid=3251->guuid=fefa9d55-1600-0000-9a11-28f5230e0000 pid=3619 clone guuid=25dfdd55-1600-0000-9a11-28f5260e0000 pid=3622 /usr/bin/rm delete-file guuid=430a6ce5-1500-0000-9a11-28f5b30c0000 pid=3251->guuid=25dfdd55-1600-0000-9a11-28f5260e0000 pid=3622 execve guuid=1e001d56-1600-0000-9a11-28f5270e0000 pid=3623 /usr/bin/rm guuid=430a6ce5-1500-0000-9a11-28f5b30c0000 pid=3251->guuid=1e001d56-1600-0000-9a11-28f5270e0000 pid=3623 execve 5b654972-c9e1-50d8-b372-2dc2a5b9ad66 5.182.210.174:80 guuid=3ce9e0e5-1500-0000-9a11-28f5b50c0000 pid=3253->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=3970b4eb-1500-0000-9a11-28f5c60c0000 pid=3270->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=52bc2ef4-1500-0000-9a11-28f5db0c0000 pid=3291 /usr/bin/bash guuid=be900df4-1500-0000-9a11-28f5d90c0000 pid=3289->guuid=52bc2ef4-1500-0000-9a11-28f5db0c0000 pid=3291 clone guuid=a64a5ef5-1500-0000-9a11-28f5e00c0000 pid=3296->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=66f1a3f9-1500-0000-9a11-28f5ee0c0000 pid=3310->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=57a867ff-1500-0000-9a11-28f5fd0c0000 pid=3325 /usr/bin/bash guuid=5ee24bff-1500-0000-9a11-28f5fc0c0000 pid=3324->guuid=57a867ff-1500-0000-9a11-28f5fd0c0000 pid=3325 clone guuid=622e2e00-1600-0000-9a11-28f5020d0000 pid=3330->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=3bce9e02-1600-0000-9a11-28f50c0d0000 pid=3340->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=b913d606-1600-0000-9a11-28f5200d0000 pid=3360 /usr/bin/bash guuid=3922c406-1600-0000-9a11-28f51f0d0000 pid=3359->guuid=b913d606-1600-0000-9a11-28f5200d0000 pid=3360 clone guuid=48917407-1600-0000-9a11-28f5250d0000 pid=3365->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=08dace09-1600-0000-9a11-28f52f0d0000 pid=3375->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=604caf10-1600-0000-9a11-28f5420d0000 pid=3394 /usr/bin/bash guuid=3a119a10-1600-0000-9a11-28f5410d0000 pid=3393->guuid=604caf10-1600-0000-9a11-28f5420d0000 pid=3394 clone guuid=e5994b11-1600-0000-9a11-28f5450d0000 pid=3397->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=2bbda213-1600-0000-9a11-28f5490d0000 pid=3401->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=6b640418-1600-0000-9a11-28f5560d0000 pid=3414 /usr/bin/bash guuid=b111dd17-1600-0000-9a11-28f5550d0000 pid=3413->guuid=6b640418-1600-0000-9a11-28f5560d0000 pid=3414 clone guuid=ddfef918-1600-0000-9a11-28f55a0d0000 pid=3418->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=a414c51b-1600-0000-9a11-28f5610d0000 pid=3425->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=3a84f921-1600-0000-9a11-28f56d0d0000 pid=3437 /usr/bin/bash guuid=696cd621-1600-0000-9a11-28f56c0d0000 pid=3436->guuid=3a84f921-1600-0000-9a11-28f56d0d0000 pid=3437 clone guuid=d52c1623-1600-0000-9a11-28f5750d0000 pid=3445->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=e6074926-1600-0000-9a11-28f5790d0000 pid=3449->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=3727702c-1600-0000-9a11-28f5870d0000 pid=3463 /usr/bin/bash guuid=f736532c-1600-0000-9a11-28f5860d0000 pid=3462->guuid=3727702c-1600-0000-9a11-28f5870d0000 pid=3463 clone guuid=65206b2d-1600-0000-9a11-28f58f0d0000 pid=3471->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=267b4c30-1600-0000-9a11-28f59b0d0000 pid=3483->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=a3baa735-1600-0000-9a11-28f5ab0d0000 pid=3499 /usr/bin/bash guuid=473f9435-1600-0000-9a11-28f5aa0d0000 pid=3498->guuid=a3baa735-1600-0000-9a11-28f5ab0d0000 pid=3499 clone guuid=2baf3536-1600-0000-9a11-28f5af0d0000 pid=3503->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=fcc6b138-1600-0000-9a11-28f5b80d0000 pid=3512->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=53dfb73d-1600-0000-9a11-28f5c80d0000 pid=3528 /usr/bin/bash guuid=c88fa33d-1600-0000-9a11-28f5c70d0000 pid=3527->guuid=53dfb73d-1600-0000-9a11-28f5c80d0000 pid=3528 clone guuid=5eba473e-1600-0000-9a11-28f5cd0d0000 pid=3533->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=c5fae340-1600-0000-9a11-28f5d60d0000 pid=3542->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=dc61ff45-1600-0000-9a11-28f5e30d0000 pid=3555 /usr/bin/bash guuid=9fbfea45-1600-0000-9a11-28f5e20d0000 pid=3554->guuid=dc61ff45-1600-0000-9a11-28f5e30d0000 pid=3555 clone guuid=d6d4a046-1600-0000-9a11-28f5e80d0000 pid=3560->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=1d27c349-1600-0000-9a11-28f5f00d0000 pid=3568->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=13a45a4f-1600-0000-9a11-28f5040e0000 pid=3588 /usr/bin/bash guuid=cf6d424f-1600-0000-9a11-28f5030e0000 pid=3587->guuid=13a45a4f-1600-0000-9a11-28f5040e0000 pid=3588 clone guuid=038de64f-1600-0000-9a11-28f50a0e0000 pid=3594->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=281e4a52-1600-0000-9a11-28f5130e0000 pid=3603->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=2028b555-1600-0000-9a11-28f5240e0000 pid=3620 /usr/bin/bash guuid=fefa9d55-1600-0000-9a11-28f5230e0000 pid=3619->guuid=2028b555-1600-0000-9a11-28f5240e0000 pid=3620 clone
Score:
99%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/a95ea59943cdc97693ea9b9d54e722cc617dc2a577a7b82b352a664b8d1bfdbf
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a95ea59943cdc97693ea9b9d54e722cc617dc2a577a7b82b352a664b8d1bfdbf/
Threat name:
Linux.Downloader.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-08-29 08:51:33 UTC
File Type:
Text (Shell)
AV detection:
12 of 36 (33.33%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vfpklgkdzxexne7ktoovjzzczrqx3qvfo6t3qkzvfjtexdi37w7q._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260829-krp26sxxbz/
Behaviour
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh a95ea59943cdc97693ea9b9d54e722cc617dc2a577a7b82b352a664b8d1bfdbf

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3897671/
  
Delivery method
Distributed via web download

Comments