🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b06f4b22c7828b395c1074c5c3de2fa1c5d380dde916bf21ad0905fc876ed8df. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b06f4b22c7828b395c1074c5c3de2fa1c5d380dde916bf21ad0905fc876ed8df
SHA3-384 hash: f11d15a4d8293e29eb01869929c272901f6684a32d562888eee50255d09263e6219858ff16b39cebd65f33bf3dee48f5
SHA1 hash: 0c2800c16614e8f3e5565eca79de4ee3c5f30560
MD5 hash: 892b565f7000d9c7881426dbcfbbc9c2
humanhash: failed-jupiter-colorado-princess
File name:ok
Download: download sample
File size:1'608 bytes
First seen:2026-09-08 04:41:21 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 12:UK6w0SDy6Dq5xMag6qhvxD36NDzXx6XGotB4TKDa6D8DD861aIGI6IG8ltwGI6wq:a5xM75CsGNJxWZ8ln3aIJhnBagbe2
TLSH T1A6314B8E10246A328003D98EB3B76599668DA5E7389FD7D4D84C4EA9928828CF261B59
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://5.182.210.174/29d22bn/an/an/a
http://5.182.210.174/f1f51fn/an/an/a
http://5.182.210.174/cd0d4fn/an/an/a
http://5.182.210.174/b6d0dbn/an/an/a
http://5.182.210.174/0ce574n/an/an/a
http://5.182.210.174/dcfb4fn/an/an/a
http://5.182.210.174/da22b0n/an/an/a
http://5.182.210.174/71e38en/an/an/a
http://5.182.210.174/356a95n/an/an/a
http://5.182.210.174/70c8a6n/an/an/a
http://5.182.210.174/27778cn/an/an/a
http://5.182.210.174/a2c4bcn/an/an/a

Intelligence

File Origin
# of uploads :
1
# of downloads :
30
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive mirai
Link:
https://www.filescan.io/uploads/6a9f9225a51c5f914d0253df/reports/9337523c-a66d-4f06-b731-a9182079a560/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-09-08T02:21:00Z UTC
Last seen:
2026-09-09T18:31:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/b06f4b22c7828b395c1074c5c3de2fa1c5d380dde916bf21ad0905fc876ed8df/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/5be8c7d9-b825-443a-a0b7-87628d1bf9fe
Behavior Graph:
Download SVG
%3 guuid=eff3bddd-3200-0000-5d8c-2b3a3d030000 pid=829 /usr/bin/sudo guuid=c358a5e0-3200-0000-5d8c-2b3a3e030000 pid=830 /tmp/sample.bin guuid=eff3bddd-3200-0000-5d8c-2b3a3d030000 pid=829->guuid=c358a5e0-3200-0000-5d8c-2b3a3e030000 pid=830 execve guuid=99fa3ae1-3200-0000-5d8c-2b3a3f030000 pid=831 /usr/bin/wget net send-data guuid=c358a5e0-3200-0000-5d8c-2b3a3e030000 pid=830->guuid=99fa3ae1-3200-0000-5d8c-2b3a3f030000 pid=831 execve guuid=cfb5ec46-3500-0000-5d8c-2b3a40030000 pid=832 /usr/bin/curl net send-data write-file guuid=c358a5e0-3200-0000-5d8c-2b3a3e030000 pid=830->guuid=cfb5ec46-3500-0000-5d8c-2b3a40030000 pid=832 execve guuid=9e00f64b-3500-0000-5d8c-2b3a41030000 pid=833 /usr/bin/chmod guuid=c358a5e0-3200-0000-5d8c-2b3a3e030000 pid=830->guuid=9e00f64b-3500-0000-5d8c-2b3a41030000 pid=833 execve guuid=70ab8a4c-3500-0000-5d8c-2b3a42030000 pid=834 /usr/bin/bash guuid=c358a5e0-3200-0000-5d8c-2b3a3e030000 pid=830->guuid=70ab8a4c-3500-0000-5d8c-2b3a42030000 pid=834 clone guuid=dd51c74c-3500-0000-5d8c-2b3a44030000 pid=836 /usr/bin/rm delete-file guuid=c358a5e0-3200-0000-5d8c-2b3a3e030000 pid=830->guuid=dd51c74c-3500-0000-5d8c-2b3a44030000 pid=836 execve guuid=8251514d-3500-0000-5d8c-2b3a45030000 pid=837 /usr/bin/rm guuid=c358a5e0-3200-0000-5d8c-2b3a3e030000 pid=830->guuid=8251514d-3500-0000-5d8c-2b3a45030000 pid=837 execve guuid=3012ae4d-3500-0000-5d8c-2b3a46030000 pid=838 /usr/bin/wget net send-data guuid=c358a5e0-3200-0000-5d8c-2b3a3e030000 pid=830->guuid=3012ae4d-3500-0000-5d8c-2b3a46030000 pid=838 execve guuid=03f19c50-3500-0000-5d8c-2b3a47030000 pid=839 /usr/bin/curl net send-data write-file guuid=c358a5e0-3200-0000-5d8c-2b3a3e030000 pid=830->guuid=03f19c50-3500-0000-5d8c-2b3a47030000 pid=839 execve guuid=88d6eb53-3500-0000-5d8c-2b3a48030000 pid=840 /usr/bin/chmod guuid=c358a5e0-3200-0000-5d8c-2b3a3e030000 pid=830->guuid=88d6eb53-3500-0000-5d8c-2b3a48030000 pid=840 execve guuid=ad7d3254-3500-0000-5d8c-2b3a49030000 pid=841 /usr/bin/bash guuid=c358a5e0-3200-0000-5d8c-2b3a3e030000 pid=830->guuid=ad7d3254-3500-0000-5d8c-2b3a49030000 pid=841 clone guuid=0f036e54-3500-0000-5d8c-2b3a4b030000 pid=843 /usr/bin/rm delete-file guuid=c358a5e0-3200-0000-5d8c-2b3a3e030000 pid=830->guuid=0f036e54-3500-0000-5d8c-2b3a4b030000 pid=843 execve guuid=a416b754-3500-0000-5d8c-2b3a4c030000 pid=844 /usr/bin/rm guuid=c358a5e0-3200-0000-5d8c-2b3a3e030000 pid=830->guuid=a416b754-3500-0000-5d8c-2b3a4c030000 pid=844 execve guuid=a7bafa54-3500-0000-5d8c-2b3a4d030000 pid=845 /usr/bin/wget net send-data guuid=c358a5e0-3200-0000-5d8c-2b3a3e030000 pid=830->guuid=a7bafa54-3500-0000-5d8c-2b3a4d030000 pid=845 execve guuid=cdc37357-3500-0000-5d8c-2b3a4e030000 pid=846 /usr/bin/curl net send-data write-file guuid=c358a5e0-3200-0000-5d8c-2b3a3e030000 pid=830->guuid=cdc37357-3500-0000-5d8c-2b3a4e030000 pid=846 execve guuid=a94fb45a-3500-0000-5d8c-2b3a4f030000 pid=847 /usr/bin/chmod guuid=c358a5e0-3200-0000-5d8c-2b3a3e030000 pid=830->guuid=a94fb45a-3500-0000-5d8c-2b3a4f030000 pid=847 execve guuid=8fa1f85a-3500-0000-5d8c-2b3a50030000 pid=848 /usr/bin/bash guuid=c358a5e0-3200-0000-5d8c-2b3a3e030000 pid=830->guuid=8fa1f85a-3500-0000-5d8c-2b3a50030000 pid=848 clone guuid=9f902b5b-3500-0000-5d8c-2b3a52030000 pid=850 /usr/bin/rm delete-file guuid=c358a5e0-3200-0000-5d8c-2b3a3e030000 pid=830->guuid=9f902b5b-3500-0000-5d8c-2b3a52030000 pid=850 execve guuid=5991765b-3500-0000-5d8c-2b3a53030000 pid=851 /usr/bin/rm guuid=c358a5e0-3200-0000-5d8c-2b3a3e030000 pid=830->guuid=5991765b-3500-0000-5d8c-2b3a53030000 pid=851 execve guuid=77cfb65b-3500-0000-5d8c-2b3a54030000 pid=852 /usr/bin/wget net send-data guuid=c358a5e0-3200-0000-5d8c-2b3a3e030000 pid=830->guuid=77cfb65b-3500-0000-5d8c-2b3a54030000 pid=852 execve guuid=e1ac265e-3500-0000-5d8c-2b3a55030000 pid=853 /usr/bin/curl net send-data write-file guuid=c358a5e0-3200-0000-5d8c-2b3a3e030000 pid=830->guuid=e1ac265e-3500-0000-5d8c-2b3a55030000 pid=853 execve guuid=b8c06b61-3500-0000-5d8c-2b3a56030000 pid=854 /usr/bin/chmod guuid=c358a5e0-3200-0000-5d8c-2b3a3e030000 pid=830->guuid=b8c06b61-3500-0000-5d8c-2b3a56030000 pid=854 execve guuid=b1adb461-3500-0000-5d8c-2b3a57030000 pid=855 /usr/bin/bash guuid=c358a5e0-3200-0000-5d8c-2b3a3e030000 pid=830->guuid=b1adb461-3500-0000-5d8c-2b3a57030000 pid=855 clone guuid=f2acf161-3500-0000-5d8c-2b3a59030000 pid=857 /usr/bin/rm delete-file guuid=c358a5e0-3200-0000-5d8c-2b3a3e030000 pid=830->guuid=f2acf161-3500-0000-5d8c-2b3a59030000 pid=857 execve guuid=d4263a62-3500-0000-5d8c-2b3a5a030000 pid=858 /usr/bin/rm guuid=c358a5e0-3200-0000-5d8c-2b3a3e030000 pid=830->guuid=d4263a62-3500-0000-5d8c-2b3a5a030000 pid=858 execve guuid=2b787c62-3500-0000-5d8c-2b3a5b030000 pid=859 /usr/bin/wget net send-data guuid=c358a5e0-3200-0000-5d8c-2b3a3e030000 pid=830->guuid=2b787c62-3500-0000-5d8c-2b3a5b030000 pid=859 execve guuid=b10cde64-3500-0000-5d8c-2b3a5c030000 pid=860 /usr/bin/curl net send-data write-file guuid=c358a5e0-3200-0000-5d8c-2b3a3e030000 pid=830->guuid=b10cde64-3500-0000-5d8c-2b3a5c030000 pid=860 execve guuid=1e8c5569-3500-0000-5d8c-2b3a5d030000 pid=861 /usr/bin/chmod guuid=c358a5e0-3200-0000-5d8c-2b3a3e030000 pid=830->guuid=1e8c5569-3500-0000-5d8c-2b3a5d030000 pid=861 execve guuid=e9a89869-3500-0000-5d8c-2b3a5e030000 pid=862 /usr/bin/bash guuid=c358a5e0-3200-0000-5d8c-2b3a3e030000 pid=830->guuid=e9a89869-3500-0000-5d8c-2b3a5e030000 pid=862 clone guuid=de8be669-3500-0000-5d8c-2b3a60030000 pid=864 /usr/bin/rm delete-file guuid=c358a5e0-3200-0000-5d8c-2b3a3e030000 pid=830->guuid=de8be669-3500-0000-5d8c-2b3a60030000 pid=864 execve guuid=659c2c6a-3500-0000-5d8c-2b3a61030000 pid=865 /usr/bin/rm guuid=c358a5e0-3200-0000-5d8c-2b3a3e030000 pid=830->guuid=659c2c6a-3500-0000-5d8c-2b3a61030000 pid=865 execve guuid=a6666f6a-3500-0000-5d8c-2b3a62030000 pid=866 /usr/bin/wget net send-data guuid=c358a5e0-3200-0000-5d8c-2b3a3e030000 pid=830->guuid=a6666f6a-3500-0000-5d8c-2b3a62030000 pid=866 execve guuid=28dade6c-3500-0000-5d8c-2b3a63030000 pid=867 /usr/bin/curl net send-data write-file guuid=c358a5e0-3200-0000-5d8c-2b3a3e030000 pid=830->guuid=28dade6c-3500-0000-5d8c-2b3a63030000 pid=867 execve guuid=ebd60d71-3500-0000-5d8c-2b3a64030000 pid=868 /usr/bin/chmod guuid=c358a5e0-3200-0000-5d8c-2b3a3e030000 pid=830->guuid=ebd60d71-3500-0000-5d8c-2b3a64030000 pid=868 execve guuid=5e035571-3500-0000-5d8c-2b3a65030000 pid=869 /usr/bin/bash guuid=c358a5e0-3200-0000-5d8c-2b3a3e030000 pid=830->guuid=5e035571-3500-0000-5d8c-2b3a65030000 pid=869 clone guuid=6d609071-3500-0000-5d8c-2b3a67030000 pid=871 /usr/bin/rm delete-file guuid=c358a5e0-3200-0000-5d8c-2b3a3e030000 pid=830->guuid=6d609071-3500-0000-5d8c-2b3a67030000 pid=871 execve guuid=9be6e271-3500-0000-5d8c-2b3a68030000 pid=872 /usr/bin/rm guuid=c358a5e0-3200-0000-5d8c-2b3a3e030000 pid=830->guuid=9be6e271-3500-0000-5d8c-2b3a68030000 pid=872 execve guuid=9ca32a72-3500-0000-5d8c-2b3a69030000 pid=873 /usr/bin/wget net send-data guuid=c358a5e0-3200-0000-5d8c-2b3a3e030000 pid=830->guuid=9ca32a72-3500-0000-5d8c-2b3a69030000 pid=873 execve guuid=7ac6ab74-3500-0000-5d8c-2b3a6a030000 pid=874 /usr/bin/curl net send-data write-file guuid=c358a5e0-3200-0000-5d8c-2b3a3e030000 pid=830->guuid=7ac6ab74-3500-0000-5d8c-2b3a6a030000 pid=874 execve guuid=e9ec2779-3500-0000-5d8c-2b3a6b030000 pid=875 /usr/bin/chmod guuid=c358a5e0-3200-0000-5d8c-2b3a3e030000 pid=830->guuid=e9ec2779-3500-0000-5d8c-2b3a6b030000 pid=875 execve guuid=127a6b79-3500-0000-5d8c-2b3a6c030000 pid=876 /usr/bin/bash guuid=c358a5e0-3200-0000-5d8c-2b3a3e030000 pid=830->guuid=127a6b79-3500-0000-5d8c-2b3a6c030000 pid=876 clone guuid=1bdded79-3500-0000-5d8c-2b3a6e030000 pid=878 /usr/bin/rm delete-file guuid=c358a5e0-3200-0000-5d8c-2b3a3e030000 pid=830->guuid=1bdded79-3500-0000-5d8c-2b3a6e030000 pid=878 execve guuid=cfd1857a-3500-0000-5d8c-2b3a6f030000 pid=879 /usr/bin/rm guuid=c358a5e0-3200-0000-5d8c-2b3a3e030000 pid=830->guuid=cfd1857a-3500-0000-5d8c-2b3a6f030000 pid=879 execve guuid=c3edfc7a-3500-0000-5d8c-2b3a70030000 pid=880 /usr/bin/wget net send-data guuid=c358a5e0-3200-0000-5d8c-2b3a3e030000 pid=830->guuid=c3edfc7a-3500-0000-5d8c-2b3a70030000 pid=880 execve guuid=39808a7d-3500-0000-5d8c-2b3a71030000 pid=881 /usr/bin/curl net send-data write-file guuid=c358a5e0-3200-0000-5d8c-2b3a3e030000 pid=830->guuid=39808a7d-3500-0000-5d8c-2b3a71030000 pid=881 execve guuid=f42eda31-3600-0000-5d8c-2b3a72030000 pid=882 /usr/bin/chmod guuid=c358a5e0-3200-0000-5d8c-2b3a3e030000 pid=830->guuid=f42eda31-3600-0000-5d8c-2b3a72030000 pid=882 execve guuid=23ca2632-3600-0000-5d8c-2b3a73030000 pid=883 /usr/bin/bash guuid=c358a5e0-3200-0000-5d8c-2b3a3e030000 pid=830->guuid=23ca2632-3600-0000-5d8c-2b3a73030000 pid=883 clone guuid=77e17232-3600-0000-5d8c-2b3a75030000 pid=885 /usr/bin/rm delete-file guuid=c358a5e0-3200-0000-5d8c-2b3a3e030000 pid=830->guuid=77e17232-3600-0000-5d8c-2b3a75030000 pid=885 execve guuid=08e2b732-3600-0000-5d8c-2b3a76030000 pid=886 /usr/bin/rm guuid=c358a5e0-3200-0000-5d8c-2b3a3e030000 pid=830->guuid=08e2b732-3600-0000-5d8c-2b3a76030000 pid=886 execve guuid=b3c03c33-3600-0000-5d8c-2b3a77030000 pid=887 /usr/bin/wget net send-data guuid=c358a5e0-3200-0000-5d8c-2b3a3e030000 pid=830->guuid=b3c03c33-3600-0000-5d8c-2b3a77030000 pid=887 execve guuid=0f3e6d58-3600-0000-5d8c-2b3a78030000 pid=888 /usr/bin/curl net send-data write-file guuid=c358a5e0-3200-0000-5d8c-2b3a3e030000 pid=830->guuid=0f3e6d58-3600-0000-5d8c-2b3a78030000 pid=888 execve guuid=bd30d65b-3600-0000-5d8c-2b3a79030000 pid=889 /usr/bin/chmod guuid=c358a5e0-3200-0000-5d8c-2b3a3e030000 pid=830->guuid=bd30d65b-3600-0000-5d8c-2b3a79030000 pid=889 execve guuid=beaa1d5c-3600-0000-5d8c-2b3a7a030000 pid=890 /usr/bin/bash guuid=c358a5e0-3200-0000-5d8c-2b3a3e030000 pid=830->guuid=beaa1d5c-3600-0000-5d8c-2b3a7a030000 pid=890 clone guuid=ad3b615c-3600-0000-5d8c-2b3a7c030000 pid=892 /usr/bin/rm delete-file guuid=c358a5e0-3200-0000-5d8c-2b3a3e030000 pid=830->guuid=ad3b615c-3600-0000-5d8c-2b3a7c030000 pid=892 execve guuid=e428af5c-3600-0000-5d8c-2b3a7d030000 pid=893 /usr/bin/rm guuid=c358a5e0-3200-0000-5d8c-2b3a3e030000 pid=830->guuid=e428af5c-3600-0000-5d8c-2b3a7d030000 pid=893 execve guuid=9d4df35c-3600-0000-5d8c-2b3a7e030000 pid=894 /usr/bin/wget net send-data guuid=c358a5e0-3200-0000-5d8c-2b3a3e030000 pid=830->guuid=9d4df35c-3600-0000-5d8c-2b3a7e030000 pid=894 execve guuid=5e9d6c5f-3600-0000-5d8c-2b3a7f030000 pid=895 /usr/bin/curl net send-data write-file guuid=c358a5e0-3200-0000-5d8c-2b3a3e030000 pid=830->guuid=5e9d6c5f-3600-0000-5d8c-2b3a7f030000 pid=895 execve guuid=0512be63-3600-0000-5d8c-2b3a80030000 pid=896 /usr/bin/chmod guuid=c358a5e0-3200-0000-5d8c-2b3a3e030000 pid=830->guuid=0512be63-3600-0000-5d8c-2b3a80030000 pid=896 execve guuid=e74d0a64-3600-0000-5d8c-2b3a81030000 pid=897 /usr/bin/bash guuid=c358a5e0-3200-0000-5d8c-2b3a3e030000 pid=830->guuid=e74d0a64-3600-0000-5d8c-2b3a81030000 pid=897 clone guuid=b81b4d64-3600-0000-5d8c-2b3a83030000 pid=899 /usr/bin/rm delete-file guuid=c358a5e0-3200-0000-5d8c-2b3a3e030000 pid=830->guuid=b81b4d64-3600-0000-5d8c-2b3a83030000 pid=899 execve guuid=88dbaf64-3600-0000-5d8c-2b3a84030000 pid=900 /usr/bin/rm guuid=c358a5e0-3200-0000-5d8c-2b3a3e030000 pid=830->guuid=88dbaf64-3600-0000-5d8c-2b3a84030000 pid=900 execve guuid=d761f864-3600-0000-5d8c-2b3a85030000 pid=901 /usr/bin/wget net send-data guuid=c358a5e0-3200-0000-5d8c-2b3a3e030000 pid=830->guuid=d761f864-3600-0000-5d8c-2b3a85030000 pid=901 execve guuid=5e8db267-3600-0000-5d8c-2b3a86030000 pid=902 /usr/bin/curl net send-data write-file guuid=c358a5e0-3200-0000-5d8c-2b3a3e030000 pid=830->guuid=5e8db267-3600-0000-5d8c-2b3a86030000 pid=902 execve guuid=a6e1566b-3600-0000-5d8c-2b3a87030000 pid=903 /usr/bin/chmod guuid=c358a5e0-3200-0000-5d8c-2b3a3e030000 pid=830->guuid=a6e1566b-3600-0000-5d8c-2b3a87030000 pid=903 execve guuid=0f75a36b-3600-0000-5d8c-2b3a88030000 pid=904 /usr/bin/bash guuid=c358a5e0-3200-0000-5d8c-2b3a3e030000 pid=830->guuid=0f75a36b-3600-0000-5d8c-2b3a88030000 pid=904 clone guuid=1177056c-3600-0000-5d8c-2b3a8a030000 pid=906 /usr/bin/rm delete-file guuid=c358a5e0-3200-0000-5d8c-2b3a3e030000 pid=830->guuid=1177056c-3600-0000-5d8c-2b3a8a030000 pid=906 execve guuid=9f344d6c-3600-0000-5d8c-2b3a8b030000 pid=907 /usr/bin/rm guuid=c358a5e0-3200-0000-5d8c-2b3a3e030000 pid=830->guuid=9f344d6c-3600-0000-5d8c-2b3a8b030000 pid=907 execve guuid=7ade976c-3600-0000-5d8c-2b3a8c030000 pid=908 /usr/bin/wget net send-data guuid=c358a5e0-3200-0000-5d8c-2b3a3e030000 pid=830->guuid=7ade976c-3600-0000-5d8c-2b3a8c030000 pid=908 execve guuid=f4dd2c6f-3600-0000-5d8c-2b3a8d030000 pid=909 /usr/bin/curl net send-data write-file guuid=c358a5e0-3200-0000-5d8c-2b3a3e030000 pid=830->guuid=f4dd2c6f-3600-0000-5d8c-2b3a8d030000 pid=909 execve guuid=30e4bb72-3600-0000-5d8c-2b3a8e030000 pid=910 /usr/bin/chmod guuid=c358a5e0-3200-0000-5d8c-2b3a3e030000 pid=830->guuid=30e4bb72-3600-0000-5d8c-2b3a8e030000 pid=910 execve guuid=9ccb1673-3600-0000-5d8c-2b3a8f030000 pid=911 /usr/bin/bash guuid=c358a5e0-3200-0000-5d8c-2b3a3e030000 pid=830->guuid=9ccb1673-3600-0000-5d8c-2b3a8f030000 pid=911 clone guuid=b2854c73-3600-0000-5d8c-2b3a91030000 pid=913 /usr/bin/rm delete-file guuid=c358a5e0-3200-0000-5d8c-2b3a3e030000 pid=830->guuid=b2854c73-3600-0000-5d8c-2b3a91030000 pid=913 execve guuid=0977a273-3600-0000-5d8c-2b3a92030000 pid=914 /usr/bin/rm guuid=c358a5e0-3200-0000-5d8c-2b3a3e030000 pid=830->guuid=0977a273-3600-0000-5d8c-2b3a92030000 pid=914 execve 5b654972-c9e1-50d8-b372-2dc2a5b9ad66 5.182.210.174:80 guuid=99fa3ae1-3200-0000-5d8c-2b3a3f030000 pid=831->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=cfb5ec46-3500-0000-5d8c-2b3a40030000 pid=832->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=4e92a04c-3500-0000-5d8c-2b3a43030000 pid=835 /usr/bin/bash guuid=70ab8a4c-3500-0000-5d8c-2b3a42030000 pid=834->guuid=4e92a04c-3500-0000-5d8c-2b3a43030000 pid=835 clone guuid=3012ae4d-3500-0000-5d8c-2b3a46030000 pid=838->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=03f19c50-3500-0000-5d8c-2b3a47030000 pid=839->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=fbd34954-3500-0000-5d8c-2b3a4a030000 pid=842 /usr/bin/bash guuid=ad7d3254-3500-0000-5d8c-2b3a49030000 pid=841->guuid=fbd34954-3500-0000-5d8c-2b3a4a030000 pid=842 clone guuid=a7bafa54-3500-0000-5d8c-2b3a4d030000 pid=845->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=cdc37357-3500-0000-5d8c-2b3a4e030000 pid=846->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=25fe0e5b-3500-0000-5d8c-2b3a51030000 pid=849 /usr/bin/bash guuid=8fa1f85a-3500-0000-5d8c-2b3a50030000 pid=848->guuid=25fe0e5b-3500-0000-5d8c-2b3a51030000 pid=849 clone guuid=77cfb65b-3500-0000-5d8c-2b3a54030000 pid=852->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=e1ac265e-3500-0000-5d8c-2b3a55030000 pid=853->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=b6e5c861-3500-0000-5d8c-2b3a58030000 pid=856 /usr/bin/bash guuid=b1adb461-3500-0000-5d8c-2b3a57030000 pid=855->guuid=b6e5c861-3500-0000-5d8c-2b3a58030000 pid=856 clone guuid=2b787c62-3500-0000-5d8c-2b3a5b030000 pid=859->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=b10cde64-3500-0000-5d8c-2b3a5c030000 pid=860->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=6331b969-3500-0000-5d8c-2b3a5f030000 pid=863 /usr/bin/bash guuid=e9a89869-3500-0000-5d8c-2b3a5e030000 pid=862->guuid=6331b969-3500-0000-5d8c-2b3a5f030000 pid=863 clone guuid=a6666f6a-3500-0000-5d8c-2b3a62030000 pid=866->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=28dade6c-3500-0000-5d8c-2b3a63030000 pid=867->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=72b36f71-3500-0000-5d8c-2b3a66030000 pid=870 /usr/bin/bash guuid=5e035571-3500-0000-5d8c-2b3a65030000 pid=869->guuid=72b36f71-3500-0000-5d8c-2b3a66030000 pid=870 clone guuid=9ca32a72-3500-0000-5d8c-2b3a69030000 pid=873->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=7ac6ab74-3500-0000-5d8c-2b3a6a030000 pid=874->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=1e539c79-3500-0000-5d8c-2b3a6d030000 pid=877 /usr/bin/bash guuid=127a6b79-3500-0000-5d8c-2b3a6c030000 pid=876->guuid=1e539c79-3500-0000-5d8c-2b3a6d030000 pid=877 clone guuid=c3edfc7a-3500-0000-5d8c-2b3a70030000 pid=880->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=39808a7d-3500-0000-5d8c-2b3a71030000 pid=881->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=a4034032-3600-0000-5d8c-2b3a74030000 pid=884 /usr/bin/bash guuid=23ca2632-3600-0000-5d8c-2b3a73030000 pid=883->guuid=a4034032-3600-0000-5d8c-2b3a74030000 pid=884 clone guuid=b3c03c33-3600-0000-5d8c-2b3a77030000 pid=887->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=0f3e6d58-3600-0000-5d8c-2b3a78030000 pid=888->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=9a133c5c-3600-0000-5d8c-2b3a7b030000 pid=891 /usr/bin/bash guuid=beaa1d5c-3600-0000-5d8c-2b3a7a030000 pid=890->guuid=9a133c5c-3600-0000-5d8c-2b3a7b030000 pid=891 clone guuid=9d4df35c-3600-0000-5d8c-2b3a7e030000 pid=894->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=5e9d6c5f-3600-0000-5d8c-2b3a7f030000 pid=895->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=95c62564-3600-0000-5d8c-2b3a82030000 pid=898 /usr/bin/bash guuid=e74d0a64-3600-0000-5d8c-2b3a81030000 pid=897->guuid=95c62564-3600-0000-5d8c-2b3a82030000 pid=898 clone guuid=d761f864-3600-0000-5d8c-2b3a85030000 pid=901->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=5e8db267-3600-0000-5d8c-2b3a86030000 pid=902->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=9854cf6b-3600-0000-5d8c-2b3a89030000 pid=905 /usr/bin/bash guuid=0f75a36b-3600-0000-5d8c-2b3a88030000 pid=904->guuid=9854cf6b-3600-0000-5d8c-2b3a89030000 pid=905 clone guuid=7ade976c-3600-0000-5d8c-2b3a8c030000 pid=908->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=f4dd2c6f-3600-0000-5d8c-2b3a8d030000 pid=909->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=ba282e73-3600-0000-5d8c-2b3a90030000 pid=912 /usr/bin/bash guuid=9ccb1673-3600-0000-5d8c-2b3a8f030000 pid=911->guuid=ba282e73-3600-0000-5d8c-2b3a90030000 pid=912 clone
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/b06f4b22c7828b395c1074c5c3de2fa1c5d380dde916bf21ad0905fc876ed8df
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b06f4b22c7828b395c1074c5c3de2fa1c5d380dde916bf21ad0905fc876ed8df/
Threat name:
Linux.Trojan.Multiverze
Create hunting rule
Status:
Malicious
First seen:
2026-09-08 04:42:31 UTC
File Type:
Text (Shell)
AV detection:
11 of 24 (45.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wbxuwiwhqkftsxaqotc4hxrpuhc5hag55ell6innbec7zb3o3dpq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260908-fbhkyazzcx/
Behaviour
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.11
Link:
https://yomi.yoroi.company/submissions/b06f4b22c7828b395c1074c5c3de2fa1c5d380dde916bf21ad0905fc876ed8df

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh b06f4b22c7828b395c1074c5c3de2fa1c5d380dde916bf21ad0905fc876ed8df

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3897671/
  
Delivery method
Distributed via web download

Comments