🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b1b7ce2518eaa30bc1a13161fd7a7294ba80bb281f792484d87ad262dc03c40a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b1b7ce2518eaa30bc1a13161fd7a7294ba80bb281f792484d87ad262dc03c40a
SHA3-384 hash: 82f7d6b7659cdd8fe9b1e0c046859fad1995959f9e8d387a65c57737194600b75f7922db8878ebff05909bb5aaa197e1
SHA1 hash: 9c0298a81e05954a509d25724669f8e76013ed6d
MD5 hash: 231605371b88675a0f5af5db84e9ab4a
humanhash: quiet-fruit-kansas-alaska
File name:install_panel.sh
Download: download sample
File size:80'778 bytes
First seen:2026-08-08 13:48:55 UTC
Last seen:2026-08-08 20:47:17 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 1536:70KhgppevVnosI9fsQyeSxXeil3hLh8xLdfhQH7hrt0sHzmBWptxM7vWB06putR4:YXpmVnosI9fsQyeSxXeil3hLh8xLdfh4
TLSH T1A8830896EF08D9F43C50C22D5B518E0DFA0E92D702157864B0DFB8A42B9CB73B97E616
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
https://www.bt.cn/api/wpanel/SetupCountn/an/an/a
https://api.bt.cn/api/isCNn/an/an/a
https://mirrors.aliyun.com/repo/Centos-vault-8.5.2111.repon/an/an/a
https://mirrors.aliyun.com/repo/epel-archive-8.repon/an/an/a
http://download.bt.cn/install/yumRepo_select.shn/an/an/a
https://www.bt.cn/api/index/get_timen/an/an/a
https://download.bt.cn/install/plugin/oneav/install.shn/an/an/a
https://www.bt.cn/Api/getIpAddressn/an/an/a
https://api.bt.cn/Api/getIpAddressn/an/an/a
https://www.aapanel.com/api/common/getClientIPn/an/an/a
https://www.bt.cn/Api/SetupCountn/an/an/a
https://www.bt.cn/Api/SetupCountPren/an/an/a
https://www.bt.cn/Api/installationCountn/an/an/a
https://www-node3.bt.cn/Api/installationCountn/an/an/a

Intelligence

File Origin
# of uploads :
2
# of downloads :
54
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
bash lolbin opendir
Link:
https://www.filescan.io/uploads/6a7733ea4d38786ce67798b8/reports/f5408e72-0ea9-476b-b5bf-ab815c58a69a/overview
Verdict:
Unknown
File Type:
unix shell
Link:
https://opentip.kaspersky.com/b1b7ce2518eaa30bc1a13161fd7a7294ba80bb281f792484d87ad262dc03c40a/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/95c8c52a-3eeb-4168-94b2-0fb05fdf1728
Behavior Graph:
Download SVG
%3 guuid=d2637664-2100-0000-6a5b-202c8c070000 pid=1932 /usr/bin/sudo guuid=12105367-2100-0000-6a5b-202c90070000 pid=1936 /tmp/sample.bin guuid=d2637664-2100-0000-6a5b-202c8c070000 pid=1932->guuid=12105367-2100-0000-6a5b-202c90070000 pid=1936 execve guuid=a752a368-2100-0000-6a5b-202c91070000 pid=1937 /usr/bin/bash guuid=12105367-2100-0000-6a5b-202c90070000 pid=1936->guuid=a752a368-2100-0000-6a5b-202c91070000 pid=1937 clone guuid=48a4286a-2100-0000-6a5b-202c95070000 pid=1941 /usr/bin/tee write-file guuid=12105367-2100-0000-6a5b-202c90070000 pid=1936->guuid=48a4286a-2100-0000-6a5b-202c95070000 pid=1941 execve guuid=42cc8a6a-2100-0000-6a5b-202c96070000 pid=1942 /usr/bin/which.debianutils guuid=12105367-2100-0000-6a5b-202c90070000 pid=1936->guuid=42cc8a6a-2100-0000-6a5b-202c96070000 pid=1942 execve guuid=8f59a26c-2100-0000-6a5b-202c97070000 pid=1943 /usr/bin/curl net send-data guuid=12105367-2100-0000-6a5b-202c90070000 pid=1936->guuid=8f59a26c-2100-0000-6a5b-202c97070000 pid=1943 execve guuid=488e67e2-2100-0000-6a5b-202cf3070000 pid=2035 /usr/bin/whoami guuid=12105367-2100-0000-6a5b-202c90070000 pid=1936->guuid=488e67e2-2100-0000-6a5b-202cf3070000 pid=2035 execve guuid=0f011de5-2100-0000-6a5b-202cf7070000 pid=2039 /usr/bin/bash guuid=12105367-2100-0000-6a5b-202c90070000 pid=1936->guuid=0f011de5-2100-0000-6a5b-202cf7070000 pid=2039 clone guuid=b94f57e7-2100-0000-6a5b-202cfd070000 pid=2045 /usr/bin/getconf guuid=12105367-2100-0000-6a5b-202c90070000 pid=1936->guuid=b94f57e7-2100-0000-6a5b-202cfd070000 pid=2045 execve guuid=64f1a4e8-2100-0000-6a5b-202cff070000 pid=2047 /usr/bin/bash guuid=12105367-2100-0000-6a5b-202c90070000 pid=1936->guuid=64f1a4e8-2100-0000-6a5b-202cff070000 pid=2047 clone guuid=9660b1ea-2100-0000-6a5b-202c04080000 pid=2052 /usr/bin/bash guuid=12105367-2100-0000-6a5b-202c90070000 pid=1936->guuid=9660b1ea-2100-0000-6a5b-202c04080000 pid=2052 clone guuid=f1c991ed-2100-0000-6a5b-202c0c080000 pid=2060 /usr/bin/cat guuid=12105367-2100-0000-6a5b-202c90070000 pid=1936->guuid=f1c991ed-2100-0000-6a5b-202c0c080000 pid=2060 execve guuid=6912d7ee-2100-0000-6a5b-202c0f080000 pid=2063 /usr/bin/bash guuid=12105367-2100-0000-6a5b-202c90070000 pid=1936->guuid=6912d7ee-2100-0000-6a5b-202c0f080000 pid=2063 clone guuid=1e5b9af1-2100-0000-6a5b-202c16080000 pid=2070 /usr/bin/bash guuid=12105367-2100-0000-6a5b-202c90070000 pid=1936->guuid=1e5b9af1-2100-0000-6a5b-202c16080000 pid=2070 clone guuid=1c64e4f2-2100-0000-6a5b-202c1c080000 pid=2076 /usr/bin/bash guuid=12105367-2100-0000-6a5b-202c90070000 pid=1936->guuid=1c64e4f2-2100-0000-6a5b-202c1c080000 pid=2076 clone guuid=416c8df4-2100-0000-6a5b-202c22080000 pid=2082 /usr/bin/expr guuid=12105367-2100-0000-6a5b-202c90070000 pid=1936->guuid=416c8df4-2100-0000-6a5b-202c22080000 pid=2082 execve guuid=6f07c768-2100-0000-6a5b-202c92070000 pid=1938 /usr/bin/uname guuid=a752a368-2100-0000-6a5b-202c91070000 pid=1937->guuid=6f07c768-2100-0000-6a5b-202c92070000 pid=1938 execve guuid=1273d468-2100-0000-6a5b-202c93070000 pid=1939 /usr/bin/grep guuid=a752a368-2100-0000-6a5b-202c91070000 pid=1937->guuid=1273d468-2100-0000-6a5b-202c93070000 pid=1939 execve 83ee29da-e6c1-5782-beaf-7dee6832de76 www.bt.cn:443 guuid=8f59a26c-2100-0000-6a5b-202c97070000 pid=1943->83ee29da-e6c1-5782-beaf-7dee6832de76 send: 789B guuid=8f59a26c-2100-0000-6a5b-202c97070000 pid=1961 /usr/bin/curl dns net send-data guuid=8f59a26c-2100-0000-6a5b-202c97070000 pid=1943->guuid=8f59a26c-2100-0000-6a5b-202c97070000 pid=1961 clone guuid=8f59a26c-2100-0000-6a5b-202c97070000 pid=1961->83ee29da-e6c1-5782-beaf-7dee6832de76 con 4f6baed0-9587-596c-82b3-fd721afe4cc1 10.0.2.3:53 guuid=8f59a26c-2100-0000-6a5b-202c97070000 pid=1961->4f6baed0-9587-596c-82b3-fd721afe4cc1 send: 54B guuid=0cd44ae5-2100-0000-6a5b-202cf8070000 pid=2040 /usr/bin/free guuid=0f011de5-2100-0000-6a5b-202cf7070000 pid=2039->guuid=0cd44ae5-2100-0000-6a5b-202cf8070000 pid=2040 execve guuid=54de58e5-2100-0000-6a5b-202cf9070000 pid=2041 /usr/bin/grep guuid=0f011de5-2100-0000-6a5b-202cf7070000 pid=2039->guuid=54de58e5-2100-0000-6a5b-202cf9070000 pid=2041 execve guuid=37b865e5-2100-0000-6a5b-202cfa070000 pid=2042 /usr/bin/mawk guuid=0f011de5-2100-0000-6a5b-202cf7070000 pid=2039->guuid=37b865e5-2100-0000-6a5b-202cfa070000 pid=2042 execve guuid=6a075de9-2100-0000-6a5b-202c00080000 pid=2048 /usr/bin/cat guuid=64f1a4e8-2100-0000-6a5b-202cff070000 pid=2047->guuid=6a075de9-2100-0000-6a5b-202c00080000 pid=2048 execve guuid=c4726ae9-2100-0000-6a5b-202c01080000 pid=2049 /usr/bin/grep guuid=64f1a4e8-2100-0000-6a5b-202cff070000 pid=2047->guuid=c4726ae9-2100-0000-6a5b-202c01080000 pid=2049 execve guuid=4bf174e9-2100-0000-6a5b-202c02080000 pid=2050 /usr/bin/grep guuid=64f1a4e8-2100-0000-6a5b-202cff070000 pid=2047->guuid=4bf174e9-2100-0000-6a5b-202c02080000 pid=2050 execve guuid=373fcaea-2100-0000-6a5b-202c05080000 pid=2053 /usr/bin/cat guuid=9660b1ea-2100-0000-6a5b-202c04080000 pid=2052->guuid=373fcaea-2100-0000-6a5b-202c05080000 pid=2053 execve guuid=f4a2d5ea-2100-0000-6a5b-202c07080000 pid=2055 /usr/bin/grep guuid=9660b1ea-2100-0000-6a5b-202c04080000 pid=2052->guuid=f4a2d5ea-2100-0000-6a5b-202c07080000 pid=2055 execve guuid=420416eb-2100-0000-6a5b-202c08080000 pid=2056 /usr/bin/mawk guuid=9660b1ea-2100-0000-6a5b-202c04080000 pid=2052->guuid=420416eb-2100-0000-6a5b-202c08080000 pid=2056 execve guuid=565c20eb-2100-0000-6a5b-202c09080000 pid=2057 /usr/bin/cut guuid=9660b1ea-2100-0000-6a5b-202c04080000 pid=2052->guuid=565c20eb-2100-0000-6a5b-202c09080000 pid=2057 execve guuid=daafe7ee-2100-0000-6a5b-202c10080000 pid=2064 /usr/bin/cat guuid=6912d7ee-2100-0000-6a5b-202c0f080000 pid=2063->guuid=daafe7ee-2100-0000-6a5b-202c10080000 pid=2064 execve guuid=f6c154ef-2100-0000-6a5b-202c11080000 pid=2065 /usr/bin/grep guuid=6912d7ee-2100-0000-6a5b-202c0f080000 pid=2063->guuid=f6c154ef-2100-0000-6a5b-202c11080000 pid=2065 execve guuid=78bc5fef-2100-0000-6a5b-202c12080000 pid=2066 /usr/bin/grep guuid=6912d7ee-2100-0000-6a5b-202c0f080000 pid=2063->guuid=78bc5fef-2100-0000-6a5b-202c12080000 pid=2066 execve guuid=1112c0f1-2100-0000-6a5b-202c17080000 pid=2071 /usr/bin/cat guuid=1e5b9af1-2100-0000-6a5b-202c16080000 pid=2070->guuid=1112c0f1-2100-0000-6a5b-202c17080000 pid=2071 execve guuid=3daecef1-2100-0000-6a5b-202c19080000 pid=2073 /usr/bin/grep guuid=1e5b9af1-2100-0000-6a5b-202c16080000 pid=2070->guuid=3daecef1-2100-0000-6a5b-202c19080000 pid=2073 execve guuid=43b3d8f1-2100-0000-6a5b-202c1a080000 pid=2074 /usr/bin/grep guuid=1e5b9af1-2100-0000-6a5b-202c16080000 pid=2070->guuid=43b3d8f1-2100-0000-6a5b-202c1a080000 pid=2074 execve guuid=513902f3-2100-0000-6a5b-202c1d080000 pid=2077 /usr/bin/cat guuid=1c64e4f2-2100-0000-6a5b-202c1c080000 pid=2076->guuid=513902f3-2100-0000-6a5b-202c1d080000 pid=2077 execve guuid=328522f3-2100-0000-6a5b-202c1e080000 pid=2078 /usr/bin/grep guuid=1c64e4f2-2100-0000-6a5b-202c1c080000 pid=2076->guuid=328522f3-2100-0000-6a5b-202c1e080000 pid=2078 execve guuid=1b752ff3-2100-0000-6a5b-202c1f080000 pid=2079 /usr/bin/wc guuid=1c64e4f2-2100-0000-6a5b-202c1c080000 pid=2076->guuid=1b752ff3-2100-0000-6a5b-202c1f080000 pid=2079 execve
Score:
2%
Verdict:
Benign
File Type:
SCRIPT
Link:
https://malprob.io/report/b1b7ce2518eaa30bc1a13161fd7a7294ba80bb281f792484d87ad262dc03c40a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b1b7ce2518eaa30bc1a13161fd7a7294ba80bb281f792484d87ad262dc03c40a/
Threat name:
Linux.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-08-08 13:49:40 UTC
File Type:
Text (Shell)
AV detection:
6 of 23 (26.09%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wg344jiy5krqxqnbgfq726tsss5ibozid54sjbgypljgfxadyqfa._file
Result
Malware family:
n/a
Score:
  4/10
Tags:
antivm discovery linux
Link:
https://tria.ge/reports/260808-q4w9xagj5s/
Behaviour
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
Reads CPU attributes
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.34
Link:
https://yomi.yoroi.company/submissions/b1b7ce2518eaa30bc1a13161fd7a7294ba80bb281f792484d87ad262dc03c40a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:dependsonpythonailib
Create hunting rule
Author:Tim Brown
Description:Hunts for dependencies on Python AI libraries

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh b1b7ce2518eaa30bc1a13161fd7a7294ba80bb281f792484d87ad262dc03c40a

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3893440/
  
Delivery method
Distributed via web download

Comments