MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b59075c2da6a7f8e093a6ddc8f48d77244c8fc7330e66f767d99bdbe9fcb8006. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b59075c2da6a7f8e093a6ddc8f48d77244c8fc7330e66f767d99bdbe9fcb8006
SHA3-384 hash: 913ecbd95be072e51b42a101596bf5117c0003953e32fbecfba2d3b8117d159ea9b8684a9a01d2d4b06534f669916bb2
SHA1 hash: 93803fb4c0e1231d2ba5992a01275816e24599f2
MD5 hash: d48beea3c242577eeb2f9041afbeac72
humanhash: stairway-timing-social-double
File name:ok
Download: download sample
File size:1'608 bytes
First seen:2026-08-21 02:37:18 UTC
Last seen:2026-08-21 04:14:32 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 12:Ut67A8NFCr6F6ECDaG6ac7i/6i/Hy76opBx6Bn3gnGRQ6RFTOr6tBzvluTr6u5rA:5CqEzl/aOk+/BzINiywqLG
TLSH T1EE3162CF04342E312142DA8D72A67548B24EA5EB2A5FC7D5D85D1EEA438878CF2A1B5C
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://5.182.210.174/6ef423n/an/aua-wget
http://5.182.210.174/14acdfn/an/aua-wget
http://5.182.210.174/b8b233n/an/aua-wget
http://5.182.210.174/e7b8f7n/an/aua-wget
http://5.182.210.174/29ea88n/an/aua-wget
http://5.182.210.174/50edccn/an/aua-wget
http://5.182.210.174/846cacn/an/aua-wget
http://5.182.210.174/08040bn/an/aua-wget
http://5.182.210.174/f82d25n/an/aua-wget
http://5.182.210.174/d97308n/an/aua-wget
http://5.182.210.174/90e1den/an/aua-wget
http://5.182.210.174/b7a381n/an/aua-wget

Intelligence

File Origin
# of uploads :
2
# of downloads :
56
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive mirai
Link:
https://www.filescan.io/uploads/6a87ba122aaf180ce9425e18/reports/9a6f6ca8-e3f5-46a5-b4a4-42ee06b27781/overview
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/86e24f76-1512-4596-8a1f-061ef3e91791
Behavior Graph:
Download SVG
%3 guuid=e651f023-1b00-0000-fdd6-51d3e6080000 pid=2278 /usr/bin/sudo guuid=f12cd425-1b00-0000-fdd6-51d3ea080000 pid=2282 /tmp/sample.bin guuid=e651f023-1b00-0000-fdd6-51d3e6080000 pid=2278->guuid=f12cd425-1b00-0000-fdd6-51d3ea080000 pid=2282 execve guuid=69cb2826-1b00-0000-fdd6-51d3eb080000 pid=2283 /usr/bin/wget net send-data guuid=f12cd425-1b00-0000-fdd6-51d3ea080000 pid=2282->guuid=69cb2826-1b00-0000-fdd6-51d3eb080000 pid=2283 execve guuid=f4cdc22d-1b00-0000-fdd6-51d3f3080000 pid=2291 /usr/bin/curl net send-data write-file guuid=f12cd425-1b00-0000-fdd6-51d3ea080000 pid=2282->guuid=f4cdc22d-1b00-0000-fdd6-51d3f3080000 pid=2291 execve guuid=87357d36-1b00-0000-fdd6-51d3ff080000 pid=2303 /usr/bin/chmod guuid=f12cd425-1b00-0000-fdd6-51d3ea080000 pid=2282->guuid=87357d36-1b00-0000-fdd6-51d3ff080000 pid=2303 execve guuid=0cd5c136-1b00-0000-fdd6-51d300090000 pid=2304 /usr/bin/bash guuid=f12cd425-1b00-0000-fdd6-51d3ea080000 pid=2282->guuid=0cd5c136-1b00-0000-fdd6-51d300090000 pid=2304 clone guuid=be560437-1b00-0000-fdd6-51d302090000 pid=2306 /usr/bin/rm delete-file guuid=f12cd425-1b00-0000-fdd6-51d3ea080000 pid=2282->guuid=be560437-1b00-0000-fdd6-51d302090000 pid=2306 execve guuid=7a068437-1b00-0000-fdd6-51d304090000 pid=2308 /usr/bin/rm guuid=f12cd425-1b00-0000-fdd6-51d3ea080000 pid=2282->guuid=7a068437-1b00-0000-fdd6-51d304090000 pid=2308 execve guuid=33930938-1b00-0000-fdd6-51d306090000 pid=2310 /usr/bin/wget net send-data guuid=f12cd425-1b00-0000-fdd6-51d3ea080000 pid=2282->guuid=33930938-1b00-0000-fdd6-51d306090000 pid=2310 execve guuid=b6e74b3b-1b00-0000-fdd6-51d30d090000 pid=2317 /usr/bin/curl net send-data write-file guuid=f12cd425-1b00-0000-fdd6-51d3ea080000 pid=2282->guuid=b6e74b3b-1b00-0000-fdd6-51d30d090000 pid=2317 execve guuid=01d48241-1b00-0000-fdd6-51d316090000 pid=2326 /usr/bin/chmod guuid=f12cd425-1b00-0000-fdd6-51d3ea080000 pid=2282->guuid=01d48241-1b00-0000-fdd6-51d316090000 pid=2326 execve guuid=9b860142-1b00-0000-fdd6-51d318090000 pid=2328 /usr/bin/bash guuid=f12cd425-1b00-0000-fdd6-51d3ea080000 pid=2282->guuid=9b860142-1b00-0000-fdd6-51d318090000 pid=2328 clone guuid=bf425942-1b00-0000-fdd6-51d31a090000 pid=2330 /usr/bin/rm delete-file guuid=f12cd425-1b00-0000-fdd6-51d3ea080000 pid=2282->guuid=bf425942-1b00-0000-fdd6-51d31a090000 pid=2330 execve guuid=a119bd42-1b00-0000-fdd6-51d31c090000 pid=2332 /usr/bin/rm guuid=f12cd425-1b00-0000-fdd6-51d3ea080000 pid=2282->guuid=a119bd42-1b00-0000-fdd6-51d31c090000 pid=2332 execve guuid=2ecb1c43-1b00-0000-fdd6-51d31e090000 pid=2334 /usr/bin/wget net send-data guuid=f12cd425-1b00-0000-fdd6-51d3ea080000 pid=2282->guuid=2ecb1c43-1b00-0000-fdd6-51d31e090000 pid=2334 execve guuid=cb088f46-1b00-0000-fdd6-51d326090000 pid=2342 /usr/bin/curl net send-data write-file guuid=f12cd425-1b00-0000-fdd6-51d3ea080000 pid=2282->guuid=cb088f46-1b00-0000-fdd6-51d326090000 pid=2342 execve guuid=4d975856-1b00-0000-fdd6-51d334090000 pid=2356 /usr/bin/chmod guuid=f12cd425-1b00-0000-fdd6-51d3ea080000 pid=2282->guuid=4d975856-1b00-0000-fdd6-51d334090000 pid=2356 execve guuid=fcfec256-1b00-0000-fdd6-51d336090000 pid=2358 /usr/bin/bash guuid=f12cd425-1b00-0000-fdd6-51d3ea080000 pid=2282->guuid=fcfec256-1b00-0000-fdd6-51d336090000 pid=2358 clone guuid=02341e57-1b00-0000-fdd6-51d339090000 pid=2361 /usr/bin/rm delete-file guuid=f12cd425-1b00-0000-fdd6-51d3ea080000 pid=2282->guuid=02341e57-1b00-0000-fdd6-51d339090000 pid=2361 execve guuid=91808257-1b00-0000-fdd6-51d33b090000 pid=2363 /usr/bin/rm guuid=f12cd425-1b00-0000-fdd6-51d3ea080000 pid=2282->guuid=91808257-1b00-0000-fdd6-51d33b090000 pid=2363 execve guuid=bd53e057-1b00-0000-fdd6-51d33d090000 pid=2365 /usr/bin/wget net send-data guuid=f12cd425-1b00-0000-fdd6-51d3ea080000 pid=2282->guuid=bd53e057-1b00-0000-fdd6-51d33d090000 pid=2365 execve guuid=ea7dd25a-1b00-0000-fdd6-51d346090000 pid=2374 /usr/bin/curl net send-data write-file guuid=f12cd425-1b00-0000-fdd6-51d3ea080000 pid=2282->guuid=ea7dd25a-1b00-0000-fdd6-51d346090000 pid=2374 execve guuid=004e5a5f-1b00-0000-fdd6-51d350090000 pid=2384 /usr/bin/chmod guuid=f12cd425-1b00-0000-fdd6-51d3ea080000 pid=2282->guuid=004e5a5f-1b00-0000-fdd6-51d350090000 pid=2384 execve guuid=0e98a25f-1b00-0000-fdd6-51d351090000 pid=2385 /usr/bin/bash guuid=f12cd425-1b00-0000-fdd6-51d3ea080000 pid=2282->guuid=0e98a25f-1b00-0000-fdd6-51d351090000 pid=2385 clone guuid=1f70ef5f-1b00-0000-fdd6-51d354090000 pid=2388 /usr/bin/rm delete-file guuid=f12cd425-1b00-0000-fdd6-51d3ea080000 pid=2282->guuid=1f70ef5f-1b00-0000-fdd6-51d354090000 pid=2388 execve guuid=c9596360-1b00-0000-fdd6-51d355090000 pid=2389 /usr/bin/rm guuid=f12cd425-1b00-0000-fdd6-51d3ea080000 pid=2282->guuid=c9596360-1b00-0000-fdd6-51d355090000 pid=2389 execve guuid=ed12d260-1b00-0000-fdd6-51d356090000 pid=2390 /usr/bin/wget net send-data guuid=f12cd425-1b00-0000-fdd6-51d3ea080000 pid=2282->guuid=ed12d260-1b00-0000-fdd6-51d356090000 pid=2390 execve guuid=9f557363-1b00-0000-fdd6-51d35b090000 pid=2395 /usr/bin/curl net send-data write-file guuid=f12cd425-1b00-0000-fdd6-51d3ea080000 pid=2282->guuid=9f557363-1b00-0000-fdd6-51d35b090000 pid=2395 execve guuid=2f7d9468-1b00-0000-fdd6-51d365090000 pid=2405 /usr/bin/chmod guuid=f12cd425-1b00-0000-fdd6-51d3ea080000 pid=2282->guuid=2f7d9468-1b00-0000-fdd6-51d365090000 pid=2405 execve guuid=e3902869-1b00-0000-fdd6-51d366090000 pid=2406 /usr/bin/bash guuid=f12cd425-1b00-0000-fdd6-51d3ea080000 pid=2282->guuid=e3902869-1b00-0000-fdd6-51d366090000 pid=2406 clone guuid=d8348369-1b00-0000-fdd6-51d368090000 pid=2408 /usr/bin/rm delete-file guuid=f12cd425-1b00-0000-fdd6-51d3ea080000 pid=2282->guuid=d8348369-1b00-0000-fdd6-51d368090000 pid=2408 execve guuid=1ec1df69-1b00-0000-fdd6-51d369090000 pid=2409 /usr/bin/rm guuid=f12cd425-1b00-0000-fdd6-51d3ea080000 pid=2282->guuid=1ec1df69-1b00-0000-fdd6-51d369090000 pid=2409 execve guuid=468b396a-1b00-0000-fdd6-51d36a090000 pid=2410 /usr/bin/wget net send-data guuid=f12cd425-1b00-0000-fdd6-51d3ea080000 pid=2282->guuid=468b396a-1b00-0000-fdd6-51d36a090000 pid=2410 execve guuid=0d092c6d-1b00-0000-fdd6-51d370090000 pid=2416 /usr/bin/curl net send-data write-file guuid=f12cd425-1b00-0000-fdd6-51d3ea080000 pid=2282->guuid=0d092c6d-1b00-0000-fdd6-51d370090000 pid=2416 execve guuid=a0bb0b73-1b00-0000-fdd6-51d378090000 pid=2424 /usr/bin/chmod guuid=f12cd425-1b00-0000-fdd6-51d3ea080000 pid=2282->guuid=a0bb0b73-1b00-0000-fdd6-51d378090000 pid=2424 execve guuid=6c507f73-1b00-0000-fdd6-51d37a090000 pid=2426 /usr/bin/bash guuid=f12cd425-1b00-0000-fdd6-51d3ea080000 pid=2282->guuid=6c507f73-1b00-0000-fdd6-51d37a090000 pid=2426 clone guuid=8897d073-1b00-0000-fdd6-51d37d090000 pid=2429 /usr/bin/rm delete-file guuid=f12cd425-1b00-0000-fdd6-51d3ea080000 pid=2282->guuid=8897d073-1b00-0000-fdd6-51d37d090000 pid=2429 execve guuid=dce12774-1b00-0000-fdd6-51d37f090000 pid=2431 /usr/bin/rm guuid=f12cd425-1b00-0000-fdd6-51d3ea080000 pid=2282->guuid=dce12774-1b00-0000-fdd6-51d37f090000 pid=2431 execve guuid=f3cb6f74-1b00-0000-fdd6-51d381090000 pid=2433 /usr/bin/wget net send-data guuid=f12cd425-1b00-0000-fdd6-51d3ea080000 pid=2282->guuid=f3cb6f74-1b00-0000-fdd6-51d381090000 pid=2433 execve guuid=4ebe1b77-1b00-0000-fdd6-51d388090000 pid=2440 /usr/bin/curl net send-data write-file guuid=f12cd425-1b00-0000-fdd6-51d3ea080000 pid=2282->guuid=4ebe1b77-1b00-0000-fdd6-51d388090000 pid=2440 execve guuid=0caa5d82-1b00-0000-fdd6-51d3a4090000 pid=2468 /usr/bin/chmod guuid=f12cd425-1b00-0000-fdd6-51d3ea080000 pid=2282->guuid=0caa5d82-1b00-0000-fdd6-51d3a4090000 pid=2468 execve guuid=cd513583-1b00-0000-fdd6-51d3a7090000 pid=2471 /usr/bin/bash guuid=f12cd425-1b00-0000-fdd6-51d3ea080000 pid=2282->guuid=cd513583-1b00-0000-fdd6-51d3a7090000 pid=2471 clone guuid=11192d84-1b00-0000-fdd6-51d3ab090000 pid=2475 /usr/bin/rm delete-file guuid=f12cd425-1b00-0000-fdd6-51d3ea080000 pid=2282->guuid=11192d84-1b00-0000-fdd6-51d3ab090000 pid=2475 execve guuid=a79f1585-1b00-0000-fdd6-51d3ae090000 pid=2478 /usr/bin/rm guuid=f12cd425-1b00-0000-fdd6-51d3ea080000 pid=2282->guuid=a79f1585-1b00-0000-fdd6-51d3ae090000 pid=2478 execve guuid=cea7e085-1b00-0000-fdd6-51d3b1090000 pid=2481 /usr/bin/wget net send-data guuid=f12cd425-1b00-0000-fdd6-51d3ea080000 pid=2282->guuid=cea7e085-1b00-0000-fdd6-51d3b1090000 pid=2481 execve guuid=1183658b-1b00-0000-fdd6-51d3b7090000 pid=2487 /usr/bin/curl net send-data write-file guuid=f12cd425-1b00-0000-fdd6-51d3ea080000 pid=2282->guuid=1183658b-1b00-0000-fdd6-51d3b7090000 pid=2487 execve guuid=39939090-1b00-0000-fdd6-51d3bc090000 pid=2492 /usr/bin/chmod guuid=f12cd425-1b00-0000-fdd6-51d3ea080000 pid=2282->guuid=39939090-1b00-0000-fdd6-51d3bc090000 pid=2492 execve guuid=98bf9c91-1b00-0000-fdd6-51d3bf090000 pid=2495 /usr/bin/bash guuid=f12cd425-1b00-0000-fdd6-51d3ea080000 pid=2282->guuid=98bf9c91-1b00-0000-fdd6-51d3bf090000 pid=2495 clone guuid=ab548f92-1b00-0000-fdd6-51d3c3090000 pid=2499 /usr/bin/rm delete-file guuid=f12cd425-1b00-0000-fdd6-51d3ea080000 pid=2282->guuid=ab548f92-1b00-0000-fdd6-51d3c3090000 pid=2499 execve guuid=b301c193-1b00-0000-fdd6-51d3c6090000 pid=2502 /usr/bin/rm guuid=f12cd425-1b00-0000-fdd6-51d3ea080000 pid=2282->guuid=b301c193-1b00-0000-fdd6-51d3c6090000 pid=2502 execve guuid=4b10ce94-1b00-0000-fdd6-51d3c9090000 pid=2505 /usr/bin/wget net send-data guuid=f12cd425-1b00-0000-fdd6-51d3ea080000 pid=2282->guuid=4b10ce94-1b00-0000-fdd6-51d3c9090000 pid=2505 execve guuid=0f5d9998-1b00-0000-fdd6-51d3d1090000 pid=2513 /usr/bin/curl net send-data write-file guuid=f12cd425-1b00-0000-fdd6-51d3ea080000 pid=2282->guuid=0f5d9998-1b00-0000-fdd6-51d3d1090000 pid=2513 execve guuid=9ca4b29d-1b00-0000-fdd6-51d3d8090000 pid=2520 /usr/bin/chmod guuid=f12cd425-1b00-0000-fdd6-51d3ea080000 pid=2282->guuid=9ca4b29d-1b00-0000-fdd6-51d3d8090000 pid=2520 execve guuid=bbb6329e-1b00-0000-fdd6-51d3d9090000 pid=2521 /usr/bin/bash guuid=f12cd425-1b00-0000-fdd6-51d3ea080000 pid=2282->guuid=bbb6329e-1b00-0000-fdd6-51d3d9090000 pid=2521 clone guuid=17b9879e-1b00-0000-fdd6-51d3db090000 pid=2523 /usr/bin/rm delete-file guuid=f12cd425-1b00-0000-fdd6-51d3ea080000 pid=2282->guuid=17b9879e-1b00-0000-fdd6-51d3db090000 pid=2523 execve guuid=68caff9e-1b00-0000-fdd6-51d3dd090000 pid=2525 /usr/bin/rm guuid=f12cd425-1b00-0000-fdd6-51d3ea080000 pid=2282->guuid=68caff9e-1b00-0000-fdd6-51d3dd090000 pid=2525 execve guuid=33ab6e9f-1b00-0000-fdd6-51d3de090000 pid=2526 /usr/bin/wget net send-data guuid=f12cd425-1b00-0000-fdd6-51d3ea080000 pid=2282->guuid=33ab6e9f-1b00-0000-fdd6-51d3de090000 pid=2526 execve guuid=112482a2-1b00-0000-fdd6-51d3e6090000 pid=2534 /usr/bin/curl net send-data write-file guuid=f12cd425-1b00-0000-fdd6-51d3ea080000 pid=2282->guuid=112482a2-1b00-0000-fdd6-51d3e6090000 pid=2534 execve guuid=d3da66aa-1b00-0000-fdd6-51d3f8090000 pid=2552 /usr/bin/chmod guuid=f12cd425-1b00-0000-fdd6-51d3ea080000 pid=2282->guuid=d3da66aa-1b00-0000-fdd6-51d3f8090000 pid=2552 execve guuid=aac4d3aa-1b00-0000-fdd6-51d3fa090000 pid=2554 /usr/bin/bash guuid=f12cd425-1b00-0000-fdd6-51d3ea080000 pid=2282->guuid=aac4d3aa-1b00-0000-fdd6-51d3fa090000 pid=2554 clone guuid=873b27ab-1b00-0000-fdd6-51d3fc090000 pid=2556 /usr/bin/rm delete-file guuid=f12cd425-1b00-0000-fdd6-51d3ea080000 pid=2282->guuid=873b27ab-1b00-0000-fdd6-51d3fc090000 pid=2556 execve guuid=e6a998ab-1b00-0000-fdd6-51d3fe090000 pid=2558 /usr/bin/rm guuid=f12cd425-1b00-0000-fdd6-51d3ea080000 pid=2282->guuid=e6a998ab-1b00-0000-fdd6-51d3fe090000 pid=2558 execve guuid=4d1b03ac-1b00-0000-fdd6-51d3000a0000 pid=2560 /usr/bin/wget net send-data guuid=f12cd425-1b00-0000-fdd6-51d3ea080000 pid=2282->guuid=4d1b03ac-1b00-0000-fdd6-51d3000a0000 pid=2560 execve guuid=660eddaf-1b00-0000-fdd6-51d3070a0000 pid=2567 /usr/bin/curl net send-data write-file guuid=f12cd425-1b00-0000-fdd6-51d3ea080000 pid=2282->guuid=660eddaf-1b00-0000-fdd6-51d3070a0000 pid=2567 execve guuid=80878fb6-1b00-0000-fdd6-51d3190a0000 pid=2585 /usr/bin/chmod guuid=f12cd425-1b00-0000-fdd6-51d3ea080000 pid=2282->guuid=80878fb6-1b00-0000-fdd6-51d3190a0000 pid=2585 execve guuid=6a2009b7-1b00-0000-fdd6-51d31b0a0000 pid=2587 /usr/bin/bash guuid=f12cd425-1b00-0000-fdd6-51d3ea080000 pid=2282->guuid=6a2009b7-1b00-0000-fdd6-51d31b0a0000 pid=2587 clone guuid=2fb847b7-1b00-0000-fdd6-51d31e0a0000 pid=2590 /usr/bin/rm delete-file guuid=f12cd425-1b00-0000-fdd6-51d3ea080000 pid=2282->guuid=2fb847b7-1b00-0000-fdd6-51d31e0a0000 pid=2590 execve guuid=45509db7-1b00-0000-fdd6-51d31f0a0000 pid=2591 /usr/bin/rm guuid=f12cd425-1b00-0000-fdd6-51d3ea080000 pid=2282->guuid=45509db7-1b00-0000-fdd6-51d31f0a0000 pid=2591 execve guuid=e066fcb7-1b00-0000-fdd6-51d3210a0000 pid=2593 /usr/bin/wget net send-data guuid=f12cd425-1b00-0000-fdd6-51d3ea080000 pid=2282->guuid=e066fcb7-1b00-0000-fdd6-51d3210a0000 pid=2593 execve guuid=96201ebb-1b00-0000-fdd6-51d32a0a0000 pid=2602 /usr/bin/curl net send-data write-file guuid=f12cd425-1b00-0000-fdd6-51d3ea080000 pid=2282->guuid=96201ebb-1b00-0000-fdd6-51d32a0a0000 pid=2602 execve guuid=9be35fbf-1b00-0000-fdd6-51d3350a0000 pid=2613 /usr/bin/chmod guuid=f12cd425-1b00-0000-fdd6-51d3ea080000 pid=2282->guuid=9be35fbf-1b00-0000-fdd6-51d3350a0000 pid=2613 execve guuid=373bd3bf-1b00-0000-fdd6-51d3360a0000 pid=2614 /usr/bin/bash guuid=f12cd425-1b00-0000-fdd6-51d3ea080000 pid=2282->guuid=373bd3bf-1b00-0000-fdd6-51d3360a0000 pid=2614 clone guuid=60ba23c0-1b00-0000-fdd6-51d3380a0000 pid=2616 /usr/bin/rm delete-file guuid=f12cd425-1b00-0000-fdd6-51d3ea080000 pid=2282->guuid=60ba23c0-1b00-0000-fdd6-51d3380a0000 pid=2616 execve guuid=c72495c0-1b00-0000-fdd6-51d33a0a0000 pid=2618 /usr/bin/rm guuid=f12cd425-1b00-0000-fdd6-51d3ea080000 pid=2282->guuid=c72495c0-1b00-0000-fdd6-51d33a0a0000 pid=2618 execve 5b654972-c9e1-50d8-b372-2dc2a5b9ad66 5.182.210.174:80 guuid=69cb2826-1b00-0000-fdd6-51d3eb080000 pid=2283->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=f4cdc22d-1b00-0000-fdd6-51d3f3080000 pid=2291->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=19ded936-1b00-0000-fdd6-51d301090000 pid=2305 /usr/bin/bash guuid=0cd5c136-1b00-0000-fdd6-51d300090000 pid=2304->guuid=19ded936-1b00-0000-fdd6-51d301090000 pid=2305 clone guuid=33930938-1b00-0000-fdd6-51d306090000 pid=2310->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=b6e74b3b-1b00-0000-fdd6-51d30d090000 pid=2317->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=5b742642-1b00-0000-fdd6-51d319090000 pid=2329 /usr/bin/bash guuid=9b860142-1b00-0000-fdd6-51d318090000 pid=2328->guuid=5b742642-1b00-0000-fdd6-51d319090000 pid=2329 clone guuid=2ecb1c43-1b00-0000-fdd6-51d31e090000 pid=2334->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=cb088f46-1b00-0000-fdd6-51d326090000 pid=2342->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=5905e756-1b00-0000-fdd6-51d338090000 pid=2360 /usr/bin/bash guuid=fcfec256-1b00-0000-fdd6-51d336090000 pid=2358->guuid=5905e756-1b00-0000-fdd6-51d338090000 pid=2360 clone guuid=bd53e057-1b00-0000-fdd6-51d33d090000 pid=2365->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=ea7dd25a-1b00-0000-fdd6-51d346090000 pid=2374->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=58edb75f-1b00-0000-fdd6-51d353090000 pid=2387 /usr/bin/bash guuid=0e98a25f-1b00-0000-fdd6-51d351090000 pid=2385->guuid=58edb75f-1b00-0000-fdd6-51d353090000 pid=2387 clone guuid=ed12d260-1b00-0000-fdd6-51d356090000 pid=2390->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=9f557363-1b00-0000-fdd6-51d35b090000 pid=2395->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=60e74b69-1b00-0000-fdd6-51d367090000 pid=2407 /usr/bin/bash guuid=e3902869-1b00-0000-fdd6-51d366090000 pid=2406->guuid=60e74b69-1b00-0000-fdd6-51d367090000 pid=2407 clone guuid=468b396a-1b00-0000-fdd6-51d36a090000 pid=2410->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=0d092c6d-1b00-0000-fdd6-51d370090000 pid=2416->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=20519e73-1b00-0000-fdd6-51d37b090000 pid=2427 /usr/bin/bash guuid=6c507f73-1b00-0000-fdd6-51d37a090000 pid=2426->guuid=20519e73-1b00-0000-fdd6-51d37b090000 pid=2427 clone guuid=f3cb6f74-1b00-0000-fdd6-51d381090000 pid=2433->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=4ebe1b77-1b00-0000-fdd6-51d388090000 pid=2440->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=0abbb383-1b00-0000-fdd6-51d3aa090000 pid=2474 /usr/bin/bash guuid=cd513583-1b00-0000-fdd6-51d3a7090000 pid=2471->guuid=0abbb383-1b00-0000-fdd6-51d3aa090000 pid=2474 clone guuid=cea7e085-1b00-0000-fdd6-51d3b1090000 pid=2481->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=1183658b-1b00-0000-fdd6-51d3b7090000 pid=2487->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=d3470392-1b00-0000-fdd6-51d3c1090000 pid=2497 /usr/bin/bash guuid=98bf9c91-1b00-0000-fdd6-51d3bf090000 pid=2495->guuid=d3470392-1b00-0000-fdd6-51d3c1090000 pid=2497 clone guuid=4b10ce94-1b00-0000-fdd6-51d3c9090000 pid=2505->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=0f5d9998-1b00-0000-fdd6-51d3d1090000 pid=2513->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=e56d599e-1b00-0000-fdd6-51d3da090000 pid=2522 /usr/bin/bash guuid=bbb6329e-1b00-0000-fdd6-51d3d9090000 pid=2521->guuid=e56d599e-1b00-0000-fdd6-51d3da090000 pid=2522 clone guuid=33ab6e9f-1b00-0000-fdd6-51d3de090000 pid=2526->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=112482a2-1b00-0000-fdd6-51d3e6090000 pid=2534->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=04c6f8aa-1b00-0000-fdd6-51d3fb090000 pid=2555 /usr/bin/bash guuid=aac4d3aa-1b00-0000-fdd6-51d3fa090000 pid=2554->guuid=04c6f8aa-1b00-0000-fdd6-51d3fb090000 pid=2555 clone guuid=4d1b03ac-1b00-0000-fdd6-51d3000a0000 pid=2560->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=660eddaf-1b00-0000-fdd6-51d3070a0000 pid=2567->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=19b128b7-1b00-0000-fdd6-51d31c0a0000 pid=2588 /usr/bin/bash guuid=6a2009b7-1b00-0000-fdd6-51d31b0a0000 pid=2587->guuid=19b128b7-1b00-0000-fdd6-51d31c0a0000 pid=2588 clone guuid=e066fcb7-1b00-0000-fdd6-51d3210a0000 pid=2593->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=96201ebb-1b00-0000-fdd6-51d32a0a0000 pid=2602->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=5a76f7bf-1b00-0000-fdd6-51d3370a0000 pid=2615 /usr/bin/bash guuid=373bd3bf-1b00-0000-fdd6-51d3360a0000 pid=2614->guuid=5a76f7bf-1b00-0000-fdd6-51d3370a0000 pid=2615 clone
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/b59075c2da6a7f8e093a6ddc8f48d77244c8fc7330e66f767d99bdbe9fcb8006
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b59075c2da6a7f8e093a6ddc8f48d77244c8fc7330e66f767d99bdbe9fcb8006/
Threat name:
Linux.Downloader.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-08-21 02:38:14 UTC
File Type:
Text (Shell)
AV detection:
13 of 36 (36.11%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wwihlqw2nj7y4cj2nxoi6sgxojcmr7dtgdtg65t5tg635h6lqada._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260821-c4s1la1elc/
Behaviour
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.11
Link:
https://yomi.yoroi.company/submissions/b59075c2da6a7f8e093a6ddc8f48d77244c8fc7330e66f767d99bdbe9fcb8006

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh b59075c2da6a7f8e093a6ddc8f48d77244c8fc7330e66f767d99bdbe9fcb8006

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3897671/
  
Delivery method
Distributed via web download

Comments