MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b9b0d9654fea3fd034fa62ae3d8805379c8c7fe5168b7c44f2f55702e541e72e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b9b0d9654fea3fd034fa62ae3d8805379c8c7fe5168b7c44f2f55702e541e72e
SHA3-384 hash: 2dcfcc7c03d701a4e06997de5888c7841d30cf9ca2e82fb051f911e4f691e6a7e47126bb57ec8dafcb17fde0aeb78a75
SHA1 hash: 0faf952a07bbb7de84aa6ff0c78e9884e83eb403
MD5 hash: f9004f27af6dad07b76401a1239eba15
humanhash: zulu-maryland-dakota-enemy
File name:b9b0d9654fea3fd034fa62ae3d8805379c8c7fe5168b7c44f2f55702e541e72e
Download: download sample
File size:1'584 bytes
First seen:2026-07-27 12:01:04 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 12:Ut6Yc0X76IZXDfSwW69BAJaIvQr6v2Ex1wcr6qvULwxq6xQMUAkDnT6nLtTwI5YX:mXZXDSqBEOHEx11LvYWLFwcY8NKYKNLB
TLSH T1243161DE042019395716CBDE7363764CA21CC1FB2DDBCBA488594EAA83881CCB662F81
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter Anonymous
Tags:cowrie hermes-noc honeypot sh


Avatar
Anonymous
Captured by Hermes-NOC Cowrie SSH honeypot
URLMalware sample (SHA256 hash)SignatureTags
http://5.182.210.61/81d631n/an/aua-wget
http://5.182.210.61/f1ed24n/an/aua-wget
http://5.182.210.61/599506n/an/aua-wget
http://5.182.210.61/332a0cn/an/aua-wget
http://5.182.210.61/370ad5n/an/aua-wget
http://5.182.210.61/2051fbn/an/aua-wget
http://5.182.210.61/2297afn/an/aua-wget
http://5.182.210.61/b07ab1n/an/aua-wget
http://5.182.210.61/2573fdn/an/aua-wget
http://5.182.210.61/156c25n/an/aua-wget
http://5.182.210.61/2864e0n/an/aua-wget
http://5.182.210.61/3cbe86n/an/aua-wget

Intelligence

File Origin
# of uploads :
1
# of downloads :
52
Origin country :
NL NL
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive mirai
Link:
https://www.filescan.io/uploads/6a67488fa9fd1fefd14f88be/reports/7c7a4679-7246-492e-8e7c-ead91bed07f5/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-07-27T10:40:00Z UTC
Last seen:
2026-07-27T11:01:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/b9b0d9654fea3fd034fa62ae3d8805379c8c7fe5168b7c44f2f55702e541e72e/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/31c2922c-ee9d-408e-b678-ac6120b6392f
Behavior Graph:
Download SVG
%3 guuid=eedb85b2-1600-0000-3f90-1b92820c0000 pid=3202 /usr/bin/sudo guuid=f6cca9b6-1600-0000-3f90-1b92870c0000 pid=3207 /tmp/sample.bin guuid=eedb85b2-1600-0000-3f90-1b92820c0000 pid=3202->guuid=f6cca9b6-1600-0000-3f90-1b92870c0000 pid=3207 execve guuid=5bf12eb7-1600-0000-3f90-1b92880c0000 pid=3208 /usr/bin/wget net send-data guuid=f6cca9b6-1600-0000-3f90-1b92870c0000 pid=3207->guuid=5bf12eb7-1600-0000-3f90-1b92880c0000 pid=3208 execve guuid=aac708bc-1600-0000-3f90-1b92890c0000 pid=3209 /usr/bin/curl net send-data write-file guuid=f6cca9b6-1600-0000-3f90-1b92870c0000 pid=3207->guuid=aac708bc-1600-0000-3f90-1b92890c0000 pid=3209 execve guuid=b6eb79c5-1600-0000-3f90-1b92960c0000 pid=3222 /usr/bin/chmod guuid=f6cca9b6-1600-0000-3f90-1b92870c0000 pid=3207->guuid=b6eb79c5-1600-0000-3f90-1b92960c0000 pid=3222 execve guuid=cf13eac5-1600-0000-3f90-1b92970c0000 pid=3223 /usr/bin/bash guuid=f6cca9b6-1600-0000-3f90-1b92870c0000 pid=3207->guuid=cf13eac5-1600-0000-3f90-1b92970c0000 pid=3223 clone guuid=7cb057c6-1600-0000-3f90-1b929a0c0000 pid=3226 /usr/bin/rm delete-file guuid=f6cca9b6-1600-0000-3f90-1b92870c0000 pid=3207->guuid=7cb057c6-1600-0000-3f90-1b929a0c0000 pid=3226 execve guuid=3185a7c6-1600-0000-3f90-1b929c0c0000 pid=3228 /usr/bin/rm guuid=f6cca9b6-1600-0000-3f90-1b92870c0000 pid=3207->guuid=3185a7c6-1600-0000-3f90-1b929c0c0000 pid=3228 execve guuid=de8600c7-1600-0000-3f90-1b929e0c0000 pid=3230 /usr/bin/wget net send-data guuid=f6cca9b6-1600-0000-3f90-1b92870c0000 pid=3207->guuid=de8600c7-1600-0000-3f90-1b929e0c0000 pid=3230 execve guuid=ca30efc9-1600-0000-3f90-1b92a80c0000 pid=3240 /usr/bin/curl net send-data write-file guuid=f6cca9b6-1600-0000-3f90-1b92870c0000 pid=3207->guuid=ca30efc9-1600-0000-3f90-1b92a80c0000 pid=3240 execve guuid=6a1ed4ce-1600-0000-3f90-1b92b70c0000 pid=3255 /usr/bin/chmod guuid=f6cca9b6-1600-0000-3f90-1b92870c0000 pid=3207->guuid=6a1ed4ce-1600-0000-3f90-1b92b70c0000 pid=3255 execve guuid=987e23cf-1600-0000-3f90-1b92b90c0000 pid=3257 /usr/bin/bash guuid=f6cca9b6-1600-0000-3f90-1b92870c0000 pid=3207->guuid=987e23cf-1600-0000-3f90-1b92b90c0000 pid=3257 clone guuid=9f65eccf-1600-0000-3f90-1b92be0c0000 pid=3262 /usr/bin/rm delete-file guuid=f6cca9b6-1600-0000-3f90-1b92870c0000 pid=3207->guuid=9f65eccf-1600-0000-3f90-1b92be0c0000 pid=3262 execve guuid=b78bcad0-1600-0000-3f90-1b92c20c0000 pid=3266 /usr/bin/rm guuid=f6cca9b6-1600-0000-3f90-1b92870c0000 pid=3207->guuid=b78bcad0-1600-0000-3f90-1b92c20c0000 pid=3266 execve guuid=3f7914d1-1600-0000-3f90-1b92c30c0000 pid=3267 /usr/bin/wget net send-data guuid=f6cca9b6-1600-0000-3f90-1b92870c0000 pid=3207->guuid=3f7914d1-1600-0000-3f90-1b92c30c0000 pid=3267 execve guuid=1acae9d4-1600-0000-3f90-1b92cf0c0000 pid=3279 /usr/bin/curl net send-data write-file guuid=f6cca9b6-1600-0000-3f90-1b92870c0000 pid=3207->guuid=1acae9d4-1600-0000-3f90-1b92cf0c0000 pid=3279 execve guuid=96d51bd8-1600-0000-3f90-1b92da0c0000 pid=3290 /usr/bin/chmod guuid=f6cca9b6-1600-0000-3f90-1b92870c0000 pid=3207->guuid=96d51bd8-1600-0000-3f90-1b92da0c0000 pid=3290 execve guuid=5ec15cd8-1600-0000-3f90-1b92dc0c0000 pid=3292 /usr/bin/bash guuid=f6cca9b6-1600-0000-3f90-1b92870c0000 pid=3207->guuid=5ec15cd8-1600-0000-3f90-1b92dc0c0000 pid=3292 clone guuid=44e293d8-1600-0000-3f90-1b92df0c0000 pid=3295 /usr/bin/rm delete-file guuid=f6cca9b6-1600-0000-3f90-1b92870c0000 pid=3207->guuid=44e293d8-1600-0000-3f90-1b92df0c0000 pid=3295 execve guuid=90ccd7d8-1600-0000-3f90-1b92e10c0000 pid=3297 /usr/bin/rm guuid=f6cca9b6-1600-0000-3f90-1b92870c0000 pid=3207->guuid=90ccd7d8-1600-0000-3f90-1b92e10c0000 pid=3297 execve guuid=288c19d9-1600-0000-3f90-1b92e30c0000 pid=3299 /usr/bin/wget net send-data guuid=f6cca9b6-1600-0000-3f90-1b92870c0000 pid=3207->guuid=288c19d9-1600-0000-3f90-1b92e30c0000 pid=3299 execve guuid=5e527edb-1600-0000-3f90-1b92eb0c0000 pid=3307 /usr/bin/curl net send-data write-file guuid=f6cca9b6-1600-0000-3f90-1b92870c0000 pid=3207->guuid=5e527edb-1600-0000-3f90-1b92eb0c0000 pid=3307 execve guuid=d1801ee3-1600-0000-3f90-1b92ff0c0000 pid=3327 /usr/bin/chmod guuid=f6cca9b6-1600-0000-3f90-1b92870c0000 pid=3207->guuid=d1801ee3-1600-0000-3f90-1b92ff0c0000 pid=3327 execve guuid=1fc25ee3-1600-0000-3f90-1b92010d0000 pid=3329 /usr/bin/bash guuid=f6cca9b6-1600-0000-3f90-1b92870c0000 pid=3207->guuid=1fc25ee3-1600-0000-3f90-1b92010d0000 pid=3329 clone guuid=c8988de3-1600-0000-3f90-1b92030d0000 pid=3331 /usr/bin/rm delete-file guuid=f6cca9b6-1600-0000-3f90-1b92870c0000 pid=3207->guuid=c8988de3-1600-0000-3f90-1b92030d0000 pid=3331 execve guuid=3fb8c4e3-1600-0000-3f90-1b92050d0000 pid=3333 /usr/bin/rm guuid=f6cca9b6-1600-0000-3f90-1b92870c0000 pid=3207->guuid=3fb8c4e3-1600-0000-3f90-1b92050d0000 pid=3333 execve guuid=a34afae3-1600-0000-3f90-1b92070d0000 pid=3335 /usr/bin/wget net send-data guuid=f6cca9b6-1600-0000-3f90-1b92870c0000 pid=3207->guuid=a34afae3-1600-0000-3f90-1b92070d0000 pid=3335 execve guuid=49948ae6-1600-0000-3f90-1b92120d0000 pid=3346 /usr/bin/curl net send-data write-file guuid=f6cca9b6-1600-0000-3f90-1b92870c0000 pid=3207->guuid=49948ae6-1600-0000-3f90-1b92120d0000 pid=3346 execve guuid=908b14ea-1600-0000-3f90-1b921f0d0000 pid=3359 /usr/bin/chmod guuid=f6cca9b6-1600-0000-3f90-1b92870c0000 pid=3207->guuid=908b14ea-1600-0000-3f90-1b921f0d0000 pid=3359 execve guuid=eeea57ea-1600-0000-3f90-1b92210d0000 pid=3361 /usr/bin/bash guuid=f6cca9b6-1600-0000-3f90-1b92870c0000 pid=3207->guuid=eeea57ea-1600-0000-3f90-1b92210d0000 pid=3361 clone guuid=d93e8cea-1600-0000-3f90-1b92240d0000 pid=3364 /usr/bin/rm delete-file guuid=f6cca9b6-1600-0000-3f90-1b92870c0000 pid=3207->guuid=d93e8cea-1600-0000-3f90-1b92240d0000 pid=3364 execve guuid=c93acdea-1600-0000-3f90-1b92260d0000 pid=3366 /usr/bin/rm guuid=f6cca9b6-1600-0000-3f90-1b92870c0000 pid=3207->guuid=c93acdea-1600-0000-3f90-1b92260d0000 pid=3366 execve guuid=ab820beb-1600-0000-3f90-1b92280d0000 pid=3368 /usr/bin/wget net send-data guuid=f6cca9b6-1600-0000-3f90-1b92870c0000 pid=3207->guuid=ab820beb-1600-0000-3f90-1b92280d0000 pid=3368 execve guuid=96df86ed-1600-0000-3f90-1b92330d0000 pid=3379 /usr/bin/curl net send-data write-file guuid=f6cca9b6-1600-0000-3f90-1b92870c0000 pid=3207->guuid=96df86ed-1600-0000-3f90-1b92330d0000 pid=3379 execve guuid=cc7422f2-1600-0000-3f90-1b92470d0000 pid=3399 /usr/bin/chmod guuid=f6cca9b6-1600-0000-3f90-1b92870c0000 pid=3207->guuid=cc7422f2-1600-0000-3f90-1b92470d0000 pid=3399 execve guuid=b2355cf2-1600-0000-3f90-1b92490d0000 pid=3401 /usr/bin/bash guuid=f6cca9b6-1600-0000-3f90-1b92870c0000 pid=3207->guuid=b2355cf2-1600-0000-3f90-1b92490d0000 pid=3401 clone guuid=3f738ef2-1600-0000-3f90-1b924c0d0000 pid=3404 /usr/bin/rm delete-file guuid=f6cca9b6-1600-0000-3f90-1b92870c0000 pid=3207->guuid=3f738ef2-1600-0000-3f90-1b924c0d0000 pid=3404 execve guuid=b9b4e2f2-1600-0000-3f90-1b924e0d0000 pid=3406 /usr/bin/rm guuid=f6cca9b6-1600-0000-3f90-1b92870c0000 pid=3207->guuid=b9b4e2f2-1600-0000-3f90-1b924e0d0000 pid=3406 execve guuid=ae262bf3-1600-0000-3f90-1b92500d0000 pid=3408 /usr/bin/wget net send-data guuid=f6cca9b6-1600-0000-3f90-1b92870c0000 pid=3207->guuid=ae262bf3-1600-0000-3f90-1b92500d0000 pid=3408 execve guuid=0fceb6f5-1600-0000-3f90-1b92560d0000 pid=3414 /usr/bin/curl net send-data write-file guuid=f6cca9b6-1600-0000-3f90-1b92870c0000 pid=3207->guuid=0fceb6f5-1600-0000-3f90-1b92560d0000 pid=3414 execve guuid=9e8d8af9-1600-0000-3f90-1b925c0d0000 pid=3420 /usr/bin/chmod guuid=f6cca9b6-1600-0000-3f90-1b92870c0000 pid=3207->guuid=9e8d8af9-1600-0000-3f90-1b925c0d0000 pid=3420 execve guuid=f3cd38fa-1600-0000-3f90-1b925f0d0000 pid=3423 /usr/bin/bash guuid=f6cca9b6-1600-0000-3f90-1b92870c0000 pid=3207->guuid=f3cd38fa-1600-0000-3f90-1b925f0d0000 pid=3423 clone guuid=aba26dfa-1600-0000-3f90-1b92620d0000 pid=3426 /usr/bin/rm delete-file guuid=f6cca9b6-1600-0000-3f90-1b92870c0000 pid=3207->guuid=aba26dfa-1600-0000-3f90-1b92620d0000 pid=3426 execve guuid=eb233efb-1600-0000-3f90-1b92670d0000 pid=3431 /usr/bin/rm guuid=f6cca9b6-1600-0000-3f90-1b92870c0000 pid=3207->guuid=eb233efb-1600-0000-3f90-1b92670d0000 pid=3431 execve guuid=3cc5e8fb-1600-0000-3f90-1b92690d0000 pid=3433 /usr/bin/wget net send-data guuid=f6cca9b6-1600-0000-3f90-1b92870c0000 pid=3207->guuid=3cc5e8fb-1600-0000-3f90-1b92690d0000 pid=3433 execve guuid=a6209afe-1600-0000-3f90-1b926f0d0000 pid=3439 /usr/bin/curl net send-data write-file guuid=f6cca9b6-1600-0000-3f90-1b92870c0000 pid=3207->guuid=a6209afe-1600-0000-3f90-1b926f0d0000 pid=3439 execve guuid=e6fd2906-1700-0000-3f90-1b927b0d0000 pid=3451 /usr/bin/chmod guuid=f6cca9b6-1600-0000-3f90-1b92870c0000 pid=3207->guuid=e6fd2906-1700-0000-3f90-1b927b0d0000 pid=3451 execve guuid=ecad8706-1700-0000-3f90-1b927d0d0000 pid=3453 /usr/bin/bash guuid=f6cca9b6-1600-0000-3f90-1b92870c0000 pid=3207->guuid=ecad8706-1700-0000-3f90-1b927d0d0000 pid=3453 clone guuid=37b3d106-1700-0000-3f90-1b92800d0000 pid=3456 /usr/bin/rm delete-file guuid=f6cca9b6-1600-0000-3f90-1b92870c0000 pid=3207->guuid=37b3d106-1700-0000-3f90-1b92800d0000 pid=3456 execve guuid=4efc2c07-1700-0000-3f90-1b92810d0000 pid=3457 /usr/bin/rm guuid=f6cca9b6-1600-0000-3f90-1b92870c0000 pid=3207->guuid=4efc2c07-1700-0000-3f90-1b92810d0000 pid=3457 execve guuid=cc448907-1700-0000-3f90-1b92830d0000 pid=3459 /usr/bin/wget net send-data guuid=f6cca9b6-1600-0000-3f90-1b92870c0000 pid=3207->guuid=cc448907-1700-0000-3f90-1b92830d0000 pid=3459 execve guuid=a56d820a-1700-0000-3f90-1b92890d0000 pid=3465 /usr/bin/curl net send-data write-file guuid=f6cca9b6-1600-0000-3f90-1b92870c0000 pid=3207->guuid=a56d820a-1700-0000-3f90-1b92890d0000 pid=3465 execve guuid=d7c51610-1700-0000-3f90-1b92940d0000 pid=3476 /usr/bin/chmod guuid=f6cca9b6-1600-0000-3f90-1b92870c0000 pid=3207->guuid=d7c51610-1700-0000-3f90-1b92940d0000 pid=3476 execve guuid=3eb08110-1700-0000-3f90-1b92960d0000 pid=3478 /usr/bin/bash guuid=f6cca9b6-1600-0000-3f90-1b92870c0000 pid=3207->guuid=3eb08110-1700-0000-3f90-1b92960d0000 pid=3478 clone guuid=77d0d410-1700-0000-3f90-1b92990d0000 pid=3481 /usr/bin/rm delete-file guuid=f6cca9b6-1600-0000-3f90-1b92870c0000 pid=3207->guuid=77d0d410-1700-0000-3f90-1b92990d0000 pid=3481 execve guuid=90752f11-1700-0000-3f90-1b929b0d0000 pid=3483 /usr/bin/rm guuid=f6cca9b6-1600-0000-3f90-1b92870c0000 pid=3207->guuid=90752f11-1700-0000-3f90-1b929b0d0000 pid=3483 execve guuid=ff758911-1700-0000-3f90-1b929d0d0000 pid=3485 /usr/bin/wget net send-data guuid=f6cca9b6-1600-0000-3f90-1b92870c0000 pid=3207->guuid=ff758911-1700-0000-3f90-1b929d0d0000 pid=3485 execve guuid=e43b5014-1700-0000-3f90-1b92a50d0000 pid=3493 /usr/bin/curl net send-data write-file guuid=f6cca9b6-1600-0000-3f90-1b92870c0000 pid=3207->guuid=e43b5014-1700-0000-3f90-1b92a50d0000 pid=3493 execve guuid=1dce2119-1700-0000-3f90-1b92b30d0000 pid=3507 /usr/bin/chmod guuid=f6cca9b6-1600-0000-3f90-1b92870c0000 pid=3207->guuid=1dce2119-1700-0000-3f90-1b92b30d0000 pid=3507 execve guuid=03dbb219-1700-0000-3f90-1b92b50d0000 pid=3509 /usr/bin/bash guuid=f6cca9b6-1600-0000-3f90-1b92870c0000 pid=3207->guuid=03dbb219-1700-0000-3f90-1b92b50d0000 pid=3509 clone guuid=e82efd19-1700-0000-3f90-1b92b70d0000 pid=3511 /usr/bin/rm delete-file guuid=f6cca9b6-1600-0000-3f90-1b92870c0000 pid=3207->guuid=e82efd19-1700-0000-3f90-1b92b70d0000 pid=3511 execve guuid=4ace541a-1700-0000-3f90-1b92b80d0000 pid=3512 /usr/bin/rm guuid=f6cca9b6-1600-0000-3f90-1b92870c0000 pid=3207->guuid=4ace541a-1700-0000-3f90-1b92b80d0000 pid=3512 execve guuid=74d9f81a-1700-0000-3f90-1b92bb0d0000 pid=3515 /usr/bin/wget net send-data guuid=f6cca9b6-1600-0000-3f90-1b92870c0000 pid=3207->guuid=74d9f81a-1700-0000-3f90-1b92bb0d0000 pid=3515 execve guuid=45240b1e-1700-0000-3f90-1b92c30d0000 pid=3523 /usr/bin/curl net send-data write-file guuid=f6cca9b6-1600-0000-3f90-1b92870c0000 pid=3207->guuid=45240b1e-1700-0000-3f90-1b92c30d0000 pid=3523 execve guuid=4472d523-1700-0000-3f90-1b92d20d0000 pid=3538 /usr/bin/chmod guuid=f6cca9b6-1600-0000-3f90-1b92870c0000 pid=3207->guuid=4472d523-1700-0000-3f90-1b92d20d0000 pid=3538 execve guuid=58d65124-1700-0000-3f90-1b92d50d0000 pid=3541 /usr/bin/bash guuid=f6cca9b6-1600-0000-3f90-1b92870c0000 pid=3207->guuid=58d65124-1700-0000-3f90-1b92d50d0000 pid=3541 clone guuid=98afaa24-1700-0000-3f90-1b92d70d0000 pid=3543 /usr/bin/rm delete-file guuid=f6cca9b6-1600-0000-3f90-1b92870c0000 pid=3207->guuid=98afaa24-1700-0000-3f90-1b92d70d0000 pid=3543 execve guuid=d1782025-1700-0000-3f90-1b92da0d0000 pid=3546 /usr/bin/rm guuid=f6cca9b6-1600-0000-3f90-1b92870c0000 pid=3207->guuid=d1782025-1700-0000-3f90-1b92da0d0000 pid=3546 execve guuid=fa428025-1700-0000-3f90-1b92dc0d0000 pid=3548 /usr/bin/wget net send-data guuid=f6cca9b6-1600-0000-3f90-1b92870c0000 pid=3207->guuid=fa428025-1700-0000-3f90-1b92dc0d0000 pid=3548 execve guuid=b820b628-1700-0000-3f90-1b92e50d0000 pid=3557 /usr/bin/curl net send-data write-file guuid=f6cca9b6-1600-0000-3f90-1b92870c0000 pid=3207->guuid=b820b628-1700-0000-3f90-1b92e50d0000 pid=3557 execve guuid=fe6fc535-1700-0000-3f90-1b92070e0000 pid=3591 /usr/bin/chmod guuid=f6cca9b6-1600-0000-3f90-1b92870c0000 pid=3207->guuid=fe6fc535-1700-0000-3f90-1b92070e0000 pid=3591 execve guuid=401f0936-1700-0000-3f90-1b92090e0000 pid=3593 /usr/bin/bash guuid=f6cca9b6-1600-0000-3f90-1b92870c0000 pid=3207->guuid=401f0936-1700-0000-3f90-1b92090e0000 pid=3593 clone guuid=2ae84536-1700-0000-3f90-1b920c0e0000 pid=3596 /usr/bin/rm delete-file guuid=f6cca9b6-1600-0000-3f90-1b92870c0000 pid=3207->guuid=2ae84536-1700-0000-3f90-1b920c0e0000 pid=3596 execve guuid=51999136-1700-0000-3f90-1b920e0e0000 pid=3598 /usr/bin/rm guuid=f6cca9b6-1600-0000-3f90-1b92870c0000 pid=3207->guuid=51999136-1700-0000-3f90-1b920e0e0000 pid=3598 execve 9e33e6d7-6ac7-5a65-88f4-941337e56821 5.182.210.61:80 guuid=5bf12eb7-1600-0000-3f90-1b92880c0000 pid=3208->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=aac708bc-1600-0000-3f90-1b92890c0000 pid=3209->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=e71618c6-1600-0000-3f90-1b92980c0000 pid=3224 /usr/bin/bash guuid=cf13eac5-1600-0000-3f90-1b92970c0000 pid=3223->guuid=e71618c6-1600-0000-3f90-1b92980c0000 pid=3224 clone guuid=de8600c7-1600-0000-3f90-1b929e0c0000 pid=3230->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=ca30efc9-1600-0000-3f90-1b92a80c0000 pid=3240->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=08a061cf-1600-0000-3f90-1b92bb0c0000 pid=3259 /usr/bin/bash guuid=987e23cf-1600-0000-3f90-1b92b90c0000 pid=3257->guuid=08a061cf-1600-0000-3f90-1b92bb0c0000 pid=3259 clone guuid=3f7914d1-1600-0000-3f90-1b92c30c0000 pid=3267->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=1acae9d4-1600-0000-3f90-1b92cf0c0000 pid=3279->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=c8ab77d8-1600-0000-3f90-1b92de0c0000 pid=3294 /usr/bin/bash guuid=5ec15cd8-1600-0000-3f90-1b92dc0c0000 pid=3292->guuid=c8ab77d8-1600-0000-3f90-1b92de0c0000 pid=3294 clone guuid=288c19d9-1600-0000-3f90-1b92e30c0000 pid=3299->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=5e527edb-1600-0000-3f90-1b92eb0c0000 pid=3307->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=d2bf72e3-1600-0000-3f90-1b92020d0000 pid=3330 /usr/bin/bash guuid=1fc25ee3-1600-0000-3f90-1b92010d0000 pid=3329->guuid=d2bf72e3-1600-0000-3f90-1b92020d0000 pid=3330 clone guuid=a34afae3-1600-0000-3f90-1b92070d0000 pid=3335->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=49948ae6-1600-0000-3f90-1b92120d0000 pid=3346->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=29686bea-1600-0000-3f90-1b92230d0000 pid=3363 /usr/bin/bash guuid=eeea57ea-1600-0000-3f90-1b92210d0000 pid=3361->guuid=29686bea-1600-0000-3f90-1b92230d0000 pid=3363 clone guuid=ab820beb-1600-0000-3f90-1b92280d0000 pid=3368->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=96df86ed-1600-0000-3f90-1b92330d0000 pid=3379->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=cb5872f2-1600-0000-3f90-1b924a0d0000 pid=3402 /usr/bin/bash guuid=b2355cf2-1600-0000-3f90-1b92490d0000 pid=3401->guuid=cb5872f2-1600-0000-3f90-1b924a0d0000 pid=3402 clone guuid=ae262bf3-1600-0000-3f90-1b92500d0000 pid=3408->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=0fceb6f5-1600-0000-3f90-1b92560d0000 pid=3414->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=d33251fa-1600-0000-3f90-1b92610d0000 pid=3425 /usr/bin/bash guuid=f3cd38fa-1600-0000-3f90-1b925f0d0000 pid=3423->guuid=d33251fa-1600-0000-3f90-1b92610d0000 pid=3425 clone guuid=3cc5e8fb-1600-0000-3f90-1b92690d0000 pid=3433->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=a6209afe-1600-0000-3f90-1b926f0d0000 pid=3439->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=6da5a506-1700-0000-3f90-1b927e0d0000 pid=3454 /usr/bin/bash guuid=ecad8706-1700-0000-3f90-1b927d0d0000 pid=3453->guuid=6da5a506-1700-0000-3f90-1b927e0d0000 pid=3454 clone guuid=cc448907-1700-0000-3f90-1b92830d0000 pid=3459->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=a56d820a-1700-0000-3f90-1b92890d0000 pid=3465->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=c1cf9c10-1700-0000-3f90-1b92970d0000 pid=3479 /usr/bin/bash guuid=3eb08110-1700-0000-3f90-1b92960d0000 pid=3478->guuid=c1cf9c10-1700-0000-3f90-1b92970d0000 pid=3479 clone guuid=ff758911-1700-0000-3f90-1b929d0d0000 pid=3485->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=e43b5014-1700-0000-3f90-1b92a50d0000 pid=3493->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=47a0d219-1700-0000-3f90-1b92b60d0000 pid=3510 /usr/bin/bash guuid=03dbb219-1700-0000-3f90-1b92b50d0000 pid=3509->guuid=47a0d219-1700-0000-3f90-1b92b60d0000 pid=3510 clone guuid=74d9f81a-1700-0000-3f90-1b92bb0d0000 pid=3515->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=45240b1e-1700-0000-3f90-1b92c30d0000 pid=3523->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=80968124-1700-0000-3f90-1b92d60d0000 pid=3542 /usr/bin/bash guuid=58d65124-1700-0000-3f90-1b92d50d0000 pid=3541->guuid=80968124-1700-0000-3f90-1b92d60d0000 pid=3542 clone guuid=fa428025-1700-0000-3f90-1b92dc0d0000 pid=3548->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=b820b628-1700-0000-3f90-1b92e50d0000 pid=3557->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=d81c2236-1700-0000-3f90-1b920b0e0000 pid=3595 /usr/bin/bash guuid=401f0936-1700-0000-3f90-1b92090e0000 pid=3593->guuid=d81c2236-1700-0000-3f90-1b920b0e0000 pid=3595 clone
Score:
99%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/b9b0d9654fea3fd034fa62ae3d8805379c8c7fe5168b7c44f2f55702e541e72e
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b9b0d9654fea3fd034fa62ae3d8805379c8c7fe5168b7c44f2f55702e541e72e/
Threat name:
Linux.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-07-27 12:02:12 UTC
File Type:
Text (Shell)
AV detection:
14 of 24 (58.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xgynszkp5i75anh2mkxd3cafg6oiy77fc2fxyrhs6vlqfzkb44xa._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260727-n6xmcadr91/
Behaviour
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.11
Link:
https://yomi.yoroi.company/submissions/b9b0d9654fea3fd034fa62ae3d8805379c8c7fe5168b7c44f2f55702e541e72e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments