MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bb9a3175ec5f7ad622540c597c81a8987433e514b7223ebaf2e7d81bcb2da4f1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bb9a3175ec5f7ad622540c597c81a8987433e514b7223ebaf2e7d81bcb2da4f1
SHA3-384 hash: 0cf11582d6bb5f6bb2cfdfcc72a43d5b00afef1ab309db6dda51c43b809d277eb063d72f179b2efbf55d552d7a157a95
SHA1 hash: 48ad4df12b7e98402d6a5317cf4ecc2685dc4ee9
MD5 hash: c9472640f1fddf8c4810c39ab4c83706
humanhash: lion-video-oregon-ink
File name:bb9a3175ec5f7ad622540c597c81a8987433e514b7223ebaf2e7d81bcb2da4f1
Download: download sample
File size:1'608 bytes
First seen:2026-08-29 09:00:31 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 24:ZeciNg+tvMsRCXsTs/UdUkDtFsul99LA00EA8zlXXNp:ZZ+tvMsRCcTs/UdUU1l9B
TLSH T1F731839F00604A315002DB5DB666799CB19EE1FB295FD3D4CC184EAA82487DCF172B0E
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter EnthecSolutions
Tags:enthec sh
URLMalware sample (SHA256 hash)SignatureTags
http://5.182.210.174/a902d7n/an/an/a
http://5.182.210.174/1ebb3fn/an/an/a
http://5.182.210.174/e86b5dn/an/an/a
http://5.182.210.174/959307n/an/an/a
http://5.182.210.174/12d0bdn/an/an/a
http://5.182.210.174/c79419n/an/an/a
http://5.182.210.174/556e8en/an/an/a
http://5.182.210.174/561356n/an/an/a
http://5.182.210.174/ffabecn/an/an/a
http://5.182.210.174/aedbe2n/an/an/a
http://5.182.210.174/973dbcn/an/an/a
http://5.182.210.174/f936f9n/an/an/a

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
CA CA
Vendor Threat Intelligence
No detections
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-08-29T07:11:00Z UTC
Last seen:
2026-08-29T07:42:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/bb9a3175ec5f7ad622540c597c81a8987433e514b7223ebaf2e7d81bcb2da4f1/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/fef32fc0-3528-4a6d-ae9d-cb52f3c435f0
Behavior Graph:
Download SVG
%3 guuid=83281b5b-1800-0000-d4f2-ba30f10b0000 pid=3057 /usr/bin/sudo guuid=6bc7695d-1800-0000-d4f2-ba30f20b0000 pid=3058 /tmp/sample.bin guuid=83281b5b-1800-0000-d4f2-ba30f10b0000 pid=3057->guuid=6bc7695d-1800-0000-d4f2-ba30f20b0000 pid=3058 execve guuid=88fc1b5e-1800-0000-d4f2-ba30f30b0000 pid=3059 /usr/bin/wget net send-data guuid=6bc7695d-1800-0000-d4f2-ba30f20b0000 pid=3058->guuid=88fc1b5e-1800-0000-d4f2-ba30f30b0000 pid=3059 execve guuid=67994164-1800-0000-d4f2-ba30f40b0000 pid=3060 /usr/bin/curl net send-data write-file guuid=6bc7695d-1800-0000-d4f2-ba30f20b0000 pid=3058->guuid=67994164-1800-0000-d4f2-ba30f40b0000 pid=3060 execve guuid=60430e6e-1800-0000-d4f2-ba30ff0b0000 pid=3071 /usr/bin/chmod guuid=6bc7695d-1800-0000-d4f2-ba30f20b0000 pid=3058->guuid=60430e6e-1800-0000-d4f2-ba30ff0b0000 pid=3071 execve guuid=96c8646e-1800-0000-d4f2-ba30000c0000 pid=3072 /usr/bin/bash guuid=6bc7695d-1800-0000-d4f2-ba30f20b0000 pid=3058->guuid=96c8646e-1800-0000-d4f2-ba30000c0000 pid=3072 clone guuid=ce24b96e-1800-0000-d4f2-ba30020c0000 pid=3074 /usr/bin/rm delete-file guuid=6bc7695d-1800-0000-d4f2-ba30f20b0000 pid=3058->guuid=ce24b96e-1800-0000-d4f2-ba30020c0000 pid=3074 execve guuid=09df2c6f-1800-0000-d4f2-ba30030c0000 pid=3075 /usr/bin/rm guuid=6bc7695d-1800-0000-d4f2-ba30f20b0000 pid=3058->guuid=09df2c6f-1800-0000-d4f2-ba30030c0000 pid=3075 execve guuid=ab93946f-1800-0000-d4f2-ba30040c0000 pid=3076 /usr/bin/wget net send-data guuid=6bc7695d-1800-0000-d4f2-ba30f20b0000 pid=3058->guuid=ab93946f-1800-0000-d4f2-ba30040c0000 pid=3076 execve guuid=bf624472-1800-0000-d4f2-ba300a0c0000 pid=3082 /usr/bin/curl net send-data write-file guuid=6bc7695d-1800-0000-d4f2-ba30f20b0000 pid=3058->guuid=bf624472-1800-0000-d4f2-ba300a0c0000 pid=3082 execve guuid=dcbda677-1800-0000-d4f2-ba30170c0000 pid=3095 /usr/bin/chmod guuid=6bc7695d-1800-0000-d4f2-ba30f20b0000 pid=3058->guuid=dcbda677-1800-0000-d4f2-ba30170c0000 pid=3095 execve guuid=641be977-1800-0000-d4f2-ba30190c0000 pid=3097 /usr/bin/bash guuid=6bc7695d-1800-0000-d4f2-ba30f20b0000 pid=3058->guuid=641be977-1800-0000-d4f2-ba30190c0000 pid=3097 clone guuid=114a1f78-1800-0000-d4f2-ba301c0c0000 pid=3100 /usr/bin/rm delete-file guuid=6bc7695d-1800-0000-d4f2-ba30f20b0000 pid=3058->guuid=114a1f78-1800-0000-d4f2-ba301c0c0000 pid=3100 execve guuid=444c6378-1800-0000-d4f2-ba301e0c0000 pid=3102 /usr/bin/rm guuid=6bc7695d-1800-0000-d4f2-ba30f20b0000 pid=3058->guuid=444c6378-1800-0000-d4f2-ba301e0c0000 pid=3102 execve guuid=18edb478-1800-0000-d4f2-ba30200c0000 pid=3104 /usr/bin/wget net send-data guuid=6bc7695d-1800-0000-d4f2-ba30f20b0000 pid=3058->guuid=18edb478-1800-0000-d4f2-ba30200c0000 pid=3104 execve guuid=02bd277b-1800-0000-d4f2-ba30260c0000 pid=3110 /usr/bin/curl net send-data write-file guuid=6bc7695d-1800-0000-d4f2-ba30f20b0000 pid=3058->guuid=02bd277b-1800-0000-d4f2-ba30260c0000 pid=3110 execve guuid=d199dc81-1800-0000-d4f2-ba30270c0000 pid=3111 /usr/bin/chmod guuid=6bc7695d-1800-0000-d4f2-ba30f20b0000 pid=3058->guuid=d199dc81-1800-0000-d4f2-ba30270c0000 pid=3111 execve guuid=00ac4282-1800-0000-d4f2-ba30280c0000 pid=3112 /usr/bin/bash guuid=6bc7695d-1800-0000-d4f2-ba30f20b0000 pid=3058->guuid=00ac4282-1800-0000-d4f2-ba30280c0000 pid=3112 clone guuid=24c2b982-1800-0000-d4f2-ba302a0c0000 pid=3114 /usr/bin/rm delete-file guuid=6bc7695d-1800-0000-d4f2-ba30f20b0000 pid=3058->guuid=24c2b982-1800-0000-d4f2-ba302a0c0000 pid=3114 execve guuid=b5537e83-1800-0000-d4f2-ba302b0c0000 pid=3115 /usr/bin/rm guuid=6bc7695d-1800-0000-d4f2-ba30f20b0000 pid=3058->guuid=b5537e83-1800-0000-d4f2-ba302b0c0000 pid=3115 execve guuid=ee25d983-1800-0000-d4f2-ba302c0c0000 pid=3116 /usr/bin/wget net send-data guuid=6bc7695d-1800-0000-d4f2-ba30f20b0000 pid=3058->guuid=ee25d983-1800-0000-d4f2-ba302c0c0000 pid=3116 execve guuid=2c928d87-1800-0000-d4f2-ba302d0c0000 pid=3117 /usr/bin/curl net send-data write-file guuid=6bc7695d-1800-0000-d4f2-ba30f20b0000 pid=3058->guuid=2c928d87-1800-0000-d4f2-ba302d0c0000 pid=3117 execve guuid=80deed8d-1800-0000-d4f2-ba302e0c0000 pid=3118 /usr/bin/chmod guuid=6bc7695d-1800-0000-d4f2-ba30f20b0000 pid=3058->guuid=80deed8d-1800-0000-d4f2-ba302e0c0000 pid=3118 execve guuid=e4ab618e-1800-0000-d4f2-ba302f0c0000 pid=3119 /usr/bin/bash guuid=6bc7695d-1800-0000-d4f2-ba30f20b0000 pid=3058->guuid=e4ab618e-1800-0000-d4f2-ba302f0c0000 pid=3119 clone guuid=2311c08e-1800-0000-d4f2-ba30310c0000 pid=3121 /usr/bin/rm delete-file guuid=6bc7695d-1800-0000-d4f2-ba30f20b0000 pid=3058->guuid=2311c08e-1800-0000-d4f2-ba30310c0000 pid=3121 execve guuid=b6561f8f-1800-0000-d4f2-ba30320c0000 pid=3122 /usr/bin/rm guuid=6bc7695d-1800-0000-d4f2-ba30f20b0000 pid=3058->guuid=b6561f8f-1800-0000-d4f2-ba30320c0000 pid=3122 execve guuid=0285818f-1800-0000-d4f2-ba30330c0000 pid=3123 /usr/bin/wget net send-data guuid=6bc7695d-1800-0000-d4f2-ba30f20b0000 pid=3058->guuid=0285818f-1800-0000-d4f2-ba30330c0000 pid=3123 execve guuid=86e9b592-1800-0000-d4f2-ba30350c0000 pid=3125 /usr/bin/curl net send-data write-file guuid=6bc7695d-1800-0000-d4f2-ba30f20b0000 pid=3058->guuid=86e9b592-1800-0000-d4f2-ba30350c0000 pid=3125 execve guuid=3965c996-1800-0000-d4f2-ba303c0c0000 pid=3132 /usr/bin/chmod guuid=6bc7695d-1800-0000-d4f2-ba30f20b0000 pid=3058->guuid=3965c996-1800-0000-d4f2-ba303c0c0000 pid=3132 execve guuid=03850d97-1800-0000-d4f2-ba303e0c0000 pid=3134 /usr/bin/bash guuid=6bc7695d-1800-0000-d4f2-ba30f20b0000 pid=3058->guuid=03850d97-1800-0000-d4f2-ba303e0c0000 pid=3134 clone guuid=86dd3e97-1800-0000-d4f2-ba30400c0000 pid=3136 /usr/bin/rm delete-file guuid=6bc7695d-1800-0000-d4f2-ba30f20b0000 pid=3058->guuid=86dd3e97-1800-0000-d4f2-ba30400c0000 pid=3136 execve guuid=d4867c97-1800-0000-d4f2-ba30420c0000 pid=3138 /usr/bin/rm guuid=6bc7695d-1800-0000-d4f2-ba30f20b0000 pid=3058->guuid=d4867c97-1800-0000-d4f2-ba30420c0000 pid=3138 execve guuid=2751b997-1800-0000-d4f2-ba30440c0000 pid=3140 /usr/bin/wget net send-data guuid=6bc7695d-1800-0000-d4f2-ba30f20b0000 pid=3058->guuid=2751b997-1800-0000-d4f2-ba30440c0000 pid=3140 execve guuid=abf6309c-1800-0000-d4f2-ba30490c0000 pid=3145 /usr/bin/curl net send-data write-file guuid=6bc7695d-1800-0000-d4f2-ba30f20b0000 pid=3058->guuid=abf6309c-1800-0000-d4f2-ba30490c0000 pid=3145 execve guuid=6c1f1da5-1800-0000-d4f2-ba30510c0000 pid=3153 /usr/bin/chmod guuid=6bc7695d-1800-0000-d4f2-ba30f20b0000 pid=3058->guuid=6c1f1da5-1800-0000-d4f2-ba30510c0000 pid=3153 execve guuid=db30b3a5-1800-0000-d4f2-ba30520c0000 pid=3154 /usr/bin/bash guuid=6bc7695d-1800-0000-d4f2-ba30f20b0000 pid=3058->guuid=db30b3a5-1800-0000-d4f2-ba30520c0000 pid=3154 clone guuid=9fb037a6-1800-0000-d4f2-ba30540c0000 pid=3156 /usr/bin/rm delete-file guuid=6bc7695d-1800-0000-d4f2-ba30f20b0000 pid=3058->guuid=9fb037a6-1800-0000-d4f2-ba30540c0000 pid=3156 execve guuid=ea3398a6-1800-0000-d4f2-ba30550c0000 pid=3157 /usr/bin/rm guuid=6bc7695d-1800-0000-d4f2-ba30f20b0000 pid=3058->guuid=ea3398a6-1800-0000-d4f2-ba30550c0000 pid=3157 execve guuid=77b929a7-1800-0000-d4f2-ba30560c0000 pid=3158 /usr/bin/wget net send-data guuid=6bc7695d-1800-0000-d4f2-ba30f20b0000 pid=3058->guuid=77b929a7-1800-0000-d4f2-ba30560c0000 pid=3158 execve guuid=955ed5a9-1800-0000-d4f2-ba305a0c0000 pid=3162 /usr/bin/curl net send-data write-file guuid=6bc7695d-1800-0000-d4f2-ba30f20b0000 pid=3058->guuid=955ed5a9-1800-0000-d4f2-ba305a0c0000 pid=3162 execve guuid=0bff5eaf-1800-0000-d4f2-ba30600c0000 pid=3168 /usr/bin/chmod guuid=6bc7695d-1800-0000-d4f2-ba30f20b0000 pid=3058->guuid=0bff5eaf-1800-0000-d4f2-ba30600c0000 pid=3168 execve guuid=7e13e5af-1800-0000-d4f2-ba30610c0000 pid=3169 /usr/bin/bash guuid=6bc7695d-1800-0000-d4f2-ba30f20b0000 pid=3058->guuid=7e13e5af-1800-0000-d4f2-ba30610c0000 pid=3169 clone guuid=b06050b0-1800-0000-d4f2-ba30630c0000 pid=3171 /usr/bin/rm delete-file guuid=6bc7695d-1800-0000-d4f2-ba30f20b0000 pid=3058->guuid=b06050b0-1800-0000-d4f2-ba30630c0000 pid=3171 execve guuid=ca0bafb0-1800-0000-d4f2-ba30640c0000 pid=3172 /usr/bin/rm guuid=6bc7695d-1800-0000-d4f2-ba30f20b0000 pid=3058->guuid=ca0bafb0-1800-0000-d4f2-ba30640c0000 pid=3172 execve guuid=80d2edb0-1800-0000-d4f2-ba30650c0000 pid=3173 /usr/bin/wget net send-data guuid=6bc7695d-1800-0000-d4f2-ba30f20b0000 pid=3058->guuid=80d2edb0-1800-0000-d4f2-ba30650c0000 pid=3173 execve guuid=f1c6d9b3-1800-0000-d4f2-ba30680c0000 pid=3176 /usr/bin/curl net send-data write-file guuid=6bc7695d-1800-0000-d4f2-ba30f20b0000 pid=3058->guuid=f1c6d9b3-1800-0000-d4f2-ba30680c0000 pid=3176 execve guuid=899c4bb8-1800-0000-d4f2-ba306d0c0000 pid=3181 /usr/bin/chmod guuid=6bc7695d-1800-0000-d4f2-ba30f20b0000 pid=3058->guuid=899c4bb8-1800-0000-d4f2-ba306d0c0000 pid=3181 execve guuid=b952ebb8-1800-0000-d4f2-ba306e0c0000 pid=3182 /usr/bin/bash guuid=6bc7695d-1800-0000-d4f2-ba30f20b0000 pid=3058->guuid=b952ebb8-1800-0000-d4f2-ba306e0c0000 pid=3182 clone guuid=1f1346b9-1800-0000-d4f2-ba30710c0000 pid=3185 /usr/bin/rm delete-file guuid=6bc7695d-1800-0000-d4f2-ba30f20b0000 pid=3058->guuid=1f1346b9-1800-0000-d4f2-ba30710c0000 pid=3185 execve guuid=8d2291b9-1800-0000-d4f2-ba30720c0000 pid=3186 /usr/bin/rm guuid=6bc7695d-1800-0000-d4f2-ba30f20b0000 pid=3058->guuid=8d2291b9-1800-0000-d4f2-ba30720c0000 pid=3186 execve guuid=f115f7b9-1800-0000-d4f2-ba30740c0000 pid=3188 /usr/bin/wget net send-data guuid=6bc7695d-1800-0000-d4f2-ba30f20b0000 pid=3058->guuid=f115f7b9-1800-0000-d4f2-ba30740c0000 pid=3188 execve guuid=8aba07bd-1800-0000-d4f2-ba307a0c0000 pid=3194 /usr/bin/curl net send-data write-file guuid=6bc7695d-1800-0000-d4f2-ba30f20b0000 pid=3058->guuid=8aba07bd-1800-0000-d4f2-ba307a0c0000 pid=3194 execve guuid=765207c3-1800-0000-d4f2-ba307f0c0000 pid=3199 /usr/bin/chmod guuid=6bc7695d-1800-0000-d4f2-ba30f20b0000 pid=3058->guuid=765207c3-1800-0000-d4f2-ba307f0c0000 pid=3199 execve guuid=a90d5bc3-1800-0000-d4f2-ba30810c0000 pid=3201 /usr/bin/bash guuid=6bc7695d-1800-0000-d4f2-ba30f20b0000 pid=3058->guuid=a90d5bc3-1800-0000-d4f2-ba30810c0000 pid=3201 clone guuid=2789bec3-1800-0000-d4f2-ba30830c0000 pid=3203 /usr/bin/rm delete-file guuid=6bc7695d-1800-0000-d4f2-ba30f20b0000 pid=3058->guuid=2789bec3-1800-0000-d4f2-ba30830c0000 pid=3203 execve guuid=ac011ec4-1800-0000-d4f2-ba30850c0000 pid=3205 /usr/bin/rm guuid=6bc7695d-1800-0000-d4f2-ba30f20b0000 pid=3058->guuid=ac011ec4-1800-0000-d4f2-ba30850c0000 pid=3205 execve guuid=e1ed61c4-1800-0000-d4f2-ba30870c0000 pid=3207 /usr/bin/wget net send-data guuid=6bc7695d-1800-0000-d4f2-ba30f20b0000 pid=3058->guuid=e1ed61c4-1800-0000-d4f2-ba30870c0000 pid=3207 execve guuid=7e0ed8c6-1800-0000-d4f2-ba308f0c0000 pid=3215 /usr/bin/curl net send-data write-file guuid=6bc7695d-1800-0000-d4f2-ba30f20b0000 pid=3058->guuid=7e0ed8c6-1800-0000-d4f2-ba308f0c0000 pid=3215 execve guuid=1dc733cd-1800-0000-d4f2-ba30a20c0000 pid=3234 /usr/bin/chmod guuid=6bc7695d-1800-0000-d4f2-ba30f20b0000 pid=3058->guuid=1dc733cd-1800-0000-d4f2-ba30a20c0000 pid=3234 execve guuid=f01a78cd-1800-0000-d4f2-ba30a30c0000 pid=3235 /usr/bin/bash guuid=6bc7695d-1800-0000-d4f2-ba30f20b0000 pid=3058->guuid=f01a78cd-1800-0000-d4f2-ba30a30c0000 pid=3235 clone guuid=29e7abcd-1800-0000-d4f2-ba30a50c0000 pid=3237 /usr/bin/rm delete-file guuid=6bc7695d-1800-0000-d4f2-ba30f20b0000 pid=3058->guuid=29e7abcd-1800-0000-d4f2-ba30a50c0000 pid=3237 execve guuid=cf3ef2cd-1800-0000-d4f2-ba30a70c0000 pid=3239 /usr/bin/rm guuid=6bc7695d-1800-0000-d4f2-ba30f20b0000 pid=3058->guuid=cf3ef2cd-1800-0000-d4f2-ba30a70c0000 pid=3239 execve guuid=2f0d32ce-1800-0000-d4f2-ba30a80c0000 pid=3240 /usr/bin/wget net send-data guuid=6bc7695d-1800-0000-d4f2-ba30f20b0000 pid=3058->guuid=2f0d32ce-1800-0000-d4f2-ba30a80c0000 pid=3240 execve guuid=69a39ed0-1800-0000-d4f2-ba30ad0c0000 pid=3245 /usr/bin/curl net send-data write-file guuid=6bc7695d-1800-0000-d4f2-ba30f20b0000 pid=3058->guuid=69a39ed0-1800-0000-d4f2-ba30ad0c0000 pid=3245 execve guuid=52d30fd5-1800-0000-d4f2-ba30b60c0000 pid=3254 /usr/bin/chmod guuid=6bc7695d-1800-0000-d4f2-ba30f20b0000 pid=3058->guuid=52d30fd5-1800-0000-d4f2-ba30b60c0000 pid=3254 execve guuid=89c74cd5-1800-0000-d4f2-ba30b70c0000 pid=3255 /usr/bin/bash guuid=6bc7695d-1800-0000-d4f2-ba30f20b0000 pid=3058->guuid=89c74cd5-1800-0000-d4f2-ba30b70c0000 pid=3255 clone guuid=61b67cd5-1800-0000-d4f2-ba30b90c0000 pid=3257 /usr/bin/rm delete-file guuid=6bc7695d-1800-0000-d4f2-ba30f20b0000 pid=3058->guuid=61b67cd5-1800-0000-d4f2-ba30b90c0000 pid=3257 execve guuid=a709c6d5-1800-0000-d4f2-ba30ba0c0000 pid=3258 /usr/bin/rm guuid=6bc7695d-1800-0000-d4f2-ba30f20b0000 pid=3058->guuid=a709c6d5-1800-0000-d4f2-ba30ba0c0000 pid=3258 execve guuid=2e670fd6-1800-0000-d4f2-ba30bc0c0000 pid=3260 /usr/bin/wget net send-data guuid=6bc7695d-1800-0000-d4f2-ba30f20b0000 pid=3058->guuid=2e670fd6-1800-0000-d4f2-ba30bc0c0000 pid=3260 execve guuid=63a186d8-1800-0000-d4f2-ba30c40c0000 pid=3268 /usr/bin/curl net send-data write-file guuid=6bc7695d-1800-0000-d4f2-ba30f20b0000 pid=3058->guuid=63a186d8-1800-0000-d4f2-ba30c40c0000 pid=3268 execve guuid=c60f9ee0-1800-0000-d4f2-ba30d70c0000 pid=3287 /usr/bin/chmod guuid=6bc7695d-1800-0000-d4f2-ba30f20b0000 pid=3058->guuid=c60f9ee0-1800-0000-d4f2-ba30d70c0000 pid=3287 execve guuid=27887be1-1800-0000-d4f2-ba30d80c0000 pid=3288 /usr/bin/bash guuid=6bc7695d-1800-0000-d4f2-ba30f20b0000 pid=3058->guuid=27887be1-1800-0000-d4f2-ba30d80c0000 pid=3288 clone guuid=6ce42ae2-1800-0000-d4f2-ba30da0c0000 pid=3290 /usr/bin/rm delete-file guuid=6bc7695d-1800-0000-d4f2-ba30f20b0000 pid=3058->guuid=6ce42ae2-1800-0000-d4f2-ba30da0c0000 pid=3290 execve guuid=447911e3-1800-0000-d4f2-ba30db0c0000 pid=3291 /usr/bin/rm guuid=6bc7695d-1800-0000-d4f2-ba30f20b0000 pid=3058->guuid=447911e3-1800-0000-d4f2-ba30db0c0000 pid=3291 execve 5b654972-c9e1-50d8-b372-2dc2a5b9ad66 5.182.210.174:80 guuid=88fc1b5e-1800-0000-d4f2-ba30f30b0000 pid=3059->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=67994164-1800-0000-d4f2-ba30f40b0000 pid=3060->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=860d876e-1800-0000-d4f2-ba30010c0000 pid=3073 /usr/bin/bash guuid=96c8646e-1800-0000-d4f2-ba30000c0000 pid=3072->guuid=860d876e-1800-0000-d4f2-ba30010c0000 pid=3073 clone guuid=ab93946f-1800-0000-d4f2-ba30040c0000 pid=3076->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=bf624472-1800-0000-d4f2-ba300a0c0000 pid=3082->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=517f0178-1800-0000-d4f2-ba301a0c0000 pid=3098 /usr/bin/bash guuid=641be977-1800-0000-d4f2-ba30190c0000 pid=3097->guuid=517f0178-1800-0000-d4f2-ba301a0c0000 pid=3098 clone guuid=18edb478-1800-0000-d4f2-ba30200c0000 pid=3104->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=02bd277b-1800-0000-d4f2-ba30260c0000 pid=3110->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=865f6882-1800-0000-d4f2-ba30290c0000 pid=3113 /usr/bin/bash guuid=00ac4282-1800-0000-d4f2-ba30280c0000 pid=3112->guuid=865f6882-1800-0000-d4f2-ba30290c0000 pid=3113 clone guuid=ee25d983-1800-0000-d4f2-ba302c0c0000 pid=3116->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=2c928d87-1800-0000-d4f2-ba302d0c0000 pid=3117->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=42cc8e8e-1800-0000-d4f2-ba30300c0000 pid=3120 /usr/bin/bash guuid=e4ab618e-1800-0000-d4f2-ba302f0c0000 pid=3119->guuid=42cc8e8e-1800-0000-d4f2-ba30300c0000 pid=3120 clone guuid=0285818f-1800-0000-d4f2-ba30330c0000 pid=3123->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=86e9b592-1800-0000-d4f2-ba30350c0000 pid=3125->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=50632197-1800-0000-d4f2-ba303f0c0000 pid=3135 /usr/bin/bash guuid=03850d97-1800-0000-d4f2-ba303e0c0000 pid=3134->guuid=50632197-1800-0000-d4f2-ba303f0c0000 pid=3135 clone guuid=2751b997-1800-0000-d4f2-ba30440c0000 pid=3140->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=abf6309c-1800-0000-d4f2-ba30490c0000 pid=3145->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=5b6af3a5-1800-0000-d4f2-ba30530c0000 pid=3155 /usr/bin/bash guuid=db30b3a5-1800-0000-d4f2-ba30520c0000 pid=3154->guuid=5b6af3a5-1800-0000-d4f2-ba30530c0000 pid=3155 clone guuid=77b929a7-1800-0000-d4f2-ba30560c0000 pid=3158->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=955ed5a9-1800-0000-d4f2-ba305a0c0000 pid=3162->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=484513b0-1800-0000-d4f2-ba30620c0000 pid=3170 /usr/bin/bash guuid=7e13e5af-1800-0000-d4f2-ba30610c0000 pid=3169->guuid=484513b0-1800-0000-d4f2-ba30620c0000 pid=3170 clone guuid=80d2edb0-1800-0000-d4f2-ba30650c0000 pid=3173->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=f1c6d9b3-1800-0000-d4f2-ba30680c0000 pid=3176->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=c9cd1db9-1800-0000-d4f2-ba30700c0000 pid=3184 /usr/bin/bash guuid=b952ebb8-1800-0000-d4f2-ba306e0c0000 pid=3182->guuid=c9cd1db9-1800-0000-d4f2-ba30700c0000 pid=3184 clone guuid=f115f7b9-1800-0000-d4f2-ba30740c0000 pid=3188->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=8aba07bd-1800-0000-d4f2-ba307a0c0000 pid=3194->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=5d4a7cc3-1800-0000-d4f2-ba30820c0000 pid=3202 /usr/bin/bash guuid=a90d5bc3-1800-0000-d4f2-ba30810c0000 pid=3201->guuid=5d4a7cc3-1800-0000-d4f2-ba30820c0000 pid=3202 clone guuid=e1ed61c4-1800-0000-d4f2-ba30870c0000 pid=3207->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=7e0ed8c6-1800-0000-d4f2-ba308f0c0000 pid=3215->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=b7208dcd-1800-0000-d4f2-ba30a40c0000 pid=3236 /usr/bin/bash guuid=f01a78cd-1800-0000-d4f2-ba30a30c0000 pid=3235->guuid=b7208dcd-1800-0000-d4f2-ba30a40c0000 pid=3236 clone guuid=2f0d32ce-1800-0000-d4f2-ba30a80c0000 pid=3240->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=69a39ed0-1800-0000-d4f2-ba30ad0c0000 pid=3245->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=bf6d60d5-1800-0000-d4f2-ba30b80c0000 pid=3256 /usr/bin/bash guuid=89c74cd5-1800-0000-d4f2-ba30b70c0000 pid=3255->guuid=bf6d60d5-1800-0000-d4f2-ba30b80c0000 pid=3256 clone guuid=2e670fd6-1800-0000-d4f2-ba30bc0c0000 pid=3260->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=63a186d8-1800-0000-d4f2-ba30c40c0000 pid=3268->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=52b4c8e1-1800-0000-d4f2-ba30d90c0000 pid=3289 /usr/bin/bash guuid=27887be1-1800-0000-d4f2-ba30d80c0000 pid=3288->guuid=52b4c8e1-1800-0000-d4f2-ba30d90c0000 pid=3289 clone
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/bb9a3175ec5f7ad622540c597c81a8987433e514b7223ebaf2e7d81bcb2da4f1
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bb9a3175ec5f7ad622540c597c81a8987433e514b7223ebaf2e7d81bcb2da4f1/
Threat name:
Linux.Trojan.Egairtigado
Create hunting rule
Status:
Malicious
First seen:
2026-08-29 09:01:39 UTC
File Type:
Text (Shell)
AV detection:
13 of 24 (54.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xondc5pml55nmisubrmxzanitb2dhziuw4rd5oxs47mbxsznutyq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260829-ky3a3sxfmf/
Behaviour
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.11
Link:
https://yomi.yoroi.company/submissions/bb9a3175ec5f7ad622540c597c81a8987433e514b7223ebaf2e7d81bcb2da4f1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments