🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c4a95654994d20dc982d63e95885f00f976949d1b451419bacce463baf9cfcc3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c4a95654994d20dc982d63e95885f00f976949d1b451419bacce463baf9cfcc3
SHA3-384 hash: cfcb8dc9fc76b0cbfe2cc74a546a467d7a0dcf0d1d40d53d5cb55c9596ca4cdd6c86c0b3b0d81958ce65d03518041a6f
SHA1 hash: 9639830d0c9790ed3724cba59ba0300763c1881e
MD5 hash: 1f0e490b8eccb3f92a32150e8d1f78ed
humanhash: five-butter-happy-beer
File name:ok
Download: download sample
File size:1'608 bytes
First seen:2026-08-28 20:45:14 UTC
Last seen:2026-08-29 12:19:49 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 24:SniHCGy2vxzFLFbvQQdx2MK2rv6MapCBK:3tzFLFbv9dx2MK2rCMapCBK
TLSH T14231A0DF44102A722603CE8DB3B3658CA58EA1EB1C5FD3D49C184EE892882CCF265B4D
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://5.182.210.174/cdcb4an/an/an/a
http://5.182.210.174/a1906an/an/an/a
http://5.182.210.174/85a178n/an/an/a
http://5.182.210.174/504da5n/an/an/a
http://5.182.210.174/dfad12n/an/an/a
http://5.182.210.174/a1e904n/an/an/a
http://5.182.210.174/bcd659n/an/an/a
http://5.182.210.174/959715n/an/an/a
http://5.182.210.174/3931e2n/an/an/a
http://5.182.210.174/1b4095n/an/an/a
http://5.182.210.174/de6885n/an/an/a
http://5.182.210.174/a4afa0n/an/an/a

Intelligence

File Origin
# of uploads :
3
# of downloads :
63
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive mirai
Link:
https://www.filescan.io/uploads/6a91f35f152ed720dd3ecec8/reports/030721ed-b0c0-4060-b54c-df6eb0879364/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-08-28T18:51:00Z UTC
Last seen:
2026-08-29T20:13:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/c4a95654994d20dc982d63e95885f00f976949d1b451419bacce463baf9cfcc3/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/42031cdd-ede2-4c83-9383-07ed0f737703
Behavior Graph:
Download SVG
%3 guuid=bfee68be-1800-0000-a6a1-a49a6f0b0000 pid=2927 /usr/bin/sudo guuid=7d731dc1-1800-0000-a6a1-a49a740b0000 pid=2932 /tmp/sample.bin guuid=bfee68be-1800-0000-a6a1-a49a6f0b0000 pid=2927->guuid=7d731dc1-1800-0000-a6a1-a49a740b0000 pid=2932 execve guuid=8ab62cc2-1800-0000-a6a1-a49a770b0000 pid=2935 /usr/bin/wget net send-data guuid=7d731dc1-1800-0000-a6a1-a49a740b0000 pid=2932->guuid=8ab62cc2-1800-0000-a6a1-a49a770b0000 pid=2935 execve guuid=b08fcbc9-1800-0000-a6a1-a49a870b0000 pid=2951 /usr/bin/curl net send-data write-file guuid=7d731dc1-1800-0000-a6a1-a49a740b0000 pid=2932->guuid=b08fcbc9-1800-0000-a6a1-a49a870b0000 pid=2951 execve guuid=6cd302d3-1800-0000-a6a1-a49aa00b0000 pid=2976 /usr/bin/chmod guuid=7d731dc1-1800-0000-a6a1-a49a740b0000 pid=2932->guuid=6cd302d3-1800-0000-a6a1-a49aa00b0000 pid=2976 execve guuid=bcb047d3-1800-0000-a6a1-a49aa10b0000 pid=2977 /usr/bin/bash guuid=7d731dc1-1800-0000-a6a1-a49a740b0000 pid=2932->guuid=bcb047d3-1800-0000-a6a1-a49aa10b0000 pid=2977 clone guuid=0bd08fd3-1800-0000-a6a1-a49aa40b0000 pid=2980 /usr/bin/rm delete-file guuid=7d731dc1-1800-0000-a6a1-a49a740b0000 pid=2932->guuid=0bd08fd3-1800-0000-a6a1-a49aa40b0000 pid=2980 execve guuid=eac716d4-1800-0000-a6a1-a49aa50b0000 pid=2981 /usr/bin/rm guuid=7d731dc1-1800-0000-a6a1-a49a740b0000 pid=2932->guuid=eac716d4-1800-0000-a6a1-a49aa50b0000 pid=2981 execve guuid=852e7fd5-1800-0000-a6a1-a49aa90b0000 pid=2985 /usr/bin/wget net send-data guuid=7d731dc1-1800-0000-a6a1-a49a740b0000 pid=2932->guuid=852e7fd5-1800-0000-a6a1-a49aa90b0000 pid=2985 execve guuid=f60875dc-1800-0000-a6a1-a49ab20b0000 pid=2994 /usr/bin/curl net send-data write-file guuid=7d731dc1-1800-0000-a6a1-a49a740b0000 pid=2932->guuid=f60875dc-1800-0000-a6a1-a49ab20b0000 pid=2994 execve guuid=5c01aee2-1800-0000-a6a1-a49abe0b0000 pid=3006 /usr/bin/chmod guuid=7d731dc1-1800-0000-a6a1-a49a740b0000 pid=2932->guuid=5c01aee2-1800-0000-a6a1-a49abe0b0000 pid=3006 execve guuid=318316e3-1800-0000-a6a1-a49ac00b0000 pid=3008 /usr/bin/bash guuid=7d731dc1-1800-0000-a6a1-a49a740b0000 pid=2932->guuid=318316e3-1800-0000-a6a1-a49ac00b0000 pid=3008 clone guuid=78346fe3-1800-0000-a6a1-a49ac30b0000 pid=3011 /usr/bin/rm delete-file guuid=7d731dc1-1800-0000-a6a1-a49a740b0000 pid=2932->guuid=78346fe3-1800-0000-a6a1-a49ac30b0000 pid=3011 execve guuid=9ab7e7e3-1800-0000-a6a1-a49ac60b0000 pid=3014 /usr/bin/rm guuid=7d731dc1-1800-0000-a6a1-a49a740b0000 pid=2932->guuid=9ab7e7e3-1800-0000-a6a1-a49ac60b0000 pid=3014 execve guuid=7c256be4-1800-0000-a6a1-a49ac90b0000 pid=3017 /usr/bin/wget net send-data guuid=7d731dc1-1800-0000-a6a1-a49a740b0000 pid=2932->guuid=7c256be4-1800-0000-a6a1-a49ac90b0000 pid=3017 execve guuid=20d85ee7-1800-0000-a6a1-a49ad40b0000 pid=3028 /usr/bin/curl net send-data write-file guuid=7d731dc1-1800-0000-a6a1-a49a740b0000 pid=2932->guuid=20d85ee7-1800-0000-a6a1-a49ad40b0000 pid=3028 execve guuid=1628a5ec-1800-0000-a6a1-a49ae40b0000 pid=3044 /usr/bin/chmod guuid=7d731dc1-1800-0000-a6a1-a49a740b0000 pid=2932->guuid=1628a5ec-1800-0000-a6a1-a49ae40b0000 pid=3044 execve guuid=791be5ec-1800-0000-a6a1-a49ae60b0000 pid=3046 /usr/bin/bash guuid=7d731dc1-1800-0000-a6a1-a49a740b0000 pid=2932->guuid=791be5ec-1800-0000-a6a1-a49ae60b0000 pid=3046 clone guuid=edca1eed-1800-0000-a6a1-a49ae90b0000 pid=3049 /usr/bin/rm delete-file guuid=7d731dc1-1800-0000-a6a1-a49a740b0000 pid=2932->guuid=edca1eed-1800-0000-a6a1-a49ae90b0000 pid=3049 execve guuid=d80362ed-1800-0000-a6a1-a49aeb0b0000 pid=3051 /usr/bin/rm guuid=7d731dc1-1800-0000-a6a1-a49a740b0000 pid=2932->guuid=d80362ed-1800-0000-a6a1-a49aeb0b0000 pid=3051 execve guuid=f9189fed-1800-0000-a6a1-a49aed0b0000 pid=3053 /usr/bin/wget net send-data guuid=7d731dc1-1800-0000-a6a1-a49a740b0000 pid=2932->guuid=f9189fed-1800-0000-a6a1-a49aed0b0000 pid=3053 execve guuid=2fd812f0-1800-0000-a6a1-a49af40b0000 pid=3060 /usr/bin/curl net send-data write-file guuid=7d731dc1-1800-0000-a6a1-a49a740b0000 pid=2932->guuid=2fd812f0-1800-0000-a6a1-a49af40b0000 pid=3060 execve guuid=236f8ef5-1800-0000-a6a1-a49a020c0000 pid=3074 /usr/bin/chmod guuid=7d731dc1-1800-0000-a6a1-a49a740b0000 pid=2932->guuid=236f8ef5-1800-0000-a6a1-a49a020c0000 pid=3074 execve guuid=ea4ccaf5-1800-0000-a6a1-a49a040c0000 pid=3076 /usr/bin/bash guuid=7d731dc1-1800-0000-a6a1-a49a740b0000 pid=2932->guuid=ea4ccaf5-1800-0000-a6a1-a49a040c0000 pid=3076 clone guuid=a603fcf5-1800-0000-a6a1-a49a060c0000 pid=3078 /usr/bin/rm delete-file guuid=7d731dc1-1800-0000-a6a1-a49a740b0000 pid=2932->guuid=a603fcf5-1800-0000-a6a1-a49a060c0000 pid=3078 execve guuid=666641f6-1800-0000-a6a1-a49a070c0000 pid=3079 /usr/bin/rm guuid=7d731dc1-1800-0000-a6a1-a49a740b0000 pid=2932->guuid=666641f6-1800-0000-a6a1-a49a070c0000 pid=3079 execve guuid=b76480f6-1800-0000-a6a1-a49a090c0000 pid=3081 /usr/bin/wget net send-data guuid=7d731dc1-1800-0000-a6a1-a49a740b0000 pid=2932->guuid=b76480f6-1800-0000-a6a1-a49a090c0000 pid=3081 execve guuid=fec41ff9-1800-0000-a6a1-a49a0f0c0000 pid=3087 /usr/bin/curl net send-data write-file guuid=7d731dc1-1800-0000-a6a1-a49a740b0000 pid=2932->guuid=fec41ff9-1800-0000-a6a1-a49a0f0c0000 pid=3087 execve guuid=59b98eff-1800-0000-a6a1-a49a100c0000 pid=3088 /usr/bin/chmod guuid=7d731dc1-1800-0000-a6a1-a49a740b0000 pid=2932->guuid=59b98eff-1800-0000-a6a1-a49a100c0000 pid=3088 execve guuid=bae3eeff-1800-0000-a6a1-a49a110c0000 pid=3089 /usr/bin/bash guuid=7d731dc1-1800-0000-a6a1-a49a740b0000 pid=2932->guuid=bae3eeff-1800-0000-a6a1-a49a110c0000 pid=3089 clone guuid=ed174700-1900-0000-a6a1-a49a130c0000 pid=3091 /usr/bin/rm delete-file guuid=7d731dc1-1800-0000-a6a1-a49a740b0000 pid=2932->guuid=ed174700-1900-0000-a6a1-a49a130c0000 pid=3091 execve guuid=153fa100-1900-0000-a6a1-a49a140c0000 pid=3092 /usr/bin/rm guuid=7d731dc1-1800-0000-a6a1-a49a740b0000 pid=2932->guuid=153fa100-1900-0000-a6a1-a49a140c0000 pid=3092 execve guuid=fd9efc00-1900-0000-a6a1-a49a150c0000 pid=3093 /usr/bin/wget net send-data guuid=7d731dc1-1800-0000-a6a1-a49a740b0000 pid=2932->guuid=fd9efc00-1900-0000-a6a1-a49a150c0000 pid=3093 execve guuid=49d4a403-1900-0000-a6a1-a49a160c0000 pid=3094 /usr/bin/curl net send-data write-file guuid=7d731dc1-1800-0000-a6a1-a49a740b0000 pid=2932->guuid=49d4a403-1900-0000-a6a1-a49a160c0000 pid=3094 execve guuid=89253c08-1900-0000-a6a1-a49a170c0000 pid=3095 /usr/bin/chmod guuid=7d731dc1-1800-0000-a6a1-a49a740b0000 pid=2932->guuid=89253c08-1900-0000-a6a1-a49a170c0000 pid=3095 execve guuid=03b0cc08-1900-0000-a6a1-a49a180c0000 pid=3096 /usr/bin/bash guuid=7d731dc1-1800-0000-a6a1-a49a740b0000 pid=2932->guuid=03b0cc08-1900-0000-a6a1-a49a180c0000 pid=3096 clone guuid=baf23409-1900-0000-a6a1-a49a1a0c0000 pid=3098 /usr/bin/rm delete-file guuid=7d731dc1-1800-0000-a6a1-a49a740b0000 pid=2932->guuid=baf23409-1900-0000-a6a1-a49a1a0c0000 pid=3098 execve guuid=86ddb209-1900-0000-a6a1-a49a1b0c0000 pid=3099 /usr/bin/rm guuid=7d731dc1-1800-0000-a6a1-a49a740b0000 pid=2932->guuid=86ddb209-1900-0000-a6a1-a49a1b0c0000 pid=3099 execve guuid=53bd1b0a-1900-0000-a6a1-a49a1c0c0000 pid=3100 /usr/bin/wget net send-data guuid=7d731dc1-1800-0000-a6a1-a49a740b0000 pid=2932->guuid=53bd1b0a-1900-0000-a6a1-a49a1c0c0000 pid=3100 execve guuid=9a3d4110-1900-0000-a6a1-a49a2a0c0000 pid=3114 /usr/bin/curl net send-data write-file guuid=7d731dc1-1800-0000-a6a1-a49a740b0000 pid=2932->guuid=9a3d4110-1900-0000-a6a1-a49a2a0c0000 pid=3114 execve guuid=66b3d513-1900-0000-a6a1-a49a310c0000 pid=3121 /usr/bin/chmod guuid=7d731dc1-1800-0000-a6a1-a49a740b0000 pid=2932->guuid=66b3d513-1900-0000-a6a1-a49a310c0000 pid=3121 execve guuid=fd843214-1900-0000-a6a1-a49a320c0000 pid=3122 /usr/bin/bash guuid=7d731dc1-1800-0000-a6a1-a49a740b0000 pid=2932->guuid=fd843214-1900-0000-a6a1-a49a320c0000 pid=3122 clone guuid=276b7f14-1900-0000-a6a1-a49a340c0000 pid=3124 /usr/bin/rm delete-file guuid=7d731dc1-1800-0000-a6a1-a49a740b0000 pid=2932->guuid=276b7f14-1900-0000-a6a1-a49a340c0000 pid=3124 execve guuid=1b532e15-1900-0000-a6a1-a49a380c0000 pid=3128 /usr/bin/rm guuid=7d731dc1-1800-0000-a6a1-a49a740b0000 pid=2932->guuid=1b532e15-1900-0000-a6a1-a49a380c0000 pid=3128 execve guuid=a654a215-1900-0000-a6a1-a49a3a0c0000 pid=3130 /usr/bin/wget net send-data guuid=7d731dc1-1800-0000-a6a1-a49a740b0000 pid=2932->guuid=a654a215-1900-0000-a6a1-a49a3a0c0000 pid=3130 execve guuid=e22c441a-1900-0000-a6a1-a49a3f0c0000 pid=3135 /usr/bin/curl net send-data write-file guuid=7d731dc1-1800-0000-a6a1-a49a740b0000 pid=2932->guuid=e22c441a-1900-0000-a6a1-a49a3f0c0000 pid=3135 execve guuid=4dde6f1f-1900-0000-a6a1-a49a490c0000 pid=3145 /usr/bin/chmod guuid=7d731dc1-1800-0000-a6a1-a49a740b0000 pid=2932->guuid=4dde6f1f-1900-0000-a6a1-a49a490c0000 pid=3145 execve guuid=03d6f51f-1900-0000-a6a1-a49a4a0c0000 pid=3146 /usr/bin/bash guuid=7d731dc1-1800-0000-a6a1-a49a740b0000 pid=2932->guuid=03d6f51f-1900-0000-a6a1-a49a4a0c0000 pid=3146 clone guuid=0aa5c120-1900-0000-a6a1-a49a4c0c0000 pid=3148 /usr/bin/rm delete-file guuid=7d731dc1-1800-0000-a6a1-a49a740b0000 pid=2932->guuid=0aa5c120-1900-0000-a6a1-a49a4c0c0000 pid=3148 execve guuid=fb90a321-1900-0000-a6a1-a49a4d0c0000 pid=3149 /usr/bin/rm guuid=7d731dc1-1800-0000-a6a1-a49a740b0000 pid=2932->guuid=fb90a321-1900-0000-a6a1-a49a4d0c0000 pid=3149 execve guuid=56868922-1900-0000-a6a1-a49a4e0c0000 pid=3150 /usr/bin/wget net send-data guuid=7d731dc1-1800-0000-a6a1-a49a740b0000 pid=2932->guuid=56868922-1900-0000-a6a1-a49a4e0c0000 pid=3150 execve guuid=45bae426-1900-0000-a6a1-a49a4f0c0000 pid=3151 /usr/bin/curl net send-data write-file guuid=7d731dc1-1800-0000-a6a1-a49a740b0000 pid=2932->guuid=45bae426-1900-0000-a6a1-a49a4f0c0000 pid=3151 execve guuid=0b652730-1900-0000-a6a1-a49a500c0000 pid=3152 /usr/bin/chmod guuid=7d731dc1-1800-0000-a6a1-a49a740b0000 pid=2932->guuid=0b652730-1900-0000-a6a1-a49a500c0000 pid=3152 execve guuid=42aa9430-1900-0000-a6a1-a49a510c0000 pid=3153 /usr/bin/bash guuid=7d731dc1-1800-0000-a6a1-a49a740b0000 pid=2932->guuid=42aa9430-1900-0000-a6a1-a49a510c0000 pid=3153 clone guuid=fbe2e530-1900-0000-a6a1-a49a530c0000 pid=3155 /usr/bin/rm delete-file guuid=7d731dc1-1800-0000-a6a1-a49a740b0000 pid=2932->guuid=fbe2e530-1900-0000-a6a1-a49a530c0000 pid=3155 execve guuid=34325531-1900-0000-a6a1-a49a540c0000 pid=3156 /usr/bin/rm guuid=7d731dc1-1800-0000-a6a1-a49a740b0000 pid=2932->guuid=34325531-1900-0000-a6a1-a49a540c0000 pid=3156 execve guuid=bcb2b931-1900-0000-a6a1-a49a550c0000 pid=3157 /usr/bin/wget net send-data guuid=7d731dc1-1800-0000-a6a1-a49a740b0000 pid=2932->guuid=bcb2b931-1900-0000-a6a1-a49a550c0000 pid=3157 execve guuid=863cc834-1900-0000-a6a1-a49a560c0000 pid=3158 /usr/bin/curl net send-data write-file guuid=7d731dc1-1800-0000-a6a1-a49a740b0000 pid=2932->guuid=863cc834-1900-0000-a6a1-a49a560c0000 pid=3158 execve guuid=c9bcc03a-1900-0000-a6a1-a49a570c0000 pid=3159 /usr/bin/chmod guuid=7d731dc1-1800-0000-a6a1-a49a740b0000 pid=2932->guuid=c9bcc03a-1900-0000-a6a1-a49a570c0000 pid=3159 execve guuid=fece333b-1900-0000-a6a1-a49a590c0000 pid=3161 /usr/bin/bash guuid=7d731dc1-1800-0000-a6a1-a49a740b0000 pid=2932->guuid=fece333b-1900-0000-a6a1-a49a590c0000 pid=3161 clone guuid=27ea723b-1900-0000-a6a1-a49a5b0c0000 pid=3163 /usr/bin/rm delete-file guuid=7d731dc1-1800-0000-a6a1-a49a740b0000 pid=2932->guuid=27ea723b-1900-0000-a6a1-a49a5b0c0000 pid=3163 execve guuid=89a0c63b-1900-0000-a6a1-a49a5d0c0000 pid=3165 /usr/bin/rm guuid=7d731dc1-1800-0000-a6a1-a49a740b0000 pid=2932->guuid=89a0c63b-1900-0000-a6a1-a49a5d0c0000 pid=3165 execve guuid=9c650e3c-1900-0000-a6a1-a49a5f0c0000 pid=3167 /usr/bin/wget net send-data guuid=7d731dc1-1800-0000-a6a1-a49a740b0000 pid=2932->guuid=9c650e3c-1900-0000-a6a1-a49a5f0c0000 pid=3167 execve guuid=f6541340-1900-0000-a6a1-a49a650c0000 pid=3173 /usr/bin/curl net send-data write-file guuid=7d731dc1-1800-0000-a6a1-a49a740b0000 pid=2932->guuid=f6541340-1900-0000-a6a1-a49a650c0000 pid=3173 execve guuid=4631eb4e-1900-0000-a6a1-a49a710c0000 pid=3185 /usr/bin/chmod guuid=7d731dc1-1800-0000-a6a1-a49a740b0000 pid=2932->guuid=4631eb4e-1900-0000-a6a1-a49a710c0000 pid=3185 execve guuid=c0903d50-1900-0000-a6a1-a49a740c0000 pid=3188 /usr/bin/bash guuid=7d731dc1-1800-0000-a6a1-a49a740b0000 pid=2932->guuid=c0903d50-1900-0000-a6a1-a49a740c0000 pid=3188 clone guuid=d5a59750-1900-0000-a6a1-a49a760c0000 pid=3190 /usr/bin/rm delete-file guuid=7d731dc1-1800-0000-a6a1-a49a740b0000 pid=2932->guuid=d5a59750-1900-0000-a6a1-a49a760c0000 pid=3190 execve guuid=bf037251-1900-0000-a6a1-a49a770c0000 pid=3191 /usr/bin/rm guuid=7d731dc1-1800-0000-a6a1-a49a740b0000 pid=2932->guuid=bf037251-1900-0000-a6a1-a49a770c0000 pid=3191 execve guuid=1f9aeb51-1900-0000-a6a1-a49a780c0000 pid=3192 /usr/bin/wget net send-data guuid=7d731dc1-1800-0000-a6a1-a49a740b0000 pid=2932->guuid=1f9aeb51-1900-0000-a6a1-a49a780c0000 pid=3192 execve guuid=e1b3a655-1900-0000-a6a1-a49a790c0000 pid=3193 /usr/bin/curl net send-data write-file guuid=7d731dc1-1800-0000-a6a1-a49a740b0000 pid=2932->guuid=e1b3a655-1900-0000-a6a1-a49a790c0000 pid=3193 execve guuid=f3c4325e-1900-0000-a6a1-a49a7c0c0000 pid=3196 /usr/bin/chmod guuid=7d731dc1-1800-0000-a6a1-a49a740b0000 pid=2932->guuid=f3c4325e-1900-0000-a6a1-a49a7c0c0000 pid=3196 execve guuid=71ea9d5e-1900-0000-a6a1-a49a7f0c0000 pid=3199 /usr/bin/bash guuid=7d731dc1-1800-0000-a6a1-a49a740b0000 pid=2932->guuid=71ea9d5e-1900-0000-a6a1-a49a7f0c0000 pid=3199 clone guuid=9ec6f15e-1900-0000-a6a1-a49a810c0000 pid=3201 /usr/bin/rm delete-file guuid=7d731dc1-1800-0000-a6a1-a49a740b0000 pid=2932->guuid=9ec6f15e-1900-0000-a6a1-a49a810c0000 pid=3201 execve guuid=573b3a5f-1900-0000-a6a1-a49a830c0000 pid=3203 /usr/bin/rm guuid=7d731dc1-1800-0000-a6a1-a49a740b0000 pid=2932->guuid=573b3a5f-1900-0000-a6a1-a49a830c0000 pid=3203 execve 5b654972-c9e1-50d8-b372-2dc2a5b9ad66 5.182.210.174:80 guuid=8ab62cc2-1800-0000-a6a1-a49a770b0000 pid=2935->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=b08fcbc9-1800-0000-a6a1-a49a870b0000 pid=2951->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=7c9869d3-1800-0000-a6a1-a49aa30b0000 pid=2979 /usr/bin/bash guuid=bcb047d3-1800-0000-a6a1-a49aa10b0000 pid=2977->guuid=7c9869d3-1800-0000-a6a1-a49aa30b0000 pid=2979 clone guuid=852e7fd5-1800-0000-a6a1-a49aa90b0000 pid=2985->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=f60875dc-1800-0000-a6a1-a49ab20b0000 pid=2994->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=11ed35e3-1800-0000-a6a1-a49ac10b0000 pid=3009 /usr/bin/bash guuid=318316e3-1800-0000-a6a1-a49ac00b0000 pid=3008->guuid=11ed35e3-1800-0000-a6a1-a49ac10b0000 pid=3009 clone guuid=7c256be4-1800-0000-a6a1-a49ac90b0000 pid=3017->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=20d85ee7-1800-0000-a6a1-a49ad40b0000 pid=3028->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=c37cf9ec-1800-0000-a6a1-a49ae80b0000 pid=3048 /usr/bin/bash guuid=791be5ec-1800-0000-a6a1-a49ae60b0000 pid=3046->guuid=c37cf9ec-1800-0000-a6a1-a49ae80b0000 pid=3048 clone guuid=f9189fed-1800-0000-a6a1-a49aed0b0000 pid=3053->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=2fd812f0-1800-0000-a6a1-a49af40b0000 pid=3060->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=ecf1dff5-1800-0000-a6a1-a49a050c0000 pid=3077 /usr/bin/bash guuid=ea4ccaf5-1800-0000-a6a1-a49a040c0000 pid=3076->guuid=ecf1dff5-1800-0000-a6a1-a49a050c0000 pid=3077 clone guuid=b76480f6-1800-0000-a6a1-a49a090c0000 pid=3081->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=fec41ff9-1800-0000-a6a1-a49a0f0c0000 pid=3087->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=9bbf0a00-1900-0000-a6a1-a49a120c0000 pid=3090 /usr/bin/bash guuid=bae3eeff-1800-0000-a6a1-a49a110c0000 pid=3089->guuid=9bbf0a00-1900-0000-a6a1-a49a120c0000 pid=3090 clone guuid=fd9efc00-1900-0000-a6a1-a49a150c0000 pid=3093->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=49d4a403-1900-0000-a6a1-a49a160c0000 pid=3094->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=5c76fa08-1900-0000-a6a1-a49a190c0000 pid=3097 /usr/bin/bash guuid=03b0cc08-1900-0000-a6a1-a49a180c0000 pid=3096->guuid=5c76fa08-1900-0000-a6a1-a49a190c0000 pid=3097 clone guuid=53bd1b0a-1900-0000-a6a1-a49a1c0c0000 pid=3100->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=9a3d4110-1900-0000-a6a1-a49a2a0c0000 pid=3114->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=f37a5b14-1900-0000-a6a1-a49a330c0000 pid=3123 /usr/bin/bash guuid=fd843214-1900-0000-a6a1-a49a320c0000 pid=3122->guuid=f37a5b14-1900-0000-a6a1-a49a330c0000 pid=3123 clone guuid=a654a215-1900-0000-a6a1-a49a3a0c0000 pid=3130->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=e22c441a-1900-0000-a6a1-a49a3f0c0000 pid=3135->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=52a25320-1900-0000-a6a1-a49a4b0c0000 pid=3147 /usr/bin/bash guuid=03d6f51f-1900-0000-a6a1-a49a4a0c0000 pid=3146->guuid=52a25320-1900-0000-a6a1-a49a4b0c0000 pid=3147 clone guuid=56868922-1900-0000-a6a1-a49a4e0c0000 pid=3150->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=45bae426-1900-0000-a6a1-a49a4f0c0000 pid=3151->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=048eb430-1900-0000-a6a1-a49a520c0000 pid=3154 /usr/bin/bash guuid=42aa9430-1900-0000-a6a1-a49a510c0000 pid=3153->guuid=048eb430-1900-0000-a6a1-a49a520c0000 pid=3154 clone guuid=bcb2b931-1900-0000-a6a1-a49a550c0000 pid=3157->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=863cc834-1900-0000-a6a1-a49a560c0000 pid=3158->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=14564e3b-1900-0000-a6a1-a49a5a0c0000 pid=3162 /usr/bin/bash guuid=fece333b-1900-0000-a6a1-a49a590c0000 pid=3161->guuid=14564e3b-1900-0000-a6a1-a49a5a0c0000 pid=3162 clone guuid=9c650e3c-1900-0000-a6a1-a49a5f0c0000 pid=3167->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=f6541340-1900-0000-a6a1-a49a650c0000 pid=3173->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=1b6f6350-1900-0000-a6a1-a49a750c0000 pid=3189 /usr/bin/bash guuid=c0903d50-1900-0000-a6a1-a49a740c0000 pid=3188->guuid=1b6f6350-1900-0000-a6a1-a49a750c0000 pid=3189 clone guuid=1f9aeb51-1900-0000-a6a1-a49a780c0000 pid=3192->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=e1b3a655-1900-0000-a6a1-a49a790c0000 pid=3193->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=b92abd5e-1900-0000-a6a1-a49a800c0000 pid=3200 /usr/bin/bash guuid=71ea9d5e-1900-0000-a6a1-a49a7f0c0000 pid=3199->guuid=b92abd5e-1900-0000-a6a1-a49a800c0000 pid=3200 clone
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/c4a95654994d20dc982d63e95885f00f976949d1b451419bacce463baf9cfcc3
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c4a95654994d20dc982d63e95885f00f976949d1b451419bacce463baf9cfcc3/
Threat name:
Linux.Trojan.Egairtigado
Create hunting rule
Status:
Malicious
First seen:
2026-08-28 20:46:20 UTC
File Type:
Text (Shell)
AV detection:
13 of 24 (54.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ysuvmvezjuqnzgbnmpuvrbpqb6lwssorwriudg5mzzddxl447tbq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260828-zjvp1sej5s/
Behaviour
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.11
Link:
https://yomi.yoroi.company/submissions/c4a95654994d20dc982d63e95885f00f976949d1b451419bacce463baf9cfcc3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh c4a95654994d20dc982d63e95885f00f976949d1b451419bacce463baf9cfcc3

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3897671/
  
Delivery method
Distributed via web download

Comments