🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c5adc5f3185170c1645b3c05707848e2f16cc92308535cbffa14c2e87b0130b1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c5adc5f3185170c1645b3c05707848e2f16cc92308535cbffa14c2e87b0130b1
SHA3-384 hash: 0bd037bf81bcfb78cc5c67b72b6b066fd67d91c439fa156c94438fc6389f9a010574a62190fd7681a2a048e437ffb76c
SHA1 hash: d2cff443d729f9d0cfc182c05421fe5bb746d47d
MD5 hash: c87b00757ee127e30cf0fa7cd06a83be
humanhash: oranges-one-south-enemy
File name:p
Download: download sample
File size:835 bytes
First seen:2026-07-20 19:10:14 UTC
Last seen:2026-07-21 04:19:00 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 24:kXCKysE2hi0ziQvZohaABmsBFLNU8WQA7:e9Qp+MsABmQpU8WQA7
TLSH T1BA01ABCA8210AE009169DA5D32D771A0B421C3CE194B4FB87F9C5D2EFB8C808B036E96
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://129.121.114.124/XrnGn/an/aua-wget
http://129.121.114.124/BM3yn/an/aua-wget
http://129.121.114.124/s5in/an/aua-wget
http://129.121.114.124/P0Jn/an/aua-wget
http://129.121.114.124/Tz4n/an/aua-wget

Intelligence

File Origin
# of uploads :
3
# of downloads :
80
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive
Link:
https://www.filescan.io/uploads/6a5e72f02a5482001feca38a/reports/9b3cbf3e-a635-4f56-8283-d632edbf9eec/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-07-20T21:14:00Z UTC
Last seen:
2026-07-21T17:25:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/c5adc5f3185170c1645b3c05707848e2f16cc92308535cbffa14c2e87b0130b1/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/86befeac-b8ba-4fb2-afd2-078397b0a9cd
Behavior Graph:
Download SVG
%3 guuid=800988aa-1a00-0000-82b6-0f81fc090000 pid=2556 /usr/bin/sudo guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561 /tmp/sample.bin write-file guuid=800988aa-1a00-0000-82b6-0f81fc090000 pid=2556->guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561 execve guuid=eaa53cad-1a00-0000-82b6-0f81030a0000 pid=2563 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=eaa53cad-1a00-0000-82b6-0f81030a0000 pid=2563 execve guuid=b3e89ead-1a00-0000-82b6-0f81050a0000 pid=2565 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=b3e89ead-1a00-0000-82b6-0f81050a0000 pid=2565 execve guuid=9405f5ad-1a00-0000-82b6-0f81070a0000 pid=2567 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=9405f5ad-1a00-0000-82b6-0f81070a0000 pid=2567 execve guuid=ce6953ae-1a00-0000-82b6-0f81090a0000 pid=2569 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=ce6953ae-1a00-0000-82b6-0f81090a0000 pid=2569 execve guuid=a8bba9ae-1a00-0000-82b6-0f810b0a0000 pid=2571 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=a8bba9ae-1a00-0000-82b6-0f810b0a0000 pid=2571 execve guuid=810002af-1a00-0000-82b6-0f810d0a0000 pid=2573 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=810002af-1a00-0000-82b6-0f810d0a0000 pid=2573 execve guuid=b16656af-1a00-0000-82b6-0f810f0a0000 pid=2575 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=b16656af-1a00-0000-82b6-0f810f0a0000 pid=2575 execve guuid=6aa0aeaf-1a00-0000-82b6-0f81110a0000 pid=2577 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=6aa0aeaf-1a00-0000-82b6-0f81110a0000 pid=2577 execve guuid=52f104b0-1a00-0000-82b6-0f81130a0000 pid=2579 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=52f104b0-1a00-0000-82b6-0f81130a0000 pid=2579 execve guuid=e5ce59b0-1a00-0000-82b6-0f81150a0000 pid=2581 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=e5ce59b0-1a00-0000-82b6-0f81150a0000 pid=2581 execve guuid=f5ddb2b0-1a00-0000-82b6-0f81170a0000 pid=2583 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=f5ddb2b0-1a00-0000-82b6-0f81170a0000 pid=2583 execve guuid=cd9f07b1-1a00-0000-82b6-0f81190a0000 pid=2585 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=cd9f07b1-1a00-0000-82b6-0f81190a0000 pid=2585 execve guuid=b66460b1-1a00-0000-82b6-0f811b0a0000 pid=2587 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=b66460b1-1a00-0000-82b6-0f811b0a0000 pid=2587 execve guuid=b743b7b1-1a00-0000-82b6-0f811e0a0000 pid=2590 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=b743b7b1-1a00-0000-82b6-0f811e0a0000 pid=2590 execve guuid=f68312b2-1a00-0000-82b6-0f81200a0000 pid=2592 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=f68312b2-1a00-0000-82b6-0f81200a0000 pid=2592 execve guuid=74ca70b2-1a00-0000-82b6-0f81220a0000 pid=2594 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=74ca70b2-1a00-0000-82b6-0f81220a0000 pid=2594 execve guuid=fd72d0b2-1a00-0000-82b6-0f81250a0000 pid=2597 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=fd72d0b2-1a00-0000-82b6-0f81250a0000 pid=2597 execve guuid=39843fb3-1a00-0000-82b6-0f81270a0000 pid=2599 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=39843fb3-1a00-0000-82b6-0f81270a0000 pid=2599 execve guuid=2b21c3b3-1a00-0000-82b6-0f812a0a0000 pid=2602 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=2b21c3b3-1a00-0000-82b6-0f812a0a0000 pid=2602 execve guuid=ac4c4eb4-1a00-0000-82b6-0f812d0a0000 pid=2605 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=ac4c4eb4-1a00-0000-82b6-0f812d0a0000 pid=2605 execve guuid=426baeb4-1a00-0000-82b6-0f812f0a0000 pid=2607 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=426baeb4-1a00-0000-82b6-0f812f0a0000 pid=2607 execve guuid=07e602b5-1a00-0000-82b6-0f81310a0000 pid=2609 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=07e602b5-1a00-0000-82b6-0f81310a0000 pid=2609 execve guuid=dd8c59b5-1a00-0000-82b6-0f81330a0000 pid=2611 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=dd8c59b5-1a00-0000-82b6-0f81330a0000 pid=2611 execve guuid=3cc5b6b5-1a00-0000-82b6-0f81340a0000 pid=2612 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=3cc5b6b5-1a00-0000-82b6-0f81340a0000 pid=2612 execve guuid=b755f3b6-1a00-0000-82b6-0f81380a0000 pid=2616 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=b755f3b6-1a00-0000-82b6-0f81380a0000 pid=2616 execve guuid=28e24ab7-1a00-0000-82b6-0f813a0a0000 pid=2618 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=28e24ab7-1a00-0000-82b6-0f813a0a0000 pid=2618 execve guuid=83a59fb7-1a00-0000-82b6-0f813c0a0000 pid=2620 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=83a59fb7-1a00-0000-82b6-0f813c0a0000 pid=2620 execve guuid=fce2f5b7-1a00-0000-82b6-0f813e0a0000 pid=2622 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=fce2f5b7-1a00-0000-82b6-0f813e0a0000 pid=2622 execve guuid=2a0a4eb8-1a00-0000-82b6-0f81410a0000 pid=2625 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=2a0a4eb8-1a00-0000-82b6-0f81410a0000 pid=2625 execve guuid=e277a0b8-1a00-0000-82b6-0f81430a0000 pid=2627 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=e277a0b8-1a00-0000-82b6-0f81430a0000 pid=2627 execve guuid=3844f8b8-1a00-0000-82b6-0f81450a0000 pid=2629 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=3844f8b8-1a00-0000-82b6-0f81450a0000 pid=2629 execve guuid=1eb04bb9-1a00-0000-82b6-0f81480a0000 pid=2632 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=1eb04bb9-1a00-0000-82b6-0f81480a0000 pid=2632 execve guuid=f895a2b9-1a00-0000-82b6-0f814a0a0000 pid=2634 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=f895a2b9-1a00-0000-82b6-0f814a0a0000 pid=2634 execve guuid=25daf8b9-1a00-0000-82b6-0f814d0a0000 pid=2637 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=25daf8b9-1a00-0000-82b6-0f814d0a0000 pid=2637 execve guuid=435a4cba-1a00-0000-82b6-0f814f0a0000 pid=2639 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=435a4cba-1a00-0000-82b6-0f814f0a0000 pid=2639 execve guuid=9590a0ba-1a00-0000-82b6-0f81510a0000 pid=2641 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=9590a0ba-1a00-0000-82b6-0f81510a0000 pid=2641 execve guuid=0875f6ba-1a00-0000-82b6-0f81530a0000 pid=2643 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=0875f6ba-1a00-0000-82b6-0f81530a0000 pid=2643 execve guuid=a76648bb-1a00-0000-82b6-0f81540a0000 pid=2644 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=a76648bb-1a00-0000-82b6-0f81540a0000 pid=2644 execve guuid=99faf9bb-1a00-0000-82b6-0f81580a0000 pid=2648 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=99faf9bb-1a00-0000-82b6-0f81580a0000 pid=2648 execve guuid=9c14a2bc-1a00-0000-82b6-0f815a0a0000 pid=2650 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=9c14a2bc-1a00-0000-82b6-0f815a0a0000 pid=2650 execve guuid=747b4cbd-1a00-0000-82b6-0f815d0a0000 pid=2653 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=747b4cbd-1a00-0000-82b6-0f815d0a0000 pid=2653 execve guuid=fac4bcbd-1a00-0000-82b6-0f815f0a0000 pid=2655 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=fac4bcbd-1a00-0000-82b6-0f815f0a0000 pid=2655 execve guuid=5ad24ebe-1a00-0000-82b6-0f81610a0000 pid=2657 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=5ad24ebe-1a00-0000-82b6-0f81610a0000 pid=2657 execve guuid=5953e2be-1a00-0000-82b6-0f81630a0000 pid=2659 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=5953e2be-1a00-0000-82b6-0f81630a0000 pid=2659 execve guuid=026071bf-1a00-0000-82b6-0f81640a0000 pid=2660 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=026071bf-1a00-0000-82b6-0f81640a0000 pid=2660 execve guuid=87eefabf-1a00-0000-82b6-0f81660a0000 pid=2662 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=87eefabf-1a00-0000-82b6-0f81660a0000 pid=2662 execve guuid=22c185c0-1a00-0000-82b6-0f81670a0000 pid=2663 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=22c185c0-1a00-0000-82b6-0f81670a0000 pid=2663 execve guuid=c6d729c1-1a00-0000-82b6-0f816a0a0000 pid=2666 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=c6d729c1-1a00-0000-82b6-0f816a0a0000 pid=2666 execve guuid=e53fd2c1-1a00-0000-82b6-0f816b0a0000 pid=2667 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=e53fd2c1-1a00-0000-82b6-0f816b0a0000 pid=2667 execve guuid=795d6dc2-1a00-0000-82b6-0f816d0a0000 pid=2669 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=795d6dc2-1a00-0000-82b6-0f816d0a0000 pid=2669 execve guuid=f11010c3-1a00-0000-82b6-0f816e0a0000 pid=2670 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=f11010c3-1a00-0000-82b6-0f816e0a0000 pid=2670 execve guuid=2395b5c3-1a00-0000-82b6-0f816f0a0000 pid=2671 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=2395b5c3-1a00-0000-82b6-0f816f0a0000 pid=2671 execve guuid=101d50c4-1a00-0000-82b6-0f81700a0000 pid=2672 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=101d50c4-1a00-0000-82b6-0f81700a0000 pid=2672 execve guuid=2c3103c5-1a00-0000-82b6-0f81720a0000 pid=2674 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=2c3103c5-1a00-0000-82b6-0f81720a0000 pid=2674 execve guuid=24adb4c5-1a00-0000-82b6-0f81750a0000 pid=2677 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=24adb4c5-1a00-0000-82b6-0f81750a0000 pid=2677 execve guuid=0ab15cc6-1a00-0000-82b6-0f81770a0000 pid=2679 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=0ab15cc6-1a00-0000-82b6-0f81770a0000 pid=2679 execve guuid=834afec6-1a00-0000-82b6-0f817a0a0000 pid=2682 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=834afec6-1a00-0000-82b6-0f817a0a0000 pid=2682 execve guuid=0b7da1c7-1a00-0000-82b6-0f817c0a0000 pid=2684 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=0b7da1c7-1a00-0000-82b6-0f817c0a0000 pid=2684 execve guuid=ed9e50c8-1a00-0000-82b6-0f817e0a0000 pid=2686 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=ed9e50c8-1a00-0000-82b6-0f817e0a0000 pid=2686 execve guuid=8cbf06c9-1a00-0000-82b6-0f817f0a0000 pid=2687 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=8cbf06c9-1a00-0000-82b6-0f817f0a0000 pid=2687 execve guuid=73e06ec9-1a00-0000-82b6-0f81800a0000 pid=2688 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=73e06ec9-1a00-0000-82b6-0f81800a0000 pid=2688 execve guuid=940cdac9-1a00-0000-82b6-0f81810a0000 pid=2689 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=940cdac9-1a00-0000-82b6-0f81810a0000 pid=2689 execve guuid=5a3333ca-1a00-0000-82b6-0f81830a0000 pid=2691 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=5a3333ca-1a00-0000-82b6-0f81830a0000 pid=2691 execve guuid=dbed86ca-1a00-0000-82b6-0f81850a0000 pid=2693 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=dbed86ca-1a00-0000-82b6-0f81850a0000 pid=2693 execve guuid=8d7cdeca-1a00-0000-82b6-0f81870a0000 pid=2695 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=8d7cdeca-1a00-0000-82b6-0f81870a0000 pid=2695 execve guuid=6b1431cb-1a00-0000-82b6-0f818a0a0000 pid=2698 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=6b1431cb-1a00-0000-82b6-0f818a0a0000 pid=2698 execve guuid=580789cb-1a00-0000-82b6-0f818c0a0000 pid=2700 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=580789cb-1a00-0000-82b6-0f818c0a0000 pid=2700 execve guuid=a92de4cb-1a00-0000-82b6-0f818d0a0000 pid=2701 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=a92de4cb-1a00-0000-82b6-0f818d0a0000 pid=2701 execve guuid=371661cc-1a00-0000-82b6-0f818f0a0000 pid=2703 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=371661cc-1a00-0000-82b6-0f818f0a0000 pid=2703 execve guuid=6e27f7cc-1a00-0000-82b6-0f81910a0000 pid=2705 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=6e27f7cc-1a00-0000-82b6-0f81910a0000 pid=2705 execve guuid=535b8fcd-1a00-0000-82b6-0f81930a0000 pid=2707 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=535b8fcd-1a00-0000-82b6-0f81930a0000 pid=2707 execve guuid=9db320ce-1a00-0000-82b6-0f81950a0000 pid=2709 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=9db320ce-1a00-0000-82b6-0f81950a0000 pid=2709 execve guuid=3ac7b2ce-1a00-0000-82b6-0f81970a0000 pid=2711 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=3ac7b2ce-1a00-0000-82b6-0f81970a0000 pid=2711 execve guuid=228f44cf-1a00-0000-82b6-0f81990a0000 pid=2713 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=228f44cf-1a00-0000-82b6-0f81990a0000 pid=2713 execve guuid=a800d2cf-1a00-0000-82b6-0f819b0a0000 pid=2715 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=a800d2cf-1a00-0000-82b6-0f819b0a0000 pid=2715 execve guuid=078fa5d0-1a00-0000-82b6-0f819c0a0000 pid=2716 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=078fa5d0-1a00-0000-82b6-0f819c0a0000 pid=2716 execve guuid=916079d1-1a00-0000-82b6-0f819d0a0000 pid=2717 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=916079d1-1a00-0000-82b6-0f819d0a0000 pid=2717 execve guuid=0d855ad2-1a00-0000-82b6-0f819e0a0000 pid=2718 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=0d855ad2-1a00-0000-82b6-0f819e0a0000 pid=2718 execve guuid=975c7ed3-1a00-0000-82b6-0f819f0a0000 pid=2719 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=975c7ed3-1a00-0000-82b6-0f819f0a0000 pid=2719 execve guuid=ee2408d4-1a00-0000-82b6-0f81a00a0000 pid=2720 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=ee2408d4-1a00-0000-82b6-0f81a00a0000 pid=2720 execve guuid=eda085d4-1a00-0000-82b6-0f81a10a0000 pid=2721 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=eda085d4-1a00-0000-82b6-0f81a10a0000 pid=2721 execve guuid=ed76fdd4-1a00-0000-82b6-0f81a20a0000 pid=2722 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=ed76fdd4-1a00-0000-82b6-0f81a20a0000 pid=2722 execve guuid=f9d972d5-1a00-0000-82b6-0f81a30a0000 pid=2723 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=f9d972d5-1a00-0000-82b6-0f81a30a0000 pid=2723 execve guuid=1f18d8d5-1a00-0000-82b6-0f81a50a0000 pid=2725 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=1f18d8d5-1a00-0000-82b6-0f81a50a0000 pid=2725 execve guuid=8d2850d6-1a00-0000-82b6-0f81a60a0000 pid=2726 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=8d2850d6-1a00-0000-82b6-0f81a60a0000 pid=2726 execve guuid=84edc7d6-1a00-0000-82b6-0f81a70a0000 pid=2727 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=84edc7d6-1a00-0000-82b6-0f81a70a0000 pid=2727 execve guuid=5bd33dd7-1a00-0000-82b6-0f81a80a0000 pid=2728 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=5bd33dd7-1a00-0000-82b6-0f81a80a0000 pid=2728 execve guuid=0385aed7-1a00-0000-82b6-0f81a90a0000 pid=2729 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=0385aed7-1a00-0000-82b6-0f81a90a0000 pid=2729 execve guuid=7e3a15d8-1a00-0000-82b6-0f81aa0a0000 pid=2730 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=7e3a15d8-1a00-0000-82b6-0f81aa0a0000 pid=2730 execve guuid=51f067d8-1a00-0000-82b6-0f81ac0a0000 pid=2732 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=51f067d8-1a00-0000-82b6-0f81ac0a0000 pid=2732 execve guuid=c378bcd8-1a00-0000-82b6-0f81ae0a0000 pid=2734 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=c378bcd8-1a00-0000-82b6-0f81ae0a0000 pid=2734 execve guuid=64ba10d9-1a00-0000-82b6-0f81af0a0000 pid=2735 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=64ba10d9-1a00-0000-82b6-0f81af0a0000 pid=2735 execve guuid=f65367d9-1a00-0000-82b6-0f81b10a0000 pid=2737 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=f65367d9-1a00-0000-82b6-0f81b10a0000 pid=2737 execve guuid=9d44bbd9-1a00-0000-82b6-0f81b20a0000 pid=2738 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=9d44bbd9-1a00-0000-82b6-0f81b20a0000 pid=2738 execve guuid=8a2e10da-1a00-0000-82b6-0f81b40a0000 pid=2740 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=8a2e10da-1a00-0000-82b6-0f81b40a0000 pid=2740 execve guuid=c54f68da-1a00-0000-82b6-0f81b60a0000 pid=2742 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=c54f68da-1a00-0000-82b6-0f81b60a0000 pid=2742 execve guuid=64cbbcda-1a00-0000-82b6-0f81b80a0000 pid=2744 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=64cbbcda-1a00-0000-82b6-0f81b80a0000 pid=2744 execve guuid=6b7a12db-1a00-0000-82b6-0f81b90a0000 pid=2745 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=6b7a12db-1a00-0000-82b6-0f81b90a0000 pid=2745 execve guuid=21758edb-1a00-0000-82b6-0f81ba0a0000 pid=2746 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=21758edb-1a00-0000-82b6-0f81ba0a0000 pid=2746 execve guuid=c48909dc-1a00-0000-82b6-0f81bc0a0000 pid=2748 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=c48909dc-1a00-0000-82b6-0f81bc0a0000 pid=2748 execve guuid=f24c91dc-1a00-0000-82b6-0f81bd0a0000 pid=2749 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=f24c91dc-1a00-0000-82b6-0f81bd0a0000 pid=2749 execve guuid=38e646dd-1a00-0000-82b6-0f81be0a0000 pid=2750 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=38e646dd-1a00-0000-82b6-0f81be0a0000 pid=2750 execve guuid=bc03b7dd-1a00-0000-82b6-0f81bf0a0000 pid=2751 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=bc03b7dd-1a00-0000-82b6-0f81bf0a0000 pid=2751 execve guuid=81540cde-1a00-0000-82b6-0f81c10a0000 pid=2753 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=81540cde-1a00-0000-82b6-0f81c10a0000 pid=2753 execve guuid=70690bdf-1a00-0000-82b6-0f81c50a0000 pid=2757 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=70690bdf-1a00-0000-82b6-0f81c50a0000 pid=2757 execve guuid=7dc7a3df-1a00-0000-82b6-0f81c80a0000 pid=2760 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=7dc7a3df-1a00-0000-82b6-0f81c80a0000 pid=2760 execve guuid=40e51be0-1a00-0000-82b6-0f81ca0a0000 pid=2762 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=40e51be0-1a00-0000-82b6-0f81ca0a0000 pid=2762 execve guuid=ac7b7ae0-1a00-0000-82b6-0f81cb0a0000 pid=2763 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=ac7b7ae0-1a00-0000-82b6-0f81cb0a0000 pid=2763 execve guuid=66a748e1-1a00-0000-82b6-0f81cd0a0000 pid=2765 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=66a748e1-1a00-0000-82b6-0f81cd0a0000 pid=2765 execve guuid=f102eee1-1a00-0000-82b6-0f81d00a0000 pid=2768 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=f102eee1-1a00-0000-82b6-0f81d00a0000 pid=2768 execve guuid=0d0e9ce2-1a00-0000-82b6-0f81d30a0000 pid=2771 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=0d0e9ce2-1a00-0000-82b6-0f81d30a0000 pid=2771 execve guuid=929000e3-1a00-0000-82b6-0f81d40a0000 pid=2772 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=929000e3-1a00-0000-82b6-0f81d40a0000 pid=2772 execve guuid=4ffd58e3-1a00-0000-82b6-0f81d60a0000 pid=2774 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=4ffd58e3-1a00-0000-82b6-0f81d60a0000 pid=2774 execve guuid=43e5afe3-1a00-0000-82b6-0f81d70a0000 pid=2775 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=43e5afe3-1a00-0000-82b6-0f81d70a0000 pid=2775 execve guuid=cb9a46e4-1a00-0000-82b6-0f81d80a0000 pid=2776 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=cb9a46e4-1a00-0000-82b6-0f81d80a0000 pid=2776 execve guuid=2bfaf7e4-1a00-0000-82b6-0f81d90a0000 pid=2777 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=2bfaf7e4-1a00-0000-82b6-0f81d90a0000 pid=2777 execve guuid=c7179be5-1a00-0000-82b6-0f81da0a0000 pid=2778 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=c7179be5-1a00-0000-82b6-0f81da0a0000 pid=2778 execve guuid=397533e6-1a00-0000-82b6-0f81dc0a0000 pid=2780 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=397533e6-1a00-0000-82b6-0f81dc0a0000 pid=2780 execve guuid=eef902e7-1a00-0000-82b6-0f81dd0a0000 pid=2781 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=eef902e7-1a00-0000-82b6-0f81dd0a0000 pid=2781 execve guuid=cdecbce7-1a00-0000-82b6-0f81de0a0000 pid=2782 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=cdecbce7-1a00-0000-82b6-0f81de0a0000 pid=2782 execve guuid=dd4337e8-1a00-0000-82b6-0f81df0a0000 pid=2783 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=dd4337e8-1a00-0000-82b6-0f81df0a0000 pid=2783 execve guuid=97a8fae8-1a00-0000-82b6-0f81e20a0000 pid=2786 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=97a8fae8-1a00-0000-82b6-0f81e20a0000 pid=2786 execve guuid=6504ace9-1a00-0000-82b6-0f81e40a0000 pid=2788 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=6504ace9-1a00-0000-82b6-0f81e40a0000 pid=2788 execve guuid=08eb55ea-1a00-0000-82b6-0f81e70a0000 pid=2791 /usr/bin/ls guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=08eb55ea-1a00-0000-82b6-0f81e70a0000 pid=2791 execve guuid=4e06e9ea-1a00-0000-82b6-0f81e90a0000 pid=2793 /usr/bin/rm guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=4e06e9ea-1a00-0000-82b6-0f81e90a0000 pid=2793 execve guuid=c90c37eb-1a00-0000-82b6-0f81eb0a0000 pid=2795 /usr/bin/wget net send-data write-file guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=c90c37eb-1a00-0000-82b6-0f81eb0a0000 pid=2795 execve guuid=69a23dfa-1a00-0000-82b6-0f81f60a0000 pid=2806 /usr/bin/chmod guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=69a23dfa-1a00-0000-82b6-0f81f60a0000 pid=2806 execve guuid=921cd6fa-1a00-0000-82b6-0f81f70a0000 pid=2807 /tmp/XrnG guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=921cd6fa-1a00-0000-82b6-0f81f70a0000 pid=2807 execve guuid=670b4bfc-1a00-0000-82b6-0f81fa0a0000 pid=2810 /usr/bin/rm guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=670b4bfc-1a00-0000-82b6-0f81fa0a0000 pid=2810 execve guuid=901ddffc-1a00-0000-82b6-0f81fb0a0000 pid=2811 /usr/bin/wget net send-data write-file guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=901ddffc-1a00-0000-82b6-0f81fb0a0000 pid=2811 execve guuid=e4dbcf09-1b00-0000-82b6-0f810c0b0000 pid=2828 /usr/bin/chmod guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=e4dbcf09-1b00-0000-82b6-0f810c0b0000 pid=2828 execve guuid=dc17590a-1b00-0000-82b6-0f810d0b0000 pid=2829 /tmp/BM3y guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=dc17590a-1b00-0000-82b6-0f810d0b0000 pid=2829 execve guuid=9134430b-1b00-0000-82b6-0f81120b0000 pid=2834 /usr/bin/rm guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=9134430b-1b00-0000-82b6-0f81120b0000 pid=2834 execve guuid=1e2cfb0b-1b00-0000-82b6-0f81150b0000 pid=2837 /usr/bin/wget net send-data write-file guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=1e2cfb0b-1b00-0000-82b6-0f81150b0000 pid=2837 execve guuid=ae7b4e1a-1b00-0000-82b6-0f812d0b0000 pid=2861 /usr/bin/chmod guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=ae7b4e1a-1b00-0000-82b6-0f812d0b0000 pid=2861 execve guuid=5b54ae1a-1b00-0000-82b6-0f812e0b0000 pid=2862 /tmp/s5i guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=5b54ae1a-1b00-0000-82b6-0f812e0b0000 pid=2862 execve guuid=f5e9711b-1b00-0000-82b6-0f81310b0000 pid=2865 /usr/bin/rm guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=f5e9711b-1b00-0000-82b6-0f81310b0000 pid=2865 execve guuid=8da1aa1b-1b00-0000-82b6-0f81320b0000 pid=2866 /usr/bin/wget net send-data write-file guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=8da1aa1b-1b00-0000-82b6-0f81320b0000 pid=2866 execve guuid=7de6b228-1b00-0000-82b6-0f81550b0000 pid=2901 /usr/bin/chmod guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=7de6b228-1b00-0000-82b6-0f81550b0000 pid=2901 execve guuid=23b08529-1b00-0000-82b6-0f81580b0000 pid=2904 /tmp/P0J guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=23b08529-1b00-0000-82b6-0f81580b0000 pid=2904 execve guuid=ad32b32b-1b00-0000-82b6-0f815e0b0000 pid=2910 /usr/bin/rm guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=ad32b32b-1b00-0000-82b6-0f815e0b0000 pid=2910 execve guuid=8943192c-1b00-0000-82b6-0f81610b0000 pid=2913 /usr/bin/wget net send-data write-file guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=8943192c-1b00-0000-82b6-0f81610b0000 pid=2913 execve guuid=347e7d3a-1b00-0000-82b6-0f81800b0000 pid=2944 /usr/bin/chmod guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=347e7d3a-1b00-0000-82b6-0f81800b0000 pid=2944 execve guuid=2f8edb3a-1b00-0000-82b6-0f81820b0000 pid=2946 /tmp/Tz4 guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=2f8edb3a-1b00-0000-82b6-0f81820b0000 pid=2946 execve guuid=7c5f2b3c-1b00-0000-82b6-0f81860b0000 pid=2950 /usr/bin/rm delete-file guuid=1775d5ac-1a00-0000-82b6-0f81010a0000 pid=2561->guuid=7c5f2b3c-1b00-0000-82b6-0f81860b0000 pid=2950 execve 801186e6-5fe8-5959-a7b4-832d8d66e7aa 129.121.114.124:80 guuid=c90c37eb-1a00-0000-82b6-0f81eb0a0000 pid=2795->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 134B guuid=901ddffc-1a00-0000-82b6-0f81fb0a0000 pid=2811->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 134B guuid=1e2cfb0b-1b00-0000-82b6-0f81150b0000 pid=2837->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 133B guuid=8da1aa1b-1b00-0000-82b6-0f81320b0000 pid=2866->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 133B guuid=8943192c-1b00-0000-82b6-0f81610b0000 pid=2913->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 133B
Score:
98%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/c5adc5f3185170c1645b3c05707848e2f16cc92308535cbffa14c2e87b0130b1
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c5adc5f3185170c1645b3c05707848e2f16cc92308535cbffa14c2e87b0130b1/
Threat name:
Document-HTML.Trojan.Bash
Create hunting rule
Status:
Malicious
First seen:
2026-07-20 19:13:38 UTC
File Type:
Text (Shell)
AV detection:
12 of 24 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=yww4l4yykfymczc3hqcxa6ci4lywzsjdbbjvzp72ctboq6ybgcyq._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
discovery linux
Link:
https://tria.ge/reports/260720-xv7slscw8m/
Behaviour
Reads runtime system information
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.26
Link:
https://yomi.yoroi.company/submissions/c5adc5f3185170c1645b3c05707848e2f16cc92308535cbffa14c2e87b0130b1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh c5adc5f3185170c1645b3c05707848e2f16cc92308535cbffa14c2e87b0130b1

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3866369/
  
Delivery method
Distributed via web download

Comments