MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c851ecd062b1cc9db81dcff434973c2fb577ae732cba966aa469744c2d074c31. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c851ecd062b1cc9db81dcff434973c2fb577ae732cba966aa469744c2d074c31
SHA3-384 hash: fd544bb1e4ac798e6678e4be5e60aea950aeafe916832c4644185e3bf76b88e41445e38d58f55a6ff47fe4919683fcfd
SHA1 hash: 7b666c8a911b5e0e64ecf5306febdffc327debf0
MD5 hash: 9bd2093752a963dc928658d30a6f61eb
humanhash: coffee-cup-lake-ohio
File name:p
Download: download sample
File size:835 bytes
First seen:2026-08-04 06:17:59 UTC
Last seen:2026-08-05 04:05:48 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkaxCBriFCeTKCkxFdCyWBrdCg8wgbUauD:kXCKysE2hi0ziQvZohaxHFPKRJqTN8a7
TLSH T1A9014CCA87506900901DAA5E62D752A0B410C3CE5A4A4F787F9C5D3EFB98914B127F98
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://129.121.114.124/rOYn/an/aua-wget
http://129.121.114.124/Yu9n/an/aua-wget
http://129.121.114.124/oI5jn/an/aua-wget
http://129.121.114.124/RKYn/an/aua-wget
http://129.121.114.124/fUE0n/an/aua-wget

Intelligence

File Origin
# of uploads :
3
# of downloads :
59
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive
Link:
https://www.filescan.io/uploads/6a71843459a68d792b9495b8/reports/5e3952c1-fb98-4212-8c3f-83e3f7714cf8/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-08-04T04:12:00Z UTC
Last seen:
2026-08-04T04:26:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/c851ecd062b1cc9db81dcff434973c2fb577ae732cba966aa469744c2d074c31/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/5d9795a7-1fb5-4104-a1d4-a59a322c7d31
Behavior Graph:
Download SVG
%3 guuid=f04cf659-1b00-0000-ae35-b8cf44080000 pid=2116 /usr/bin/sudo guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126 /tmp/sample.bin write-file guuid=f04cf659-1b00-0000-ae35-b8cf44080000 pid=2116->guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126 execve guuid=ccc7545d-1b00-0000-ae35-b8cf50080000 pid=2128 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=ccc7545d-1b00-0000-ae35-b8cf50080000 pid=2128 execve guuid=0d7e015e-1b00-0000-ae35-b8cf54080000 pid=2132 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=0d7e015e-1b00-0000-ae35-b8cf54080000 pid=2132 execve guuid=3aef9b5e-1b00-0000-ae35-b8cf56080000 pid=2134 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=3aef9b5e-1b00-0000-ae35-b8cf56080000 pid=2134 execve guuid=fd7fb65f-1b00-0000-ae35-b8cf58080000 pid=2136 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=fd7fb65f-1b00-0000-ae35-b8cf58080000 pid=2136 execve guuid=4b7e2b60-1b00-0000-ae35-b8cf5a080000 pid=2138 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=4b7e2b60-1b00-0000-ae35-b8cf5a080000 pid=2138 execve guuid=5bc9b660-1b00-0000-ae35-b8cf5d080000 pid=2141 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=5bc9b660-1b00-0000-ae35-b8cf5d080000 pid=2141 execve guuid=699e6d61-1b00-0000-ae35-b8cf5f080000 pid=2143 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=699e6d61-1b00-0000-ae35-b8cf5f080000 pid=2143 execve guuid=1a0e0262-1b00-0000-ae35-b8cf61080000 pid=2145 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=1a0e0262-1b00-0000-ae35-b8cf61080000 pid=2145 execve guuid=a754d162-1b00-0000-ae35-b8cf63080000 pid=2147 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=a754d162-1b00-0000-ae35-b8cf63080000 pid=2147 execve guuid=daaa9463-1b00-0000-ae35-b8cf66080000 pid=2150 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=daaa9463-1b00-0000-ae35-b8cf66080000 pid=2150 execve guuid=86457364-1b00-0000-ae35-b8cf69080000 pid=2153 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=86457364-1b00-0000-ae35-b8cf69080000 pid=2153 execve guuid=73d42565-1b00-0000-ae35-b8cf6b080000 pid=2155 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=73d42565-1b00-0000-ae35-b8cf6b080000 pid=2155 execve guuid=6cbfd665-1b00-0000-ae35-b8cf6d080000 pid=2157 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=6cbfd665-1b00-0000-ae35-b8cf6d080000 pid=2157 execve guuid=1a559666-1b00-0000-ae35-b8cf6e080000 pid=2158 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=1a559666-1b00-0000-ae35-b8cf6e080000 pid=2158 execve guuid=ee796c67-1b00-0000-ae35-b8cf6f080000 pid=2159 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=ee796c67-1b00-0000-ae35-b8cf6f080000 pid=2159 execve guuid=d4611f68-1b00-0000-ae35-b8cf70080000 pid=2160 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=d4611f68-1b00-0000-ae35-b8cf70080000 pid=2160 execve guuid=87d9b668-1b00-0000-ae35-b8cf73080000 pid=2163 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=87d9b668-1b00-0000-ae35-b8cf73080000 pid=2163 execve guuid=7caa4b69-1b00-0000-ae35-b8cf75080000 pid=2165 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=7caa4b69-1b00-0000-ae35-b8cf75080000 pid=2165 execve guuid=c3bfd769-1b00-0000-ae35-b8cf77080000 pid=2167 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=c3bfd769-1b00-0000-ae35-b8cf77080000 pid=2167 execve guuid=80c86b6a-1b00-0000-ae35-b8cf79080000 pid=2169 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=80c86b6a-1b00-0000-ae35-b8cf79080000 pid=2169 execve guuid=dc14fb6a-1b00-0000-ae35-b8cf7c080000 pid=2172 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=dc14fb6a-1b00-0000-ae35-b8cf7c080000 pid=2172 execve guuid=3acb916b-1b00-0000-ae35-b8cf7e080000 pid=2174 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=3acb916b-1b00-0000-ae35-b8cf7e080000 pid=2174 execve guuid=74c92d6c-1b00-0000-ae35-b8cf80080000 pid=2176 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=74c92d6c-1b00-0000-ae35-b8cf80080000 pid=2176 execve guuid=0e69c66c-1b00-0000-ae35-b8cf82080000 pid=2178 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=0e69c66c-1b00-0000-ae35-b8cf82080000 pid=2178 execve guuid=5651576d-1b00-0000-ae35-b8cf84080000 pid=2180 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=5651576d-1b00-0000-ae35-b8cf84080000 pid=2180 execve guuid=316bfe6d-1b00-0000-ae35-b8cf85080000 pid=2181 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=316bfe6d-1b00-0000-ae35-b8cf85080000 pid=2181 execve guuid=8893a86e-1b00-0000-ae35-b8cf87080000 pid=2183 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=8893a86e-1b00-0000-ae35-b8cf87080000 pid=2183 execve guuid=cbaa386f-1b00-0000-ae35-b8cf89080000 pid=2185 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=cbaa386f-1b00-0000-ae35-b8cf89080000 pid=2185 execve guuid=2dc8c56f-1b00-0000-ae35-b8cf8b080000 pid=2187 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=2dc8c56f-1b00-0000-ae35-b8cf8b080000 pid=2187 execve guuid=c5584170-1b00-0000-ae35-b8cf8d080000 pid=2189 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=c5584170-1b00-0000-ae35-b8cf8d080000 pid=2189 execve guuid=e323de70-1b00-0000-ae35-b8cf90080000 pid=2192 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=e323de70-1b00-0000-ae35-b8cf90080000 pid=2192 execve guuid=08a26d71-1b00-0000-ae35-b8cf92080000 pid=2194 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=08a26d71-1b00-0000-ae35-b8cf92080000 pid=2194 execve guuid=2ad70472-1b00-0000-ae35-b8cf94080000 pid=2196 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=2ad70472-1b00-0000-ae35-b8cf94080000 pid=2196 execve guuid=06279972-1b00-0000-ae35-b8cf97080000 pid=2199 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=06279972-1b00-0000-ae35-b8cf97080000 pid=2199 execve guuid=c0e33973-1b00-0000-ae35-b8cf98080000 pid=2200 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=c0e33973-1b00-0000-ae35-b8cf98080000 pid=2200 execve guuid=46a4e473-1b00-0000-ae35-b8cf9a080000 pid=2202 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=46a4e473-1b00-0000-ae35-b8cf9a080000 pid=2202 execve guuid=506dae74-1b00-0000-ae35-b8cf9b080000 pid=2203 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=506dae74-1b00-0000-ae35-b8cf9b080000 pid=2203 execve guuid=76a35075-1b00-0000-ae35-b8cf9e080000 pid=2206 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=76a35075-1b00-0000-ae35-b8cf9e080000 pid=2206 execve guuid=da5be075-1b00-0000-ae35-b8cfa1080000 pid=2209 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=da5be075-1b00-0000-ae35-b8cfa1080000 pid=2209 execve guuid=a8aa7076-1b00-0000-ae35-b8cfa3080000 pid=2211 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=a8aa7076-1b00-0000-ae35-b8cfa3080000 pid=2211 execve guuid=a3230377-1b00-0000-ae35-b8cfa6080000 pid=2214 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=a3230377-1b00-0000-ae35-b8cfa6080000 pid=2214 execve guuid=44fd9477-1b00-0000-ae35-b8cfa9080000 pid=2217 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=44fd9477-1b00-0000-ae35-b8cfa9080000 pid=2217 execve guuid=85273378-1b00-0000-ae35-b8cfab080000 pid=2219 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=85273378-1b00-0000-ae35-b8cfab080000 pid=2219 execve guuid=01f8d478-1b00-0000-ae35-b8cfac080000 pid=2220 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=01f8d478-1b00-0000-ae35-b8cfac080000 pid=2220 execve guuid=619aa579-1b00-0000-ae35-b8cfad080000 pid=2221 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=619aa579-1b00-0000-ae35-b8cfad080000 pid=2221 execve guuid=3c68467a-1b00-0000-ae35-b8cfaf080000 pid=2223 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=3c68467a-1b00-0000-ae35-b8cfaf080000 pid=2223 execve guuid=0d79037b-1b00-0000-ae35-b8cfb0080000 pid=2224 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=0d79037b-1b00-0000-ae35-b8cfb0080000 pid=2224 execve guuid=09ccd67b-1b00-0000-ae35-b8cfb1080000 pid=2225 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=09ccd67b-1b00-0000-ae35-b8cfb1080000 pid=2225 execve guuid=f524837c-1b00-0000-ae35-b8cfb4080000 pid=2228 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=f524837c-1b00-0000-ae35-b8cfb4080000 pid=2228 execve guuid=b869247d-1b00-0000-ae35-b8cfb6080000 pid=2230 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=b869247d-1b00-0000-ae35-b8cfb6080000 pid=2230 execve guuid=b533c97d-1b00-0000-ae35-b8cfb9080000 pid=2233 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=b533c97d-1b00-0000-ae35-b8cfb9080000 pid=2233 execve guuid=11d8847e-1b00-0000-ae35-b8cfbb080000 pid=2235 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=11d8847e-1b00-0000-ae35-b8cfbb080000 pid=2235 execve guuid=5ae43c7f-1b00-0000-ae35-b8cfbd080000 pid=2237 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=5ae43c7f-1b00-0000-ae35-b8cfbd080000 pid=2237 execve guuid=fb144980-1b00-0000-ae35-b8cfbe080000 pid=2238 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=fb144980-1b00-0000-ae35-b8cfbe080000 pid=2238 execve guuid=fa6ce880-1b00-0000-ae35-b8cfbf080000 pid=2239 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=fa6ce880-1b00-0000-ae35-b8cfbf080000 pid=2239 execve guuid=9c435181-1b00-0000-ae35-b8cfc1080000 pid=2241 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=9c435181-1b00-0000-ae35-b8cfc1080000 pid=2241 execve guuid=9df3d981-1b00-0000-ae35-b8cfc4080000 pid=2244 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=9df3d981-1b00-0000-ae35-b8cfc4080000 pid=2244 execve guuid=e3c54e82-1b00-0000-ae35-b8cfc6080000 pid=2246 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=e3c54e82-1b00-0000-ae35-b8cfc6080000 pid=2246 execve guuid=e8b2f682-1b00-0000-ae35-b8cfc8080000 pid=2248 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=e8b2f682-1b00-0000-ae35-b8cfc8080000 pid=2248 execve guuid=dd59a783-1b00-0000-ae35-b8cfca080000 pid=2250 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=dd59a783-1b00-0000-ae35-b8cfca080000 pid=2250 execve guuid=af786b84-1b00-0000-ae35-b8cfcc080000 pid=2252 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=af786b84-1b00-0000-ae35-b8cfcc080000 pid=2252 execve guuid=27093385-1b00-0000-ae35-b8cfcf080000 pid=2255 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=27093385-1b00-0000-ae35-b8cfcf080000 pid=2255 execve guuid=fa9bd885-1b00-0000-ae35-b8cfd2080000 pid=2258 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=fa9bd885-1b00-0000-ae35-b8cfd2080000 pid=2258 execve guuid=f3945c86-1b00-0000-ae35-b8cfd5080000 pid=2261 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=f3945c86-1b00-0000-ae35-b8cfd5080000 pid=2261 execve guuid=5b9dd086-1b00-0000-ae35-b8cfd7080000 pid=2263 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=5b9dd086-1b00-0000-ae35-b8cfd7080000 pid=2263 execve guuid=1a502f87-1b00-0000-ae35-b8cfd8080000 pid=2264 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=1a502f87-1b00-0000-ae35-b8cfd8080000 pid=2264 execve guuid=6f31af87-1b00-0000-ae35-b8cfda080000 pid=2266 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=6f31af87-1b00-0000-ae35-b8cfda080000 pid=2266 execve guuid=12652e88-1b00-0000-ae35-b8cfdd080000 pid=2269 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=12652e88-1b00-0000-ae35-b8cfdd080000 pid=2269 execve guuid=18028b88-1b00-0000-ae35-b8cfde080000 pid=2270 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=18028b88-1b00-0000-ae35-b8cfde080000 pid=2270 execve guuid=b257ef88-1b00-0000-ae35-b8cfe0080000 pid=2272 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=b257ef88-1b00-0000-ae35-b8cfe0080000 pid=2272 execve guuid=6df04d89-1b00-0000-ae35-b8cfe1080000 pid=2273 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=6df04d89-1b00-0000-ae35-b8cfe1080000 pid=2273 execve guuid=b723b389-1b00-0000-ae35-b8cfe2080000 pid=2274 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=b723b389-1b00-0000-ae35-b8cfe2080000 pid=2274 execve guuid=c6ff2c8a-1b00-0000-ae35-b8cfe3080000 pid=2275 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=c6ff2c8a-1b00-0000-ae35-b8cfe3080000 pid=2275 execve guuid=2c7f968a-1b00-0000-ae35-b8cfe4080000 pid=2276 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=2c7f968a-1b00-0000-ae35-b8cfe4080000 pid=2276 execve guuid=5c33f68a-1b00-0000-ae35-b8cfe5080000 pid=2277 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=5c33f68a-1b00-0000-ae35-b8cfe5080000 pid=2277 execve guuid=f20d4c8b-1b00-0000-ae35-b8cfe7080000 pid=2279 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=f20d4c8b-1b00-0000-ae35-b8cfe7080000 pid=2279 execve guuid=a921a28b-1b00-0000-ae35-b8cfe9080000 pid=2281 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=a921a28b-1b00-0000-ae35-b8cfe9080000 pid=2281 execve guuid=b16efc8b-1b00-0000-ae35-b8cfea080000 pid=2282 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=b16efc8b-1b00-0000-ae35-b8cfea080000 pid=2282 execve guuid=90975f8c-1b00-0000-ae35-b8cfec080000 pid=2284 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=90975f8c-1b00-0000-ae35-b8cfec080000 pid=2284 execve guuid=2e3dd38c-1b00-0000-ae35-b8cfee080000 pid=2286 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=2e3dd38c-1b00-0000-ae35-b8cfee080000 pid=2286 execve guuid=e467318d-1b00-0000-ae35-b8cff0080000 pid=2288 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=e467318d-1b00-0000-ae35-b8cff0080000 pid=2288 execve guuid=acf48e8d-1b00-0000-ae35-b8cff2080000 pid=2290 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=acf48e8d-1b00-0000-ae35-b8cff2080000 pid=2290 execve guuid=1038e58d-1b00-0000-ae35-b8cff3080000 pid=2291 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=1038e58d-1b00-0000-ae35-b8cff3080000 pid=2291 execve guuid=f129488e-1b00-0000-ae35-b8cff4080000 pid=2292 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=f129488e-1b00-0000-ae35-b8cff4080000 pid=2292 execve guuid=cbd6268f-1b00-0000-ae35-b8cff5080000 pid=2293 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=cbd6268f-1b00-0000-ae35-b8cff5080000 pid=2293 execve guuid=dabbfc8f-1b00-0000-ae35-b8cff7080000 pid=2295 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=dabbfc8f-1b00-0000-ae35-b8cff7080000 pid=2295 execve guuid=4155d690-1b00-0000-ae35-b8cff8080000 pid=2296 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=4155d690-1b00-0000-ae35-b8cff8080000 pid=2296 execve guuid=79707091-1b00-0000-ae35-b8cffb080000 pid=2299 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=79707091-1b00-0000-ae35-b8cffb080000 pid=2299 execve guuid=bcc10392-1b00-0000-ae35-b8cffd080000 pid=2301 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=bcc10392-1b00-0000-ae35-b8cffd080000 pid=2301 execve guuid=0051a392-1b00-0000-ae35-b8cfff080000 pid=2303 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=0051a392-1b00-0000-ae35-b8cfff080000 pid=2303 execve guuid=f2ed4c93-1b00-0000-ae35-b8cf02090000 pid=2306 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=f2ed4c93-1b00-0000-ae35-b8cf02090000 pid=2306 execve guuid=5f2eaa93-1b00-0000-ae35-b8cf04090000 pid=2308 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=5f2eaa93-1b00-0000-ae35-b8cf04090000 pid=2308 execve guuid=902b0494-1b00-0000-ae35-b8cf06090000 pid=2310 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=902b0494-1b00-0000-ae35-b8cf06090000 pid=2310 execve guuid=9b725a94-1b00-0000-ae35-b8cf07090000 pid=2311 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=9b725a94-1b00-0000-ae35-b8cf07090000 pid=2311 execve guuid=4b1f0595-1b00-0000-ae35-b8cf0b090000 pid=2315 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=4b1f0595-1b00-0000-ae35-b8cf0b090000 pid=2315 execve guuid=77857095-1b00-0000-ae35-b8cf0e090000 pid=2318 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=77857095-1b00-0000-ae35-b8cf0e090000 pid=2318 execve guuid=1e4d0996-1b00-0000-ae35-b8cf11090000 pid=2321 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=1e4d0996-1b00-0000-ae35-b8cf11090000 pid=2321 execve guuid=55226e96-1b00-0000-ae35-b8cf13090000 pid=2323 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=55226e96-1b00-0000-ae35-b8cf13090000 pid=2323 execve guuid=365b0597-1b00-0000-ae35-b8cf16090000 pid=2326 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=365b0597-1b00-0000-ae35-b8cf16090000 pid=2326 execve guuid=d6fa6d97-1b00-0000-ae35-b8cf17090000 pid=2327 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=d6fa6d97-1b00-0000-ae35-b8cf17090000 pid=2327 execve guuid=558cc997-1b00-0000-ae35-b8cf18090000 pid=2328 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=558cc997-1b00-0000-ae35-b8cf18090000 pid=2328 execve guuid=b7642d98-1b00-0000-ae35-b8cf1a090000 pid=2330 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=b7642d98-1b00-0000-ae35-b8cf1a090000 pid=2330 execve guuid=3020e798-1b00-0000-ae35-b8cf1d090000 pid=2333 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=3020e798-1b00-0000-ae35-b8cf1d090000 pid=2333 execve guuid=dd2c5699-1b00-0000-ae35-b8cf20090000 pid=2336 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=dd2c5699-1b00-0000-ae35-b8cf20090000 pid=2336 execve guuid=a689d599-1b00-0000-ae35-b8cf23090000 pid=2339 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=a689d599-1b00-0000-ae35-b8cf23090000 pid=2339 execve guuid=8d0be29a-1b00-0000-ae35-b8cf25090000 pid=2341 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=8d0be29a-1b00-0000-ae35-b8cf25090000 pid=2341 execve guuid=83607c9b-1b00-0000-ae35-b8cf27090000 pid=2343 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=83607c9b-1b00-0000-ae35-b8cf27090000 pid=2343 execve guuid=14c9a99c-1b00-0000-ae35-b8cf2b090000 pid=2347 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=14c9a99c-1b00-0000-ae35-b8cf2b090000 pid=2347 execve guuid=baf40e9d-1b00-0000-ae35-b8cf2d090000 pid=2349 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=baf40e9d-1b00-0000-ae35-b8cf2d090000 pid=2349 execve guuid=459a9b9d-1b00-0000-ae35-b8cf2f090000 pid=2351 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=459a9b9d-1b00-0000-ae35-b8cf2f090000 pid=2351 execve guuid=a9b50b9e-1b00-0000-ae35-b8cf31090000 pid=2353 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=a9b50b9e-1b00-0000-ae35-b8cf31090000 pid=2353 execve guuid=3ae6cc9e-1b00-0000-ae35-b8cf33090000 pid=2355 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=3ae6cc9e-1b00-0000-ae35-b8cf33090000 pid=2355 execve guuid=a1897e9f-1b00-0000-ae35-b8cf35090000 pid=2357 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=a1897e9f-1b00-0000-ae35-b8cf35090000 pid=2357 execve guuid=b90635a0-1b00-0000-ae35-b8cf37090000 pid=2359 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=b90635a0-1b00-0000-ae35-b8cf37090000 pid=2359 execve guuid=948c02a1-1b00-0000-ae35-b8cf3a090000 pid=2362 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=948c02a1-1b00-0000-ae35-b8cf3a090000 pid=2362 execve guuid=670013a2-1b00-0000-ae35-b8cf3c090000 pid=2364 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=670013a2-1b00-0000-ae35-b8cf3c090000 pid=2364 execve guuid=89d1bba2-1b00-0000-ae35-b8cf3d090000 pid=2365 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=89d1bba2-1b00-0000-ae35-b8cf3d090000 pid=2365 execve guuid=243c92a3-1b00-0000-ae35-b8cf3f090000 pid=2367 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=243c92a3-1b00-0000-ae35-b8cf3f090000 pid=2367 execve guuid=f257fda3-1b00-0000-ae35-b8cf40090000 pid=2368 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=f257fda3-1b00-0000-ae35-b8cf40090000 pid=2368 execve guuid=41825ea4-1b00-0000-ae35-b8cf42090000 pid=2370 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=41825ea4-1b00-0000-ae35-b8cf42090000 pid=2370 execve guuid=8527bca4-1b00-0000-ae35-b8cf44090000 pid=2372 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=8527bca4-1b00-0000-ae35-b8cf44090000 pid=2372 execve guuid=799b24a5-1b00-0000-ae35-b8cf46090000 pid=2374 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=799b24a5-1b00-0000-ae35-b8cf46090000 pid=2374 execve guuid=6e78c7a5-1b00-0000-ae35-b8cf48090000 pid=2376 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=6e78c7a5-1b00-0000-ae35-b8cf48090000 pid=2376 execve guuid=eccb73a6-1b00-0000-ae35-b8cf4a090000 pid=2378 /usr/bin/ls guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=eccb73a6-1b00-0000-ae35-b8cf4a090000 pid=2378 execve guuid=bb683ca7-1b00-0000-ae35-b8cf4c090000 pid=2380 /usr/bin/rm guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=bb683ca7-1b00-0000-ae35-b8cf4c090000 pid=2380 execve guuid=8631baa7-1b00-0000-ae35-b8cf4e090000 pid=2382 /usr/bin/wget net send-data write-file guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=8631baa7-1b00-0000-ae35-b8cf4e090000 pid=2382 execve guuid=0e54c5c2-1b00-0000-ae35-b8cf71090000 pid=2417 /usr/bin/chmod guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=0e54c5c2-1b00-0000-ae35-b8cf71090000 pid=2417 execve guuid=2cfff2c3-1b00-0000-ae35-b8cf73090000 pid=2419 /usr/bin/dash guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=2cfff2c3-1b00-0000-ae35-b8cf73090000 pid=2419 clone guuid=b6075ec7-1b00-0000-ae35-b8cf77090000 pid=2423 /usr/bin/rm guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=b6075ec7-1b00-0000-ae35-b8cf77090000 pid=2423 execve guuid=736376c8-1b00-0000-ae35-b8cf79090000 pid=2425 /usr/bin/wget net send-data write-file guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=736376c8-1b00-0000-ae35-b8cf79090000 pid=2425 execve guuid=a6c3b3e6-1b00-0000-ae35-b8cf92090000 pid=2450 /usr/bin/chmod guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=a6c3b3e6-1b00-0000-ae35-b8cf92090000 pid=2450 execve guuid=0b29d2e7-1b00-0000-ae35-b8cf93090000 pid=2451 /usr/bin/dash guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=0b29d2e7-1b00-0000-ae35-b8cf93090000 pid=2451 clone guuid=9bace0ea-1b00-0000-ae35-b8cf97090000 pid=2455 /usr/bin/rm guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=9bace0ea-1b00-0000-ae35-b8cf97090000 pid=2455 execve guuid=4ff36aeb-1b00-0000-ae35-b8cf98090000 pid=2456 /usr/bin/wget net send-data write-file guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=4ff36aeb-1b00-0000-ae35-b8cf98090000 pid=2456 execve guuid=68223b09-1c00-0000-ae35-b8cfb2090000 pid=2482 /usr/bin/chmod guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=68223b09-1c00-0000-ae35-b8cfb2090000 pid=2482 execve guuid=a57ea909-1c00-0000-ae35-b8cfb3090000 pid=2483 /usr/bin/dash guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=a57ea909-1c00-0000-ae35-b8cfb3090000 pid=2483 clone guuid=25138a0a-1c00-0000-ae35-b8cfb5090000 pid=2485 /usr/bin/rm guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=25138a0a-1c00-0000-ae35-b8cfb5090000 pid=2485 execve guuid=edcce60a-1c00-0000-ae35-b8cfb7090000 pid=2487 /usr/bin/wget net send-data write-file guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=edcce60a-1c00-0000-ae35-b8cfb7090000 pid=2487 execve guuid=7647cc2c-1c00-0000-ae35-b8cfd4090000 pid=2516 /usr/bin/chmod guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=7647cc2c-1c00-0000-ae35-b8cfd4090000 pid=2516 execve guuid=de19792d-1c00-0000-ae35-b8cfd5090000 pid=2517 /usr/bin/dash guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=de19792d-1c00-0000-ae35-b8cfd5090000 pid=2517 clone guuid=139c422f-1c00-0000-ae35-b8cfd9090000 pid=2521 /usr/bin/rm guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=139c422f-1c00-0000-ae35-b8cfd9090000 pid=2521 execve guuid=838a5d30-1c00-0000-ae35-b8cfda090000 pid=2522 /usr/bin/wget net send-data write-file guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=838a5d30-1c00-0000-ae35-b8cfda090000 pid=2522 execve guuid=c6cdc250-1c00-0000-ae35-b8cff8090000 pid=2552 /usr/bin/chmod guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=c6cdc250-1c00-0000-ae35-b8cff8090000 pid=2552 execve guuid=70f56551-1c00-0000-ae35-b8cffa090000 pid=2554 /usr/bin/dash guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=70f56551-1c00-0000-ae35-b8cffa090000 pid=2554 clone guuid=078fdb52-1c00-0000-ae35-b8cffd090000 pid=2557 /usr/bin/rm delete-file guuid=9ac9ec5c-1b00-0000-ae35-b8cf4e080000 pid=2126->guuid=078fdb52-1c00-0000-ae35-b8cffd090000 pid=2557 execve 801186e6-5fe8-5959-a7b4-832d8d66e7aa 129.121.114.124:80 guuid=8631baa7-1b00-0000-ae35-b8cf4e090000 pid=2382->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 133B guuid=736376c8-1b00-0000-ae35-b8cf79090000 pid=2425->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 133B guuid=4ff36aeb-1b00-0000-ae35-b8cf98090000 pid=2456->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 134B guuid=edcce60a-1c00-0000-ae35-b8cfb7090000 pid=2487->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 133B guuid=838a5d30-1c00-0000-ae35-b8cfda090000 pid=2522->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 134B
Score:
99%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/c851ecd062b1cc9db81dcff434973c2fb577ae732cba966aa469744c2d074c31
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c851ecd062b1cc9db81dcff434973c2fb577ae732cba966aa469744c2d074c31/
Threat name:
Document-HTML.Trojan.Bash
Create hunting rule
Status:
Malicious
First seen:
2026-08-04 06:19:27 UTC
File Type:
Text (Shell)
AV detection:
12 of 24 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zbi6zudcwhgj3oa5z72djfz4f62xplttfs5jm2venf2eylihjqyq._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
discovery linux
Link:
https://tria.ge/reports/260804-g2t74ahk31/
Behaviour
Reads runtime system information
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh c851ecd062b1cc9db81dcff434973c2fb577ae732cba966aa469744c2d074c31

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3866369/
  
Delivery method
Distributed via web download

Comments