🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cb75505b5596af0f091d021c2716883fe647de8d385791c8040bbd2f678d732f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cb75505b5596af0f091d021c2716883fe647de8d385791c8040bbd2f678d732f
SHA3-384 hash: c32934de93a1b7fe6a01e9998f937d4e3e80295e42a10a2686998c2a778cc96cd0edb5bcab605a987a1df03fe5fa098d
SHA1 hash: 9163ebaa5a367b6898cf183839d41bda04bf02d5
MD5 hash: 6aacf1a7615c0bb83d4f7fcd8c102f37
humanhash: summer-mirror-shade-comet
File name:cb75505b5596af0f091d021c2716883fe647de8d385791c8040bbd2f678d732f
Download: download sample
File size:1'608 bytes
First seen:2026-09-16 02:17:18 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 24:jpm/1XpDt/018vw7cTw9urUgl9ElLqtyVq:jItZy3z6MlVq
TLSH T19D3141DB00121E718103CA9EB3B23649A68EA5F71C8FD7D5D80C0EA9828838EF555F5E
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter GAYINT_DOT_ORG
Tags:cowrie dropper honeypot sh
URLMalware sample (SHA256 hash)SignatureTags
http://5.182.210.174/82f49an/an/an/a
http://5.182.210.174/edd74en/an/an/a
http://5.182.210.174/0a1b8fn/an/an/a
http://5.182.210.174/a6d71fn/an/an/a
http://5.182.210.174/8e70dcn/an/an/a
http://5.182.210.174/b7cf5bn/an/an/a
http://5.182.210.174/d54554n/an/an/a
http://5.182.210.174/cb7fdfn/an/an/a
http://5.182.210.174/351309n/an/an/a
http://5.182.210.174/196bban/an/an/a
http://5.182.210.174/bd8de7n/an/an/a
http://5.182.210.174/6a81c6n/an/an/a

Intelligence

File Origin
# of uploads :
1
# of downloads :
63
Origin country :
US US
Vendor Threat Intelligence
No detections
Gathering data
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/cc784fee-f5f9-41cf-9c4b-b16ff7430cbe
Behavior Graph:
Download SVG
%3 guuid=1707a636-1c00-0000-b499-c9888c070000 pid=1932 /usr/bin/sudo guuid=76a28a3f-1c00-0000-b499-c98894070000 pid=1940 /tmp/sample.bin guuid=1707a636-1c00-0000-b499-c9888c070000 pid=1932->guuid=76a28a3f-1c00-0000-b499-c98894070000 pid=1940 execve guuid=8b2e9240-1c00-0000-b499-c98896070000 pid=1942 /usr/bin/wget net send-data guuid=76a28a3f-1c00-0000-b499-c98894070000 pid=1940->guuid=8b2e9240-1c00-0000-b499-c98896070000 pid=1942 execve guuid=d6489846-1c00-0000-b499-c9889e070000 pid=1950 /usr/bin/curl net send-data write-file guuid=76a28a3f-1c00-0000-b499-c98894070000 pid=1940->guuid=d6489846-1c00-0000-b499-c9889e070000 pid=1950 execve guuid=27bf1d50-1c00-0000-b499-c988a6070000 pid=1958 /usr/bin/chmod guuid=76a28a3f-1c00-0000-b499-c98894070000 pid=1940->guuid=27bf1d50-1c00-0000-b499-c988a6070000 pid=1958 execve guuid=fb7cff50-1c00-0000-b499-c988a8070000 pid=1960 /usr/bin/bash guuid=76a28a3f-1c00-0000-b499-c98894070000 pid=1940->guuid=fb7cff50-1c00-0000-b499-c988a8070000 pid=1960 clone guuid=7f828051-1c00-0000-b499-c988aa070000 pid=1962 /usr/bin/rm delete-file guuid=76a28a3f-1c00-0000-b499-c98894070000 pid=1940->guuid=7f828051-1c00-0000-b499-c988aa070000 pid=1962 execve guuid=47051853-1c00-0000-b499-c988ad070000 pid=1965 /usr/bin/rm guuid=76a28a3f-1c00-0000-b499-c98894070000 pid=1940->guuid=47051853-1c00-0000-b499-c988ad070000 pid=1965 execve guuid=81ea5c54-1c00-0000-b499-c988af070000 pid=1967 /usr/bin/wget net send-data guuid=76a28a3f-1c00-0000-b499-c98894070000 pid=1940->guuid=81ea5c54-1c00-0000-b499-c988af070000 pid=1967 execve guuid=c71efa58-1c00-0000-b499-c988b4070000 pid=1972 /usr/bin/curl net send-data write-file guuid=76a28a3f-1c00-0000-b499-c98894070000 pid=1940->guuid=c71efa58-1c00-0000-b499-c988b4070000 pid=1972 execve guuid=beb62d62-1c00-0000-b499-c988be070000 pid=1982 /usr/bin/chmod guuid=76a28a3f-1c00-0000-b499-c98894070000 pid=1940->guuid=beb62d62-1c00-0000-b499-c988be070000 pid=1982 execve guuid=441fab62-1c00-0000-b499-c988c0070000 pid=1984 /usr/bin/bash guuid=76a28a3f-1c00-0000-b499-c98894070000 pid=1940->guuid=441fab62-1c00-0000-b499-c988c0070000 pid=1984 clone guuid=165a1663-1c00-0000-b499-c988c2070000 pid=1986 /usr/bin/rm delete-file guuid=76a28a3f-1c00-0000-b499-c98894070000 pid=1940->guuid=165a1663-1c00-0000-b499-c988c2070000 pid=1986 execve guuid=e1908763-1c00-0000-b499-c988c4070000 pid=1988 /usr/bin/rm guuid=76a28a3f-1c00-0000-b499-c98894070000 pid=1940->guuid=e1908763-1c00-0000-b499-c988c4070000 pid=1988 execve guuid=c084fd63-1c00-0000-b499-c988c6070000 pid=1990 /usr/bin/wget net send-data guuid=76a28a3f-1c00-0000-b499-c98894070000 pid=1940->guuid=c084fd63-1c00-0000-b499-c988c6070000 pid=1990 execve guuid=fd069b69-1c00-0000-b499-c988c9070000 pid=1993 /usr/bin/curl net send-data write-file guuid=76a28a3f-1c00-0000-b499-c98894070000 pid=1940->guuid=fd069b69-1c00-0000-b499-c988c9070000 pid=1993 execve guuid=bd537770-1c00-0000-b499-c988d3070000 pid=2003 /usr/bin/chmod guuid=76a28a3f-1c00-0000-b499-c98894070000 pid=1940->guuid=bd537770-1c00-0000-b499-c988d3070000 pid=2003 execve guuid=710d0b71-1c00-0000-b499-c988d4070000 pid=2004 /usr/bin/bash guuid=76a28a3f-1c00-0000-b499-c98894070000 pid=1940->guuid=710d0b71-1c00-0000-b499-c988d4070000 pid=2004 clone guuid=0dc4ae71-1c00-0000-b499-c988d6070000 pid=2006 /usr/bin/rm delete-file guuid=76a28a3f-1c00-0000-b499-c98894070000 pid=1940->guuid=0dc4ae71-1c00-0000-b499-c988d6070000 pid=2006 execve guuid=0ead5d72-1c00-0000-b499-c988d8070000 pid=2008 /usr/bin/rm guuid=76a28a3f-1c00-0000-b499-c98894070000 pid=1940->guuid=0ead5d72-1c00-0000-b499-c988d8070000 pid=2008 execve guuid=3b677374-1c00-0000-b499-c988dc070000 pid=2012 /usr/bin/wget net send-data guuid=76a28a3f-1c00-0000-b499-c98894070000 pid=1940->guuid=3b677374-1c00-0000-b499-c988dc070000 pid=2012 execve guuid=747fa379-1c00-0000-b499-c988e3070000 pid=2019 /usr/bin/curl net send-data write-file guuid=76a28a3f-1c00-0000-b499-c98894070000 pid=1940->guuid=747fa379-1c00-0000-b499-c988e3070000 pid=2019 execve guuid=9ebc1a81-1c00-0000-b499-c988eb070000 pid=2027 /usr/bin/chmod guuid=76a28a3f-1c00-0000-b499-c98894070000 pid=1940->guuid=9ebc1a81-1c00-0000-b499-c988eb070000 pid=2027 execve guuid=4751aa82-1c00-0000-b499-c988ec070000 pid=2028 /usr/bin/bash guuid=76a28a3f-1c00-0000-b499-c98894070000 pid=1940->guuid=4751aa82-1c00-0000-b499-c988ec070000 pid=2028 clone guuid=d0ab8883-1c00-0000-b499-c988ef070000 pid=2031 /usr/bin/rm delete-file guuid=76a28a3f-1c00-0000-b499-c98894070000 pid=1940->guuid=d0ab8883-1c00-0000-b499-c988ef070000 pid=2031 execve guuid=11a70e84-1c00-0000-b499-c988f0070000 pid=2032 /usr/bin/rm guuid=76a28a3f-1c00-0000-b499-c98894070000 pid=1940->guuid=11a70e84-1c00-0000-b499-c988f0070000 pid=2032 execve guuid=29169184-1c00-0000-b499-c988f1070000 pid=2033 /usr/bin/wget net send-data guuid=76a28a3f-1c00-0000-b499-c98894070000 pid=1940->guuid=29169184-1c00-0000-b499-c988f1070000 pid=2033 execve guuid=63226f89-1c00-0000-b499-c988fa070000 pid=2042 /usr/bin/curl net send-data write-file guuid=76a28a3f-1c00-0000-b499-c98894070000 pid=1940->guuid=63226f89-1c00-0000-b499-c988fa070000 pid=2042 execve guuid=8487f590-1c00-0000-b499-c98804080000 pid=2052 /usr/bin/chmod guuid=76a28a3f-1c00-0000-b499-c98894070000 pid=1940->guuid=8487f590-1c00-0000-b499-c98804080000 pid=2052 execve guuid=0c95e591-1c00-0000-b499-c98806080000 pid=2054 /usr/bin/bash guuid=76a28a3f-1c00-0000-b499-c98894070000 pid=1940->guuid=0c95e591-1c00-0000-b499-c98806080000 pid=2054 clone guuid=61cef892-1c00-0000-b499-c98809080000 pid=2057 /usr/bin/rm delete-file guuid=76a28a3f-1c00-0000-b499-c98894070000 pid=1940->guuid=61cef892-1c00-0000-b499-c98809080000 pid=2057 execve guuid=6560bc93-1c00-0000-b499-c9880b080000 pid=2059 /usr/bin/rm guuid=76a28a3f-1c00-0000-b499-c98894070000 pid=1940->guuid=6560bc93-1c00-0000-b499-c9880b080000 pid=2059 execve guuid=fc523194-1c00-0000-b499-c9880d080000 pid=2061 /usr/bin/wget net send-data guuid=76a28a3f-1c00-0000-b499-c98894070000 pid=1940->guuid=fc523194-1c00-0000-b499-c9880d080000 pid=2061 execve guuid=fb53ad97-1c00-0000-b499-c98814080000 pid=2068 /usr/bin/curl net send-data write-file guuid=76a28a3f-1c00-0000-b499-c98894070000 pid=1940->guuid=fb53ad97-1c00-0000-b499-c98814080000 pid=2068 execve guuid=71407b9f-1c00-0000-b499-c98823080000 pid=2083 /usr/bin/chmod guuid=76a28a3f-1c00-0000-b499-c98894070000 pid=1940->guuid=71407b9f-1c00-0000-b499-c98823080000 pid=2083 execve guuid=1009e79f-1c00-0000-b499-c98824080000 pid=2084 /usr/bin/bash guuid=76a28a3f-1c00-0000-b499-c98894070000 pid=1940->guuid=1009e79f-1c00-0000-b499-c98824080000 pid=2084 clone guuid=0d7034a0-1c00-0000-b499-c98827080000 pid=2087 /usr/bin/rm delete-file guuid=76a28a3f-1c00-0000-b499-c98894070000 pid=1940->guuid=0d7034a0-1c00-0000-b499-c98827080000 pid=2087 execve guuid=d9d4a4a0-1c00-0000-b499-c98828080000 pid=2088 /usr/bin/rm guuid=76a28a3f-1c00-0000-b499-c98894070000 pid=1940->guuid=d9d4a4a0-1c00-0000-b499-c98828080000 pid=2088 execve guuid=7a8320a1-1c00-0000-b499-c9882a080000 pid=2090 /usr/bin/wget net send-data guuid=76a28a3f-1c00-0000-b499-c98894070000 pid=1940->guuid=7a8320a1-1c00-0000-b499-c9882a080000 pid=2090 execve guuid=44a1e5a5-1c00-0000-b499-c98831080000 pid=2097 /usr/bin/curl net send-data write-file guuid=76a28a3f-1c00-0000-b499-c98894070000 pid=1940->guuid=44a1e5a5-1c00-0000-b499-c98831080000 pid=2097 execve guuid=67a734ad-1c00-0000-b499-c9883b080000 pid=2107 /usr/bin/chmod guuid=76a28a3f-1c00-0000-b499-c98894070000 pid=1940->guuid=67a734ad-1c00-0000-b499-c9883b080000 pid=2107 execve guuid=0e754cae-1c00-0000-b499-c9883e080000 pid=2110 /usr/bin/bash guuid=76a28a3f-1c00-0000-b499-c98894070000 pid=1940->guuid=0e754cae-1c00-0000-b499-c9883e080000 pid=2110 clone guuid=6b9f97ae-1c00-0000-b499-c98840080000 pid=2112 /usr/bin/rm delete-file guuid=76a28a3f-1c00-0000-b499-c98894070000 pid=1940->guuid=6b9f97ae-1c00-0000-b499-c98840080000 pid=2112 execve guuid=a58d17af-1c00-0000-b499-c98843080000 pid=2115 /usr/bin/rm guuid=76a28a3f-1c00-0000-b499-c98894070000 pid=1940->guuid=a58d17af-1c00-0000-b499-c98843080000 pid=2115 execve guuid=51be98af-1c00-0000-b499-c98845080000 pid=2117 /usr/bin/wget net send-data guuid=76a28a3f-1c00-0000-b499-c98894070000 pid=1940->guuid=51be98af-1c00-0000-b499-c98845080000 pid=2117 execve guuid=73dfabb9-1c00-0000-b499-c98851080000 pid=2129 /usr/bin/curl net send-data write-file guuid=76a28a3f-1c00-0000-b499-c98894070000 pid=1940->guuid=73dfabb9-1c00-0000-b499-c98851080000 pid=2129 execve guuid=c1e176bf-1c00-0000-b499-c9885a080000 pid=2138 /usr/bin/chmod guuid=76a28a3f-1c00-0000-b499-c98894070000 pid=1940->guuid=c1e176bf-1c00-0000-b499-c9885a080000 pid=2138 execve guuid=49950fc0-1c00-0000-b499-c9885b080000 pid=2139 /usr/bin/bash guuid=76a28a3f-1c00-0000-b499-c98894070000 pid=1940->guuid=49950fc0-1c00-0000-b499-c9885b080000 pid=2139 clone guuid=9ca4c5c0-1c00-0000-b499-c9885e080000 pid=2142 /usr/bin/rm delete-file guuid=76a28a3f-1c00-0000-b499-c98894070000 pid=1940->guuid=9ca4c5c0-1c00-0000-b499-c9885e080000 pid=2142 execve guuid=3f9196c1-1c00-0000-b499-c98861080000 pid=2145 /usr/bin/rm guuid=76a28a3f-1c00-0000-b499-c98894070000 pid=1940->guuid=3f9196c1-1c00-0000-b499-c98861080000 pid=2145 execve guuid=26b591c2-1c00-0000-b499-c98863080000 pid=2147 /usr/bin/wget net send-data guuid=76a28a3f-1c00-0000-b499-c98894070000 pid=1940->guuid=26b591c2-1c00-0000-b499-c98863080000 pid=2147 execve guuid=333a31d0-1c00-0000-b499-c98872080000 pid=2162 /usr/bin/curl net send-data write-file guuid=76a28a3f-1c00-0000-b499-c98894070000 pid=1940->guuid=333a31d0-1c00-0000-b499-c98872080000 pid=2162 execve guuid=f4ba2dd5-1c00-0000-b499-c9887c080000 pid=2172 /usr/bin/chmod guuid=76a28a3f-1c00-0000-b499-c98894070000 pid=1940->guuid=f4ba2dd5-1c00-0000-b499-c9887c080000 pid=2172 execve guuid=f6fab3d5-1c00-0000-b499-c9887e080000 pid=2174 /usr/bin/bash guuid=76a28a3f-1c00-0000-b499-c98894070000 pid=1940->guuid=f6fab3d5-1c00-0000-b499-c9887e080000 pid=2174 clone guuid=b1f933d6-1c00-0000-b499-c98880080000 pid=2176 /usr/bin/rm delete-file guuid=76a28a3f-1c00-0000-b499-c98894070000 pid=1940->guuid=b1f933d6-1c00-0000-b499-c98880080000 pid=2176 execve guuid=1a2ce3d6-1c00-0000-b499-c98882080000 pid=2178 /usr/bin/rm guuid=76a28a3f-1c00-0000-b499-c98894070000 pid=1940->guuid=1a2ce3d6-1c00-0000-b499-c98882080000 pid=2178 execve guuid=15537bd7-1c00-0000-b499-c98884080000 pid=2180 /usr/bin/wget net send-data guuid=76a28a3f-1c00-0000-b499-c98894070000 pid=1940->guuid=15537bd7-1c00-0000-b499-c98884080000 pid=2180 execve guuid=3524a3dc-1c00-0000-b499-c9888b080000 pid=2187 /usr/bin/curl net send-data write-file guuid=76a28a3f-1c00-0000-b499-c98894070000 pid=1940->guuid=3524a3dc-1c00-0000-b499-c9888b080000 pid=2187 execve guuid=f8505ae4-1c00-0000-b499-c98893080000 pid=2195 /usr/bin/chmod guuid=76a28a3f-1c00-0000-b499-c98894070000 pid=1940->guuid=f8505ae4-1c00-0000-b499-c98893080000 pid=2195 execve guuid=bfb3b2e5-1c00-0000-b499-c98897080000 pid=2199 /usr/bin/bash guuid=76a28a3f-1c00-0000-b499-c98894070000 pid=1940->guuid=bfb3b2e5-1c00-0000-b499-c98897080000 pid=2199 clone guuid=71eecce6-1c00-0000-b499-c98899080000 pid=2201 /usr/bin/rm delete-file guuid=76a28a3f-1c00-0000-b499-c98894070000 pid=1940->guuid=71eecce6-1c00-0000-b499-c98899080000 pid=2201 execve guuid=0e5e98e7-1c00-0000-b499-c9889a080000 pid=2202 /usr/bin/rm guuid=76a28a3f-1c00-0000-b499-c98894070000 pid=1940->guuid=0e5e98e7-1c00-0000-b499-c9889a080000 pid=2202 execve guuid=67bba2e8-1c00-0000-b499-c9889d080000 pid=2205 /usr/bin/wget net send-data guuid=76a28a3f-1c00-0000-b499-c98894070000 pid=1940->guuid=67bba2e8-1c00-0000-b499-c9889d080000 pid=2205 execve guuid=d263b2ec-1c00-0000-b499-c988a4080000 pid=2212 /usr/bin/curl net send-data write-file guuid=76a28a3f-1c00-0000-b499-c98894070000 pid=1940->guuid=d263b2ec-1c00-0000-b499-c988a4080000 pid=2212 execve guuid=fe34edf3-1c00-0000-b499-c988ab080000 pid=2219 /usr/bin/chmod guuid=76a28a3f-1c00-0000-b499-c98894070000 pid=1940->guuid=fe34edf3-1c00-0000-b499-c988ab080000 pid=2219 execve guuid=742e98f4-1c00-0000-b499-c988ac080000 pid=2220 /usr/bin/bash guuid=76a28a3f-1c00-0000-b499-c98894070000 pid=1940->guuid=742e98f4-1c00-0000-b499-c988ac080000 pid=2220 clone guuid=972683f5-1c00-0000-b499-c988ae080000 pid=2222 /usr/bin/rm delete-file guuid=76a28a3f-1c00-0000-b499-c98894070000 pid=1940->guuid=972683f5-1c00-0000-b499-c988ae080000 pid=2222 execve guuid=e2c025f6-1c00-0000-b499-c988af080000 pid=2223 /usr/bin/rm guuid=76a28a3f-1c00-0000-b499-c98894070000 pid=1940->guuid=e2c025f6-1c00-0000-b499-c988af080000 pid=2223 execve guuid=95f1aff6-1c00-0000-b499-c988b1080000 pid=2225 /usr/bin/wget net send-data guuid=76a28a3f-1c00-0000-b499-c98894070000 pid=1940->guuid=95f1aff6-1c00-0000-b499-c988b1080000 pid=2225 execve guuid=2c686dfa-1c00-0000-b499-c988b8080000 pid=2232 /usr/bin/curl net send-data write-file guuid=76a28a3f-1c00-0000-b499-c98894070000 pid=1940->guuid=2c686dfa-1c00-0000-b499-c988b8080000 pid=2232 execve guuid=e5f70c04-1d00-0000-b499-c988bd080000 pid=2237 /usr/bin/chmod guuid=76a28a3f-1c00-0000-b499-c98894070000 pid=1940->guuid=e5f70c04-1d00-0000-b499-c988bd080000 pid=2237 execve guuid=9def9b04-1d00-0000-b499-c988be080000 pid=2238 /usr/bin/bash guuid=76a28a3f-1c00-0000-b499-c98894070000 pid=1940->guuid=9def9b04-1d00-0000-b499-c988be080000 pid=2238 clone guuid=ae4e5105-1d00-0000-b499-c988c1080000 pid=2241 /usr/bin/rm delete-file guuid=76a28a3f-1c00-0000-b499-c98894070000 pid=1940->guuid=ae4e5105-1d00-0000-b499-c988c1080000 pid=2241 execve guuid=b41e1a07-1d00-0000-b499-c988c3080000 pid=2243 /usr/bin/rm guuid=76a28a3f-1c00-0000-b499-c98894070000 pid=1940->guuid=b41e1a07-1d00-0000-b499-c988c3080000 pid=2243 execve 5b654972-c9e1-50d8-b372-2dc2a5b9ad66 5.182.210.174:80 guuid=8b2e9240-1c00-0000-b499-c98896070000 pid=1942->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=d6489846-1c00-0000-b499-c9889e070000 pid=1950->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=e6762951-1c00-0000-b499-c988a9070000 pid=1961 /usr/bin/bash guuid=fb7cff50-1c00-0000-b499-c988a8070000 pid=1960->guuid=e6762951-1c00-0000-b499-c988a9070000 pid=1961 clone guuid=81ea5c54-1c00-0000-b499-c988af070000 pid=1967->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=c71efa58-1c00-0000-b499-c988b4070000 pid=1972->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=4c2bdb62-1c00-0000-b499-c988c1070000 pid=1985 /usr/bin/bash guuid=441fab62-1c00-0000-b499-c988c0070000 pid=1984->guuid=4c2bdb62-1c00-0000-b499-c988c1070000 pid=1985 clone guuid=c084fd63-1c00-0000-b499-c988c6070000 pid=1990->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=fd069b69-1c00-0000-b499-c988c9070000 pid=1993->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=c2c23e71-1c00-0000-b499-c988d5070000 pid=2005 /usr/bin/bash guuid=710d0b71-1c00-0000-b499-c988d4070000 pid=2004->guuid=c2c23e71-1c00-0000-b499-c988d5070000 pid=2005 clone guuid=3b677374-1c00-0000-b499-c988dc070000 pid=2012->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=747fa379-1c00-0000-b499-c988e3070000 pid=2019->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=d6924183-1c00-0000-b499-c988ee070000 pid=2030 /usr/bin/bash guuid=4751aa82-1c00-0000-b499-c988ec070000 pid=2028->guuid=d6924183-1c00-0000-b499-c988ee070000 pid=2030 clone guuid=29169184-1c00-0000-b499-c988f1070000 pid=2033->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=63226f89-1c00-0000-b499-c988fa070000 pid=2042->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=e22e1a92-1c00-0000-b499-c98807080000 pid=2055 /usr/bin/bash guuid=0c95e591-1c00-0000-b499-c98806080000 pid=2054->guuid=e22e1a92-1c00-0000-b499-c98807080000 pid=2055 clone guuid=fc523194-1c00-0000-b499-c9880d080000 pid=2061->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=fb53ad97-1c00-0000-b499-c98814080000 pid=2068->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=ca2e07a0-1c00-0000-b499-c98826080000 pid=2086 /usr/bin/bash guuid=1009e79f-1c00-0000-b499-c98824080000 pid=2084->guuid=ca2e07a0-1c00-0000-b499-c98826080000 pid=2086 clone guuid=7a8320a1-1c00-0000-b499-c9882a080000 pid=2090->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=44a1e5a5-1c00-0000-b499-c98831080000 pid=2097->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=059069ae-1c00-0000-b499-c9883f080000 pid=2111 /usr/bin/bash guuid=0e754cae-1c00-0000-b499-c9883e080000 pid=2110->guuid=059069ae-1c00-0000-b499-c9883f080000 pid=2111 clone guuid=51be98af-1c00-0000-b499-c98845080000 pid=2117->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=73dfabb9-1c00-0000-b499-c98851080000 pid=2129->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=4fad5cc0-1c00-0000-b499-c9885d080000 pid=2141 /usr/bin/bash guuid=49950fc0-1c00-0000-b499-c9885b080000 pid=2139->guuid=4fad5cc0-1c00-0000-b499-c9885d080000 pid=2141 clone guuid=26b591c2-1c00-0000-b499-c98863080000 pid=2147->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=333a31d0-1c00-0000-b499-c98872080000 pid=2162->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=d9d8e6d5-1c00-0000-b499-c9887f080000 pid=2175 /usr/bin/bash guuid=f6fab3d5-1c00-0000-b499-c9887e080000 pid=2174->guuid=d9d8e6d5-1c00-0000-b499-c9887f080000 pid=2175 clone guuid=15537bd7-1c00-0000-b499-c98884080000 pid=2180->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=3524a3dc-1c00-0000-b499-c9888b080000 pid=2187->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=51c6e0e5-1c00-0000-b499-c98898080000 pid=2200 /usr/bin/bash guuid=bfb3b2e5-1c00-0000-b499-c98897080000 pid=2199->guuid=51c6e0e5-1c00-0000-b499-c98898080000 pid=2200 clone guuid=67bba2e8-1c00-0000-b499-c9889d080000 pid=2205->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=d263b2ec-1c00-0000-b499-c988a4080000 pid=2212->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=e31220f5-1c00-0000-b499-c988ad080000 pid=2221 /usr/bin/bash guuid=742e98f4-1c00-0000-b499-c988ac080000 pid=2220->guuid=e31220f5-1c00-0000-b499-c988ad080000 pid=2221 clone guuid=95f1aff6-1c00-0000-b499-c988b1080000 pid=2225->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=2c686dfa-1c00-0000-b499-c988b8080000 pid=2232->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=0f63ce04-1d00-0000-b499-c988bf080000 pid=2239 /usr/bin/bash guuid=9def9b04-1d00-0000-b499-c988be080000 pid=2238->guuid=0f63ce04-1d00-0000-b499-c988bf080000 pid=2239 clone
Score:
99%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/cb75505b5596af0f091d021c2716883fe647de8d385791c8040bbd2f678d732f
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cb75505b5596af0f091d021c2716883fe647de8d385791c8040bbd2f678d732f/
Threat name:
Linux.Downloader.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-08-24 23:35:20 UTC
File Type:
Text (Shell)
AV detection:
14 of 36 (38.89%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zn2vaw2vs2xq6ci5aiocofuih7tepxunhblzdsaebo6s6z4nomxq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260916-crbwjssxc1/
Behaviour
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.11
Link:
https://yomi.yoroi.company/submissions/cb75505b5596af0f091d021c2716883fe647de8d385791c8040bbd2f678d732f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh cb75505b5596af0f091d021c2716883fe647de8d385791c8040bbd2f678d732f

(this sample)

  
Delivery method
Distributed via web download

Comments