🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cb95ae7c133af13e09902136a3fec23fc6884ec983f934c4219bcddebea9401a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cb95ae7c133af13e09902136a3fec23fc6884ec983f934c4219bcddebea9401a
SHA3-384 hash: 6e8d2ee75c68de17f66bbd5a71fd2cdd57d1baf97cf07380cd9d6e8ffcaa97abe7253be21307c87d3c8c17ec987fc4d3
SHA1 hash: 9a817cea976c3fa072e3e11ee3098a485b707698
MD5 hash: 212fbce0965815cc1c2cbc9a8ee86aaf
humanhash: jig-cup-fifteen-two
File name:cat.sh
Download: download sample
File size:426 bytes
First seen:2026-10-27 05:18:39 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 6:haLOwOnFflcvr797W+e4o3GHuY3FdeQoTuLsTKFFFMuLs7v/F59FiyF:MLOgr9HTo3GOkrZLIKFFjL29ZF
TLSH T1A2E02BE3B5B14531EA48A625308B6DC0E28F008FA7415930E05DBC901F6DD407886935
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter BlinkzSec
URLMalware sample (SHA256 hash)SignatureTags
http://94.154.43.27/iran.n/an/an/a

Intelligence

File Origin
# of uploads :
1
# of downloads :
54
Origin country :
AT AT
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.DownLoader.2650.21121.13746.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
File Type:
unix shell
First seen:
2026-10-27T05:05:00Z UTC
Last seen:
2026-10-27T09:10:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/cb95ae7c133af13e09902136a3fec23fc6884ec983f934c4219bcddebea9401a/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/90ae61a8-19d0-4d32-abe8-8aec54e1d795
Behavior Graph:
Download SVG
%3 guuid=6a6932ac-1a00-0000-0bc4-c1aae1050000 pid=1505 /usr/bin/sudo guuid=11debcb2-1a00-0000-0bc4-c1aaec050000 pid=1516 /tmp/sample.bin guuid=6a6932ac-1a00-0000-0bc4-c1aae1050000 pid=1505->guuid=11debcb2-1a00-0000-0bc4-c1aaec050000 pid=1516 execve guuid=65b919b3-1a00-0000-0bc4-c1aaed050000 pid=1517 /usr/bin/wget net send-data guuid=11debcb2-1a00-0000-0bc4-c1aaec050000 pid=1516->guuid=65b919b3-1a00-0000-0bc4-c1aaed050000 pid=1517 execve guuid=d05e82be-1a00-0000-0bc4-c1aaf9050000 pid=1529 /usr/bin/curl net send-data write-file guuid=11debcb2-1a00-0000-0bc4-c1aaec050000 pid=1516->guuid=d05e82be-1a00-0000-0bc4-c1aaf9050000 pid=1529 execve guuid=abd8b0c6-1a00-0000-0bc4-c1aa06060000 pid=1542 /usr/bin/chmod guuid=11debcb2-1a00-0000-0bc4-c1aaec050000 pid=1516->guuid=abd8b0c6-1a00-0000-0bc4-c1aa06060000 pid=1542 execve guuid=8bb4fbc7-1a00-0000-0bc4-c1aa09060000 pid=1545 /tmp/iran.x86_64 guuid=11debcb2-1a00-0000-0bc4-c1aaec050000 pid=1516->guuid=8bb4fbc7-1a00-0000-0bc4-c1aa09060000 pid=1545 execve guuid=280619c9-1a00-0000-0bc4-c1aa0c060000 pid=1548 /usr/bin/wget net send-data guuid=11debcb2-1a00-0000-0bc4-c1aaec050000 pid=1516->guuid=280619c9-1a00-0000-0bc4-c1aa0c060000 pid=1548 execve guuid=8b6ab6d0-1a00-0000-0bc4-c1aa16060000 pid=1558 /usr/bin/curl net send-data write-file guuid=11debcb2-1a00-0000-0bc4-c1aaec050000 pid=1516->guuid=8b6ab6d0-1a00-0000-0bc4-c1aa16060000 pid=1558 execve guuid=eed756d7-1a00-0000-0bc4-c1aa1f060000 pid=1567 /usr/bin/chmod guuid=11debcb2-1a00-0000-0bc4-c1aaec050000 pid=1516->guuid=eed756d7-1a00-0000-0bc4-c1aa1f060000 pid=1567 execve guuid=2bf67ed8-1a00-0000-0bc4-c1aa21060000 pid=1569 /tmp/iran.aarch64 guuid=11debcb2-1a00-0000-0bc4-c1aaec050000 pid=1516->guuid=2bf67ed8-1a00-0000-0bc4-c1aa21060000 pid=1569 execve guuid=56852ed9-1a00-0000-0bc4-c1aa22060000 pid=1570 /usr/bin/wget net send-data guuid=11debcb2-1a00-0000-0bc4-c1aaec050000 pid=1516->guuid=56852ed9-1a00-0000-0bc4-c1aa22060000 pid=1570 execve guuid=fc265bdd-1a00-0000-0bc4-c1aa29060000 pid=1577 /usr/bin/curl net send-data write-file guuid=11debcb2-1a00-0000-0bc4-c1aaec050000 pid=1516->guuid=fc265bdd-1a00-0000-0bc4-c1aa29060000 pid=1577 execve guuid=0547bae2-1a00-0000-0bc4-c1aa32060000 pid=1586 /usr/bin/chmod guuid=11debcb2-1a00-0000-0bc4-c1aaec050000 pid=1516->guuid=0547bae2-1a00-0000-0bc4-c1aa32060000 pid=1586 execve guuid=ba3a41e3-1a00-0000-0bc4-c1aa34060000 pid=1588 /tmp/iran.armv7l guuid=11debcb2-1a00-0000-0bc4-c1aaec050000 pid=1516->guuid=ba3a41e3-1a00-0000-0bc4-c1aa34060000 pid=1588 execve guuid=4488d8e3-1a00-0000-0bc4-c1aa36060000 pid=1590 /usr/bin/wget net send-data guuid=11debcb2-1a00-0000-0bc4-c1aaec050000 pid=1516->guuid=4488d8e3-1a00-0000-0bc4-c1aa36060000 pid=1590 execve guuid=6c0613e8-1a00-0000-0bc4-c1aa3b060000 pid=1595 /usr/bin/curl net send-data write-file guuid=11debcb2-1a00-0000-0bc4-c1aaec050000 pid=1516->guuid=6c0613e8-1a00-0000-0bc4-c1aa3b060000 pid=1595 execve guuid=69c401ef-1a00-0000-0bc4-c1aa44060000 pid=1604 /usr/bin/chmod guuid=11debcb2-1a00-0000-0bc4-c1aaec050000 pid=1516->guuid=69c401ef-1a00-0000-0bc4-c1aa44060000 pid=1604 execve guuid=6170aaef-1a00-0000-0bc4-c1aa46060000 pid=1606 /tmp/iran.armv6l guuid=11debcb2-1a00-0000-0bc4-c1aaec050000 pid=1516->guuid=6170aaef-1a00-0000-0bc4-c1aa46060000 pid=1606 execve guuid=a46231f0-1a00-0000-0bc4-c1aa48060000 pid=1608 /usr/bin/wget net send-data guuid=11debcb2-1a00-0000-0bc4-c1aaec050000 pid=1516->guuid=a46231f0-1a00-0000-0bc4-c1aa48060000 pid=1608 execve guuid=42d906f5-1a00-0000-0bc4-c1aa4c060000 pid=1612 /usr/bin/curl net send-data write-file guuid=11debcb2-1a00-0000-0bc4-c1aaec050000 pid=1516->guuid=42d906f5-1a00-0000-0bc4-c1aa4c060000 pid=1612 execve guuid=0b1558fb-1a00-0000-0bc4-c1aa52060000 pid=1618 /usr/bin/chmod guuid=11debcb2-1a00-0000-0bc4-c1aaec050000 pid=1516->guuid=0b1558fb-1a00-0000-0bc4-c1aa52060000 pid=1618 execve guuid=f5e241fc-1a00-0000-0bc4-c1aa56060000 pid=1622 /tmp/iran.armv5l guuid=11debcb2-1a00-0000-0bc4-c1aaec050000 pid=1516->guuid=f5e241fc-1a00-0000-0bc4-c1aa56060000 pid=1622 execve guuid=d56abefc-1a00-0000-0bc4-c1aa57060000 pid=1623 /usr/bin/wget net send-data guuid=11debcb2-1a00-0000-0bc4-c1aaec050000 pid=1516->guuid=d56abefc-1a00-0000-0bc4-c1aa57060000 pid=1623 execve guuid=79c1d301-1b00-0000-0bc4-c1aa5f060000 pid=1631 /usr/bin/curl net send-data write-file guuid=11debcb2-1a00-0000-0bc4-c1aaec050000 pid=1516->guuid=79c1d301-1b00-0000-0bc4-c1aa5f060000 pid=1631 execve guuid=48b57809-1b00-0000-0bc4-c1aa70060000 pid=1648 /usr/bin/chmod guuid=11debcb2-1a00-0000-0bc4-c1aaec050000 pid=1516->guuid=48b57809-1b00-0000-0bc4-c1aa70060000 pid=1648 execve guuid=c852b309-1b00-0000-0bc4-c1aa71060000 pid=1649 /tmp/iran.armv4l guuid=11debcb2-1a00-0000-0bc4-c1aaec050000 pid=1516->guuid=c852b309-1b00-0000-0bc4-c1aa71060000 pid=1649 execve guuid=f19df009-1b00-0000-0bc4-c1aa75060000 pid=1653 /usr/bin/wget net send-data guuid=11debcb2-1a00-0000-0bc4-c1aaec050000 pid=1516->guuid=f19df009-1b00-0000-0bc4-c1aa75060000 pid=1653 execve guuid=1b76240d-1b00-0000-0bc4-c1aa7b060000 pid=1659 /usr/bin/curl net send-data write-file guuid=11debcb2-1a00-0000-0bc4-c1aaec050000 pid=1516->guuid=1b76240d-1b00-0000-0bc4-c1aa7b060000 pid=1659 execve guuid=78246c13-1b00-0000-0bc4-c1aa87060000 pid=1671 /usr/bin/chmod guuid=11debcb2-1a00-0000-0bc4-c1aaec050000 pid=1516->guuid=78246c13-1b00-0000-0bc4-c1aa87060000 pid=1671 execve guuid=4c80db13-1b00-0000-0bc4-c1aa88060000 pid=1672 /tmp/iran.mips guuid=11debcb2-1a00-0000-0bc4-c1aaec050000 pid=1516->guuid=4c80db13-1b00-0000-0bc4-c1aa88060000 pid=1672 execve guuid=d06a5414-1b00-0000-0bc4-c1aa8a060000 pid=1674 /usr/bin/wget net send-data guuid=11debcb2-1a00-0000-0bc4-c1aaec050000 pid=1516->guuid=d06a5414-1b00-0000-0bc4-c1aa8a060000 pid=1674 execve guuid=2d2e7417-1b00-0000-0bc4-c1aa8d060000 pid=1677 /usr/bin/curl net send-data write-file guuid=11debcb2-1a00-0000-0bc4-c1aaec050000 pid=1516->guuid=2d2e7417-1b00-0000-0bc4-c1aa8d060000 pid=1677 execve guuid=4aa37d1c-1b00-0000-0bc4-c1aa92060000 pid=1682 /usr/bin/chmod guuid=11debcb2-1a00-0000-0bc4-c1aaec050000 pid=1516->guuid=4aa37d1c-1b00-0000-0bc4-c1aa92060000 pid=1682 execve guuid=8ff6581d-1b00-0000-0bc4-c1aa94060000 pid=1684 /tmp/iran.mipsel guuid=11debcb2-1a00-0000-0bc4-c1aaec050000 pid=1516->guuid=8ff6581d-1b00-0000-0bc4-c1aa94060000 pid=1684 execve guuid=1df5331e-1b00-0000-0bc4-c1aa96060000 pid=1686 /usr/bin/wget net send-data guuid=11debcb2-1a00-0000-0bc4-c1aaec050000 pid=1516->guuid=1df5331e-1b00-0000-0bc4-c1aa96060000 pid=1686 execve guuid=8f2b4222-1b00-0000-0bc4-c1aa9f060000 pid=1695 /usr/bin/curl net send-data write-file guuid=11debcb2-1a00-0000-0bc4-c1aaec050000 pid=1516->guuid=8f2b4222-1b00-0000-0bc4-c1aa9f060000 pid=1695 execve guuid=ab8d0b28-1b00-0000-0bc4-c1aaa6060000 pid=1702 /usr/bin/chmod guuid=11debcb2-1a00-0000-0bc4-c1aaec050000 pid=1516->guuid=ab8d0b28-1b00-0000-0bc4-c1aaa6060000 pid=1702 execve guuid=d8bb5328-1b00-0000-0bc4-c1aaa8060000 pid=1704 /tmp/iran.mipsrouter guuid=11debcb2-1a00-0000-0bc4-c1aaec050000 pid=1516->guuid=d8bb5328-1b00-0000-0bc4-c1aaa8060000 pid=1704 execve guuid=dc319f29-1b00-0000-0bc4-c1aaab060000 pid=1707 /usr/bin/wget net send-data guuid=11debcb2-1a00-0000-0bc4-c1aaec050000 pid=1516->guuid=dc319f29-1b00-0000-0bc4-c1aaab060000 pid=1707 execve guuid=e2f0872c-1b00-0000-0bc4-c1aab3060000 pid=1715 /usr/bin/curl net send-data write-file guuid=11debcb2-1a00-0000-0bc4-c1aaec050000 pid=1516->guuid=e2f0872c-1b00-0000-0bc4-c1aab3060000 pid=1715 execve guuid=43810833-1b00-0000-0bc4-c1aabd060000 pid=1725 /usr/bin/chmod guuid=11debcb2-1a00-0000-0bc4-c1aaec050000 pid=1516->guuid=43810833-1b00-0000-0bc4-c1aabd060000 pid=1725 execve guuid=a798d533-1b00-0000-0bc4-c1aabe060000 pid=1726 /tmp/iran.i486 guuid=11debcb2-1a00-0000-0bc4-c1aaec050000 pid=1516->guuid=a798d533-1b00-0000-0bc4-c1aabe060000 pid=1726 execve guuid=c2e2be34-1b00-0000-0bc4-c1aac0060000 pid=1728 /usr/bin/wget net send-data guuid=11debcb2-1a00-0000-0bc4-c1aaec050000 pid=1516->guuid=c2e2be34-1b00-0000-0bc4-c1aac0060000 pid=1728 execve guuid=a3677f3a-1b00-0000-0bc4-c1aac7060000 pid=1735 /usr/bin/curl net send-data write-file guuid=11debcb2-1a00-0000-0bc4-c1aaec050000 pid=1516->guuid=a3677f3a-1b00-0000-0bc4-c1aac7060000 pid=1735 execve guuid=68be4e41-1b00-0000-0bc4-c1aad0060000 pid=1744 /usr/bin/chmod guuid=11debcb2-1a00-0000-0bc4-c1aaec050000 pid=1516->guuid=68be4e41-1b00-0000-0bc4-c1aad0060000 pid=1744 execve guuid=4464e041-1b00-0000-0bc4-c1aad1060000 pid=1745 /tmp/iran.powerpc guuid=11debcb2-1a00-0000-0bc4-c1aaec050000 pid=1516->guuid=4464e041-1b00-0000-0bc4-c1aad1060000 pid=1745 execve guuid=9d685442-1b00-0000-0bc4-c1aad2060000 pid=1746 /usr/bin/wget net send-data guuid=11debcb2-1a00-0000-0bc4-c1aaec050000 pid=1516->guuid=9d685442-1b00-0000-0bc4-c1aad2060000 pid=1746 execve guuid=bbf5b645-1b00-0000-0bc4-c1aad8060000 pid=1752 /usr/bin/curl net send-data write-file guuid=11debcb2-1a00-0000-0bc4-c1aaec050000 pid=1516->guuid=bbf5b645-1b00-0000-0bc4-c1aad8060000 pid=1752 execve guuid=d4f7144b-1b00-0000-0bc4-c1aadd060000 pid=1757 /usr/bin/chmod guuid=11debcb2-1a00-0000-0bc4-c1aaec050000 pid=1516->guuid=d4f7144b-1b00-0000-0bc4-c1aadd060000 pid=1757 execve guuid=41a6564c-1b00-0000-0bc4-c1aadf060000 pid=1759 /tmp/iran.sh4 guuid=11debcb2-1a00-0000-0bc4-c1aaec050000 pid=1516->guuid=41a6564c-1b00-0000-0bc4-c1aadf060000 pid=1759 execve guuid=20e3fd4c-1b00-0000-0bc4-c1aae2060000 pid=1762 /usr/bin/wget net send-data guuid=11debcb2-1a00-0000-0bc4-c1aaec050000 pid=1516->guuid=20e3fd4c-1b00-0000-0bc4-c1aae2060000 pid=1762 execve guuid=7991ac5b-1b00-0000-0bc4-c1aae8060000 pid=1768 /usr/bin/curl net send-data write-file guuid=11debcb2-1a00-0000-0bc4-c1aaec050000 pid=1516->guuid=7991ac5b-1b00-0000-0bc4-c1aae8060000 pid=1768 execve guuid=333c3b68-1b00-0000-0bc4-c1aaed060000 pid=1773 /usr/bin/chmod guuid=11debcb2-1a00-0000-0bc4-c1aaec050000 pid=1516->guuid=333c3b68-1b00-0000-0bc4-c1aaed060000 pid=1773 execve guuid=28059c68-1b00-0000-0bc4-c1aaee060000 pid=1774 /tmp/iran.m68k guuid=11debcb2-1a00-0000-0bc4-c1aaec050000 pid=1516->guuid=28059c68-1b00-0000-0bc4-c1aaee060000 pid=1774 execve guuid=b0280869-1b00-0000-0bc4-c1aaef060000 pid=1775 /usr/bin/wget net send-data guuid=11debcb2-1a00-0000-0bc4-c1aaec050000 pid=1516->guuid=b0280869-1b00-0000-0bc4-c1aaef060000 pid=1775 execve guuid=d310e66b-1b00-0000-0bc4-c1aaf6060000 pid=1782 /usr/bin/curl net send-data write-file guuid=11debcb2-1a00-0000-0bc4-c1aaec050000 pid=1516->guuid=d310e66b-1b00-0000-0bc4-c1aaf6060000 pid=1782 execve guuid=8b965679-1b00-0000-0bc4-c1aa00070000 pid=1792 /usr/bin/chmod guuid=11debcb2-1a00-0000-0bc4-c1aaec050000 pid=1516->guuid=8b965679-1b00-0000-0bc4-c1aa00070000 pid=1792 execve guuid=de5dd079-1b00-0000-0bc4-c1aa01070000 pid=1793 /tmp/iran.sparc guuid=11debcb2-1a00-0000-0bc4-c1aaec050000 pid=1516->guuid=de5dd079-1b00-0000-0bc4-c1aa01070000 pid=1793 execve guuid=8411447a-1b00-0000-0bc4-c1aa02070000 pid=1794 /usr/bin/wget net send-data guuid=11debcb2-1a00-0000-0bc4-c1aaec050000 pid=1516->guuid=8411447a-1b00-0000-0bc4-c1aa02070000 pid=1794 execve guuid=17b5467e-1b00-0000-0bc4-c1aa05070000 pid=1797 /usr/bin/curl net send-data write-file guuid=11debcb2-1a00-0000-0bc4-c1aaec050000 pid=1516->guuid=17b5467e-1b00-0000-0bc4-c1aa05070000 pid=1797 execve guuid=43cf0e84-1b00-0000-0bc4-c1aa0c070000 pid=1804 /usr/bin/chmod guuid=11debcb2-1a00-0000-0bc4-c1aaec050000 pid=1516->guuid=43cf0e84-1b00-0000-0bc4-c1aa0c070000 pid=1804 execve guuid=2a305884-1b00-0000-0bc4-c1aa0e070000 pid=1806 /tmp/iran.arc guuid=11debcb2-1a00-0000-0bc4-c1aaec050000 pid=1516->guuid=2a305884-1b00-0000-0bc4-c1aa0e070000 pid=1806 execve c4c9e901-aa52-5480-bc5c-b1b2930726db 94.154.43.27:80 guuid=65b919b3-1a00-0000-0bc4-c1aaed050000 pid=1517->c4c9e901-aa52-5480-bc5c-b1b2930726db send: 138B guuid=d05e82be-1a00-0000-0bc4-c1aaf9050000 pid=1529->c4c9e901-aa52-5480-bc5c-b1b2930726db send: 87B guuid=280619c9-1a00-0000-0bc4-c1aa0c060000 pid=1548->c4c9e901-aa52-5480-bc5c-b1b2930726db send: 139B guuid=8b6ab6d0-1a00-0000-0bc4-c1aa16060000 pid=1558->c4c9e901-aa52-5480-bc5c-b1b2930726db send: 88B guuid=56852ed9-1a00-0000-0bc4-c1aa22060000 pid=1570->c4c9e901-aa52-5480-bc5c-b1b2930726db send: 138B guuid=fc265bdd-1a00-0000-0bc4-c1aa29060000 pid=1577->c4c9e901-aa52-5480-bc5c-b1b2930726db send: 87B guuid=4488d8e3-1a00-0000-0bc4-c1aa36060000 pid=1590->c4c9e901-aa52-5480-bc5c-b1b2930726db send: 138B guuid=6c0613e8-1a00-0000-0bc4-c1aa3b060000 pid=1595->c4c9e901-aa52-5480-bc5c-b1b2930726db send: 87B guuid=a46231f0-1a00-0000-0bc4-c1aa48060000 pid=1608->c4c9e901-aa52-5480-bc5c-b1b2930726db send: 138B guuid=42d906f5-1a00-0000-0bc4-c1aa4c060000 pid=1612->c4c9e901-aa52-5480-bc5c-b1b2930726db send: 87B guuid=d56abefc-1a00-0000-0bc4-c1aa57060000 pid=1623->c4c9e901-aa52-5480-bc5c-b1b2930726db send: 138B guuid=79c1d301-1b00-0000-0bc4-c1aa5f060000 pid=1631->c4c9e901-aa52-5480-bc5c-b1b2930726db send: 87B guuid=f19df009-1b00-0000-0bc4-c1aa75060000 pid=1653->c4c9e901-aa52-5480-bc5c-b1b2930726db send: 136B guuid=1b76240d-1b00-0000-0bc4-c1aa7b060000 pid=1659->c4c9e901-aa52-5480-bc5c-b1b2930726db send: 85B guuid=d06a5414-1b00-0000-0bc4-c1aa8a060000 pid=1674->c4c9e901-aa52-5480-bc5c-b1b2930726db send: 138B guuid=2d2e7417-1b00-0000-0bc4-c1aa8d060000 pid=1677->c4c9e901-aa52-5480-bc5c-b1b2930726db send: 87B guuid=1df5331e-1b00-0000-0bc4-c1aa96060000 pid=1686->c4c9e901-aa52-5480-bc5c-b1b2930726db send: 142B guuid=8f2b4222-1b00-0000-0bc4-c1aa9f060000 pid=1695->c4c9e901-aa52-5480-bc5c-b1b2930726db send: 91B guuid=dc319f29-1b00-0000-0bc4-c1aaab060000 pid=1707->c4c9e901-aa52-5480-bc5c-b1b2930726db send: 136B guuid=e2f0872c-1b00-0000-0bc4-c1aab3060000 pid=1715->c4c9e901-aa52-5480-bc5c-b1b2930726db send: 85B guuid=c2e2be34-1b00-0000-0bc4-c1aac0060000 pid=1728->c4c9e901-aa52-5480-bc5c-b1b2930726db send: 139B guuid=a3677f3a-1b00-0000-0bc4-c1aac7060000 pid=1735->c4c9e901-aa52-5480-bc5c-b1b2930726db send: 88B guuid=9d685442-1b00-0000-0bc4-c1aad2060000 pid=1746->c4c9e901-aa52-5480-bc5c-b1b2930726db send: 135B guuid=bbf5b645-1b00-0000-0bc4-c1aad8060000 pid=1752->c4c9e901-aa52-5480-bc5c-b1b2930726db send: 84B guuid=20e3fd4c-1b00-0000-0bc4-c1aae2060000 pid=1762->c4c9e901-aa52-5480-bc5c-b1b2930726db send: 136B guuid=7991ac5b-1b00-0000-0bc4-c1aae8060000 pid=1768->c4c9e901-aa52-5480-bc5c-b1b2930726db send: 85B guuid=b0280869-1b00-0000-0bc4-c1aaef060000 pid=1775->c4c9e901-aa52-5480-bc5c-b1b2930726db send: 137B guuid=d310e66b-1b00-0000-0bc4-c1aaf6060000 pid=1782->c4c9e901-aa52-5480-bc5c-b1b2930726db send: 86B guuid=8411447a-1b00-0000-0bc4-c1aa02070000 pid=1794->c4c9e901-aa52-5480-bc5c-b1b2930726db send: 135B guuid=17b5467e-1b00-0000-0bc4-c1aa05070000 pid=1797->c4c9e901-aa52-5480-bc5c-b1b2930726db send: 84B
Score:
99%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/cb95ae7c133af13e09902136a3fec23fc6884ec983f934c4219bcddebea9401a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cb95ae7c133af13e09902136a3fec23fc6884ec983f934c4219bcddebea9401a/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zok247athlyt4cmqee3kh7wch7diqtwjqp4tjrbbtpg55pvjiana._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/261027-fzy8labw7q/
Behaviour
Reads runtime system information
System Network Configuration Discovery
Writes file to tmp directory
Checks CPU configuration
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:has_telegram_urls
Create hunting rule
Author:Aaron DeVera<aaron@backchannel.re>
Description:Detects Telegram URLs

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments