MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cc78869bcd1b727f68ad846ae7e4434a69c4ec9a1457d80762c9fe5259dff9fc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cc78869bcd1b727f68ad846ae7e4434a69c4ec9a1457d80762c9fe5259dff9fc
SHA3-384 hash: 215e006d210c6952871f25a0168a18e34dc1d8d035bfbeeeb849e2b8ecd09dcb614f2dd203aecfc6752649f37bd4285a
SHA1 hash: c1a650ab0cb47a6ba6b4b3dd70e344db4aeeb859
MD5 hash: 98b1da42a84f725180f021dbf1556b2b
humanhash: king-carolina-five-mars
File name:ok
Download: download sample
File size:1'608 bytes
First seen:2026-08-12 07:33:42 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 12:U2L62PLNjlO6ylF/6FfJ9FBQB66r6iOwE36EH0i60qUCCetbcgZDai6aNdEEJZWK:JvJdUdsccsLEEJZWVJrcSKaJwlL
TLSH T1A33123AB01105A311202DDAE7367354CB69DA6FB2D8FC3D4DC080DE9924C2DCF261B49
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://5.182.210.174/878e23n/an/aua-wget
http://5.182.210.174/7b2a6cn/an/aua-wget
http://5.182.210.174/1ad6ddn/an/aua-wget
http://5.182.210.174/2059d3n/an/aua-wget
http://5.182.210.174/d9fc8cn/an/aua-wget
http://5.182.210.174/73c8e4n/an/aua-wget
http://5.182.210.174/a7a53en/an/aua-wget
http://5.182.210.174/a12c22n/an/aua-wget
http://5.182.210.174/cabc7an/an/aua-wget
http://5.182.210.174/df64a3n/an/aua-wget
http://5.182.210.174/8c2153n/an/aua-wget
http://5.182.210.174/ce4957n/an/aua-wget

Intelligence

File Origin
# of uploads :
1
# of downloads :
21
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Gathering data
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive
Link:
https://www.filescan.io/uploads/6a7c2205a56f78af53ff7820/reports/169cb50c-4d96-4332-99a4-ba8df073e555/overview
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/017ec666-6d93-4b06-ac35-b127aa0e161e
Behavior Graph:
Download SVG
%3 guuid=020006db-1600-0000-aebc-abac0a0d0000 pid=3338 /usr/bin/sudo guuid=f99d8fdc-1600-0000-aebc-abac110d0000 pid=3345 /tmp/sample.bin guuid=020006db-1600-0000-aebc-abac0a0d0000 pid=3338->guuid=f99d8fdc-1600-0000-aebc-abac110d0000 pid=3345 execve guuid=c74dd8dc-1600-0000-aebc-abac140d0000 pid=3348 /usr/bin/wget net send-data guuid=f99d8fdc-1600-0000-aebc-abac110d0000 pid=3345->guuid=c74dd8dc-1600-0000-aebc-abac140d0000 pid=3348 execve guuid=a00f86e0-1600-0000-aebc-abac240d0000 pid=3364 /usr/bin/curl net send-data write-file guuid=f99d8fdc-1600-0000-aebc-abac110d0000 pid=3345->guuid=a00f86e0-1600-0000-aebc-abac240d0000 pid=3364 execve guuid=fc2d7de8-1600-0000-aebc-abac310d0000 pid=3377 /usr/bin/chmod guuid=f99d8fdc-1600-0000-aebc-abac110d0000 pid=3345->guuid=fc2d7de8-1600-0000-aebc-abac310d0000 pid=3377 execve guuid=3fe2c7e8-1600-0000-aebc-abac320d0000 pid=3378 /usr/bin/bash guuid=f99d8fdc-1600-0000-aebc-abac110d0000 pid=3345->guuid=3fe2c7e8-1600-0000-aebc-abac320d0000 pid=3378 clone guuid=6e530be9-1600-0000-aebc-abac340d0000 pid=3380 /usr/bin/rm delete-file guuid=f99d8fdc-1600-0000-aebc-abac110d0000 pid=3345->guuid=6e530be9-1600-0000-aebc-abac340d0000 pid=3380 execve guuid=2e0d53e9-1600-0000-aebc-abac360d0000 pid=3382 /usr/bin/rm guuid=f99d8fdc-1600-0000-aebc-abac110d0000 pid=3345->guuid=2e0d53e9-1600-0000-aebc-abac360d0000 pid=3382 execve guuid=62f29ee9-1600-0000-aebc-abac380d0000 pid=3384 /usr/bin/wget net send-data guuid=f99d8fdc-1600-0000-aebc-abac110d0000 pid=3345->guuid=62f29ee9-1600-0000-aebc-abac380d0000 pid=3384 execve guuid=123ca3ec-1600-0000-aebc-abac410d0000 pid=3393 /usr/bin/curl net send-data write-file guuid=f99d8fdc-1600-0000-aebc-abac110d0000 pid=3345->guuid=123ca3ec-1600-0000-aebc-abac410d0000 pid=3393 execve guuid=ffc118f1-1600-0000-aebc-abac440d0000 pid=3396 /usr/bin/chmod guuid=f99d8fdc-1600-0000-aebc-abac110d0000 pid=3345->guuid=ffc118f1-1600-0000-aebc-abac440d0000 pid=3396 execve guuid=daf656f1-1600-0000-aebc-abac460d0000 pid=3398 /usr/bin/bash guuid=f99d8fdc-1600-0000-aebc-abac110d0000 pid=3345->guuid=daf656f1-1600-0000-aebc-abac460d0000 pid=3398 clone guuid=80cb8ff1-1600-0000-aebc-abac490d0000 pid=3401 /usr/bin/rm delete-file guuid=f99d8fdc-1600-0000-aebc-abac110d0000 pid=3345->guuid=80cb8ff1-1600-0000-aebc-abac490d0000 pid=3401 execve guuid=54abe3f1-1600-0000-aebc-abac4b0d0000 pid=3403 /usr/bin/rm guuid=f99d8fdc-1600-0000-aebc-abac110d0000 pid=3345->guuid=54abe3f1-1600-0000-aebc-abac4b0d0000 pid=3403 execve guuid=40f620f2-1600-0000-aebc-abac4c0d0000 pid=3404 /usr/bin/wget net send-data guuid=f99d8fdc-1600-0000-aebc-abac110d0000 pid=3345->guuid=40f620f2-1600-0000-aebc-abac4c0d0000 pid=3404 execve guuid=d61814f6-1600-0000-aebc-abac560d0000 pid=3414 /usr/bin/curl net send-data write-file guuid=f99d8fdc-1600-0000-aebc-abac110d0000 pid=3345->guuid=d61814f6-1600-0000-aebc-abac560d0000 pid=3414 execve guuid=7e3ec9fb-1600-0000-aebc-abac610d0000 pid=3425 /usr/bin/chmod guuid=f99d8fdc-1600-0000-aebc-abac110d0000 pid=3345->guuid=7e3ec9fb-1600-0000-aebc-abac610d0000 pid=3425 execve guuid=911e23fc-1600-0000-aebc-abac620d0000 pid=3426 /usr/bin/bash guuid=f99d8fdc-1600-0000-aebc-abac110d0000 pid=3345->guuid=911e23fc-1600-0000-aebc-abac620d0000 pid=3426 clone guuid=55a56ffc-1600-0000-aebc-abac640d0000 pid=3428 /usr/bin/rm delete-file guuid=f99d8fdc-1600-0000-aebc-abac110d0000 pid=3345->guuid=55a56ffc-1600-0000-aebc-abac640d0000 pid=3428 execve guuid=ea43cbfc-1600-0000-aebc-abac650d0000 pid=3429 /usr/bin/rm guuid=f99d8fdc-1600-0000-aebc-abac110d0000 pid=3345->guuid=ea43cbfc-1600-0000-aebc-abac650d0000 pid=3429 execve guuid=c5f123fd-1600-0000-aebc-abac660d0000 pid=3430 /usr/bin/wget net send-data guuid=f99d8fdc-1600-0000-aebc-abac110d0000 pid=3345->guuid=c5f123fd-1600-0000-aebc-abac660d0000 pid=3430 execve guuid=10ca0203-1700-0000-aebc-abac700d0000 pid=3440 /usr/bin/curl net send-data write-file guuid=f99d8fdc-1600-0000-aebc-abac110d0000 pid=3345->guuid=10ca0203-1700-0000-aebc-abac700d0000 pid=3440 execve guuid=d3255e0a-1700-0000-aebc-abac890d0000 pid=3465 /usr/bin/chmod guuid=f99d8fdc-1600-0000-aebc-abac110d0000 pid=3345->guuid=d3255e0a-1700-0000-aebc-abac890d0000 pid=3465 execve guuid=abf7440b-1700-0000-aebc-abac8b0d0000 pid=3467 /usr/bin/bash guuid=f99d8fdc-1600-0000-aebc-abac110d0000 pid=3345->guuid=abf7440b-1700-0000-aebc-abac8b0d0000 pid=3467 clone guuid=687fa60b-1700-0000-aebc-abac8e0d0000 pid=3470 /usr/bin/rm delete-file guuid=f99d8fdc-1600-0000-aebc-abac110d0000 pid=3345->guuid=687fa60b-1700-0000-aebc-abac8e0d0000 pid=3470 execve guuid=89d9ff0b-1700-0000-aebc-abac8f0d0000 pid=3471 /usr/bin/rm guuid=f99d8fdc-1600-0000-aebc-abac110d0000 pid=3345->guuid=89d9ff0b-1700-0000-aebc-abac8f0d0000 pid=3471 execve guuid=6fd74d0c-1700-0000-aebc-abac910d0000 pid=3473 /usr/bin/wget net send-data guuid=f99d8fdc-1600-0000-aebc-abac110d0000 pid=3345->guuid=6fd74d0c-1700-0000-aebc-abac910d0000 pid=3473 execve guuid=f9cf1712-1700-0000-aebc-abac990d0000 pid=3481 /usr/bin/curl net send-data write-file guuid=f99d8fdc-1600-0000-aebc-abac110d0000 pid=3345->guuid=f9cf1712-1700-0000-aebc-abac990d0000 pid=3481 execve guuid=e821b219-1700-0000-aebc-abaca70d0000 pid=3495 /usr/bin/chmod guuid=f99d8fdc-1600-0000-aebc-abac110d0000 pid=3345->guuid=e821b219-1700-0000-aebc-abaca70d0000 pid=3495 execve guuid=e223151a-1700-0000-aebc-abaca90d0000 pid=3497 /usr/bin/bash guuid=f99d8fdc-1600-0000-aebc-abac110d0000 pid=3345->guuid=e223151a-1700-0000-aebc-abaca90d0000 pid=3497 clone guuid=adbc531a-1700-0000-aebc-abacac0d0000 pid=3500 /usr/bin/rm delete-file guuid=f99d8fdc-1600-0000-aebc-abac110d0000 pid=3345->guuid=adbc531a-1700-0000-aebc-abacac0d0000 pid=3500 execve guuid=4838ae1a-1700-0000-aebc-abacae0d0000 pid=3502 /usr/bin/rm guuid=f99d8fdc-1600-0000-aebc-abac110d0000 pid=3345->guuid=4838ae1a-1700-0000-aebc-abacae0d0000 pid=3502 execve guuid=9a320c1b-1700-0000-aebc-abacaf0d0000 pid=3503 /usr/bin/wget net send-data guuid=f99d8fdc-1600-0000-aebc-abac110d0000 pid=3345->guuid=9a320c1b-1700-0000-aebc-abacaf0d0000 pid=3503 execve guuid=d10ffa1e-1700-0000-aebc-abacb70d0000 pid=3511 /usr/bin/curl net send-data write-file guuid=f99d8fdc-1600-0000-aebc-abac110d0000 pid=3345->guuid=d10ffa1e-1700-0000-aebc-abacb70d0000 pid=3511 execve guuid=23bffb25-1700-0000-aebc-abacbe0d0000 pid=3518 /usr/bin/chmod guuid=f99d8fdc-1600-0000-aebc-abac110d0000 pid=3345->guuid=23bffb25-1700-0000-aebc-abacbe0d0000 pid=3518 execve guuid=c90b5e28-1700-0000-aebc-abacc10d0000 pid=3521 /usr/bin/bash guuid=f99d8fdc-1600-0000-aebc-abac110d0000 pid=3345->guuid=c90b5e28-1700-0000-aebc-abacc10d0000 pid=3521 clone guuid=e3429f28-1700-0000-aebc-abacc30d0000 pid=3523 /usr/bin/rm delete-file guuid=f99d8fdc-1600-0000-aebc-abac110d0000 pid=3345->guuid=e3429f28-1700-0000-aebc-abacc30d0000 pid=3523 execve guuid=e89f1f29-1700-0000-aebc-abacc40d0000 pid=3524 /usr/bin/rm guuid=f99d8fdc-1600-0000-aebc-abac110d0000 pid=3345->guuid=e89f1f29-1700-0000-aebc-abacc40d0000 pid=3524 execve guuid=a846e429-1700-0000-aebc-abacc50d0000 pid=3525 /usr/bin/wget net send-data guuid=f99d8fdc-1600-0000-aebc-abac110d0000 pid=3345->guuid=a846e429-1700-0000-aebc-abacc50d0000 pid=3525 execve guuid=6e4a892d-1700-0000-aebc-abaccf0d0000 pid=3535 /usr/bin/curl net send-data write-file guuid=f99d8fdc-1600-0000-aebc-abac110d0000 pid=3345->guuid=6e4a892d-1700-0000-aebc-abaccf0d0000 pid=3535 execve guuid=d4a1aa31-1700-0000-aebc-abacde0d0000 pid=3550 /usr/bin/chmod guuid=f99d8fdc-1600-0000-aebc-abac110d0000 pid=3345->guuid=d4a1aa31-1700-0000-aebc-abacde0d0000 pid=3550 execve guuid=1f04f431-1700-0000-aebc-abace20d0000 pid=3554 /usr/bin/bash guuid=f99d8fdc-1600-0000-aebc-abac110d0000 pid=3345->guuid=1f04f431-1700-0000-aebc-abace20d0000 pid=3554 clone guuid=83703332-1700-0000-aebc-abace40d0000 pid=3556 /usr/bin/rm delete-file guuid=f99d8fdc-1600-0000-aebc-abac110d0000 pid=3345->guuid=83703332-1700-0000-aebc-abace40d0000 pid=3556 execve guuid=481c9632-1700-0000-aebc-abace50d0000 pid=3557 /usr/bin/rm guuid=f99d8fdc-1600-0000-aebc-abac110d0000 pid=3345->guuid=481c9632-1700-0000-aebc-abace50d0000 pid=3557 execve guuid=2f37e032-1700-0000-aebc-abace80d0000 pid=3560 /usr/bin/wget net send-data guuid=f99d8fdc-1600-0000-aebc-abac110d0000 pid=3345->guuid=2f37e032-1700-0000-aebc-abace80d0000 pid=3560 execve guuid=15150338-1700-0000-aebc-abacef0d0000 pid=3567 /usr/bin/curl net send-data write-file guuid=f99d8fdc-1600-0000-aebc-abac110d0000 pid=3345->guuid=15150338-1700-0000-aebc-abacef0d0000 pid=3567 execve guuid=67da203f-1700-0000-aebc-abacfa0d0000 pid=3578 /usr/bin/chmod guuid=f99d8fdc-1600-0000-aebc-abac110d0000 pid=3345->guuid=67da203f-1700-0000-aebc-abacfa0d0000 pid=3578 execve guuid=8f8b893f-1700-0000-aebc-abacfc0d0000 pid=3580 /usr/bin/bash guuid=f99d8fdc-1600-0000-aebc-abac110d0000 pid=3345->guuid=8f8b893f-1700-0000-aebc-abacfc0d0000 pid=3580 clone guuid=a765d03f-1700-0000-aebc-abacff0d0000 pid=3583 /usr/bin/rm delete-file guuid=f99d8fdc-1600-0000-aebc-abac110d0000 pid=3345->guuid=a765d03f-1700-0000-aebc-abacff0d0000 pid=3583 execve guuid=dddc1240-1700-0000-aebc-abac010e0000 pid=3585 /usr/bin/rm guuid=f99d8fdc-1600-0000-aebc-abac110d0000 pid=3345->guuid=dddc1240-1700-0000-aebc-abac010e0000 pid=3585 execve guuid=9b4f5b40-1700-0000-aebc-abac030e0000 pid=3587 /usr/bin/wget net send-data guuid=f99d8fdc-1600-0000-aebc-abac110d0000 pid=3345->guuid=9b4f5b40-1700-0000-aebc-abac030e0000 pid=3587 execve guuid=b9596a43-1700-0000-aebc-abac0e0e0000 pid=3598 /usr/bin/curl net send-data write-file guuid=f99d8fdc-1600-0000-aebc-abac110d0000 pid=3345->guuid=b9596a43-1700-0000-aebc-abac0e0e0000 pid=3598 execve guuid=1ddc9447-1700-0000-aebc-abac140e0000 pid=3604 /usr/bin/chmod guuid=f99d8fdc-1600-0000-aebc-abac110d0000 pid=3345->guuid=1ddc9447-1700-0000-aebc-abac140e0000 pid=3604 execve guuid=ad7cf747-1700-0000-aebc-abac150e0000 pid=3605 /usr/bin/bash guuid=f99d8fdc-1600-0000-aebc-abac110d0000 pid=3345->guuid=ad7cf747-1700-0000-aebc-abac150e0000 pid=3605 clone guuid=6c445648-1700-0000-aebc-abac1a0e0000 pid=3610 /usr/bin/rm delete-file guuid=f99d8fdc-1600-0000-aebc-abac110d0000 pid=3345->guuid=6c445648-1700-0000-aebc-abac1a0e0000 pid=3610 execve guuid=3523d848-1700-0000-aebc-abac1b0e0000 pid=3611 /usr/bin/rm guuid=f99d8fdc-1600-0000-aebc-abac110d0000 pid=3345->guuid=3523d848-1700-0000-aebc-abac1b0e0000 pid=3611 execve guuid=16ae3949-1700-0000-aebc-abac1c0e0000 pid=3612 /usr/bin/wget net send-data guuid=f99d8fdc-1600-0000-aebc-abac110d0000 pid=3345->guuid=16ae3949-1700-0000-aebc-abac1c0e0000 pid=3612 execve guuid=89bd944c-1700-0000-aebc-abac270e0000 pid=3623 /usr/bin/curl net send-data write-file guuid=f99d8fdc-1600-0000-aebc-abac110d0000 pid=3345->guuid=89bd944c-1700-0000-aebc-abac270e0000 pid=3623 execve guuid=6951ac51-1700-0000-aebc-abac350e0000 pid=3637 /usr/bin/chmod guuid=f99d8fdc-1600-0000-aebc-abac110d0000 pid=3345->guuid=6951ac51-1700-0000-aebc-abac350e0000 pid=3637 execve guuid=d2881552-1700-0000-aebc-abac370e0000 pid=3639 /usr/bin/bash guuid=f99d8fdc-1600-0000-aebc-abac110d0000 pid=3345->guuid=d2881552-1700-0000-aebc-abac370e0000 pid=3639 clone guuid=9d75cd52-1700-0000-aebc-abac3b0e0000 pid=3643 /usr/bin/rm delete-file guuid=f99d8fdc-1600-0000-aebc-abac110d0000 pid=3345->guuid=9d75cd52-1700-0000-aebc-abac3b0e0000 pid=3643 execve guuid=5159b053-1700-0000-aebc-abac3f0e0000 pid=3647 /usr/bin/rm guuid=f99d8fdc-1600-0000-aebc-abac110d0000 pid=3345->guuid=5159b053-1700-0000-aebc-abac3f0e0000 pid=3647 execve guuid=d0278d54-1700-0000-aebc-abac400e0000 pid=3648 /usr/bin/wget net send-data guuid=f99d8fdc-1600-0000-aebc-abac110d0000 pid=3345->guuid=d0278d54-1700-0000-aebc-abac400e0000 pid=3648 execve guuid=f04e8d57-1700-0000-aebc-abac520e0000 pid=3666 /usr/bin/curl net send-data write-file guuid=f99d8fdc-1600-0000-aebc-abac110d0000 pid=3345->guuid=f04e8d57-1700-0000-aebc-abac520e0000 pid=3666 execve guuid=35a4335b-1700-0000-aebc-abac670e0000 pid=3687 /usr/bin/chmod guuid=f99d8fdc-1600-0000-aebc-abac110d0000 pid=3345->guuid=35a4335b-1700-0000-aebc-abac670e0000 pid=3687 execve guuid=3a596d5b-1700-0000-aebc-abac690e0000 pid=3689 /usr/bin/bash guuid=f99d8fdc-1600-0000-aebc-abac110d0000 pid=3345->guuid=3a596d5b-1700-0000-aebc-abac690e0000 pid=3689 clone guuid=4bb99c5b-1700-0000-aebc-abac6b0e0000 pid=3691 /usr/bin/rm delete-file guuid=f99d8fdc-1600-0000-aebc-abac110d0000 pid=3345->guuid=4bb99c5b-1700-0000-aebc-abac6b0e0000 pid=3691 execve guuid=8c50da5b-1700-0000-aebc-abac6f0e0000 pid=3695 /usr/bin/rm guuid=f99d8fdc-1600-0000-aebc-abac110d0000 pid=3345->guuid=8c50da5b-1700-0000-aebc-abac6f0e0000 pid=3695 execve guuid=2d051d5c-1700-0000-aebc-abac700e0000 pid=3696 /usr/bin/wget net send-data guuid=f99d8fdc-1600-0000-aebc-abac110d0000 pid=3345->guuid=2d051d5c-1700-0000-aebc-abac700e0000 pid=3696 execve guuid=b1d1f55e-1700-0000-aebc-abac7d0e0000 pid=3709 /usr/bin/curl net send-data write-file guuid=f99d8fdc-1600-0000-aebc-abac110d0000 pid=3345->guuid=b1d1f55e-1700-0000-aebc-abac7d0e0000 pid=3709 execve guuid=53c75c63-1700-0000-aebc-abac8f0e0000 pid=3727 /usr/bin/chmod guuid=f99d8fdc-1600-0000-aebc-abac110d0000 pid=3345->guuid=53c75c63-1700-0000-aebc-abac8f0e0000 pid=3727 execve guuid=8957a963-1700-0000-aebc-abac940e0000 pid=3732 /usr/bin/bash guuid=f99d8fdc-1600-0000-aebc-abac110d0000 pid=3345->guuid=8957a963-1700-0000-aebc-abac940e0000 pid=3732 clone guuid=35f70e64-1700-0000-aebc-abac980e0000 pid=3736 /usr/bin/rm delete-file guuid=f99d8fdc-1600-0000-aebc-abac110d0000 pid=3345->guuid=35f70e64-1700-0000-aebc-abac980e0000 pid=3736 execve guuid=f1b64c64-1700-0000-aebc-abac9a0e0000 pid=3738 /usr/bin/rm guuid=f99d8fdc-1600-0000-aebc-abac110d0000 pid=3345->guuid=f1b64c64-1700-0000-aebc-abac9a0e0000 pid=3738 execve 5b654972-c9e1-50d8-b372-2dc2a5b9ad66 5.182.210.174:80 guuid=c74dd8dc-1600-0000-aebc-abac140d0000 pid=3348->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=a00f86e0-1600-0000-aebc-abac240d0000 pid=3364->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=35e8e2e8-1600-0000-aebc-abac330d0000 pid=3379 /usr/bin/bash guuid=3fe2c7e8-1600-0000-aebc-abac320d0000 pid=3378->guuid=35e8e2e8-1600-0000-aebc-abac330d0000 pid=3379 clone guuid=62f29ee9-1600-0000-aebc-abac380d0000 pid=3384->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=123ca3ec-1600-0000-aebc-abac410d0000 pid=3393->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=9cd96cf1-1600-0000-aebc-abac470d0000 pid=3399 /usr/bin/bash guuid=daf656f1-1600-0000-aebc-abac460d0000 pid=3398->guuid=9cd96cf1-1600-0000-aebc-abac470d0000 pid=3399 clone guuid=40f620f2-1600-0000-aebc-abac4c0d0000 pid=3404->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=d61814f6-1600-0000-aebc-abac560d0000 pid=3414->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=561243fc-1600-0000-aebc-abac630d0000 pid=3427 /usr/bin/bash guuid=911e23fc-1600-0000-aebc-abac620d0000 pid=3426->guuid=561243fc-1600-0000-aebc-abac630d0000 pid=3427 clone guuid=c5f123fd-1600-0000-aebc-abac660d0000 pid=3430->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=10ca0203-1700-0000-aebc-abac700d0000 pid=3440->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=7ae07f0b-1700-0000-aebc-abac8d0d0000 pid=3469 /usr/bin/bash guuid=abf7440b-1700-0000-aebc-abac8b0d0000 pid=3467->guuid=7ae07f0b-1700-0000-aebc-abac8d0d0000 pid=3469 clone guuid=6fd74d0c-1700-0000-aebc-abac910d0000 pid=3473->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=f9cf1712-1700-0000-aebc-abac990d0000 pid=3481->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=4297341a-1700-0000-aebc-abacab0d0000 pid=3499 /usr/bin/bash guuid=e223151a-1700-0000-aebc-abaca90d0000 pid=3497->guuid=4297341a-1700-0000-aebc-abacab0d0000 pid=3499 clone guuid=9a320c1b-1700-0000-aebc-abacaf0d0000 pid=3503->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=d10ffa1e-1700-0000-aebc-abacb70d0000 pid=3511->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=77217428-1700-0000-aebc-abacc20d0000 pid=3522 /usr/bin/bash guuid=c90b5e28-1700-0000-aebc-abacc10d0000 pid=3521->guuid=77217428-1700-0000-aebc-abacc20d0000 pid=3522 clone guuid=a846e429-1700-0000-aebc-abacc50d0000 pid=3525->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=6e4a892d-1700-0000-aebc-abaccf0d0000 pid=3535->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=c2c60a32-1700-0000-aebc-abace30d0000 pid=3555 /usr/bin/bash guuid=1f04f431-1700-0000-aebc-abace20d0000 pid=3554->guuid=c2c60a32-1700-0000-aebc-abace30d0000 pid=3555 clone guuid=2f37e032-1700-0000-aebc-abace80d0000 pid=3560->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=15150338-1700-0000-aebc-abacef0d0000 pid=3567->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=b2a9b03f-1700-0000-aebc-abacfe0d0000 pid=3582 /usr/bin/bash guuid=8f8b893f-1700-0000-aebc-abacfc0d0000 pid=3580->guuid=b2a9b03f-1700-0000-aebc-abacfe0d0000 pid=3582 clone guuid=9b4f5b40-1700-0000-aebc-abac030e0000 pid=3587->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=b9596a43-1700-0000-aebc-abac0e0e0000 pid=3598->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=bf582348-1700-0000-aebc-abac160e0000 pid=3606 /usr/bin/bash guuid=ad7cf747-1700-0000-aebc-abac150e0000 pid=3605->guuid=bf582348-1700-0000-aebc-abac160e0000 pid=3606 clone guuid=16ae3949-1700-0000-aebc-abac1c0e0000 pid=3612->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=89bd944c-1700-0000-aebc-abac270e0000 pid=3623->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=de526252-1700-0000-aebc-abac390e0000 pid=3641 /usr/bin/bash guuid=d2881552-1700-0000-aebc-abac370e0000 pid=3639->guuid=de526252-1700-0000-aebc-abac390e0000 pid=3641 clone guuid=d0278d54-1700-0000-aebc-abac400e0000 pid=3648->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=f04e8d57-1700-0000-aebc-abac520e0000 pid=3666->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=380d805b-1700-0000-aebc-abac6a0e0000 pid=3690 /usr/bin/bash guuid=3a596d5b-1700-0000-aebc-abac690e0000 pid=3689->guuid=380d805b-1700-0000-aebc-abac6a0e0000 pid=3690 clone guuid=2d051d5c-1700-0000-aebc-abac700e0000 pid=3696->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=b1d1f55e-1700-0000-aebc-abac7d0e0000 pid=3709->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=5716bf63-1700-0000-aebc-abac960e0000 pid=3734 /usr/bin/bash guuid=8957a963-1700-0000-aebc-abac940e0000 pid=3732->guuid=5716bf63-1700-0000-aebc-abac960e0000 pid=3734 clone
Score:
99%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/cc78869bcd1b727f68ad846ae7e4434a69c4ec9a1457d80762c9fe5259dff9fc
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cc78869bcd1b727f68ad846ae7e4434a69c4ec9a1457d80762c9fe5259dff9fc/
Gathering data
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zr4ing6ndnzh62fnqrvopzcdjju4j3e2crl5qb3czh7fewo77h6a._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260812-jea7tacm5v/
Behaviour
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh cc78869bcd1b727f68ad846ae7e4434a69c4ec9a1457d80762c9fe5259dff9fc

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3897671/
  
Delivery method
Distributed via web download

Comments