MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ccf383d57772285ebce806390168d13dfd6038f123cc148998ccf7da766c099f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ccf383d57772285ebce806390168d13dfd6038f123cc148998ccf7da766c099f
SHA3-384 hash: 3434e46fa0145d1efe808c62a1f0771fe55b3f2e2f49eaa06e9d820117799c957e6ebdb7cf2aebfec212a36654da9ee5
SHA1 hash: f01b0b9dcb25df1bf1ea2abc798e02e95a117295
MD5 hash: a7a4add7f1e3733b40bff05c924eb813
humanhash: bravo-video-chicken-william
File name:run.sh
Download: download sample
File size:2'855 bytes
First seen:2026-08-27 03:15:38 UTC
Last seen:2026-08-27 05:38:29 UTC
File type: sh
MIME type:text/plain
ssdeep 24:Fk2JMHpbiBPMuZOE5EnE2EhE6D9bwIHJUfsvhM3W:Fk2JMHpbiBPMuZOOcvy19bw8vhM3W
TLSH T17251139B13845F31970D865EB7FC7178720BB0D2AADB86C4E9464C2D5ECAE4C76C6E40
Magika txt
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://94.154.43.60/bins/xnxnxnxnxnxnxnxnaarch64xnxnn/an/aelf ua-wget
http://94.154.43.60/bins/xnxnxnxnxnxnxnxni386xnxnn/an/aelf ua-wget
http://94.154.43.60/bins/xnxnxnxnxnxnxnxnloongarch64xnxnn/an/aelf ua-wget
http://94.154.43.60/bins/xnxnxnxnxnxnxnxnm68kxnxnn/an/aelf ua-wget
http://94.154.43.60/bins/xnxnxnxnxnxnxnxnmicroblazexnxnn/an/aelf ua-wget
http://94.154.43.60/bins/xnxnxnxnxnxnxnxnmipsxnxnn/an/aelf ua-wget
http://94.154.43.60/bins/xnxnxnxnxnxnxnxnor1kxnxnn/an/aelf ua-wget
http://94.154.43.60/bins/xnxnxnxnxnxnxnxnpowerpcxnxnn/an/aelf ua-wget
http://94.154.43.60/bins/xnxnxnxnxnxnxnxnriscv32xnxnn/an/aelf ua-wget
http://94.154.43.60/bins/xnxnxnxnxnxnxnxnriscv64xnxnn/an/aelf ua-wget
http://94.154.43.60/bins/xnxnxnxnxnxnxnxnsh2xnxnn/an/aelf ua-wget
http://94.154.43.60/bins/xnxnxnxnxnxnxnxnsh4xnxnn/an/aelf ua-wget
http://94.154.43.60/bins/xnxnxnxnxnxnxnxnx86_64xnxnn/an/aelf ua-wget

Intelligence

File Origin
# of uploads :
2
# of downloads :
63
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/2b8d4db8-5744-4f98-acb8-b1459514f23f
Behavior Graph:
Download SVG
%3 guuid=884c71a0-1600-0000-0d7c-bcd3750d0000 pid=3445 /usr/bin/sudo guuid=d95d17a4-1600-0000-0d7c-bcd3820d0000 pid=3458 /tmp/sample.bin guuid=884c71a0-1600-0000-0d7c-bcd3750d0000 pid=3445->guuid=d95d17a4-1600-0000-0d7c-bcd3820d0000 pid=3458 execve guuid=dbca7aa4-1600-0000-0d7c-bcd3830d0000 pid=3459 /usr/bin/wget net send-data guuid=d95d17a4-1600-0000-0d7c-bcd3820d0000 pid=3458->guuid=dbca7aa4-1600-0000-0d7c-bcd3830d0000 pid=3459 execve guuid=44763da9-1600-0000-0d7c-bcd3910d0000 pid=3473 /usr/bin/curl net send-data write-file guuid=d95d17a4-1600-0000-0d7c-bcd3820d0000 pid=3458->guuid=44763da9-1600-0000-0d7c-bcd3910d0000 pid=3473 execve guuid=b51b70b3-1600-0000-0d7c-bcd3b40d0000 pid=3508 /usr/bin/chmod guuid=d95d17a4-1600-0000-0d7c-bcd3820d0000 pid=3458->guuid=b51b70b3-1600-0000-0d7c-bcd3b40d0000 pid=3508 execve guuid=8ae4a0b3-1600-0000-0d7c-bcd3b50d0000 pid=3509 /home/sandbox/xnxnxnxnxnxnxnxnaarch64xnxn guuid=d95d17a4-1600-0000-0d7c-bcd3820d0000 pid=3458->guuid=8ae4a0b3-1600-0000-0d7c-bcd3b50d0000 pid=3509 execve guuid=03d7d6b3-1600-0000-0d7c-bcd3b70d0000 pid=3511 /usr/bin/rm delete-file guuid=d95d17a4-1600-0000-0d7c-bcd3820d0000 pid=3458->guuid=03d7d6b3-1600-0000-0d7c-bcd3b70d0000 pid=3511 execve guuid=43820bb4-1600-0000-0d7c-bcd3b90d0000 pid=3513 /usr/bin/wget net send-data guuid=d95d17a4-1600-0000-0d7c-bcd3820d0000 pid=3458->guuid=43820bb4-1600-0000-0d7c-bcd3b90d0000 pid=3513 execve guuid=23e760b6-1600-0000-0d7c-bcd3bf0d0000 pid=3519 /usr/bin/curl net send-data write-file guuid=d95d17a4-1600-0000-0d7c-bcd3820d0000 pid=3458->guuid=23e760b6-1600-0000-0d7c-bcd3bf0d0000 pid=3519 execve guuid=9c06b3b9-1600-0000-0d7c-bcd3ce0d0000 pid=3534 /usr/bin/chmod guuid=d95d17a4-1600-0000-0d7c-bcd3820d0000 pid=3458->guuid=9c06b3b9-1600-0000-0d7c-bcd3ce0d0000 pid=3534 execve guuid=5107f4b9-1600-0000-0d7c-bcd3cf0d0000 pid=3535 /home/sandbox/xnxnxnxnxnxnxnxni386xnxn guuid=d95d17a4-1600-0000-0d7c-bcd3820d0000 pid=3458->guuid=5107f4b9-1600-0000-0d7c-bcd3cf0d0000 pid=3535 execve guuid=453930ba-1600-0000-0d7c-bcd3d00d0000 pid=3536 /usr/bin/rm delete-file guuid=d95d17a4-1600-0000-0d7c-bcd3820d0000 pid=3458->guuid=453930ba-1600-0000-0d7c-bcd3d00d0000 pid=3536 execve guuid=b7c470ba-1600-0000-0d7c-bcd3d40d0000 pid=3540 /usr/bin/wget net send-data guuid=d95d17a4-1600-0000-0d7c-bcd3820d0000 pid=3458->guuid=b7c470ba-1600-0000-0d7c-bcd3d40d0000 pid=3540 execve guuid=1489c7bc-1600-0000-0d7c-bcd3dc0d0000 pid=3548 /usr/bin/curl net send-data write-file guuid=d95d17a4-1600-0000-0d7c-bcd3820d0000 pid=3458->guuid=1489c7bc-1600-0000-0d7c-bcd3dc0d0000 pid=3548 execve guuid=a89a6cc3-1600-0000-0d7c-bcd3df0d0000 pid=3551 /usr/bin/chmod guuid=d95d17a4-1600-0000-0d7c-bcd3820d0000 pid=3458->guuid=a89a6cc3-1600-0000-0d7c-bcd3df0d0000 pid=3551 execve guuid=6c4ebcc3-1600-0000-0d7c-bcd3e00d0000 pid=3552 /home/sandbox/xnxnxnxnxnxnxnxnloongarch64xnxn guuid=d95d17a4-1600-0000-0d7c-bcd3820d0000 pid=3458->guuid=6c4ebcc3-1600-0000-0d7c-bcd3e00d0000 pid=3552 execve guuid=81e7fdc3-1600-0000-0d7c-bcd3e10d0000 pid=3553 /usr/bin/rm delete-file guuid=d95d17a4-1600-0000-0d7c-bcd3820d0000 pid=3458->guuid=81e7fdc3-1600-0000-0d7c-bcd3e10d0000 pid=3553 execve guuid=b80547c4-1600-0000-0d7c-bcd3e20d0000 pid=3554 /usr/bin/wget net send-data guuid=d95d17a4-1600-0000-0d7c-bcd3820d0000 pid=3458->guuid=b80547c4-1600-0000-0d7c-bcd3e20d0000 pid=3554 execve guuid=cb82abc6-1600-0000-0d7c-bcd3ec0d0000 pid=3564 /usr/bin/curl net send-data write-file guuid=d95d17a4-1600-0000-0d7c-bcd3820d0000 pid=3458->guuid=cb82abc6-1600-0000-0d7c-bcd3ec0d0000 pid=3564 execve guuid=7dd55ccb-1600-0000-0d7c-bcd3f00d0000 pid=3568 /usr/bin/chmod guuid=d95d17a4-1600-0000-0d7c-bcd3820d0000 pid=3458->guuid=7dd55ccb-1600-0000-0d7c-bcd3f00d0000 pid=3568 execve guuid=b245a6cb-1600-0000-0d7c-bcd3f10d0000 pid=3569 /home/sandbox/xnxnxnxnxnxnxnxnm68kxnxn guuid=d95d17a4-1600-0000-0d7c-bcd3820d0000 pid=3458->guuid=b245a6cb-1600-0000-0d7c-bcd3f10d0000 pid=3569 execve guuid=d0b5e2cb-1600-0000-0d7c-bcd3f20d0000 pid=3570 /usr/bin/rm delete-file guuid=d95d17a4-1600-0000-0d7c-bcd3820d0000 pid=3458->guuid=d0b5e2cb-1600-0000-0d7c-bcd3f20d0000 pid=3570 execve guuid=ff342fcc-1600-0000-0d7c-bcd3f30d0000 pid=3571 /usr/bin/wget net send-data guuid=d95d17a4-1600-0000-0d7c-bcd3820d0000 pid=3458->guuid=ff342fcc-1600-0000-0d7c-bcd3f30d0000 pid=3571 execve guuid=08aba1ce-1600-0000-0d7c-bcd3ff0d0000 pid=3583 /usr/bin/curl net send-data write-file guuid=d95d17a4-1600-0000-0d7c-bcd3820d0000 pid=3458->guuid=08aba1ce-1600-0000-0d7c-bcd3ff0d0000 pid=3583 execve guuid=88cb84d4-1600-0000-0d7c-bcd3180e0000 pid=3608 /usr/bin/chmod guuid=d95d17a4-1600-0000-0d7c-bcd3820d0000 pid=3458->guuid=88cb84d4-1600-0000-0d7c-bcd3180e0000 pid=3608 execve guuid=5631c6d4-1600-0000-0d7c-bcd3190e0000 pid=3609 /home/sandbox/xnxnxnxnxnxnxnxnmicroblazexnxn guuid=d95d17a4-1600-0000-0d7c-bcd3820d0000 pid=3458->guuid=5631c6d4-1600-0000-0d7c-bcd3190e0000 pid=3609 execve guuid=79fc0bd5-1600-0000-0d7c-bcd31a0e0000 pid=3610 /usr/bin/rm delete-file guuid=d95d17a4-1600-0000-0d7c-bcd3820d0000 pid=3458->guuid=79fc0bd5-1600-0000-0d7c-bcd31a0e0000 pid=3610 execve guuid=31ae56d5-1600-0000-0d7c-bcd31b0e0000 pid=3611 /usr/bin/wget net send-data guuid=d95d17a4-1600-0000-0d7c-bcd3820d0000 pid=3458->guuid=31ae56d5-1600-0000-0d7c-bcd31b0e0000 pid=3611 execve guuid=a1a656d8-1600-0000-0d7c-bcd3250e0000 pid=3621 /usr/bin/curl net send-data write-file guuid=d95d17a4-1600-0000-0d7c-bcd3820d0000 pid=3458->guuid=a1a656d8-1600-0000-0d7c-bcd3250e0000 pid=3621 execve guuid=b0b6d3df-1600-0000-0d7c-bcd3440e0000 pid=3652 /usr/bin/chmod guuid=d95d17a4-1600-0000-0d7c-bcd3820d0000 pid=3458->guuid=b0b6d3df-1600-0000-0d7c-bcd3440e0000 pid=3652 execve guuid=ddd090e0-1600-0000-0d7c-bcd3470e0000 pid=3655 /home/sandbox/xnxnxnxnxnxnxnxnmipsxnxn guuid=d95d17a4-1600-0000-0d7c-bcd3820d0000 pid=3458->guuid=ddd090e0-1600-0000-0d7c-bcd3470e0000 pid=3655 execve guuid=31461ee1-1600-0000-0d7c-bcd34a0e0000 pid=3658 /usr/bin/rm delete-file guuid=d95d17a4-1600-0000-0d7c-bcd3820d0000 pid=3458->guuid=31461ee1-1600-0000-0d7c-bcd34a0e0000 pid=3658 execve guuid=bbe393e1-1600-0000-0d7c-bcd34c0e0000 pid=3660 /usr/bin/wget net send-data guuid=d95d17a4-1600-0000-0d7c-bcd3820d0000 pid=3458->guuid=bbe393e1-1600-0000-0d7c-bcd34c0e0000 pid=3660 execve guuid=40ec25e5-1600-0000-0d7c-bcd3550e0000 pid=3669 /usr/bin/curl net send-data write-file guuid=d95d17a4-1600-0000-0d7c-bcd3820d0000 pid=3458->guuid=40ec25e5-1600-0000-0d7c-bcd3550e0000 pid=3669 execve guuid=cd1d0bea-1600-0000-0d7c-bcd36d0e0000 pid=3693 /usr/bin/chmod guuid=d95d17a4-1600-0000-0d7c-bcd3820d0000 pid=3458->guuid=cd1d0bea-1600-0000-0d7c-bcd36d0e0000 pid=3693 execve guuid=16df49ea-1600-0000-0d7c-bcd3700e0000 pid=3696 /home/sandbox/xnxnxnxnxnxnxnxnor1kxnxn guuid=d95d17a4-1600-0000-0d7c-bcd3820d0000 pid=3458->guuid=16df49ea-1600-0000-0d7c-bcd3700e0000 pid=3696 execve guuid=1d1e7eea-1600-0000-0d7c-bcd3720e0000 pid=3698 /usr/bin/rm delete-file guuid=d95d17a4-1600-0000-0d7c-bcd3820d0000 pid=3458->guuid=1d1e7eea-1600-0000-0d7c-bcd3720e0000 pid=3698 execve guuid=eb1cd3ea-1600-0000-0d7c-bcd3750e0000 pid=3701 /usr/bin/wget net send-data guuid=d95d17a4-1600-0000-0d7c-bcd3820d0000 pid=3458->guuid=eb1cd3ea-1600-0000-0d7c-bcd3750e0000 pid=3701 execve guuid=6b1876ed-1600-0000-0d7c-bcd3870e0000 pid=3719 /usr/bin/curl net send-data write-file guuid=d95d17a4-1600-0000-0d7c-bcd3820d0000 pid=3458->guuid=6b1876ed-1600-0000-0d7c-bcd3870e0000 pid=3719 execve guuid=e51fb7f1-1600-0000-0d7c-bcd3960e0000 pid=3734 /usr/bin/chmod guuid=d95d17a4-1600-0000-0d7c-bcd3820d0000 pid=3458->guuid=e51fb7f1-1600-0000-0d7c-bcd3960e0000 pid=3734 execve guuid=024afcf1-1600-0000-0d7c-bcd3970e0000 pid=3735 /home/sandbox/xnxnxnxnxnxnxnxnpowerpcxnxn guuid=d95d17a4-1600-0000-0d7c-bcd3820d0000 pid=3458->guuid=024afcf1-1600-0000-0d7c-bcd3970e0000 pid=3735 execve guuid=673635f2-1600-0000-0d7c-bcd3980e0000 pid=3736 /usr/bin/rm delete-file guuid=d95d17a4-1600-0000-0d7c-bcd3820d0000 pid=3458->guuid=673635f2-1600-0000-0d7c-bcd3980e0000 pid=3736 execve guuid=ab336ef2-1600-0000-0d7c-bcd39a0e0000 pid=3738 /usr/bin/wget net send-data guuid=d95d17a4-1600-0000-0d7c-bcd3820d0000 pid=3458->guuid=ab336ef2-1600-0000-0d7c-bcd39a0e0000 pid=3738 execve guuid=dc6e00f5-1600-0000-0d7c-bcd3a70e0000 pid=3751 /usr/bin/curl net send-data write-file guuid=d95d17a4-1600-0000-0d7c-bcd3820d0000 pid=3458->guuid=dc6e00f5-1600-0000-0d7c-bcd3a70e0000 pid=3751 execve guuid=adc2bdfc-1600-0000-0d7c-bcd3c60e0000 pid=3782 /usr/bin/chmod guuid=d95d17a4-1600-0000-0d7c-bcd3820d0000 pid=3458->guuid=adc2bdfc-1600-0000-0d7c-bcd3c60e0000 pid=3782 execve guuid=a490f3fc-1600-0000-0d7c-bcd3c70e0000 pid=3783 /home/sandbox/xnxnxnxnxnxnxnxnriscv32xnxn guuid=d95d17a4-1600-0000-0d7c-bcd3820d0000 pid=3458->guuid=a490f3fc-1600-0000-0d7c-bcd3c70e0000 pid=3783 execve guuid=1a1b2efd-1600-0000-0d7c-bcd3c90e0000 pid=3785 /usr/bin/rm delete-file guuid=d95d17a4-1600-0000-0d7c-bcd3820d0000 pid=3458->guuid=1a1b2efd-1600-0000-0d7c-bcd3c90e0000 pid=3785 execve guuid=5a1970fd-1600-0000-0d7c-bcd3cd0e0000 pid=3789 /usr/bin/wget net send-data guuid=d95d17a4-1600-0000-0d7c-bcd3820d0000 pid=3458->guuid=5a1970fd-1600-0000-0d7c-bcd3cd0e0000 pid=3789 execve guuid=28220e02-1700-0000-0d7c-bcd3dc0e0000 pid=3804 /usr/bin/curl net send-data write-file guuid=d95d17a4-1600-0000-0d7c-bcd3820d0000 pid=3458->guuid=28220e02-1700-0000-0d7c-bcd3dc0e0000 pid=3804 execve guuid=2f813c07-1700-0000-0d7c-bcd3ef0e0000 pid=3823 /usr/bin/chmod guuid=d95d17a4-1600-0000-0d7c-bcd3820d0000 pid=3458->guuid=2f813c07-1700-0000-0d7c-bcd3ef0e0000 pid=3823 execve guuid=a0b18c07-1700-0000-0d7c-bcd3f10e0000 pid=3825 /home/sandbox/xnxnxnxnxnxnxnxnriscv64xnxn guuid=d95d17a4-1600-0000-0d7c-bcd3820d0000 pid=3458->guuid=a0b18c07-1700-0000-0d7c-bcd3f10e0000 pid=3825 execve guuid=9c53ec07-1700-0000-0d7c-bcd3f30e0000 pid=3827 /usr/bin/rm delete-file guuid=d95d17a4-1600-0000-0d7c-bcd3820d0000 pid=3458->guuid=9c53ec07-1700-0000-0d7c-bcd3f30e0000 pid=3827 execve guuid=b2de3c08-1700-0000-0d7c-bcd3f50e0000 pid=3829 /usr/bin/wget net send-data guuid=d95d17a4-1600-0000-0d7c-bcd3820d0000 pid=3458->guuid=b2de3c08-1700-0000-0d7c-bcd3f50e0000 pid=3829 execve guuid=b46ffa0a-1700-0000-0d7c-bcd3fb0e0000 pid=3835 /usr/bin/curl net send-data write-file guuid=d95d17a4-1600-0000-0d7c-bcd3820d0000 pid=3458->guuid=b46ffa0a-1700-0000-0d7c-bcd3fb0e0000 pid=3835 execve guuid=5e195610-1700-0000-0d7c-bcd30a0f0000 pid=3850 /usr/bin/chmod guuid=d95d17a4-1600-0000-0d7c-bcd3820d0000 pid=3458->guuid=5e195610-1700-0000-0d7c-bcd30a0f0000 pid=3850 execve guuid=a3cce210-1700-0000-0d7c-bcd30e0f0000 pid=3854 /home/sandbox/xnxnxnxnxnxnxnxnsh2xnxn guuid=d95d17a4-1600-0000-0d7c-bcd3820d0000 pid=3458->guuid=a3cce210-1700-0000-0d7c-bcd30e0f0000 pid=3854 execve guuid=ed523a11-1700-0000-0d7c-bcd30f0f0000 pid=3855 /usr/bin/rm delete-file guuid=d95d17a4-1600-0000-0d7c-bcd3820d0000 pid=3458->guuid=ed523a11-1700-0000-0d7c-bcd30f0f0000 pid=3855 execve guuid=5cf6cc11-1700-0000-0d7c-bcd3120f0000 pid=3858 /usr/bin/wget net send-data guuid=d95d17a4-1600-0000-0d7c-bcd3820d0000 pid=3458->guuid=5cf6cc11-1700-0000-0d7c-bcd3120f0000 pid=3858 execve guuid=4459e614-1700-0000-0d7c-bcd31d0f0000 pid=3869 /usr/bin/curl net send-data write-file guuid=d95d17a4-1600-0000-0d7c-bcd3820d0000 pid=3458->guuid=4459e614-1700-0000-0d7c-bcd31d0f0000 pid=3869 execve guuid=3c805419-1700-0000-0d7c-bcd32b0f0000 pid=3883 /usr/bin/chmod guuid=d95d17a4-1600-0000-0d7c-bcd3820d0000 pid=3458->guuid=3c805419-1700-0000-0d7c-bcd32b0f0000 pid=3883 execve guuid=fc038619-1700-0000-0d7c-bcd32c0f0000 pid=3884 /home/sandbox/xnxnxnxnxnxnxnxnsh4xnxn guuid=d95d17a4-1600-0000-0d7c-bcd3820d0000 pid=3458->guuid=fc038619-1700-0000-0d7c-bcd32c0f0000 pid=3884 execve guuid=528cb919-1700-0000-0d7c-bcd32d0f0000 pid=3885 /usr/bin/rm delete-file guuid=d95d17a4-1600-0000-0d7c-bcd3820d0000 pid=3458->guuid=528cb919-1700-0000-0d7c-bcd32d0f0000 pid=3885 execve guuid=5b6dec19-1700-0000-0d7c-bcd32e0f0000 pid=3886 /usr/bin/wget net send-data guuid=d95d17a4-1600-0000-0d7c-bcd3820d0000 pid=3458->guuid=5b6dec19-1700-0000-0d7c-bcd32e0f0000 pid=3886 execve guuid=a711311c-1700-0000-0d7c-bcd33e0f0000 pid=3902 /usr/bin/curl net send-data write-file guuid=d95d17a4-1600-0000-0d7c-bcd3820d0000 pid=3458->guuid=a711311c-1700-0000-0d7c-bcd33e0f0000 pid=3902 execve guuid=7112991f-1700-0000-0d7c-bcd34f0f0000 pid=3919 /usr/bin/chmod guuid=d95d17a4-1600-0000-0d7c-bcd3820d0000 pid=3458->guuid=7112991f-1700-0000-0d7c-bcd34f0f0000 pid=3919 execve guuid=81b9cb1f-1700-0000-0d7c-bcd3510f0000 pid=3921 /home/sandbox/xnxnxnxnxnxnxnxnx86_64xnxn guuid=d95d17a4-1600-0000-0d7c-bcd3820d0000 pid=3458->guuid=81b9cb1f-1700-0000-0d7c-bcd3510f0000 pid=3921 execve guuid=a0fdfa1f-1700-0000-0d7c-bcd3530f0000 pid=3923 /usr/bin/rm delete-file guuid=d95d17a4-1600-0000-0d7c-bcd3820d0000 pid=3458->guuid=a0fdfa1f-1700-0000-0d7c-bcd3530f0000 pid=3923 execve 079589fc-ef9b-528e-b132-247c095d948c 94.154.43.60:80 guuid=dbca7aa4-1600-0000-0d7c-bcd3830d0000 pid=3459->079589fc-ef9b-528e-b132-247c095d948c send: 159B guuid=44763da9-1600-0000-0d7c-bcd3910d0000 pid=3473->079589fc-ef9b-528e-b132-247c095d948c send: 108B guuid=43820bb4-1600-0000-0d7c-bcd3b90d0000 pid=3513->079589fc-ef9b-528e-b132-247c095d948c send: 156B guuid=23e760b6-1600-0000-0d7c-bcd3bf0d0000 pid=3519->079589fc-ef9b-528e-b132-247c095d948c send: 105B guuid=b7c470ba-1600-0000-0d7c-bcd3d40d0000 pid=3540->079589fc-ef9b-528e-b132-247c095d948c send: 163B guuid=1489c7bc-1600-0000-0d7c-bcd3dc0d0000 pid=3548->079589fc-ef9b-528e-b132-247c095d948c send: 112B guuid=b80547c4-1600-0000-0d7c-bcd3e20d0000 pid=3554->079589fc-ef9b-528e-b132-247c095d948c send: 156B guuid=cb82abc6-1600-0000-0d7c-bcd3ec0d0000 pid=3564->079589fc-ef9b-528e-b132-247c095d948c send: 105B guuid=ff342fcc-1600-0000-0d7c-bcd3f30d0000 pid=3571->079589fc-ef9b-528e-b132-247c095d948c send: 162B guuid=08aba1ce-1600-0000-0d7c-bcd3ff0d0000 pid=3583->079589fc-ef9b-528e-b132-247c095d948c send: 111B guuid=31ae56d5-1600-0000-0d7c-bcd31b0e0000 pid=3611->079589fc-ef9b-528e-b132-247c095d948c send: 156B guuid=a1a656d8-1600-0000-0d7c-bcd3250e0000 pid=3621->079589fc-ef9b-528e-b132-247c095d948c send: 105B guuid=bbe393e1-1600-0000-0d7c-bcd34c0e0000 pid=3660->079589fc-ef9b-528e-b132-247c095d948c send: 156B guuid=40ec25e5-1600-0000-0d7c-bcd3550e0000 pid=3669->079589fc-ef9b-528e-b132-247c095d948c send: 105B guuid=eb1cd3ea-1600-0000-0d7c-bcd3750e0000 pid=3701->079589fc-ef9b-528e-b132-247c095d948c send: 159B guuid=6b1876ed-1600-0000-0d7c-bcd3870e0000 pid=3719->079589fc-ef9b-528e-b132-247c095d948c send: 108B guuid=ab336ef2-1600-0000-0d7c-bcd39a0e0000 pid=3738->079589fc-ef9b-528e-b132-247c095d948c send: 159B guuid=dc6e00f5-1600-0000-0d7c-bcd3a70e0000 pid=3751->079589fc-ef9b-528e-b132-247c095d948c send: 108B guuid=5a1970fd-1600-0000-0d7c-bcd3cd0e0000 pid=3789->079589fc-ef9b-528e-b132-247c095d948c send: 159B guuid=28220e02-1700-0000-0d7c-bcd3dc0e0000 pid=3804->079589fc-ef9b-528e-b132-247c095d948c send: 108B guuid=b2de3c08-1700-0000-0d7c-bcd3f50e0000 pid=3829->079589fc-ef9b-528e-b132-247c095d948c send: 155B guuid=b46ffa0a-1700-0000-0d7c-bcd3fb0e0000 pid=3835->079589fc-ef9b-528e-b132-247c095d948c send: 104B guuid=5cf6cc11-1700-0000-0d7c-bcd3120f0000 pid=3858->079589fc-ef9b-528e-b132-247c095d948c send: 155B guuid=4459e614-1700-0000-0d7c-bcd31d0f0000 pid=3869->079589fc-ef9b-528e-b132-247c095d948c send: 104B guuid=5b6dec19-1700-0000-0d7c-bcd32e0f0000 pid=3886->079589fc-ef9b-528e-b132-247c095d948c send: 158B guuid=a711311c-1700-0000-0d7c-bcd33e0f0000 pid=3902->079589fc-ef9b-528e-b132-247c095d948c send: 107B
Score:
98%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/ccf383d57772285ebce806390168d13dfd6038f123cc148998ccf7da766c099f
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ccf383d57772285ebce806390168d13dfd6038f123cc148998ccf7da766c099f/
Threat name:
Script-BAT.Downloader.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2026-08-27 03:16:19 UTC
File Type:
Text (Shell)
AV detection:
7 of 36 (19.44%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ztzyhvlxoiuf5phiay4qc2grhx6waohrepgbjcmyzt35u5tmbgpq._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
execution
Link:
https://tria.ge/reports/260827-dsk2aadj9v/
Behaviour
Modifies registry class
Suspicious use of SetWindowsHookEx
Enumerates physical storage devices
Executes a command shell one-liner
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/ccf383d57772285ebce806390168d13dfd6038f123cc148998ccf7da766c099f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh ccf383d57772285ebce806390168d13dfd6038f123cc148998ccf7da766c099f

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3908532/
  
Delivery method
Distributed via web download

Comments