🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ce99a1520f381fba7ca927bc9e214b6e34bebd54548c1c22543bc5b39660510d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ce99a1520f381fba7ca927bc9e214b6e34bebd54548c1c22543bc5b39660510d
SHA3-384 hash: 538303de56509997823868caead8baa555924557f1a5039ebc8fb1b60841e498e8132480b53265b7dbf89c80966454dd
SHA1 hash: c6161eb7d2b69508a0bb871f13e8bd78a5e9c609
MD5 hash: 5521a82046a18f865069931496072edf
humanhash: early-steak-maryland-princess
File name:ok
Download: download sample
File size:1'608 bytes
First seen:2026-09-03 02:51:33 UTC
Last seen:2026-09-03 22:50:23 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 24:b/JMClKoTpupm1nzeDmvpc6Bc61Ey8gWVn:9pKEBymc6Bc6T5WVn
TLSH T1993112DE01245E710142DA8F72B73188B59DA5FB2C8FE3E888091EAD568C7CCF661B49
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://5.182.210.174/1135aan/an/an/a
http://5.182.210.174/c08665n/an/an/a
http://5.182.210.174/bd71b6n/an/an/a
http://5.182.210.174/b950b9n/an/an/a
http://5.182.210.174/76c141n/an/an/a
http://5.182.210.174/c1beden/an/an/a
http://5.182.210.174/f6f2b5n/an/an/a
http://5.182.210.174/ea4d4bn/an/an/a
http://5.182.210.174/13587dn/an/an/a
http://5.182.210.174/30b32dn/an/an/a
http://5.182.210.174/faeb9bn/an/an/a
http://5.182.210.174/d7bc61n/an/an/a

Intelligence

File Origin
# of uploads :
4
# of downloads :
69
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive mirai
Link:
https://www.filescan.io/uploads/6a98e0dc3b935c0ca2104b54/reports/c28268fa-68cf-4efa-9c04-66e7679275c6/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-09-03T00:47:00Z UTC
Last seen:
2026-09-03T00:58:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/ce99a1520f381fba7ca927bc9e214b6e34bebd54548c1c22543bc5b39660510d/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/b9df1aac-27dd-4c53-a227-2e5dde997deb
Behavior Graph:
Download SVG
%3 guuid=1e0a631d-1900-0000-ff54-38f817090000 pid=2327 /usr/bin/sudo guuid=79428a1f-1900-0000-ff54-38f81e090000 pid=2334 /tmp/sample.bin guuid=1e0a631d-1900-0000-ff54-38f817090000 pid=2327->guuid=79428a1f-1900-0000-ff54-38f81e090000 pid=2334 execve guuid=c021f21f-1900-0000-ff54-38f820090000 pid=2336 /usr/bin/wget net send-data guuid=79428a1f-1900-0000-ff54-38f81e090000 pid=2334->guuid=c021f21f-1900-0000-ff54-38f820090000 pid=2336 execve guuid=584bed26-1900-0000-ff54-38f82e090000 pid=2350 /usr/bin/curl net send-data write-file guuid=79428a1f-1900-0000-ff54-38f81e090000 pid=2334->guuid=584bed26-1900-0000-ff54-38f82e090000 pid=2350 execve guuid=4cc7b72f-1900-0000-ff54-38f847090000 pid=2375 /usr/bin/chmod guuid=79428a1f-1900-0000-ff54-38f81e090000 pid=2334->guuid=4cc7b72f-1900-0000-ff54-38f847090000 pid=2375 execve guuid=b2825530-1900-0000-ff54-38f84a090000 pid=2378 /usr/bin/bash guuid=79428a1f-1900-0000-ff54-38f81e090000 pid=2334->guuid=b2825530-1900-0000-ff54-38f84a090000 pid=2378 clone guuid=37d0a130-1900-0000-ff54-38f84c090000 pid=2380 /usr/bin/rm delete-file guuid=79428a1f-1900-0000-ff54-38f81e090000 pid=2334->guuid=37d0a130-1900-0000-ff54-38f84c090000 pid=2380 execve guuid=c674fb30-1900-0000-ff54-38f84d090000 pid=2381 /usr/bin/rm guuid=79428a1f-1900-0000-ff54-38f81e090000 pid=2334->guuid=c674fb30-1900-0000-ff54-38f84d090000 pid=2381 execve guuid=5bcf5831-1900-0000-ff54-38f84e090000 pid=2382 /usr/bin/wget net send-data guuid=79428a1f-1900-0000-ff54-38f81e090000 pid=2334->guuid=5bcf5831-1900-0000-ff54-38f84e090000 pid=2382 execve guuid=3eff9a34-1900-0000-ff54-38f851090000 pid=2385 /usr/bin/curl net send-data write-file guuid=79428a1f-1900-0000-ff54-38f81e090000 pid=2334->guuid=3eff9a34-1900-0000-ff54-38f851090000 pid=2385 execve guuid=ce1e053c-1900-0000-ff54-38f863090000 pid=2403 /usr/bin/chmod guuid=79428a1f-1900-0000-ff54-38f81e090000 pid=2334->guuid=ce1e053c-1900-0000-ff54-38f863090000 pid=2403 execve guuid=6e964b3c-1900-0000-ff54-38f865090000 pid=2405 /usr/bin/bash guuid=79428a1f-1900-0000-ff54-38f81e090000 pid=2334->guuid=6e964b3c-1900-0000-ff54-38f865090000 pid=2405 clone guuid=a2ad953c-1900-0000-ff54-38f867090000 pid=2407 /usr/bin/rm delete-file guuid=79428a1f-1900-0000-ff54-38f81e090000 pid=2334->guuid=a2ad953c-1900-0000-ff54-38f867090000 pid=2407 execve guuid=3edce93c-1900-0000-ff54-38f869090000 pid=2409 /usr/bin/rm guuid=79428a1f-1900-0000-ff54-38f81e090000 pid=2334->guuid=3edce93c-1900-0000-ff54-38f869090000 pid=2409 execve guuid=61a2433d-1900-0000-ff54-38f86b090000 pid=2411 /usr/bin/wget net send-data guuid=79428a1f-1900-0000-ff54-38f81e090000 pid=2334->guuid=61a2433d-1900-0000-ff54-38f86b090000 pid=2411 execve guuid=87d9d63f-1900-0000-ff54-38f870090000 pid=2416 /usr/bin/curl net send-data write-file guuid=79428a1f-1900-0000-ff54-38f81e090000 pid=2334->guuid=87d9d63f-1900-0000-ff54-38f870090000 pid=2416 execve guuid=8bf0c043-1900-0000-ff54-38f87f090000 pid=2431 /usr/bin/chmod guuid=79428a1f-1900-0000-ff54-38f81e090000 pid=2334->guuid=8bf0c043-1900-0000-ff54-38f87f090000 pid=2431 execve guuid=96840144-1900-0000-ff54-38f880090000 pid=2432 /usr/bin/bash guuid=79428a1f-1900-0000-ff54-38f81e090000 pid=2334->guuid=96840144-1900-0000-ff54-38f880090000 pid=2432 clone guuid=8be13944-1900-0000-ff54-38f883090000 pid=2435 /usr/bin/rm delete-file guuid=79428a1f-1900-0000-ff54-38f81e090000 pid=2334->guuid=8be13944-1900-0000-ff54-38f883090000 pid=2435 execve guuid=d05a8e44-1900-0000-ff54-38f885090000 pid=2437 /usr/bin/rm guuid=79428a1f-1900-0000-ff54-38f81e090000 pid=2334->guuid=d05a8e44-1900-0000-ff54-38f885090000 pid=2437 execve guuid=eea7d244-1900-0000-ff54-38f887090000 pid=2439 /usr/bin/wget net send-data guuid=79428a1f-1900-0000-ff54-38f81e090000 pid=2334->guuid=eea7d244-1900-0000-ff54-38f887090000 pid=2439 execve guuid=317a8147-1900-0000-ff54-38f88f090000 pid=2447 /usr/bin/curl net send-data write-file guuid=79428a1f-1900-0000-ff54-38f81e090000 pid=2334->guuid=317a8147-1900-0000-ff54-38f88f090000 pid=2447 execve guuid=83a3ed4c-1900-0000-ff54-38f89e090000 pid=2462 /usr/bin/chmod guuid=79428a1f-1900-0000-ff54-38f81e090000 pid=2334->guuid=83a3ed4c-1900-0000-ff54-38f89e090000 pid=2462 execve guuid=c1eb664d-1900-0000-ff54-38f8a0090000 pid=2464 /usr/bin/bash guuid=79428a1f-1900-0000-ff54-38f81e090000 pid=2334->guuid=c1eb664d-1900-0000-ff54-38f8a0090000 pid=2464 clone guuid=af4fcc4d-1900-0000-ff54-38f8a3090000 pid=2467 /usr/bin/rm delete-file guuid=79428a1f-1900-0000-ff54-38f81e090000 pid=2334->guuid=af4fcc4d-1900-0000-ff54-38f8a3090000 pid=2467 execve guuid=2d981b4e-1900-0000-ff54-38f8a5090000 pid=2469 /usr/bin/rm guuid=79428a1f-1900-0000-ff54-38f81e090000 pid=2334->guuid=2d981b4e-1900-0000-ff54-38f8a5090000 pid=2469 execve guuid=50bb8b4e-1900-0000-ff54-38f8a8090000 pid=2472 /usr/bin/wget net send-data guuid=79428a1f-1900-0000-ff54-38f81e090000 pid=2334->guuid=50bb8b4e-1900-0000-ff54-38f8a8090000 pid=2472 execve guuid=a02a1152-1900-0000-ff54-38f8af090000 pid=2479 /usr/bin/curl net send-data write-file guuid=79428a1f-1900-0000-ff54-38f81e090000 pid=2334->guuid=a02a1152-1900-0000-ff54-38f8af090000 pid=2479 execve guuid=0007345d-1900-0000-ff54-38f8c1090000 pid=2497 /usr/bin/chmod guuid=79428a1f-1900-0000-ff54-38f81e090000 pid=2334->guuid=0007345d-1900-0000-ff54-38f8c1090000 pid=2497 execve guuid=2a68e25e-1900-0000-ff54-38f8c7090000 pid=2503 /usr/bin/bash guuid=79428a1f-1900-0000-ff54-38f81e090000 pid=2334->guuid=2a68e25e-1900-0000-ff54-38f8c7090000 pid=2503 clone guuid=6564fc5f-1900-0000-ff54-38f8cc090000 pid=2508 /usr/bin/rm delete-file guuid=79428a1f-1900-0000-ff54-38f81e090000 pid=2334->guuid=6564fc5f-1900-0000-ff54-38f8cc090000 pid=2508 execve guuid=1e4d0361-1900-0000-ff54-38f8cf090000 pid=2511 /usr/bin/rm guuid=79428a1f-1900-0000-ff54-38f81e090000 pid=2334->guuid=1e4d0361-1900-0000-ff54-38f8cf090000 pid=2511 execve guuid=d0f35161-1900-0000-ff54-38f8d1090000 pid=2513 /usr/bin/wget net send-data guuid=79428a1f-1900-0000-ff54-38f81e090000 pid=2334->guuid=d0f35161-1900-0000-ff54-38f8d1090000 pid=2513 execve guuid=d79f1c64-1900-0000-ff54-38f8da090000 pid=2522 /usr/bin/curl net send-data write-file guuid=79428a1f-1900-0000-ff54-38f81e090000 pid=2334->guuid=d79f1c64-1900-0000-ff54-38f8da090000 pid=2522 execve guuid=65097b69-1900-0000-ff54-38f8ec090000 pid=2540 /usr/bin/chmod guuid=79428a1f-1900-0000-ff54-38f81e090000 pid=2334->guuid=65097b69-1900-0000-ff54-38f8ec090000 pid=2540 execve guuid=e203cd69-1900-0000-ff54-38f8ee090000 pid=2542 /usr/bin/bash guuid=79428a1f-1900-0000-ff54-38f81e090000 pid=2334->guuid=e203cd69-1900-0000-ff54-38f8ee090000 pid=2542 clone guuid=29fa006a-1900-0000-ff54-38f8f1090000 pid=2545 /usr/bin/rm delete-file guuid=79428a1f-1900-0000-ff54-38f81e090000 pid=2334->guuid=29fa006a-1900-0000-ff54-38f8f1090000 pid=2545 execve guuid=75bc416a-1900-0000-ff54-38f8f3090000 pid=2547 /usr/bin/rm guuid=79428a1f-1900-0000-ff54-38f81e090000 pid=2334->guuid=75bc416a-1900-0000-ff54-38f8f3090000 pid=2547 execve guuid=244a7b6a-1900-0000-ff54-38f8f5090000 pid=2549 /usr/bin/wget net send-data guuid=79428a1f-1900-0000-ff54-38f81e090000 pid=2334->guuid=244a7b6a-1900-0000-ff54-38f8f5090000 pid=2549 execve guuid=2287536d-1900-0000-ff54-38f8020a0000 pid=2562 /usr/bin/curl net send-data write-file guuid=79428a1f-1900-0000-ff54-38f81e090000 pid=2334->guuid=2287536d-1900-0000-ff54-38f8020a0000 pid=2562 execve guuid=6a2d0971-1900-0000-ff54-38f8110a0000 pid=2577 /usr/bin/chmod guuid=79428a1f-1900-0000-ff54-38f81e090000 pid=2334->guuid=6a2d0971-1900-0000-ff54-38f8110a0000 pid=2577 execve guuid=3629a771-1900-0000-ff54-38f8130a0000 pid=2579 /usr/bin/bash guuid=79428a1f-1900-0000-ff54-38f81e090000 pid=2334->guuid=3629a771-1900-0000-ff54-38f8130a0000 pid=2579 clone guuid=dc312d72-1900-0000-ff54-38f8160a0000 pid=2582 /usr/bin/rm delete-file guuid=79428a1f-1900-0000-ff54-38f81e090000 pid=2334->guuid=dc312d72-1900-0000-ff54-38f8160a0000 pid=2582 execve guuid=7d317972-1900-0000-ff54-38f8190a0000 pid=2585 /usr/bin/rm guuid=79428a1f-1900-0000-ff54-38f81e090000 pid=2334->guuid=7d317972-1900-0000-ff54-38f8190a0000 pid=2585 execve guuid=e278c672-1900-0000-ff54-38f81b0a0000 pid=2587 /usr/bin/wget net send-data guuid=79428a1f-1900-0000-ff54-38f81e090000 pid=2334->guuid=e278c672-1900-0000-ff54-38f81b0a0000 pid=2587 execve guuid=ace44a75-1900-0000-ff54-38f8230a0000 pid=2595 /usr/bin/curl net send-data write-file guuid=79428a1f-1900-0000-ff54-38f81e090000 pid=2334->guuid=ace44a75-1900-0000-ff54-38f8230a0000 pid=2595 execve guuid=b34fb07c-1900-0000-ff54-38f8300a0000 pid=2608 /usr/bin/chmod guuid=79428a1f-1900-0000-ff54-38f81e090000 pid=2334->guuid=b34fb07c-1900-0000-ff54-38f8300a0000 pid=2608 execve guuid=625aea7c-1900-0000-ff54-38f8310a0000 pid=2609 /usr/bin/bash guuid=79428a1f-1900-0000-ff54-38f81e090000 pid=2334->guuid=625aea7c-1900-0000-ff54-38f8310a0000 pid=2609 clone guuid=c8e5197d-1900-0000-ff54-38f8330a0000 pid=2611 /usr/bin/rm delete-file guuid=79428a1f-1900-0000-ff54-38f81e090000 pid=2334->guuid=c8e5197d-1900-0000-ff54-38f8330a0000 pid=2611 execve guuid=9bde547d-1900-0000-ff54-38f8350a0000 pid=2613 /usr/bin/rm guuid=79428a1f-1900-0000-ff54-38f81e090000 pid=2334->guuid=9bde547d-1900-0000-ff54-38f8350a0000 pid=2613 execve guuid=04cf8d7d-1900-0000-ff54-38f8360a0000 pid=2614 /usr/bin/wget net send-data guuid=79428a1f-1900-0000-ff54-38f81e090000 pid=2334->guuid=04cf8d7d-1900-0000-ff54-38f8360a0000 pid=2614 execve guuid=9b9cef80-1900-0000-ff54-38f83c0a0000 pid=2620 /usr/bin/curl net send-data write-file guuid=79428a1f-1900-0000-ff54-38f81e090000 pid=2334->guuid=9b9cef80-1900-0000-ff54-38f83c0a0000 pid=2620 execve guuid=d3cc1488-1900-0000-ff54-38f84e0a0000 pid=2638 /usr/bin/chmod guuid=79428a1f-1900-0000-ff54-38f81e090000 pid=2334->guuid=d3cc1488-1900-0000-ff54-38f84e0a0000 pid=2638 execve guuid=34675988-1900-0000-ff54-38f8500a0000 pid=2640 /usr/bin/bash guuid=79428a1f-1900-0000-ff54-38f81e090000 pid=2334->guuid=34675988-1900-0000-ff54-38f8500a0000 pid=2640 clone guuid=e10d9188-1900-0000-ff54-38f8520a0000 pid=2642 /usr/bin/rm delete-file guuid=79428a1f-1900-0000-ff54-38f81e090000 pid=2334->guuid=e10d9188-1900-0000-ff54-38f8520a0000 pid=2642 execve guuid=91ded688-1900-0000-ff54-38f8540a0000 pid=2644 /usr/bin/rm guuid=79428a1f-1900-0000-ff54-38f81e090000 pid=2334->guuid=91ded688-1900-0000-ff54-38f8540a0000 pid=2644 execve guuid=5d7d1d89-1900-0000-ff54-38f8560a0000 pid=2646 /usr/bin/wget net send-data guuid=79428a1f-1900-0000-ff54-38f81e090000 pid=2334->guuid=5d7d1d89-1900-0000-ff54-38f8560a0000 pid=2646 execve guuid=0179f48b-1900-0000-ff54-38f85e0a0000 pid=2654 /usr/bin/curl net send-data write-file guuid=79428a1f-1900-0000-ff54-38f81e090000 pid=2334->guuid=0179f48b-1900-0000-ff54-38f85e0a0000 pid=2654 execve guuid=2ad76495-1900-0000-ff54-38f8720a0000 pid=2674 /usr/bin/chmod guuid=79428a1f-1900-0000-ff54-38f81e090000 pid=2334->guuid=2ad76495-1900-0000-ff54-38f8720a0000 pid=2674 execve guuid=6ce6b795-1900-0000-ff54-38f8730a0000 pid=2675 /usr/bin/bash guuid=79428a1f-1900-0000-ff54-38f81e090000 pid=2334->guuid=6ce6b795-1900-0000-ff54-38f8730a0000 pid=2675 clone guuid=b3234696-1900-0000-ff54-38f8750a0000 pid=2677 /usr/bin/rm delete-file guuid=79428a1f-1900-0000-ff54-38f81e090000 pid=2334->guuid=b3234696-1900-0000-ff54-38f8750a0000 pid=2677 execve guuid=e419a096-1900-0000-ff54-38f8760a0000 pid=2678 /usr/bin/rm guuid=79428a1f-1900-0000-ff54-38f81e090000 pid=2334->guuid=e419a096-1900-0000-ff54-38f8760a0000 pid=2678 execve guuid=16bfde96-1900-0000-ff54-38f8770a0000 pid=2679 /usr/bin/wget net send-data guuid=79428a1f-1900-0000-ff54-38f81e090000 pid=2334->guuid=16bfde96-1900-0000-ff54-38f8770a0000 pid=2679 execve guuid=ecd47799-1900-0000-ff54-38f87a0a0000 pid=2682 /usr/bin/curl net send-data write-file guuid=79428a1f-1900-0000-ff54-38f81e090000 pid=2334->guuid=ecd47799-1900-0000-ff54-38f87a0a0000 pid=2682 execve guuid=f89d639e-1900-0000-ff54-38f8840a0000 pid=2692 /usr/bin/chmod guuid=79428a1f-1900-0000-ff54-38f81e090000 pid=2334->guuid=f89d639e-1900-0000-ff54-38f8840a0000 pid=2692 execve guuid=fd69d89e-1900-0000-ff54-38f8850a0000 pid=2693 /usr/bin/bash guuid=79428a1f-1900-0000-ff54-38f81e090000 pid=2334->guuid=fd69d89e-1900-0000-ff54-38f8850a0000 pid=2693 clone guuid=bd503e9f-1900-0000-ff54-38f8870a0000 pid=2695 /usr/bin/rm delete-file guuid=79428a1f-1900-0000-ff54-38f81e090000 pid=2334->guuid=bd503e9f-1900-0000-ff54-38f8870a0000 pid=2695 execve guuid=54e7899f-1900-0000-ff54-38f8890a0000 pid=2697 /usr/bin/rm guuid=79428a1f-1900-0000-ff54-38f81e090000 pid=2334->guuid=54e7899f-1900-0000-ff54-38f8890a0000 pid=2697 execve guuid=e11dd59f-1900-0000-ff54-38f88b0a0000 pid=2699 /usr/bin/wget net send-data guuid=79428a1f-1900-0000-ff54-38f81e090000 pid=2334->guuid=e11dd59f-1900-0000-ff54-38f88b0a0000 pid=2699 execve guuid=2bef78a2-1900-0000-ff54-38f8910a0000 pid=2705 /usr/bin/curl net send-data write-file guuid=79428a1f-1900-0000-ff54-38f81e090000 pid=2334->guuid=2bef78a2-1900-0000-ff54-38f8910a0000 pid=2705 execve guuid=535a09a7-1900-0000-ff54-38f89b0a0000 pid=2715 /usr/bin/chmod guuid=79428a1f-1900-0000-ff54-38f81e090000 pid=2334->guuid=535a09a7-1900-0000-ff54-38f89b0a0000 pid=2715 execve guuid=59674aa7-1900-0000-ff54-38f89c0a0000 pid=2716 /usr/bin/bash guuid=79428a1f-1900-0000-ff54-38f81e090000 pid=2334->guuid=59674aa7-1900-0000-ff54-38f89c0a0000 pid=2716 clone guuid=e8a277a7-1900-0000-ff54-38f89f0a0000 pid=2719 /usr/bin/rm delete-file guuid=79428a1f-1900-0000-ff54-38f81e090000 pid=2334->guuid=e8a277a7-1900-0000-ff54-38f89f0a0000 pid=2719 execve guuid=d2b5bba7-1900-0000-ff54-38f8a10a0000 pid=2721 /usr/bin/rm guuid=79428a1f-1900-0000-ff54-38f81e090000 pid=2334->guuid=d2b5bba7-1900-0000-ff54-38f8a10a0000 pid=2721 execve 5b654972-c9e1-50d8-b372-2dc2a5b9ad66 5.182.210.174:80 guuid=c021f21f-1900-0000-ff54-38f820090000 pid=2336->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=584bed26-1900-0000-ff54-38f82e090000 pid=2350->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=7d8b6f30-1900-0000-ff54-38f84b090000 pid=2379 /usr/bin/bash guuid=b2825530-1900-0000-ff54-38f84a090000 pid=2378->guuid=7d8b6f30-1900-0000-ff54-38f84b090000 pid=2379 clone guuid=5bcf5831-1900-0000-ff54-38f84e090000 pid=2382->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=3eff9a34-1900-0000-ff54-38f851090000 pid=2385->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=438d653c-1900-0000-ff54-38f866090000 pid=2406 /usr/bin/bash guuid=6e964b3c-1900-0000-ff54-38f865090000 pid=2405->guuid=438d653c-1900-0000-ff54-38f866090000 pid=2406 clone guuid=61a2433d-1900-0000-ff54-38f86b090000 pid=2411->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=87d9d63f-1900-0000-ff54-38f870090000 pid=2416->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=b3ed1a44-1900-0000-ff54-38f882090000 pid=2434 /usr/bin/bash guuid=96840144-1900-0000-ff54-38f880090000 pid=2432->guuid=b3ed1a44-1900-0000-ff54-38f882090000 pid=2434 clone guuid=eea7d244-1900-0000-ff54-38f887090000 pid=2439->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=317a8147-1900-0000-ff54-38f88f090000 pid=2447->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=be66974d-1900-0000-ff54-38f8a2090000 pid=2466 /usr/bin/bash guuid=c1eb664d-1900-0000-ff54-38f8a0090000 pid=2464->guuid=be66974d-1900-0000-ff54-38f8a2090000 pid=2466 clone guuid=50bb8b4e-1900-0000-ff54-38f8a8090000 pid=2472->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=a02a1152-1900-0000-ff54-38f8af090000 pid=2479->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=83a7825f-1900-0000-ff54-38f8c9090000 pid=2505 /usr/bin/bash guuid=2a68e25e-1900-0000-ff54-38f8c7090000 pid=2503->guuid=83a7825f-1900-0000-ff54-38f8c9090000 pid=2505 clone guuid=d0f35161-1900-0000-ff54-38f8d1090000 pid=2513->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=d79f1c64-1900-0000-ff54-38f8da090000 pid=2522->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=c387e269-1900-0000-ff54-38f8f0090000 pid=2544 /usr/bin/bash guuid=e203cd69-1900-0000-ff54-38f8ee090000 pid=2542->guuid=c387e269-1900-0000-ff54-38f8f0090000 pid=2544 clone guuid=244a7b6a-1900-0000-ff54-38f8f5090000 pid=2549->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=2287536d-1900-0000-ff54-38f8020a0000 pid=2562->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=d8ca0172-1900-0000-ff54-38f8150a0000 pid=2581 /usr/bin/bash guuid=3629a771-1900-0000-ff54-38f8130a0000 pid=2579->guuid=d8ca0172-1900-0000-ff54-38f8150a0000 pid=2581 clone guuid=e278c672-1900-0000-ff54-38f81b0a0000 pid=2587->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=ace44a75-1900-0000-ff54-38f8230a0000 pid=2595->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=4370fd7c-1900-0000-ff54-38f8320a0000 pid=2610 /usr/bin/bash guuid=625aea7c-1900-0000-ff54-38f8310a0000 pid=2609->guuid=4370fd7c-1900-0000-ff54-38f8320a0000 pid=2610 clone guuid=04cf8d7d-1900-0000-ff54-38f8360a0000 pid=2614->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=9b9cef80-1900-0000-ff54-38f83c0a0000 pid=2620->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=21b56d88-1900-0000-ff54-38f8510a0000 pid=2641 /usr/bin/bash guuid=34675988-1900-0000-ff54-38f8500a0000 pid=2640->guuid=21b56d88-1900-0000-ff54-38f8510a0000 pid=2641 clone guuid=5d7d1d89-1900-0000-ff54-38f8560a0000 pid=2646->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=0179f48b-1900-0000-ff54-38f85e0a0000 pid=2654->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=8ca6fe95-1900-0000-ff54-38f8740a0000 pid=2676 /usr/bin/bash guuid=6ce6b795-1900-0000-ff54-38f8730a0000 pid=2675->guuid=8ca6fe95-1900-0000-ff54-38f8740a0000 pid=2676 clone guuid=16bfde96-1900-0000-ff54-38f8770a0000 pid=2679->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=ecd47799-1900-0000-ff54-38f87a0a0000 pid=2682->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=56e6019f-1900-0000-ff54-38f8860a0000 pid=2694 /usr/bin/bash guuid=fd69d89e-1900-0000-ff54-38f8850a0000 pid=2693->guuid=56e6019f-1900-0000-ff54-38f8860a0000 pid=2694 clone guuid=e11dd59f-1900-0000-ff54-38f88b0a0000 pid=2699->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=2bef78a2-1900-0000-ff54-38f8910a0000 pid=2705->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=930a5da7-1900-0000-ff54-38f89d0a0000 pid=2717 /usr/bin/bash guuid=59674aa7-1900-0000-ff54-38f89c0a0000 pid=2716->guuid=930a5da7-1900-0000-ff54-38f89d0a0000 pid=2717 clone
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/ce99a1520f381fba7ca927bc9e214b6e34bebd54548c1c22543bc5b39660510d
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ce99a1520f381fba7ca927bc9e214b6e34bebd54548c1c22543bc5b39660510d/
Threat name:
Linux.Trojan.Malgent
Create hunting rule
Status:
Malicious
First seen:
2026-09-03 02:52:16 UTC
File Type:
Text (Shell)
AV detection:
13 of 24 (54.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=z2m2cuqphap3u7fje66j4iklny2l5pkuksgbyisuhpc3hftakegq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260903-dcty9aszfx/
Behaviour
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.11
Link:
https://yomi.yoroi.company/submissions/ce99a1520f381fba7ca927bc9e214b6e34bebd54548c1c22543bc5b39660510d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh ce99a1520f381fba7ca927bc9e214b6e34bebd54548c1c22543bc5b39660510d

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3897671/
  
Delivery method
Distributed via web download

Comments