🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d10340985d49d95b4ad19f1d98b01ce9e9d31e0b348caa88ae77aca04f522153. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d10340985d49d95b4ad19f1d98b01ce9e9d31e0b348caa88ae77aca04f522153
SHA3-384 hash: f408a2ba3cbd4287a34dbed381f39de2a6b2312f891ed07f427b15bc3d7b5e3dc00501809de4b7021e6d77fee2ef9838
SHA1 hash: 7fdb5aad72eaf8854960827a630474c8f22df226
MD5 hash: cddace86dbc1ef4de9bd053f480b1c8e
humanhash: nineteen-shade-quebec-robert
File name:ok
Download: download sample
File size:1'608 bytes
First seen:2026-08-26 01:10:24 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 12:UNlr6N0war6CJvowj6uoDNBb6BOGBV6BJcqSiDA6JINi6lQHLFSjB6FSjRzDFtHx:4vjSTMOE6JHSXBQHs9xjyhcXAC
TLSH T1E631B29A12256A721452CF5E73A3350D728EE1FB284FD7D19C580EA98A886CCF291B0D
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://5.182.210.174/9918ben/an/an/a
http://5.182.210.174/28938an/an/an/a
http://5.182.210.174/457d73n/an/an/a
http://5.182.210.174/502445n/an/an/a
http://5.182.210.174/5087dfn/an/an/a
http://5.182.210.174/7b953cn/an/an/a
http://5.182.210.174/eca5b5n/an/an/a
http://5.182.210.174/179754n/an/an/a
http://5.182.210.174/19dcd3n/an/an/a
http://5.182.210.174/4530e1n/an/an/a
http://5.182.210.174/4e885en/an/an/a
http://5.182.210.174/014259n/an/an/a

Intelligence

File Origin
# of uploads :
1
# of downloads :
43
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive mirai
Link:
https://www.filescan.io/uploads/6a8e3d059b4a96890d5b0972/reports/bdac20da-8a90-4c55-b45b-858e4a7c1a6f/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-08-25T23:21:00Z UTC
Last seen:
2026-08-27T18:07:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/d10340985d49d95b4ad19f1d98b01ce9e9d31e0b348caa88ae77aca04f522153/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/976d39b0-e5ff-4c82-9d5d-05fc3bb390eb
Behavior Graph:
Download SVG
%3 guuid=38f4c12b-1700-0000-d994-cdf4410e0000 pid=3649 /usr/bin/sudo guuid=03e2952d-1700-0000-d994-cdf44a0e0000 pid=3658 /tmp/sample.bin guuid=38f4c12b-1700-0000-d994-cdf4410e0000 pid=3649->guuid=03e2952d-1700-0000-d994-cdf44a0e0000 pid=3658 execve guuid=38b4ef2d-1700-0000-d994-cdf44d0e0000 pid=3661 /usr/bin/wget net send-data guuid=03e2952d-1700-0000-d994-cdf44a0e0000 pid=3658->guuid=38b4ef2d-1700-0000-d994-cdf44d0e0000 pid=3661 execve guuid=1db86c31-1700-0000-d994-cdf4610e0000 pid=3681 /usr/bin/curl net send-data write-file guuid=03e2952d-1700-0000-d994-cdf44a0e0000 pid=3658->guuid=1db86c31-1700-0000-d994-cdf4610e0000 pid=3681 execve guuid=98e57f3b-1700-0000-d994-cdf4870e0000 pid=3719 /usr/bin/chmod guuid=03e2952d-1700-0000-d994-cdf44a0e0000 pid=3658->guuid=98e57f3b-1700-0000-d994-cdf4870e0000 pid=3719 execve guuid=64ecc43b-1700-0000-d994-cdf48b0e0000 pid=3723 /usr/bin/bash guuid=03e2952d-1700-0000-d994-cdf44a0e0000 pid=3658->guuid=64ecc43b-1700-0000-d994-cdf48b0e0000 pid=3723 clone guuid=6784033c-1700-0000-d994-cdf48d0e0000 pid=3725 /usr/bin/rm delete-file guuid=03e2952d-1700-0000-d994-cdf44a0e0000 pid=3658->guuid=6784033c-1700-0000-d994-cdf48d0e0000 pid=3725 execve guuid=2fcc7d3c-1700-0000-d994-cdf48e0e0000 pid=3726 /usr/bin/rm guuid=03e2952d-1700-0000-d994-cdf44a0e0000 pid=3658->guuid=2fcc7d3c-1700-0000-d994-cdf48e0e0000 pid=3726 execve guuid=8855d03c-1700-0000-d994-cdf4910e0000 pid=3729 /usr/bin/wget net send-data guuid=03e2952d-1700-0000-d994-cdf44a0e0000 pid=3658->guuid=8855d03c-1700-0000-d994-cdf4910e0000 pid=3729 execve guuid=d373523f-1700-0000-d994-cdf49b0e0000 pid=3739 /usr/bin/curl net send-data write-file guuid=03e2952d-1700-0000-d994-cdf44a0e0000 pid=3658->guuid=d373523f-1700-0000-d994-cdf49b0e0000 pid=3739 execve guuid=e54d4643-1700-0000-d994-cdf4aa0e0000 pid=3754 /usr/bin/chmod guuid=03e2952d-1700-0000-d994-cdf44a0e0000 pid=3658->guuid=e54d4643-1700-0000-d994-cdf4aa0e0000 pid=3754 execve guuid=1ec8a243-1700-0000-d994-cdf4ab0e0000 pid=3755 /usr/bin/bash guuid=03e2952d-1700-0000-d994-cdf44a0e0000 pid=3658->guuid=1ec8a243-1700-0000-d994-cdf4ab0e0000 pid=3755 clone guuid=ac2ae943-1700-0000-d994-cdf4b00e0000 pid=3760 /usr/bin/rm delete-file guuid=03e2952d-1700-0000-d994-cdf44a0e0000 pid=3658->guuid=ac2ae943-1700-0000-d994-cdf4b00e0000 pid=3760 execve guuid=22b24c44-1700-0000-d994-cdf4b10e0000 pid=3761 /usr/bin/rm guuid=03e2952d-1700-0000-d994-cdf44a0e0000 pid=3658->guuid=22b24c44-1700-0000-d994-cdf4b10e0000 pid=3761 execve guuid=a8428e44-1700-0000-d994-cdf4b30e0000 pid=3763 /usr/bin/wget net send-data guuid=03e2952d-1700-0000-d994-cdf44a0e0000 pid=3658->guuid=a8428e44-1700-0000-d994-cdf4b30e0000 pid=3763 execve guuid=c51e2d47-1700-0000-d994-cdf4c00e0000 pid=3776 /usr/bin/curl net send-data write-file guuid=03e2952d-1700-0000-d994-cdf44a0e0000 pid=3658->guuid=c51e2d47-1700-0000-d994-cdf4c00e0000 pid=3776 execve guuid=2789c64d-1700-0000-d994-cdf4d80e0000 pid=3800 /usr/bin/chmod guuid=03e2952d-1700-0000-d994-cdf44a0e0000 pid=3658->guuid=2789c64d-1700-0000-d994-cdf4d80e0000 pid=3800 execve guuid=d5ae264e-1700-0000-d994-cdf4d90e0000 pid=3801 /usr/bin/bash guuid=03e2952d-1700-0000-d994-cdf44a0e0000 pid=3658->guuid=d5ae264e-1700-0000-d994-cdf4d90e0000 pid=3801 clone guuid=f3e9744e-1700-0000-d994-cdf4dc0e0000 pid=3804 /usr/bin/rm delete-file guuid=03e2952d-1700-0000-d994-cdf44a0e0000 pid=3658->guuid=f3e9744e-1700-0000-d994-cdf4dc0e0000 pid=3804 execve guuid=cc05fc4e-1700-0000-d994-cdf4df0e0000 pid=3807 /usr/bin/rm guuid=03e2952d-1700-0000-d994-cdf44a0e0000 pid=3658->guuid=cc05fc4e-1700-0000-d994-cdf4df0e0000 pid=3807 execve guuid=966f684f-1700-0000-d994-cdf4e10e0000 pid=3809 /usr/bin/wget net send-data guuid=03e2952d-1700-0000-d994-cdf44a0e0000 pid=3658->guuid=966f684f-1700-0000-d994-cdf4e10e0000 pid=3809 execve guuid=82b4d952-1700-0000-d994-cdf4ed0e0000 pid=3821 /usr/bin/curl net send-data write-file guuid=03e2952d-1700-0000-d994-cdf44a0e0000 pid=3658->guuid=82b4d952-1700-0000-d994-cdf4ed0e0000 pid=3821 execve guuid=a0f94a58-1700-0000-d994-cdf4040f0000 pid=3844 /usr/bin/chmod guuid=03e2952d-1700-0000-d994-cdf44a0e0000 pid=3658->guuid=a0f94a58-1700-0000-d994-cdf4040f0000 pid=3844 execve guuid=bbc3d558-1700-0000-d994-cdf4070f0000 pid=3847 /usr/bin/bash guuid=03e2952d-1700-0000-d994-cdf44a0e0000 pid=3658->guuid=bbc3d558-1700-0000-d994-cdf4070f0000 pid=3847 clone guuid=167c2259-1700-0000-d994-cdf40a0f0000 pid=3850 /usr/bin/rm delete-file guuid=03e2952d-1700-0000-d994-cdf44a0e0000 pid=3658->guuid=167c2259-1700-0000-d994-cdf40a0f0000 pid=3850 execve guuid=9a5e9259-1700-0000-d994-cdf40b0f0000 pid=3851 /usr/bin/rm guuid=03e2952d-1700-0000-d994-cdf44a0e0000 pid=3658->guuid=9a5e9259-1700-0000-d994-cdf40b0f0000 pid=3851 execve guuid=43ce055a-1700-0000-d994-cdf40f0f0000 pid=3855 /usr/bin/wget net send-data guuid=03e2952d-1700-0000-d994-cdf44a0e0000 pid=3658->guuid=43ce055a-1700-0000-d994-cdf40f0f0000 pid=3855 execve guuid=e222335d-1700-0000-d994-cdf4190f0000 pid=3865 /usr/bin/curl net send-data write-file guuid=03e2952d-1700-0000-d994-cdf44a0e0000 pid=3658->guuid=e222335d-1700-0000-d994-cdf4190f0000 pid=3865 execve guuid=fb341964-1700-0000-d994-cdf42e0f0000 pid=3886 /usr/bin/chmod guuid=03e2952d-1700-0000-d994-cdf44a0e0000 pid=3658->guuid=fb341964-1700-0000-d994-cdf42e0f0000 pid=3886 execve guuid=18877c64-1700-0000-d994-cdf42f0f0000 pid=3887 /usr/bin/bash guuid=03e2952d-1700-0000-d994-cdf44a0e0000 pid=3658->guuid=18877c64-1700-0000-d994-cdf42f0f0000 pid=3887 clone guuid=63dfe264-1700-0000-d994-cdf4320f0000 pid=3890 /usr/bin/rm delete-file guuid=03e2952d-1700-0000-d994-cdf44a0e0000 pid=3658->guuid=63dfe264-1700-0000-d994-cdf4320f0000 pid=3890 execve guuid=4dbf4565-1700-0000-d994-cdf4340f0000 pid=3892 /usr/bin/rm guuid=03e2952d-1700-0000-d994-cdf44a0e0000 pid=3658->guuid=4dbf4565-1700-0000-d994-cdf4340f0000 pid=3892 execve guuid=98d19f65-1700-0000-d994-cdf4350f0000 pid=3893 /usr/bin/wget net send-data guuid=03e2952d-1700-0000-d994-cdf44a0e0000 pid=3658->guuid=98d19f65-1700-0000-d994-cdf4350f0000 pid=3893 execve guuid=c030eb68-1700-0000-d994-cdf43f0f0000 pid=3903 /usr/bin/curl net send-data write-file guuid=03e2952d-1700-0000-d994-cdf44a0e0000 pid=3658->guuid=c030eb68-1700-0000-d994-cdf43f0f0000 pid=3903 execve guuid=389a5e6e-1700-0000-d994-cdf4580f0000 pid=3928 /usr/bin/chmod guuid=03e2952d-1700-0000-d994-cdf44a0e0000 pid=3658->guuid=389a5e6e-1700-0000-d994-cdf4580f0000 pid=3928 execve guuid=98a92e70-1700-0000-d994-cdf45d0f0000 pid=3933 /usr/bin/bash guuid=03e2952d-1700-0000-d994-cdf44a0e0000 pid=3658->guuid=98a92e70-1700-0000-d994-cdf45d0f0000 pid=3933 clone guuid=f0e9d371-1700-0000-d994-cdf4640f0000 pid=3940 /usr/bin/rm delete-file guuid=03e2952d-1700-0000-d994-cdf44a0e0000 pid=3658->guuid=f0e9d371-1700-0000-d994-cdf4640f0000 pid=3940 execve guuid=d8f11072-1700-0000-d994-cdf4680f0000 pid=3944 /usr/bin/rm guuid=03e2952d-1700-0000-d994-cdf44a0e0000 pid=3658->guuid=d8f11072-1700-0000-d994-cdf4680f0000 pid=3944 execve guuid=21604e72-1700-0000-d994-cdf46a0f0000 pid=3946 /usr/bin/wget net send-data guuid=03e2952d-1700-0000-d994-cdf44a0e0000 pid=3658->guuid=21604e72-1700-0000-d994-cdf46a0f0000 pid=3946 execve guuid=5223ca74-1700-0000-d994-cdf4780f0000 pid=3960 /usr/bin/curl net send-data write-file guuid=03e2952d-1700-0000-d994-cdf44a0e0000 pid=3658->guuid=5223ca74-1700-0000-d994-cdf4780f0000 pid=3960 execve guuid=c88c8a78-1700-0000-d994-cdf4880f0000 pid=3976 /usr/bin/chmod guuid=03e2952d-1700-0000-d994-cdf44a0e0000 pid=3658->guuid=c88c8a78-1700-0000-d994-cdf4880f0000 pid=3976 execve guuid=db3be378-1700-0000-d994-cdf48b0f0000 pid=3979 /usr/bin/bash guuid=03e2952d-1700-0000-d994-cdf44a0e0000 pid=3658->guuid=db3be378-1700-0000-d994-cdf48b0f0000 pid=3979 clone guuid=e5282379-1700-0000-d994-cdf48e0f0000 pid=3982 /usr/bin/rm delete-file guuid=03e2952d-1700-0000-d994-cdf44a0e0000 pid=3658->guuid=e5282379-1700-0000-d994-cdf48e0f0000 pid=3982 execve guuid=751f6079-1700-0000-d994-cdf4900f0000 pid=3984 /usr/bin/rm guuid=03e2952d-1700-0000-d994-cdf44a0e0000 pid=3658->guuid=751f6079-1700-0000-d994-cdf4900f0000 pid=3984 execve guuid=9eb1a379-1700-0000-d994-cdf4920f0000 pid=3986 /usr/bin/wget net send-data guuid=03e2952d-1700-0000-d994-cdf44a0e0000 pid=3658->guuid=9eb1a379-1700-0000-d994-cdf4920f0000 pid=3986 execve guuid=e83b237c-1700-0000-d994-cdf4990f0000 pid=3993 /usr/bin/curl net send-data write-file guuid=03e2952d-1700-0000-d994-cdf44a0e0000 pid=3658->guuid=e83b237c-1700-0000-d994-cdf4990f0000 pid=3993 execve guuid=d5066480-1700-0000-d994-cdf4a70f0000 pid=4007 /usr/bin/chmod guuid=03e2952d-1700-0000-d994-cdf44a0e0000 pid=3658->guuid=d5066480-1700-0000-d994-cdf4a70f0000 pid=4007 execve guuid=141b9f80-1700-0000-d994-cdf4a90f0000 pid=4009 /usr/bin/bash guuid=03e2952d-1700-0000-d994-cdf44a0e0000 pid=3658->guuid=141b9f80-1700-0000-d994-cdf4a90f0000 pid=4009 clone guuid=8b61d180-1700-0000-d994-cdf4ab0f0000 pid=4011 /usr/bin/rm delete-file guuid=03e2952d-1700-0000-d994-cdf44a0e0000 pid=3658->guuid=8b61d180-1700-0000-d994-cdf4ab0f0000 pid=4011 execve guuid=6df20d81-1700-0000-d994-cdf4ae0f0000 pid=4014 /usr/bin/rm guuid=03e2952d-1700-0000-d994-cdf44a0e0000 pid=3658->guuid=6df20d81-1700-0000-d994-cdf4ae0f0000 pid=4014 execve guuid=2c584681-1700-0000-d994-cdf4b00f0000 pid=4016 /usr/bin/wget net send-data guuid=03e2952d-1700-0000-d994-cdf44a0e0000 pid=3658->guuid=2c584681-1700-0000-d994-cdf4b00f0000 pid=4016 execve guuid=8656cb83-1700-0000-d994-cdf4b70f0000 pid=4023 /usr/bin/curl net send-data write-file guuid=03e2952d-1700-0000-d994-cdf44a0e0000 pid=3658->guuid=8656cb83-1700-0000-d994-cdf4b70f0000 pid=4023 execve guuid=8fff6e8b-1700-0000-d994-cdf4cb0f0000 pid=4043 /usr/bin/chmod guuid=03e2952d-1700-0000-d994-cdf44a0e0000 pid=3658->guuid=8fff6e8b-1700-0000-d994-cdf4cb0f0000 pid=4043 execve guuid=f718ae8b-1700-0000-d994-cdf4cd0f0000 pid=4045 /usr/bin/bash guuid=03e2952d-1700-0000-d994-cdf44a0e0000 pid=3658->guuid=f718ae8b-1700-0000-d994-cdf4cd0f0000 pid=4045 clone guuid=952edb8b-1700-0000-d994-cdf4d10f0000 pid=4049 /usr/bin/rm delete-file guuid=03e2952d-1700-0000-d994-cdf44a0e0000 pid=3658->guuid=952edb8b-1700-0000-d994-cdf4d10f0000 pid=4049 execve guuid=6a33118c-1700-0000-d994-cdf4d20f0000 pid=4050 /usr/bin/rm guuid=03e2952d-1700-0000-d994-cdf44a0e0000 pid=3658->guuid=6a33118c-1700-0000-d994-cdf4d20f0000 pid=4050 execve guuid=2dd1468c-1700-0000-d994-cdf4d30f0000 pid=4051 /usr/bin/wget net send-data guuid=03e2952d-1700-0000-d994-cdf44a0e0000 pid=3658->guuid=2dd1468c-1700-0000-d994-cdf4d30f0000 pid=4051 execve guuid=9337b18e-1700-0000-d994-cdf4e10f0000 pid=4065 /usr/bin/curl net send-data write-file guuid=03e2952d-1700-0000-d994-cdf44a0e0000 pid=3658->guuid=9337b18e-1700-0000-d994-cdf4e10f0000 pid=4065 execve guuid=c0c77293-1700-0000-d994-cdf4fa0f0000 pid=4090 /usr/bin/chmod guuid=03e2952d-1700-0000-d994-cdf44a0e0000 pid=3658->guuid=c0c77293-1700-0000-d994-cdf4fa0f0000 pid=4090 execve guuid=f112aa93-1700-0000-d994-cdf4fb0f0000 pid=4091 /usr/bin/bash guuid=03e2952d-1700-0000-d994-cdf44a0e0000 pid=3658->guuid=f112aa93-1700-0000-d994-cdf4fb0f0000 pid=4091 clone guuid=62e8d793-1700-0000-d994-cdf4ff0f0000 pid=4095 /usr/bin/rm delete-file guuid=03e2952d-1700-0000-d994-cdf44a0e0000 pid=3658->guuid=62e8d793-1700-0000-d994-cdf4ff0f0000 pid=4095 execve guuid=89d10f94-1700-0000-d994-cdf400100000 pid=4096 /usr/bin/rm guuid=03e2952d-1700-0000-d994-cdf44a0e0000 pid=3658->guuid=89d10f94-1700-0000-d994-cdf400100000 pid=4096 execve guuid=d1874394-1700-0000-d994-cdf402100000 pid=4098 /usr/bin/wget net send-data guuid=03e2952d-1700-0000-d994-cdf44a0e0000 pid=3658->guuid=d1874394-1700-0000-d994-cdf402100000 pid=4098 execve guuid=e58f2d97-1700-0000-d994-cdf409100000 pid=4105 /usr/bin/curl net send-data write-file guuid=03e2952d-1700-0000-d994-cdf44a0e0000 pid=3658->guuid=e58f2d97-1700-0000-d994-cdf409100000 pid=4105 execve guuid=e3c7119d-1700-0000-d994-cdf410100000 pid=4112 /usr/bin/chmod guuid=03e2952d-1700-0000-d994-cdf44a0e0000 pid=3658->guuid=e3c7119d-1700-0000-d994-cdf410100000 pid=4112 execve guuid=fb12579d-1700-0000-d994-cdf414100000 pid=4116 /usr/bin/bash guuid=03e2952d-1700-0000-d994-cdf44a0e0000 pid=3658->guuid=fb12579d-1700-0000-d994-cdf414100000 pid=4116 clone guuid=6cb71c9e-1700-0000-d994-cdf416100000 pid=4118 /usr/bin/rm delete-file guuid=03e2952d-1700-0000-d994-cdf44a0e0000 pid=3658->guuid=6cb71c9e-1700-0000-d994-cdf416100000 pid=4118 execve guuid=c503739e-1700-0000-d994-cdf41a100000 pid=4122 /usr/bin/rm guuid=03e2952d-1700-0000-d994-cdf44a0e0000 pid=3658->guuid=c503739e-1700-0000-d994-cdf41a100000 pid=4122 execve guuid=d029f79e-1700-0000-d994-cdf41e100000 pid=4126 /usr/bin/wget net send-data guuid=03e2952d-1700-0000-d994-cdf44a0e0000 pid=3658->guuid=d029f79e-1700-0000-d994-cdf41e100000 pid=4126 execve guuid=712d76a2-1700-0000-d994-cdf42e100000 pid=4142 /usr/bin/curl net send-data write-file guuid=03e2952d-1700-0000-d994-cdf44a0e0000 pid=3658->guuid=712d76a2-1700-0000-d994-cdf42e100000 pid=4142 execve guuid=1d9939a7-1700-0000-d994-cdf447100000 pid=4167 /usr/bin/chmod guuid=03e2952d-1700-0000-d994-cdf44a0e0000 pid=3658->guuid=1d9939a7-1700-0000-d994-cdf447100000 pid=4167 execve guuid=fca79da7-1700-0000-d994-cdf449100000 pid=4169 /usr/bin/bash guuid=03e2952d-1700-0000-d994-cdf44a0e0000 pid=3658->guuid=fca79da7-1700-0000-d994-cdf449100000 pid=4169 clone guuid=69b0f5a7-1700-0000-d994-cdf44d100000 pid=4173 /usr/bin/rm delete-file guuid=03e2952d-1700-0000-d994-cdf44a0e0000 pid=3658->guuid=69b0f5a7-1700-0000-d994-cdf44d100000 pid=4173 execve guuid=a91135a8-1700-0000-d994-cdf44f100000 pid=4175 /usr/bin/rm guuid=03e2952d-1700-0000-d994-cdf44a0e0000 pid=3658->guuid=a91135a8-1700-0000-d994-cdf44f100000 pid=4175 execve 5b654972-c9e1-50d8-b372-2dc2a5b9ad66 5.182.210.174:80 guuid=38b4ef2d-1700-0000-d994-cdf44d0e0000 pid=3661->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=1db86c31-1700-0000-d994-cdf4610e0000 pid=3681->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=6090dc3b-1700-0000-d994-cdf48c0e0000 pid=3724 /usr/bin/bash guuid=64ecc43b-1700-0000-d994-cdf48b0e0000 pid=3723->guuid=6090dc3b-1700-0000-d994-cdf48c0e0000 pid=3724 clone guuid=8855d03c-1700-0000-d994-cdf4910e0000 pid=3729->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=d373523f-1700-0000-d994-cdf49b0e0000 pid=3739->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=4278c143-1700-0000-d994-cdf4ad0e0000 pid=3757 /usr/bin/bash guuid=1ec8a243-1700-0000-d994-cdf4ab0e0000 pid=3755->guuid=4278c143-1700-0000-d994-cdf4ad0e0000 pid=3757 clone guuid=a8428e44-1700-0000-d994-cdf4b30e0000 pid=3763->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=c51e2d47-1700-0000-d994-cdf4c00e0000 pid=3776->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=7d864c4e-1700-0000-d994-cdf4da0e0000 pid=3802 /usr/bin/bash guuid=d5ae264e-1700-0000-d994-cdf4d90e0000 pid=3801->guuid=7d864c4e-1700-0000-d994-cdf4da0e0000 pid=3802 clone guuid=966f684f-1700-0000-d994-cdf4e10e0000 pid=3809->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=82b4d952-1700-0000-d994-cdf4ed0e0000 pid=3821->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=4b82fa58-1700-0000-d994-cdf4080f0000 pid=3848 /usr/bin/bash guuid=bbc3d558-1700-0000-d994-cdf4070f0000 pid=3847->guuid=4b82fa58-1700-0000-d994-cdf4080f0000 pid=3848 clone guuid=43ce055a-1700-0000-d994-cdf40f0f0000 pid=3855->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=e222335d-1700-0000-d994-cdf4190f0000 pid=3865->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=468ea664-1700-0000-d994-cdf4310f0000 pid=3889 /usr/bin/bash guuid=18877c64-1700-0000-d994-cdf42f0f0000 pid=3887->guuid=468ea664-1700-0000-d994-cdf4310f0000 pid=3889 clone guuid=98d19f65-1700-0000-d994-cdf4350f0000 pid=3893->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=c030eb68-1700-0000-d994-cdf43f0f0000 pid=3903->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=1ec1f670-1700-0000-d994-cdf4600f0000 pid=3936 /usr/bin/bash guuid=98a92e70-1700-0000-d994-cdf45d0f0000 pid=3933->guuid=1ec1f670-1700-0000-d994-cdf4600f0000 pid=3936 clone guuid=21604e72-1700-0000-d994-cdf46a0f0000 pid=3946->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=5223ca74-1700-0000-d994-cdf4780f0000 pid=3960->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=5e4ff578-1700-0000-d994-cdf48d0f0000 pid=3981 /usr/bin/bash guuid=db3be378-1700-0000-d994-cdf48b0f0000 pid=3979->guuid=5e4ff578-1700-0000-d994-cdf48d0f0000 pid=3981 clone guuid=9eb1a379-1700-0000-d994-cdf4920f0000 pid=3986->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=e83b237c-1700-0000-d994-cdf4990f0000 pid=3993->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=077fb380-1700-0000-d994-cdf4aa0f0000 pid=4010 /usr/bin/bash guuid=141b9f80-1700-0000-d994-cdf4a90f0000 pid=4009->guuid=077fb380-1700-0000-d994-cdf4aa0f0000 pid=4010 clone guuid=2c584681-1700-0000-d994-cdf4b00f0000 pid=4016->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=8656cb83-1700-0000-d994-cdf4b70f0000 pid=4023->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=29ccc28b-1700-0000-d994-cdf4d00f0000 pid=4048 /usr/bin/bash guuid=f718ae8b-1700-0000-d994-cdf4cd0f0000 pid=4045->guuid=29ccc28b-1700-0000-d994-cdf4d00f0000 pid=4048 clone guuid=2dd1468c-1700-0000-d994-cdf4d30f0000 pid=4051->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=9337b18e-1700-0000-d994-cdf4e10f0000 pid=4065->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=1fc7bc93-1700-0000-d994-cdf4fe0f0000 pid=4094 /usr/bin/bash guuid=f112aa93-1700-0000-d994-cdf4fb0f0000 pid=4091->guuid=1fc7bc93-1700-0000-d994-cdf4fe0f0000 pid=4094 clone guuid=d1874394-1700-0000-d994-cdf402100000 pid=4098->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=e58f2d97-1700-0000-d994-cdf409100000 pid=4105->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=1983a79d-1700-0000-d994-cdf415100000 pid=4117 /usr/bin/bash guuid=fb12579d-1700-0000-d994-cdf414100000 pid=4116->guuid=1983a79d-1700-0000-d994-cdf415100000 pid=4117 clone guuid=d029f79e-1700-0000-d994-cdf41e100000 pid=4126->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=712d76a2-1700-0000-d994-cdf42e100000 pid=4142->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=5910c1a7-1700-0000-d994-cdf44b100000 pid=4171 /usr/bin/bash guuid=fca79da7-1700-0000-d994-cdf449100000 pid=4169->guuid=5910c1a7-1700-0000-d994-cdf44b100000 pid=4171 clone
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/d10340985d49d95b4ad19f1d98b01ce9e9d31e0b348caa88ae77aca04f522153
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d10340985d49d95b4ad19f1d98b01ce9e9d31e0b348caa88ae77aca04f522153/
Threat name:
Linux.Trojan.Multiverze
Create hunting rule
Status:
Malicious
First seen:
2026-08-26 01:11:22 UTC
File Type:
Text (Shell)
AV detection:
13 of 24 (54.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2ebubgc5jhmvwswrt4ozrma45hu5ghqlgsgkvcfoo6wkat2sefjq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260826-bjkytaxxgy/
Behaviour
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.11
Link:
https://yomi.yoroi.company/submissions/d10340985d49d95b4ad19f1d98b01ce9e9d31e0b348caa88ae77aca04f522153

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh d10340985d49d95b4ad19f1d98b01ce9e9d31e0b348caa88ae77aca04f522153

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3897671/
  
Delivery method
Distributed via web download

Comments