MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d2035337fdfac27bb8dd6678f959c6ff88e404a8c19acab48424d20b449915a7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d2035337fdfac27bb8dd6678f959c6ff88e404a8c19acab48424d20b449915a7
SHA3-384 hash: 1779f760f05057732622e3e3cf9065ff1a12653629b4c6e22c7b04c4332a21b94488905ea7f7a961f238e39c430ca951
SHA1 hash: f641b713245b5cf6841ae3e239c7bb55044f5f8d
MD5 hash: 177d5c605dd7c0e2acbf71f41b20b32d
humanhash: asparagus-twelve-uncle-black
File name:ok
Download: download sample
File size:1'608 bytes
First seen:2026-08-14 14:56:33 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 12:UC6/ZV6EL6Ej9aG/Vx6VchMDwCC6aNd6NCdwk6sKqN6QUNn76Jt60Ofai6aaplLx:yvj9RtmMMDwDdpC40aplgTK
TLSH T16B3182DF11141A316106CD5E72A3310DB18DA9FB3C8FCBE49D580EB98A887CCF291B4A
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://5.182.210.174/00df69n/an/an/a
http://5.182.210.174/4b26b9n/an/an/a
http://5.182.210.174/a1d493n/an/an/a
http://5.182.210.174/7836d7n/an/an/a
http://5.182.210.174/9846b5n/an/an/a
http://5.182.210.174/8e5a00n/an/an/a
http://5.182.210.174/c6503en/an/an/a
http://5.182.210.174/47b560n/an/an/a
http://5.182.210.174/c9023cn/an/an/a
http://5.182.210.174/6b8b4dn/an/an/a
http://5.182.210.174/46c7b2n/an/an/a
http://5.182.210.174/796fc4n/an/an/a

Intelligence

File Origin
# of uploads :
1
# of downloads :
82
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive
Link:
https://www.filescan.io/uploads/6a7f2ce043d6640e4d41a5a3/reports/f5b2b770-b396-42ca-a992-167a8f592dfc/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-08-14T12:12:00Z UTC
Last seen:
2026-08-14T23:45:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/d2035337fdfac27bb8dd6678f959c6ff88e404a8c19acab48424d20b449915a7/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/de78d382-65cf-4f09-b051-306a4bf92aa4
Behavior Graph:
Download SVG
%3 guuid=b188e8e6-1600-0000-a019-dbf1150c0000 pid=3093 /usr/bin/sudo guuid=64922fea-1600-0000-a019-dbf1160c0000 pid=3094 /tmp/sample.bin guuid=b188e8e6-1600-0000-a019-dbf1150c0000 pid=3093->guuid=64922fea-1600-0000-a019-dbf1160c0000 pid=3094 execve guuid=764c48eb-1600-0000-a019-dbf1170c0000 pid=3095 /usr/bin/wget net send-data guuid=64922fea-1600-0000-a019-dbf1160c0000 pid=3094->guuid=764c48eb-1600-0000-a019-dbf1170c0000 pid=3095 execve guuid=59c485f1-1600-0000-a019-dbf1180c0000 pid=3096 /usr/bin/curl net send-data write-file guuid=64922fea-1600-0000-a019-dbf1160c0000 pid=3094->guuid=59c485f1-1600-0000-a019-dbf1180c0000 pid=3096 execve guuid=f506e8f9-1600-0000-a019-dbf1200c0000 pid=3104 /usr/bin/chmod guuid=64922fea-1600-0000-a019-dbf1160c0000 pid=3094->guuid=f506e8f9-1600-0000-a019-dbf1200c0000 pid=3104 execve guuid=6d983ffa-1600-0000-a019-dbf1210c0000 pid=3105 /usr/bin/bash guuid=64922fea-1600-0000-a019-dbf1160c0000 pid=3094->guuid=6d983ffa-1600-0000-a019-dbf1210c0000 pid=3105 clone guuid=338b8cfa-1600-0000-a019-dbf1240c0000 pid=3108 /usr/bin/rm delete-file guuid=64922fea-1600-0000-a019-dbf1160c0000 pid=3094->guuid=338b8cfa-1600-0000-a019-dbf1240c0000 pid=3108 execve guuid=2e7cdefa-1600-0000-a019-dbf1250c0000 pid=3109 /usr/bin/rm guuid=64922fea-1600-0000-a019-dbf1160c0000 pid=3094->guuid=2e7cdefa-1600-0000-a019-dbf1250c0000 pid=3109 execve guuid=584256fb-1600-0000-a019-dbf1260c0000 pid=3110 /usr/bin/wget net send-data guuid=64922fea-1600-0000-a019-dbf1160c0000 pid=3094->guuid=584256fb-1600-0000-a019-dbf1260c0000 pid=3110 execve guuid=ce3505fe-1600-0000-a019-dbf12d0c0000 pid=3117 /usr/bin/curl net send-data write-file guuid=64922fea-1600-0000-a019-dbf1160c0000 pid=3094->guuid=ce3505fe-1600-0000-a019-dbf12d0c0000 pid=3117 execve guuid=12766704-1700-0000-a019-dbf1360c0000 pid=3126 /usr/bin/chmod guuid=64922fea-1600-0000-a019-dbf1160c0000 pid=3094->guuid=12766704-1700-0000-a019-dbf1360c0000 pid=3126 execve guuid=d200c504-1700-0000-a019-dbf1370c0000 pid=3127 /usr/bin/bash guuid=64922fea-1600-0000-a019-dbf1160c0000 pid=3094->guuid=d200c504-1700-0000-a019-dbf1370c0000 pid=3127 clone guuid=8b6c1b05-1700-0000-a019-dbf13a0c0000 pid=3130 /usr/bin/rm delete-file guuid=64922fea-1600-0000-a019-dbf1160c0000 pid=3094->guuid=8b6c1b05-1700-0000-a019-dbf13a0c0000 pid=3130 execve guuid=ef2f6e05-1700-0000-a019-dbf13c0c0000 pid=3132 /usr/bin/rm guuid=64922fea-1600-0000-a019-dbf1160c0000 pid=3094->guuid=ef2f6e05-1700-0000-a019-dbf13c0c0000 pid=3132 execve guuid=ccc5be05-1700-0000-a019-dbf13e0c0000 pid=3134 /usr/bin/wget net send-data guuid=64922fea-1600-0000-a019-dbf1160c0000 pid=3094->guuid=ccc5be05-1700-0000-a019-dbf13e0c0000 pid=3134 execve guuid=4b46ae08-1700-0000-a019-dbf1460c0000 pid=3142 /usr/bin/curl net send-data write-file guuid=64922fea-1600-0000-a019-dbf1160c0000 pid=3094->guuid=4b46ae08-1700-0000-a019-dbf1460c0000 pid=3142 execve guuid=ec08b30d-1700-0000-a019-dbf1510c0000 pid=3153 /usr/bin/chmod guuid=64922fea-1600-0000-a019-dbf1160c0000 pid=3094->guuid=ec08b30d-1700-0000-a019-dbf1510c0000 pid=3153 execve guuid=33670a0e-1700-0000-a019-dbf1530c0000 pid=3155 /usr/bin/bash guuid=64922fea-1600-0000-a019-dbf1160c0000 pid=3094->guuid=33670a0e-1700-0000-a019-dbf1530c0000 pid=3155 clone guuid=de7f5a0e-1700-0000-a019-dbf1550c0000 pid=3157 /usr/bin/rm delete-file guuid=64922fea-1600-0000-a019-dbf1160c0000 pid=3094->guuid=de7f5a0e-1700-0000-a019-dbf1550c0000 pid=3157 execve guuid=59f9b50e-1700-0000-a019-dbf1570c0000 pid=3159 /usr/bin/rm guuid=64922fea-1600-0000-a019-dbf1160c0000 pid=3094->guuid=59f9b50e-1700-0000-a019-dbf1570c0000 pid=3159 execve guuid=fff5080f-1700-0000-a019-dbf1590c0000 pid=3161 /usr/bin/wget net send-data guuid=64922fea-1600-0000-a019-dbf1160c0000 pid=3094->guuid=fff5080f-1700-0000-a019-dbf1590c0000 pid=3161 execve guuid=63f5fe14-1700-0000-a019-dbf16a0c0000 pid=3178 /usr/bin/curl net send-data write-file guuid=64922fea-1600-0000-a019-dbf1160c0000 pid=3094->guuid=63f5fe14-1700-0000-a019-dbf16a0c0000 pid=3178 execve guuid=d0f5761a-1700-0000-a019-dbf17a0c0000 pid=3194 /usr/bin/chmod guuid=64922fea-1600-0000-a019-dbf1160c0000 pid=3094->guuid=d0f5761a-1700-0000-a019-dbf17a0c0000 pid=3194 execve guuid=f6ecaf1a-1700-0000-a019-dbf17c0c0000 pid=3196 /usr/bin/bash guuid=64922fea-1600-0000-a019-dbf1160c0000 pid=3094->guuid=f6ecaf1a-1700-0000-a019-dbf17c0c0000 pid=3196 clone guuid=6006df1a-1700-0000-a019-dbf17f0c0000 pid=3199 /usr/bin/rm delete-file guuid=64922fea-1600-0000-a019-dbf1160c0000 pid=3094->guuid=6006df1a-1700-0000-a019-dbf17f0c0000 pid=3199 execve guuid=6a5c171b-1700-0000-a019-dbf1810c0000 pid=3201 /usr/bin/rm guuid=64922fea-1600-0000-a019-dbf1160c0000 pid=3094->guuid=6a5c171b-1700-0000-a019-dbf1810c0000 pid=3201 execve guuid=c9314e1b-1700-0000-a019-dbf1820c0000 pid=3202 /usr/bin/wget net send-data guuid=64922fea-1600-0000-a019-dbf1160c0000 pid=3094->guuid=c9314e1b-1700-0000-a019-dbf1820c0000 pid=3202 execve guuid=6d0ec21d-1700-0000-a019-dbf18b0c0000 pid=3211 /usr/bin/curl net send-data write-file guuid=64922fea-1600-0000-a019-dbf1160c0000 pid=3094->guuid=6d0ec21d-1700-0000-a019-dbf18b0c0000 pid=3211 execve guuid=68d8fd20-1700-0000-a019-dbf1970c0000 pid=3223 /usr/bin/chmod guuid=64922fea-1600-0000-a019-dbf1160c0000 pid=3094->guuid=68d8fd20-1700-0000-a019-dbf1970c0000 pid=3223 execve guuid=a1f34021-1700-0000-a019-dbf1990c0000 pid=3225 /usr/bin/bash guuid=64922fea-1600-0000-a019-dbf1160c0000 pid=3094->guuid=a1f34021-1700-0000-a019-dbf1990c0000 pid=3225 clone guuid=6cb67e21-1700-0000-a019-dbf19b0c0000 pid=3227 /usr/bin/rm delete-file guuid=64922fea-1600-0000-a019-dbf1160c0000 pid=3094->guuid=6cb67e21-1700-0000-a019-dbf19b0c0000 pid=3227 execve guuid=e0cec921-1700-0000-a019-dbf19d0c0000 pid=3229 /usr/bin/rm guuid=64922fea-1600-0000-a019-dbf1160c0000 pid=3094->guuid=e0cec921-1700-0000-a019-dbf19d0c0000 pid=3229 execve guuid=c58d1822-1700-0000-a019-dbf19f0c0000 pid=3231 /usr/bin/wget net send-data guuid=64922fea-1600-0000-a019-dbf1160c0000 pid=3094->guuid=c58d1822-1700-0000-a019-dbf19f0c0000 pid=3231 execve guuid=676dce24-1700-0000-a019-dbf1a80c0000 pid=3240 /usr/bin/curl net send-data write-file guuid=64922fea-1600-0000-a019-dbf1160c0000 pid=3094->guuid=676dce24-1700-0000-a019-dbf1a80c0000 pid=3240 execve guuid=58157528-1700-0000-a019-dbf1b40c0000 pid=3252 /usr/bin/chmod guuid=64922fea-1600-0000-a019-dbf1160c0000 pid=3094->guuid=58157528-1700-0000-a019-dbf1b40c0000 pid=3252 execve guuid=4f16be28-1700-0000-a019-dbf1b60c0000 pid=3254 /usr/bin/bash guuid=64922fea-1600-0000-a019-dbf1160c0000 pid=3094->guuid=4f16be28-1700-0000-a019-dbf1b60c0000 pid=3254 clone guuid=23f4f428-1700-0000-a019-dbf1b90c0000 pid=3257 /usr/bin/rm delete-file guuid=64922fea-1600-0000-a019-dbf1160c0000 pid=3094->guuid=23f4f428-1700-0000-a019-dbf1b90c0000 pid=3257 execve guuid=94223f29-1700-0000-a019-dbf1bb0c0000 pid=3259 /usr/bin/rm guuid=64922fea-1600-0000-a019-dbf1160c0000 pid=3094->guuid=94223f29-1700-0000-a019-dbf1bb0c0000 pid=3259 execve guuid=32ee7f29-1700-0000-a019-dbf1bd0c0000 pid=3261 /usr/bin/wget net send-data guuid=64922fea-1600-0000-a019-dbf1160c0000 pid=3094->guuid=32ee7f29-1700-0000-a019-dbf1bd0c0000 pid=3261 execve guuid=79bef92b-1700-0000-a019-dbf1c40c0000 pid=3268 /usr/bin/curl net send-data write-file guuid=64922fea-1600-0000-a019-dbf1160c0000 pid=3094->guuid=79bef92b-1700-0000-a019-dbf1c40c0000 pid=3268 execve guuid=5638b930-1700-0000-a019-dbf1cd0c0000 pid=3277 /usr/bin/chmod guuid=64922fea-1600-0000-a019-dbf1160c0000 pid=3094->guuid=5638b930-1700-0000-a019-dbf1cd0c0000 pid=3277 execve guuid=d2dff930-1700-0000-a019-dbf1cf0c0000 pid=3279 /usr/bin/bash guuid=64922fea-1600-0000-a019-dbf1160c0000 pid=3094->guuid=d2dff930-1700-0000-a019-dbf1cf0c0000 pid=3279 clone guuid=81dc6d31-1700-0000-a019-dbf1d10c0000 pid=3281 /usr/bin/rm delete-file guuid=64922fea-1600-0000-a019-dbf1160c0000 pid=3094->guuid=81dc6d31-1700-0000-a019-dbf1d10c0000 pid=3281 execve guuid=f3f0cc31-1700-0000-a019-dbf1d30c0000 pid=3283 /usr/bin/rm guuid=64922fea-1600-0000-a019-dbf1160c0000 pid=3094->guuid=f3f0cc31-1700-0000-a019-dbf1d30c0000 pid=3283 execve guuid=ba493332-1700-0000-a019-dbf1d40c0000 pid=3284 /usr/bin/wget net send-data guuid=64922fea-1600-0000-a019-dbf1160c0000 pid=3094->guuid=ba493332-1700-0000-a019-dbf1d40c0000 pid=3284 execve guuid=d67b0f35-1700-0000-a019-dbf1de0c0000 pid=3294 /usr/bin/curl net send-data write-file guuid=64922fea-1600-0000-a019-dbf1160c0000 pid=3094->guuid=d67b0f35-1700-0000-a019-dbf1de0c0000 pid=3294 execve guuid=1e42fc38-1700-0000-a019-dbf1ea0c0000 pid=3306 /usr/bin/chmod guuid=64922fea-1600-0000-a019-dbf1160c0000 pid=3094->guuid=1e42fc38-1700-0000-a019-dbf1ea0c0000 pid=3306 execve guuid=13f15339-1700-0000-a019-dbf1ec0c0000 pid=3308 /usr/bin/bash guuid=64922fea-1600-0000-a019-dbf1160c0000 pid=3094->guuid=13f15339-1700-0000-a019-dbf1ec0c0000 pid=3308 clone guuid=b320f139-1700-0000-a019-dbf1f00c0000 pid=3312 /usr/bin/rm delete-file guuid=64922fea-1600-0000-a019-dbf1160c0000 pid=3094->guuid=b320f139-1700-0000-a019-dbf1f00c0000 pid=3312 execve guuid=7e79863a-1700-0000-a019-dbf1f30c0000 pid=3315 /usr/bin/rm guuid=64922fea-1600-0000-a019-dbf1160c0000 pid=3094->guuid=7e79863a-1700-0000-a019-dbf1f30c0000 pid=3315 execve guuid=53443b3b-1700-0000-a019-dbf1f60c0000 pid=3318 /usr/bin/wget net send-data guuid=64922fea-1600-0000-a019-dbf1160c0000 pid=3094->guuid=53443b3b-1700-0000-a019-dbf1f60c0000 pid=3318 execve guuid=2313ce3d-1700-0000-a019-dbf1000d0000 pid=3328 /usr/bin/curl net send-data write-file guuid=64922fea-1600-0000-a019-dbf1160c0000 pid=3094->guuid=2313ce3d-1700-0000-a019-dbf1000d0000 pid=3328 execve guuid=af514d41-1700-0000-a019-dbf10d0d0000 pid=3341 /usr/bin/chmod guuid=64922fea-1600-0000-a019-dbf1160c0000 pid=3094->guuid=af514d41-1700-0000-a019-dbf10d0d0000 pid=3341 execve guuid=4261c241-1700-0000-a019-dbf1100d0000 pid=3344 /usr/bin/bash guuid=64922fea-1600-0000-a019-dbf1160c0000 pid=3094->guuid=4261c241-1700-0000-a019-dbf1100d0000 pid=3344 clone guuid=ed781f42-1700-0000-a019-dbf1130d0000 pid=3347 /usr/bin/rm delete-file guuid=64922fea-1600-0000-a019-dbf1160c0000 pid=3094->guuid=ed781f42-1700-0000-a019-dbf1130d0000 pid=3347 execve guuid=49ce9d42-1700-0000-a019-dbf1160d0000 pid=3350 /usr/bin/rm guuid=64922fea-1600-0000-a019-dbf1160c0000 pid=3094->guuid=49ce9d42-1700-0000-a019-dbf1160d0000 pid=3350 execve guuid=dd0c0d43-1700-0000-a019-dbf1190d0000 pid=3353 /usr/bin/wget net send-data guuid=64922fea-1600-0000-a019-dbf1160c0000 pid=3094->guuid=dd0c0d43-1700-0000-a019-dbf1190d0000 pid=3353 execve guuid=98200b46-1700-0000-a019-dbf1260d0000 pid=3366 /usr/bin/curl net send-data write-file guuid=64922fea-1600-0000-a019-dbf1160c0000 pid=3094->guuid=98200b46-1700-0000-a019-dbf1260d0000 pid=3366 execve guuid=8ffdf74a-1700-0000-a019-dbf1380d0000 pid=3384 /usr/bin/chmod guuid=64922fea-1600-0000-a019-dbf1160c0000 pid=3094->guuid=8ffdf74a-1700-0000-a019-dbf1380d0000 pid=3384 execve guuid=d3093b4b-1700-0000-a019-dbf13a0d0000 pid=3386 /usr/bin/bash guuid=64922fea-1600-0000-a019-dbf1160c0000 pid=3094->guuid=d3093b4b-1700-0000-a019-dbf13a0d0000 pid=3386 clone guuid=e53a714b-1700-0000-a019-dbf13d0d0000 pid=3389 /usr/bin/rm delete-file guuid=64922fea-1600-0000-a019-dbf1160c0000 pid=3094->guuid=e53a714b-1700-0000-a019-dbf13d0d0000 pid=3389 execve guuid=ee91b94b-1700-0000-a019-dbf13f0d0000 pid=3391 /usr/bin/rm guuid=64922fea-1600-0000-a019-dbf1160c0000 pid=3094->guuid=ee91b94b-1700-0000-a019-dbf13f0d0000 pid=3391 execve guuid=06e5f94b-1700-0000-a019-dbf1410d0000 pid=3393 /usr/bin/wget net send-data guuid=64922fea-1600-0000-a019-dbf1160c0000 pid=3094->guuid=06e5f94b-1700-0000-a019-dbf1410d0000 pid=3393 execve guuid=7958854e-1700-0000-a019-dbf14a0d0000 pid=3402 /usr/bin/curl net send-data write-file guuid=64922fea-1600-0000-a019-dbf1160c0000 pid=3094->guuid=7958854e-1700-0000-a019-dbf14a0d0000 pid=3402 execve guuid=50829452-1700-0000-a019-dbf1590d0000 pid=3417 /usr/bin/chmod guuid=64922fea-1600-0000-a019-dbf1160c0000 pid=3094->guuid=50829452-1700-0000-a019-dbf1590d0000 pid=3417 execve guuid=80e8d652-1700-0000-a019-dbf15b0d0000 pid=3419 /usr/bin/bash guuid=64922fea-1600-0000-a019-dbf1160c0000 pid=3094->guuid=80e8d652-1700-0000-a019-dbf15b0d0000 pid=3419 clone guuid=27751253-1700-0000-a019-dbf15e0d0000 pid=3422 /usr/bin/rm delete-file guuid=64922fea-1600-0000-a019-dbf1160c0000 pid=3094->guuid=27751253-1700-0000-a019-dbf15e0d0000 pid=3422 execve guuid=460e5953-1700-0000-a019-dbf1600d0000 pid=3424 /usr/bin/rm guuid=64922fea-1600-0000-a019-dbf1160c0000 pid=3094->guuid=460e5953-1700-0000-a019-dbf1600d0000 pid=3424 execve guuid=88a69a53-1700-0000-a019-dbf1620d0000 pid=3426 /usr/bin/wget net send-data guuid=64922fea-1600-0000-a019-dbf1160c0000 pid=3094->guuid=88a69a53-1700-0000-a019-dbf1620d0000 pid=3426 execve guuid=fa491b56-1700-0000-a019-dbf16c0d0000 pid=3436 /usr/bin/curl net send-data write-file guuid=64922fea-1600-0000-a019-dbf1160c0000 pid=3094->guuid=fa491b56-1700-0000-a019-dbf16c0d0000 pid=3436 execve guuid=26b6bf59-1700-0000-a019-dbf17a0d0000 pid=3450 /usr/bin/chmod guuid=64922fea-1600-0000-a019-dbf1160c0000 pid=3094->guuid=26b6bf59-1700-0000-a019-dbf17a0d0000 pid=3450 execve guuid=a559205a-1700-0000-a019-dbf17b0d0000 pid=3451 /usr/bin/bash guuid=64922fea-1600-0000-a019-dbf1160c0000 pid=3094->guuid=a559205a-1700-0000-a019-dbf17b0d0000 pid=3451 clone guuid=8b916c5a-1700-0000-a019-dbf17d0d0000 pid=3453 /usr/bin/rm delete-file guuid=64922fea-1600-0000-a019-dbf1160c0000 pid=3094->guuid=8b916c5a-1700-0000-a019-dbf17d0d0000 pid=3453 execve guuid=5606b15a-1700-0000-a019-dbf17e0d0000 pid=3454 /usr/bin/rm guuid=64922fea-1600-0000-a019-dbf1160c0000 pid=3094->guuid=5606b15a-1700-0000-a019-dbf17e0d0000 pid=3454 execve 5b654972-c9e1-50d8-b372-2dc2a5b9ad66 5.182.210.174:80 guuid=764c48eb-1600-0000-a019-dbf1170c0000 pid=3095->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=59c485f1-1600-0000-a019-dbf1180c0000 pid=3096->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=09185efa-1600-0000-a019-dbf1220c0000 pid=3106 /usr/bin/bash guuid=6d983ffa-1600-0000-a019-dbf1210c0000 pid=3105->guuid=09185efa-1600-0000-a019-dbf1220c0000 pid=3106 clone guuid=584256fb-1600-0000-a019-dbf1260c0000 pid=3110->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=ce3505fe-1600-0000-a019-dbf12d0c0000 pid=3117->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=3afae204-1700-0000-a019-dbf1380c0000 pid=3128 /usr/bin/bash guuid=d200c504-1700-0000-a019-dbf1370c0000 pid=3127->guuid=3afae204-1700-0000-a019-dbf1380c0000 pid=3128 clone guuid=ccc5be05-1700-0000-a019-dbf13e0c0000 pid=3134->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=4b46ae08-1700-0000-a019-dbf1460c0000 pid=3142->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=ccdd300e-1700-0000-a019-dbf1540c0000 pid=3156 /usr/bin/bash guuid=33670a0e-1700-0000-a019-dbf1530c0000 pid=3155->guuid=ccdd300e-1700-0000-a019-dbf1540c0000 pid=3156 clone guuid=fff5080f-1700-0000-a019-dbf1590c0000 pid=3161->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=63f5fe14-1700-0000-a019-dbf16a0c0000 pid=3178->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=29cfc41a-1700-0000-a019-dbf17d0c0000 pid=3197 /usr/bin/bash guuid=f6ecaf1a-1700-0000-a019-dbf17c0c0000 pid=3196->guuid=29cfc41a-1700-0000-a019-dbf17d0c0000 pid=3197 clone guuid=c9314e1b-1700-0000-a019-dbf1820c0000 pid=3202->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=6d0ec21d-1700-0000-a019-dbf18b0c0000 pid=3211->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=d04a5921-1700-0000-a019-dbf19a0c0000 pid=3226 /usr/bin/bash guuid=a1f34021-1700-0000-a019-dbf1990c0000 pid=3225->guuid=d04a5921-1700-0000-a019-dbf19a0c0000 pid=3226 clone guuid=c58d1822-1700-0000-a019-dbf19f0c0000 pid=3231->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=676dce24-1700-0000-a019-dbf1a80c0000 pid=3240->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=6477d628-1700-0000-a019-dbf1b70c0000 pid=3255 /usr/bin/bash guuid=4f16be28-1700-0000-a019-dbf1b60c0000 pid=3254->guuid=6477d628-1700-0000-a019-dbf1b70c0000 pid=3255 clone guuid=32ee7f29-1700-0000-a019-dbf1bd0c0000 pid=3261->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=79bef92b-1700-0000-a019-dbf1c40c0000 pid=3268->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=1ca30e31-1700-0000-a019-dbf1d00c0000 pid=3280 /usr/bin/bash guuid=d2dff930-1700-0000-a019-dbf1cf0c0000 pid=3279->guuid=1ca30e31-1700-0000-a019-dbf1d00c0000 pid=3280 clone guuid=ba493332-1700-0000-a019-dbf1d40c0000 pid=3284->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=d67b0f35-1700-0000-a019-dbf1de0c0000 pid=3294->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=453f9239-1700-0000-a019-dbf1ee0c0000 pid=3310 /usr/bin/bash guuid=13f15339-1700-0000-a019-dbf1ec0c0000 pid=3308->guuid=453f9239-1700-0000-a019-dbf1ee0c0000 pid=3310 clone guuid=53443b3b-1700-0000-a019-dbf1f60c0000 pid=3318->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=2313ce3d-1700-0000-a019-dbf1000d0000 pid=3328->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=a8eaea41-1700-0000-a019-dbf1110d0000 pid=3345 /usr/bin/bash guuid=4261c241-1700-0000-a019-dbf1100d0000 pid=3344->guuid=a8eaea41-1700-0000-a019-dbf1110d0000 pid=3345 clone guuid=dd0c0d43-1700-0000-a019-dbf1190d0000 pid=3353->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=98200b46-1700-0000-a019-dbf1260d0000 pid=3366->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=e7eb504b-1700-0000-a019-dbf13b0d0000 pid=3387 /usr/bin/bash guuid=d3093b4b-1700-0000-a019-dbf13a0d0000 pid=3386->guuid=e7eb504b-1700-0000-a019-dbf13b0d0000 pid=3387 clone guuid=06e5f94b-1700-0000-a019-dbf1410d0000 pid=3393->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=7958854e-1700-0000-a019-dbf14a0d0000 pid=3402->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=616ced52-1700-0000-a019-dbf15c0d0000 pid=3420 /usr/bin/bash guuid=80e8d652-1700-0000-a019-dbf15b0d0000 pid=3419->guuid=616ced52-1700-0000-a019-dbf15c0d0000 pid=3420 clone guuid=88a69a53-1700-0000-a019-dbf1620d0000 pid=3426->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=fa491b56-1700-0000-a019-dbf16c0d0000 pid=3436->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=fd0d3f5a-1700-0000-a019-dbf17c0d0000 pid=3452 /usr/bin/bash guuid=a559205a-1700-0000-a019-dbf17b0d0000 pid=3451->guuid=fd0d3f5a-1700-0000-a019-dbf17c0d0000 pid=3452 clone
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/d2035337fdfac27bb8dd6678f959c6ff88e404a8c19acab48424d20b449915a7
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d2035337fdfac27bb8dd6678f959c6ff88e404a8c19acab48424d20b449915a7/
Threat name:
Linux.Downloader.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-08-14 14:57:44 UTC
File Type:
Text (Shell)
AV detection:
12 of 36 (33.33%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2ibvgn757lbhxog5mz4pswog76eoibfiygnmvneeetjawrezcwtq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260814-sbsr5awcpf/
Behaviour
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.11
Link:
https://yomi.yoroi.company/submissions/d2035337fdfac27bb8dd6678f959c6ff88e404a8c19acab48424d20b449915a7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh d2035337fdfac27bb8dd6678f959c6ff88e404a8c19acab48424d20b449915a7

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3897671/
  
Delivery method
Distributed via web download

Comments