MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d475c3caf477bd0e4aebbce33f062d4d42a3533e28b76d2ad23c709d013e7926. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d475c3caf477bd0e4aebbce33f062d4d42a3533e28b76d2ad23c709d013e7926
SHA3-384 hash: f2c3127cb75830b6a20cf1bf091cfa813e8c0ca401c0863f871453eb32a18213c6fb91acea410b38cfc7f5a704d80c33
SHA1 hash: 366f8c2aa78438df22bccb66e4c6971f988f7063
MD5 hash: be71d936a939e65ab5135e8b4c7ce73c
humanhash: neptune-oregon-glucose-india
File name:p
Download: download sample
File size:839 bytes
First seen:2026-07-21 20:00:36 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 12:dOXOsYxcysE+vhCFN0zvy/RQvZowHka/CzSdUjAFCCLnC5NXCFG9MLCQKTuauD:kXCKysE2hi0ziQvZoha/wx0duXYtKTu7
TLSH T1F3011EC695006D406029C95E72DB2290B852C3CF1A8A0F787FDC2E2DFBACD04B026F9C
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://129.121.114.124/y93qn/an/aarm elf ua-wget
http://129.121.114.124/0FGn/an/an/a
http://129.121.114.124/t3Inn/an/aarm elf ua-wget
http://129.121.114.124/tE6Cn/an/an/a
http://129.121.114.124/8Bnn/an/aelf mips ua-wget

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive mirai
Link:
https://www.filescan.io/uploads/6a5fcff7911c1977f80fdb3b/reports/8cb9f9e1-486b-48b5-8349-d10a433a87a0/overview
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/f8d311cf-23c9-42d7-8fad-5a8989d7dd90
Behavior Graph:
Download SVG
%3 guuid=fc7536b8-1600-0000-0551-f73b5a0c0000 pid=3162 /usr/bin/sudo guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171 /tmp/sample.bin write-file guuid=fc7536b8-1600-0000-0551-f73b5a0c0000 pid=3162->guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171 execve guuid=9796ccba-1600-0000-0551-f73b650c0000 pid=3173 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=9796ccba-1600-0000-0551-f73b650c0000 pid=3173 execve guuid=4b5a84bb-1600-0000-0551-f73b690c0000 pid=3177 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=4b5a84bb-1600-0000-0551-f73b690c0000 pid=3177 execve guuid=f327dbbb-1600-0000-0551-f73b6b0c0000 pid=3179 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=f327dbbb-1600-0000-0551-f73b6b0c0000 pid=3179 execve guuid=dc0b4fbc-1600-0000-0551-f73b6c0c0000 pid=3180 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=dc0b4fbc-1600-0000-0551-f73b6c0c0000 pid=3180 execve guuid=eeeed0bc-1600-0000-0551-f73b6d0c0000 pid=3181 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=eeeed0bc-1600-0000-0551-f73b6d0c0000 pid=3181 execve guuid=ecc844bd-1600-0000-0551-f73b6e0c0000 pid=3182 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=ecc844bd-1600-0000-0551-f73b6e0c0000 pid=3182 execve guuid=0148aabd-1600-0000-0551-f73b700c0000 pid=3184 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=0148aabd-1600-0000-0551-f73b700c0000 pid=3184 execve guuid=b9a00bbe-1600-0000-0551-f73b730c0000 pid=3187 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=b9a00bbe-1600-0000-0551-f73b730c0000 pid=3187 execve guuid=001069be-1600-0000-0551-f73b750c0000 pid=3189 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=001069be-1600-0000-0551-f73b750c0000 pid=3189 execve guuid=8254c4be-1600-0000-0551-f73b780c0000 pid=3192 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=8254c4be-1600-0000-0551-f73b780c0000 pid=3192 execve guuid=2ed036bf-1600-0000-0551-f73b790c0000 pid=3193 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=2ed036bf-1600-0000-0551-f73b790c0000 pid=3193 execve guuid=19233dc0-1600-0000-0551-f73b7b0c0000 pid=3195 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=19233dc0-1600-0000-0551-f73b7b0c0000 pid=3195 execve guuid=4a2b45c1-1600-0000-0551-f73b7c0c0000 pid=3196 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=4a2b45c1-1600-0000-0551-f73b7c0c0000 pid=3196 execve guuid=8f6446c2-1600-0000-0551-f73b800c0000 pid=3200 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=8f6446c2-1600-0000-0551-f73b800c0000 pid=3200 execve guuid=68dc68c3-1600-0000-0551-f73b850c0000 pid=3205 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=68dc68c3-1600-0000-0551-f73b850c0000 pid=3205 execve guuid=b3fea5c4-1600-0000-0551-f73b8b0c0000 pid=3211 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=b3fea5c4-1600-0000-0551-f73b8b0c0000 pid=3211 execve guuid=90e5bac5-1600-0000-0551-f73b8f0c0000 pid=3215 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=90e5bac5-1600-0000-0551-f73b8f0c0000 pid=3215 execve guuid=c380f7c6-1600-0000-0551-f73b940c0000 pid=3220 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=c380f7c6-1600-0000-0551-f73b940c0000 pid=3220 execve guuid=5dfbf9c7-1600-0000-0551-f73b970c0000 pid=3223 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=5dfbf9c7-1600-0000-0551-f73b970c0000 pid=3223 execve guuid=fbade2c8-1600-0000-0551-f73b9b0c0000 pid=3227 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=fbade2c8-1600-0000-0551-f73b9b0c0000 pid=3227 execve guuid=430dc9c9-1600-0000-0551-f73b9d0c0000 pid=3229 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=430dc9c9-1600-0000-0551-f73b9d0c0000 pid=3229 execve guuid=ac9af5ca-1600-0000-0551-f73b9e0c0000 pid=3230 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=ac9af5ca-1600-0000-0551-f73b9e0c0000 pid=3230 execve guuid=8ae51bcc-1600-0000-0551-f73b9f0c0000 pid=3231 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=8ae51bcc-1600-0000-0551-f73b9f0c0000 pid=3231 execve guuid=a087a1cc-1600-0000-0551-f73ba00c0000 pid=3232 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=a087a1cc-1600-0000-0551-f73ba00c0000 pid=3232 execve guuid=985e21cd-1600-0000-0551-f73ba10c0000 pid=3233 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=985e21cd-1600-0000-0551-f73ba10c0000 pid=3233 execve guuid=e75cb7cd-1600-0000-0551-f73ba20c0000 pid=3234 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=e75cb7cd-1600-0000-0551-f73ba20c0000 pid=3234 execve guuid=6c0135ce-1600-0000-0551-f73ba30c0000 pid=3235 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=6c0135ce-1600-0000-0551-f73ba30c0000 pid=3235 execve guuid=4ec7bcce-1600-0000-0551-f73ba40c0000 pid=3236 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=4ec7bcce-1600-0000-0551-f73ba40c0000 pid=3236 execve guuid=594c45cf-1600-0000-0551-f73ba50c0000 pid=3237 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=594c45cf-1600-0000-0551-f73ba50c0000 pid=3237 execve guuid=18f1cccf-1600-0000-0551-f73ba60c0000 pid=3238 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=18f1cccf-1600-0000-0551-f73ba60c0000 pid=3238 execve guuid=b53251d0-1600-0000-0551-f73ba70c0000 pid=3239 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=b53251d0-1600-0000-0551-f73ba70c0000 pid=3239 execve guuid=5536d4d0-1600-0000-0551-f73ba80c0000 pid=3240 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=5536d4d0-1600-0000-0551-f73ba80c0000 pid=3240 execve guuid=c69a57d1-1600-0000-0551-f73ba90c0000 pid=3241 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=c69a57d1-1600-0000-0551-f73ba90c0000 pid=3241 execve guuid=da2fded1-1600-0000-0551-f73baa0c0000 pid=3242 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=da2fded1-1600-0000-0551-f73baa0c0000 pid=3242 execve guuid=de335cd2-1600-0000-0551-f73bac0c0000 pid=3244 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=de335cd2-1600-0000-0551-f73bac0c0000 pid=3244 execve guuid=8a0fc4d2-1600-0000-0551-f73bad0c0000 pid=3245 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=8a0fc4d2-1600-0000-0551-f73bad0c0000 pid=3245 execve guuid=68a437d3-1600-0000-0551-f73bae0c0000 pid=3246 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=68a437d3-1600-0000-0551-f73bae0c0000 pid=3246 execve guuid=bf599ad3-1600-0000-0551-f73bb00c0000 pid=3248 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=bf599ad3-1600-0000-0551-f73bb00c0000 pid=3248 execve guuid=674d04d4-1600-0000-0551-f73bb20c0000 pid=3250 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=674d04d4-1600-0000-0551-f73bb20c0000 pid=3250 execve guuid=93fa55d4-1600-0000-0551-f73bb30c0000 pid=3251 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=93fa55d4-1600-0000-0551-f73bb30c0000 pid=3251 execve guuid=0b1da8d4-1600-0000-0551-f73bb40c0000 pid=3252 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=0b1da8d4-1600-0000-0551-f73bb40c0000 pid=3252 execve guuid=dd3ffad4-1600-0000-0551-f73bb60c0000 pid=3254 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=dd3ffad4-1600-0000-0551-f73bb60c0000 pid=3254 execve guuid=f8364bd5-1600-0000-0551-f73bb70c0000 pid=3255 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=f8364bd5-1600-0000-0551-f73bb70c0000 pid=3255 execve guuid=d2019cd5-1600-0000-0551-f73bb80c0000 pid=3256 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=d2019cd5-1600-0000-0551-f73bb80c0000 pid=3256 execve guuid=3025edd5-1600-0000-0551-f73bb90c0000 pid=3257 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=3025edd5-1600-0000-0551-f73bb90c0000 pid=3257 execve guuid=993d40d6-1600-0000-0551-f73bbb0c0000 pid=3259 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=993d40d6-1600-0000-0551-f73bbb0c0000 pid=3259 execve guuid=714297d6-1600-0000-0551-f73bbc0c0000 pid=3260 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=714297d6-1600-0000-0551-f73bbc0c0000 pid=3260 execve guuid=4bb5ead6-1600-0000-0551-f73bbe0c0000 pid=3262 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=4bb5ead6-1600-0000-0551-f73bbe0c0000 pid=3262 execve guuid=511841d7-1600-0000-0551-f73bc00c0000 pid=3264 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=511841d7-1600-0000-0551-f73bc00c0000 pid=3264 execve guuid=3bf797d7-1600-0000-0551-f73bc10c0000 pid=3265 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=3bf797d7-1600-0000-0551-f73bc10c0000 pid=3265 execve guuid=32bde8d7-1600-0000-0551-f73bc30c0000 pid=3267 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=32bde8d7-1600-0000-0551-f73bc30c0000 pid=3267 execve guuid=9e593fd8-1600-0000-0551-f73bc40c0000 pid=3268 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=9e593fd8-1600-0000-0551-f73bc40c0000 pid=3268 execve guuid=4c5d94d8-1600-0000-0551-f73bc60c0000 pid=3270 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=4c5d94d8-1600-0000-0551-f73bc60c0000 pid=3270 execve guuid=a158ebd8-1600-0000-0551-f73bc80c0000 pid=3272 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=a158ebd8-1600-0000-0551-f73bc80c0000 pid=3272 execve guuid=a7d532d9-1600-0000-0551-f73bc90c0000 pid=3273 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=a7d532d9-1600-0000-0551-f73bc90c0000 pid=3273 execve guuid=56458dd9-1600-0000-0551-f73bcb0c0000 pid=3275 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=56458dd9-1600-0000-0551-f73bcb0c0000 pid=3275 execve guuid=619ae1d9-1600-0000-0551-f73bcc0c0000 pid=3276 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=619ae1d9-1600-0000-0551-f73bcc0c0000 pid=3276 execve guuid=eb2e38da-1600-0000-0551-f73bcd0c0000 pid=3277 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=eb2e38da-1600-0000-0551-f73bcd0c0000 pid=3277 execve guuid=a3298bda-1600-0000-0551-f73bcf0c0000 pid=3279 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=a3298bda-1600-0000-0551-f73bcf0c0000 pid=3279 execve guuid=e4a1e2da-1600-0000-0551-f73bd00c0000 pid=3280 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=e4a1e2da-1600-0000-0551-f73bd00c0000 pid=3280 execve guuid=20e93adb-1600-0000-0551-f73bd10c0000 pid=3281 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=20e93adb-1600-0000-0551-f73bd10c0000 pid=3281 execve guuid=14b291db-1600-0000-0551-f73bd20c0000 pid=3282 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=14b291db-1600-0000-0551-f73bd20c0000 pid=3282 execve guuid=ce17ecdb-1600-0000-0551-f73bd30c0000 pid=3283 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=ce17ecdb-1600-0000-0551-f73bd30c0000 pid=3283 execve guuid=bb1642dc-1600-0000-0551-f73bd50c0000 pid=3285 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=bb1642dc-1600-0000-0551-f73bd50c0000 pid=3285 execve guuid=cd8295dc-1600-0000-0551-f73bd60c0000 pid=3286 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=cd8295dc-1600-0000-0551-f73bd60c0000 pid=3286 execve guuid=524fe8dc-1600-0000-0551-f73bd80c0000 pid=3288 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=524fe8dc-1600-0000-0551-f73bd80c0000 pid=3288 execve guuid=c6863ddd-1600-0000-0551-f73bda0c0000 pid=3290 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=c6863ddd-1600-0000-0551-f73bda0c0000 pid=3290 execve guuid=e8fca4dd-1600-0000-0551-f73bdd0c0000 pid=3293 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=e8fca4dd-1600-0000-0551-f73bdd0c0000 pid=3293 execve guuid=0e0fffdd-1600-0000-0551-f73bdf0c0000 pid=3295 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=0e0fffdd-1600-0000-0551-f73bdf0c0000 pid=3295 execve guuid=665359de-1600-0000-0551-f73be10c0000 pid=3297 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=665359de-1600-0000-0551-f73be10c0000 pid=3297 execve guuid=bcd4c1de-1600-0000-0551-f73be20c0000 pid=3298 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=bcd4c1de-1600-0000-0551-f73be20c0000 pid=3298 execve guuid=e0e128df-1600-0000-0551-f73be30c0000 pid=3299 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=e0e128df-1600-0000-0551-f73be30c0000 pid=3299 execve guuid=33a383df-1600-0000-0551-f73be50c0000 pid=3301 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=33a383df-1600-0000-0551-f73be50c0000 pid=3301 execve guuid=e0dce0df-1600-0000-0551-f73be80c0000 pid=3304 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=e0dce0df-1600-0000-0551-f73be80c0000 pid=3304 execve guuid=392f41e0-1600-0000-0551-f73bea0c0000 pid=3306 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=392f41e0-1600-0000-0551-f73bea0c0000 pid=3306 execve guuid=06409fe0-1600-0000-0551-f73bed0c0000 pid=3309 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=06409fe0-1600-0000-0551-f73bed0c0000 pid=3309 execve guuid=c92202e1-1600-0000-0551-f73bef0c0000 pid=3311 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=c92202e1-1600-0000-0551-f73bef0c0000 pid=3311 execve guuid=e35865e1-1600-0000-0551-f73bf00c0000 pid=3312 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=e35865e1-1600-0000-0551-f73bf00c0000 pid=3312 execve guuid=9c9ac4e1-1600-0000-0551-f73bf30c0000 pid=3315 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=9c9ac4e1-1600-0000-0551-f73bf30c0000 pid=3315 execve guuid=1ec71de2-1600-0000-0551-f73bf50c0000 pid=3317 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=1ec71de2-1600-0000-0551-f73bf50c0000 pid=3317 execve guuid=09eb83e2-1600-0000-0551-f73bf80c0000 pid=3320 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=09eb83e2-1600-0000-0551-f73bf80c0000 pid=3320 execve guuid=2dbee3e2-1600-0000-0551-f73bfb0c0000 pid=3323 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=2dbee3e2-1600-0000-0551-f73bfb0c0000 pid=3323 execve guuid=a5c242e3-1600-0000-0551-f73bfd0c0000 pid=3325 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=a5c242e3-1600-0000-0551-f73bfd0c0000 pid=3325 execve guuid=4f5c9ae3-1600-0000-0551-f73b000d0000 pid=3328 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=4f5c9ae3-1600-0000-0551-f73b000d0000 pid=3328 execve guuid=5227f9e3-1600-0000-0551-f73b020d0000 pid=3330 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=5227f9e3-1600-0000-0551-f73b020d0000 pid=3330 execve guuid=5a905be4-1600-0000-0551-f73b030d0000 pid=3331 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=5a905be4-1600-0000-0551-f73b030d0000 pid=3331 execve guuid=500bc3e4-1600-0000-0551-f73b060d0000 pid=3334 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=500bc3e4-1600-0000-0551-f73b060d0000 pid=3334 execve guuid=8de522e5-1600-0000-0551-f73b080d0000 pid=3336 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=8de522e5-1600-0000-0551-f73b080d0000 pid=3336 execve guuid=bc397ae5-1600-0000-0551-f73b0b0d0000 pid=3339 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=bc397ae5-1600-0000-0551-f73b0b0d0000 pid=3339 execve guuid=6de7dce5-1600-0000-0551-f73b0d0d0000 pid=3341 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=6de7dce5-1600-0000-0551-f73b0d0d0000 pid=3341 execve guuid=439e41e6-1600-0000-0551-f73b100d0000 pid=3344 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=439e41e6-1600-0000-0551-f73b100d0000 pid=3344 execve guuid=54269de6-1600-0000-0551-f73b110d0000 pid=3345 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=54269de6-1600-0000-0551-f73b110d0000 pid=3345 execve guuid=0fcd35e7-1600-0000-0551-f73b130d0000 pid=3347 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=0fcd35e7-1600-0000-0551-f73b130d0000 pid=3347 execve guuid=0b05afe7-1600-0000-0551-f73b140d0000 pid=3348 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=0b05afe7-1600-0000-0551-f73b140d0000 pid=3348 execve guuid=1c780ee8-1600-0000-0551-f73b160d0000 pid=3350 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=1c780ee8-1600-0000-0551-f73b160d0000 pid=3350 execve guuid=ed1f6de8-1600-0000-0551-f73b190d0000 pid=3353 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=ed1f6de8-1600-0000-0551-f73b190d0000 pid=3353 execve guuid=ee90c8e8-1600-0000-0551-f73b1b0d0000 pid=3355 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=ee90c8e8-1600-0000-0551-f73b1b0d0000 pid=3355 execve guuid=016425e9-1600-0000-0551-f73b1d0d0000 pid=3357 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=016425e9-1600-0000-0551-f73b1d0d0000 pid=3357 execve guuid=5f2e87e9-1600-0000-0551-f73b200d0000 pid=3360 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=5f2e87e9-1600-0000-0551-f73b200d0000 pid=3360 execve guuid=48f5e8e9-1600-0000-0551-f73b220d0000 pid=3362 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=48f5e8e9-1600-0000-0551-f73b220d0000 pid=3362 execve guuid=28dc49ea-1600-0000-0551-f73b250d0000 pid=3365 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=28dc49ea-1600-0000-0551-f73b250d0000 pid=3365 execve guuid=62d1a9ea-1600-0000-0551-f73b270d0000 pid=3367 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=62d1a9ea-1600-0000-0551-f73b270d0000 pid=3367 execve guuid=925908eb-1600-0000-0551-f73b290d0000 pid=3369 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=925908eb-1600-0000-0551-f73b290d0000 pid=3369 execve guuid=aafe63eb-1600-0000-0551-f73b2c0d0000 pid=3372 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=aafe63eb-1600-0000-0551-f73b2c0d0000 pid=3372 execve guuid=4499caeb-1600-0000-0551-f73b2e0d0000 pid=3374 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=4499caeb-1600-0000-0551-f73b2e0d0000 pid=3374 execve guuid=c0b727ec-1600-0000-0551-f73b300d0000 pid=3376 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=c0b727ec-1600-0000-0551-f73b300d0000 pid=3376 execve guuid=07f986ec-1600-0000-0551-f73b320d0000 pid=3378 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=07f986ec-1600-0000-0551-f73b320d0000 pid=3378 execve guuid=6d9de5ec-1600-0000-0551-f73b330d0000 pid=3379 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=6d9de5ec-1600-0000-0551-f73b330d0000 pid=3379 execve guuid=951541ed-1600-0000-0551-f73b340d0000 pid=3380 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=951541ed-1600-0000-0551-f73b340d0000 pid=3380 execve guuid=7fdd9aed-1600-0000-0551-f73b350d0000 pid=3381 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=7fdd9aed-1600-0000-0551-f73b350d0000 pid=3381 execve guuid=9120ebed-1600-0000-0551-f73b370d0000 pid=3383 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=9120ebed-1600-0000-0551-f73b370d0000 pid=3383 execve guuid=736338ee-1600-0000-0551-f73b390d0000 pid=3385 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=736338ee-1600-0000-0551-f73b390d0000 pid=3385 execve guuid=630586ee-1600-0000-0551-f73b3a0d0000 pid=3386 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=630586ee-1600-0000-0551-f73b3a0d0000 pid=3386 execve guuid=be6bdaee-1600-0000-0551-f73b3c0d0000 pid=3388 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=be6bdaee-1600-0000-0551-f73b3c0d0000 pid=3388 execve guuid=3b8c27ef-1600-0000-0551-f73b3e0d0000 pid=3390 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=3b8c27ef-1600-0000-0551-f73b3e0d0000 pid=3390 execve guuid=bc6a73ef-1600-0000-0551-f73b400d0000 pid=3392 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=bc6a73ef-1600-0000-0551-f73b400d0000 pid=3392 execve guuid=2c5bc1ef-1600-0000-0551-f73b420d0000 pid=3394 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=2c5bc1ef-1600-0000-0551-f73b420d0000 pid=3394 execve guuid=65e814f0-1600-0000-0551-f73b440d0000 pid=3396 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=65e814f0-1600-0000-0551-f73b440d0000 pid=3396 execve guuid=7f7362f0-1600-0000-0551-f73b460d0000 pid=3398 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=7f7362f0-1600-0000-0551-f73b460d0000 pid=3398 execve guuid=a3d3b1f0-1600-0000-0551-f73b470d0000 pid=3399 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=a3d3b1f0-1600-0000-0551-f73b470d0000 pid=3399 execve guuid=593d02f1-1600-0000-0551-f73b490d0000 pid=3401 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=593d02f1-1600-0000-0551-f73b490d0000 pid=3401 execve guuid=61b451f1-1600-0000-0551-f73b4b0d0000 pid=3403 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=61b451f1-1600-0000-0551-f73b4b0d0000 pid=3403 execve guuid=548fa1f1-1600-0000-0551-f73b4d0d0000 pid=3405 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=548fa1f1-1600-0000-0551-f73b4d0d0000 pid=3405 execve guuid=50b4f4f1-1600-0000-0551-f73b4f0d0000 pid=3407 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=50b4f4f1-1600-0000-0551-f73b4f0d0000 pid=3407 execve guuid=849642f2-1600-0000-0551-f73b510d0000 pid=3409 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=849642f2-1600-0000-0551-f73b510d0000 pid=3409 execve guuid=f28f92f2-1600-0000-0551-f73b530d0000 pid=3411 /usr/bin/ls guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=f28f92f2-1600-0000-0551-f73b530d0000 pid=3411 execve guuid=36b3e4f2-1600-0000-0551-f73b550d0000 pid=3413 /usr/bin/rm guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=36b3e4f2-1600-0000-0551-f73b550d0000 pid=3413 execve guuid=3fbd13f3-1600-0000-0551-f73b560d0000 pid=3414 /usr/bin/wget net send-data write-file guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=3fbd13f3-1600-0000-0551-f73b560d0000 pid=3414 execve guuid=4bdf2c01-1700-0000-0551-f73b7d0d0000 pid=3453 /usr/bin/chmod guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=4bdf2c01-1700-0000-0551-f73b7d0d0000 pid=3453 execve guuid=179bac01-1700-0000-0551-f73b7f0d0000 pid=3455 /tmp/y93q guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=179bac01-1700-0000-0551-f73b7f0d0000 pid=3455 execve guuid=fd918f02-1700-0000-0551-f73b830d0000 pid=3459 /usr/bin/rm guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=fd918f02-1700-0000-0551-f73b830d0000 pid=3459 execve guuid=38d2cb02-1700-0000-0551-f73b850d0000 pid=3461 /usr/bin/wget net send-data write-file guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=38d2cb02-1700-0000-0551-f73b850d0000 pid=3461 execve guuid=6ced580f-1700-0000-0551-f73ba70d0000 pid=3495 /usr/bin/chmod guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=6ced580f-1700-0000-0551-f73ba70d0000 pid=3495 execve guuid=fc544210-1700-0000-0551-f73baa0d0000 pid=3498 /tmp/0FG guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=fc544210-1700-0000-0551-f73baa0d0000 pid=3498 execve guuid=04b2d514-1700-0000-0551-f73bb40d0000 pid=3508 /usr/bin/rm guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=04b2d514-1700-0000-0551-f73bb40d0000 pid=3508 execve guuid=11c81e15-1700-0000-0551-f73bb50d0000 pid=3509 /usr/bin/wget net send-data write-file guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=11c81e15-1700-0000-0551-f73bb50d0000 pid=3509 execve guuid=3883fd22-1700-0000-0551-f73bc30d0000 pid=3523 /usr/bin/chmod guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=3883fd22-1700-0000-0551-f73bc30d0000 pid=3523 execve guuid=e7478d23-1700-0000-0551-f73bc40d0000 pid=3524 /tmp/t3In guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=e7478d23-1700-0000-0551-f73bc40d0000 pid=3524 execve guuid=757e9324-1700-0000-0551-f73bc70d0000 pid=3527 /usr/bin/rm guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=757e9324-1700-0000-0551-f73bc70d0000 pid=3527 execve guuid=6053e424-1700-0000-0551-f73bc80d0000 pid=3528 /usr/bin/wget net send-data write-file guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=6053e424-1700-0000-0551-f73bc80d0000 pid=3528 execve guuid=c04f6b31-1700-0000-0551-f73bec0d0000 pid=3564 /usr/bin/chmod guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=c04f6b31-1700-0000-0551-f73bec0d0000 pid=3564 execve guuid=dd4aa431-1700-0000-0551-f73bee0d0000 pid=3566 /tmp/tE6C guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=dd4aa431-1700-0000-0551-f73bee0d0000 pid=3566 execve guuid=e4764532-1700-0000-0551-f73bf20d0000 pid=3570 /usr/bin/rm guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=e4764532-1700-0000-0551-f73bf20d0000 pid=3570 execve guuid=0fa98032-1700-0000-0551-f73bf40d0000 pid=3572 /usr/bin/wget net send-data write-file guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=0fa98032-1700-0000-0551-f73bf40d0000 pid=3572 execve guuid=7fdde850-1700-0000-0551-f73b4c0e0000 pid=3660 /usr/bin/chmod guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=7fdde850-1700-0000-0551-f73b4c0e0000 pid=3660 execve guuid=ee0f2751-1700-0000-0551-f73b4e0e0000 pid=3662 /tmp/8Bn guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=ee0f2751-1700-0000-0551-f73b4e0e0000 pid=3662 execve guuid=976eec51-1700-0000-0551-f73b510e0000 pid=3665 /usr/bin/rm delete-file guuid=9da086ba-1600-0000-0551-f73b630c0000 pid=3171->guuid=976eec51-1700-0000-0551-f73b510e0000 pid=3665 execve 801186e6-5fe8-5959-a7b4-832d8d66e7aa 129.121.114.124:80 guuid=3fbd13f3-1600-0000-0551-f73b560d0000 pid=3414->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 134B guuid=38d2cb02-1700-0000-0551-f73b850d0000 pid=3461->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 133B guuid=11c81e15-1700-0000-0551-f73bb50d0000 pid=3509->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 134B guuid=6053e424-1700-0000-0551-f73bc80d0000 pid=3528->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 134B guuid=0fa98032-1700-0000-0551-f73bf40d0000 pid=3572->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 133B
Score:
96%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/d475c3caf477bd0e4aebbce33f062d4d42a3533e28b76d2ad23c709d013e7926
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d475c3caf477bd0e4aebbce33f062d4d42a3533e28b76d2ad23c709d013e7926/
Threat name:
Document-HTML.Downloader.Bash
Create hunting rule
Status:
Malicious
First seen:
2026-07-21 20:17:58 UTC
AV detection:
12 of 38 (31.58%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2r24hsxuo66q4sxlxtrt6brnjvbkguz6fc3w2kwshryj2aj6peta._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
discovery linux
Link:
https://tria.ge/reports/260721-yres4ahl3s/
Behaviour
Reads runtime system information
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.26
Link:
https://yomi.yoroi.company/submissions/d475c3caf477bd0e4aebbce33f062d4d42a3533e28b76d2ad23c709d013e7926

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh d475c3caf477bd0e4aebbce33f062d4d42a3533e28b76d2ad23c709d013e7926

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3866369/
  
Delivery method
Distributed via web download

Comments