🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 db7c84a407766eea064a05a1ba35aebac84fb3948409b9b79ab03adde44aaecc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: db7c84a407766eea064a05a1ba35aebac84fb3948409b9b79ab03adde44aaecc
SHA3-384 hash: 54342b0275a7b33663f2046e9787073ce96176f0ee0733d651de0843cb394e6ca9ab59bec28c55269bca7a275d068d48
SHA1 hash: 6fd3526495cb9fd1d7da8f43ce73efcc44b0f0a0
MD5 hash: 831935d69ca9c55a26eb68a126229bea
humanhash: king-kitten-cat-alabama
File name:ok
Download: download sample
File size:1'608 bytes
First seen:2026-08-27 22:18:44 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 24:e7GeVxjr0aKXEc984saBSa+C3nEnEx2QbsHNrR:e7Ge32EcoaBSalXEnEgQbstrR
TLSH T17E3176CA50202A311553CA9DB3A3308C62CD95FF2D9FD7C59C890DA956487CCF262B5A
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://5.182.210.174/027cb5n/an/an/a
http://5.182.210.174/f34036n/an/an/a
http://5.182.210.174/8cdfd3n/an/an/a
http://5.182.210.174/4d1717n/an/an/a
http://5.182.210.174/6c84d8n/an/an/a
http://5.182.210.174/5b2e89n/an/an/a
http://5.182.210.174/bbe8den/an/an/a
http://5.182.210.174/cc5c8fn/an/an/a
http://5.182.210.174/b8a5can/an/an/a
http://5.182.210.174/2ed4b5n/an/an/a
http://5.182.210.174/aa828cn/an/an/a
http://5.182.210.174/653bb7n/an/an/a

Intelligence

File Origin
# of uploads :
1
# of downloads :
78
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive mirai
Link:
https://www.filescan.io/uploads/6a90b7e09cb8db2631721b76/reports/e113b943-0232-4443-9d4e-aa5928992e3b/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-08-27T20:31:00Z UTC
Last seen:
2026-08-27T23:51:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/db7c84a407766eea064a05a1ba35aebac84fb3948409b9b79ab03adde44aaecc/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/5e14f68e-fbaa-419d-ad97-cefddb67da86
Behavior Graph:
Download SVG
%3 guuid=559b7fb9-1600-0000-00e8-c366b30d0000 pid=3507 /usr/bin/sudo guuid=c15df9ba-1600-0000-00e8-c366b80d0000 pid=3512 /tmp/sample.bin guuid=559b7fb9-1600-0000-00e8-c366b30d0000 pid=3507->guuid=c15df9ba-1600-0000-00e8-c366b80d0000 pid=3512 execve guuid=a21e67bb-1600-0000-00e8-c366bb0d0000 pid=3515 /usr/bin/wget net send-data guuid=c15df9ba-1600-0000-00e8-c366b80d0000 pid=3512->guuid=a21e67bb-1600-0000-00e8-c366bb0d0000 pid=3515 execve guuid=800539c1-1600-0000-00e8-c366ca0d0000 pid=3530 /usr/bin/curl net send-data write-file guuid=c15df9ba-1600-0000-00e8-c366b80d0000 pid=3512->guuid=800539c1-1600-0000-00e8-c366ca0d0000 pid=3530 execve guuid=279b6bd1-1600-0000-00e8-c366df0d0000 pid=3551 /usr/bin/chmod guuid=c15df9ba-1600-0000-00e8-c366b80d0000 pid=3512->guuid=279b6bd1-1600-0000-00e8-c366df0d0000 pid=3551 execve guuid=cc59e8d1-1600-0000-00e8-c366e10d0000 pid=3553 /usr/bin/bash guuid=c15df9ba-1600-0000-00e8-c366b80d0000 pid=3512->guuid=cc59e8d1-1600-0000-00e8-c366e10d0000 pid=3553 clone guuid=309d8ed2-1600-0000-00e8-c366e60d0000 pid=3558 /usr/bin/rm delete-file guuid=c15df9ba-1600-0000-00e8-c366b80d0000 pid=3512->guuid=309d8ed2-1600-0000-00e8-c366e60d0000 pid=3558 execve guuid=b67c4fd3-1600-0000-00e8-c366e90d0000 pid=3561 /usr/bin/rm guuid=c15df9ba-1600-0000-00e8-c366b80d0000 pid=3512->guuid=b67c4fd3-1600-0000-00e8-c366e90d0000 pid=3561 execve guuid=2669fbd3-1600-0000-00e8-c366ea0d0000 pid=3562 /usr/bin/wget net send-data guuid=c15df9ba-1600-0000-00e8-c366b80d0000 pid=3512->guuid=2669fbd3-1600-0000-00e8-c366ea0d0000 pid=3562 execve guuid=9daecbd7-1600-0000-00e8-c366ee0d0000 pid=3566 /usr/bin/curl net send-data write-file guuid=c15df9ba-1600-0000-00e8-c366b80d0000 pid=3512->guuid=9daecbd7-1600-0000-00e8-c366ee0d0000 pid=3566 execve guuid=0cd361dd-1600-0000-00e8-c366040e0000 pid=3588 /usr/bin/chmod guuid=c15df9ba-1600-0000-00e8-c366b80d0000 pid=3512->guuid=0cd361dd-1600-0000-00e8-c366040e0000 pid=3588 execve guuid=8021bbdd-1600-0000-00e8-c366060e0000 pid=3590 /usr/bin/bash guuid=c15df9ba-1600-0000-00e8-c366b80d0000 pid=3512->guuid=8021bbdd-1600-0000-00e8-c366060e0000 pid=3590 clone guuid=cd0c04de-1600-0000-00e8-c366090e0000 pid=3593 /usr/bin/rm delete-file guuid=c15df9ba-1600-0000-00e8-c366b80d0000 pid=3512->guuid=cd0c04de-1600-0000-00e8-c366090e0000 pid=3593 execve guuid=1ce351de-1600-0000-00e8-c3660c0e0000 pid=3596 /usr/bin/rm guuid=c15df9ba-1600-0000-00e8-c366b80d0000 pid=3512->guuid=1ce351de-1600-0000-00e8-c3660c0e0000 pid=3596 execve guuid=833a93de-1600-0000-00e8-c3660e0e0000 pid=3598 /usr/bin/wget net send-data guuid=c15df9ba-1600-0000-00e8-c366b80d0000 pid=3512->guuid=833a93de-1600-0000-00e8-c3660e0e0000 pid=3598 execve guuid=f34ef3e0-1600-0000-00e8-c3661d0e0000 pid=3613 /usr/bin/curl net send-data write-file guuid=c15df9ba-1600-0000-00e8-c366b80d0000 pid=3512->guuid=f34ef3e0-1600-0000-00e8-c3661d0e0000 pid=3613 execve guuid=abc35fe4-1600-0000-00e8-c3662c0e0000 pid=3628 /usr/bin/chmod guuid=c15df9ba-1600-0000-00e8-c366b80d0000 pid=3512->guuid=abc35fe4-1600-0000-00e8-c3662c0e0000 pid=3628 execve guuid=298ab8e4-1600-0000-00e8-c3662f0e0000 pid=3631 /usr/bin/bash guuid=c15df9ba-1600-0000-00e8-c366b80d0000 pid=3512->guuid=298ab8e4-1600-0000-00e8-c3662f0e0000 pid=3631 clone guuid=4ac1f7e4-1600-0000-00e8-c366320e0000 pid=3634 /usr/bin/rm delete-file guuid=c15df9ba-1600-0000-00e8-c366b80d0000 pid=3512->guuid=4ac1f7e4-1600-0000-00e8-c366320e0000 pid=3634 execve guuid=70f94ce5-1600-0000-00e8-c366340e0000 pid=3636 /usr/bin/rm guuid=c15df9ba-1600-0000-00e8-c366b80d0000 pid=3512->guuid=70f94ce5-1600-0000-00e8-c366340e0000 pid=3636 execve guuid=7b6c96e5-1600-0000-00e8-c366380e0000 pid=3640 /usr/bin/wget net send-data guuid=c15df9ba-1600-0000-00e8-c366b80d0000 pid=3512->guuid=7b6c96e5-1600-0000-00e8-c366380e0000 pid=3640 execve guuid=21191de8-1600-0000-00e8-c366410e0000 pid=3649 /usr/bin/curl net send-data write-file guuid=c15df9ba-1600-0000-00e8-c366b80d0000 pid=3512->guuid=21191de8-1600-0000-00e8-c366410e0000 pid=3649 execve guuid=cfc36beb-1600-0000-00e8-c3664b0e0000 pid=3659 /usr/bin/chmod guuid=c15df9ba-1600-0000-00e8-c366b80d0000 pid=3512->guuid=cfc36beb-1600-0000-00e8-c3664b0e0000 pid=3659 execve guuid=4bc4deeb-1600-0000-00e8-c3664d0e0000 pid=3661 /usr/bin/bash guuid=c15df9ba-1600-0000-00e8-c366b80d0000 pid=3512->guuid=4bc4deeb-1600-0000-00e8-c3664d0e0000 pid=3661 clone guuid=68ba27ec-1600-0000-00e8-c366500e0000 pid=3664 /usr/bin/rm delete-file guuid=c15df9ba-1600-0000-00e8-c366b80d0000 pid=3512->guuid=68ba27ec-1600-0000-00e8-c366500e0000 pid=3664 execve guuid=dce882ec-1600-0000-00e8-c366520e0000 pid=3666 /usr/bin/rm guuid=c15df9ba-1600-0000-00e8-c366b80d0000 pid=3512->guuid=dce882ec-1600-0000-00e8-c366520e0000 pid=3666 execve guuid=6237d7ec-1600-0000-00e8-c366540e0000 pid=3668 /usr/bin/wget net send-data guuid=c15df9ba-1600-0000-00e8-c366b80d0000 pid=3512->guuid=6237d7ec-1600-0000-00e8-c366540e0000 pid=3668 execve guuid=84df5fef-1600-0000-00e8-c3665d0e0000 pid=3677 /usr/bin/curl net send-data write-file guuid=c15df9ba-1600-0000-00e8-c366b80d0000 pid=3512->guuid=84df5fef-1600-0000-00e8-c3665d0e0000 pid=3677 execve guuid=f79f4ff3-1600-0000-00e8-c3666f0e0000 pid=3695 /usr/bin/chmod guuid=c15df9ba-1600-0000-00e8-c366b80d0000 pid=3512->guuid=f79f4ff3-1600-0000-00e8-c3666f0e0000 pid=3695 execve guuid=898ff1f3-1600-0000-00e8-c366730e0000 pid=3699 /usr/bin/bash guuid=c15df9ba-1600-0000-00e8-c366b80d0000 pid=3512->guuid=898ff1f3-1600-0000-00e8-c366730e0000 pid=3699 clone guuid=c17a5af4-1600-0000-00e8-c366780e0000 pid=3704 /usr/bin/rm delete-file guuid=c15df9ba-1600-0000-00e8-c366b80d0000 pid=3512->guuid=c17a5af4-1600-0000-00e8-c366780e0000 pid=3704 execve guuid=5107c7f4-1600-0000-00e8-c3667d0e0000 pid=3709 /usr/bin/rm guuid=c15df9ba-1600-0000-00e8-c366b80d0000 pid=3512->guuid=5107c7f4-1600-0000-00e8-c3667d0e0000 pid=3709 execve guuid=451649f5-1600-0000-00e8-c366820e0000 pid=3714 /usr/bin/wget net send-data guuid=c15df9ba-1600-0000-00e8-c366b80d0000 pid=3512->guuid=451649f5-1600-0000-00e8-c366820e0000 pid=3714 execve guuid=1b024ef9-1600-0000-00e8-c366970e0000 pid=3735 /usr/bin/curl net send-data write-file guuid=c15df9ba-1600-0000-00e8-c366b80d0000 pid=3512->guuid=1b024ef9-1600-0000-00e8-c366970e0000 pid=3735 execve guuid=580255fe-1600-0000-00e8-c366a10e0000 pid=3745 /usr/bin/chmod guuid=c15df9ba-1600-0000-00e8-c366b80d0000 pid=3512->guuid=580255fe-1600-0000-00e8-c366a10e0000 pid=3745 execve guuid=b73696fe-1600-0000-00e8-c366a30e0000 pid=3747 /usr/bin/bash guuid=c15df9ba-1600-0000-00e8-c366b80d0000 pid=3512->guuid=b73696fe-1600-0000-00e8-c366a30e0000 pid=3747 clone guuid=057dc7fe-1600-0000-00e8-c366a70e0000 pid=3751 /usr/bin/rm delete-file guuid=c15df9ba-1600-0000-00e8-c366b80d0000 pid=3512->guuid=057dc7fe-1600-0000-00e8-c366a70e0000 pid=3751 execve guuid=9db604ff-1600-0000-00e8-c366a80e0000 pid=3752 /usr/bin/rm guuid=c15df9ba-1600-0000-00e8-c366b80d0000 pid=3512->guuid=9db604ff-1600-0000-00e8-c366a80e0000 pid=3752 execve guuid=ed4763ff-1600-0000-00e8-c366ab0e0000 pid=3755 /usr/bin/wget net send-data guuid=c15df9ba-1600-0000-00e8-c366b80d0000 pid=3512->guuid=ed4763ff-1600-0000-00e8-c366ab0e0000 pid=3755 execve guuid=e9212702-1700-0000-00e8-c366b90e0000 pid=3769 /usr/bin/curl net send-data write-file guuid=c15df9ba-1600-0000-00e8-c366b80d0000 pid=3512->guuid=e9212702-1700-0000-00e8-c366b90e0000 pid=3769 execve guuid=e59edc05-1700-0000-00e8-c366ca0e0000 pid=3786 /usr/bin/chmod guuid=c15df9ba-1600-0000-00e8-c366b80d0000 pid=3512->guuid=e59edc05-1700-0000-00e8-c366ca0e0000 pid=3786 execve guuid=f7ad2106-1700-0000-00e8-c366cc0e0000 pid=3788 /usr/bin/bash guuid=c15df9ba-1600-0000-00e8-c366b80d0000 pid=3512->guuid=f7ad2106-1700-0000-00e8-c366cc0e0000 pid=3788 clone guuid=acee4f06-1700-0000-00e8-c366ce0e0000 pid=3790 /usr/bin/rm delete-file guuid=c15df9ba-1600-0000-00e8-c366b80d0000 pid=3512->guuid=acee4f06-1700-0000-00e8-c366ce0e0000 pid=3790 execve guuid=56ea9606-1700-0000-00e8-c366d00e0000 pid=3792 /usr/bin/rm guuid=c15df9ba-1600-0000-00e8-c366b80d0000 pid=3512->guuid=56ea9606-1700-0000-00e8-c366d00e0000 pid=3792 execve guuid=afdcd206-1700-0000-00e8-c366d20e0000 pid=3794 /usr/bin/wget net send-data guuid=c15df9ba-1600-0000-00e8-c366b80d0000 pid=3512->guuid=afdcd206-1700-0000-00e8-c366d20e0000 pid=3794 execve guuid=7ee76c09-1700-0000-00e8-c366da0e0000 pid=3802 /usr/bin/curl net send-data write-file guuid=c15df9ba-1600-0000-00e8-c366b80d0000 pid=3512->guuid=7ee76c09-1700-0000-00e8-c366da0e0000 pid=3802 execve guuid=bac1640d-1700-0000-00e8-c366eb0e0000 pid=3819 /usr/bin/chmod guuid=c15df9ba-1600-0000-00e8-c366b80d0000 pid=3512->guuid=bac1640d-1700-0000-00e8-c366eb0e0000 pid=3819 execve guuid=c89cdd11-1700-0000-00e8-c366f90e0000 pid=3833 /usr/bin/bash guuid=c15df9ba-1600-0000-00e8-c366b80d0000 pid=3512->guuid=c89cdd11-1700-0000-00e8-c366f90e0000 pid=3833 clone guuid=b32dc512-1700-0000-00e8-c366fd0e0000 pid=3837 /usr/bin/rm delete-file guuid=c15df9ba-1600-0000-00e8-c366b80d0000 pid=3512->guuid=b32dc512-1700-0000-00e8-c366fd0e0000 pid=3837 execve guuid=8a2a5414-1700-0000-00e8-c366010f0000 pid=3841 /usr/bin/rm guuid=c15df9ba-1600-0000-00e8-c366b80d0000 pid=3512->guuid=8a2a5414-1700-0000-00e8-c366010f0000 pid=3841 execve guuid=7fd77315-1700-0000-00e8-c366030f0000 pid=3843 /usr/bin/wget net send-data guuid=c15df9ba-1600-0000-00e8-c366b80d0000 pid=3512->guuid=7fd77315-1700-0000-00e8-c366030f0000 pid=3843 execve guuid=6b5bda1b-1700-0000-00e8-c366130f0000 pid=3859 /usr/bin/curl net send-data write-file guuid=c15df9ba-1600-0000-00e8-c366b80d0000 pid=3512->guuid=6b5bda1b-1700-0000-00e8-c366130f0000 pid=3859 execve guuid=f31fbe20-1700-0000-00e8-c366200f0000 pid=3872 /usr/bin/chmod guuid=c15df9ba-1600-0000-00e8-c366b80d0000 pid=3512->guuid=f31fbe20-1700-0000-00e8-c366200f0000 pid=3872 execve guuid=3fc81621-1700-0000-00e8-c366230f0000 pid=3875 /usr/bin/bash guuid=c15df9ba-1600-0000-00e8-c366b80d0000 pid=3512->guuid=3fc81621-1700-0000-00e8-c366230f0000 pid=3875 clone guuid=7a2f6a22-1700-0000-00e8-c366270f0000 pid=3879 /usr/bin/rm delete-file guuid=c15df9ba-1600-0000-00e8-c366b80d0000 pid=3512->guuid=7a2f6a22-1700-0000-00e8-c366270f0000 pid=3879 execve guuid=70421f23-1700-0000-00e8-c3662b0f0000 pid=3883 /usr/bin/rm guuid=c15df9ba-1600-0000-00e8-c366b80d0000 pid=3512->guuid=70421f23-1700-0000-00e8-c3662b0f0000 pid=3883 execve guuid=5fba0124-1700-0000-00e8-c3662e0f0000 pid=3886 /usr/bin/wget net send-data guuid=c15df9ba-1600-0000-00e8-c366b80d0000 pid=3512->guuid=5fba0124-1700-0000-00e8-c3662e0f0000 pid=3886 execve guuid=fd17f227-1700-0000-00e8-c3663c0f0000 pid=3900 /usr/bin/curl net send-data write-file guuid=c15df9ba-1600-0000-00e8-c366b80d0000 pid=3512->guuid=fd17f227-1700-0000-00e8-c3663c0f0000 pid=3900 execve guuid=45cbc230-1700-0000-00e8-c366570f0000 pid=3927 /usr/bin/chmod guuid=c15df9ba-1600-0000-00e8-c366b80d0000 pid=3512->guuid=45cbc230-1700-0000-00e8-c366570f0000 pid=3927 execve guuid=e13a3131-1700-0000-00e8-c366590f0000 pid=3929 /usr/bin/bash guuid=c15df9ba-1600-0000-00e8-c366b80d0000 pid=3512->guuid=e13a3131-1700-0000-00e8-c366590f0000 pid=3929 clone guuid=abf48231-1700-0000-00e8-c3665c0f0000 pid=3932 /usr/bin/rm delete-file guuid=c15df9ba-1600-0000-00e8-c366b80d0000 pid=3512->guuid=abf48231-1700-0000-00e8-c3665c0f0000 pid=3932 execve guuid=a5cff131-1700-0000-00e8-c366600f0000 pid=3936 /usr/bin/rm guuid=c15df9ba-1600-0000-00e8-c366b80d0000 pid=3512->guuid=a5cff131-1700-0000-00e8-c366600f0000 pid=3936 execve guuid=86242d32-1700-0000-00e8-c366640f0000 pid=3940 /usr/bin/wget net send-data guuid=c15df9ba-1600-0000-00e8-c366b80d0000 pid=3512->guuid=86242d32-1700-0000-00e8-c366640f0000 pid=3940 execve guuid=2cdca034-1700-0000-00e8-c366710f0000 pid=3953 /usr/bin/curl net send-data write-file guuid=c15df9ba-1600-0000-00e8-c366b80d0000 pid=3512->guuid=2cdca034-1700-0000-00e8-c366710f0000 pid=3953 execve guuid=6c034938-1700-0000-00e8-c366790f0000 pid=3961 /usr/bin/chmod guuid=c15df9ba-1600-0000-00e8-c366b80d0000 pid=3512->guuid=6c034938-1700-0000-00e8-c366790f0000 pid=3961 execve guuid=3c1d8e38-1700-0000-00e8-c3667d0f0000 pid=3965 /usr/bin/bash guuid=c15df9ba-1600-0000-00e8-c366b80d0000 pid=3512->guuid=3c1d8e38-1700-0000-00e8-c3667d0f0000 pid=3965 clone guuid=e09fbe38-1700-0000-00e8-c366800f0000 pid=3968 /usr/bin/rm delete-file guuid=c15df9ba-1600-0000-00e8-c366b80d0000 pid=3512->guuid=e09fbe38-1700-0000-00e8-c366800f0000 pid=3968 execve guuid=e37ffd38-1700-0000-00e8-c366820f0000 pid=3970 /usr/bin/rm guuid=c15df9ba-1600-0000-00e8-c366b80d0000 pid=3512->guuid=e37ffd38-1700-0000-00e8-c366820f0000 pid=3970 execve guuid=66f03739-1700-0000-00e8-c366840f0000 pid=3972 /usr/bin/wget net send-data guuid=c15df9ba-1600-0000-00e8-c366b80d0000 pid=3512->guuid=66f03739-1700-0000-00e8-c366840f0000 pid=3972 execve guuid=bef0c33b-1700-0000-00e8-c366900f0000 pid=3984 /usr/bin/curl net send-data write-file guuid=c15df9ba-1600-0000-00e8-c366b80d0000 pid=3512->guuid=bef0c33b-1700-0000-00e8-c366900f0000 pid=3984 execve guuid=c333313f-1700-0000-00e8-c366a10f0000 pid=4001 /usr/bin/chmod guuid=c15df9ba-1600-0000-00e8-c366b80d0000 pid=3512->guuid=c333313f-1700-0000-00e8-c366a10f0000 pid=4001 execve guuid=31fd653f-1700-0000-00e8-c366a30f0000 pid=4003 /usr/bin/bash guuid=c15df9ba-1600-0000-00e8-c366b80d0000 pid=3512->guuid=31fd653f-1700-0000-00e8-c366a30f0000 pid=4003 clone guuid=6f978f3f-1700-0000-00e8-c366a50f0000 pid=4005 /usr/bin/rm delete-file guuid=c15df9ba-1600-0000-00e8-c366b80d0000 pid=3512->guuid=6f978f3f-1700-0000-00e8-c366a50f0000 pid=4005 execve guuid=8c5ac63f-1700-0000-00e8-c366a60f0000 pid=4006 /usr/bin/rm guuid=c15df9ba-1600-0000-00e8-c366b80d0000 pid=3512->guuid=8c5ac63f-1700-0000-00e8-c366a60f0000 pid=4006 execve 5b654972-c9e1-50d8-b372-2dc2a5b9ad66 5.182.210.174:80 guuid=a21e67bb-1600-0000-00e8-c366bb0d0000 pid=3515->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=800539c1-1600-0000-00e8-c366ca0d0000 pid=3530->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=848c3bd2-1600-0000-00e8-c366e40d0000 pid=3556 /usr/bin/bash guuid=cc59e8d1-1600-0000-00e8-c366e10d0000 pid=3553->guuid=848c3bd2-1600-0000-00e8-c366e40d0000 pid=3556 clone guuid=2669fbd3-1600-0000-00e8-c366ea0d0000 pid=3562->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=9daecbd7-1600-0000-00e8-c366ee0d0000 pid=3566->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=1766d1dd-1600-0000-00e8-c366080e0000 pid=3592 /usr/bin/bash guuid=8021bbdd-1600-0000-00e8-c366060e0000 pid=3590->guuid=1766d1dd-1600-0000-00e8-c366080e0000 pid=3592 clone guuid=833a93de-1600-0000-00e8-c3660e0e0000 pid=3598->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=f34ef3e0-1600-0000-00e8-c3661d0e0000 pid=3613->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=ee24cee4-1600-0000-00e8-c366300e0000 pid=3632 /usr/bin/bash guuid=298ab8e4-1600-0000-00e8-c3662f0e0000 pid=3631->guuid=ee24cee4-1600-0000-00e8-c366300e0000 pid=3632 clone guuid=7b6c96e5-1600-0000-00e8-c366380e0000 pid=3640->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=21191de8-1600-0000-00e8-c366410e0000 pid=3649->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=5cef02ec-1600-0000-00e8-c3664f0e0000 pid=3663 /usr/bin/bash guuid=4bc4deeb-1600-0000-00e8-c3664d0e0000 pid=3661->guuid=5cef02ec-1600-0000-00e8-c3664f0e0000 pid=3663 clone guuid=6237d7ec-1600-0000-00e8-c366540e0000 pid=3668->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=84df5fef-1600-0000-00e8-c3665d0e0000 pid=3677->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=55392cf4-1600-0000-00e8-c366750e0000 pid=3701 /usr/bin/bash guuid=898ff1f3-1600-0000-00e8-c366730e0000 pid=3699->guuid=55392cf4-1600-0000-00e8-c366750e0000 pid=3701 clone guuid=451649f5-1600-0000-00e8-c366820e0000 pid=3714->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=1b024ef9-1600-0000-00e8-c366970e0000 pid=3735->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=25b3aafe-1600-0000-00e8-c366a60e0000 pid=3750 /usr/bin/bash guuid=b73696fe-1600-0000-00e8-c366a30e0000 pid=3747->guuid=25b3aafe-1600-0000-00e8-c366a60e0000 pid=3750 clone guuid=ed4763ff-1600-0000-00e8-c366ab0e0000 pid=3755->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=e9212702-1700-0000-00e8-c366b90e0000 pid=3769->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=aa543806-1700-0000-00e8-c366cd0e0000 pid=3789 /usr/bin/bash guuid=f7ad2106-1700-0000-00e8-c366cc0e0000 pid=3788->guuid=aa543806-1700-0000-00e8-c366cd0e0000 pid=3789 clone guuid=afdcd206-1700-0000-00e8-c366d20e0000 pid=3794->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=7ee76c09-1700-0000-00e8-c366da0e0000 pid=3802->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=18523a12-1700-0000-00e8-c366fa0e0000 pid=3834 /usr/bin/bash guuid=c89cdd11-1700-0000-00e8-c366f90e0000 pid=3833->guuid=18523a12-1700-0000-00e8-c366fa0e0000 pid=3834 clone guuid=7fd77315-1700-0000-00e8-c366030f0000 pid=3843->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=6b5bda1b-1700-0000-00e8-c366130f0000 pid=3859->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=7b593621-1700-0000-00e8-c366240f0000 pid=3876 /usr/bin/bash guuid=3fc81621-1700-0000-00e8-c366230f0000 pid=3875->guuid=7b593621-1700-0000-00e8-c366240f0000 pid=3876 clone guuid=5fba0124-1700-0000-00e8-c3662e0f0000 pid=3886->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=fd17f227-1700-0000-00e8-c3663c0f0000 pid=3900->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=dfb25631-1700-0000-00e8-c3665b0f0000 pid=3931 /usr/bin/bash guuid=e13a3131-1700-0000-00e8-c366590f0000 pid=3929->guuid=dfb25631-1700-0000-00e8-c3665b0f0000 pid=3931 clone guuid=86242d32-1700-0000-00e8-c366640f0000 pid=3940->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=2cdca034-1700-0000-00e8-c366710f0000 pid=3953->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=286ba138-1700-0000-00e8-c3667e0f0000 pid=3966 /usr/bin/bash guuid=3c1d8e38-1700-0000-00e8-c3667d0f0000 pid=3965->guuid=286ba138-1700-0000-00e8-c3667e0f0000 pid=3966 clone guuid=66f03739-1700-0000-00e8-c366840f0000 pid=3972->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=bef0c33b-1700-0000-00e8-c366900f0000 pid=3984->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=373d7b3f-1700-0000-00e8-c366a40f0000 pid=4004 /usr/bin/bash guuid=31fd653f-1700-0000-00e8-c366a30f0000 pid=4003->guuid=373d7b3f-1700-0000-00e8-c366a40f0000 pid=4004 clone
Score:
99%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/db7c84a407766eea064a05a1ba35aebac84fb3948409b9b79ab03adde44aaecc
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/db7c84a407766eea064a05a1ba35aebac84fb3948409b9b79ab03adde44aaecc/
Threat name:
Win32.Trojan.Egairtigado
Create hunting rule
Status:
Malicious
First seen:
2026-08-27 22:19:16 UTC
File Type:
Text (Shell)
AV detection:
10 of 23 (43.48%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3n6ijjahozxoubskawq3unnoxlee7m4uqqe3tn42wa5n3zckv3ga._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260827-18krsa1dra/
Behaviour
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.34
Link:
https://yomi.yoroi.company/submissions/db7c84a407766eea064a05a1ba35aebac84fb3948409b9b79ab03adde44aaecc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh db7c84a407766eea064a05a1ba35aebac84fb3948409b9b79ab03adde44aaecc

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3897671/
  
Delivery method
Distributed via web download

Comments