MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dcf0da9a4f8f4a7d5b66de5169b62b343572b31ca4e77dda487760da484d0404. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dcf0da9a4f8f4a7d5b66de5169b62b343572b31ca4e77dda487760da484d0404
SHA3-384 hash: 2a6be9a48532be6c27af36dbdc06d3973d8be3c67d3920c17167fbdc5501a5f273fd08c900b781f5c33bbc12bd6064f9
SHA1 hash: ff91b25eefb76c86fa459b5d5053b06fd989c7bf
MD5 hash: 165ffa475681469ac4fadf2b11618675
humanhash: nine-king-aspen-magnesium
File name:ok
Download: download sample
File size:1'608 bytes
First seen:2026-08-09 13:14:16 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 24:aQM5RmkcdEbq0J7r8XcdEfZT/6dkav/B4LwF5:yRmkcdEbq0988EIkav53
TLSH T1D03140DA05105A311153CE8D726336C8669DA6F7189FD7D4EC881EEA828AA8CF261F4D
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh

Intelligence

File Origin
# of uploads :
1
# of downloads :
37
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive
Link:
https://www.filescan.io/uploads/6a787d3b750d670a1ccb4218/reports/185f3818-2b1c-4af3-b6b1-417f565d6446/overview
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/080eb168-69b3-4e6d-a114-5f7f17eedddb
Behavior Graph:
Download SVG
%3 guuid=8c91cbfc-1a00-0000-40cd-5dcb2b0a0000 pid=2603 /usr/bin/sudo guuid=b07b2100-1b00-0000-40cd-5dcb310a0000 pid=2609 /tmp/sample.bin guuid=8c91cbfc-1a00-0000-40cd-5dcb2b0a0000 pid=2603->guuid=b07b2100-1b00-0000-40cd-5dcb310a0000 pid=2609 execve guuid=1841fc00-1b00-0000-40cd-5dcb340a0000 pid=2612 /usr/bin/wget net send-data guuid=b07b2100-1b00-0000-40cd-5dcb310a0000 pid=2609->guuid=1841fc00-1b00-0000-40cd-5dcb340a0000 pid=2612 execve guuid=7ce55a05-1b00-0000-40cd-5dcb400a0000 pid=2624 /usr/bin/curl net send-data write-file guuid=b07b2100-1b00-0000-40cd-5dcb310a0000 pid=2609->guuid=7ce55a05-1b00-0000-40cd-5dcb400a0000 pid=2624 execve guuid=13c7e10e-1b00-0000-40cd-5dcb510a0000 pid=2641 /usr/bin/chmod guuid=b07b2100-1b00-0000-40cd-5dcb310a0000 pid=2609->guuid=13c7e10e-1b00-0000-40cd-5dcb510a0000 pid=2641 execve guuid=15b6940f-1b00-0000-40cd-5dcb520a0000 pid=2642 /usr/bin/bash guuid=b07b2100-1b00-0000-40cd-5dcb310a0000 pid=2609->guuid=15b6940f-1b00-0000-40cd-5dcb520a0000 pid=2642 clone guuid=0b021f10-1b00-0000-40cd-5dcb540a0000 pid=2644 /usr/bin/rm delete-file guuid=b07b2100-1b00-0000-40cd-5dcb310a0000 pid=2609->guuid=0b021f10-1b00-0000-40cd-5dcb540a0000 pid=2644 execve guuid=5607d810-1b00-0000-40cd-5dcb550a0000 pid=2645 /usr/bin/rm guuid=b07b2100-1b00-0000-40cd-5dcb310a0000 pid=2609->guuid=5607d810-1b00-0000-40cd-5dcb550a0000 pid=2645 execve guuid=7c058f11-1b00-0000-40cd-5dcb560a0000 pid=2646 /usr/bin/wget net send-data guuid=b07b2100-1b00-0000-40cd-5dcb310a0000 pid=2609->guuid=7c058f11-1b00-0000-40cd-5dcb560a0000 pid=2646 execve guuid=98eb0015-1b00-0000-40cd-5dcb5b0a0000 pid=2651 /usr/bin/curl net send-data write-file guuid=b07b2100-1b00-0000-40cd-5dcb310a0000 pid=2609->guuid=98eb0015-1b00-0000-40cd-5dcb5b0a0000 pid=2651 execve guuid=aa4b971c-1b00-0000-40cd-5dcb670a0000 pid=2663 /usr/bin/chmod guuid=b07b2100-1b00-0000-40cd-5dcb310a0000 pid=2609->guuid=aa4b971c-1b00-0000-40cd-5dcb670a0000 pid=2663 execve guuid=23532d1d-1b00-0000-40cd-5dcb690a0000 pid=2665 /usr/bin/bash guuid=b07b2100-1b00-0000-40cd-5dcb310a0000 pid=2609->guuid=23532d1d-1b00-0000-40cd-5dcb690a0000 pid=2665 clone guuid=d69d861d-1b00-0000-40cd-5dcb6b0a0000 pid=2667 /usr/bin/rm delete-file guuid=b07b2100-1b00-0000-40cd-5dcb310a0000 pid=2609->guuid=d69d861d-1b00-0000-40cd-5dcb6b0a0000 pid=2667 execve guuid=ff76031e-1b00-0000-40cd-5dcb6d0a0000 pid=2669 /usr/bin/rm guuid=b07b2100-1b00-0000-40cd-5dcb310a0000 pid=2609->guuid=ff76031e-1b00-0000-40cd-5dcb6d0a0000 pid=2669 execve guuid=57766b1e-1b00-0000-40cd-5dcb6f0a0000 pid=2671 /usr/bin/wget net send-data guuid=b07b2100-1b00-0000-40cd-5dcb310a0000 pid=2609->guuid=57766b1e-1b00-0000-40cd-5dcb6f0a0000 pid=2671 execve guuid=d1dc3121-1b00-0000-40cd-5dcb740a0000 pid=2676 /usr/bin/curl net send-data write-file guuid=b07b2100-1b00-0000-40cd-5dcb310a0000 pid=2609->guuid=d1dc3121-1b00-0000-40cd-5dcb740a0000 pid=2676 execve guuid=204d8926-1b00-0000-40cd-5dcb800a0000 pid=2688 /usr/bin/chmod guuid=b07b2100-1b00-0000-40cd-5dcb310a0000 pid=2609->guuid=204d8926-1b00-0000-40cd-5dcb800a0000 pid=2688 execve guuid=6a17f426-1b00-0000-40cd-5dcb820a0000 pid=2690 /usr/bin/bash guuid=b07b2100-1b00-0000-40cd-5dcb310a0000 pid=2609->guuid=6a17f426-1b00-0000-40cd-5dcb820a0000 pid=2690 clone guuid=c82f2d27-1b00-0000-40cd-5dcb840a0000 pid=2692 /usr/bin/rm delete-file guuid=b07b2100-1b00-0000-40cd-5dcb310a0000 pid=2609->guuid=c82f2d27-1b00-0000-40cd-5dcb840a0000 pid=2692 execve guuid=4a5d7027-1b00-0000-40cd-5dcb860a0000 pid=2694 /usr/bin/rm guuid=b07b2100-1b00-0000-40cd-5dcb310a0000 pid=2609->guuid=4a5d7027-1b00-0000-40cd-5dcb860a0000 pid=2694 execve guuid=387cbe27-1b00-0000-40cd-5dcb870a0000 pid=2695 /usr/bin/wget net send-data guuid=b07b2100-1b00-0000-40cd-5dcb310a0000 pid=2609->guuid=387cbe27-1b00-0000-40cd-5dcb870a0000 pid=2695 execve guuid=fa0ded2a-1b00-0000-40cd-5dcb8c0a0000 pid=2700 /usr/bin/curl net send-data write-file guuid=b07b2100-1b00-0000-40cd-5dcb310a0000 pid=2609->guuid=fa0ded2a-1b00-0000-40cd-5dcb8c0a0000 pid=2700 execve guuid=70268e2f-1b00-0000-40cd-5dcb8f0a0000 pid=2703 /usr/bin/chmod guuid=b07b2100-1b00-0000-40cd-5dcb310a0000 pid=2609->guuid=70268e2f-1b00-0000-40cd-5dcb8f0a0000 pid=2703 execve guuid=a43fe92f-1b00-0000-40cd-5dcb910a0000 pid=2705 /usr/bin/bash guuid=b07b2100-1b00-0000-40cd-5dcb310a0000 pid=2609->guuid=a43fe92f-1b00-0000-40cd-5dcb910a0000 pid=2705 clone guuid=2c3f3630-1b00-0000-40cd-5dcb940a0000 pid=2708 /usr/bin/rm delete-file guuid=b07b2100-1b00-0000-40cd-5dcb310a0000 pid=2609->guuid=2c3f3630-1b00-0000-40cd-5dcb940a0000 pid=2708 execve guuid=73d28930-1b00-0000-40cd-5dcb960a0000 pid=2710 /usr/bin/rm guuid=b07b2100-1b00-0000-40cd-5dcb310a0000 pid=2609->guuid=73d28930-1b00-0000-40cd-5dcb960a0000 pid=2710 execve guuid=5262f130-1b00-0000-40cd-5dcb980a0000 pid=2712 /usr/bin/wget net send-data guuid=b07b2100-1b00-0000-40cd-5dcb310a0000 pid=2609->guuid=5262f130-1b00-0000-40cd-5dcb980a0000 pid=2712 execve guuid=791d5d33-1b00-0000-40cd-5dcba00a0000 pid=2720 /usr/bin/curl net send-data write-file guuid=b07b2100-1b00-0000-40cd-5dcb310a0000 pid=2609->guuid=791d5d33-1b00-0000-40cd-5dcba00a0000 pid=2720 execve guuid=a2541b3a-1b00-0000-40cd-5dcba90a0000 pid=2729 /usr/bin/chmod guuid=b07b2100-1b00-0000-40cd-5dcb310a0000 pid=2609->guuid=a2541b3a-1b00-0000-40cd-5dcba90a0000 pid=2729 execve guuid=0896583a-1b00-0000-40cd-5dcbab0a0000 pid=2731 /usr/bin/bash guuid=b07b2100-1b00-0000-40cd-5dcb310a0000 pid=2609->guuid=0896583a-1b00-0000-40cd-5dcbab0a0000 pid=2731 clone guuid=41a9873a-1b00-0000-40cd-5dcbad0a0000 pid=2733 /usr/bin/rm delete-file guuid=b07b2100-1b00-0000-40cd-5dcb310a0000 pid=2609->guuid=41a9873a-1b00-0000-40cd-5dcbad0a0000 pid=2733 execve guuid=38c5c13a-1b00-0000-40cd-5dcbaf0a0000 pid=2735 /usr/bin/rm guuid=b07b2100-1b00-0000-40cd-5dcb310a0000 pid=2609->guuid=38c5c13a-1b00-0000-40cd-5dcbaf0a0000 pid=2735 execve guuid=06f0fa3a-1b00-0000-40cd-5dcbb00a0000 pid=2736 /usr/bin/wget net send-data guuid=b07b2100-1b00-0000-40cd-5dcb310a0000 pid=2609->guuid=06f0fa3a-1b00-0000-40cd-5dcbb00a0000 pid=2736 execve guuid=3d2dfa40-1b00-0000-40cd-5dcbb80a0000 pid=2744 /usr/bin/curl net send-data write-file guuid=b07b2100-1b00-0000-40cd-5dcb310a0000 pid=2609->guuid=3d2dfa40-1b00-0000-40cd-5dcbb80a0000 pid=2744 execve guuid=ef54bf48-1b00-0000-40cd-5dcbca0a0000 pid=2762 /usr/bin/chmod guuid=b07b2100-1b00-0000-40cd-5dcb310a0000 pid=2609->guuid=ef54bf48-1b00-0000-40cd-5dcbca0a0000 pid=2762 execve guuid=d0102a49-1b00-0000-40cd-5dcbcd0a0000 pid=2765 /usr/bin/bash guuid=b07b2100-1b00-0000-40cd-5dcb310a0000 pid=2609->guuid=d0102a49-1b00-0000-40cd-5dcbcd0a0000 pid=2765 clone guuid=b8f27b49-1b00-0000-40cd-5dcbd00a0000 pid=2768 /usr/bin/rm delete-file guuid=b07b2100-1b00-0000-40cd-5dcb310a0000 pid=2609->guuid=b8f27b49-1b00-0000-40cd-5dcbd00a0000 pid=2768 execve guuid=3b0c264e-1b00-0000-40cd-5dcbdb0a0000 pid=2779 /usr/bin/rm guuid=b07b2100-1b00-0000-40cd-5dcb310a0000 pid=2609->guuid=3b0c264e-1b00-0000-40cd-5dcbdb0a0000 pid=2779 execve guuid=ed0b0b4f-1b00-0000-40cd-5dcbde0a0000 pid=2782 /usr/bin/wget net send-data guuid=b07b2100-1b00-0000-40cd-5dcb310a0000 pid=2609->guuid=ed0b0b4f-1b00-0000-40cd-5dcbde0a0000 pid=2782 execve guuid=b7525d53-1b00-0000-40cd-5dcbeb0a0000 pid=2795 /usr/bin/curl net send-data write-file guuid=b07b2100-1b00-0000-40cd-5dcb310a0000 pid=2609->guuid=b7525d53-1b00-0000-40cd-5dcbeb0a0000 pid=2795 execve guuid=a45e575a-1b00-0000-40cd-5dcbfc0a0000 pid=2812 /usr/bin/chmod guuid=b07b2100-1b00-0000-40cd-5dcb310a0000 pid=2609->guuid=a45e575a-1b00-0000-40cd-5dcbfc0a0000 pid=2812 execve guuid=0962ed5b-1b00-0000-40cd-5dcb020b0000 pid=2818 /usr/bin/bash guuid=b07b2100-1b00-0000-40cd-5dcb310a0000 pid=2609->guuid=0962ed5b-1b00-0000-40cd-5dcb020b0000 pid=2818 clone guuid=83b2535c-1b00-0000-40cd-5dcb070b0000 pid=2823 /usr/bin/rm delete-file guuid=b07b2100-1b00-0000-40cd-5dcb310a0000 pid=2609->guuid=83b2535c-1b00-0000-40cd-5dcb070b0000 pid=2823 execve guuid=ad4fa75c-1b00-0000-40cd-5dcb080b0000 pid=2824 /usr/bin/rm guuid=b07b2100-1b00-0000-40cd-5dcb310a0000 pid=2609->guuid=ad4fa75c-1b00-0000-40cd-5dcb080b0000 pid=2824 execve guuid=93ad065d-1b00-0000-40cd-5dcb090b0000 pid=2825 /usr/bin/wget net send-data guuid=b07b2100-1b00-0000-40cd-5dcb310a0000 pid=2609->guuid=93ad065d-1b00-0000-40cd-5dcb090b0000 pid=2825 execve guuid=0f4ff45f-1b00-0000-40cd-5dcb110b0000 pid=2833 /usr/bin/curl net send-data write-file guuid=b07b2100-1b00-0000-40cd-5dcb310a0000 pid=2609->guuid=0f4ff45f-1b00-0000-40cd-5dcb110b0000 pid=2833 execve guuid=8257c965-1b00-0000-40cd-5dcb1a0b0000 pid=2842 /usr/bin/chmod guuid=b07b2100-1b00-0000-40cd-5dcb310a0000 pid=2609->guuid=8257c965-1b00-0000-40cd-5dcb1a0b0000 pid=2842 execve guuid=85252f66-1b00-0000-40cd-5dcb1c0b0000 pid=2844 /usr/bin/bash guuid=b07b2100-1b00-0000-40cd-5dcb310a0000 pid=2609->guuid=85252f66-1b00-0000-40cd-5dcb1c0b0000 pid=2844 clone guuid=add17266-1b00-0000-40cd-5dcb200b0000 pid=2848 /usr/bin/rm delete-file guuid=b07b2100-1b00-0000-40cd-5dcb310a0000 pid=2609->guuid=add17266-1b00-0000-40cd-5dcb200b0000 pid=2848 execve guuid=9681bc66-1b00-0000-40cd-5dcb220b0000 pid=2850 /usr/bin/rm guuid=b07b2100-1b00-0000-40cd-5dcb310a0000 pid=2609->guuid=9681bc66-1b00-0000-40cd-5dcb220b0000 pid=2850 execve guuid=d9811967-1b00-0000-40cd-5dcb240b0000 pid=2852 /usr/bin/wget net send-data guuid=b07b2100-1b00-0000-40cd-5dcb310a0000 pid=2609->guuid=d9811967-1b00-0000-40cd-5dcb240b0000 pid=2852 execve guuid=d5bfb069-1b00-0000-40cd-5dcb290b0000 pid=2857 /usr/bin/curl net send-data write-file guuid=b07b2100-1b00-0000-40cd-5dcb310a0000 pid=2609->guuid=d5bfb069-1b00-0000-40cd-5dcb290b0000 pid=2857 execve guuid=a18ef66e-1b00-0000-40cd-5dcb2d0b0000 pid=2861 /usr/bin/chmod guuid=b07b2100-1b00-0000-40cd-5dcb310a0000 pid=2609->guuid=a18ef66e-1b00-0000-40cd-5dcb2d0b0000 pid=2861 execve guuid=b3998b6f-1b00-0000-40cd-5dcb300b0000 pid=2864 /usr/bin/bash guuid=b07b2100-1b00-0000-40cd-5dcb310a0000 pid=2609->guuid=b3998b6f-1b00-0000-40cd-5dcb300b0000 pid=2864 clone guuid=2648e76f-1b00-0000-40cd-5dcb330b0000 pid=2867 /usr/bin/rm delete-file guuid=b07b2100-1b00-0000-40cd-5dcb310a0000 pid=2609->guuid=2648e76f-1b00-0000-40cd-5dcb330b0000 pid=2867 execve guuid=47349670-1b00-0000-40cd-5dcb350b0000 pid=2869 /usr/bin/rm guuid=b07b2100-1b00-0000-40cd-5dcb310a0000 pid=2609->guuid=47349670-1b00-0000-40cd-5dcb350b0000 pid=2869 execve guuid=33e43871-1b00-0000-40cd-5dcb370b0000 pid=2871 /usr/bin/wget net send-data guuid=b07b2100-1b00-0000-40cd-5dcb310a0000 pid=2609->guuid=33e43871-1b00-0000-40cd-5dcb370b0000 pid=2871 execve guuid=6dab9675-1b00-0000-40cd-5dcb3f0b0000 pid=2879 /usr/bin/curl net send-data write-file guuid=b07b2100-1b00-0000-40cd-5dcb310a0000 pid=2609->guuid=6dab9675-1b00-0000-40cd-5dcb3f0b0000 pid=2879 execve guuid=2dfb1b7b-1b00-0000-40cd-5dcb480b0000 pid=2888 /usr/bin/chmod guuid=b07b2100-1b00-0000-40cd-5dcb310a0000 pid=2609->guuid=2dfb1b7b-1b00-0000-40cd-5dcb480b0000 pid=2888 execve guuid=94368d7b-1b00-0000-40cd-5dcb4a0b0000 pid=2890 /usr/bin/bash guuid=b07b2100-1b00-0000-40cd-5dcb310a0000 pid=2609->guuid=94368d7b-1b00-0000-40cd-5dcb4a0b0000 pid=2890 clone guuid=0ea5e17b-1b00-0000-40cd-5dcb4d0b0000 pid=2893 /usr/bin/rm delete-file guuid=b07b2100-1b00-0000-40cd-5dcb310a0000 pid=2609->guuid=0ea5e17b-1b00-0000-40cd-5dcb4d0b0000 pid=2893 execve guuid=63c3657c-1b00-0000-40cd-5dcb4f0b0000 pid=2895 /usr/bin/rm guuid=b07b2100-1b00-0000-40cd-5dcb310a0000 pid=2609->guuid=63c3657c-1b00-0000-40cd-5dcb4f0b0000 pid=2895 execve guuid=b2e8ea7c-1b00-0000-40cd-5dcb520b0000 pid=2898 /usr/bin/wget net send-data guuid=b07b2100-1b00-0000-40cd-5dcb310a0000 pid=2609->guuid=b2e8ea7c-1b00-0000-40cd-5dcb520b0000 pid=2898 execve guuid=321c3f80-1b00-0000-40cd-5dcb5a0b0000 pid=2906 /usr/bin/curl net send-data write-file guuid=b07b2100-1b00-0000-40cd-5dcb310a0000 pid=2609->guuid=321c3f80-1b00-0000-40cd-5dcb5a0b0000 pid=2906 execve guuid=795d5085-1b00-0000-40cd-5dcb680b0000 pid=2920 /usr/bin/chmod guuid=b07b2100-1b00-0000-40cd-5dcb310a0000 pid=2609->guuid=795d5085-1b00-0000-40cd-5dcb680b0000 pid=2920 execve guuid=6c82ad85-1b00-0000-40cd-5dcb690b0000 pid=2921 /usr/bin/bash guuid=b07b2100-1b00-0000-40cd-5dcb310a0000 pid=2609->guuid=6c82ad85-1b00-0000-40cd-5dcb690b0000 pid=2921 clone guuid=a72c2086-1b00-0000-40cd-5dcb6b0b0000 pid=2923 /usr/bin/rm delete-file guuid=b07b2100-1b00-0000-40cd-5dcb310a0000 pid=2609->guuid=a72c2086-1b00-0000-40cd-5dcb6b0b0000 pid=2923 execve guuid=eccd8286-1b00-0000-40cd-5dcb6c0b0000 pid=2924 /usr/bin/rm guuid=b07b2100-1b00-0000-40cd-5dcb310a0000 pid=2609->guuid=eccd8286-1b00-0000-40cd-5dcb6c0b0000 pid=2924 execve guuid=219ac286-1b00-0000-40cd-5dcb6e0b0000 pid=2926 /usr/bin/wget net send-data guuid=b07b2100-1b00-0000-40cd-5dcb310a0000 pid=2609->guuid=219ac286-1b00-0000-40cd-5dcb6e0b0000 pid=2926 execve guuid=ae258489-1b00-0000-40cd-5dcb730b0000 pid=2931 /usr/bin/curl net send-data write-file guuid=b07b2100-1b00-0000-40cd-5dcb310a0000 pid=2609->guuid=ae258489-1b00-0000-40cd-5dcb730b0000 pid=2931 execve guuid=99ee7a8d-1b00-0000-40cd-5dcb800b0000 pid=2944 /usr/bin/chmod guuid=b07b2100-1b00-0000-40cd-5dcb310a0000 pid=2609->guuid=99ee7a8d-1b00-0000-40cd-5dcb800b0000 pid=2944 execve guuid=8624cf8d-1b00-0000-40cd-5dcb810b0000 pid=2945 /usr/bin/bash guuid=b07b2100-1b00-0000-40cd-5dcb310a0000 pid=2609->guuid=8624cf8d-1b00-0000-40cd-5dcb810b0000 pid=2945 clone guuid=bac20f8e-1b00-0000-40cd-5dcb840b0000 pid=2948 /usr/bin/rm delete-file guuid=b07b2100-1b00-0000-40cd-5dcb310a0000 pid=2609->guuid=bac20f8e-1b00-0000-40cd-5dcb840b0000 pid=2948 execve guuid=ef65538e-1b00-0000-40cd-5dcb850b0000 pid=2949 /usr/bin/rm guuid=b07b2100-1b00-0000-40cd-5dcb310a0000 pid=2609->guuid=ef65538e-1b00-0000-40cd-5dcb850b0000 pid=2949 execve 5b654972-c9e1-50d8-b372-2dc2a5b9ad66 5.182.210.174:80 guuid=1841fc00-1b00-0000-40cd-5dcb340a0000 pid=2612->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=7ce55a05-1b00-0000-40cd-5dcb400a0000 pid=2624->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=d741da0f-1b00-0000-40cd-5dcb530a0000 pid=2643 /usr/bin/bash guuid=15b6940f-1b00-0000-40cd-5dcb520a0000 pid=2642->guuid=d741da0f-1b00-0000-40cd-5dcb530a0000 pid=2643 clone guuid=7c058f11-1b00-0000-40cd-5dcb560a0000 pid=2646->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=98eb0015-1b00-0000-40cd-5dcb5b0a0000 pid=2651->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=dc6b5e1d-1b00-0000-40cd-5dcb6a0a0000 pid=2666 /usr/bin/bash guuid=23532d1d-1b00-0000-40cd-5dcb690a0000 pid=2665->guuid=dc6b5e1d-1b00-0000-40cd-5dcb6a0a0000 pid=2666 clone guuid=57766b1e-1b00-0000-40cd-5dcb6f0a0000 pid=2671->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=d1dc3121-1b00-0000-40cd-5dcb740a0000 pid=2676->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=55881227-1b00-0000-40cd-5dcb830a0000 pid=2691 /usr/bin/bash guuid=6a17f426-1b00-0000-40cd-5dcb820a0000 pid=2690->guuid=55881227-1b00-0000-40cd-5dcb830a0000 pid=2691 clone guuid=387cbe27-1b00-0000-40cd-5dcb870a0000 pid=2695->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=fa0ded2a-1b00-0000-40cd-5dcb8c0a0000 pid=2700->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=3db50c30-1b00-0000-40cd-5dcb920a0000 pid=2706 /usr/bin/bash guuid=a43fe92f-1b00-0000-40cd-5dcb910a0000 pid=2705->guuid=3db50c30-1b00-0000-40cd-5dcb920a0000 pid=2706 clone guuid=5262f130-1b00-0000-40cd-5dcb980a0000 pid=2712->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=791d5d33-1b00-0000-40cd-5dcba00a0000 pid=2720->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=c2d56d3a-1b00-0000-40cd-5dcbac0a0000 pid=2732 /usr/bin/bash guuid=0896583a-1b00-0000-40cd-5dcbab0a0000 pid=2731->guuid=c2d56d3a-1b00-0000-40cd-5dcbac0a0000 pid=2732 clone guuid=06f0fa3a-1b00-0000-40cd-5dcbb00a0000 pid=2736->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=3d2dfa40-1b00-0000-40cd-5dcbb80a0000 pid=2744->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=e9054f49-1b00-0000-40cd-5dcbce0a0000 pid=2766 /usr/bin/bash guuid=d0102a49-1b00-0000-40cd-5dcbcd0a0000 pid=2765->guuid=e9054f49-1b00-0000-40cd-5dcbce0a0000 pid=2766 clone guuid=ed0b0b4f-1b00-0000-40cd-5dcbde0a0000 pid=2782->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=b7525d53-1b00-0000-40cd-5dcbeb0a0000 pid=2795->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=22dc235c-1b00-0000-40cd-5dcb030b0000 pid=2819 /usr/bin/bash guuid=0962ed5b-1b00-0000-40cd-5dcb020b0000 pid=2818->guuid=22dc235c-1b00-0000-40cd-5dcb030b0000 pid=2819 clone guuid=93ad065d-1b00-0000-40cd-5dcb090b0000 pid=2825->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=0f4ff45f-1b00-0000-40cd-5dcb110b0000 pid=2833->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=f2224d66-1b00-0000-40cd-5dcb1e0b0000 pid=2846 /usr/bin/bash guuid=85252f66-1b00-0000-40cd-5dcb1c0b0000 pid=2844->guuid=f2224d66-1b00-0000-40cd-5dcb1e0b0000 pid=2846 clone guuid=d9811967-1b00-0000-40cd-5dcb240b0000 pid=2852->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=d5bfb069-1b00-0000-40cd-5dcb290b0000 pid=2857->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=19b0ad6f-1b00-0000-40cd-5dcb310b0000 pid=2865 /usr/bin/bash guuid=b3998b6f-1b00-0000-40cd-5dcb300b0000 pid=2864->guuid=19b0ad6f-1b00-0000-40cd-5dcb310b0000 pid=2865 clone guuid=33e43871-1b00-0000-40cd-5dcb370b0000 pid=2871->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=6dab9675-1b00-0000-40cd-5dcb3f0b0000 pid=2879->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=edc6ac7b-1b00-0000-40cd-5dcb4c0b0000 pid=2892 /usr/bin/bash guuid=94368d7b-1b00-0000-40cd-5dcb4a0b0000 pid=2890->guuid=edc6ac7b-1b00-0000-40cd-5dcb4c0b0000 pid=2892 clone guuid=b2e8ea7c-1b00-0000-40cd-5dcb520b0000 pid=2898->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=321c3f80-1b00-0000-40cd-5dcb5a0b0000 pid=2906->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=e81ed385-1b00-0000-40cd-5dcb6a0b0000 pid=2922 /usr/bin/bash guuid=6c82ad85-1b00-0000-40cd-5dcb690b0000 pid=2921->guuid=e81ed385-1b00-0000-40cd-5dcb6a0b0000 pid=2922 clone guuid=219ac286-1b00-0000-40cd-5dcb6e0b0000 pid=2926->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=ae258489-1b00-0000-40cd-5dcb730b0000 pid=2931->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=d0b3eb8d-1b00-0000-40cd-5dcb830b0000 pid=2947 /usr/bin/bash guuid=8624cf8d-1b00-0000-40cd-5dcb810b0000 pid=2945->guuid=d0b3eb8d-1b00-0000-40cd-5dcb830b0000 pid=2947 clone
Score:
99%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/dcf0da9a4f8f4a7d5b66de5169b62b343572b31ca4e77dda487760da484d0404
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/dcf0da9a4f8f4a7d5b66de5169b62b343572b31ca4e77dda487760da484d0404/
Gathering data
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3tynvgspr5fh2w3g3ziwtnrlgq2xfmy4uttx3wsio5qnuscnaqca._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260809-qgw1ma1xh1/
Behaviour
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.11
Link:
https://yomi.yoroi.company/submissions/dcf0da9a4f8f4a7d5b66de5169b62b343572b31ca4e77dda487760da484d0404

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh dcf0da9a4f8f4a7d5b66de5169b62b343572b31ca4e77dda487760da484d0404

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3897671/
  
Delivery method
Distributed via web download

Comments