MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e0e2e7ce1b38f04d6e20e22cb25915bdc4e1cc90f08e7114243ceadffa9e4a59. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e0e2e7ce1b38f04d6e20e22cb25915bdc4e1cc90f08e7114243ceadffa9e4a59
SHA3-384 hash: 41b907a147e74d1087b2423bdbaebfb8a541c30046d815b698aa92ebcb7f5989ba5b79c949fa565b00921110fed2e7a1
SHA1 hash: f95ced71807acae9f84e03b71163d1c6e900d681
MD5 hash: c33b6d076a762fdce6f982c00841feeb
humanhash: quebec-seventeen-illinois-harry
File name:p
Download: download sample
File size:835 bytes
First seen:2026-07-20 00:47:01 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 24:kXCKysE2hi0ziQvZohaSEDq/9aZD/PI7JmUwwFY7:e9Qp+MsSEK+3KZY7
TLSH T116016BDA8640AD004019D95D229B5194B821D3CF1A8B4FB87F9C5D3EFB88814F06BFA4
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://129.121.114.124/00Jn/an/aua-wget
http://129.121.114.124/4bXn/an/aua-wget
http://129.121.114.124/Frztn/an/aua-wget
http://129.121.114.124/6qUn/an/aua-wget
http://129.121.114.124/jIQQn/an/aua-wget

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive mirai
Link:
https://www.filescan.io/uploads/6a5d702396ec53402bec0ad0/reports/0bd4451a-78e6-420a-b193-0a0c138c16c8/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-07-19T22:32:00Z UTC
Last seen:
2026-07-21T17:25:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/e0e2e7ce1b38f04d6e20e22cb25915bdc4e1cc90f08e7114243ceadffa9e4a59/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/5eeafe68-aa45-407a-b817-7fcae00a5e3a
Behavior Graph:
Download SVG
%3 guuid=a382c6ff-1600-0000-70b2-af33760c0000 pid=3190 /usr/bin/sudo guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197 /tmp/sample.bin write-file guuid=a382c6ff-1600-0000-70b2-af33760c0000 pid=3190->guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197 execve guuid=1b2f6602-1700-0000-70b2-af337f0c0000 pid=3199 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=1b2f6602-1700-0000-70b2-af337f0c0000 pid=3199 execve guuid=0180d702-1700-0000-70b2-af33810c0000 pid=3201 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=0180d702-1700-0000-70b2-af33810c0000 pid=3201 execve guuid=9ae45703-1700-0000-70b2-af33840c0000 pid=3204 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=9ae45703-1700-0000-70b2-af33840c0000 pid=3204 execve guuid=eddec503-1700-0000-70b2-af33860c0000 pid=3206 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=eddec503-1700-0000-70b2-af33860c0000 pid=3206 execve guuid=12a33404-1700-0000-70b2-af33880c0000 pid=3208 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=12a33404-1700-0000-70b2-af33880c0000 pid=3208 execve guuid=bb1eab04-1700-0000-70b2-af338a0c0000 pid=3210 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=bb1eab04-1700-0000-70b2-af338a0c0000 pid=3210 execve guuid=0cc23805-1700-0000-70b2-af338b0c0000 pid=3211 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=0cc23805-1700-0000-70b2-af338b0c0000 pid=3211 execve guuid=f2cbaf05-1700-0000-70b2-af338c0c0000 pid=3212 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=f2cbaf05-1700-0000-70b2-af338c0c0000 pid=3212 execve guuid=a1361506-1700-0000-70b2-af338e0c0000 pid=3214 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=a1361506-1700-0000-70b2-af338e0c0000 pid=3214 execve guuid=3d298006-1700-0000-70b2-af33900c0000 pid=3216 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=3d298006-1700-0000-70b2-af33900c0000 pid=3216 execve guuid=7b53ec06-1700-0000-70b2-af33920c0000 pid=3218 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=7b53ec06-1700-0000-70b2-af33920c0000 pid=3218 execve guuid=9b9e5807-1700-0000-70b2-af33930c0000 pid=3219 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=9b9e5807-1700-0000-70b2-af33930c0000 pid=3219 execve guuid=d6a3b307-1700-0000-70b2-af33950c0000 pid=3221 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=d6a3b307-1700-0000-70b2-af33950c0000 pid=3221 execve guuid=79940e08-1700-0000-70b2-af33970c0000 pid=3223 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=79940e08-1700-0000-70b2-af33970c0000 pid=3223 execve guuid=562c6b08-1700-0000-70b2-af33990c0000 pid=3225 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=562c6b08-1700-0000-70b2-af33990c0000 pid=3225 execve guuid=98acd608-1700-0000-70b2-af339a0c0000 pid=3226 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=98acd608-1700-0000-70b2-af339a0c0000 pid=3226 execve guuid=09d25009-1700-0000-70b2-af339b0c0000 pid=3227 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=09d25009-1700-0000-70b2-af339b0c0000 pid=3227 execve guuid=de91bc09-1700-0000-70b2-af339d0c0000 pid=3229 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=de91bc09-1700-0000-70b2-af339d0c0000 pid=3229 execve guuid=66b51a0a-1700-0000-70b2-af339e0c0000 pid=3230 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=66b51a0a-1700-0000-70b2-af339e0c0000 pid=3230 execve guuid=7fab760a-1700-0000-70b2-af339f0c0000 pid=3231 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=7fab760a-1700-0000-70b2-af339f0c0000 pid=3231 execve guuid=79dbd60a-1700-0000-70b2-af33a10c0000 pid=3233 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=79dbd60a-1700-0000-70b2-af33a10c0000 pid=3233 execve guuid=f2377f0b-1700-0000-70b2-af33a50c0000 pid=3237 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=f2377f0b-1700-0000-70b2-af33a50c0000 pid=3237 execve guuid=0b64080c-1700-0000-70b2-af33a80c0000 pid=3240 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=0b64080c-1700-0000-70b2-af33a80c0000 pid=3240 execve guuid=fbd0890c-1700-0000-70b2-af33ab0c0000 pid=3243 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=fbd0890c-1700-0000-70b2-af33ab0c0000 pid=3243 execve guuid=9be73f0d-1700-0000-70b2-af33ae0c0000 pid=3246 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=9be73f0d-1700-0000-70b2-af33ae0c0000 pid=3246 execve guuid=3ffecc0d-1700-0000-70b2-af33b10c0000 pid=3249 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=3ffecc0d-1700-0000-70b2-af33b10c0000 pid=3249 execve guuid=f6d35d0e-1700-0000-70b2-af33b30c0000 pid=3251 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=f6d35d0e-1700-0000-70b2-af33b30c0000 pid=3251 execve guuid=18a1ff0e-1700-0000-70b2-af33b50c0000 pid=3253 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=18a1ff0e-1700-0000-70b2-af33b50c0000 pid=3253 execve guuid=6a44840f-1700-0000-70b2-af33b80c0000 pid=3256 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=6a44840f-1700-0000-70b2-af33b80c0000 pid=3256 execve guuid=3763fb0f-1700-0000-70b2-af33ba0c0000 pid=3258 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=3763fb0f-1700-0000-70b2-af33ba0c0000 pid=3258 execve guuid=17697b10-1700-0000-70b2-af33bc0c0000 pid=3260 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=17697b10-1700-0000-70b2-af33bc0c0000 pid=3260 execve guuid=a58ff310-1700-0000-70b2-af33be0c0000 pid=3262 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=a58ff310-1700-0000-70b2-af33be0c0000 pid=3262 execve guuid=8dfe6f11-1700-0000-70b2-af33bf0c0000 pid=3263 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=8dfe6f11-1700-0000-70b2-af33bf0c0000 pid=3263 execve guuid=0930fe11-1700-0000-70b2-af33c20c0000 pid=3266 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=0930fe11-1700-0000-70b2-af33c20c0000 pid=3266 execve guuid=dd516b12-1700-0000-70b2-af33c40c0000 pid=3268 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=dd516b12-1700-0000-70b2-af33c40c0000 pid=3268 execve guuid=7a88da12-1700-0000-70b2-af33c70c0000 pid=3271 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=7a88da12-1700-0000-70b2-af33c70c0000 pid=3271 execve guuid=44a74913-1700-0000-70b2-af33c90c0000 pid=3273 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=44a74913-1700-0000-70b2-af33c90c0000 pid=3273 execve guuid=94cfcd13-1700-0000-70b2-af33ca0c0000 pid=3274 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=94cfcd13-1700-0000-70b2-af33ca0c0000 pid=3274 execve guuid=094b6c14-1700-0000-70b2-af33cb0c0000 pid=3275 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=094b6c14-1700-0000-70b2-af33cb0c0000 pid=3275 execve guuid=5bb60115-1700-0000-70b2-af33cc0c0000 pid=3276 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=5bb60115-1700-0000-70b2-af33cc0c0000 pid=3276 execve guuid=759a9015-1700-0000-70b2-af33cd0c0000 pid=3277 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=759a9015-1700-0000-70b2-af33cd0c0000 pid=3277 execve guuid=4bac1716-1700-0000-70b2-af33cf0c0000 pid=3279 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=4bac1716-1700-0000-70b2-af33cf0c0000 pid=3279 execve guuid=9f069e16-1700-0000-70b2-af33d00c0000 pid=3280 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=9f069e16-1700-0000-70b2-af33d00c0000 pid=3280 execve guuid=7ccf2317-1700-0000-70b2-af33d30c0000 pid=3283 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=7ccf2317-1700-0000-70b2-af33d30c0000 pid=3283 execve guuid=3107a417-1700-0000-70b2-af33d50c0000 pid=3285 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=3107a417-1700-0000-70b2-af33d50c0000 pid=3285 execve guuid=cacb1918-1700-0000-70b2-af33d80c0000 pid=3288 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=cacb1918-1700-0000-70b2-af33d80c0000 pid=3288 execve guuid=40308618-1700-0000-70b2-af33da0c0000 pid=3290 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=40308618-1700-0000-70b2-af33da0c0000 pid=3290 execve guuid=78092c19-1700-0000-70b2-af33dd0c0000 pid=3293 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=78092c19-1700-0000-70b2-af33dd0c0000 pid=3293 execve guuid=2851f519-1700-0000-70b2-af33e00c0000 pid=3296 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=2851f519-1700-0000-70b2-af33e00c0000 pid=3296 execve guuid=ecf67a1a-1700-0000-70b2-af33e20c0000 pid=3298 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=ecf67a1a-1700-0000-70b2-af33e20c0000 pid=3298 execve guuid=51c5e81a-1700-0000-70b2-af33e30c0000 pid=3299 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=51c5e81a-1700-0000-70b2-af33e30c0000 pid=3299 execve guuid=55af621b-1700-0000-70b2-af33e50c0000 pid=3301 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=55af621b-1700-0000-70b2-af33e50c0000 pid=3301 execve guuid=4b50d61b-1700-0000-70b2-af33e80c0000 pid=3304 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=4b50d61b-1700-0000-70b2-af33e80c0000 pid=3304 execve guuid=1eb7461c-1700-0000-70b2-af33ea0c0000 pid=3306 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=1eb7461c-1700-0000-70b2-af33ea0c0000 pid=3306 execve guuid=d37ab81c-1700-0000-70b2-af33ec0c0000 pid=3308 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=d37ab81c-1700-0000-70b2-af33ec0c0000 pid=3308 execve guuid=3b8f321d-1700-0000-70b2-af33ee0c0000 pid=3310 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=3b8f321d-1700-0000-70b2-af33ee0c0000 pid=3310 execve guuid=2ebfa91d-1700-0000-70b2-af33f00c0000 pid=3312 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=2ebfa91d-1700-0000-70b2-af33f00c0000 pid=3312 execve guuid=4bac1f1e-1700-0000-70b2-af33f20c0000 pid=3314 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=4bac1f1e-1700-0000-70b2-af33f20c0000 pid=3314 execve guuid=8cf99d1e-1700-0000-70b2-af33f50c0000 pid=3317 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=8cf99d1e-1700-0000-70b2-af33f50c0000 pid=3317 execve guuid=c7ef201f-1700-0000-70b2-af33f70c0000 pid=3319 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=c7ef201f-1700-0000-70b2-af33f70c0000 pid=3319 execve guuid=936b981f-1700-0000-70b2-af33f90c0000 pid=3321 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=936b981f-1700-0000-70b2-af33f90c0000 pid=3321 execve guuid=66e20420-1700-0000-70b2-af33fb0c0000 pid=3323 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=66e20420-1700-0000-70b2-af33fb0c0000 pid=3323 execve guuid=9ef77920-1700-0000-70b2-af33fd0c0000 pid=3325 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=9ef77920-1700-0000-70b2-af33fd0c0000 pid=3325 execve guuid=e9e3e620-1700-0000-70b2-af33ff0c0000 pid=3327 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=e9e3e620-1700-0000-70b2-af33ff0c0000 pid=3327 execve guuid=250f7421-1700-0000-70b2-af33000d0000 pid=3328 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=250f7421-1700-0000-70b2-af33000d0000 pid=3328 execve guuid=5761e721-1700-0000-70b2-af33020d0000 pid=3330 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=5761e721-1700-0000-70b2-af33020d0000 pid=3330 execve guuid=222b5822-1700-0000-70b2-af33040d0000 pid=3332 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=222b5822-1700-0000-70b2-af33040d0000 pid=3332 execve guuid=7e91d022-1700-0000-70b2-af33060d0000 pid=3334 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=7e91d022-1700-0000-70b2-af33060d0000 pid=3334 execve guuid=eb8a4423-1700-0000-70b2-af33080d0000 pid=3336 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=eb8a4423-1700-0000-70b2-af33080d0000 pid=3336 execve guuid=e769b823-1700-0000-70b2-af330b0d0000 pid=3339 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=e769b823-1700-0000-70b2-af330b0d0000 pid=3339 execve guuid=c5f03024-1700-0000-70b2-af330d0d0000 pid=3341 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=c5f03024-1700-0000-70b2-af330d0d0000 pid=3341 execve guuid=7fc8a424-1700-0000-70b2-af33100d0000 pid=3344 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=7fc8a424-1700-0000-70b2-af33100d0000 pid=3344 execve guuid=ecee1c25-1700-0000-70b2-af33110d0000 pid=3345 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=ecee1c25-1700-0000-70b2-af33110d0000 pid=3345 execve guuid=b8da9325-1700-0000-70b2-af33130d0000 pid=3347 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=b8da9325-1700-0000-70b2-af33130d0000 pid=3347 execve guuid=d9270d26-1700-0000-70b2-af33150d0000 pid=3349 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=d9270d26-1700-0000-70b2-af33150d0000 pid=3349 execve guuid=75b88726-1700-0000-70b2-af33170d0000 pid=3351 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=75b88726-1700-0000-70b2-af33170d0000 pid=3351 execve guuid=b404e026-1700-0000-70b2-af331a0d0000 pid=3354 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=b404e026-1700-0000-70b2-af331a0d0000 pid=3354 execve guuid=11383627-1700-0000-70b2-af331c0d0000 pid=3356 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=11383627-1700-0000-70b2-af331c0d0000 pid=3356 execve guuid=739b8927-1700-0000-70b2-af331e0d0000 pid=3358 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=739b8927-1700-0000-70b2-af331e0d0000 pid=3358 execve guuid=14afe227-1700-0000-70b2-af33210d0000 pid=3361 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=14afe227-1700-0000-70b2-af33210d0000 pid=3361 execve guuid=26a73b28-1700-0000-70b2-af33220d0000 pid=3362 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=26a73b28-1700-0000-70b2-af33220d0000 pid=3362 execve guuid=1cfb9628-1700-0000-70b2-af33240d0000 pid=3364 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=1cfb9628-1700-0000-70b2-af33240d0000 pid=3364 execve guuid=6866ed28-1700-0000-70b2-af33260d0000 pid=3366 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=6866ed28-1700-0000-70b2-af33260d0000 pid=3366 execve guuid=638c4d29-1700-0000-70b2-af33290d0000 pid=3369 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=638c4d29-1700-0000-70b2-af33290d0000 pid=3369 execve guuid=4a6fb829-1700-0000-70b2-af332b0d0000 pid=3371 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=4a6fb829-1700-0000-70b2-af332b0d0000 pid=3371 execve guuid=3b35212a-1700-0000-70b2-af332e0d0000 pid=3374 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=3b35212a-1700-0000-70b2-af332e0d0000 pid=3374 execve guuid=ec0a842a-1700-0000-70b2-af33300d0000 pid=3376 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=ec0a842a-1700-0000-70b2-af33300d0000 pid=3376 execve guuid=1d61db2a-1700-0000-70b2-af33330d0000 pid=3379 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=1d61db2a-1700-0000-70b2-af33330d0000 pid=3379 execve guuid=a154342b-1700-0000-70b2-af33350d0000 pid=3381 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=a154342b-1700-0000-70b2-af33350d0000 pid=3381 execve guuid=875a872b-1700-0000-70b2-af33370d0000 pid=3383 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=875a872b-1700-0000-70b2-af33370d0000 pid=3383 execve guuid=caa7e22b-1700-0000-70b2-af333a0d0000 pid=3386 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=caa7e22b-1700-0000-70b2-af333a0d0000 pid=3386 execve guuid=b05f372c-1700-0000-70b2-af333c0d0000 pid=3388 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=b05f372c-1700-0000-70b2-af333c0d0000 pid=3388 execve guuid=1ec08a2c-1700-0000-70b2-af333f0d0000 pid=3391 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=1ec08a2c-1700-0000-70b2-af333f0d0000 pid=3391 execve guuid=497bde2c-1700-0000-70b2-af33400d0000 pid=3392 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=497bde2c-1700-0000-70b2-af33400d0000 pid=3392 execve guuid=61b7322d-1700-0000-70b2-af33420d0000 pid=3394 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=61b7322d-1700-0000-70b2-af33420d0000 pid=3394 execve guuid=345fa62d-1700-0000-70b2-af33440d0000 pid=3396 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=345fa62d-1700-0000-70b2-af33440d0000 pid=3396 execve guuid=4417132e-1700-0000-70b2-af33470d0000 pid=3399 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=4417132e-1700-0000-70b2-af33470d0000 pid=3399 execve guuid=3167842e-1700-0000-70b2-af334a0d0000 pid=3402 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=3167842e-1700-0000-70b2-af334a0d0000 pid=3402 execve guuid=89011a2f-1700-0000-70b2-af334c0d0000 pid=3404 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=89011a2f-1700-0000-70b2-af334c0d0000 pid=3404 execve guuid=73d99a2f-1700-0000-70b2-af334f0d0000 pid=3407 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=73d99a2f-1700-0000-70b2-af334f0d0000 pid=3407 execve guuid=fa63fc2f-1700-0000-70b2-af33520d0000 pid=3410 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=fa63fc2f-1700-0000-70b2-af33520d0000 pid=3410 execve guuid=7b997430-1700-0000-70b2-af33540d0000 pid=3412 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=7b997430-1700-0000-70b2-af33540d0000 pid=3412 execve guuid=d270f330-1700-0000-70b2-af33570d0000 pid=3415 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=d270f330-1700-0000-70b2-af33570d0000 pid=3415 execve guuid=83c08d31-1700-0000-70b2-af33590d0000 pid=3417 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=83c08d31-1700-0000-70b2-af33590d0000 pid=3417 execve guuid=4db50232-1700-0000-70b2-af335c0d0000 pid=3420 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=4db50232-1700-0000-70b2-af335c0d0000 pid=3420 execve guuid=33587232-1700-0000-70b2-af335f0d0000 pid=3423 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=33587232-1700-0000-70b2-af335f0d0000 pid=3423 execve guuid=3fbdd632-1700-0000-70b2-af33610d0000 pid=3425 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=3fbdd632-1700-0000-70b2-af33610d0000 pid=3425 execve guuid=d7092a33-1700-0000-70b2-af33640d0000 pid=3428 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=d7092a33-1700-0000-70b2-af33640d0000 pid=3428 execve guuid=6e238533-1700-0000-70b2-af33660d0000 pid=3430 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=6e238533-1700-0000-70b2-af33660d0000 pid=3430 execve guuid=894bdb33-1700-0000-70b2-af33680d0000 pid=3432 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=894bdb33-1700-0000-70b2-af33680d0000 pid=3432 execve guuid=56db5834-1700-0000-70b2-af336b0d0000 pid=3435 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=56db5834-1700-0000-70b2-af336b0d0000 pid=3435 execve guuid=0eaddc34-1700-0000-70b2-af336d0d0000 pid=3437 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=0eaddc34-1700-0000-70b2-af336d0d0000 pid=3437 execve guuid=7ff45f35-1700-0000-70b2-af33700d0000 pid=3440 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=7ff45f35-1700-0000-70b2-af33700d0000 pid=3440 execve guuid=b851b535-1700-0000-70b2-af33720d0000 pid=3442 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=b851b535-1700-0000-70b2-af33720d0000 pid=3442 execve guuid=a4e20936-1700-0000-70b2-af33740d0000 pid=3444 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=a4e20936-1700-0000-70b2-af33740d0000 pid=3444 execve guuid=72d76236-1700-0000-70b2-af33760d0000 pid=3446 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=72d76236-1700-0000-70b2-af33760d0000 pid=3446 execve guuid=0398c036-1700-0000-70b2-af33790d0000 pid=3449 /usr/bin/ls guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=0398c036-1700-0000-70b2-af33790d0000 pid=3449 execve guuid=8a8b2337-1700-0000-70b2-af337b0d0000 pid=3451 /usr/bin/rm guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=8a8b2337-1700-0000-70b2-af337b0d0000 pid=3451 execve guuid=3b5d6837-1700-0000-70b2-af337d0d0000 pid=3453 /usr/bin/wget net send-data write-file guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=3b5d6837-1700-0000-70b2-af337d0d0000 pid=3453 execve guuid=57f61f50-1700-0000-70b2-af33bf0d0000 pid=3519 /usr/bin/chmod guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=57f61f50-1700-0000-70b2-af33bf0d0000 pid=3519 execve guuid=77506150-1700-0000-70b2-af33c00d0000 pid=3520 /usr/bin/dash guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=77506150-1700-0000-70b2-af33c00d0000 pid=3520 clone guuid=6a7de150-1700-0000-70b2-af33c20d0000 pid=3522 /usr/bin/rm guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=6a7de150-1700-0000-70b2-af33c20d0000 pid=3522 execve guuid=c2cc2051-1700-0000-70b2-af33c30d0000 pid=3523 /usr/bin/wget net send-data write-file guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=c2cc2051-1700-0000-70b2-af33c30d0000 pid=3523 execve guuid=2e300f69-1700-0000-70b2-af33e90d0000 pid=3561 /usr/bin/chmod guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=2e300f69-1700-0000-70b2-af33e90d0000 pid=3561 execve guuid=cc338969-1700-0000-70b2-af33ea0d0000 pid=3562 /usr/bin/dash guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=cc338969-1700-0000-70b2-af33ea0d0000 pid=3562 clone guuid=18d2b86a-1700-0000-70b2-af33ec0d0000 pid=3564 /usr/bin/rm guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=18d2b86a-1700-0000-70b2-af33ec0d0000 pid=3564 execve guuid=2c2b296b-1700-0000-70b2-af33ed0d0000 pid=3565 /usr/bin/wget net send-data write-file guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=2c2b296b-1700-0000-70b2-af33ed0d0000 pid=3565 execve guuid=96744e83-1700-0000-70b2-af33190e0000 pid=3609 /usr/bin/chmod guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=96744e83-1700-0000-70b2-af33190e0000 pid=3609 execve guuid=c4f1bf83-1700-0000-70b2-af331b0e0000 pid=3611 /usr/bin/dash guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=c4f1bf83-1700-0000-70b2-af331b0e0000 pid=3611 clone guuid=b48da984-1700-0000-70b2-af331f0e0000 pid=3615 /usr/bin/rm guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=b48da984-1700-0000-70b2-af331f0e0000 pid=3615 execve guuid=4cdc0285-1700-0000-70b2-af33200e0000 pid=3616 /usr/bin/wget net send-data write-file guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=4cdc0285-1700-0000-70b2-af33200e0000 pid=3616 execve guuid=7b599ea2-1700-0000-70b2-af33570e0000 pid=3671 /usr/bin/chmod guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=7b599ea2-1700-0000-70b2-af33570e0000 pid=3671 execve guuid=d43916a3-1700-0000-70b2-af33590e0000 pid=3673 /usr/bin/dash guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=d43916a3-1700-0000-70b2-af33590e0000 pid=3673 clone guuid=a0e118a4-1700-0000-70b2-af335d0e0000 pid=3677 /usr/bin/rm guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=a0e118a4-1700-0000-70b2-af335d0e0000 pid=3677 execve guuid=315f84a4-1700-0000-70b2-af335f0e0000 pid=3679 /usr/bin/wget net send-data write-file guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=315f84a4-1700-0000-70b2-af335f0e0000 pid=3679 execve guuid=44e2edc1-1700-0000-70b2-af338a0e0000 pid=3722 /usr/bin/chmod guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=44e2edc1-1700-0000-70b2-af338a0e0000 pid=3722 execve guuid=983583c2-1700-0000-70b2-af338b0e0000 pid=3723 /usr/bin/dash guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=983583c2-1700-0000-70b2-af338b0e0000 pid=3723 clone guuid=7ac87bc3-1700-0000-70b2-af338d0e0000 pid=3725 /usr/bin/rm delete-file guuid=c1412a02-1700-0000-70b2-af337d0c0000 pid=3197->guuid=7ac87bc3-1700-0000-70b2-af338d0e0000 pid=3725 execve 801186e6-5fe8-5959-a7b4-832d8d66e7aa 129.121.114.124:80 guuid=3b5d6837-1700-0000-70b2-af337d0d0000 pid=3453->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 133B guuid=c2cc2051-1700-0000-70b2-af33c30d0000 pid=3523->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 133B guuid=2c2b296b-1700-0000-70b2-af33ed0d0000 pid=3565->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 134B guuid=4cdc0285-1700-0000-70b2-af33200e0000 pid=3616->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 133B guuid=315f84a4-1700-0000-70b2-af335f0e0000 pid=3679->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 134B
Score:
98%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/e0e2e7ce1b38f04d6e20e22cb25915bdc4e1cc90f08e7114243ceadffa9e4a59
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e0e2e7ce1b38f04d6e20e22cb25915bdc4e1cc90f08e7114243ceadffa9e4a59/
Threat name:
Document-HTML.Trojan.Bash
Create hunting rule
Status:
Malicious
First seen:
2026-07-20 00:47:34 UTC
File Type:
Text (Shell)
AV detection:
12 of 24 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4droptq3hdye23ra4iwlewivxxcodteq6chhcfbehtvn76u6jjmq._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
discovery linux
Link:
https://tria.ge/reports/260720-a5gb3sav6q/
Behaviour
Reads runtime system information
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.26
Link:
https://yomi.yoroi.company/submissions/e0e2e7ce1b38f04d6e20e22cb25915bdc4e1cc90f08e7114243ceadffa9e4a59

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh e0e2e7ce1b38f04d6e20e22cb25915bdc4e1cc90f08e7114243ceadffa9e4a59

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3866369/
  
Delivery method
Distributed via web download

Comments