🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e690ccc549b42843172352be51ca95074dc6abc41d18212a46519ea1f625dbc6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e690ccc549b42843172352be51ca95074dc6abc41d18212a46519ea1f625dbc6
SHA3-384 hash: 00bd8544fea7dc7e9df6d09f7acf2a79ea57be15d6d231087a34ad75e3dc636733e7bca892a8a83c5af8d09d9ce1dd1f
SHA1 hash: 8755fd56ecbee23b66657335b233897f98281177
MD5 hash: 2a6c80fb2171c9bb9c03ce8b511b55cc
humanhash: utah-speaker-vegan-undress
File name:p
Download: download sample
File size:843 bytes
First seen:2026-07-14 12:06:52 UTC
Last seen:2026-07-15 08:19:43 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 24:kXCKysE2hi0ziQvZoha+jv7E0FRh7EtGN6lEU0A7:e9Qp+Ms+vNf7E0QEfA7
TLSH T154016FCA4640F900421D9A6D62A755D4B821D3CE0A460F687FDC9D2DF798914B13AFDC
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://129.121.114.124/8Gt6n/an/an/a
http://129.121.114.124/rGHqn/an/an/a
http://129.121.114.124/dvPin/an/an/a
http://129.121.114.124/ws7n/an/an/a
http://129.121.114.124/IZL0n/an/an/a

Intelligence

File Origin
# of uploads :
3
# of downloads :
64
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive mirai
Link:
https://www.filescan.io/uploads/6a56266705ecc481a2c72505/reports/648b18b6-fb2f-47ac-afe0-8bdded98b3fc/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-07-14T10:35:00Z UTC
Last seen:
2026-07-16T08:53:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/e690ccc549b42843172352be51ca95074dc6abc41d18212a46519ea1f625dbc6/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/50532a55-87ec-46a8-b9df-d748c840efcd
Behavior Graph:
Download SVG
%3 guuid=94a0de3b-1a00-0000-370a-550ef70c0000 pid=3319 /usr/bin/sudo guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320 /tmp/sample.bin write-file guuid=94a0de3b-1a00-0000-370a-550ef70c0000 pid=3319->guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320 execve guuid=8f70183e-1a00-0000-370a-550ef90c0000 pid=3321 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=8f70183e-1a00-0000-370a-550ef90c0000 pid=3321 execve guuid=a048983e-1a00-0000-370a-550efa0c0000 pid=3322 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=a048983e-1a00-0000-370a-550efa0c0000 pid=3322 execve guuid=e8b70b3f-1a00-0000-370a-550efb0c0000 pid=3323 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=e8b70b3f-1a00-0000-370a-550efb0c0000 pid=3323 execve guuid=f18c793f-1a00-0000-370a-550efc0c0000 pid=3324 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=f18c793f-1a00-0000-370a-550efc0c0000 pid=3324 execve guuid=eb8ce63f-1a00-0000-370a-550efd0c0000 pid=3325 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=eb8ce63f-1a00-0000-370a-550efd0c0000 pid=3325 execve guuid=09775140-1a00-0000-370a-550efe0c0000 pid=3326 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=09775140-1a00-0000-370a-550efe0c0000 pid=3326 execve guuid=5709bd40-1a00-0000-370a-550eff0c0000 pid=3327 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=5709bd40-1a00-0000-370a-550eff0c0000 pid=3327 execve guuid=3f8c5741-1a00-0000-370a-550e010d0000 pid=3329 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=3f8c5741-1a00-0000-370a-550e010d0000 pid=3329 execve guuid=e620f341-1a00-0000-370a-550e030d0000 pid=3331 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=e620f341-1a00-0000-370a-550e030d0000 pid=3331 execve guuid=76efc042-1a00-0000-370a-550e060d0000 pid=3334 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=76efc042-1a00-0000-370a-550e060d0000 pid=3334 execve guuid=297d5f43-1a00-0000-370a-550e090d0000 pid=3337 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=297d5f43-1a00-0000-370a-550e090d0000 pid=3337 execve guuid=8436de43-1a00-0000-370a-550e0b0d0000 pid=3339 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=8436de43-1a00-0000-370a-550e0b0d0000 pid=3339 execve guuid=28f34244-1a00-0000-370a-550e0d0d0000 pid=3341 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=28f34244-1a00-0000-370a-550e0d0d0000 pid=3341 execve guuid=e6afa544-1a00-0000-370a-550e100d0000 pid=3344 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=e6afa544-1a00-0000-370a-550e100d0000 pid=3344 execve guuid=e8921d45-1a00-0000-370a-550e120d0000 pid=3346 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=e8921d45-1a00-0000-370a-550e120d0000 pid=3346 execve guuid=6e098545-1a00-0000-370a-550e140d0000 pid=3348 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=6e098545-1a00-0000-370a-550e140d0000 pid=3348 execve guuid=8087f645-1a00-0000-370a-550e160d0000 pid=3350 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=8087f645-1a00-0000-370a-550e160d0000 pid=3350 execve guuid=d8137146-1a00-0000-370a-550e190d0000 pid=3353 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=d8137146-1a00-0000-370a-550e190d0000 pid=3353 execve guuid=ee36ef46-1a00-0000-370a-550e1c0d0000 pid=3356 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=ee36ef46-1a00-0000-370a-550e1c0d0000 pid=3356 execve guuid=560d6347-1a00-0000-370a-550e1d0d0000 pid=3357 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=560d6347-1a00-0000-370a-550e1d0d0000 pid=3357 execve guuid=e9650848-1a00-0000-370a-550e1e0d0000 pid=3358 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=e9650848-1a00-0000-370a-550e1e0d0000 pid=3358 execve guuid=0fe0ab48-1a00-0000-370a-550e200d0000 pid=3360 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=0fe0ab48-1a00-0000-370a-550e200d0000 pid=3360 execve guuid=8f774649-1a00-0000-370a-550e210d0000 pid=3361 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=8f774649-1a00-0000-370a-550e210d0000 pid=3361 execve guuid=a73ed149-1a00-0000-370a-550e250d0000 pid=3365 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=a73ed149-1a00-0000-370a-550e250d0000 pid=3365 execve guuid=7ab3404a-1a00-0000-370a-550e270d0000 pid=3367 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=7ab3404a-1a00-0000-370a-550e270d0000 pid=3367 execve guuid=cc09ac4a-1a00-0000-370a-550e290d0000 pid=3369 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=cc09ac4a-1a00-0000-370a-550e290d0000 pid=3369 execve guuid=905a1e4b-1a00-0000-370a-550e2b0d0000 pid=3371 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=905a1e4b-1a00-0000-370a-550e2b0d0000 pid=3371 execve guuid=b2c6814b-1a00-0000-370a-550e2d0d0000 pid=3373 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=b2c6814b-1a00-0000-370a-550e2d0d0000 pid=3373 execve guuid=5230f34b-1a00-0000-370a-550e2f0d0000 pid=3375 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=5230f34b-1a00-0000-370a-550e2f0d0000 pid=3375 execve guuid=6b27764c-1a00-0000-370a-550e320d0000 pid=3378 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=6b27764c-1a00-0000-370a-550e320d0000 pid=3378 execve guuid=54edde4c-1a00-0000-370a-550e340d0000 pid=3380 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=54edde4c-1a00-0000-370a-550e340d0000 pid=3380 execve guuid=a79a784d-1a00-0000-370a-550e370d0000 pid=3383 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=a79a784d-1a00-0000-370a-550e370d0000 pid=3383 execve guuid=2d22ee4d-1a00-0000-370a-550e390d0000 pid=3385 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=2d22ee4d-1a00-0000-370a-550e390d0000 pid=3385 execve guuid=91717f4e-1a00-0000-370a-550e3c0d0000 pid=3388 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=91717f4e-1a00-0000-370a-550e3c0d0000 pid=3388 execve guuid=0c34014f-1a00-0000-370a-550e3e0d0000 pid=3390 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=0c34014f-1a00-0000-370a-550e3e0d0000 pid=3390 execve guuid=92bc7b4f-1a00-0000-370a-550e400d0000 pid=3392 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=92bc7b4f-1a00-0000-370a-550e400d0000 pid=3392 execve guuid=ae430950-1a00-0000-370a-550e430d0000 pid=3395 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=ae430950-1a00-0000-370a-550e430d0000 pid=3395 execve guuid=8b1ca350-1a00-0000-370a-550e460d0000 pid=3398 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=8b1ca350-1a00-0000-370a-550e460d0000 pid=3398 execve guuid=48d01051-1a00-0000-370a-550e480d0000 pid=3400 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=48d01051-1a00-0000-370a-550e480d0000 pid=3400 execve guuid=d4ff9c51-1a00-0000-370a-550e4a0d0000 pid=3402 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=d4ff9c51-1a00-0000-370a-550e4a0d0000 pid=3402 execve guuid=07000552-1a00-0000-370a-550e4c0d0000 pid=3404 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=07000552-1a00-0000-370a-550e4c0d0000 pid=3404 execve guuid=0d659052-1a00-0000-370a-550e4e0d0000 pid=3406 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=0d659052-1a00-0000-370a-550e4e0d0000 pid=3406 execve guuid=e29a3253-1a00-0000-370a-550e510d0000 pid=3409 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=e29a3253-1a00-0000-370a-550e510d0000 pid=3409 execve guuid=a61fd153-1a00-0000-370a-550e540d0000 pid=3412 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=a61fd153-1a00-0000-370a-550e540d0000 pid=3412 execve guuid=8d626854-1a00-0000-370a-550e570d0000 pid=3415 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=8d626854-1a00-0000-370a-550e570d0000 pid=3415 execve guuid=e17bd554-1a00-0000-370a-550e590d0000 pid=3417 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=e17bd554-1a00-0000-370a-550e590d0000 pid=3417 execve guuid=fc555555-1a00-0000-370a-550e5c0d0000 pid=3420 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=fc555555-1a00-0000-370a-550e5c0d0000 pid=3420 execve guuid=42e4c255-1a00-0000-370a-550e5e0d0000 pid=3422 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=42e4c255-1a00-0000-370a-550e5e0d0000 pid=3422 execve guuid=b666df56-1a00-0000-370a-550e630d0000 pid=3427 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=b666df56-1a00-0000-370a-550e630d0000 pid=3427 execve guuid=c3637357-1a00-0000-370a-550e650d0000 pid=3429 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=c3637357-1a00-0000-370a-550e650d0000 pid=3429 execve guuid=10070258-1a00-0000-370a-550e670d0000 pid=3431 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=10070258-1a00-0000-370a-550e670d0000 pid=3431 execve guuid=a1c5a658-1a00-0000-370a-550e6a0d0000 pid=3434 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=a1c5a658-1a00-0000-370a-550e6a0d0000 pid=3434 execve guuid=e86b0159-1a00-0000-370a-550e6d0d0000 pid=3437 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=e86b0159-1a00-0000-370a-550e6d0d0000 pid=3437 execve guuid=fbca6d59-1a00-0000-370a-550e6e0d0000 pid=3438 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=fbca6d59-1a00-0000-370a-550e6e0d0000 pid=3438 execve guuid=fbb80b5a-1a00-0000-370a-550e720d0000 pid=3442 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=fbb80b5a-1a00-0000-370a-550e720d0000 pid=3442 execve guuid=7a9baf5a-1a00-0000-370a-550e750d0000 pid=3445 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=7a9baf5a-1a00-0000-370a-550e750d0000 pid=3445 execve guuid=6ad55d5b-1a00-0000-370a-550e790d0000 pid=3449 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=6ad55d5b-1a00-0000-370a-550e790d0000 pid=3449 execve guuid=2309f65b-1a00-0000-370a-550e7c0d0000 pid=3452 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=2309f65b-1a00-0000-370a-550e7c0d0000 pid=3452 execve guuid=bb81975c-1a00-0000-370a-550e7f0d0000 pid=3455 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=bb81975c-1a00-0000-370a-550e7f0d0000 pid=3455 execve guuid=9de7395d-1a00-0000-370a-550e820d0000 pid=3458 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=9de7395d-1a00-0000-370a-550e820d0000 pid=3458 execve guuid=e038d35d-1a00-0000-370a-550e840d0000 pid=3460 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=e038d35d-1a00-0000-370a-550e840d0000 pid=3460 execve guuid=83db705e-1a00-0000-370a-550e870d0000 pid=3463 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=83db705e-1a00-0000-370a-550e870d0000 pid=3463 execve guuid=48dbe85e-1a00-0000-370a-550e890d0000 pid=3465 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=48dbe85e-1a00-0000-370a-550e890d0000 pid=3465 execve guuid=e4e0ab5f-1a00-0000-370a-550e8b0d0000 pid=3467 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=e4e0ab5f-1a00-0000-370a-550e8b0d0000 pid=3467 execve guuid=20012460-1a00-0000-370a-550e8d0d0000 pid=3469 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=20012460-1a00-0000-370a-550e8d0d0000 pid=3469 execve guuid=6f71a160-1a00-0000-370a-550e8f0d0000 pid=3471 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=6f71a160-1a00-0000-370a-550e8f0d0000 pid=3471 execve guuid=f8912461-1a00-0000-370a-550e910d0000 pid=3473 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=f8912461-1a00-0000-370a-550e910d0000 pid=3473 execve guuid=a58b9d61-1a00-0000-370a-550e930d0000 pid=3475 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=a58b9d61-1a00-0000-370a-550e930d0000 pid=3475 execve guuid=a3351162-1a00-0000-370a-550e950d0000 pid=3477 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=a3351162-1a00-0000-370a-550e950d0000 pid=3477 execve guuid=2cb29662-1a00-0000-370a-550e980d0000 pid=3480 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=2cb29662-1a00-0000-370a-550e980d0000 pid=3480 execve guuid=91fb0a63-1a00-0000-370a-550e9a0d0000 pid=3482 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=91fb0a63-1a00-0000-370a-550e9a0d0000 pid=3482 execve guuid=b78a9e63-1a00-0000-370a-550e9c0d0000 pid=3484 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=b78a9e63-1a00-0000-370a-550e9c0d0000 pid=3484 execve guuid=5a722964-1a00-0000-370a-550e9f0d0000 pid=3487 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=5a722964-1a00-0000-370a-550e9f0d0000 pid=3487 execve guuid=fb281c65-1a00-0000-370a-550ea20d0000 pid=3490 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=fb281c65-1a00-0000-370a-550ea20d0000 pid=3490 execve guuid=d805c765-1a00-0000-370a-550ea50d0000 pid=3493 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=d805c765-1a00-0000-370a-550ea50d0000 pid=3493 execve guuid=404d9166-1a00-0000-370a-550ea80d0000 pid=3496 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=404d9166-1a00-0000-370a-550ea80d0000 pid=3496 execve guuid=1b343267-1a00-0000-370a-550eab0d0000 pid=3499 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=1b343267-1a00-0000-370a-550eab0d0000 pid=3499 execve guuid=d8cac367-1a00-0000-370a-550ead0d0000 pid=3501 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=d8cac367-1a00-0000-370a-550ead0d0000 pid=3501 execve guuid=35354968-1a00-0000-370a-550eb00d0000 pid=3504 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=35354968-1a00-0000-370a-550eb00d0000 pid=3504 execve guuid=4d4bb768-1a00-0000-370a-550eb20d0000 pid=3506 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=4d4bb768-1a00-0000-370a-550eb20d0000 pid=3506 execve guuid=01e06469-1a00-0000-370a-550eb50d0000 pid=3509 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=01e06469-1a00-0000-370a-550eb50d0000 pid=3509 execve guuid=56f9ea69-1a00-0000-370a-550eb80d0000 pid=3512 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=56f9ea69-1a00-0000-370a-550eb80d0000 pid=3512 execve guuid=036f506a-1a00-0000-370a-550eba0d0000 pid=3514 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=036f506a-1a00-0000-370a-550eba0d0000 pid=3514 execve guuid=c2352f6b-1a00-0000-370a-550ebe0d0000 pid=3518 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=c2352f6b-1a00-0000-370a-550ebe0d0000 pid=3518 execve guuid=5f658d6b-1a00-0000-370a-550ec30d0000 pid=3523 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=5f658d6b-1a00-0000-370a-550ec30d0000 pid=3523 execve guuid=5947f76b-1a00-0000-370a-550ec40d0000 pid=3524 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=5947f76b-1a00-0000-370a-550ec40d0000 pid=3524 execve guuid=f8c3586c-1a00-0000-370a-550ec50d0000 pid=3525 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=f8c3586c-1a00-0000-370a-550ec50d0000 pid=3525 execve guuid=4409b66c-1a00-0000-370a-550ec60d0000 pid=3526 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=4409b66c-1a00-0000-370a-550ec60d0000 pid=3526 execve guuid=38681d6d-1a00-0000-370a-550ec70d0000 pid=3527 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=38681d6d-1a00-0000-370a-550ec70d0000 pid=3527 execve guuid=92137e6d-1a00-0000-370a-550ec80d0000 pid=3528 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=92137e6d-1a00-0000-370a-550ec80d0000 pid=3528 execve guuid=a6bae16d-1a00-0000-370a-550ec90d0000 pid=3529 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=a6bae16d-1a00-0000-370a-550ec90d0000 pid=3529 execve guuid=fd48386e-1a00-0000-370a-550eca0d0000 pid=3530 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=fd48386e-1a00-0000-370a-550eca0d0000 pid=3530 execve guuid=f58b926e-1a00-0000-370a-550ecb0d0000 pid=3531 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=f58b926e-1a00-0000-370a-550ecb0d0000 pid=3531 execve guuid=6cd7ec6e-1a00-0000-370a-550ecc0d0000 pid=3532 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=6cd7ec6e-1a00-0000-370a-550ecc0d0000 pid=3532 execve guuid=2e4f446f-1a00-0000-370a-550ecd0d0000 pid=3533 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=2e4f446f-1a00-0000-370a-550ecd0d0000 pid=3533 execve guuid=8c9d9a6f-1a00-0000-370a-550ece0d0000 pid=3534 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=8c9d9a6f-1a00-0000-370a-550ece0d0000 pid=3534 execve guuid=9fc3f06f-1a00-0000-370a-550ecf0d0000 pid=3535 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=9fc3f06f-1a00-0000-370a-550ecf0d0000 pid=3535 execve guuid=e7484570-1a00-0000-370a-550ed00d0000 pid=3536 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=e7484570-1a00-0000-370a-550ed00d0000 pid=3536 execve guuid=77f64871-1a00-0000-370a-550ed10d0000 pid=3537 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=77f64871-1a00-0000-370a-550ed10d0000 pid=3537 execve guuid=7ec60d72-1a00-0000-370a-550ed20d0000 pid=3538 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=7ec60d72-1a00-0000-370a-550ed20d0000 pid=3538 execve guuid=940be172-1a00-0000-370a-550ed60d0000 pid=3542 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=940be172-1a00-0000-370a-550ed60d0000 pid=3542 execve guuid=ff956c73-1a00-0000-370a-550ed70d0000 pid=3543 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=ff956c73-1a00-0000-370a-550ed70d0000 pid=3543 execve guuid=4826d573-1a00-0000-370a-550ed90d0000 pid=3545 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=4826d573-1a00-0000-370a-550ed90d0000 pid=3545 execve guuid=f3734b74-1a00-0000-370a-550edc0d0000 pid=3548 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=f3734b74-1a00-0000-370a-550edc0d0000 pid=3548 execve guuid=5339c674-1a00-0000-370a-550ede0d0000 pid=3550 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=5339c674-1a00-0000-370a-550ede0d0000 pid=3550 execve guuid=7ed72475-1a00-0000-370a-550ee00d0000 pid=3552 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=7ed72475-1a00-0000-370a-550ee00d0000 pid=3552 execve guuid=9c2d8875-1a00-0000-370a-550ee30d0000 pid=3555 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=9c2d8875-1a00-0000-370a-550ee30d0000 pid=3555 execve guuid=875cef75-1a00-0000-370a-550ee50d0000 pid=3557 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=875cef75-1a00-0000-370a-550ee50d0000 pid=3557 execve guuid=5a9b5c76-1a00-0000-370a-550ee60d0000 pid=3558 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=5a9b5c76-1a00-0000-370a-550ee60d0000 pid=3558 execve guuid=b2fabe76-1a00-0000-370a-550ee80d0000 pid=3560 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=b2fabe76-1a00-0000-370a-550ee80d0000 pid=3560 execve guuid=eb3e2377-1a00-0000-370a-550eea0d0000 pid=3562 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=eb3e2377-1a00-0000-370a-550eea0d0000 pid=3562 execve guuid=6ea5a977-1a00-0000-370a-550eeb0d0000 pid=3563 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=6ea5a977-1a00-0000-370a-550eeb0d0000 pid=3563 execve guuid=4bf6d378-1a00-0000-370a-550eec0d0000 pid=3564 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=4bf6d378-1a00-0000-370a-550eec0d0000 pid=3564 execve guuid=6763d379-1a00-0000-370a-550eed0d0000 pid=3565 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=6763d379-1a00-0000-370a-550eed0d0000 pid=3565 execve guuid=46718f7a-1a00-0000-370a-550eef0d0000 pid=3567 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=46718f7a-1a00-0000-370a-550eef0d0000 pid=3567 execve guuid=6bb2177b-1a00-0000-370a-550ef00d0000 pid=3568 /usr/bin/ls guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=6bb2177b-1a00-0000-370a-550ef00d0000 pid=3568 execve guuid=03ae9b7b-1a00-0000-370a-550ef10d0000 pid=3569 /usr/bin/rm guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=03ae9b7b-1a00-0000-370a-550ef10d0000 pid=3569 execve guuid=267fe57b-1a00-0000-370a-550ef20d0000 pid=3570 /usr/bin/wget net send-data write-file guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=267fe57b-1a00-0000-370a-550ef20d0000 pid=3570 execve guuid=74d5b498-1a00-0000-370a-550e300e0000 pid=3632 /usr/bin/chmod guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=74d5b498-1a00-0000-370a-550e300e0000 pid=3632 execve guuid=78a8f098-1a00-0000-370a-550e320e0000 pid=3634 /usr/bin/dash guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=78a8f098-1a00-0000-370a-550e320e0000 pid=3634 clone guuid=9f4b7199-1a00-0000-370a-550e350e0000 pid=3637 /usr/bin/rm guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=9f4b7199-1a00-0000-370a-550e350e0000 pid=3637 execve guuid=1410a799-1a00-0000-370a-550e360e0000 pid=3638 /usr/bin/wget net send-data write-file guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=1410a799-1a00-0000-370a-550e360e0000 pid=3638 execve guuid=aac791b3-1a00-0000-370a-550e760e0000 pid=3702 /usr/bin/chmod guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=aac791b3-1a00-0000-370a-550e760e0000 pid=3702 execve guuid=44eed2b3-1a00-0000-370a-550e770e0000 pid=3703 /usr/bin/dash guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=44eed2b3-1a00-0000-370a-550e770e0000 pid=3703 clone guuid=287f6cb5-1a00-0000-370a-550e7e0e0000 pid=3710 /usr/bin/rm guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=287f6cb5-1a00-0000-370a-550e7e0e0000 pid=3710 execve guuid=1b6ab1b5-1a00-0000-370a-550e7f0e0000 pid=3711 /usr/bin/wget net send-data write-file guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=1b6ab1b5-1a00-0000-370a-550e7f0e0000 pid=3711 execve guuid=ad56d5cf-1a00-0000-370a-550ea60e0000 pid=3750 /usr/bin/chmod guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=ad56d5cf-1a00-0000-370a-550ea60e0000 pid=3750 execve guuid=06dea2d0-1a00-0000-370a-550eaa0e0000 pid=3754 /usr/bin/dash guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=06dea2d0-1a00-0000-370a-550eaa0e0000 pid=3754 clone guuid=a68ec6d2-1a00-0000-370a-550eb20e0000 pid=3762 /usr/bin/rm guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=a68ec6d2-1a00-0000-370a-550eb20e0000 pid=3762 execve guuid=9f6d23d3-1a00-0000-370a-550eb40e0000 pid=3764 /usr/bin/wget net send-data write-file guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=9f6d23d3-1a00-0000-370a-550eb40e0000 pid=3764 execve guuid=3b4dfeeb-1a00-0000-370a-550e080f0000 pid=3848 /usr/bin/chmod guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=3b4dfeeb-1a00-0000-370a-550e080f0000 pid=3848 execve guuid=376368ec-1a00-0000-370a-550e0d0f0000 pid=3853 /usr/bin/dash guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=376368ec-1a00-0000-370a-550e0d0f0000 pid=3853 clone guuid=068b38ee-1a00-0000-370a-550e170f0000 pid=3863 /usr/bin/rm guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=068b38ee-1a00-0000-370a-550e170f0000 pid=3863 execve guuid=f99d99ee-1a00-0000-370a-550e190f0000 pid=3865 /usr/bin/wget net send-data write-file guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=f99d99ee-1a00-0000-370a-550e190f0000 pid=3865 execve guuid=ee4c7408-1b00-0000-370a-550e7d0f0000 pid=3965 /usr/bin/chmod guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=ee4c7408-1b00-0000-370a-550e7d0f0000 pid=3965 execve guuid=b303b108-1b00-0000-370a-550e7f0f0000 pid=3967 /usr/bin/dash guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=b303b108-1b00-0000-370a-550e7f0f0000 pid=3967 clone guuid=87283209-1b00-0000-370a-550e820f0000 pid=3970 /usr/bin/rm delete-file guuid=e8e09a3d-1a00-0000-370a-550ef80c0000 pid=3320->guuid=87283209-1b00-0000-370a-550e820f0000 pid=3970 execve 801186e6-5fe8-5959-a7b4-832d8d66e7aa 129.121.114.124:80 guuid=267fe57b-1a00-0000-370a-550ef20d0000 pid=3570->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 134B guuid=1410a799-1a00-0000-370a-550e360e0000 pid=3638->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 134B guuid=1b6ab1b5-1a00-0000-370a-550e7f0e0000 pid=3711->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 134B guuid=9f6d23d3-1a00-0000-370a-550eb40e0000 pid=3764->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 133B guuid=f99d99ee-1a00-0000-370a-550e190f0000 pid=3865->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 134B
Score:
98%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/e690ccc549b42843172352be51ca95074dc6abc41d18212a46519ea1f625dbc6
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e690ccc549b42843172352be51ca95074dc6abc41d18212a46519ea1f625dbc6/
Threat name:
Document-HTML.Trojan.Bash
Create hunting rule
Status:
Malicious
First seen:
2026-07-14 12:07:44 UTC
File Type:
Text (Shell)
AV detection:
10 of 24 (41.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=42imzrkjwquegfzdkk7fdsuva5g4nk6edumccksgkgpkd5rf3pda._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
discovery linux
Link:
https://tria.ge/reports/260714-n99fbaby8j/
Behaviour
Reads runtime system information
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.26
Link:
https://yomi.yoroi.company/submissions/e690ccc549b42843172352be51ca95074dc6abc41d18212a46519ea1f625dbc6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh e690ccc549b42843172352be51ca95074dc6abc41d18212a46519ea1f625dbc6

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3866369/
  
Delivery method
Distributed via web download

Comments