🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f072c70eb4a1dee1968e7ed6dfe240b02c1d6fe159fe301b08509a56f6e2c8ab. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f072c70eb4a1dee1968e7ed6dfe240b02c1d6fe159fe301b08509a56f6e2c8ab
SHA3-384 hash: 35199d904fde185ee77f4f384d74fa01a6153f5e75239278fda67e264f89bd5afed414497d13139908726bb9a2d1a6c2
SHA1 hash: c3fa3704b39399a52ca95f03b4d97d015685612d
MD5 hash: 9e15a8d0114537b6f900d402933f403f
humanhash: idaho-louisiana-diet-twenty
File name:ok
Download: download sample
File size:1'608 bytes
First seen:2026-09-02 05:23:39 UTC
Last seen:2026-09-02 09:44:43 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 24:bEIEw9HKX8cI+aKZyZQd7QNhmVtRH7xDx1a13qrVvgEkS:b7NKX7IwmQd7QNhGH7xDx1I3iN
TLSH T1B03163DE15181B370102D99E73A33148B58DA1FB289FDBD4C9480DAE82887CDF265B99
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://5.182.210.174/9a1cfan/an/an/a
http://5.182.210.174/269a05n/an/an/a
http://5.182.210.174/35cbbfn/an/an/a
http://5.182.210.174/621785n/an/an/a
http://5.182.210.174/2a2603n/an/an/a
http://5.182.210.174/5fd37fn/an/an/a
http://5.182.210.174/58f550n/an/an/a
http://5.182.210.174/35e3a2n/an/an/a
http://5.182.210.174/f32b98n/an/an/a
http://5.182.210.174/4eb394n/an/an/a
http://5.182.210.174/442489n/an/an/a
http://5.182.210.174/337b04n/an/an/a

Intelligence

File Origin
# of uploads :
2
# of downloads :
78
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive mirai
Link:
https://www.filescan.io/uploads/6a97b2fc8e22ced6d61b452b/reports/9c87c1f5-6fe7-4940-8a6a-4c9458077194/overview
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/5b5dcc85-ee65-4129-b7a0-f81b46c48a71
Behavior Graph:
Download SVG
%3 guuid=fc16f2ca-1600-0000-e863-c84e770d0000 pid=3447 /usr/bin/sudo guuid=927acfcc-1600-0000-e863-c84e7d0d0000 pid=3453 /tmp/sample.bin guuid=fc16f2ca-1600-0000-e863-c84e770d0000 pid=3447->guuid=927acfcc-1600-0000-e863-c84e7d0d0000 pid=3453 execve guuid=855f2bcd-1600-0000-e863-c84e7f0d0000 pid=3455 /usr/bin/wget net send-data guuid=927acfcc-1600-0000-e863-c84e7d0d0000 pid=3453->guuid=855f2bcd-1600-0000-e863-c84e7f0d0000 pid=3455 execve guuid=58981ad2-1600-0000-e863-c84e8f0d0000 pid=3471 /usr/bin/curl net send-data write-file guuid=927acfcc-1600-0000-e863-c84e7d0d0000 pid=3453->guuid=58981ad2-1600-0000-e863-c84e8f0d0000 pid=3471 execve guuid=2d4699da-1600-0000-e863-c84ea80d0000 pid=3496 /usr/bin/chmod guuid=927acfcc-1600-0000-e863-c84e7d0d0000 pid=3453->guuid=2d4699da-1600-0000-e863-c84ea80d0000 pid=3496 execve guuid=6c2ee2da-1600-0000-e863-c84ea90d0000 pid=3497 /usr/bin/bash guuid=927acfcc-1600-0000-e863-c84e7d0d0000 pid=3453->guuid=6c2ee2da-1600-0000-e863-c84ea90d0000 pid=3497 clone guuid=c70719db-1600-0000-e863-c84eae0d0000 pid=3502 /usr/bin/rm delete-file guuid=927acfcc-1600-0000-e863-c84e7d0d0000 pid=3453->guuid=c70719db-1600-0000-e863-c84eae0d0000 pid=3502 execve guuid=99c358db-1600-0000-e863-c84eaf0d0000 pid=3503 /usr/bin/rm guuid=927acfcc-1600-0000-e863-c84e7d0d0000 pid=3453->guuid=99c358db-1600-0000-e863-c84eaf0d0000 pid=3503 execve guuid=d3b1a7db-1600-0000-e863-c84eb00d0000 pid=3504 /usr/bin/wget net send-data guuid=927acfcc-1600-0000-e863-c84e7d0d0000 pid=3453->guuid=d3b1a7db-1600-0000-e863-c84eb00d0000 pid=3504 execve guuid=5b4088de-1600-0000-e863-c84ec00d0000 pid=3520 /usr/bin/curl net send-data write-file guuid=927acfcc-1600-0000-e863-c84e7d0d0000 pid=3453->guuid=5b4088de-1600-0000-e863-c84ec00d0000 pid=3520 execve guuid=692d08e3-1600-0000-e863-c84ece0d0000 pid=3534 /usr/bin/chmod guuid=927acfcc-1600-0000-e863-c84e7d0d0000 pid=3453->guuid=692d08e3-1600-0000-e863-c84ece0d0000 pid=3534 execve guuid=fc308de3-1600-0000-e863-c84ed00d0000 pid=3536 /usr/bin/bash guuid=927acfcc-1600-0000-e863-c84e7d0d0000 pid=3453->guuid=fc308de3-1600-0000-e863-c84ed00d0000 pid=3536 clone guuid=8cbafbe3-1600-0000-e863-c84ed40d0000 pid=3540 /usr/bin/rm delete-file guuid=927acfcc-1600-0000-e863-c84e7d0d0000 pid=3453->guuid=8cbafbe3-1600-0000-e863-c84ed40d0000 pid=3540 execve guuid=44233fe4-1600-0000-e863-c84ed60d0000 pid=3542 /usr/bin/rm guuid=927acfcc-1600-0000-e863-c84e7d0d0000 pid=3453->guuid=44233fe4-1600-0000-e863-c84ed60d0000 pid=3542 execve guuid=6a4c8de4-1600-0000-e863-c84ed80d0000 pid=3544 /usr/bin/wget net send-data guuid=927acfcc-1600-0000-e863-c84e7d0d0000 pid=3453->guuid=6a4c8de4-1600-0000-e863-c84ed80d0000 pid=3544 execve guuid=b4ea80e7-1600-0000-e863-c84ee00d0000 pid=3552 /usr/bin/curl net send-data write-file guuid=927acfcc-1600-0000-e863-c84e7d0d0000 pid=3453->guuid=b4ea80e7-1600-0000-e863-c84ee00d0000 pid=3552 execve guuid=135e2beb-1600-0000-e863-c84ee70d0000 pid=3559 /usr/bin/chmod guuid=927acfcc-1600-0000-e863-c84e7d0d0000 pid=3453->guuid=135e2beb-1600-0000-e863-c84ee70d0000 pid=3559 execve guuid=f04098eb-1600-0000-e863-c84ee80d0000 pid=3560 /usr/bin/bash guuid=927acfcc-1600-0000-e863-c84e7d0d0000 pid=3453->guuid=f04098eb-1600-0000-e863-c84ee80d0000 pid=3560 clone guuid=8301fceb-1600-0000-e863-c84eea0d0000 pid=3562 /usr/bin/rm delete-file guuid=927acfcc-1600-0000-e863-c84e7d0d0000 pid=3453->guuid=8301fceb-1600-0000-e863-c84eea0d0000 pid=3562 execve guuid=3f308aec-1600-0000-e863-c84eeb0d0000 pid=3563 /usr/bin/rm guuid=927acfcc-1600-0000-e863-c84e7d0d0000 pid=3453->guuid=3f308aec-1600-0000-e863-c84eeb0d0000 pid=3563 execve guuid=9d560aed-1600-0000-e863-c84eec0d0000 pid=3564 /usr/bin/wget net send-data guuid=927acfcc-1600-0000-e863-c84e7d0d0000 pid=3453->guuid=9d560aed-1600-0000-e863-c84eec0d0000 pid=3564 execve guuid=a67260f0-1600-0000-e863-c84eed0d0000 pid=3565 /usr/bin/curl net send-data write-file guuid=927acfcc-1600-0000-e863-c84e7d0d0000 pid=3453->guuid=a67260f0-1600-0000-e863-c84eed0d0000 pid=3565 execve guuid=e051b6f5-1600-0000-e863-c84eee0d0000 pid=3566 /usr/bin/chmod guuid=927acfcc-1600-0000-e863-c84e7d0d0000 pid=3453->guuid=e051b6f5-1600-0000-e863-c84eee0d0000 pid=3566 execve guuid=9ddb11f6-1600-0000-e863-c84eef0d0000 pid=3567 /usr/bin/bash guuid=927acfcc-1600-0000-e863-c84e7d0d0000 pid=3453->guuid=9ddb11f6-1600-0000-e863-c84eef0d0000 pid=3567 clone guuid=a3929bf6-1600-0000-e863-c84ef10d0000 pid=3569 /usr/bin/rm delete-file guuid=927acfcc-1600-0000-e863-c84e7d0d0000 pid=3453->guuid=a3929bf6-1600-0000-e863-c84ef10d0000 pid=3569 execve guuid=0dc833f7-1600-0000-e863-c84ef50d0000 pid=3573 /usr/bin/rm guuid=927acfcc-1600-0000-e863-c84e7d0d0000 pid=3453->guuid=0dc833f7-1600-0000-e863-c84ef50d0000 pid=3573 execve guuid=8a0877f7-1600-0000-e863-c84ef90d0000 pid=3577 /usr/bin/wget net send-data guuid=927acfcc-1600-0000-e863-c84e7d0d0000 pid=3453->guuid=8a0877f7-1600-0000-e863-c84ef90d0000 pid=3577 execve guuid=d877e7fb-1600-0000-e863-c84e060e0000 pid=3590 /usr/bin/curl net send-data write-file guuid=927acfcc-1600-0000-e863-c84e7d0d0000 pid=3453->guuid=d877e7fb-1600-0000-e863-c84e060e0000 pid=3590 execve guuid=2fc62007-1700-0000-e863-c84e1e0e0000 pid=3614 /usr/bin/chmod guuid=927acfcc-1600-0000-e863-c84e7d0d0000 pid=3453->guuid=2fc62007-1700-0000-e863-c84e1e0e0000 pid=3614 execve guuid=070f8e07-1700-0000-e863-c84e1f0e0000 pid=3615 /usr/bin/bash guuid=927acfcc-1600-0000-e863-c84e7d0d0000 pid=3453->guuid=070f8e07-1700-0000-e863-c84e1f0e0000 pid=3615 clone guuid=2dc3d807-1700-0000-e863-c84e210e0000 pid=3617 /usr/bin/rm delete-file guuid=927acfcc-1600-0000-e863-c84e7d0d0000 pid=3453->guuid=2dc3d807-1700-0000-e863-c84e210e0000 pid=3617 execve guuid=1b1f3b08-1700-0000-e863-c84e250e0000 pid=3621 /usr/bin/rm guuid=927acfcc-1600-0000-e863-c84e7d0d0000 pid=3453->guuid=1b1f3b08-1700-0000-e863-c84e250e0000 pid=3621 execve guuid=5a5c9108-1700-0000-e863-c84e260e0000 pid=3622 /usr/bin/wget net send-data guuid=927acfcc-1600-0000-e863-c84e7d0d0000 pid=3453->guuid=5a5c9108-1700-0000-e863-c84e260e0000 pid=3622 execve guuid=f559730b-1700-0000-e863-c84e2d0e0000 pid=3629 /usr/bin/curl net send-data write-file guuid=927acfcc-1600-0000-e863-c84e7d0d0000 pid=3453->guuid=f559730b-1700-0000-e863-c84e2d0e0000 pid=3629 execve guuid=95bed10f-1700-0000-e863-c84e3b0e0000 pid=3643 /usr/bin/chmod guuid=927acfcc-1600-0000-e863-c84e7d0d0000 pid=3453->guuid=95bed10f-1700-0000-e863-c84e3b0e0000 pid=3643 execve guuid=a6951212-1700-0000-e863-c84e410e0000 pid=3649 /usr/bin/bash guuid=927acfcc-1600-0000-e863-c84e7d0d0000 pid=3453->guuid=a6951212-1700-0000-e863-c84e410e0000 pid=3649 clone guuid=093ba612-1700-0000-e863-c84e460e0000 pid=3654 /usr/bin/rm delete-file guuid=927acfcc-1600-0000-e863-c84e7d0d0000 pid=3453->guuid=093ba612-1700-0000-e863-c84e460e0000 pid=3654 execve guuid=9c9d8313-1700-0000-e863-c84e490e0000 pid=3657 /usr/bin/rm guuid=927acfcc-1600-0000-e863-c84e7d0d0000 pid=3453->guuid=9c9d8313-1700-0000-e863-c84e490e0000 pid=3657 execve guuid=adb5f213-1700-0000-e863-c84e4d0e0000 pid=3661 /usr/bin/wget net send-data guuid=927acfcc-1600-0000-e863-c84e7d0d0000 pid=3453->guuid=adb5f213-1700-0000-e863-c84e4d0e0000 pid=3661 execve guuid=a70e7417-1700-0000-e863-c84e540e0000 pid=3668 /usr/bin/curl net send-data write-file guuid=927acfcc-1600-0000-e863-c84e7d0d0000 pid=3453->guuid=a70e7417-1700-0000-e863-c84e540e0000 pid=3668 execve guuid=eeb1ad1d-1700-0000-e863-c84e630e0000 pid=3683 /usr/bin/chmod guuid=927acfcc-1600-0000-e863-c84e7d0d0000 pid=3453->guuid=eeb1ad1d-1700-0000-e863-c84e630e0000 pid=3683 execve guuid=a559fd1d-1700-0000-e863-c84e650e0000 pid=3685 /usr/bin/bash guuid=927acfcc-1600-0000-e863-c84e7d0d0000 pid=3453->guuid=a559fd1d-1700-0000-e863-c84e650e0000 pid=3685 clone guuid=f0e8401e-1700-0000-e863-c84e670e0000 pid=3687 /usr/bin/rm delete-file guuid=927acfcc-1600-0000-e863-c84e7d0d0000 pid=3453->guuid=f0e8401e-1700-0000-e863-c84e670e0000 pid=3687 execve guuid=7003971e-1700-0000-e863-c84e690e0000 pid=3689 /usr/bin/rm guuid=927acfcc-1600-0000-e863-c84e7d0d0000 pid=3453->guuid=7003971e-1700-0000-e863-c84e690e0000 pid=3689 execve guuid=e5eee61e-1700-0000-e863-c84e6b0e0000 pid=3691 /usr/bin/wget net send-data guuid=927acfcc-1600-0000-e863-c84e7d0d0000 pid=3453->guuid=e5eee61e-1700-0000-e863-c84e6b0e0000 pid=3691 execve guuid=4697fa21-1700-0000-e863-c84e710e0000 pid=3697 /usr/bin/curl net send-data write-file guuid=927acfcc-1600-0000-e863-c84e7d0d0000 pid=3453->guuid=4697fa21-1700-0000-e863-c84e710e0000 pid=3697 execve guuid=c01e8526-1700-0000-e863-c84e840e0000 pid=3716 /usr/bin/chmod guuid=927acfcc-1600-0000-e863-c84e7d0d0000 pid=3453->guuid=c01e8526-1700-0000-e863-c84e840e0000 pid=3716 execve guuid=d0e8cf26-1700-0000-e863-c84e870e0000 pid=3719 /usr/bin/bash guuid=927acfcc-1600-0000-e863-c84e7d0d0000 pid=3453->guuid=d0e8cf26-1700-0000-e863-c84e870e0000 pid=3719 clone guuid=b50c0927-1700-0000-e863-c84e890e0000 pid=3721 /usr/bin/rm delete-file guuid=927acfcc-1600-0000-e863-c84e7d0d0000 pid=3453->guuid=b50c0927-1700-0000-e863-c84e890e0000 pid=3721 execve guuid=ad105227-1700-0000-e863-c84e8c0e0000 pid=3724 /usr/bin/rm guuid=927acfcc-1600-0000-e863-c84e7d0d0000 pid=3453->guuid=ad105227-1700-0000-e863-c84e8c0e0000 pid=3724 execve guuid=97668b27-1700-0000-e863-c84e8e0e0000 pid=3726 /usr/bin/wget net send-data guuid=927acfcc-1600-0000-e863-c84e7d0d0000 pid=3453->guuid=97668b27-1700-0000-e863-c84e8e0e0000 pid=3726 execve guuid=1707fb29-1700-0000-e863-c84ea20e0000 pid=3746 /usr/bin/curl net send-data write-file guuid=927acfcc-1600-0000-e863-c84e7d0d0000 pid=3453->guuid=1707fb29-1700-0000-e863-c84ea20e0000 pid=3746 execve guuid=9d5fa52d-1700-0000-e863-c84eb20e0000 pid=3762 /usr/bin/chmod guuid=927acfcc-1600-0000-e863-c84e7d0d0000 pid=3453->guuid=9d5fa52d-1700-0000-e863-c84eb20e0000 pid=3762 execve guuid=c92be02d-1700-0000-e863-c84eb40e0000 pid=3764 /usr/bin/bash guuid=927acfcc-1600-0000-e863-c84e7d0d0000 pid=3453->guuid=c92be02d-1700-0000-e863-c84eb40e0000 pid=3764 clone guuid=0452182e-1700-0000-e863-c84eb70e0000 pid=3767 /usr/bin/rm delete-file guuid=927acfcc-1600-0000-e863-c84e7d0d0000 pid=3453->guuid=0452182e-1700-0000-e863-c84eb70e0000 pid=3767 execve guuid=4fb35c2e-1700-0000-e863-c84eb90e0000 pid=3769 /usr/bin/rm guuid=927acfcc-1600-0000-e863-c84e7d0d0000 pid=3453->guuid=4fb35c2e-1700-0000-e863-c84eb90e0000 pid=3769 execve guuid=5b30a72e-1700-0000-e863-c84ebb0e0000 pid=3771 /usr/bin/wget net send-data guuid=927acfcc-1600-0000-e863-c84e7d0d0000 pid=3453->guuid=5b30a72e-1700-0000-e863-c84ebb0e0000 pid=3771 execve guuid=36c86b31-1700-0000-e863-c84ecc0e0000 pid=3788 /usr/bin/curl net send-data write-file guuid=927acfcc-1600-0000-e863-c84e7d0d0000 pid=3453->guuid=36c86b31-1700-0000-e863-c84ecc0e0000 pid=3788 execve guuid=f89dca34-1700-0000-e863-c84ed70e0000 pid=3799 /usr/bin/chmod guuid=927acfcc-1600-0000-e863-c84e7d0d0000 pid=3453->guuid=f89dca34-1700-0000-e863-c84ed70e0000 pid=3799 execve guuid=78a90c35-1700-0000-e863-c84edb0e0000 pid=3803 /usr/bin/bash guuid=927acfcc-1600-0000-e863-c84e7d0d0000 pid=3453->guuid=78a90c35-1700-0000-e863-c84edb0e0000 pid=3803 clone guuid=bf5a5435-1700-0000-e863-c84edd0e0000 pid=3805 /usr/bin/rm delete-file guuid=927acfcc-1600-0000-e863-c84e7d0d0000 pid=3453->guuid=bf5a5435-1700-0000-e863-c84edd0e0000 pid=3805 execve guuid=48639e35-1700-0000-e863-c84edf0e0000 pid=3807 /usr/bin/rm guuid=927acfcc-1600-0000-e863-c84e7d0d0000 pid=3453->guuid=48639e35-1700-0000-e863-c84edf0e0000 pid=3807 execve guuid=0405eb35-1700-0000-e863-c84ee10e0000 pid=3809 /usr/bin/wget net send-data guuid=927acfcc-1600-0000-e863-c84e7d0d0000 pid=3453->guuid=0405eb35-1700-0000-e863-c84ee10e0000 pid=3809 execve guuid=610ec938-1700-0000-e863-c84eee0e0000 pid=3822 /usr/bin/curl net send-data write-file guuid=927acfcc-1600-0000-e863-c84e7d0d0000 pid=3453->guuid=610ec938-1700-0000-e863-c84eee0e0000 pid=3822 execve guuid=2556893d-1700-0000-e863-c84e030f0000 pid=3843 /usr/bin/chmod guuid=927acfcc-1600-0000-e863-c84e7d0d0000 pid=3453->guuid=2556893d-1700-0000-e863-c84e030f0000 pid=3843 execve guuid=9d20ec3d-1700-0000-e863-c84e050f0000 pid=3845 /usr/bin/bash guuid=927acfcc-1600-0000-e863-c84e7d0d0000 pid=3453->guuid=9d20ec3d-1700-0000-e863-c84e050f0000 pid=3845 clone guuid=0b82353e-1700-0000-e863-c84e080f0000 pid=3848 /usr/bin/rm delete-file guuid=927acfcc-1600-0000-e863-c84e7d0d0000 pid=3453->guuid=0b82353e-1700-0000-e863-c84e080f0000 pid=3848 execve guuid=0694953e-1700-0000-e863-c84e0c0f0000 pid=3852 /usr/bin/rm guuid=927acfcc-1600-0000-e863-c84e7d0d0000 pid=3453->guuid=0694953e-1700-0000-e863-c84e0c0f0000 pid=3852 execve guuid=cfd1eb3e-1700-0000-e863-c84e100f0000 pid=3856 /usr/bin/wget net send-data guuid=927acfcc-1600-0000-e863-c84e7d0d0000 pid=3453->guuid=cfd1eb3e-1700-0000-e863-c84e100f0000 pid=3856 execve guuid=fea8d441-1700-0000-e863-c84e190f0000 pid=3865 /usr/bin/curl net send-data write-file guuid=927acfcc-1600-0000-e863-c84e7d0d0000 pid=3453->guuid=fea8d441-1700-0000-e863-c84e190f0000 pid=3865 execve guuid=8f210d46-1700-0000-e863-c84e290f0000 pid=3881 /usr/bin/chmod guuid=927acfcc-1600-0000-e863-c84e7d0d0000 pid=3453->guuid=8f210d46-1700-0000-e863-c84e290f0000 pid=3881 execve guuid=c4a8b046-1700-0000-e863-c84e2d0f0000 pid=3885 /usr/bin/bash guuid=927acfcc-1600-0000-e863-c84e7d0d0000 pid=3453->guuid=c4a8b046-1700-0000-e863-c84e2d0f0000 pid=3885 clone guuid=f4e3e946-1700-0000-e863-c84e320f0000 pid=3890 /usr/bin/rm delete-file guuid=927acfcc-1600-0000-e863-c84e7d0d0000 pid=3453->guuid=f4e3e946-1700-0000-e863-c84e320f0000 pid=3890 execve guuid=69a83047-1700-0000-e863-c84e340f0000 pid=3892 /usr/bin/rm guuid=927acfcc-1600-0000-e863-c84e7d0d0000 pid=3453->guuid=69a83047-1700-0000-e863-c84e340f0000 pid=3892 execve 5b654972-c9e1-50d8-b372-2dc2a5b9ad66 5.182.210.174:80 guuid=855f2bcd-1600-0000-e863-c84e7f0d0000 pid=3455->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=58981ad2-1600-0000-e863-c84e8f0d0000 pid=3471->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=08f8fada-1600-0000-e863-c84eaa0d0000 pid=3498 /usr/bin/bash guuid=6c2ee2da-1600-0000-e863-c84ea90d0000 pid=3497->guuid=08f8fada-1600-0000-e863-c84eaa0d0000 pid=3498 clone guuid=d3b1a7db-1600-0000-e863-c84eb00d0000 pid=3504->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=5b4088de-1600-0000-e863-c84ec00d0000 pid=3520->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=7069a4e3-1600-0000-e863-c84ed20d0000 pid=3538 /usr/bin/bash guuid=fc308de3-1600-0000-e863-c84ed00d0000 pid=3536->guuid=7069a4e3-1600-0000-e863-c84ed20d0000 pid=3538 clone guuid=6a4c8de4-1600-0000-e863-c84ed80d0000 pid=3544->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=b4ea80e7-1600-0000-e863-c84ee00d0000 pid=3552->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=139bc2eb-1600-0000-e863-c84ee90d0000 pid=3561 /usr/bin/bash guuid=f04098eb-1600-0000-e863-c84ee80d0000 pid=3560->guuid=139bc2eb-1600-0000-e863-c84ee90d0000 pid=3561 clone guuid=9d560aed-1600-0000-e863-c84eec0d0000 pid=3564->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=a67260f0-1600-0000-e863-c84eed0d0000 pid=3565->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=47e734f6-1600-0000-e863-c84ef00d0000 pid=3568 /usr/bin/bash guuid=9ddb11f6-1600-0000-e863-c84eef0d0000 pid=3567->guuid=47e734f6-1600-0000-e863-c84ef00d0000 pid=3568 clone guuid=8a0877f7-1600-0000-e863-c84ef90d0000 pid=3577->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=d877e7fb-1600-0000-e863-c84e060e0000 pid=3590->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=69c4ad07-1700-0000-e863-c84e200e0000 pid=3616 /usr/bin/bash guuid=070f8e07-1700-0000-e863-c84e1f0e0000 pid=3615->guuid=69c4ad07-1700-0000-e863-c84e200e0000 pid=3616 clone guuid=5a5c9108-1700-0000-e863-c84e260e0000 pid=3622->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=f559730b-1700-0000-e863-c84e2d0e0000 pid=3629->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=77673212-1700-0000-e863-c84e420e0000 pid=3650 /usr/bin/bash guuid=a6951212-1700-0000-e863-c84e410e0000 pid=3649->guuid=77673212-1700-0000-e863-c84e420e0000 pid=3650 clone guuid=adb5f213-1700-0000-e863-c84e4d0e0000 pid=3661->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=a70e7417-1700-0000-e863-c84e540e0000 pid=3668->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=b7251c1e-1700-0000-e863-c84e660e0000 pid=3686 /usr/bin/bash guuid=a559fd1d-1700-0000-e863-c84e650e0000 pid=3685->guuid=b7251c1e-1700-0000-e863-c84e660e0000 pid=3686 clone guuid=e5eee61e-1700-0000-e863-c84e6b0e0000 pid=3691->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=4697fa21-1700-0000-e863-c84e710e0000 pid=3697->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=d184e726-1700-0000-e863-c84e880e0000 pid=3720 /usr/bin/bash guuid=d0e8cf26-1700-0000-e863-c84e870e0000 pid=3719->guuid=d184e726-1700-0000-e863-c84e880e0000 pid=3720 clone guuid=97668b27-1700-0000-e863-c84e8e0e0000 pid=3726->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=1707fb29-1700-0000-e863-c84ea20e0000 pid=3746->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=8ecdf22d-1700-0000-e863-c84eb50e0000 pid=3765 /usr/bin/bash guuid=c92be02d-1700-0000-e863-c84eb40e0000 pid=3764->guuid=8ecdf22d-1700-0000-e863-c84eb50e0000 pid=3765 clone guuid=5b30a72e-1700-0000-e863-c84ebb0e0000 pid=3771->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=36c86b31-1700-0000-e863-c84ecc0e0000 pid=3788->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=0e012735-1700-0000-e863-c84edc0e0000 pid=3804 /usr/bin/bash guuid=78a90c35-1700-0000-e863-c84edb0e0000 pid=3803->guuid=0e012735-1700-0000-e863-c84edc0e0000 pid=3804 clone guuid=0405eb35-1700-0000-e863-c84ee10e0000 pid=3809->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=610ec938-1700-0000-e863-c84eee0e0000 pid=3822->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=3d310e3e-1700-0000-e863-c84e070f0000 pid=3847 /usr/bin/bash guuid=9d20ec3d-1700-0000-e863-c84e050f0000 pid=3845->guuid=3d310e3e-1700-0000-e863-c84e070f0000 pid=3847 clone guuid=cfd1eb3e-1700-0000-e863-c84e100f0000 pid=3856->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=fea8d441-1700-0000-e863-c84e190f0000 pid=3865->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=6354c646-1700-0000-e863-c84e310f0000 pid=3889 /usr/bin/bash guuid=c4a8b046-1700-0000-e863-c84e2d0f0000 pid=3885->guuid=6354c646-1700-0000-e863-c84e310f0000 pid=3889 clone
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/f072c70eb4a1dee1968e7ed6dfe240b02c1d6fe159fe301b08509a56f6e2c8ab
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f072c70eb4a1dee1968e7ed6dfe240b02c1d6fe159fe301b08509a56f6e2c8ab/
Gathering data
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6bzmodvuuhpodfuop3ln7ysawawb237blh7dagyikcnfn5xczcvq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260902-f3sj8agk6s/
Behaviour
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.11
Link:
https://yomi.yoroi.company/submissions/f072c70eb4a1dee1968e7ed6dfe240b02c1d6fe159fe301b08509a56f6e2c8ab

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh f072c70eb4a1dee1968e7ed6dfe240b02c1d6fe159fe301b08509a56f6e2c8ab

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3897671/
  
Delivery method
Distributed via web download

Comments