MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f2d8eec71f2ac36975cd7b2f3a5f8a6eee1d11812f2e3a4e6e41812084a6657d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f2d8eec71f2ac36975cd7b2f3a5f8a6eee1d11812f2e3a4e6e41812084a6657d
SHA3-384 hash: 61a931f33a97bfedd539b9bc7bc43a1deef0b6fdcbf80d94b41c11fe6ff6861bb6251d07fdd1211bb25e3f571882e447
SHA1 hash: 43c63c83c30d53a2b8cb664b11442855b05619c6
MD5 hash: e8f981b86304643f1e08bb2a32d20b7f
humanhash: nineteen-july-black-purple
File name:ok
Download: download sample
File size:1'608 bytes
First seen:2026-08-27 08:28:40 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 24:H2gJFrQ4j0MaIOTHfyylW6hsG+AoZzp9c:nXQ4balzyylW6hsGoZc
TLSH T169313EDF94206A711142CA8EB7A2654C664DA6FB2C5FD7D4DD0C4FEA824C38CF261F89
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://5.182.210.174/89add4n/an/an/a
http://5.182.210.174/a8b0b9n/an/an/a
http://5.182.210.174/ac409dn/an/an/a
http://5.182.210.174/7b342an/an/an/a
http://5.182.210.174/b62190n/an/an/a
http://5.182.210.174/683a84n/an/an/a
http://5.182.210.174/3454d0n/an/an/a
http://5.182.210.174/152822n/an/an/a
http://5.182.210.174/da99f2n/an/an/a
http://5.182.210.174/a9a603n/an/an/a
http://5.182.210.174/29f5e3n/an/an/a
http://5.182.210.174/da2321n/an/an/a

Intelligence

File Origin
# of uploads :
1
# of downloads :
45
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/27103b2e-dcb2-4ce7-a103-7d2be5a939c4
Behavior Graph:
Download SVG
%3 guuid=6cc0f241-1d00-0000-d29c-31aeee0b0000 pid=3054 /usr/bin/sudo guuid=8260534c-1d00-0000-d29c-31aeef0b0000 pid=3055 /tmp/sample.bin guuid=6cc0f241-1d00-0000-d29c-31aeee0b0000 pid=3054->guuid=8260534c-1d00-0000-d29c-31aeef0b0000 pid=3055 execve guuid=d6158f4d-1d00-0000-d29c-31aef00b0000 pid=3056 /usr/bin/wget net send-data guuid=8260534c-1d00-0000-d29c-31aeef0b0000 pid=3055->guuid=d6158f4d-1d00-0000-d29c-31aef00b0000 pid=3056 execve guuid=dca54f67-1d00-0000-d29c-31aef20b0000 pid=3058 /usr/bin/curl net send-data write-file guuid=8260534c-1d00-0000-d29c-31aeef0b0000 pid=3055->guuid=dca54f67-1d00-0000-d29c-31aef20b0000 pid=3058 execve guuid=052ad4bb-1d00-0000-d29c-31ae160c0000 pid=3094 /usr/bin/chmod guuid=8260534c-1d00-0000-d29c-31aeef0b0000 pid=3055->guuid=052ad4bb-1d00-0000-d29c-31ae160c0000 pid=3094 execve guuid=8c1796bd-1d00-0000-d29c-31ae170c0000 pid=3095 /usr/bin/bash guuid=8260534c-1d00-0000-d29c-31aeef0b0000 pid=3055->guuid=8c1796bd-1d00-0000-d29c-31ae170c0000 pid=3095 clone guuid=9c2154bf-1d00-0000-d29c-31ae190c0000 pid=3097 /usr/bin/rm delete-file guuid=8260534c-1d00-0000-d29c-31aeef0b0000 pid=3055->guuid=9c2154bf-1d00-0000-d29c-31ae190c0000 pid=3097 execve guuid=b01e83c0-1d00-0000-d29c-31ae1a0c0000 pid=3098 /usr/bin/rm guuid=8260534c-1d00-0000-d29c-31aeef0b0000 pid=3055->guuid=b01e83c0-1d00-0000-d29c-31ae1a0c0000 pid=3098 execve guuid=d13cd5c1-1d00-0000-d29c-31ae1b0c0000 pid=3099 /usr/bin/wget net send-data guuid=8260534c-1d00-0000-d29c-31aeef0b0000 pid=3055->guuid=d13cd5c1-1d00-0000-d29c-31ae1b0c0000 pid=3099 execve guuid=c76d23c8-1d00-0000-d29c-31ae1c0c0000 pid=3100 /usr/bin/curl net send-data write-file guuid=8260534c-1d00-0000-d29c-31aeef0b0000 pid=3055->guuid=c76d23c8-1d00-0000-d29c-31ae1c0c0000 pid=3100 execve guuid=aa7878d1-1d00-0000-d29c-31ae1e0c0000 pid=3102 /usr/bin/chmod guuid=8260534c-1d00-0000-d29c-31aeef0b0000 pid=3055->guuid=aa7878d1-1d00-0000-d29c-31ae1e0c0000 pid=3102 execve guuid=5c1d10d3-1d00-0000-d29c-31ae1f0c0000 pid=3103 /usr/bin/bash guuid=8260534c-1d00-0000-d29c-31aeef0b0000 pid=3055->guuid=5c1d10d3-1d00-0000-d29c-31ae1f0c0000 pid=3103 clone guuid=74e327d4-1d00-0000-d29c-31ae230c0000 pid=3107 /usr/bin/rm delete-file guuid=8260534c-1d00-0000-d29c-31aeef0b0000 pid=3055->guuid=74e327d4-1d00-0000-d29c-31ae230c0000 pid=3107 execve guuid=535273d5-1d00-0000-d29c-31ae250c0000 pid=3109 /usr/bin/rm guuid=8260534c-1d00-0000-d29c-31aeef0b0000 pid=3055->guuid=535273d5-1d00-0000-d29c-31ae250c0000 pid=3109 execve guuid=dd671ad6-1d00-0000-d29c-31ae260c0000 pid=3110 /usr/bin/wget net send-data guuid=8260534c-1d00-0000-d29c-31aeef0b0000 pid=3055->guuid=dd671ad6-1d00-0000-d29c-31ae260c0000 pid=3110 execve guuid=1f87b8da-1d00-0000-d29c-31ae2b0c0000 pid=3115 /usr/bin/curl net send-data write-file guuid=8260534c-1d00-0000-d29c-31aeef0b0000 pid=3055->guuid=1f87b8da-1d00-0000-d29c-31ae2b0c0000 pid=3115 execve guuid=3e2c8be3-1d00-0000-d29c-31ae2d0c0000 pid=3117 /usr/bin/chmod guuid=8260534c-1d00-0000-d29c-31aeef0b0000 pid=3055->guuid=3e2c8be3-1d00-0000-d29c-31ae2d0c0000 pid=3117 execve guuid=73e46ee5-1d00-0000-d29c-31ae2f0c0000 pid=3119 /usr/bin/bash guuid=8260534c-1d00-0000-d29c-31aeef0b0000 pid=3055->guuid=73e46ee5-1d00-0000-d29c-31ae2f0c0000 pid=3119 clone guuid=22f090e7-1d00-0000-d29c-31ae330c0000 pid=3123 /usr/bin/rm delete-file guuid=8260534c-1d00-0000-d29c-31aeef0b0000 pid=3055->guuid=22f090e7-1d00-0000-d29c-31ae330c0000 pid=3123 execve guuid=ffd0ede8-1d00-0000-d29c-31ae360c0000 pid=3126 /usr/bin/rm guuid=8260534c-1d00-0000-d29c-31aeef0b0000 pid=3055->guuid=ffd0ede8-1d00-0000-d29c-31ae360c0000 pid=3126 execve guuid=6c5e74ea-1d00-0000-d29c-31ae370c0000 pid=3127 /usr/bin/wget net send-data guuid=8260534c-1d00-0000-d29c-31aeef0b0000 pid=3055->guuid=6c5e74ea-1d00-0000-d29c-31ae370c0000 pid=3127 execve guuid=24e010ef-1d00-0000-d29c-31ae380c0000 pid=3128 /usr/bin/curl net send-data write-file guuid=8260534c-1d00-0000-d29c-31aeef0b0000 pid=3055->guuid=24e010ef-1d00-0000-d29c-31ae380c0000 pid=3128 execve guuid=c81143f5-1d00-0000-d29c-31ae3d0c0000 pid=3133 /usr/bin/chmod guuid=8260534c-1d00-0000-d29c-31aeef0b0000 pid=3055->guuid=c81143f5-1d00-0000-d29c-31ae3d0c0000 pid=3133 execve guuid=9fd108f6-1d00-0000-d29c-31ae3f0c0000 pid=3135 /usr/bin/bash guuid=8260534c-1d00-0000-d29c-31aeef0b0000 pid=3055->guuid=9fd108f6-1d00-0000-d29c-31ae3f0c0000 pid=3135 clone guuid=ea265af6-1d00-0000-d29c-31ae410c0000 pid=3137 /usr/bin/rm delete-file guuid=8260534c-1d00-0000-d29c-31aeef0b0000 pid=3055->guuid=ea265af6-1d00-0000-d29c-31ae410c0000 pid=3137 execve guuid=e12dd3f6-1d00-0000-d29c-31ae440c0000 pid=3140 /usr/bin/rm guuid=8260534c-1d00-0000-d29c-31aeef0b0000 pid=3055->guuid=e12dd3f6-1d00-0000-d29c-31ae440c0000 pid=3140 execve guuid=736152f7-1d00-0000-d29c-31ae450c0000 pid=3141 /usr/bin/wget net send-data guuid=8260534c-1d00-0000-d29c-31aeef0b0000 pid=3055->guuid=736152f7-1d00-0000-d29c-31ae450c0000 pid=3141 execve guuid=70c3fdfb-1d00-0000-d29c-31ae470c0000 pid=3143 /usr/bin/curl net send-data write-file guuid=8260534c-1d00-0000-d29c-31aeef0b0000 pid=3055->guuid=70c3fdfb-1d00-0000-d29c-31ae470c0000 pid=3143 execve guuid=108c4108-1e00-0000-d29c-31ae4e0c0000 pid=3150 /usr/bin/chmod guuid=8260534c-1d00-0000-d29c-31aeef0b0000 pid=3055->guuid=108c4108-1e00-0000-d29c-31ae4e0c0000 pid=3150 execve guuid=ebfa2209-1e00-0000-d29c-31ae500c0000 pid=3152 /usr/bin/bash guuid=8260534c-1d00-0000-d29c-31aeef0b0000 pid=3055->guuid=ebfa2209-1e00-0000-d29c-31ae500c0000 pid=3152 clone guuid=85b33c0a-1e00-0000-d29c-31ae520c0000 pid=3154 /usr/bin/rm delete-file guuid=8260534c-1d00-0000-d29c-31aeef0b0000 pid=3055->guuid=85b33c0a-1e00-0000-d29c-31ae520c0000 pid=3154 execve guuid=921b7f0b-1e00-0000-d29c-31ae530c0000 pid=3155 /usr/bin/rm guuid=8260534c-1d00-0000-d29c-31aeef0b0000 pid=3055->guuid=921b7f0b-1e00-0000-d29c-31ae530c0000 pid=3155 execve guuid=3ab9090c-1e00-0000-d29c-31ae540c0000 pid=3156 /usr/bin/wget net send-data guuid=8260534c-1d00-0000-d29c-31aeef0b0000 pid=3055->guuid=3ab9090c-1e00-0000-d29c-31ae540c0000 pid=3156 execve guuid=42743c12-1e00-0000-d29c-31ae5b0c0000 pid=3163 /usr/bin/curl net send-data write-file guuid=8260534c-1d00-0000-d29c-31aeef0b0000 pid=3055->guuid=42743c12-1e00-0000-d29c-31ae5b0c0000 pid=3163 execve guuid=3260941d-1e00-0000-d29c-31ae620c0000 pid=3170 /usr/bin/chmod guuid=8260534c-1d00-0000-d29c-31aeef0b0000 pid=3055->guuid=3260941d-1e00-0000-d29c-31ae620c0000 pid=3170 execve guuid=58d3b01e-1e00-0000-d29c-31ae640c0000 pid=3172 /usr/bin/bash guuid=8260534c-1d00-0000-d29c-31aeef0b0000 pid=3055->guuid=58d3b01e-1e00-0000-d29c-31ae640c0000 pid=3172 clone guuid=6f6f501f-1e00-0000-d29c-31ae660c0000 pid=3174 /usr/bin/rm delete-file guuid=8260534c-1d00-0000-d29c-31aeef0b0000 pid=3055->guuid=6f6f501f-1e00-0000-d29c-31ae660c0000 pid=3174 execve guuid=16ad7320-1e00-0000-d29c-31ae670c0000 pid=3175 /usr/bin/rm guuid=8260534c-1d00-0000-d29c-31aeef0b0000 pid=3055->guuid=16ad7320-1e00-0000-d29c-31ae670c0000 pid=3175 execve guuid=83cfab21-1e00-0000-d29c-31ae680c0000 pid=3176 /usr/bin/wget net send-data guuid=8260534c-1d00-0000-d29c-31aeef0b0000 pid=3055->guuid=83cfab21-1e00-0000-d29c-31ae680c0000 pid=3176 execve guuid=90290626-1e00-0000-d29c-31ae6a0c0000 pid=3178 /usr/bin/curl net send-data write-file guuid=8260534c-1d00-0000-d29c-31aeef0b0000 pid=3055->guuid=90290626-1e00-0000-d29c-31ae6a0c0000 pid=3178 execve guuid=1157bc2d-1e00-0000-d29c-31ae700c0000 pid=3184 /usr/bin/chmod guuid=8260534c-1d00-0000-d29c-31aeef0b0000 pid=3055->guuid=1157bc2d-1e00-0000-d29c-31ae700c0000 pid=3184 execve guuid=93f4892e-1e00-0000-d29c-31ae720c0000 pid=3186 /usr/bin/bash guuid=8260534c-1d00-0000-d29c-31aeef0b0000 pid=3055->guuid=93f4892e-1e00-0000-d29c-31ae720c0000 pid=3186 clone guuid=1a9bb72f-1e00-0000-d29c-31ae750c0000 pid=3189 /usr/bin/rm delete-file guuid=8260534c-1d00-0000-d29c-31aeef0b0000 pid=3055->guuid=1a9bb72f-1e00-0000-d29c-31ae750c0000 pid=3189 execve guuid=ceef4430-1e00-0000-d29c-31ae770c0000 pid=3191 /usr/bin/rm guuid=8260534c-1d00-0000-d29c-31aeef0b0000 pid=3055->guuid=ceef4430-1e00-0000-d29c-31ae770c0000 pid=3191 execve guuid=837d6f31-1e00-0000-d29c-31ae790c0000 pid=3193 /usr/bin/wget net send-data guuid=8260534c-1d00-0000-d29c-31aeef0b0000 pid=3055->guuid=837d6f31-1e00-0000-d29c-31ae790c0000 pid=3193 execve guuid=45025a3b-1e00-0000-d29c-31ae820c0000 pid=3202 /usr/bin/curl net send-data write-file guuid=8260534c-1d00-0000-d29c-31aeef0b0000 pid=3055->guuid=45025a3b-1e00-0000-d29c-31ae820c0000 pid=3202 execve guuid=87bc8d4e-1e00-0000-d29c-31ae870c0000 pid=3207 /usr/bin/chmod guuid=8260534c-1d00-0000-d29c-31aeef0b0000 pid=3055->guuid=87bc8d4e-1e00-0000-d29c-31ae870c0000 pid=3207 execve guuid=cc3e644f-1e00-0000-d29c-31ae880c0000 pid=3208 /usr/bin/bash guuid=8260534c-1d00-0000-d29c-31aeef0b0000 pid=3055->guuid=cc3e644f-1e00-0000-d29c-31ae880c0000 pid=3208 clone guuid=459d1750-1e00-0000-d29c-31ae8a0c0000 pid=3210 /usr/bin/rm delete-file guuid=8260534c-1d00-0000-d29c-31aeef0b0000 pid=3055->guuid=459d1750-1e00-0000-d29c-31ae8a0c0000 pid=3210 execve guuid=1531db50-1e00-0000-d29c-31ae8c0c0000 pid=3212 /usr/bin/rm guuid=8260534c-1d00-0000-d29c-31aeef0b0000 pid=3055->guuid=1531db50-1e00-0000-d29c-31ae8c0c0000 pid=3212 execve guuid=fb4f8551-1e00-0000-d29c-31ae8e0c0000 pid=3214 /usr/bin/wget net send-data guuid=8260534c-1d00-0000-d29c-31aeef0b0000 pid=3055->guuid=fb4f8551-1e00-0000-d29c-31ae8e0c0000 pid=3214 execve guuid=b559f255-1e00-0000-d29c-31ae950c0000 pid=3221 /usr/bin/curl net send-data write-file guuid=8260534c-1d00-0000-d29c-31aeef0b0000 pid=3055->guuid=b559f255-1e00-0000-d29c-31ae950c0000 pid=3221 execve guuid=21ac175f-1e00-0000-d29c-31ae9f0c0000 pid=3231 /usr/bin/chmod guuid=8260534c-1d00-0000-d29c-31aeef0b0000 pid=3055->guuid=21ac175f-1e00-0000-d29c-31ae9f0c0000 pid=3231 execve guuid=31b98b61-1e00-0000-d29c-31aea10c0000 pid=3233 /usr/bin/bash guuid=8260534c-1d00-0000-d29c-31aeef0b0000 pid=3055->guuid=31b98b61-1e00-0000-d29c-31aea10c0000 pid=3233 clone guuid=0de34862-1e00-0000-d29c-31aea40c0000 pid=3236 /usr/bin/rm delete-file guuid=8260534c-1d00-0000-d29c-31aeef0b0000 pid=3055->guuid=0de34862-1e00-0000-d29c-31aea40c0000 pid=3236 execve guuid=d47cbb62-1e00-0000-d29c-31aea60c0000 pid=3238 /usr/bin/rm guuid=8260534c-1d00-0000-d29c-31aeef0b0000 pid=3055->guuid=d47cbb62-1e00-0000-d29c-31aea60c0000 pid=3238 execve guuid=b2addd63-1e00-0000-d29c-31aea70c0000 pid=3239 /usr/bin/wget net send-data guuid=8260534c-1d00-0000-d29c-31aeef0b0000 pid=3055->guuid=b2addd63-1e00-0000-d29c-31aea70c0000 pid=3239 execve guuid=861ef767-1e00-0000-d29c-31aeab0c0000 pid=3243 /usr/bin/curl net send-data write-file guuid=8260534c-1d00-0000-d29c-31aeef0b0000 pid=3055->guuid=861ef767-1e00-0000-d29c-31aeab0c0000 pid=3243 execve guuid=7c7e8770-1e00-0000-d29c-31aeb40c0000 pid=3252 /usr/bin/chmod guuid=8260534c-1d00-0000-d29c-31aeef0b0000 pid=3055->guuid=7c7e8770-1e00-0000-d29c-31aeb40c0000 pid=3252 execve guuid=5a089871-1e00-0000-d29c-31aeb60c0000 pid=3254 /usr/bin/bash guuid=8260534c-1d00-0000-d29c-31aeef0b0000 pid=3055->guuid=5a089871-1e00-0000-d29c-31aeb60c0000 pid=3254 clone guuid=5e4abc72-1e00-0000-d29c-31aeba0c0000 pid=3258 /usr/bin/rm delete-file guuid=8260534c-1d00-0000-d29c-31aeef0b0000 pid=3055->guuid=5e4abc72-1e00-0000-d29c-31aeba0c0000 pid=3258 execve guuid=aadcb173-1e00-0000-d29c-31aebc0c0000 pid=3260 /usr/bin/rm guuid=8260534c-1d00-0000-d29c-31aeef0b0000 pid=3055->guuid=aadcb173-1e00-0000-d29c-31aebc0c0000 pid=3260 execve guuid=2bb0ee74-1e00-0000-d29c-31aebd0c0000 pid=3261 /usr/bin/wget net send-data guuid=8260534c-1d00-0000-d29c-31aeef0b0000 pid=3055->guuid=2bb0ee74-1e00-0000-d29c-31aebd0c0000 pid=3261 execve guuid=acbfc579-1e00-0000-d29c-31aec40c0000 pid=3268 /usr/bin/curl net send-data write-file guuid=8260534c-1d00-0000-d29c-31aeef0b0000 pid=3055->guuid=acbfc579-1e00-0000-d29c-31aec40c0000 pid=3268 execve guuid=35b60c82-1e00-0000-d29c-31aecb0c0000 pid=3275 /usr/bin/chmod guuid=8260534c-1d00-0000-d29c-31aeef0b0000 pid=3055->guuid=35b60c82-1e00-0000-d29c-31aecb0c0000 pid=3275 execve guuid=6be6b882-1e00-0000-d29c-31aecd0c0000 pid=3277 /usr/bin/bash guuid=8260534c-1d00-0000-d29c-31aeef0b0000 pid=3055->guuid=6be6b882-1e00-0000-d29c-31aecd0c0000 pid=3277 clone guuid=7c2e4b83-1e00-0000-d29c-31aed00c0000 pid=3280 /usr/bin/rm delete-file guuid=8260534c-1d00-0000-d29c-31aeef0b0000 pid=3055->guuid=7c2e4b83-1e00-0000-d29c-31aed00c0000 pid=3280 execve guuid=c9125384-1e00-0000-d29c-31aed10c0000 pid=3281 /usr/bin/rm guuid=8260534c-1d00-0000-d29c-31aeef0b0000 pid=3055->guuid=c9125384-1e00-0000-d29c-31aed10c0000 pid=3281 execve guuid=0e421986-1e00-0000-d29c-31aed20c0000 pid=3282 /usr/bin/wget net send-data guuid=8260534c-1d00-0000-d29c-31aeef0b0000 pid=3055->guuid=0e421986-1e00-0000-d29c-31aed20c0000 pid=3282 execve guuid=70540d8a-1e00-0000-d29c-31aed40c0000 pid=3284 /usr/bin/curl net send-data write-file guuid=8260534c-1d00-0000-d29c-31aeef0b0000 pid=3055->guuid=70540d8a-1e00-0000-d29c-31aed40c0000 pid=3284 execve guuid=9ed65e90-1e00-0000-d29c-31aeda0c0000 pid=3290 /usr/bin/chmod guuid=8260534c-1d00-0000-d29c-31aeef0b0000 pid=3055->guuid=9ed65e90-1e00-0000-d29c-31aeda0c0000 pid=3290 execve guuid=dbd21291-1e00-0000-d29c-31aedb0c0000 pid=3291 /usr/bin/bash guuid=8260534c-1d00-0000-d29c-31aeef0b0000 pid=3055->guuid=dbd21291-1e00-0000-d29c-31aedb0c0000 pid=3291 clone guuid=b24dc391-1e00-0000-d29c-31aede0c0000 pid=3294 /usr/bin/rm delete-file guuid=8260534c-1d00-0000-d29c-31aeef0b0000 pid=3055->guuid=b24dc391-1e00-0000-d29c-31aede0c0000 pid=3294 execve guuid=a0f0ae92-1e00-0000-d29c-31aee10c0000 pid=3297 /usr/bin/rm guuid=8260534c-1d00-0000-d29c-31aeef0b0000 pid=3055->guuid=a0f0ae92-1e00-0000-d29c-31aee10c0000 pid=3297 execve 5b654972-c9e1-50d8-b372-2dc2a5b9ad66 5.182.210.174:80 guuid=d6158f4d-1d00-0000-d29c-31aef00b0000 pid=3056->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=dca54f67-1d00-0000-d29c-31aef20b0000 pid=3058->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=c78e54be-1d00-0000-d29c-31ae180c0000 pid=3096 /usr/bin/bash guuid=8c1796bd-1d00-0000-d29c-31ae170c0000 pid=3095->guuid=c78e54be-1d00-0000-d29c-31ae180c0000 pid=3096 clone guuid=d13cd5c1-1d00-0000-d29c-31ae1b0c0000 pid=3099->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=c76d23c8-1d00-0000-d29c-31ae1c0c0000 pid=3100->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=13aa8ad3-1d00-0000-d29c-31ae210c0000 pid=3105 /usr/bin/bash guuid=5c1d10d3-1d00-0000-d29c-31ae1f0c0000 pid=3103->guuid=13aa8ad3-1d00-0000-d29c-31ae210c0000 pid=3105 clone guuid=dd671ad6-1d00-0000-d29c-31ae260c0000 pid=3110->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=1f87b8da-1d00-0000-d29c-31ae2b0c0000 pid=3115->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=7eadc9e6-1d00-0000-d29c-31ae310c0000 pid=3121 /usr/bin/bash guuid=73e46ee5-1d00-0000-d29c-31ae2f0c0000 pid=3119->guuid=7eadc9e6-1d00-0000-d29c-31ae310c0000 pid=3121 clone guuid=6c5e74ea-1d00-0000-d29c-31ae370c0000 pid=3127->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=24e010ef-1d00-0000-d29c-31ae380c0000 pid=3128->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=868330f6-1d00-0000-d29c-31ae400c0000 pid=3136 /usr/bin/bash guuid=9fd108f6-1d00-0000-d29c-31ae3f0c0000 pid=3135->guuid=868330f6-1d00-0000-d29c-31ae400c0000 pid=3136 clone guuid=736152f7-1d00-0000-d29c-31ae450c0000 pid=3141->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=70c3fdfb-1d00-0000-d29c-31ae470c0000 pid=3143->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=eaac9f09-1e00-0000-d29c-31ae510c0000 pid=3153 /usr/bin/bash guuid=ebfa2209-1e00-0000-d29c-31ae500c0000 pid=3152->guuid=eaac9f09-1e00-0000-d29c-31ae510c0000 pid=3153 clone guuid=3ab9090c-1e00-0000-d29c-31ae540c0000 pid=3156->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=42743c12-1e00-0000-d29c-31ae5b0c0000 pid=3163->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=3d13001f-1e00-0000-d29c-31ae650c0000 pid=3173 /usr/bin/bash guuid=58d3b01e-1e00-0000-d29c-31ae640c0000 pid=3172->guuid=3d13001f-1e00-0000-d29c-31ae650c0000 pid=3173 clone guuid=83cfab21-1e00-0000-d29c-31ae680c0000 pid=3176->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=90290626-1e00-0000-d29c-31ae6a0c0000 pid=3178->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=47ead72e-1e00-0000-d29c-31ae730c0000 pid=3187 /usr/bin/bash guuid=93f4892e-1e00-0000-d29c-31ae720c0000 pid=3186->guuid=47ead72e-1e00-0000-d29c-31ae730c0000 pid=3187 clone guuid=837d6f31-1e00-0000-d29c-31ae790c0000 pid=3193->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=45025a3b-1e00-0000-d29c-31ae820c0000 pid=3202->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=9383914f-1e00-0000-d29c-31ae890c0000 pid=3209 /usr/bin/bash guuid=cc3e644f-1e00-0000-d29c-31ae880c0000 pid=3208->guuid=9383914f-1e00-0000-d29c-31ae890c0000 pid=3209 clone guuid=fb4f8551-1e00-0000-d29c-31ae8e0c0000 pid=3214->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=b559f255-1e00-0000-d29c-31ae950c0000 pid=3221->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=840ea961-1e00-0000-d29c-31aea20c0000 pid=3234 /usr/bin/bash guuid=31b98b61-1e00-0000-d29c-31aea10c0000 pid=3233->guuid=840ea961-1e00-0000-d29c-31aea20c0000 pid=3234 clone guuid=b2addd63-1e00-0000-d29c-31aea70c0000 pid=3239->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=861ef767-1e00-0000-d29c-31aeab0c0000 pid=3243->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=89eb2172-1e00-0000-d29c-31aeb90c0000 pid=3257 /usr/bin/bash guuid=5a089871-1e00-0000-d29c-31aeb60c0000 pid=3254->guuid=89eb2172-1e00-0000-d29c-31aeb90c0000 pid=3257 clone guuid=2bb0ee74-1e00-0000-d29c-31aebd0c0000 pid=3261->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=acbfc579-1e00-0000-d29c-31aec40c0000 pid=3268->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=52830183-1e00-0000-d29c-31aecf0c0000 pid=3279 /usr/bin/bash guuid=6be6b882-1e00-0000-d29c-31aecd0c0000 pid=3277->guuid=52830183-1e00-0000-d29c-31aecf0c0000 pid=3279 clone guuid=0e421986-1e00-0000-d29c-31aed20c0000 pid=3282->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=70540d8a-1e00-0000-d29c-31aed40c0000 pid=3284->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=0e273c91-1e00-0000-d29c-31aedc0c0000 pid=3292 /usr/bin/bash guuid=dbd21291-1e00-0000-d29c-31aedb0c0000 pid=3291->guuid=0e273c91-1e00-0000-d29c-31aedc0c0000 pid=3292 clone
Score:
99%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/f2d8eec71f2ac36975cd7b2f3a5f8a6eee1d11812f2e3a4e6e41812084a6657d
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f2d8eec71f2ac36975cd7b2f3a5f8a6eee1d11812f2e3a4e6e41812084a6657d/
Gathering data
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6lmo5ry7flbws5onpmxtux4kn3xb2embf4xduttoigasbbfgmv6q._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260827-kdnxysgg95/
Behaviour
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh f2d8eec71f2ac36975cd7b2f3a5f8a6eee1d11812f2e3a4e6e41812084a6657d

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3897671/
  
Delivery method
Distributed via web download

Comments