MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f4eed7244be63b1e1ef7597b8a8017cf7b2b3ec5f6ff3c6e2d94ce0e60220340. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f4eed7244be63b1e1ef7597b8a8017cf7b2b3ec5f6ff3c6e2d94ce0e60220340
SHA3-384 hash: d9d80f066f08f546036eabfa1f31fd677adb6bfab3b2fa9fdba7c50cb319627c83eb312f2207fe3729658cc2e40dd916
SHA1 hash: 9d86d7629f716d367aae0fdc640404b941a17323
MD5 hash: e2d4e912a70ff25ac6f0618613346a69
humanhash: idaho-bluebird-virginia-leopard
File name:ok
Download: download sample
File size:1'608 bytes
First seen:2026-08-30 03:20:03 UTC
Last seen:2026-08-30 19:40:49 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 12:UNk6N8XHn6U2Fi6FjhANG76NGAG16NNW6HdBgvlt6hJc8dB3L6B3h+uUlkO76rg+:t67lGrJc8Mcap3Em8MIv2Nn
TLSH T13931A2DE450429721002CE9D737A358CB24EA6FB2C6FE7D09C491EA992483DCF221B5E
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://5.182.210.174/98019dn/an/an/a
http://5.182.210.174/ab6139n/an/an/a
http://5.182.210.174/cd7393n/an/an/a
http://5.182.210.174/9ccc21n/an/an/a
http://5.182.210.174/3eda0en/an/an/a
http://5.182.210.174/d115e5n/an/an/a
http://5.182.210.174/dedebbn/an/an/a
http://5.182.210.174/2de957n/an/an/a
http://5.182.210.174/8c69a2n/an/an/a
http://5.182.210.174/afcc4cn/an/an/a
http://5.182.210.174/62f138n/an/an/a
http://5.182.210.174/a55652n/an/an/a

Intelligence

File Origin
# of uploads :
3
# of downloads :
68
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-08-30T01:28:00Z UTC
Last seen:
2026-08-30T01:52:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/f4eed7244be63b1e1ef7597b8a8017cf7b2b3ec5f6ff3c6e2d94ce0e60220340/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/c9eca2b2-c91c-480a-8b02-330361dd7d8e
Behavior Graph:
Download SVG
%3 guuid=e0eafa20-1d00-0000-3880-f73a9e0a0000 pid=2718 /usr/bin/sudo guuid=47ddcc23-1d00-0000-3880-f73aa30a0000 pid=2723 /tmp/sample.bin guuid=e0eafa20-1d00-0000-3880-f73a9e0a0000 pid=2718->guuid=47ddcc23-1d00-0000-3880-f73aa30a0000 pid=2723 execve guuid=38db6224-1d00-0000-3880-f73aa40a0000 pid=2724 /usr/bin/wget net send-data guuid=47ddcc23-1d00-0000-3880-f73aa30a0000 pid=2723->guuid=38db6224-1d00-0000-3880-f73aa40a0000 pid=2724 execve guuid=552a8a34-1d00-0000-3880-f73ab20a0000 pid=2738 /usr/bin/curl net send-data write-file guuid=47ddcc23-1d00-0000-3880-f73aa30a0000 pid=2723->guuid=552a8a34-1d00-0000-3880-f73ab20a0000 pid=2738 execve guuid=50886641-1d00-0000-3880-f73ac70a0000 pid=2759 /usr/bin/chmod guuid=47ddcc23-1d00-0000-3880-f73aa30a0000 pid=2723->guuid=50886641-1d00-0000-3880-f73ac70a0000 pid=2759 execve guuid=91720142-1d00-0000-3880-f73ac90a0000 pid=2761 /usr/bin/bash guuid=47ddcc23-1d00-0000-3880-f73aa30a0000 pid=2723->guuid=91720142-1d00-0000-3880-f73ac90a0000 pid=2761 clone guuid=ff018d42-1d00-0000-3880-f73acc0a0000 pid=2764 /usr/bin/rm delete-file guuid=47ddcc23-1d00-0000-3880-f73aa30a0000 pid=2723->guuid=ff018d42-1d00-0000-3880-f73acc0a0000 pid=2764 execve guuid=fe411743-1d00-0000-3880-f73acd0a0000 pid=2765 /usr/bin/rm guuid=47ddcc23-1d00-0000-3880-f73aa30a0000 pid=2723->guuid=fe411743-1d00-0000-3880-f73acd0a0000 pid=2765 execve guuid=6fa09a43-1d00-0000-3880-f73ad00a0000 pid=2768 /usr/bin/wget net send-data guuid=47ddcc23-1d00-0000-3880-f73aa30a0000 pid=2723->guuid=6fa09a43-1d00-0000-3880-f73ad00a0000 pid=2768 execve guuid=7b6d6f47-1d00-0000-3880-f73ad30a0000 pid=2771 /usr/bin/curl net send-data write-file guuid=47ddcc23-1d00-0000-3880-f73aa30a0000 pid=2723->guuid=7b6d6f47-1d00-0000-3880-f73ad30a0000 pid=2771 execve guuid=851d2950-1d00-0000-3880-f73ae40a0000 pid=2788 /usr/bin/chmod guuid=47ddcc23-1d00-0000-3880-f73aa30a0000 pid=2723->guuid=851d2950-1d00-0000-3880-f73ae40a0000 pid=2788 execve guuid=321d2d51-1d00-0000-3880-f73ae70a0000 pid=2791 /usr/bin/bash guuid=47ddcc23-1d00-0000-3880-f73aa30a0000 pid=2723->guuid=321d2d51-1d00-0000-3880-f73ae70a0000 pid=2791 clone guuid=14c4a251-1d00-0000-3880-f73aea0a0000 pid=2794 /usr/bin/rm delete-file guuid=47ddcc23-1d00-0000-3880-f73aa30a0000 pid=2723->guuid=14c4a251-1d00-0000-3880-f73aea0a0000 pid=2794 execve guuid=0ccd3352-1d00-0000-3880-f73aec0a0000 pid=2796 /usr/bin/rm guuid=47ddcc23-1d00-0000-3880-f73aa30a0000 pid=2723->guuid=0ccd3352-1d00-0000-3880-f73aec0a0000 pid=2796 execve guuid=398ac152-1d00-0000-3880-f73aed0a0000 pid=2797 /usr/bin/wget net send-data guuid=47ddcc23-1d00-0000-3880-f73aa30a0000 pid=2723->guuid=398ac152-1d00-0000-3880-f73aed0a0000 pid=2797 execve guuid=a13b3257-1d00-0000-3880-f73af10a0000 pid=2801 /usr/bin/curl net send-data write-file guuid=47ddcc23-1d00-0000-3880-f73aa30a0000 pid=2723->guuid=a13b3257-1d00-0000-3880-f73af10a0000 pid=2801 execve guuid=c6bdcc5b-1d00-0000-3880-f73af80a0000 pid=2808 /usr/bin/chmod guuid=47ddcc23-1d00-0000-3880-f73aa30a0000 pid=2723->guuid=c6bdcc5b-1d00-0000-3880-f73af80a0000 pid=2808 execve guuid=1329785c-1d00-0000-3880-f73af90a0000 pid=2809 /usr/bin/bash guuid=47ddcc23-1d00-0000-3880-f73aa30a0000 pid=2723->guuid=1329785c-1d00-0000-3880-f73af90a0000 pid=2809 clone guuid=d1a3e55c-1d00-0000-3880-f73afc0a0000 pid=2812 /usr/bin/rm delete-file guuid=47ddcc23-1d00-0000-3880-f73aa30a0000 pid=2723->guuid=d1a3e55c-1d00-0000-3880-f73afc0a0000 pid=2812 execve guuid=7aa94c5d-1d00-0000-3880-f73afe0a0000 pid=2814 /usr/bin/rm guuid=47ddcc23-1d00-0000-3880-f73aa30a0000 pid=2723->guuid=7aa94c5d-1d00-0000-3880-f73afe0a0000 pid=2814 execve guuid=97b1af5d-1d00-0000-3880-f73a000b0000 pid=2816 /usr/bin/wget net send-data guuid=47ddcc23-1d00-0000-3880-f73aa30a0000 pid=2723->guuid=97b1af5d-1d00-0000-3880-f73a000b0000 pid=2816 execve guuid=aa7e3061-1d00-0000-3880-f73a060b0000 pid=2822 /usr/bin/curl net send-data write-file guuid=47ddcc23-1d00-0000-3880-f73aa30a0000 pid=2723->guuid=aa7e3061-1d00-0000-3880-f73a060b0000 pid=2822 execve guuid=aa24dd6a-1d00-0000-3880-f73a0a0b0000 pid=2826 /usr/bin/chmod guuid=47ddcc23-1d00-0000-3880-f73aa30a0000 pid=2723->guuid=aa24dd6a-1d00-0000-3880-f73a0a0b0000 pid=2826 execve guuid=f383436b-1d00-0000-3880-f73a0b0b0000 pid=2827 /usr/bin/bash guuid=47ddcc23-1d00-0000-3880-f73aa30a0000 pid=2723->guuid=f383436b-1d00-0000-3880-f73a0b0b0000 pid=2827 clone guuid=ccfeb06b-1d00-0000-3880-f73a0d0b0000 pid=2829 /usr/bin/rm delete-file guuid=47ddcc23-1d00-0000-3880-f73aa30a0000 pid=2723->guuid=ccfeb06b-1d00-0000-3880-f73a0d0b0000 pid=2829 execve guuid=c2f9186c-1d00-0000-3880-f73a0e0b0000 pid=2830 /usr/bin/rm guuid=47ddcc23-1d00-0000-3880-f73aa30a0000 pid=2723->guuid=c2f9186c-1d00-0000-3880-f73a0e0b0000 pid=2830 execve guuid=4416886c-1d00-0000-3880-f73a0f0b0000 pid=2831 /usr/bin/wget net send-data guuid=47ddcc23-1d00-0000-3880-f73aa30a0000 pid=2723->guuid=4416886c-1d00-0000-3880-f73a0f0b0000 pid=2831 execve guuid=1626b66f-1d00-0000-3880-f73a110b0000 pid=2833 /usr/bin/curl net send-data write-file guuid=47ddcc23-1d00-0000-3880-f73aa30a0000 pid=2723->guuid=1626b66f-1d00-0000-3880-f73a110b0000 pid=2833 execve guuid=4ae31175-1d00-0000-3880-f73a170b0000 pid=2839 /usr/bin/chmod guuid=47ddcc23-1d00-0000-3880-f73aa30a0000 pid=2723->guuid=4ae31175-1d00-0000-3880-f73a170b0000 pid=2839 execve guuid=2d16ec75-1d00-0000-3880-f73a190b0000 pid=2841 /usr/bin/bash guuid=47ddcc23-1d00-0000-3880-f73aa30a0000 pid=2723->guuid=2d16ec75-1d00-0000-3880-f73a190b0000 pid=2841 clone guuid=112a5376-1d00-0000-3880-f73a1b0b0000 pid=2843 /usr/bin/rm delete-file guuid=47ddcc23-1d00-0000-3880-f73aa30a0000 pid=2723->guuid=112a5376-1d00-0000-3880-f73a1b0b0000 pid=2843 execve guuid=998ca876-1d00-0000-3880-f73a1c0b0000 pid=2844 /usr/bin/rm guuid=47ddcc23-1d00-0000-3880-f73aa30a0000 pid=2723->guuid=998ca876-1d00-0000-3880-f73a1c0b0000 pid=2844 execve guuid=1eaa2377-1d00-0000-3880-f73a1d0b0000 pid=2845 /usr/bin/wget net send-data guuid=47ddcc23-1d00-0000-3880-f73aa30a0000 pid=2723->guuid=1eaa2377-1d00-0000-3880-f73a1d0b0000 pid=2845 execve guuid=f157737b-1d00-0000-3880-f73a240b0000 pid=2852 /usr/bin/curl net send-data write-file guuid=47ddcc23-1d00-0000-3880-f73aa30a0000 pid=2723->guuid=f157737b-1d00-0000-3880-f73a240b0000 pid=2852 execve guuid=3c350d82-1d00-0000-3880-f73a2b0b0000 pid=2859 /usr/bin/chmod guuid=47ddcc23-1d00-0000-3880-f73aa30a0000 pid=2723->guuid=3c350d82-1d00-0000-3880-f73a2b0b0000 pid=2859 execve guuid=dff76c82-1d00-0000-3880-f73a2d0b0000 pid=2861 /usr/bin/bash guuid=47ddcc23-1d00-0000-3880-f73aa30a0000 pid=2723->guuid=dff76c82-1d00-0000-3880-f73a2d0b0000 pid=2861 clone guuid=d6b3b282-1d00-0000-3880-f73a2f0b0000 pid=2863 /usr/bin/rm delete-file guuid=47ddcc23-1d00-0000-3880-f73aa30a0000 pid=2723->guuid=d6b3b282-1d00-0000-3880-f73a2f0b0000 pid=2863 execve guuid=9d982883-1d00-0000-3880-f73a300b0000 pid=2864 /usr/bin/rm guuid=47ddcc23-1d00-0000-3880-f73aa30a0000 pid=2723->guuid=9d982883-1d00-0000-3880-f73a300b0000 pid=2864 execve guuid=246c1984-1d00-0000-3880-f73a320b0000 pid=2866 /usr/bin/wget net send-data guuid=47ddcc23-1d00-0000-3880-f73aa30a0000 pid=2723->guuid=246c1984-1d00-0000-3880-f73a320b0000 pid=2866 execve guuid=8d8a6788-1d00-0000-3880-f73a370b0000 pid=2871 /usr/bin/curl net send-data write-file guuid=47ddcc23-1d00-0000-3880-f73aa30a0000 pid=2723->guuid=8d8a6788-1d00-0000-3880-f73a370b0000 pid=2871 execve guuid=07573491-1d00-0000-3880-f73a410b0000 pid=2881 /usr/bin/chmod guuid=47ddcc23-1d00-0000-3880-f73aa30a0000 pid=2723->guuid=07573491-1d00-0000-3880-f73a410b0000 pid=2881 execve guuid=f404b691-1d00-0000-3880-f73a430b0000 pid=2883 /usr/bin/bash guuid=47ddcc23-1d00-0000-3880-f73aa30a0000 pid=2723->guuid=f404b691-1d00-0000-3880-f73a430b0000 pid=2883 clone guuid=01dffb91-1d00-0000-3880-f73a450b0000 pid=2885 /usr/bin/rm delete-file guuid=47ddcc23-1d00-0000-3880-f73aa30a0000 pid=2723->guuid=01dffb91-1d00-0000-3880-f73a450b0000 pid=2885 execve guuid=df426a92-1d00-0000-3880-f73a470b0000 pid=2887 /usr/bin/rm guuid=47ddcc23-1d00-0000-3880-f73aa30a0000 pid=2723->guuid=df426a92-1d00-0000-3880-f73a470b0000 pid=2887 execve guuid=134fe592-1d00-0000-3880-f73a490b0000 pid=2889 /usr/bin/wget net send-data guuid=47ddcc23-1d00-0000-3880-f73aa30a0000 pid=2723->guuid=134fe592-1d00-0000-3880-f73a490b0000 pid=2889 execve guuid=fd345596-1d00-0000-3880-f73a4f0b0000 pid=2895 /usr/bin/curl net send-data write-file guuid=47ddcc23-1d00-0000-3880-f73aa30a0000 pid=2723->guuid=fd345596-1d00-0000-3880-f73a4f0b0000 pid=2895 execve guuid=3a68f89c-1d00-0000-3880-f73a5a0b0000 pid=2906 /usr/bin/chmod guuid=47ddcc23-1d00-0000-3880-f73aa30a0000 pid=2723->guuid=3a68f89c-1d00-0000-3880-f73a5a0b0000 pid=2906 execve guuid=9cc2539e-1d00-0000-3880-f73a5e0b0000 pid=2910 /usr/bin/bash guuid=47ddcc23-1d00-0000-3880-f73aa30a0000 pid=2723->guuid=9cc2539e-1d00-0000-3880-f73a5e0b0000 pid=2910 clone guuid=c74bcc9e-1d00-0000-3880-f73a610b0000 pid=2913 /usr/bin/rm delete-file guuid=47ddcc23-1d00-0000-3880-f73aa30a0000 pid=2723->guuid=c74bcc9e-1d00-0000-3880-f73a610b0000 pid=2913 execve guuid=45b0589f-1d00-0000-3880-f73a630b0000 pid=2915 /usr/bin/rm guuid=47ddcc23-1d00-0000-3880-f73aa30a0000 pid=2723->guuid=45b0589f-1d00-0000-3880-f73a630b0000 pid=2915 execve guuid=67c7e19f-1d00-0000-3880-f73a650b0000 pid=2917 /usr/bin/wget net send-data guuid=47ddcc23-1d00-0000-3880-f73aa30a0000 pid=2723->guuid=67c7e19f-1d00-0000-3880-f73a650b0000 pid=2917 execve guuid=8ee32da3-1d00-0000-3880-f73a6c0b0000 pid=2924 /usr/bin/curl net send-data write-file guuid=47ddcc23-1d00-0000-3880-f73aa30a0000 pid=2723->guuid=8ee32da3-1d00-0000-3880-f73a6c0b0000 pid=2924 execve guuid=2d4494a8-1d00-0000-3880-f73a730b0000 pid=2931 /usr/bin/chmod guuid=47ddcc23-1d00-0000-3880-f73aa30a0000 pid=2723->guuid=2d4494a8-1d00-0000-3880-f73a730b0000 pid=2931 execve guuid=6b88e8a8-1d00-0000-3880-f73a750b0000 pid=2933 /usr/bin/bash guuid=47ddcc23-1d00-0000-3880-f73aa30a0000 pid=2723->guuid=6b88e8a8-1d00-0000-3880-f73a750b0000 pid=2933 clone guuid=32c56fa9-1d00-0000-3880-f73a780b0000 pid=2936 /usr/bin/rm delete-file guuid=47ddcc23-1d00-0000-3880-f73aa30a0000 pid=2723->guuid=32c56fa9-1d00-0000-3880-f73a780b0000 pid=2936 execve guuid=fe3dc8a9-1d00-0000-3880-f73a7a0b0000 pid=2938 /usr/bin/rm guuid=47ddcc23-1d00-0000-3880-f73aa30a0000 pid=2723->guuid=fe3dc8a9-1d00-0000-3880-f73a7a0b0000 pid=2938 execve guuid=8a8836aa-1d00-0000-3880-f73a7c0b0000 pid=2940 /usr/bin/wget net send-data guuid=47ddcc23-1d00-0000-3880-f73aa30a0000 pid=2723->guuid=8a8836aa-1d00-0000-3880-f73a7c0b0000 pid=2940 execve guuid=a977d5ad-1d00-0000-3880-f73a820b0000 pid=2946 /usr/bin/curl net send-data write-file guuid=47ddcc23-1d00-0000-3880-f73aa30a0000 pid=2723->guuid=a977d5ad-1d00-0000-3880-f73a820b0000 pid=2946 execve guuid=966c6cb7-1d00-0000-3880-f73a8d0b0000 pid=2957 /usr/bin/chmod guuid=47ddcc23-1d00-0000-3880-f73aa30a0000 pid=2723->guuid=966c6cb7-1d00-0000-3880-f73a8d0b0000 pid=2957 execve guuid=f5100ab8-1d00-0000-3880-f73a8e0b0000 pid=2958 /usr/bin/bash guuid=47ddcc23-1d00-0000-3880-f73aa30a0000 pid=2723->guuid=f5100ab8-1d00-0000-3880-f73a8e0b0000 pid=2958 clone guuid=3c9f4cb8-1d00-0000-3880-f73a910b0000 pid=2961 /usr/bin/rm delete-file guuid=47ddcc23-1d00-0000-3880-f73aa30a0000 pid=2723->guuid=3c9f4cb8-1d00-0000-3880-f73a910b0000 pid=2961 execve guuid=6124a3b8-1d00-0000-3880-f73a930b0000 pid=2963 /usr/bin/rm guuid=47ddcc23-1d00-0000-3880-f73aa30a0000 pid=2723->guuid=6124a3b8-1d00-0000-3880-f73a930b0000 pid=2963 execve guuid=bb3312b9-1d00-0000-3880-f73a950b0000 pid=2965 /usr/bin/wget net send-data guuid=47ddcc23-1d00-0000-3880-f73aa30a0000 pid=2723->guuid=bb3312b9-1d00-0000-3880-f73a950b0000 pid=2965 execve guuid=fed344be-1d00-0000-3880-f73aa00b0000 pid=2976 /usr/bin/curl net send-data write-file guuid=47ddcc23-1d00-0000-3880-f73aa30a0000 pid=2723->guuid=fed344be-1d00-0000-3880-f73aa00b0000 pid=2976 execve guuid=73b5e0cb-1d00-0000-3880-f73aba0b0000 pid=3002 /usr/bin/chmod guuid=47ddcc23-1d00-0000-3880-f73aa30a0000 pid=2723->guuid=73b5e0cb-1d00-0000-3880-f73aba0b0000 pid=3002 execve guuid=b0b050cc-1d00-0000-3880-f73abc0b0000 pid=3004 /usr/bin/bash guuid=47ddcc23-1d00-0000-3880-f73aa30a0000 pid=2723->guuid=b0b050cc-1d00-0000-3880-f73abc0b0000 pid=3004 clone guuid=1daab2cc-1d00-0000-3880-f73abf0b0000 pid=3007 /usr/bin/rm delete-file guuid=47ddcc23-1d00-0000-3880-f73aa30a0000 pid=2723->guuid=1daab2cc-1d00-0000-3880-f73abf0b0000 pid=3007 execve guuid=0be911cd-1d00-0000-3880-f73ac10b0000 pid=3009 /usr/bin/rm guuid=47ddcc23-1d00-0000-3880-f73aa30a0000 pid=2723->guuid=0be911cd-1d00-0000-3880-f73ac10b0000 pid=3009 execve guuid=675528ce-1d00-0000-3880-f73ac40b0000 pid=3012 /usr/bin/wget net send-data guuid=47ddcc23-1d00-0000-3880-f73aa30a0000 pid=2723->guuid=675528ce-1d00-0000-3880-f73ac40b0000 pid=3012 execve guuid=0f4c61d3-1d00-0000-3880-f73acb0b0000 pid=3019 /usr/bin/curl net send-data write-file guuid=47ddcc23-1d00-0000-3880-f73aa30a0000 pid=2723->guuid=0f4c61d3-1d00-0000-3880-f73acb0b0000 pid=3019 execve guuid=015242da-1d00-0000-3880-f73ad70b0000 pid=3031 /usr/bin/chmod guuid=47ddcc23-1d00-0000-3880-f73aa30a0000 pid=2723->guuid=015242da-1d00-0000-3880-f73ad70b0000 pid=3031 execve guuid=c5a5b5da-1d00-0000-3880-f73ad90b0000 pid=3033 /usr/bin/bash guuid=47ddcc23-1d00-0000-3880-f73aa30a0000 pid=2723->guuid=c5a5b5da-1d00-0000-3880-f73ad90b0000 pid=3033 clone guuid=64e21cdb-1d00-0000-3880-f73adc0b0000 pid=3036 /usr/bin/rm delete-file guuid=47ddcc23-1d00-0000-3880-f73aa30a0000 pid=2723->guuid=64e21cdb-1d00-0000-3880-f73adc0b0000 pid=3036 execve guuid=b4b79adb-1d00-0000-3880-f73ade0b0000 pid=3038 /usr/bin/rm guuid=47ddcc23-1d00-0000-3880-f73aa30a0000 pid=2723->guuid=b4b79adb-1d00-0000-3880-f73ade0b0000 pid=3038 execve 5b654972-c9e1-50d8-b372-2dc2a5b9ad66 5.182.210.174:80 guuid=38db6224-1d00-0000-3880-f73aa40a0000 pid=2724->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=552a8a34-1d00-0000-3880-f73ab20a0000 pid=2738->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=ccf05342-1d00-0000-3880-f73acb0a0000 pid=2763 /usr/bin/bash guuid=91720142-1d00-0000-3880-f73ac90a0000 pid=2761->guuid=ccf05342-1d00-0000-3880-f73acb0a0000 pid=2763 clone guuid=6fa09a43-1d00-0000-3880-f73ad00a0000 pid=2768->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=7b6d6f47-1d00-0000-3880-f73ad30a0000 pid=2771->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=ab905851-1d00-0000-3880-f73ae90a0000 pid=2793 /usr/bin/bash guuid=321d2d51-1d00-0000-3880-f73ae70a0000 pid=2791->guuid=ab905851-1d00-0000-3880-f73ae90a0000 pid=2793 clone guuid=398ac152-1d00-0000-3880-f73aed0a0000 pid=2797->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=a13b3257-1d00-0000-3880-f73af10a0000 pid=2801->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=163d9f5c-1d00-0000-3880-f73afa0a0000 pid=2810 /usr/bin/bash guuid=1329785c-1d00-0000-3880-f73af90a0000 pid=2809->guuid=163d9f5c-1d00-0000-3880-f73afa0a0000 pid=2810 clone guuid=97b1af5d-1d00-0000-3880-f73a000b0000 pid=2816->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=aa7e3061-1d00-0000-3880-f73a060b0000 pid=2822->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=ca92766b-1d00-0000-3880-f73a0c0b0000 pid=2828 /usr/bin/bash guuid=f383436b-1d00-0000-3880-f73a0b0b0000 pid=2827->guuid=ca92766b-1d00-0000-3880-f73a0c0b0000 pid=2828 clone guuid=4416886c-1d00-0000-3880-f73a0f0b0000 pid=2831->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=1626b66f-1d00-0000-3880-f73a110b0000 pid=2833->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=2cba1e76-1d00-0000-3880-f73a1a0b0000 pid=2842 /usr/bin/bash guuid=2d16ec75-1d00-0000-3880-f73a190b0000 pid=2841->guuid=2cba1e76-1d00-0000-3880-f73a1a0b0000 pid=2842 clone guuid=1eaa2377-1d00-0000-3880-f73a1d0b0000 pid=2845->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=f157737b-1d00-0000-3880-f73a240b0000 pid=2852->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=502b8582-1d00-0000-3880-f73a2e0b0000 pid=2862 /usr/bin/bash guuid=dff76c82-1d00-0000-3880-f73a2d0b0000 pid=2861->guuid=502b8582-1d00-0000-3880-f73a2e0b0000 pid=2862 clone guuid=246c1984-1d00-0000-3880-f73a320b0000 pid=2866->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=8d8a6788-1d00-0000-3880-f73a370b0000 pid=2871->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=2848d191-1d00-0000-3880-f73a440b0000 pid=2884 /usr/bin/bash guuid=f404b691-1d00-0000-3880-f73a430b0000 pid=2883->guuid=2848d191-1d00-0000-3880-f73a440b0000 pid=2884 clone guuid=134fe592-1d00-0000-3880-f73a490b0000 pid=2889->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=fd345596-1d00-0000-3880-f73a4f0b0000 pid=2895->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=da198e9e-1d00-0000-3880-f73a5f0b0000 pid=2911 /usr/bin/bash guuid=9cc2539e-1d00-0000-3880-f73a5e0b0000 pid=2910->guuid=da198e9e-1d00-0000-3880-f73a5f0b0000 pid=2911 clone guuid=67c7e19f-1d00-0000-3880-f73a650b0000 pid=2917->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=8ee32da3-1d00-0000-3880-f73a6c0b0000 pid=2924->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=ab3d0ca9-1d00-0000-3880-f73a760b0000 pid=2934 /usr/bin/bash guuid=6b88e8a8-1d00-0000-3880-f73a750b0000 pid=2933->guuid=ab3d0ca9-1d00-0000-3880-f73a760b0000 pid=2934 clone guuid=8a8836aa-1d00-0000-3880-f73a7c0b0000 pid=2940->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=a977d5ad-1d00-0000-3880-f73a820b0000 pid=2946->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=326e22b8-1d00-0000-3880-f73a8f0b0000 pid=2959 /usr/bin/bash guuid=f5100ab8-1d00-0000-3880-f73a8e0b0000 pid=2958->guuid=326e22b8-1d00-0000-3880-f73a8f0b0000 pid=2959 clone guuid=bb3312b9-1d00-0000-3880-f73a950b0000 pid=2965->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=fed344be-1d00-0000-3880-f73aa00b0000 pid=2976->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=acad78cc-1d00-0000-3880-f73abe0b0000 pid=3006 /usr/bin/bash guuid=b0b050cc-1d00-0000-3880-f73abc0b0000 pid=3004->guuid=acad78cc-1d00-0000-3880-f73abe0b0000 pid=3006 clone guuid=675528ce-1d00-0000-3880-f73ac40b0000 pid=3012->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=0f4c61d3-1d00-0000-3880-f73acb0b0000 pid=3019->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=1df6e1da-1d00-0000-3880-f73adb0b0000 pid=3035 /usr/bin/bash guuid=c5a5b5da-1d00-0000-3880-f73ad90b0000 pid=3033->guuid=1df6e1da-1d00-0000-3880-f73adb0b0000 pid=3035 clone
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/f4eed7244be63b1e1ef7597b8a8017cf7b2b3ec5f6ff3c6e2d94ce0e60220340
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f4eed7244be63b1e1ef7597b8a8017cf7b2b3ec5f6ff3c6e2d94ce0e60220340/
Threat name:
Linux.Downloader.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-08-30 04:24:55 UTC
AV detection:
14 of 38 (36.84%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6txnojcl4y5r4hxxlf5yvaaxz55swpwf637ty3rnstha4ybcanaa._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260830-dvw7bsxhqa/
Behaviour
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.11
Link:
https://yomi.yoroi.company/submissions/f4eed7244be63b1e1ef7597b8a8017cf7b2b3ec5f6ff3c6e2d94ce0e60220340

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh f4eed7244be63b1e1ef7597b8a8017cf7b2b3ec5f6ff3c6e2d94ce0e60220340

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3897671/
  
Delivery method
Distributed via web download

Comments