MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f84fab97acebb6a52e2e839403b8e3a7fe040dcc30e808b6198e02a3621015a8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f84fab97acebb6a52e2e839403b8e3a7fe040dcc30e808b6198e02a3621015a8
SHA3-384 hash: 6b09d139d904262e56c93fed5434c0225662e9f5286809da08f1a617b24e05a8dd9817b7b97d09f5ea1d03c391972d08
SHA1 hash: d2f0b43c27602c9a01682d9b1b8949aae454d956
MD5 hash: eb8d2d42a44c9b3f8796ccd77ccf4842
humanhash: three-uranus-high-wolfram
File name:p
Download: download sample
File size:831 bytes
First seen:2026-07-18 02:17:53 UTC
Last seen:2026-07-19 02:06:31 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 24:kXCKysE2hi0ziQvZoha8c1hwqm9jCyeEzGl7:e9Qp+Ms8c16qQjgEql7
TLSH T1F001ABCBD650AD00412EAA1EA2A71190B411C3CF164B0FB47F9C292EFF88804B026F98
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://129.121.114.124/pO8n/an/aua-wget
http://129.121.114.124/Aumn/an/aua-wget
http://129.121.114.124/oykn/an/aua-wget
http://129.121.114.124/aaYSn/an/aua-wget
http://129.121.114.124/X1xn/an/aua-wget

Intelligence

File Origin
# of uploads :
3
# of downloads :
71
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive mirai
Link:
https://www.filescan.io/uploads/6a5ae2796782ad48f91c945a/reports/53139146-d7d0-4b8e-8e12-92580796af2f/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-07-18T00:38:00Z UTC
Last seen:
2026-07-19T22:12:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/f84fab97acebb6a52e2e839403b8e3a7fe040dcc30e808b6198e02a3621015a8/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/933ebcc5-3975-4293-bf49-85a0abfc70b4
Behavior Graph:
Download SVG
%3 guuid=96370c53-1600-0000-18e6-7aab720b0000 pid=2930 /usr/bin/sudo guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936 /tmp/sample.bin write-file guuid=96370c53-1600-0000-18e6-7aab720b0000 pid=2930->guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936 execve guuid=2ae34a55-1600-0000-18e6-7aab7a0b0000 pid=2938 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=2ae34a55-1600-0000-18e6-7aab7a0b0000 pid=2938 execve guuid=40acb255-1600-0000-18e6-7aab7d0b0000 pid=2941 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=40acb255-1600-0000-18e6-7aab7d0b0000 pid=2941 execve guuid=ce771d56-1600-0000-18e6-7aab7f0b0000 pid=2943 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=ce771d56-1600-0000-18e6-7aab7f0b0000 pid=2943 execve guuid=87918f56-1600-0000-18e6-7aab820b0000 pid=2946 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=87918f56-1600-0000-18e6-7aab820b0000 pid=2946 execve guuid=842cf156-1600-0000-18e6-7aab840b0000 pid=2948 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=842cf156-1600-0000-18e6-7aab840b0000 pid=2948 execve guuid=86945057-1600-0000-18e6-7aab860b0000 pid=2950 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=86945057-1600-0000-18e6-7aab860b0000 pid=2950 execve guuid=3b32b257-1600-0000-18e6-7aab890b0000 pid=2953 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=3b32b257-1600-0000-18e6-7aab890b0000 pid=2953 execve guuid=055b1658-1600-0000-18e6-7aab8b0b0000 pid=2955 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=055b1658-1600-0000-18e6-7aab8b0b0000 pid=2955 execve guuid=755c8658-1600-0000-18e6-7aab8d0b0000 pid=2957 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=755c8658-1600-0000-18e6-7aab8d0b0000 pid=2957 execve guuid=66dc0359-1600-0000-18e6-7aab8e0b0000 pid=2958 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=66dc0359-1600-0000-18e6-7aab8e0b0000 pid=2958 execve guuid=66187359-1600-0000-18e6-7aab910b0000 pid=2961 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=66187359-1600-0000-18e6-7aab910b0000 pid=2961 execve guuid=e162e559-1600-0000-18e6-7aab930b0000 pid=2963 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=e162e559-1600-0000-18e6-7aab930b0000 pid=2963 execve guuid=4653555a-1600-0000-18e6-7aab960b0000 pid=2966 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=4653555a-1600-0000-18e6-7aab960b0000 pid=2966 execve guuid=b8c1c35a-1600-0000-18e6-7aab980b0000 pid=2968 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=b8c1c35a-1600-0000-18e6-7aab980b0000 pid=2968 execve guuid=67b1345b-1600-0000-18e6-7aab9b0b0000 pid=2971 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=67b1345b-1600-0000-18e6-7aab9b0b0000 pid=2971 execve guuid=d8af415c-1600-0000-18e6-7aaba00b0000 pid=2976 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=d8af415c-1600-0000-18e6-7aaba00b0000 pid=2976 execve guuid=6a0ad15c-1600-0000-18e6-7aaba30b0000 pid=2979 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=6a0ad15c-1600-0000-18e6-7aaba30b0000 pid=2979 execve guuid=22f9605d-1600-0000-18e6-7aaba60b0000 pid=2982 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=22f9605d-1600-0000-18e6-7aaba60b0000 pid=2982 execve guuid=b46fee5d-1600-0000-18e6-7aabaa0b0000 pid=2986 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=b46fee5d-1600-0000-18e6-7aabaa0b0000 pid=2986 execve guuid=c4e44a5e-1600-0000-18e6-7aabac0b0000 pid=2988 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=c4e44a5e-1600-0000-18e6-7aabac0b0000 pid=2988 execve guuid=a6f7a75e-1600-0000-18e6-7aabae0b0000 pid=2990 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=a6f7a75e-1600-0000-18e6-7aabae0b0000 pid=2990 execve guuid=70f1025f-1600-0000-18e6-7aabb00b0000 pid=2992 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=70f1025f-1600-0000-18e6-7aabb00b0000 pid=2992 execve guuid=890c645f-1600-0000-18e6-7aabb20b0000 pid=2994 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=890c645f-1600-0000-18e6-7aabb20b0000 pid=2994 execve guuid=3d6bcc5f-1600-0000-18e6-7aabb40b0000 pid=2996 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=3d6bcc5f-1600-0000-18e6-7aabb40b0000 pid=2996 execve guuid=e8293760-1600-0000-18e6-7aabb60b0000 pid=2998 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=e8293760-1600-0000-18e6-7aabb60b0000 pid=2998 execve guuid=83039b60-1600-0000-18e6-7aabb80b0000 pid=3000 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=83039b60-1600-0000-18e6-7aabb80b0000 pid=3000 execve guuid=d4fafd60-1600-0000-18e6-7aabba0b0000 pid=3002 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=d4fafd60-1600-0000-18e6-7aabba0b0000 pid=3002 execve guuid=75385c61-1600-0000-18e6-7aabbc0b0000 pid=3004 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=75385c61-1600-0000-18e6-7aabbc0b0000 pid=3004 execve guuid=f4d5c361-1600-0000-18e6-7aabc00b0000 pid=3008 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=f4d5c361-1600-0000-18e6-7aabc00b0000 pid=3008 execve guuid=3c555662-1600-0000-18e6-7aabc10b0000 pid=3009 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=3c555662-1600-0000-18e6-7aabc10b0000 pid=3009 execve guuid=62e7e462-1600-0000-18e6-7aabc20b0000 pid=3010 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=62e7e462-1600-0000-18e6-7aabc20b0000 pid=3010 execve guuid=26b25063-1600-0000-18e6-7aabc40b0000 pid=3012 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=26b25063-1600-0000-18e6-7aabc40b0000 pid=3012 execve guuid=8f17b163-1600-0000-18e6-7aabc60b0000 pid=3014 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=8f17b163-1600-0000-18e6-7aabc60b0000 pid=3014 execve guuid=19af1364-1600-0000-18e6-7aabc90b0000 pid=3017 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=19af1364-1600-0000-18e6-7aabc90b0000 pid=3017 execve guuid=96007a64-1600-0000-18e6-7aabcb0b0000 pid=3019 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=96007a64-1600-0000-18e6-7aabcb0b0000 pid=3019 execve guuid=2233de64-1600-0000-18e6-7aabcd0b0000 pid=3021 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=2233de64-1600-0000-18e6-7aabcd0b0000 pid=3021 execve guuid=afec3865-1600-0000-18e6-7aabcf0b0000 pid=3023 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=afec3865-1600-0000-18e6-7aabcf0b0000 pid=3023 execve guuid=48219465-1600-0000-18e6-7aabd10b0000 pid=3025 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=48219465-1600-0000-18e6-7aabd10b0000 pid=3025 execve guuid=47b4ec65-1600-0000-18e6-7aabd30b0000 pid=3027 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=47b4ec65-1600-0000-18e6-7aabd30b0000 pid=3027 execve guuid=c9d63966-1600-0000-18e6-7aabd50b0000 pid=3029 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=c9d63966-1600-0000-18e6-7aabd50b0000 pid=3029 execve guuid=aa719366-1600-0000-18e6-7aabd70b0000 pid=3031 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=aa719366-1600-0000-18e6-7aabd70b0000 pid=3031 execve guuid=fdcbe866-1600-0000-18e6-7aabd90b0000 pid=3033 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=fdcbe866-1600-0000-18e6-7aabd90b0000 pid=3033 execve guuid=4ddb4067-1600-0000-18e6-7aabda0b0000 pid=3034 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=4ddb4067-1600-0000-18e6-7aabda0b0000 pid=3034 execve guuid=ccaea767-1600-0000-18e6-7aabdc0b0000 pid=3036 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=ccaea767-1600-0000-18e6-7aabdc0b0000 pid=3036 execve guuid=58a12d68-1600-0000-18e6-7aabdd0b0000 pid=3037 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=58a12d68-1600-0000-18e6-7aabdd0b0000 pid=3037 execve guuid=ce15a968-1600-0000-18e6-7aabde0b0000 pid=3038 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=ce15a968-1600-0000-18e6-7aabde0b0000 pid=3038 execve guuid=0b435869-1600-0000-18e6-7aabe00b0000 pid=3040 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=0b435869-1600-0000-18e6-7aabe00b0000 pid=3040 execve guuid=4c92d069-1600-0000-18e6-7aabe30b0000 pid=3043 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=4c92d069-1600-0000-18e6-7aabe30b0000 pid=3043 execve guuid=4a1e616a-1600-0000-18e6-7aabe60b0000 pid=3046 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=4a1e616a-1600-0000-18e6-7aabe60b0000 pid=3046 execve guuid=cf51e96a-1600-0000-18e6-7aabe90b0000 pid=3049 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=cf51e96a-1600-0000-18e6-7aabe90b0000 pid=3049 execve guuid=3dc1656b-1600-0000-18e6-7aabec0b0000 pid=3052 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=3dc1656b-1600-0000-18e6-7aabec0b0000 pid=3052 execve guuid=3845de6b-1600-0000-18e6-7aabef0b0000 pid=3055 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=3845de6b-1600-0000-18e6-7aabef0b0000 pid=3055 execve guuid=24d0596c-1600-0000-18e6-7aabf10b0000 pid=3057 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=24d0596c-1600-0000-18e6-7aabf10b0000 pid=3057 execve guuid=bef7cd6c-1600-0000-18e6-7aabf30b0000 pid=3059 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=bef7cd6c-1600-0000-18e6-7aabf30b0000 pid=3059 execve guuid=afc6726d-1600-0000-18e6-7aabf40b0000 pid=3060 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=afc6726d-1600-0000-18e6-7aabf40b0000 pid=3060 execve guuid=04e0f06d-1600-0000-18e6-7aabf50b0000 pid=3061 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=04e0f06d-1600-0000-18e6-7aabf50b0000 pid=3061 execve guuid=e7a94a6e-1600-0000-18e6-7aabf80b0000 pid=3064 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=e7a94a6e-1600-0000-18e6-7aabf80b0000 pid=3064 execve guuid=aa08a56e-1600-0000-18e6-7aabfa0b0000 pid=3066 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=aa08a56e-1600-0000-18e6-7aabfa0b0000 pid=3066 execve guuid=572bfb6e-1600-0000-18e6-7aabfc0b0000 pid=3068 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=572bfb6e-1600-0000-18e6-7aabfc0b0000 pid=3068 execve guuid=02ab626f-1600-0000-18e6-7aabff0b0000 pid=3071 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=02ab626f-1600-0000-18e6-7aabff0b0000 pid=3071 execve guuid=66ebbc6f-1600-0000-18e6-7aab010c0000 pid=3073 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=66ebbc6f-1600-0000-18e6-7aab010c0000 pid=3073 execve guuid=05551870-1600-0000-18e6-7aab040c0000 pid=3076 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=05551870-1600-0000-18e6-7aab040c0000 pid=3076 execve guuid=3e037370-1600-0000-18e6-7aab060c0000 pid=3078 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=3e037370-1600-0000-18e6-7aab060c0000 pid=3078 execve guuid=957dd570-1600-0000-18e6-7aab080c0000 pid=3080 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=957dd570-1600-0000-18e6-7aab080c0000 pid=3080 execve guuid=e8793471-1600-0000-18e6-7aab0a0c0000 pid=3082 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=e8793471-1600-0000-18e6-7aab0a0c0000 pid=3082 execve guuid=b177af71-1600-0000-18e6-7aab0c0c0000 pid=3084 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=b177af71-1600-0000-18e6-7aab0c0c0000 pid=3084 execve guuid=d8e00d72-1600-0000-18e6-7aab0e0c0000 pid=3086 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=d8e00d72-1600-0000-18e6-7aab0e0c0000 pid=3086 execve guuid=f5c46a72-1600-0000-18e6-7aab100c0000 pid=3088 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=f5c46a72-1600-0000-18e6-7aab100c0000 pid=3088 execve guuid=2579c872-1600-0000-18e6-7aab130c0000 pid=3091 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=2579c872-1600-0000-18e6-7aab130c0000 pid=3091 execve guuid=7c382d73-1600-0000-18e6-7aab150c0000 pid=3093 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=7c382d73-1600-0000-18e6-7aab150c0000 pid=3093 execve guuid=b04e8873-1600-0000-18e6-7aab180c0000 pid=3096 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=b04e8873-1600-0000-18e6-7aab180c0000 pid=3096 execve guuid=3715f173-1600-0000-18e6-7aab1a0c0000 pid=3098 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=3715f173-1600-0000-18e6-7aab1a0c0000 pid=3098 execve guuid=025b4c74-1600-0000-18e6-7aab1d0c0000 pid=3101 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=025b4c74-1600-0000-18e6-7aab1d0c0000 pid=3101 execve guuid=ef5daa74-1600-0000-18e6-7aab1e0c0000 pid=3102 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=ef5daa74-1600-0000-18e6-7aab1e0c0000 pid=3102 execve guuid=69650c75-1600-0000-18e6-7aab210c0000 pid=3105 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=69650c75-1600-0000-18e6-7aab210c0000 pid=3105 execve guuid=0cd66875-1600-0000-18e6-7aab230c0000 pid=3107 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=0cd66875-1600-0000-18e6-7aab230c0000 pid=3107 execve guuid=0091cb75-1600-0000-18e6-7aab260c0000 pid=3110 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=0091cb75-1600-0000-18e6-7aab260c0000 pid=3110 execve guuid=a3a33176-1600-0000-18e6-7aab280c0000 pid=3112 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=a3a33176-1600-0000-18e6-7aab280c0000 pid=3112 execve guuid=b34d8976-1600-0000-18e6-7aab2b0c0000 pid=3115 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=b34d8976-1600-0000-18e6-7aab2b0c0000 pid=3115 execve guuid=a9cede76-1600-0000-18e6-7aab2d0c0000 pid=3117 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=a9cede76-1600-0000-18e6-7aab2d0c0000 pid=3117 execve guuid=d3b83277-1600-0000-18e6-7aab300c0000 pid=3120 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=d3b83277-1600-0000-18e6-7aab300c0000 pid=3120 execve guuid=b6909077-1600-0000-18e6-7aab320c0000 pid=3122 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=b6909077-1600-0000-18e6-7aab320c0000 pid=3122 execve guuid=b6fde777-1600-0000-18e6-7aab340c0000 pid=3124 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=b6fde777-1600-0000-18e6-7aab340c0000 pid=3124 execve guuid=8a4c3b78-1600-0000-18e6-7aab360c0000 pid=3126 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=8a4c3b78-1600-0000-18e6-7aab360c0000 pid=3126 execve guuid=91f68e78-1600-0000-18e6-7aab390c0000 pid=3129 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=91f68e78-1600-0000-18e6-7aab390c0000 pid=3129 execve guuid=cba3e578-1600-0000-18e6-7aab3b0c0000 pid=3131 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=cba3e578-1600-0000-18e6-7aab3b0c0000 pid=3131 execve guuid=bf694579-1600-0000-18e6-7aab3e0c0000 pid=3134 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=bf694579-1600-0000-18e6-7aab3e0c0000 pid=3134 execve guuid=e479a179-1600-0000-18e6-7aab400c0000 pid=3136 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=e479a179-1600-0000-18e6-7aab400c0000 pid=3136 execve guuid=0d9e077a-1600-0000-18e6-7aab430c0000 pid=3139 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=0d9e077a-1600-0000-18e6-7aab430c0000 pid=3139 execve guuid=0ea8707a-1600-0000-18e6-7aab450c0000 pid=3141 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=0ea8707a-1600-0000-18e6-7aab450c0000 pid=3141 execve guuid=e64cd17a-1600-0000-18e6-7aab480c0000 pid=3144 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=e64cd17a-1600-0000-18e6-7aab480c0000 pid=3144 execve guuid=11f5297b-1600-0000-18e6-7aab4a0c0000 pid=3146 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=11f5297b-1600-0000-18e6-7aab4a0c0000 pid=3146 execve guuid=d66e8a7b-1600-0000-18e6-7aab4e0c0000 pid=3150 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=d66e8a7b-1600-0000-18e6-7aab4e0c0000 pid=3150 execve guuid=d2a1fd7b-1600-0000-18e6-7aab4f0c0000 pid=3151 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=d2a1fd7b-1600-0000-18e6-7aab4f0c0000 pid=3151 execve guuid=e512667c-1600-0000-18e6-7aab500c0000 pid=3152 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=e512667c-1600-0000-18e6-7aab500c0000 pid=3152 execve guuid=119ccb7c-1600-0000-18e6-7aab510c0000 pid=3153 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=119ccb7c-1600-0000-18e6-7aab510c0000 pid=3153 execve guuid=ac45267d-1600-0000-18e6-7aab530c0000 pid=3155 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=ac45267d-1600-0000-18e6-7aab530c0000 pid=3155 execve guuid=b25c7b7d-1600-0000-18e6-7aab550c0000 pid=3157 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=b25c7b7d-1600-0000-18e6-7aab550c0000 pid=3157 execve guuid=28d1d17d-1600-0000-18e6-7aab570c0000 pid=3159 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=28d1d17d-1600-0000-18e6-7aab570c0000 pid=3159 execve guuid=9479257e-1600-0000-18e6-7aab590c0000 pid=3161 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=9479257e-1600-0000-18e6-7aab590c0000 pid=3161 execve guuid=6d548e7e-1600-0000-18e6-7aab5b0c0000 pid=3163 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=6d548e7e-1600-0000-18e6-7aab5b0c0000 pid=3163 execve guuid=4614f47e-1600-0000-18e6-7aab5e0c0000 pid=3166 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=4614f47e-1600-0000-18e6-7aab5e0c0000 pid=3166 execve guuid=84e2587f-1600-0000-18e6-7aab600c0000 pid=3168 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=84e2587f-1600-0000-18e6-7aab600c0000 pid=3168 execve guuid=cfa3b77f-1600-0000-18e6-7aab630c0000 pid=3171 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=cfa3b77f-1600-0000-18e6-7aab630c0000 pid=3171 execve guuid=f82d1b80-1600-0000-18e6-7aab640c0000 pid=3172 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=f82d1b80-1600-0000-18e6-7aab640c0000 pid=3172 execve guuid=fb159880-1600-0000-18e6-7aab650c0000 pid=3173 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=fb159880-1600-0000-18e6-7aab650c0000 pid=3173 execve guuid=229c0b81-1600-0000-18e6-7aab670c0000 pid=3175 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=229c0b81-1600-0000-18e6-7aab670c0000 pid=3175 execve guuid=2e118e81-1600-0000-18e6-7aab680c0000 pid=3176 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=2e118e81-1600-0000-18e6-7aab680c0000 pid=3176 execve guuid=996f0c82-1600-0000-18e6-7aab690c0000 pid=3177 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=996f0c82-1600-0000-18e6-7aab690c0000 pid=3177 execve guuid=24cd7e82-1600-0000-18e6-7aab6b0c0000 pid=3179 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=24cd7e82-1600-0000-18e6-7aab6b0c0000 pid=3179 execve guuid=43aadf82-1600-0000-18e6-7aab6d0c0000 pid=3181 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=43aadf82-1600-0000-18e6-7aab6d0c0000 pid=3181 execve guuid=59093b83-1600-0000-18e6-7aab6f0c0000 pid=3183 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=59093b83-1600-0000-18e6-7aab6f0c0000 pid=3183 execve guuid=b0229a83-1600-0000-18e6-7aab710c0000 pid=3185 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=b0229a83-1600-0000-18e6-7aab710c0000 pid=3185 execve guuid=c6aa1084-1600-0000-18e6-7aab740c0000 pid=3188 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=c6aa1084-1600-0000-18e6-7aab740c0000 pid=3188 execve guuid=76d2dd84-1600-0000-18e6-7aab760c0000 pid=3190 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=76d2dd84-1600-0000-18e6-7aab760c0000 pid=3190 execve guuid=a7125d85-1600-0000-18e6-7aab770c0000 pid=3191 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=a7125d85-1600-0000-18e6-7aab770c0000 pid=3191 execve guuid=5cf9ca85-1600-0000-18e6-7aab790c0000 pid=3193 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=5cf9ca85-1600-0000-18e6-7aab790c0000 pid=3193 execve guuid=a52f2486-1600-0000-18e6-7aab7b0c0000 pid=3195 /usr/bin/ls guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=a52f2486-1600-0000-18e6-7aab7b0c0000 pid=3195 execve guuid=fa767886-1600-0000-18e6-7aab7d0c0000 pid=3197 /usr/bin/rm guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=fa767886-1600-0000-18e6-7aab7d0c0000 pid=3197 execve guuid=c65db186-1600-0000-18e6-7aab7f0c0000 pid=3199 /usr/bin/wget net send-data write-file guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=c65db186-1600-0000-18e6-7aab7f0c0000 pid=3199 execve guuid=4bb78ba0-1600-0000-18e6-7aab960c0000 pid=3222 /usr/bin/chmod guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=4bb78ba0-1600-0000-18e6-7aab960c0000 pid=3222 execve guuid=06f6f7a0-1600-0000-18e6-7aab980c0000 pid=3224 /usr/bin/dash guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=06f6f7a0-1600-0000-18e6-7aab980c0000 pid=3224 clone guuid=d4ed77a2-1600-0000-18e6-7aab9e0c0000 pid=3230 /usr/bin/rm guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=d4ed77a2-1600-0000-18e6-7aab9e0c0000 pid=3230 execve guuid=7baebfa2-1600-0000-18e6-7aab9f0c0000 pid=3231 /usr/bin/wget net send-data write-file guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=7baebfa2-1600-0000-18e6-7aab9f0c0000 pid=3231 execve guuid=9d07a3ba-1600-0000-18e6-7aabb20c0000 pid=3250 /usr/bin/chmod guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=9d07a3ba-1600-0000-18e6-7aabb20c0000 pid=3250 execve guuid=d52e9abb-1600-0000-18e6-7aabb30c0000 pid=3251 /usr/bin/dash guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=d52e9abb-1600-0000-18e6-7aabb30c0000 pid=3251 clone guuid=744b49be-1600-0000-18e6-7aabb50c0000 pid=3253 /usr/bin/rm guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=744b49be-1600-0000-18e6-7aabb50c0000 pid=3253 execve guuid=3f85a7be-1600-0000-18e6-7aabb60c0000 pid=3254 /usr/bin/wget net send-data write-file guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=3f85a7be-1600-0000-18e6-7aabb60c0000 pid=3254 execve guuid=e87015d7-1600-0000-18e6-7aabcd0c0000 pid=3277 /usr/bin/chmod guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=e87015d7-1600-0000-18e6-7aabcd0c0000 pid=3277 execve guuid=334d94d7-1600-0000-18e6-7aabcf0c0000 pid=3279 /usr/bin/dash guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=334d94d7-1600-0000-18e6-7aabcf0c0000 pid=3279 clone guuid=d0d887d8-1600-0000-18e6-7aabd30c0000 pid=3283 /usr/bin/rm guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=d0d887d8-1600-0000-18e6-7aabd30c0000 pid=3283 execve guuid=d1d3ffd8-1600-0000-18e6-7aabd50c0000 pid=3285 /usr/bin/wget net send-data write-file guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=d1d3ffd8-1600-0000-18e6-7aabd50c0000 pid=3285 execve guuid=bd67f7f6-1600-0000-18e6-7aabfa0c0000 pid=3322 /usr/bin/chmod guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=bd67f7f6-1600-0000-18e6-7aabfa0c0000 pid=3322 execve guuid=7af871f7-1600-0000-18e6-7aabfc0c0000 pid=3324 /usr/bin/dash guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=7af871f7-1600-0000-18e6-7aabfc0c0000 pid=3324 clone guuid=00ed74f8-1600-0000-18e6-7aab000d0000 pid=3328 /usr/bin/rm guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=00ed74f8-1600-0000-18e6-7aab000d0000 pid=3328 execve guuid=21e4edf8-1600-0000-18e6-7aab010d0000 pid=3329 /usr/bin/wget net send-data write-file guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=21e4edf8-1600-0000-18e6-7aab010d0000 pid=3329 execve guuid=8d5d8617-1700-0000-18e6-7aab2f0d0000 pid=3375 /usr/bin/chmod guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=8d5d8617-1700-0000-18e6-7aab2f0d0000 pid=3375 execve guuid=93aecf17-1700-0000-18e6-7aab310d0000 pid=3377 /usr/bin/dash guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=93aecf17-1700-0000-18e6-7aab310d0000 pid=3377 clone guuid=f4c18118-1700-0000-18e6-7aab330d0000 pid=3379 /usr/bin/rm delete-file guuid=3d851555-1600-0000-18e6-7aab780b0000 pid=2936->guuid=f4c18118-1700-0000-18e6-7aab330d0000 pid=3379 execve 801186e6-5fe8-5959-a7b4-832d8d66e7aa 129.121.114.124:80 guuid=c65db186-1600-0000-18e6-7aab7f0c0000 pid=3199->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 133B guuid=7baebfa2-1600-0000-18e6-7aab9f0c0000 pid=3231->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 133B guuid=3f85a7be-1600-0000-18e6-7aabb60c0000 pid=3254->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 133B guuid=d1d3ffd8-1600-0000-18e6-7aabd50c0000 pid=3285->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 134B guuid=21e4edf8-1600-0000-18e6-7aab010d0000 pid=3329->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 133B
Score:
98%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/f84fab97acebb6a52e2e839403b8e3a7fe040dcc30e808b6198e02a3621015a8
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f84fab97acebb6a52e2e839403b8e3a7fe040dcc30e808b6198e02a3621015a8/
Threat name:
Document-HTML.Trojan.Bash
Create hunting rule
Status:
Malicious
First seen:
2026-07-18 02:18:38 UTC
File Type:
Text (Shell)
AV detection:
12 of 24 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7bh2xf5m5o3kklroqokahohdu77aidomgduarnqzrybkgyqqcwua._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
discovery linux
Link:
https://tria.ge/reports/260718-crjw6ac16r/
Behaviour
Reads runtime system information
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.26
Link:
https://yomi.yoroi.company/submissions/f84fab97acebb6a52e2e839403b8e3a7fe040dcc30e808b6198e02a3621015a8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh f84fab97acebb6a52e2e839403b8e3a7fe040dcc30e808b6198e02a3621015a8

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3866369/
  
Delivery method
Distributed via web download

Comments