🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f90f4a51eb29f748e8ff0343496494edfc6f39fc89e758cc01f1d90bb0400aa5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f90f4a51eb29f748e8ff0343496494edfc6f39fc89e758cc01f1d90bb0400aa5
SHA3-384 hash: db4d80e9181bf6482a27357168e614ddb021ac8aafdb01b4e41071ed6f4b41577560428f18aa7e64d093a7585ecc2f11
SHA1 hash: 2fd878bb1e50e8b86c5c9dfda1a0a7bac01e2162
MD5 hash: c6bde5bdae43f14313fef7174258735c
humanhash: mockingbird-alaska-paris-louisiana
File name:f90f4a51eb29f748e8ff0343496494edfc6f39fc89e758cc01f1d90bb0400aa5
Download: download sample
File size:1'608 bytes
First seen:2026-09-16 06:17:24 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 12:UFj6FsG2Em62EZ2FQw/36rFv6BrKn6KscUlLGBIL6BIrVrYmLN6P10v2li6MvVXF:U3bio+zgUm40v5vyloqTqc2UpZJg
TLSH T1E531419E05100A312543DA9E7363354C628FD2EB6C5FE7E4D95D0DA9875838CF612B5C
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter GAYINT_DOT_ORG
Tags:cowrie dropper honeypot sh
URLMalware sample (SHA256 hash)SignatureTags
http://5.182.210.174/1db962n/an/an/a
http://5.182.210.174/f552adn/an/an/a
http://5.182.210.174/860273n/an/an/a
http://5.182.210.174/678ee5n/an/an/a
http://5.182.210.174/a6108cn/an/an/a
http://5.182.210.174/5897a3n/an/an/a
http://5.182.210.174/bc9662n/an/an/a
http://5.182.210.174/8a0baan/an/an/a
http://5.182.210.174/67eb55n/an/an/a
http://5.182.210.174/f45573n/an/an/a
http://5.182.210.174/2c5c46n/an/an/a
http://5.182.210.174/38a04bn/an/an/a

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
US US
Vendor Threat Intelligence
No detections
Gathering data
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-08-20T23:22:00Z UTC
Last seen:
2026-08-23T00:09:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/f90f4a51eb29f748e8ff0343496494edfc6f39fc89e758cc01f1d90bb0400aa5/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/e3b3d064-e2b9-41ad-ba9a-f2a9c6be9294
Behavior Graph:
Download SVG
%3 guuid=8abc2ffe-1b00-0000-cb2f-d91a41070000 pid=1857 /usr/bin/sudo guuid=6a300e03-1c00-0000-cb2f-d91a49070000 pid=1865 /tmp/sample.bin guuid=8abc2ffe-1b00-0000-cb2f-d91a41070000 pid=1857->guuid=6a300e03-1c00-0000-cb2f-d91a49070000 pid=1865 execve guuid=6c21f603-1c00-0000-cb2f-d91a4b070000 pid=1867 /usr/bin/wget net send-data guuid=6a300e03-1c00-0000-cb2f-d91a49070000 pid=1865->guuid=6c21f603-1c00-0000-cb2f-d91a4b070000 pid=1867 execve guuid=a679210b-1c00-0000-cb2f-d91a4f070000 pid=1871 /usr/bin/curl net send-data write-file guuid=6a300e03-1c00-0000-cb2f-d91a49070000 pid=1865->guuid=a679210b-1c00-0000-cb2f-d91a4f070000 pid=1871 execve guuid=9e6df319-1c00-0000-cb2f-d91a5d070000 pid=1885 /usr/bin/chmod guuid=6a300e03-1c00-0000-cb2f-d91a49070000 pid=1865->guuid=9e6df319-1c00-0000-cb2f-d91a5d070000 pid=1885 execve guuid=086b971a-1c00-0000-cb2f-d91a5f070000 pid=1887 /usr/bin/bash guuid=6a300e03-1c00-0000-cb2f-d91a49070000 pid=1865->guuid=086b971a-1c00-0000-cb2f-d91a5f070000 pid=1887 clone guuid=b2d2051b-1c00-0000-cb2f-d91a61070000 pid=1889 /usr/bin/rm delete-file guuid=6a300e03-1c00-0000-cb2f-d91a49070000 pid=1865->guuid=b2d2051b-1c00-0000-cb2f-d91a61070000 pid=1889 execve guuid=b21cdf1b-1c00-0000-cb2f-d91a62070000 pid=1890 /usr/bin/rm guuid=6a300e03-1c00-0000-cb2f-d91a49070000 pid=1865->guuid=b21cdf1b-1c00-0000-cb2f-d91a62070000 pid=1890 execve guuid=4889a81c-1c00-0000-cb2f-d91a64070000 pid=1892 /usr/bin/wget net send-data guuid=6a300e03-1c00-0000-cb2f-d91a49070000 pid=1865->guuid=4889a81c-1c00-0000-cb2f-d91a64070000 pid=1892 execve guuid=efbf8d20-1c00-0000-cb2f-d91a6a070000 pid=1898 /usr/bin/curl net send-data write-file guuid=6a300e03-1c00-0000-cb2f-d91a49070000 pid=1865->guuid=efbf8d20-1c00-0000-cb2f-d91a6a070000 pid=1898 execve guuid=a873b425-1c00-0000-cb2f-d91a73070000 pid=1907 /usr/bin/chmod guuid=6a300e03-1c00-0000-cb2f-d91a49070000 pid=1865->guuid=a873b425-1c00-0000-cb2f-d91a73070000 pid=1907 execve guuid=96d94026-1c00-0000-cb2f-d91a74070000 pid=1908 /usr/bin/bash guuid=6a300e03-1c00-0000-cb2f-d91a49070000 pid=1865->guuid=96d94026-1c00-0000-cb2f-d91a74070000 pid=1908 clone guuid=617d9326-1c00-0000-cb2f-d91a77070000 pid=1911 /usr/bin/rm delete-file guuid=6a300e03-1c00-0000-cb2f-d91a49070000 pid=1865->guuid=617d9326-1c00-0000-cb2f-d91a77070000 pid=1911 execve guuid=49743827-1c00-0000-cb2f-d91a79070000 pid=1913 /usr/bin/rm guuid=6a300e03-1c00-0000-cb2f-d91a49070000 pid=1865->guuid=49743827-1c00-0000-cb2f-d91a79070000 pid=1913 execve guuid=ae26b627-1c00-0000-cb2f-d91a7b070000 pid=1915 /usr/bin/wget net send-data guuid=6a300e03-1c00-0000-cb2f-d91a49070000 pid=1865->guuid=ae26b627-1c00-0000-cb2f-d91a7b070000 pid=1915 execve guuid=6a54012b-1c00-0000-cb2f-d91a82070000 pid=1922 /usr/bin/curl net send-data write-file guuid=6a300e03-1c00-0000-cb2f-d91a49070000 pid=1865->guuid=6a54012b-1c00-0000-cb2f-d91a82070000 pid=1922 execve guuid=4c74ab30-1c00-0000-cb2f-d91a8b070000 pid=1931 /usr/bin/chmod guuid=6a300e03-1c00-0000-cb2f-d91a49070000 pid=1865->guuid=4c74ab30-1c00-0000-cb2f-d91a8b070000 pid=1931 execve guuid=15074e31-1c00-0000-cb2f-d91a8d070000 pid=1933 /usr/bin/bash guuid=6a300e03-1c00-0000-cb2f-d91a49070000 pid=1865->guuid=15074e31-1c00-0000-cb2f-d91a8d070000 pid=1933 clone guuid=98900332-1c00-0000-cb2f-d91a8f070000 pid=1935 /usr/bin/rm delete-file guuid=6a300e03-1c00-0000-cb2f-d91a49070000 pid=1865->guuid=98900332-1c00-0000-cb2f-d91a8f070000 pid=1935 execve guuid=ff69ff32-1c00-0000-cb2f-d91a90070000 pid=1936 /usr/bin/rm guuid=6a300e03-1c00-0000-cb2f-d91a49070000 pid=1865->guuid=ff69ff32-1c00-0000-cb2f-d91a90070000 pid=1936 execve guuid=36a12934-1c00-0000-cb2f-d91a91070000 pid=1937 /usr/bin/wget net send-data guuid=6a300e03-1c00-0000-cb2f-d91a49070000 pid=1865->guuid=36a12934-1c00-0000-cb2f-d91a91070000 pid=1937 execve guuid=b0c77a37-1c00-0000-cb2f-d91a97070000 pid=1943 /usr/bin/curl net send-data write-file guuid=6a300e03-1c00-0000-cb2f-d91a49070000 pid=1865->guuid=b0c77a37-1c00-0000-cb2f-d91a97070000 pid=1943 execve guuid=91abd13c-1c00-0000-cb2f-d91a9d070000 pid=1949 /usr/bin/chmod guuid=6a300e03-1c00-0000-cb2f-d91a49070000 pid=1865->guuid=91abd13c-1c00-0000-cb2f-d91a9d070000 pid=1949 execve guuid=022d783d-1c00-0000-cb2f-d91a9f070000 pid=1951 /usr/bin/bash guuid=6a300e03-1c00-0000-cb2f-d91a49070000 pid=1865->guuid=022d783d-1c00-0000-cb2f-d91a9f070000 pid=1951 clone guuid=cceb553e-1c00-0000-cb2f-d91aa3070000 pid=1955 /usr/bin/rm delete-file guuid=6a300e03-1c00-0000-cb2f-d91a49070000 pid=1865->guuid=cceb553e-1c00-0000-cb2f-d91aa3070000 pid=1955 execve guuid=417df23e-1c00-0000-cb2f-d91aa4070000 pid=1956 /usr/bin/rm guuid=6a300e03-1c00-0000-cb2f-d91a49070000 pid=1865->guuid=417df23e-1c00-0000-cb2f-d91aa4070000 pid=1956 execve guuid=c56a693f-1c00-0000-cb2f-d91aa5070000 pid=1957 /usr/bin/wget net send-data guuid=6a300e03-1c00-0000-cb2f-d91a49070000 pid=1865->guuid=c56a693f-1c00-0000-cb2f-d91aa5070000 pid=1957 execve guuid=09ff4144-1c00-0000-cb2f-d91aa9070000 pid=1961 /usr/bin/curl net send-data write-file guuid=6a300e03-1c00-0000-cb2f-d91a49070000 pid=1865->guuid=09ff4144-1c00-0000-cb2f-d91aa9070000 pid=1961 execve guuid=aba2934b-1c00-0000-cb2f-d91ab2070000 pid=1970 /usr/bin/chmod guuid=6a300e03-1c00-0000-cb2f-d91a49070000 pid=1865->guuid=aba2934b-1c00-0000-cb2f-d91ab2070000 pid=1970 execve guuid=3173444c-1c00-0000-cb2f-d91ab4070000 pid=1972 /usr/bin/bash guuid=6a300e03-1c00-0000-cb2f-d91a49070000 pid=1865->guuid=3173444c-1c00-0000-cb2f-d91ab4070000 pid=1972 clone guuid=72b9044d-1c00-0000-cb2f-d91ab8070000 pid=1976 /usr/bin/rm delete-file guuid=6a300e03-1c00-0000-cb2f-d91a49070000 pid=1865->guuid=72b9044d-1c00-0000-cb2f-d91ab8070000 pid=1976 execve guuid=1b07e84d-1c00-0000-cb2f-d91ab9070000 pid=1977 /usr/bin/rm guuid=6a300e03-1c00-0000-cb2f-d91a49070000 pid=1865->guuid=1b07e84d-1c00-0000-cb2f-d91ab9070000 pid=1977 execve guuid=4053ea4e-1c00-0000-cb2f-d91abc070000 pid=1980 /usr/bin/wget net send-data guuid=6a300e03-1c00-0000-cb2f-d91a49070000 pid=1865->guuid=4053ea4e-1c00-0000-cb2f-d91abc070000 pid=1980 execve guuid=53d23154-1c00-0000-cb2f-d91ac4070000 pid=1988 /usr/bin/curl net send-data write-file guuid=6a300e03-1c00-0000-cb2f-d91a49070000 pid=1865->guuid=53d23154-1c00-0000-cb2f-d91ac4070000 pid=1988 execve guuid=e4d27d5b-1c00-0000-cb2f-d91aca070000 pid=1994 /usr/bin/chmod guuid=6a300e03-1c00-0000-cb2f-d91a49070000 pid=1865->guuid=e4d27d5b-1c00-0000-cb2f-d91aca070000 pid=1994 execve guuid=3131395c-1c00-0000-cb2f-d91acc070000 pid=1996 /usr/bin/bash guuid=6a300e03-1c00-0000-cb2f-d91a49070000 pid=1865->guuid=3131395c-1c00-0000-cb2f-d91acc070000 pid=1996 clone guuid=5d69885d-1c00-0000-cb2f-d91acf070000 pid=1999 /usr/bin/rm delete-file guuid=6a300e03-1c00-0000-cb2f-d91a49070000 pid=1865->guuid=5d69885d-1c00-0000-cb2f-d91acf070000 pid=1999 execve guuid=0c7dfc5d-1c00-0000-cb2f-d91ad0070000 pid=2000 /usr/bin/rm guuid=6a300e03-1c00-0000-cb2f-d91a49070000 pid=1865->guuid=0c7dfc5d-1c00-0000-cb2f-d91ad0070000 pid=2000 execve guuid=e66aa75e-1c00-0000-cb2f-d91ad1070000 pid=2001 /usr/bin/wget net send-data guuid=6a300e03-1c00-0000-cb2f-d91a49070000 pid=1865->guuid=e66aa75e-1c00-0000-cb2f-d91ad1070000 pid=2001 execve guuid=2df1d462-1c00-0000-cb2f-d91ad8070000 pid=2008 /usr/bin/curl net send-data write-file guuid=6a300e03-1c00-0000-cb2f-d91a49070000 pid=1865->guuid=2df1d462-1c00-0000-cb2f-d91ad8070000 pid=2008 execve guuid=524d096a-1c00-0000-cb2f-d91ae2070000 pid=2018 /usr/bin/chmod guuid=6a300e03-1c00-0000-cb2f-d91a49070000 pid=1865->guuid=524d096a-1c00-0000-cb2f-d91ae2070000 pid=2018 execve guuid=8750b86a-1c00-0000-cb2f-d91ae3070000 pid=2019 /usr/bin/bash guuid=6a300e03-1c00-0000-cb2f-d91a49070000 pid=1865->guuid=8750b86a-1c00-0000-cb2f-d91ae3070000 pid=2019 clone guuid=dc2c626b-1c00-0000-cb2f-d91ae5070000 pid=2021 /usr/bin/rm delete-file guuid=6a300e03-1c00-0000-cb2f-d91a49070000 pid=1865->guuid=dc2c626b-1c00-0000-cb2f-d91ae5070000 pid=2021 execve guuid=3f498e6c-1c00-0000-cb2f-d91ae8070000 pid=2024 /usr/bin/rm guuid=6a300e03-1c00-0000-cb2f-d91a49070000 pid=1865->guuid=3f498e6c-1c00-0000-cb2f-d91ae8070000 pid=2024 execve guuid=57ad116d-1c00-0000-cb2f-d91aea070000 pid=2026 /usr/bin/wget net send-data guuid=6a300e03-1c00-0000-cb2f-d91a49070000 pid=1865->guuid=57ad116d-1c00-0000-cb2f-d91aea070000 pid=2026 execve guuid=ded8c171-1c00-0000-cb2f-d91af1070000 pid=2033 /usr/bin/curl net send-data write-file guuid=6a300e03-1c00-0000-cb2f-d91a49070000 pid=1865->guuid=ded8c171-1c00-0000-cb2f-d91af1070000 pid=2033 execve guuid=2d21427a-1c00-0000-cb2f-d91afa070000 pid=2042 /usr/bin/chmod guuid=6a300e03-1c00-0000-cb2f-d91a49070000 pid=1865->guuid=2d21427a-1c00-0000-cb2f-d91afa070000 pid=2042 execve guuid=b053ab7a-1c00-0000-cb2f-d91afc070000 pid=2044 /usr/bin/bash guuid=6a300e03-1c00-0000-cb2f-d91a49070000 pid=1865->guuid=b053ab7a-1c00-0000-cb2f-d91afc070000 pid=2044 clone guuid=2b09097b-1c00-0000-cb2f-d91aff070000 pid=2047 /usr/bin/rm delete-file guuid=6a300e03-1c00-0000-cb2f-d91a49070000 pid=1865->guuid=2b09097b-1c00-0000-cb2f-d91aff070000 pid=2047 execve guuid=ad8a967b-1c00-0000-cb2f-d91a00080000 pid=2048 /usr/bin/rm guuid=6a300e03-1c00-0000-cb2f-d91a49070000 pid=1865->guuid=ad8a967b-1c00-0000-cb2f-d91a00080000 pid=2048 execve guuid=1603167c-1c00-0000-cb2f-d91a02080000 pid=2050 /usr/bin/wget net send-data guuid=6a300e03-1c00-0000-cb2f-d91a49070000 pid=1865->guuid=1603167c-1c00-0000-cb2f-d91a02080000 pid=2050 execve guuid=b7c9f77f-1c00-0000-cb2f-d91a07080000 pid=2055 /usr/bin/curl net send-data write-file guuid=6a300e03-1c00-0000-cb2f-d91a49070000 pid=1865->guuid=b7c9f77f-1c00-0000-cb2f-d91a07080000 pid=2055 execve guuid=aa5f9087-1c00-0000-cb2f-d91a11080000 pid=2065 /usr/bin/chmod guuid=6a300e03-1c00-0000-cb2f-d91a49070000 pid=1865->guuid=aa5f9087-1c00-0000-cb2f-d91a11080000 pid=2065 execve guuid=15db1088-1c00-0000-cb2f-d91a12080000 pid=2066 /usr/bin/bash guuid=6a300e03-1c00-0000-cb2f-d91a49070000 pid=1865->guuid=15db1088-1c00-0000-cb2f-d91a12080000 pid=2066 clone guuid=68c26488-1c00-0000-cb2f-d91a14080000 pid=2068 /usr/bin/rm delete-file guuid=6a300e03-1c00-0000-cb2f-d91a49070000 pid=1865->guuid=68c26488-1c00-0000-cb2f-d91a14080000 pid=2068 execve guuid=e3055189-1c00-0000-cb2f-d91a17080000 pid=2071 /usr/bin/rm guuid=6a300e03-1c00-0000-cb2f-d91a49070000 pid=1865->guuid=e3055189-1c00-0000-cb2f-d91a17080000 pid=2071 execve guuid=3018eb89-1c00-0000-cb2f-d91a19080000 pid=2073 /usr/bin/wget net send-data guuid=6a300e03-1c00-0000-cb2f-d91a49070000 pid=1865->guuid=3018eb89-1c00-0000-cb2f-d91a19080000 pid=2073 execve guuid=072fc18e-1c00-0000-cb2f-d91a20080000 pid=2080 /usr/bin/curl net send-data write-file guuid=6a300e03-1c00-0000-cb2f-d91a49070000 pid=1865->guuid=072fc18e-1c00-0000-cb2f-d91a20080000 pid=2080 execve guuid=e14c659f-1c00-0000-cb2f-d91a2f080000 pid=2095 /usr/bin/chmod guuid=6a300e03-1c00-0000-cb2f-d91a49070000 pid=1865->guuid=e14c659f-1c00-0000-cb2f-d91a2f080000 pid=2095 execve guuid=67a15ea0-1c00-0000-cb2f-d91a32080000 pid=2098 /usr/bin/bash guuid=6a300e03-1c00-0000-cb2f-d91a49070000 pid=1865->guuid=67a15ea0-1c00-0000-cb2f-d91a32080000 pid=2098 clone guuid=6cbce1a0-1c00-0000-cb2f-d91a35080000 pid=2101 /usr/bin/rm delete-file guuid=6a300e03-1c00-0000-cb2f-d91a49070000 pid=1865->guuid=6cbce1a0-1c00-0000-cb2f-d91a35080000 pid=2101 execve guuid=c9da33a1-1c00-0000-cb2f-d91a37080000 pid=2103 /usr/bin/rm guuid=6a300e03-1c00-0000-cb2f-d91a49070000 pid=1865->guuid=c9da33a1-1c00-0000-cb2f-d91a37080000 pid=2103 execve guuid=9a32f0a1-1c00-0000-cb2f-d91a39080000 pid=2105 /usr/bin/wget net send-data guuid=6a300e03-1c00-0000-cb2f-d91a49070000 pid=1865->guuid=9a32f0a1-1c00-0000-cb2f-d91a39080000 pid=2105 execve guuid=7c253ca5-1c00-0000-cb2f-d91a3f080000 pid=2111 /usr/bin/curl net send-data write-file guuid=6a300e03-1c00-0000-cb2f-d91a49070000 pid=1865->guuid=7c253ca5-1c00-0000-cb2f-d91a3f080000 pid=2111 execve guuid=fb9f7cac-1c00-0000-cb2f-d91a4c080000 pid=2124 /usr/bin/chmod guuid=6a300e03-1c00-0000-cb2f-d91a49070000 pid=1865->guuid=fb9f7cac-1c00-0000-cb2f-d91a4c080000 pid=2124 execve guuid=ecefafae-1c00-0000-cb2f-d91a51080000 pid=2129 /usr/bin/bash guuid=6a300e03-1c00-0000-cb2f-d91a49070000 pid=1865->guuid=ecefafae-1c00-0000-cb2f-d91a51080000 pid=2129 clone guuid=2850b3af-1c00-0000-cb2f-d91a55080000 pid=2133 /usr/bin/rm delete-file guuid=6a300e03-1c00-0000-cb2f-d91a49070000 pid=1865->guuid=2850b3af-1c00-0000-cb2f-d91a55080000 pid=2133 execve guuid=97326fb0-1c00-0000-cb2f-d91a58080000 pid=2136 /usr/bin/rm guuid=6a300e03-1c00-0000-cb2f-d91a49070000 pid=1865->guuid=97326fb0-1c00-0000-cb2f-d91a58080000 pid=2136 execve guuid=842bedb0-1c00-0000-cb2f-d91a5a080000 pid=2138 /usr/bin/wget net send-data guuid=6a300e03-1c00-0000-cb2f-d91a49070000 pid=1865->guuid=842bedb0-1c00-0000-cb2f-d91a5a080000 pid=2138 execve guuid=b4b82cb6-1c00-0000-cb2f-d91a63080000 pid=2147 /usr/bin/curl net send-data write-file guuid=6a300e03-1c00-0000-cb2f-d91a49070000 pid=1865->guuid=b4b82cb6-1c00-0000-cb2f-d91a63080000 pid=2147 execve guuid=80e7e9bf-1c00-0000-cb2f-d91a75080000 pid=2165 /usr/bin/chmod guuid=6a300e03-1c00-0000-cb2f-d91a49070000 pid=1865->guuid=80e7e9bf-1c00-0000-cb2f-d91a75080000 pid=2165 execve guuid=7083e2c0-1c00-0000-cb2f-d91a78080000 pid=2168 /usr/bin/bash guuid=6a300e03-1c00-0000-cb2f-d91a49070000 pid=1865->guuid=7083e2c0-1c00-0000-cb2f-d91a78080000 pid=2168 clone guuid=6e4d54c2-1c00-0000-cb2f-d91a7a080000 pid=2170 /usr/bin/rm delete-file guuid=6a300e03-1c00-0000-cb2f-d91a49070000 pid=1865->guuid=6e4d54c2-1c00-0000-cb2f-d91a7a080000 pid=2170 execve guuid=8e520dc3-1c00-0000-cb2f-d91a7b080000 pid=2171 /usr/bin/rm guuid=6a300e03-1c00-0000-cb2f-d91a49070000 pid=1865->guuid=8e520dc3-1c00-0000-cb2f-d91a7b080000 pid=2171 execve 5b654972-c9e1-50d8-b372-2dc2a5b9ad66 5.182.210.174:80 guuid=6c21f603-1c00-0000-cb2f-d91a4b070000 pid=1867->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=a679210b-1c00-0000-cb2f-d91a4f070000 pid=1871->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=8691c01a-1c00-0000-cb2f-d91a60070000 pid=1888 /usr/bin/bash guuid=086b971a-1c00-0000-cb2f-d91a5f070000 pid=1887->guuid=8691c01a-1c00-0000-cb2f-d91a60070000 pid=1888 clone guuid=4889a81c-1c00-0000-cb2f-d91a64070000 pid=1892->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=efbf8d20-1c00-0000-cb2f-d91a6a070000 pid=1898->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=16416026-1c00-0000-cb2f-d91a75070000 pid=1909 /usr/bin/bash guuid=96d94026-1c00-0000-cb2f-d91a74070000 pid=1908->guuid=16416026-1c00-0000-cb2f-d91a75070000 pid=1909 clone guuid=ae26b627-1c00-0000-cb2f-d91a7b070000 pid=1915->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=6a54012b-1c00-0000-cb2f-d91a82070000 pid=1922->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=c4e28631-1c00-0000-cb2f-d91a8e070000 pid=1934 /usr/bin/bash guuid=15074e31-1c00-0000-cb2f-d91a8d070000 pid=1933->guuid=c4e28631-1c00-0000-cb2f-d91a8e070000 pid=1934 clone guuid=36a12934-1c00-0000-cb2f-d91a91070000 pid=1937->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=b0c77a37-1c00-0000-cb2f-d91a97070000 pid=1943->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=d20ce63d-1c00-0000-cb2f-d91aa1070000 pid=1953 /usr/bin/bash guuid=022d783d-1c00-0000-cb2f-d91a9f070000 pid=1951->guuid=d20ce63d-1c00-0000-cb2f-d91aa1070000 pid=1953 clone guuid=c56a693f-1c00-0000-cb2f-d91aa5070000 pid=1957->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=09ff4144-1c00-0000-cb2f-d91aa9070000 pid=1961->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=3c21b44c-1c00-0000-cb2f-d91ab6070000 pid=1974 /usr/bin/bash guuid=3173444c-1c00-0000-cb2f-d91ab4070000 pid=1972->guuid=3c21b44c-1c00-0000-cb2f-d91ab6070000 pid=1974 clone guuid=4053ea4e-1c00-0000-cb2f-d91abc070000 pid=1980->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=53d23154-1c00-0000-cb2f-d91ac4070000 pid=1988->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=48caa25c-1c00-0000-cb2f-d91acd070000 pid=1997 /usr/bin/bash guuid=3131395c-1c00-0000-cb2f-d91acc070000 pid=1996->guuid=48caa25c-1c00-0000-cb2f-d91acd070000 pid=1997 clone guuid=e66aa75e-1c00-0000-cb2f-d91ad1070000 pid=2001->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=2df1d462-1c00-0000-cb2f-d91ad8070000 pid=2008->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=5967ec6a-1c00-0000-cb2f-d91ae4070000 pid=2020 /usr/bin/bash guuid=8750b86a-1c00-0000-cb2f-d91ae3070000 pid=2019->guuid=5967ec6a-1c00-0000-cb2f-d91ae4070000 pid=2020 clone guuid=57ad116d-1c00-0000-cb2f-d91aea070000 pid=2026->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=ded8c171-1c00-0000-cb2f-d91af1070000 pid=2033->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=53b7db7a-1c00-0000-cb2f-d91afd070000 pid=2045 /usr/bin/bash guuid=b053ab7a-1c00-0000-cb2f-d91afc070000 pid=2044->guuid=53b7db7a-1c00-0000-cb2f-d91afd070000 pid=2045 clone guuid=1603167c-1c00-0000-cb2f-d91a02080000 pid=2050->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=b7c9f77f-1c00-0000-cb2f-d91a07080000 pid=2055->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=80fc3588-1c00-0000-cb2f-d91a13080000 pid=2067 /usr/bin/bash guuid=15db1088-1c00-0000-cb2f-d91a12080000 pid=2066->guuid=80fc3588-1c00-0000-cb2f-d91a13080000 pid=2067 clone guuid=3018eb89-1c00-0000-cb2f-d91a19080000 pid=2073->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=072fc18e-1c00-0000-cb2f-d91a20080000 pid=2080->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=9a0ba8a0-1c00-0000-cb2f-d91a34080000 pid=2100 /usr/bin/bash guuid=67a15ea0-1c00-0000-cb2f-d91a32080000 pid=2098->guuid=9a0ba8a0-1c00-0000-cb2f-d91a34080000 pid=2100 clone guuid=9a32f0a1-1c00-0000-cb2f-d91a39080000 pid=2105->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=7c253ca5-1c00-0000-cb2f-d91a3f080000 pid=2111->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=23d52aaf-1c00-0000-cb2f-d91a53080000 pid=2131 /usr/bin/bash guuid=ecefafae-1c00-0000-cb2f-d91a51080000 pid=2129->guuid=23d52aaf-1c00-0000-cb2f-d91a53080000 pid=2131 clone guuid=842bedb0-1c00-0000-cb2f-d91a5a080000 pid=2138->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=b4b82cb6-1c00-0000-cb2f-d91a63080000 pid=2147->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=c9f5c9c1-1c00-0000-cb2f-d91a79080000 pid=2169 /usr/bin/bash guuid=7083e2c0-1c00-0000-cb2f-d91a78080000 pid=2168->guuid=c9f5c9c1-1c00-0000-cb2f-d91a79080000 pid=2169 clone
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/f90f4a51eb29f748e8ff0343496494edfc6f39fc89e758cc01f1d90bb0400aa5
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f90f4a51eb29f748e8ff0343496494edfc6f39fc89e758cc01f1d90bb0400aa5/
Threat name:
Linux.Downloader.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-08-21 04:18:38 UTC
File Type:
Text (Shell)
AV detection:
17 of 36 (47.22%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7ehuuuplfh3ur2h7anbuszeu5x6g6op4rhtvrtab6hmqxmcabksq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260916-g2rrzawdmh/
Behaviour
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh f90f4a51eb29f748e8ff0343496494edfc6f39fc89e758cc01f1d90bb0400aa5

(this sample)

  
Delivery method
Distributed via web download

Comments