MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f98cee80c0311a98be9dc30e38f5bd228dfb2765b942f8a07fed04204187e8d3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f98cee80c0311a98be9dc30e38f5bd228dfb2765b942f8a07fed04204187e8d3
SHA3-384 hash: 2a28d00b712247aac7dbe949ff84996df52aeeb0d179dec2f3b7fc8cc5e1fedf106c4a0df6419f6513debf1144ae2dd3
SHA1 hash: 3b6c87053205a34002ff3f81cdcb311bdd44df18
MD5 hash: 009091ab1a1d827f4b528d779cb79268
humanhash: item-romeo-nebraska-football
File name:ok
Download: download sample
File size:1'608 bytes
First seen:2026-08-09 09:12:53 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 24:m0xh3IoBOl4XTs5ZPyAQWvvWEupCFdYKOAPdT5UHe1QVKFv:m/PyAQ6vsEdnOUU+1QVS
TLSH T1AF31439E56005F711103DA8EB3722948B28EE2FB289FD7E0DC1D1EA946886DCF211B49
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh

Intelligence

File Origin
# of uploads :
1
# of downloads :
44
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive mirai
Link:
https://www.filescan.io/uploads/6a7844b046ba96cfa12cb24d/reports/c10d472a-5b4d-40b8-ad75-e77e65648c66/overview
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/63284552-c3d4-4793-b5d1-d6c9818f5ffe
Behavior Graph:
Download SVG
%3 guuid=bc49879b-1600-0000-7707-bf98b80c0000 pid=3256 /usr/bin/sudo guuid=e6a4bb9e-1600-0000-7707-bf98c40c0000 pid=3268 /tmp/sample.bin guuid=bc49879b-1600-0000-7707-bf98b80c0000 pid=3256->guuid=e6a4bb9e-1600-0000-7707-bf98c40c0000 pid=3268 execve guuid=ea01139f-1600-0000-7707-bf98c60c0000 pid=3270 /usr/bin/wget net send-data guuid=e6a4bb9e-1600-0000-7707-bf98c40c0000 pid=3268->guuid=ea01139f-1600-0000-7707-bf98c60c0000 pid=3270 execve guuid=d56a8da2-1600-0000-7707-bf98ce0c0000 pid=3278 /usr/bin/curl net send-data write-file guuid=e6a4bb9e-1600-0000-7707-bf98c40c0000 pid=3268->guuid=d56a8da2-1600-0000-7707-bf98ce0c0000 pid=3278 execve guuid=89f035aa-1600-0000-7707-bf98e10c0000 pid=3297 /usr/bin/chmod guuid=e6a4bb9e-1600-0000-7707-bf98c40c0000 pid=3268->guuid=89f035aa-1600-0000-7707-bf98e10c0000 pid=3297 execve guuid=d66277aa-1600-0000-7707-bf98e20c0000 pid=3298 /usr/bin/bash guuid=e6a4bb9e-1600-0000-7707-bf98c40c0000 pid=3268->guuid=d66277aa-1600-0000-7707-bf98e20c0000 pid=3298 clone guuid=26a5b5aa-1600-0000-7707-bf98e50c0000 pid=3301 /usr/bin/rm delete-file guuid=e6a4bb9e-1600-0000-7707-bf98c40c0000 pid=3268->guuid=26a5b5aa-1600-0000-7707-bf98e50c0000 pid=3301 execve guuid=b296f4aa-1600-0000-7707-bf98e60c0000 pid=3302 /usr/bin/rm guuid=e6a4bb9e-1600-0000-7707-bf98c40c0000 pid=3268->guuid=b296f4aa-1600-0000-7707-bf98e60c0000 pid=3302 execve guuid=731a37ab-1600-0000-7707-bf98e80c0000 pid=3304 /usr/bin/wget net send-data guuid=e6a4bb9e-1600-0000-7707-bf98c40c0000 pid=3268->guuid=731a37ab-1600-0000-7707-bf98e80c0000 pid=3304 execve guuid=6ea4c6ad-1600-0000-7707-bf98ee0c0000 pid=3310 /usr/bin/curl net send-data write-file guuid=e6a4bb9e-1600-0000-7707-bf98c40c0000 pid=3268->guuid=6ea4c6ad-1600-0000-7707-bf98ee0c0000 pid=3310 execve guuid=e8eb1db2-1600-0000-7707-bf98f70c0000 pid=3319 /usr/bin/chmod guuid=e6a4bb9e-1600-0000-7707-bf98c40c0000 pid=3268->guuid=e8eb1db2-1600-0000-7707-bf98f70c0000 pid=3319 execve guuid=a9b4c3b2-1600-0000-7707-bf98fb0c0000 pid=3323 /usr/bin/bash guuid=e6a4bb9e-1600-0000-7707-bf98c40c0000 pid=3268->guuid=a9b4c3b2-1600-0000-7707-bf98fb0c0000 pid=3323 clone guuid=e19d3eb3-1600-0000-7707-bf98ff0c0000 pid=3327 /usr/bin/rm delete-file guuid=e6a4bb9e-1600-0000-7707-bf98c40c0000 pid=3268->guuid=e19d3eb3-1600-0000-7707-bf98ff0c0000 pid=3327 execve guuid=54f6c5b3-1600-0000-7707-bf98020d0000 pid=3330 /usr/bin/rm guuid=e6a4bb9e-1600-0000-7707-bf98c40c0000 pid=3268->guuid=54f6c5b3-1600-0000-7707-bf98020d0000 pid=3330 execve guuid=86a251b4-1600-0000-7707-bf98050d0000 pid=3333 /usr/bin/wget net send-data guuid=e6a4bb9e-1600-0000-7707-bf98c40c0000 pid=3268->guuid=86a251b4-1600-0000-7707-bf98050d0000 pid=3333 execve guuid=c4b7c4b7-1600-0000-7707-bf98100d0000 pid=3344 /usr/bin/curl net send-data write-file guuid=e6a4bb9e-1600-0000-7707-bf98c40c0000 pid=3268->guuid=c4b7c4b7-1600-0000-7707-bf98100d0000 pid=3344 execve guuid=cf4a59bb-1600-0000-7707-bf981f0d0000 pid=3359 /usr/bin/chmod guuid=e6a4bb9e-1600-0000-7707-bf98c40c0000 pid=3268->guuid=cf4a59bb-1600-0000-7707-bf981f0d0000 pid=3359 execve guuid=737b9ebb-1600-0000-7707-bf98210d0000 pid=3361 /usr/bin/bash guuid=e6a4bb9e-1600-0000-7707-bf98c40c0000 pid=3268->guuid=737b9ebb-1600-0000-7707-bf98210d0000 pid=3361 clone guuid=7f52d8bb-1600-0000-7707-bf98240d0000 pid=3364 /usr/bin/rm delete-file guuid=e6a4bb9e-1600-0000-7707-bf98c40c0000 pid=3268->guuid=7f52d8bb-1600-0000-7707-bf98240d0000 pid=3364 execve guuid=69d118bc-1600-0000-7707-bf98260d0000 pid=3366 /usr/bin/rm guuid=e6a4bb9e-1600-0000-7707-bf98c40c0000 pid=3268->guuid=69d118bc-1600-0000-7707-bf98260d0000 pid=3366 execve guuid=a5d759bc-1600-0000-7707-bf98280d0000 pid=3368 /usr/bin/wget net send-data guuid=e6a4bb9e-1600-0000-7707-bf98c40c0000 pid=3268->guuid=a5d759bc-1600-0000-7707-bf98280d0000 pid=3368 execve guuid=28cfd1be-1600-0000-7707-bf98320d0000 pid=3378 /usr/bin/curl net send-data write-file guuid=e6a4bb9e-1600-0000-7707-bf98c40c0000 pid=3268->guuid=28cfd1be-1600-0000-7707-bf98320d0000 pid=3378 execve guuid=e85a11c2-1600-0000-7707-bf983b0d0000 pid=3387 /usr/bin/chmod guuid=e6a4bb9e-1600-0000-7707-bf98c40c0000 pid=3268->guuid=e85a11c2-1600-0000-7707-bf983b0d0000 pid=3387 execve guuid=58a85dc2-1600-0000-7707-bf983d0d0000 pid=3389 /usr/bin/bash guuid=e6a4bb9e-1600-0000-7707-bf98c40c0000 pid=3268->guuid=58a85dc2-1600-0000-7707-bf983d0d0000 pid=3389 clone guuid=5e0fc2c2-1600-0000-7707-bf98400d0000 pid=3392 /usr/bin/rm delete-file guuid=e6a4bb9e-1600-0000-7707-bf98c40c0000 pid=3268->guuid=5e0fc2c2-1600-0000-7707-bf98400d0000 pid=3392 execve guuid=5f420fc3-1600-0000-7707-bf98430d0000 pid=3395 /usr/bin/rm guuid=e6a4bb9e-1600-0000-7707-bf98c40c0000 pid=3268->guuid=5f420fc3-1600-0000-7707-bf98430d0000 pid=3395 execve guuid=af0e5ec3-1600-0000-7707-bf98460d0000 pid=3398 /usr/bin/wget net send-data guuid=e6a4bb9e-1600-0000-7707-bf98c40c0000 pid=3268->guuid=af0e5ec3-1600-0000-7707-bf98460d0000 pid=3398 execve guuid=a5f311c8-1600-0000-7707-bf98470d0000 pid=3399 /usr/bin/curl net send-data write-file guuid=e6a4bb9e-1600-0000-7707-bf98c40c0000 pid=3268->guuid=a5f311c8-1600-0000-7707-bf98470d0000 pid=3399 execve guuid=fbbc1cce-1600-0000-7707-bf98560d0000 pid=3414 /usr/bin/chmod guuid=e6a4bb9e-1600-0000-7707-bf98c40c0000 pid=3268->guuid=fbbc1cce-1600-0000-7707-bf98560d0000 pid=3414 execve guuid=3bc569ce-1600-0000-7707-bf98570d0000 pid=3415 /usr/bin/bash guuid=e6a4bb9e-1600-0000-7707-bf98c40c0000 pid=3268->guuid=3bc569ce-1600-0000-7707-bf98570d0000 pid=3415 clone guuid=6dfdc8ce-1600-0000-7707-bf98590d0000 pid=3417 /usr/bin/rm delete-file guuid=e6a4bb9e-1600-0000-7707-bf98c40c0000 pid=3268->guuid=6dfdc8ce-1600-0000-7707-bf98590d0000 pid=3417 execve guuid=074028cf-1600-0000-7707-bf985a0d0000 pid=3418 /usr/bin/rm guuid=e6a4bb9e-1600-0000-7707-bf98c40c0000 pid=3268->guuid=074028cf-1600-0000-7707-bf985a0d0000 pid=3418 execve guuid=12f873cf-1600-0000-7707-bf985b0d0000 pid=3419 /usr/bin/wget net send-data guuid=e6a4bb9e-1600-0000-7707-bf98c40c0000 pid=3268->guuid=12f873cf-1600-0000-7707-bf985b0d0000 pid=3419 execve guuid=cc8d02d2-1600-0000-7707-bf98620d0000 pid=3426 /usr/bin/curl net send-data write-file guuid=e6a4bb9e-1600-0000-7707-bf98c40c0000 pid=3268->guuid=cc8d02d2-1600-0000-7707-bf98620d0000 pid=3426 execve guuid=2e3228d5-1600-0000-7707-bf986e0d0000 pid=3438 /usr/bin/chmod guuid=e6a4bb9e-1600-0000-7707-bf98c40c0000 pid=3268->guuid=2e3228d5-1600-0000-7707-bf986e0d0000 pid=3438 execve guuid=a2f76cd5-1600-0000-7707-bf98700d0000 pid=3440 /usr/bin/bash guuid=e6a4bb9e-1600-0000-7707-bf98c40c0000 pid=3268->guuid=a2f76cd5-1600-0000-7707-bf98700d0000 pid=3440 clone guuid=8299a8d5-1600-0000-7707-bf98730d0000 pid=3443 /usr/bin/rm delete-file guuid=e6a4bb9e-1600-0000-7707-bf98c40c0000 pid=3268->guuid=8299a8d5-1600-0000-7707-bf98730d0000 pid=3443 execve guuid=f3c6f6d5-1600-0000-7707-bf98750d0000 pid=3445 /usr/bin/rm guuid=e6a4bb9e-1600-0000-7707-bf98c40c0000 pid=3268->guuid=f3c6f6d5-1600-0000-7707-bf98750d0000 pid=3445 execve guuid=21803bd6-1600-0000-7707-bf98770d0000 pid=3447 /usr/bin/wget net send-data guuid=e6a4bb9e-1600-0000-7707-bf98c40c0000 pid=3268->guuid=21803bd6-1600-0000-7707-bf98770d0000 pid=3447 execve guuid=8cd618d9-1600-0000-7707-bf987b0d0000 pid=3451 /usr/bin/curl net send-data write-file guuid=e6a4bb9e-1600-0000-7707-bf98c40c0000 pid=3268->guuid=8cd618d9-1600-0000-7707-bf987b0d0000 pid=3451 execve guuid=5e8005e0-1600-0000-7707-bf98910d0000 pid=3473 /usr/bin/chmod guuid=e6a4bb9e-1600-0000-7707-bf98c40c0000 pid=3268->guuid=5e8005e0-1600-0000-7707-bf98910d0000 pid=3473 execve guuid=ad3b7ae0-1600-0000-7707-bf98940d0000 pid=3476 /usr/bin/bash guuid=e6a4bb9e-1600-0000-7707-bf98c40c0000 pid=3268->guuid=ad3b7ae0-1600-0000-7707-bf98940d0000 pid=3476 clone guuid=0fb1dde0-1600-0000-7707-bf98980d0000 pid=3480 /usr/bin/rm delete-file guuid=e6a4bb9e-1600-0000-7707-bf98c40c0000 pid=3268->guuid=0fb1dde0-1600-0000-7707-bf98980d0000 pid=3480 execve guuid=872847e1-1600-0000-7707-bf989b0d0000 pid=3483 /usr/bin/rm guuid=e6a4bb9e-1600-0000-7707-bf98c40c0000 pid=3268->guuid=872847e1-1600-0000-7707-bf989b0d0000 pid=3483 execve guuid=11ebace1-1600-0000-7707-bf989e0d0000 pid=3486 /usr/bin/wget net send-data guuid=e6a4bb9e-1600-0000-7707-bf98c40c0000 pid=3268->guuid=11ebace1-1600-0000-7707-bf989e0d0000 pid=3486 execve guuid=25670ee5-1600-0000-7707-bf98a80d0000 pid=3496 /usr/bin/curl net send-data write-file guuid=e6a4bb9e-1600-0000-7707-bf98c40c0000 pid=3268->guuid=25670ee5-1600-0000-7707-bf98a80d0000 pid=3496 execve guuid=8f0378e9-1600-0000-7707-bf98b10d0000 pid=3505 /usr/bin/chmod guuid=e6a4bb9e-1600-0000-7707-bf98c40c0000 pid=3268->guuid=8f0378e9-1600-0000-7707-bf98b10d0000 pid=3505 execve guuid=fcd8b4e9-1600-0000-7707-bf98b30d0000 pid=3507 /usr/bin/bash guuid=e6a4bb9e-1600-0000-7707-bf98c40c0000 pid=3268->guuid=fcd8b4e9-1600-0000-7707-bf98b30d0000 pid=3507 clone guuid=9a36e7e9-1600-0000-7707-bf98b50d0000 pid=3509 /usr/bin/rm delete-file guuid=e6a4bb9e-1600-0000-7707-bf98c40c0000 pid=3268->guuid=9a36e7e9-1600-0000-7707-bf98b50d0000 pid=3509 execve guuid=3db124ea-1600-0000-7707-bf98b70d0000 pid=3511 /usr/bin/rm guuid=e6a4bb9e-1600-0000-7707-bf98c40c0000 pid=3268->guuid=3db124ea-1600-0000-7707-bf98b70d0000 pid=3511 execve guuid=6aa65fea-1600-0000-7707-bf98b90d0000 pid=3513 /usr/bin/wget net send-data guuid=e6a4bb9e-1600-0000-7707-bf98c40c0000 pid=3268->guuid=6aa65fea-1600-0000-7707-bf98b90d0000 pid=3513 execve guuid=4a88f6ec-1600-0000-7707-bf98c30d0000 pid=3523 /usr/bin/curl net send-data write-file guuid=e6a4bb9e-1600-0000-7707-bf98c40c0000 pid=3268->guuid=4a88f6ec-1600-0000-7707-bf98c30d0000 pid=3523 execve guuid=76e3b0f0-1600-0000-7707-bf98cf0d0000 pid=3535 /usr/bin/chmod guuid=e6a4bb9e-1600-0000-7707-bf98c40c0000 pid=3268->guuid=76e3b0f0-1600-0000-7707-bf98cf0d0000 pid=3535 execve guuid=ab7deff0-1600-0000-7707-bf98d00d0000 pid=3536 /usr/bin/bash guuid=e6a4bb9e-1600-0000-7707-bf98c40c0000 pid=3268->guuid=ab7deff0-1600-0000-7707-bf98d00d0000 pid=3536 clone guuid=984020f1-1600-0000-7707-bf98d20d0000 pid=3538 /usr/bin/rm delete-file guuid=e6a4bb9e-1600-0000-7707-bf98c40c0000 pid=3268->guuid=984020f1-1600-0000-7707-bf98d20d0000 pid=3538 execve guuid=1bde74f1-1600-0000-7707-bf98d40d0000 pid=3540 /usr/bin/rm guuid=e6a4bb9e-1600-0000-7707-bf98c40c0000 pid=3268->guuid=1bde74f1-1600-0000-7707-bf98d40d0000 pid=3540 execve guuid=f004adf1-1600-0000-7707-bf98d50d0000 pid=3541 /usr/bin/wget net send-data guuid=e6a4bb9e-1600-0000-7707-bf98c40c0000 pid=3268->guuid=f004adf1-1600-0000-7707-bf98d50d0000 pid=3541 execve guuid=5ace1bf4-1600-0000-7707-bf98dd0d0000 pid=3549 /usr/bin/curl net send-data write-file guuid=e6a4bb9e-1600-0000-7707-bf98c40c0000 pid=3268->guuid=5ace1bf4-1600-0000-7707-bf98dd0d0000 pid=3549 execve guuid=5608c0f8-1600-0000-7707-bf98ee0d0000 pid=3566 /usr/bin/chmod guuid=e6a4bb9e-1600-0000-7707-bf98c40c0000 pid=3268->guuid=5608c0f8-1600-0000-7707-bf98ee0d0000 pid=3566 execve guuid=ca2e34f9-1600-0000-7707-bf98ef0d0000 pid=3567 /usr/bin/bash guuid=e6a4bb9e-1600-0000-7707-bf98c40c0000 pid=3268->guuid=ca2e34f9-1600-0000-7707-bf98ef0d0000 pid=3567 clone guuid=8a2a64f9-1600-0000-7707-bf98f40d0000 pid=3572 /usr/bin/rm delete-file guuid=e6a4bb9e-1600-0000-7707-bf98c40c0000 pid=3268->guuid=8a2a64f9-1600-0000-7707-bf98f40d0000 pid=3572 execve guuid=4a53a7f9-1600-0000-7707-bf98f50d0000 pid=3573 /usr/bin/rm guuid=e6a4bb9e-1600-0000-7707-bf98c40c0000 pid=3268->guuid=4a53a7f9-1600-0000-7707-bf98f50d0000 pid=3573 execve guuid=6905f6f9-1600-0000-7707-bf98f70d0000 pid=3575 /usr/bin/wget net send-data guuid=e6a4bb9e-1600-0000-7707-bf98c40c0000 pid=3268->guuid=6905f6f9-1600-0000-7707-bf98f70d0000 pid=3575 execve guuid=2d7f7bfc-1600-0000-7707-bf98020e0000 pid=3586 /usr/bin/curl net send-data write-file guuid=e6a4bb9e-1600-0000-7707-bf98c40c0000 pid=3268->guuid=2d7f7bfc-1600-0000-7707-bf98020e0000 pid=3586 execve guuid=d7b27804-1700-0000-7707-bf98140e0000 pid=3604 /usr/bin/chmod guuid=e6a4bb9e-1600-0000-7707-bf98c40c0000 pid=3268->guuid=d7b27804-1700-0000-7707-bf98140e0000 pid=3604 execve guuid=78d81605-1700-0000-7707-bf98190e0000 pid=3609 /usr/bin/bash guuid=e6a4bb9e-1600-0000-7707-bf98c40c0000 pid=3268->guuid=78d81605-1700-0000-7707-bf98190e0000 pid=3609 clone guuid=0e297e05-1700-0000-7707-bf981c0e0000 pid=3612 /usr/bin/rm delete-file guuid=e6a4bb9e-1600-0000-7707-bf98c40c0000 pid=3268->guuid=0e297e05-1700-0000-7707-bf981c0e0000 pid=3612 execve guuid=639fe705-1700-0000-7707-bf981f0e0000 pid=3615 /usr/bin/rm guuid=e6a4bb9e-1600-0000-7707-bf98c40c0000 pid=3268->guuid=639fe705-1700-0000-7707-bf981f0e0000 pid=3615 execve guuid=e3f43d06-1700-0000-7707-bf98210e0000 pid=3617 /usr/bin/wget net send-data guuid=e6a4bb9e-1600-0000-7707-bf98c40c0000 pid=3268->guuid=e3f43d06-1700-0000-7707-bf98210e0000 pid=3617 execve guuid=8fa97309-1700-0000-7707-bf98230e0000 pid=3619 /usr/bin/curl net send-data write-file guuid=e6a4bb9e-1600-0000-7707-bf98c40c0000 pid=3268->guuid=8fa97309-1700-0000-7707-bf98230e0000 pid=3619 execve guuid=deaf7d11-1700-0000-7707-bf98300e0000 pid=3632 /usr/bin/chmod guuid=e6a4bb9e-1600-0000-7707-bf98c40c0000 pid=3268->guuid=deaf7d11-1700-0000-7707-bf98300e0000 pid=3632 execve guuid=c1323213-1700-0000-7707-bf98340e0000 pid=3636 /usr/bin/bash guuid=e6a4bb9e-1600-0000-7707-bf98c40c0000 pid=3268->guuid=c1323213-1700-0000-7707-bf98340e0000 pid=3636 clone guuid=23cb8713-1700-0000-7707-bf98370e0000 pid=3639 /usr/bin/rm delete-file guuid=e6a4bb9e-1600-0000-7707-bf98c40c0000 pid=3268->guuid=23cb8713-1700-0000-7707-bf98370e0000 pid=3639 execve guuid=c12cda13-1700-0000-7707-bf983a0e0000 pid=3642 /usr/bin/rm guuid=e6a4bb9e-1600-0000-7707-bf98c40c0000 pid=3268->guuid=c12cda13-1700-0000-7707-bf983a0e0000 pid=3642 execve 5b654972-c9e1-50d8-b372-2dc2a5b9ad66 5.182.210.174:80 guuid=ea01139f-1600-0000-7707-bf98c60c0000 pid=3270->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=d56a8da2-1600-0000-7707-bf98ce0c0000 pid=3278->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=2e9b8baa-1600-0000-7707-bf98e40c0000 pid=3300 /usr/bin/bash guuid=d66277aa-1600-0000-7707-bf98e20c0000 pid=3298->guuid=2e9b8baa-1600-0000-7707-bf98e40c0000 pid=3300 clone guuid=731a37ab-1600-0000-7707-bf98e80c0000 pid=3304->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=6ea4c6ad-1600-0000-7707-bf98ee0c0000 pid=3310->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=8f02f3b2-1600-0000-7707-bf98fd0c0000 pid=3325 /usr/bin/bash guuid=a9b4c3b2-1600-0000-7707-bf98fb0c0000 pid=3323->guuid=8f02f3b2-1600-0000-7707-bf98fd0c0000 pid=3325 clone guuid=86a251b4-1600-0000-7707-bf98050d0000 pid=3333->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=c4b7c4b7-1600-0000-7707-bf98100d0000 pid=3344->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=d861b5bb-1600-0000-7707-bf98230d0000 pid=3363 /usr/bin/bash guuid=737b9ebb-1600-0000-7707-bf98210d0000 pid=3361->guuid=d861b5bb-1600-0000-7707-bf98230d0000 pid=3363 clone guuid=a5d759bc-1600-0000-7707-bf98280d0000 pid=3368->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=28cfd1be-1600-0000-7707-bf98320d0000 pid=3378->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=d64c78c2-1600-0000-7707-bf983e0d0000 pid=3390 /usr/bin/bash guuid=58a85dc2-1600-0000-7707-bf983d0d0000 pid=3389->guuid=d64c78c2-1600-0000-7707-bf983e0d0000 pid=3390 clone guuid=af0e5ec3-1600-0000-7707-bf98460d0000 pid=3398->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=a5f311c8-1600-0000-7707-bf98470d0000 pid=3399->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=4eb689ce-1600-0000-7707-bf98580d0000 pid=3416 /usr/bin/bash guuid=3bc569ce-1600-0000-7707-bf98570d0000 pid=3415->guuid=4eb689ce-1600-0000-7707-bf98580d0000 pid=3416 clone guuid=12f873cf-1600-0000-7707-bf985b0d0000 pid=3419->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=cc8d02d2-1600-0000-7707-bf98620d0000 pid=3426->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=332c84d5-1600-0000-7707-bf98710d0000 pid=3441 /usr/bin/bash guuid=a2f76cd5-1600-0000-7707-bf98700d0000 pid=3440->guuid=332c84d5-1600-0000-7707-bf98710d0000 pid=3441 clone guuid=21803bd6-1600-0000-7707-bf98770d0000 pid=3447->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=8cd618d9-1600-0000-7707-bf987b0d0000 pid=3451->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=e51caee0-1600-0000-7707-bf98960d0000 pid=3478 /usr/bin/bash guuid=ad3b7ae0-1600-0000-7707-bf98940d0000 pid=3476->guuid=e51caee0-1600-0000-7707-bf98960d0000 pid=3478 clone guuid=11ebace1-1600-0000-7707-bf989e0d0000 pid=3486->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=25670ee5-1600-0000-7707-bf98a80d0000 pid=3496->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=d43fc8e9-1600-0000-7707-bf98b40d0000 pid=3508 /usr/bin/bash guuid=fcd8b4e9-1600-0000-7707-bf98b30d0000 pid=3507->guuid=d43fc8e9-1600-0000-7707-bf98b40d0000 pid=3508 clone guuid=6aa65fea-1600-0000-7707-bf98b90d0000 pid=3513->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=4a88f6ec-1600-0000-7707-bf98c30d0000 pid=3523->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=023e05f1-1600-0000-7707-bf98d10d0000 pid=3537 /usr/bin/bash guuid=ab7deff0-1600-0000-7707-bf98d00d0000 pid=3536->guuid=023e05f1-1600-0000-7707-bf98d10d0000 pid=3537 clone guuid=f004adf1-1600-0000-7707-bf98d50d0000 pid=3541->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=5ace1bf4-1600-0000-7707-bf98dd0d0000 pid=3549->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=5ed04cf9-1600-0000-7707-bf98f10d0000 pid=3569 /usr/bin/bash guuid=ca2e34f9-1600-0000-7707-bf98ef0d0000 pid=3567->guuid=5ed04cf9-1600-0000-7707-bf98f10d0000 pid=3569 clone guuid=6905f6f9-1600-0000-7707-bf98f70d0000 pid=3575->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=2d7f7bfc-1600-0000-7707-bf98020e0000 pid=3586->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=fc363a05-1700-0000-7707-bf981a0e0000 pid=3610 /usr/bin/bash guuid=78d81605-1700-0000-7707-bf98190e0000 pid=3609->guuid=fc363a05-1700-0000-7707-bf981a0e0000 pid=3610 clone guuid=e3f43d06-1700-0000-7707-bf98210e0000 pid=3617->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=8fa97309-1700-0000-7707-bf98230e0000 pid=3619->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=61145f13-1700-0000-7707-bf98350e0000 pid=3637 /usr/bin/bash guuid=c1323213-1700-0000-7707-bf98340e0000 pid=3636->guuid=61145f13-1700-0000-7707-bf98350e0000 pid=3637 clone
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/f98cee80c0311a98be9dc30e38f5bd228dfb2765b942f8a07fed04204187e8d3
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f98cee80c0311a98be9dc30e38f5bd228dfb2765b942f8a07fed04204187e8d3/
Gathering data
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7ggo5agagenjrpu5ymhdr5n5ekg7wj3fxfbprid75uccaqmh5djq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260809-k6vwzaxzhz/
Behaviour
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.11
Link:
https://yomi.yoroi.company/submissions/f98cee80c0311a98be9dc30e38f5bd228dfb2765b942f8a07fed04204187e8d3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh f98cee80c0311a98be9dc30e38f5bd228dfb2765b942f8a07fed04204187e8d3

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3897671/
  
Delivery method
Distributed via web download

Comments