MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fd2a804f1550f5a4d1ffebe0626e8beac6e4c8f36e89eaa2061a57f2c128578e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fd2a804f1550f5a4d1ffebe0626e8beac6e4c8f36e89eaa2061a57f2c128578e
SHA3-384 hash: 2368eac84fb0e24575ddfa90571be03e9969c18c0f7bd9a7dc95c527847734786182814fc19686010eaa250fd6438938
SHA1 hash: be08b2e9e0fae9fdc233f1a3c331dedb6c11a9ec
MD5 hash: aaf312760141c6a205eb4880086cd811
humanhash: aspen-fix-queen-michigan
File name:ok
Download: download sample
File size:1'608 bytes
First seen:2026-08-23 21:16:52 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 12:Ut6WV7WDd76TZDFVlE6Cjlpp7DYNi6YNCRkSaGJ67QL6Q3y2Jf/I6J7GK6yL4X7m:wV7WeDPIjl3ENONCRgON8sP4vkD
TLSH T1963141DE05101A721153CE8F77A6364C669DE1E728ABDBD8D85C4F99838838CB261B4D
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://5.182.210.174/88c40an/an/aua-wget
http://5.182.210.174/c17f7fn/an/aua-wget
http://5.182.210.174/fd0af6n/an/aua-wget
http://5.182.210.174/87e848n/an/aua-wget
http://5.182.210.174/7616ccn/an/aua-wget
http://5.182.210.174/80de26n/an/aua-wget
http://5.182.210.174/7bd475n/an/aua-wget
http://5.182.210.174/01d9dan/an/aua-wget
http://5.182.210.174/0f8788n/an/aua-wget
http://5.182.210.174/cb4d97n/an/aua-wget
http://5.182.210.174/d799dan/an/aua-wget
http://5.182.210.174/6d91a8n/an/aua-wget

Intelligence

File Origin
# of uploads :
1
# of downloads :
37
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive mirai
Link:
https://www.filescan.io/uploads/6a8b635a2d6b05c3fb4289f6/reports/be22629b-ad90-4250-9765-4f79cfe46689/overview
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/a2620819-768b-437b-a2e6-2099a7adeda7
Behavior Graph:
Download SVG
%3 guuid=b3a8dfb6-1600-0000-fe2f-7cc1ab060000 pid=1707 /usr/bin/sudo guuid=62757cb9-1600-0000-fe2f-7cc1ac060000 pid=1708 /tmp/sample.bin guuid=b3a8dfb6-1600-0000-fe2f-7cc1ab060000 pid=1707->guuid=62757cb9-1600-0000-fe2f-7cc1ac060000 pid=1708 execve guuid=0d32e0b9-1600-0000-fe2f-7cc1ad060000 pid=1709 /usr/bin/wget net send-data guuid=62757cb9-1600-0000-fe2f-7cc1ac060000 pid=1708->guuid=0d32e0b9-1600-0000-fe2f-7cc1ad060000 pid=1709 execve guuid=130426fd-1600-0000-fe2f-7cc1ba060000 pid=1722 /usr/bin/curl net send-data write-file guuid=62757cb9-1600-0000-fe2f-7cc1ac060000 pid=1708->guuid=130426fd-1600-0000-fe2f-7cc1ba060000 pid=1722 execve guuid=0fb30905-1700-0000-fe2f-7cc1c6060000 pid=1734 /usr/bin/chmod guuid=62757cb9-1600-0000-fe2f-7cc1ac060000 pid=1708->guuid=0fb30905-1700-0000-fe2f-7cc1c6060000 pid=1734 execve guuid=8798a005-1700-0000-fe2f-7cc1c8060000 pid=1736 /usr/bin/bash guuid=62757cb9-1600-0000-fe2f-7cc1ac060000 pid=1708->guuid=8798a005-1700-0000-fe2f-7cc1c8060000 pid=1736 clone guuid=a0cf1606-1700-0000-fe2f-7cc1cc060000 pid=1740 /usr/bin/rm delete-file guuid=62757cb9-1600-0000-fe2f-7cc1ac060000 pid=1708->guuid=a0cf1606-1700-0000-fe2f-7cc1cc060000 pid=1740 execve guuid=95477406-1700-0000-fe2f-7cc1ce060000 pid=1742 /usr/bin/rm guuid=62757cb9-1600-0000-fe2f-7cc1ac060000 pid=1708->guuid=95477406-1700-0000-fe2f-7cc1ce060000 pid=1742 execve guuid=5e22cc06-1700-0000-fe2f-7cc1cf060000 pid=1743 /usr/bin/wget net send-data guuid=62757cb9-1600-0000-fe2f-7cc1ac060000 pid=1708->guuid=5e22cc06-1700-0000-fe2f-7cc1cf060000 pid=1743 execve guuid=ff08be09-1700-0000-fe2f-7cc1d6060000 pid=1750 /usr/bin/curl net send-data write-file guuid=62757cb9-1600-0000-fe2f-7cc1ac060000 pid=1708->guuid=ff08be09-1700-0000-fe2f-7cc1d6060000 pid=1750 execve guuid=8c1d6f0e-1700-0000-fe2f-7cc1e0060000 pid=1760 /usr/bin/chmod guuid=62757cb9-1600-0000-fe2f-7cc1ac060000 pid=1708->guuid=8c1d6f0e-1700-0000-fe2f-7cc1e0060000 pid=1760 execve guuid=b2e0ca0e-1700-0000-fe2f-7cc1e1060000 pid=1761 /usr/bin/bash guuid=62757cb9-1600-0000-fe2f-7cc1ac060000 pid=1708->guuid=b2e0ca0e-1700-0000-fe2f-7cc1e1060000 pid=1761 clone guuid=47c71e0f-1700-0000-fe2f-7cc1e4060000 pid=1764 /usr/bin/rm delete-file guuid=62757cb9-1600-0000-fe2f-7cc1ac060000 pid=1708->guuid=47c71e0f-1700-0000-fe2f-7cc1e4060000 pid=1764 execve guuid=2f84780f-1700-0000-fe2f-7cc1e6060000 pid=1766 /usr/bin/rm guuid=62757cb9-1600-0000-fe2f-7cc1ac060000 pid=1708->guuid=2f84780f-1700-0000-fe2f-7cc1e6060000 pid=1766 execve guuid=c705c90f-1700-0000-fe2f-7cc1e7060000 pid=1767 /usr/bin/wget net send-data guuid=62757cb9-1600-0000-fe2f-7cc1ac060000 pid=1708->guuid=c705c90f-1700-0000-fe2f-7cc1e7060000 pid=1767 execve guuid=8dc0cc12-1700-0000-fe2f-7cc1ee060000 pid=1774 /usr/bin/curl net send-data write-file guuid=62757cb9-1600-0000-fe2f-7cc1ac060000 pid=1708->guuid=8dc0cc12-1700-0000-fe2f-7cc1ee060000 pid=1774 execve guuid=21c3b118-1700-0000-fe2f-7cc1f8060000 pid=1784 /usr/bin/chmod guuid=62757cb9-1600-0000-fe2f-7cc1ac060000 pid=1708->guuid=21c3b118-1700-0000-fe2f-7cc1f8060000 pid=1784 execve guuid=77d74b19-1700-0000-fe2f-7cc1fb060000 pid=1787 /usr/bin/bash guuid=62757cb9-1600-0000-fe2f-7cc1ac060000 pid=1708->guuid=77d74b19-1700-0000-fe2f-7cc1fb060000 pid=1787 clone guuid=d697b919-1700-0000-fe2f-7cc1fe060000 pid=1790 /usr/bin/rm delete-file guuid=62757cb9-1600-0000-fe2f-7cc1ac060000 pid=1708->guuid=d697b919-1700-0000-fe2f-7cc1fe060000 pid=1790 execve guuid=4bfc4e1a-1700-0000-fe2f-7cc101070000 pid=1793 /usr/bin/rm guuid=62757cb9-1600-0000-fe2f-7cc1ac060000 pid=1708->guuid=4bfc4e1a-1700-0000-fe2f-7cc101070000 pid=1793 execve guuid=324fda1a-1700-0000-fe2f-7cc103070000 pid=1795 /usr/bin/wget net send-data guuid=62757cb9-1600-0000-fe2f-7cc1ac060000 pid=1708->guuid=324fda1a-1700-0000-fe2f-7cc103070000 pid=1795 execve guuid=c343971e-1700-0000-fe2f-7cc10b070000 pid=1803 /usr/bin/curl net send-data write-file guuid=62757cb9-1600-0000-fe2f-7cc1ac060000 pid=1708->guuid=c343971e-1700-0000-fe2f-7cc10b070000 pid=1803 execve guuid=76b84523-1700-0000-fe2f-7cc113070000 pid=1811 /usr/bin/chmod guuid=62757cb9-1600-0000-fe2f-7cc1ac060000 pid=1708->guuid=76b84523-1700-0000-fe2f-7cc113070000 pid=1811 execve guuid=9ef3d023-1700-0000-fe2f-7cc115070000 pid=1813 /usr/bin/bash guuid=62757cb9-1600-0000-fe2f-7cc1ac060000 pid=1708->guuid=9ef3d023-1700-0000-fe2f-7cc115070000 pid=1813 clone guuid=9cf81624-1700-0000-fe2f-7cc118070000 pid=1816 /usr/bin/rm delete-file guuid=62757cb9-1600-0000-fe2f-7cc1ac060000 pid=1708->guuid=9cf81624-1700-0000-fe2f-7cc118070000 pid=1816 execve guuid=26ad6224-1700-0000-fe2f-7cc119070000 pid=1817 /usr/bin/rm guuid=62757cb9-1600-0000-fe2f-7cc1ac060000 pid=1708->guuid=26ad6224-1700-0000-fe2f-7cc119070000 pid=1817 execve guuid=378ccf24-1700-0000-fe2f-7cc11c070000 pid=1820 /usr/bin/wget net send-data guuid=62757cb9-1600-0000-fe2f-7cc1ac060000 pid=1708->guuid=378ccf24-1700-0000-fe2f-7cc11c070000 pid=1820 execve guuid=144c4d27-1700-0000-fe2f-7cc124070000 pid=1828 /usr/bin/curl net send-data write-file guuid=62757cb9-1600-0000-fe2f-7cc1ac060000 pid=1708->guuid=144c4d27-1700-0000-fe2f-7cc124070000 pid=1828 execve guuid=78ee092b-1700-0000-fe2f-7cc12e070000 pid=1838 /usr/bin/chmod guuid=62757cb9-1600-0000-fe2f-7cc1ac060000 pid=1708->guuid=78ee092b-1700-0000-fe2f-7cc12e070000 pid=1838 execve guuid=5d87502b-1700-0000-fe2f-7cc12f070000 pid=1839 /usr/bin/bash guuid=62757cb9-1600-0000-fe2f-7cc1ac060000 pid=1708->guuid=5d87502b-1700-0000-fe2f-7cc12f070000 pid=1839 clone guuid=385b8f2b-1700-0000-fe2f-7cc131070000 pid=1841 /usr/bin/rm delete-file guuid=62757cb9-1600-0000-fe2f-7cc1ac060000 pid=1708->guuid=385b8f2b-1700-0000-fe2f-7cc131070000 pid=1841 execve guuid=d6c4e02b-1700-0000-fe2f-7cc133070000 pid=1843 /usr/bin/rm guuid=62757cb9-1600-0000-fe2f-7cc1ac060000 pid=1708->guuid=d6c4e02b-1700-0000-fe2f-7cc133070000 pid=1843 execve guuid=ab5d282c-1700-0000-fe2f-7cc134070000 pid=1844 /usr/bin/wget net send-data guuid=62757cb9-1600-0000-fe2f-7cc1ac060000 pid=1708->guuid=ab5d282c-1700-0000-fe2f-7cc134070000 pid=1844 execve guuid=36f3b22e-1700-0000-fe2f-7cc13b070000 pid=1851 /usr/bin/curl net send-data write-file guuid=62757cb9-1600-0000-fe2f-7cc1ac060000 pid=1708->guuid=36f3b22e-1700-0000-fe2f-7cc13b070000 pid=1851 execve guuid=fcb47732-1700-0000-fe2f-7cc145070000 pid=1861 /usr/bin/chmod guuid=62757cb9-1600-0000-fe2f-7cc1ac060000 pid=1708->guuid=fcb47732-1700-0000-fe2f-7cc145070000 pid=1861 execve guuid=e346b432-1700-0000-fe2f-7cc146070000 pid=1862 /usr/bin/bash guuid=62757cb9-1600-0000-fe2f-7cc1ac060000 pid=1708->guuid=e346b432-1700-0000-fe2f-7cc146070000 pid=1862 clone guuid=c87dff32-1700-0000-fe2f-7cc149070000 pid=1865 /usr/bin/rm delete-file guuid=62757cb9-1600-0000-fe2f-7cc1ac060000 pid=1708->guuid=c87dff32-1700-0000-fe2f-7cc149070000 pid=1865 execve guuid=f9ca6833-1700-0000-fe2f-7cc14a070000 pid=1866 /usr/bin/rm guuid=62757cb9-1600-0000-fe2f-7cc1ac060000 pid=1708->guuid=f9ca6833-1700-0000-fe2f-7cc14a070000 pid=1866 execve guuid=8eaecc33-1700-0000-fe2f-7cc14d070000 pid=1869 /usr/bin/wget net send-data guuid=62757cb9-1600-0000-fe2f-7cc1ac060000 pid=1708->guuid=8eaecc33-1700-0000-fe2f-7cc14d070000 pid=1869 execve guuid=b71ea236-1700-0000-fe2f-7cc156070000 pid=1878 /usr/bin/curl net send-data write-file guuid=62757cb9-1600-0000-fe2f-7cc1ac060000 pid=1708->guuid=b71ea236-1700-0000-fe2f-7cc156070000 pid=1878 execve guuid=bfa8c33a-1700-0000-fe2f-7cc160070000 pid=1888 /usr/bin/chmod guuid=62757cb9-1600-0000-fe2f-7cc1ac060000 pid=1708->guuid=bfa8c33a-1700-0000-fe2f-7cc160070000 pid=1888 execve guuid=3b62193b-1700-0000-fe2f-7cc162070000 pid=1890 /usr/bin/bash guuid=62757cb9-1600-0000-fe2f-7cc1ac060000 pid=1708->guuid=3b62193b-1700-0000-fe2f-7cc162070000 pid=1890 clone guuid=874b693b-1700-0000-fe2f-7cc164070000 pid=1892 /usr/bin/rm delete-file guuid=62757cb9-1600-0000-fe2f-7cc1ac060000 pid=1708->guuid=874b693b-1700-0000-fe2f-7cc164070000 pid=1892 execve guuid=6aaec13b-1700-0000-fe2f-7cc166070000 pid=1894 /usr/bin/rm guuid=62757cb9-1600-0000-fe2f-7cc1ac060000 pid=1708->guuid=6aaec13b-1700-0000-fe2f-7cc166070000 pid=1894 execve guuid=302c103c-1700-0000-fe2f-7cc168070000 pid=1896 /usr/bin/wget net send-data guuid=62757cb9-1600-0000-fe2f-7cc1ac060000 pid=1708->guuid=302c103c-1700-0000-fe2f-7cc168070000 pid=1896 execve guuid=e31c0a3f-1700-0000-fe2f-7cc16f070000 pid=1903 /usr/bin/curl net send-data write-file guuid=62757cb9-1600-0000-fe2f-7cc1ac060000 pid=1708->guuid=e31c0a3f-1700-0000-fe2f-7cc16f070000 pid=1903 execve guuid=5e7d9444-1700-0000-fe2f-7cc179070000 pid=1913 /usr/bin/chmod guuid=62757cb9-1600-0000-fe2f-7cc1ac060000 pid=1708->guuid=5e7d9444-1700-0000-fe2f-7cc179070000 pid=1913 execve guuid=1204ea44-1700-0000-fe2f-7cc17a070000 pid=1914 /usr/bin/bash guuid=62757cb9-1600-0000-fe2f-7cc1ac060000 pid=1708->guuid=1204ea44-1700-0000-fe2f-7cc17a070000 pid=1914 clone guuid=88e03445-1700-0000-fe2f-7cc17c070000 pid=1916 /usr/bin/rm delete-file guuid=62757cb9-1600-0000-fe2f-7cc1ac060000 pid=1708->guuid=88e03445-1700-0000-fe2f-7cc17c070000 pid=1916 execve guuid=c0178745-1700-0000-fe2f-7cc17d070000 pid=1917 /usr/bin/rm guuid=62757cb9-1600-0000-fe2f-7cc1ac060000 pid=1708->guuid=c0178745-1700-0000-fe2f-7cc17d070000 pid=1917 execve guuid=c4ace745-1700-0000-fe2f-7cc17f070000 pid=1919 /usr/bin/wget net send-data guuid=62757cb9-1600-0000-fe2f-7cc1ac060000 pid=1708->guuid=c4ace745-1700-0000-fe2f-7cc17f070000 pid=1919 execve guuid=8db49a49-1700-0000-fe2f-7cc187070000 pid=1927 /usr/bin/curl net send-data write-file guuid=62757cb9-1600-0000-fe2f-7cc1ac060000 pid=1708->guuid=8db49a49-1700-0000-fe2f-7cc187070000 pid=1927 execve guuid=094c024f-1700-0000-fe2f-7cc189070000 pid=1929 /usr/bin/chmod guuid=62757cb9-1600-0000-fe2f-7cc1ac060000 pid=1708->guuid=094c024f-1700-0000-fe2f-7cc189070000 pid=1929 execve guuid=38b48d4f-1700-0000-fe2f-7cc18a070000 pid=1930 /usr/bin/bash guuid=62757cb9-1600-0000-fe2f-7cc1ac060000 pid=1708->guuid=38b48d4f-1700-0000-fe2f-7cc18a070000 pid=1930 clone guuid=ff1efe4f-1700-0000-fe2f-7cc18c070000 pid=1932 /usr/bin/rm delete-file guuid=62757cb9-1600-0000-fe2f-7cc1ac060000 pid=1708->guuid=ff1efe4f-1700-0000-fe2f-7cc18c070000 pid=1932 execve guuid=7cad8e50-1700-0000-fe2f-7cc18d070000 pid=1933 /usr/bin/rm guuid=62757cb9-1600-0000-fe2f-7cc1ac060000 pid=1708->guuid=7cad8e50-1700-0000-fe2f-7cc18d070000 pid=1933 execve guuid=98ac1251-1700-0000-fe2f-7cc18e070000 pid=1934 /usr/bin/wget net send-data guuid=62757cb9-1600-0000-fe2f-7cc1ac060000 pid=1708->guuid=98ac1251-1700-0000-fe2f-7cc18e070000 pid=1934 execve guuid=b3449b54-1700-0000-fe2f-7cc192070000 pid=1938 /usr/bin/curl net send-data write-file guuid=62757cb9-1600-0000-fe2f-7cc1ac060000 pid=1708->guuid=b3449b54-1700-0000-fe2f-7cc192070000 pid=1938 execve guuid=6e2dbc59-1700-0000-fe2f-7cc198070000 pid=1944 /usr/bin/chmod guuid=62757cb9-1600-0000-fe2f-7cc1ac060000 pid=1708->guuid=6e2dbc59-1700-0000-fe2f-7cc198070000 pid=1944 execve guuid=a896385a-1700-0000-fe2f-7cc19a070000 pid=1946 /usr/bin/bash guuid=62757cb9-1600-0000-fe2f-7cc1ac060000 pid=1708->guuid=a896385a-1700-0000-fe2f-7cc19a070000 pid=1946 clone guuid=efa08d5a-1700-0000-fe2f-7cc19c070000 pid=1948 /usr/bin/rm delete-file guuid=62757cb9-1600-0000-fe2f-7cc1ac060000 pid=1708->guuid=efa08d5a-1700-0000-fe2f-7cc19c070000 pid=1948 execve guuid=4dfa035b-1700-0000-fe2f-7cc19e070000 pid=1950 /usr/bin/rm guuid=62757cb9-1600-0000-fe2f-7cc1ac060000 pid=1708->guuid=4dfa035b-1700-0000-fe2f-7cc19e070000 pid=1950 execve guuid=744ca85b-1700-0000-fe2f-7cc1a0070000 pid=1952 /usr/bin/wget net send-data guuid=62757cb9-1600-0000-fe2f-7cc1ac060000 pid=1708->guuid=744ca85b-1700-0000-fe2f-7cc1a0070000 pid=1952 execve guuid=3678d85e-1700-0000-fe2f-7cc1a6070000 pid=1958 /usr/bin/curl net send-data write-file guuid=62757cb9-1600-0000-fe2f-7cc1ac060000 pid=1708->guuid=3678d85e-1700-0000-fe2f-7cc1a6070000 pid=1958 execve guuid=b37bf364-1700-0000-fe2f-7cc1ad070000 pid=1965 /usr/bin/chmod guuid=62757cb9-1600-0000-fe2f-7cc1ac060000 pid=1708->guuid=b37bf364-1700-0000-fe2f-7cc1ad070000 pid=1965 execve guuid=fbbc6165-1700-0000-fe2f-7cc1af070000 pid=1967 /usr/bin/bash guuid=62757cb9-1600-0000-fe2f-7cc1ac060000 pid=1708->guuid=fbbc6165-1700-0000-fe2f-7cc1af070000 pid=1967 clone guuid=dbc6b865-1700-0000-fe2f-7cc1b2070000 pid=1970 /usr/bin/rm delete-file guuid=62757cb9-1600-0000-fe2f-7cc1ac060000 pid=1708->guuid=dbc6b865-1700-0000-fe2f-7cc1b2070000 pid=1970 execve guuid=f87f2666-1700-0000-fe2f-7cc1b4070000 pid=1972 /usr/bin/rm guuid=62757cb9-1600-0000-fe2f-7cc1ac060000 pid=1708->guuid=f87f2666-1700-0000-fe2f-7cc1b4070000 pid=1972 execve guuid=761c9366-1700-0000-fe2f-7cc1b6070000 pid=1974 /usr/bin/wget net send-data guuid=62757cb9-1600-0000-fe2f-7cc1ac060000 pid=1708->guuid=761c9366-1700-0000-fe2f-7cc1b6070000 pid=1974 execve guuid=97578469-1700-0000-fe2f-7cc1ba070000 pid=1978 /usr/bin/curl net send-data write-file guuid=62757cb9-1600-0000-fe2f-7cc1ac060000 pid=1708->guuid=97578469-1700-0000-fe2f-7cc1ba070000 pid=1978 execve guuid=97101b6e-1700-0000-fe2f-7cc1c2070000 pid=1986 /usr/bin/chmod guuid=62757cb9-1600-0000-fe2f-7cc1ac060000 pid=1708->guuid=97101b6e-1700-0000-fe2f-7cc1c2070000 pid=1986 execve guuid=b674b76e-1700-0000-fe2f-7cc1c4070000 pid=1988 /usr/bin/bash guuid=62757cb9-1600-0000-fe2f-7cc1ac060000 pid=1708->guuid=b674b76e-1700-0000-fe2f-7cc1c4070000 pid=1988 clone guuid=bca8fa6e-1700-0000-fe2f-7cc1c7070000 pid=1991 /usr/bin/rm delete-file guuid=62757cb9-1600-0000-fe2f-7cc1ac060000 pid=1708->guuid=bca8fa6e-1700-0000-fe2f-7cc1c7070000 pid=1991 execve guuid=8650756f-1700-0000-fe2f-7cc1c9070000 pid=1993 /usr/bin/rm guuid=62757cb9-1600-0000-fe2f-7cc1ac060000 pid=1708->guuid=8650756f-1700-0000-fe2f-7cc1c9070000 pid=1993 execve 5b654972-c9e1-50d8-b372-2dc2a5b9ad66 5.182.210.174:80 guuid=0d32e0b9-1600-0000-fe2f-7cc1ad060000 pid=1709->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=130426fd-1600-0000-fe2f-7cc1ba060000 pid=1722->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=b310d005-1700-0000-fe2f-7cc1ca060000 pid=1738 /usr/bin/bash guuid=8798a005-1700-0000-fe2f-7cc1c8060000 pid=1736->guuid=b310d005-1700-0000-fe2f-7cc1ca060000 pid=1738 clone guuid=5e22cc06-1700-0000-fe2f-7cc1cf060000 pid=1743->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=ff08be09-1700-0000-fe2f-7cc1d6060000 pid=1750->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=02c0ec0e-1700-0000-fe2f-7cc1e3060000 pid=1763 /usr/bin/bash guuid=b2e0ca0e-1700-0000-fe2f-7cc1e1060000 pid=1761->guuid=02c0ec0e-1700-0000-fe2f-7cc1e3060000 pid=1763 clone guuid=c705c90f-1700-0000-fe2f-7cc1e7060000 pid=1767->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=8dc0cc12-1700-0000-fe2f-7cc1ee060000 pid=1774->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=80cd7919-1700-0000-fe2f-7cc1fc060000 pid=1788 /usr/bin/bash guuid=77d74b19-1700-0000-fe2f-7cc1fb060000 pid=1787->guuid=80cd7919-1700-0000-fe2f-7cc1fc060000 pid=1788 clone guuid=324fda1a-1700-0000-fe2f-7cc103070000 pid=1795->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=c343971e-1700-0000-fe2f-7cc10b070000 pid=1803->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=7f25ec23-1700-0000-fe2f-7cc116070000 pid=1814 /usr/bin/bash guuid=9ef3d023-1700-0000-fe2f-7cc115070000 pid=1813->guuid=7f25ec23-1700-0000-fe2f-7cc116070000 pid=1814 clone guuid=378ccf24-1700-0000-fe2f-7cc11c070000 pid=1820->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=144c4d27-1700-0000-fe2f-7cc124070000 pid=1828->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=06216c2b-1700-0000-fe2f-7cc130070000 pid=1840 /usr/bin/bash guuid=5d87502b-1700-0000-fe2f-7cc12f070000 pid=1839->guuid=06216c2b-1700-0000-fe2f-7cc130070000 pid=1840 clone guuid=ab5d282c-1700-0000-fe2f-7cc134070000 pid=1844->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=36f3b22e-1700-0000-fe2f-7cc13b070000 pid=1851->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=9051cf32-1700-0000-fe2f-7cc147070000 pid=1863 /usr/bin/bash guuid=e346b432-1700-0000-fe2f-7cc146070000 pid=1862->guuid=9051cf32-1700-0000-fe2f-7cc147070000 pid=1863 clone guuid=8eaecc33-1700-0000-fe2f-7cc14d070000 pid=1869->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=b71ea236-1700-0000-fe2f-7cc156070000 pid=1878->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=823f373b-1700-0000-fe2f-7cc163070000 pid=1891 /usr/bin/bash guuid=3b62193b-1700-0000-fe2f-7cc162070000 pid=1890->guuid=823f373b-1700-0000-fe2f-7cc163070000 pid=1891 clone guuid=302c103c-1700-0000-fe2f-7cc168070000 pid=1896->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=e31c0a3f-1700-0000-fe2f-7cc16f070000 pid=1903->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=0fdc0745-1700-0000-fe2f-7cc17b070000 pid=1915 /usr/bin/bash guuid=1204ea44-1700-0000-fe2f-7cc17a070000 pid=1914->guuid=0fdc0745-1700-0000-fe2f-7cc17b070000 pid=1915 clone guuid=c4ace745-1700-0000-fe2f-7cc17f070000 pid=1919->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=8db49a49-1700-0000-fe2f-7cc187070000 pid=1927->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=3252c04f-1700-0000-fe2f-7cc18b070000 pid=1931 /usr/bin/bash guuid=38b48d4f-1700-0000-fe2f-7cc18a070000 pid=1930->guuid=3252c04f-1700-0000-fe2f-7cc18b070000 pid=1931 clone guuid=98ac1251-1700-0000-fe2f-7cc18e070000 pid=1934->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=b3449b54-1700-0000-fe2f-7cc192070000 pid=1938->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=b0805e5a-1700-0000-fe2f-7cc19b070000 pid=1947 /usr/bin/bash guuid=a896385a-1700-0000-fe2f-7cc19a070000 pid=1946->guuid=b0805e5a-1700-0000-fe2f-7cc19b070000 pid=1947 clone guuid=744ca85b-1700-0000-fe2f-7cc1a0070000 pid=1952->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=3678d85e-1700-0000-fe2f-7cc1a6070000 pid=1958->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=05c78365-1700-0000-fe2f-7cc1b1070000 pid=1969 /usr/bin/bash guuid=fbbc6165-1700-0000-fe2f-7cc1af070000 pid=1967->guuid=05c78365-1700-0000-fe2f-7cc1b1070000 pid=1969 clone guuid=761c9366-1700-0000-fe2f-7cc1b6070000 pid=1974->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=97578469-1700-0000-fe2f-7cc1ba070000 pid=1978->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=9c9cd26e-1700-0000-fe2f-7cc1c5070000 pid=1989 /usr/bin/bash guuid=b674b76e-1700-0000-fe2f-7cc1c4070000 pid=1988->guuid=9c9cd26e-1700-0000-fe2f-7cc1c5070000 pid=1989 clone
Score:
99%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/fd2a804f1550f5a4d1ffebe0626e8beac6e4c8f36e89eaa2061a57f2c128578e
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fd2a804f1550f5a4d1ffebe0626e8beac6e4c8f36e89eaa2061a57f2c128578e/
Threat name:
Linux.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-08-23 21:17:16 UTC
File Type:
Text (Shell)
AV detection:
13 of 24 (54.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7uviatyvkd22jup75pqge3ul5ldojshtn2e6viqgdjl7fqjik6ha._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260823-z5qyyszhnh/
Behaviour
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.11
Link:
https://yomi.yoroi.company/submissions/fd2a804f1550f5a4d1ffebe0626e8beac6e4c8f36e89eaa2061a57f2c128578e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh fd2a804f1550f5a4d1ffebe0626e8beac6e4c8f36e89eaa2061a57f2c128578e

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3897671/
  
Delivery method
Distributed via web download

Comments