MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fd2a8216e43edad7fa7e2ac6e7c1d2a52dd288f3ac242e525d74333c8c9c7c28. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fd2a8216e43edad7fa7e2ac6e7c1d2a52dd288f3ac242e525d74333c8c9c7c28
SHA3-384 hash: d16ea54b20efcecf5d5e24f80a0c6b19913a183736a498efa3002ab6d5e6c5d5f7a3368bdef0be405c17616130e70bdf
SHA1 hash: 1abbfb5f5030f143ac21e96b8f3ddd9af06bba17
MD5 hash: 519ee7a05ad5fb5a322c56a76fb67cf9
humanhash: mountain-echo-kentucky-illinois
File name:ok
Download: download sample
File size:1'608 bytes
First seen:2026-08-08 07:52:33 UTC
Last seen:2026-08-08 13:44:32 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 24:Gmd9Z1HYMXdTj1mXdZF8qNaoLVa31hhHp1tB8gHFGugyUX6A:GCsu4XdZbrVI1jJJ8glG9
TLSH T1CF311BDA50145E702002DE8E72B3354CB68EE6FB2C9FD7E48D480EED864979CF161B58
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://5.182.210.174/2419f5n/an/aua-wget
http://5.182.210.174/07aeddn/an/aua-wget
http://5.182.210.174/0c3474n/an/aua-wget
http://5.182.210.174/4a4b8bn/an/aua-wget
http://5.182.210.174/2c7a26n/an/aua-wget
http://5.182.210.174/d77667n/an/aua-wget
http://5.182.210.174/b63d70n/an/aua-wget
http://5.182.210.174/b136a3n/an/aua-wget
http://5.182.210.174/60689fn/an/aua-wget
http://5.182.210.174/155a79n/an/aua-wget
http://5.182.210.174/35c40cn/an/aua-wget
http://5.182.210.174/1a59ffn/an/aua-wget

Intelligence

File Origin
# of uploads :
2
# of downloads :
48
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive
Link:
https://www.filescan.io/uploads/6a76e078c747156d8caa762b/reports/6d4c2299-a656-4b88-9775-1aee9d31b1fc/overview
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/3d09d307-7a0d-4925-b8c6-890732936ada
Behavior Graph:
Download SVG
%3 guuid=8e1a24e1-1700-0000-f3cd-4dc02f0a0000 pid=2607 /usr/bin/sudo guuid=5d1b1de3-1700-0000-f3cd-4dc0350a0000 pid=2613 /tmp/sample.bin guuid=8e1a24e1-1700-0000-f3cd-4dc02f0a0000 pid=2607->guuid=5d1b1de3-1700-0000-f3cd-4dc0350a0000 pid=2613 execve guuid=19c1c4e3-1700-0000-f3cd-4dc0370a0000 pid=2615 /usr/bin/wget net send-data guuid=5d1b1de3-1700-0000-f3cd-4dc0350a0000 pid=2613->guuid=19c1c4e3-1700-0000-f3cd-4dc0370a0000 pid=2615 execve guuid=15429ce9-1700-0000-f3cd-4dc0440a0000 pid=2628 /usr/bin/curl net send-data write-file guuid=5d1b1de3-1700-0000-f3cd-4dc0350a0000 pid=2613->guuid=15429ce9-1700-0000-f3cd-4dc0440a0000 pid=2628 execve guuid=abd729f6-1700-0000-f3cd-4dc0540a0000 pid=2644 /usr/bin/chmod guuid=5d1b1de3-1700-0000-f3cd-4dc0350a0000 pid=2613->guuid=abd729f6-1700-0000-f3cd-4dc0540a0000 pid=2644 execve guuid=0a55a2f6-1700-0000-f3cd-4dc0550a0000 pid=2645 /usr/bin/bash guuid=5d1b1de3-1700-0000-f3cd-4dc0350a0000 pid=2613->guuid=0a55a2f6-1700-0000-f3cd-4dc0550a0000 pid=2645 clone guuid=aa5ceef6-1700-0000-f3cd-4dc0570a0000 pid=2647 /usr/bin/rm delete-file guuid=5d1b1de3-1700-0000-f3cd-4dc0350a0000 pid=2613->guuid=aa5ceef6-1700-0000-f3cd-4dc0570a0000 pid=2647 execve guuid=83774ef7-1700-0000-f3cd-4dc0580a0000 pid=2648 /usr/bin/rm guuid=5d1b1de3-1700-0000-f3cd-4dc0350a0000 pid=2613->guuid=83774ef7-1700-0000-f3cd-4dc0580a0000 pid=2648 execve guuid=d32ba5f7-1700-0000-f3cd-4dc0590a0000 pid=2649 /usr/bin/wget net send-data guuid=5d1b1de3-1700-0000-f3cd-4dc0350a0000 pid=2613->guuid=d32ba5f7-1700-0000-f3cd-4dc0590a0000 pid=2649 execve guuid=17c69afd-1700-0000-f3cd-4dc05c0a0000 pid=2652 /usr/bin/curl net send-data write-file guuid=5d1b1de3-1700-0000-f3cd-4dc0350a0000 pid=2613->guuid=17c69afd-1700-0000-f3cd-4dc05c0a0000 pid=2652 execve guuid=6230b302-1800-0000-f3cd-4dc0630a0000 pid=2659 /usr/bin/chmod guuid=5d1b1de3-1700-0000-f3cd-4dc0350a0000 pid=2613->guuid=6230b302-1800-0000-f3cd-4dc0630a0000 pid=2659 execve guuid=eabc1403-1800-0000-f3cd-4dc0660a0000 pid=2662 /usr/bin/bash guuid=5d1b1de3-1700-0000-f3cd-4dc0350a0000 pid=2613->guuid=eabc1403-1800-0000-f3cd-4dc0660a0000 pid=2662 clone guuid=5f784a03-1800-0000-f3cd-4dc0680a0000 pid=2664 /usr/bin/rm delete-file guuid=5d1b1de3-1700-0000-f3cd-4dc0350a0000 pid=2613->guuid=5f784a03-1800-0000-f3cd-4dc0680a0000 pid=2664 execve guuid=df178903-1800-0000-f3cd-4dc06a0a0000 pid=2666 /usr/bin/rm guuid=5d1b1de3-1700-0000-f3cd-4dc0350a0000 pid=2613->guuid=df178903-1800-0000-f3cd-4dc06a0a0000 pid=2666 execve guuid=7203c503-1800-0000-f3cd-4dc06b0a0000 pid=2667 /usr/bin/wget net send-data guuid=5d1b1de3-1700-0000-f3cd-4dc0350a0000 pid=2613->guuid=7203c503-1800-0000-f3cd-4dc06b0a0000 pid=2667 execve guuid=09d02906-1800-0000-f3cd-4dc0700a0000 pid=2672 /usr/bin/curl net send-data write-file guuid=5d1b1de3-1700-0000-f3cd-4dc0350a0000 pid=2613->guuid=09d02906-1800-0000-f3cd-4dc0700a0000 pid=2672 execve guuid=e898770b-1800-0000-f3cd-4dc07b0a0000 pid=2683 /usr/bin/chmod guuid=5d1b1de3-1700-0000-f3cd-4dc0350a0000 pid=2613->guuid=e898770b-1800-0000-f3cd-4dc07b0a0000 pid=2683 execve guuid=dd8ee00b-1800-0000-f3cd-4dc07e0a0000 pid=2686 /usr/bin/bash guuid=5d1b1de3-1700-0000-f3cd-4dc0350a0000 pid=2613->guuid=dd8ee00b-1800-0000-f3cd-4dc07e0a0000 pid=2686 clone guuid=5b502e0c-1800-0000-f3cd-4dc0800a0000 pid=2688 /usr/bin/rm delete-file guuid=5d1b1de3-1700-0000-f3cd-4dc0350a0000 pid=2613->guuid=5b502e0c-1800-0000-f3cd-4dc0800a0000 pid=2688 execve guuid=a0299a0c-1800-0000-f3cd-4dc0830a0000 pid=2691 /usr/bin/rm guuid=5d1b1de3-1700-0000-f3cd-4dc0350a0000 pid=2613->guuid=a0299a0c-1800-0000-f3cd-4dc0830a0000 pid=2691 execve guuid=276bfd0c-1800-0000-f3cd-4dc0850a0000 pid=2693 /usr/bin/wget net send-data guuid=5d1b1de3-1700-0000-f3cd-4dc0350a0000 pid=2613->guuid=276bfd0c-1800-0000-f3cd-4dc0850a0000 pid=2693 execve guuid=0ceaac0f-1800-0000-f3cd-4dc08e0a0000 pid=2702 /usr/bin/curl net send-data write-file guuid=5d1b1de3-1700-0000-f3cd-4dc0350a0000 pid=2613->guuid=0ceaac0f-1800-0000-f3cd-4dc08e0a0000 pid=2702 execve guuid=dec1a815-1800-0000-f3cd-4dc0970a0000 pid=2711 /usr/bin/chmod guuid=5d1b1de3-1700-0000-f3cd-4dc0350a0000 pid=2613->guuid=dec1a815-1800-0000-f3cd-4dc0970a0000 pid=2711 execve guuid=52e52016-1800-0000-f3cd-4dc0990a0000 pid=2713 /usr/bin/bash guuid=5d1b1de3-1700-0000-f3cd-4dc0350a0000 pid=2613->guuid=52e52016-1800-0000-f3cd-4dc0990a0000 pid=2713 clone guuid=f6826b16-1800-0000-f3cd-4dc09b0a0000 pid=2715 /usr/bin/rm delete-file guuid=5d1b1de3-1700-0000-f3cd-4dc0350a0000 pid=2613->guuid=f6826b16-1800-0000-f3cd-4dc09b0a0000 pid=2715 execve guuid=a1dfe716-1800-0000-f3cd-4dc09d0a0000 pid=2717 /usr/bin/rm guuid=5d1b1de3-1700-0000-f3cd-4dc0350a0000 pid=2613->guuid=a1dfe716-1800-0000-f3cd-4dc09d0a0000 pid=2717 execve guuid=4f823d17-1800-0000-f3cd-4dc09f0a0000 pid=2719 /usr/bin/wget net send-data guuid=5d1b1de3-1700-0000-f3cd-4dc0350a0000 pid=2613->guuid=4f823d17-1800-0000-f3cd-4dc09f0a0000 pid=2719 execve guuid=1648d219-1800-0000-f3cd-4dc0a70a0000 pid=2727 /usr/bin/curl net send-data write-file guuid=5d1b1de3-1700-0000-f3cd-4dc0350a0000 pid=2613->guuid=1648d219-1800-0000-f3cd-4dc0a70a0000 pid=2727 execve guuid=c7e4a91d-1800-0000-f3cd-4dc0b00a0000 pid=2736 /usr/bin/chmod guuid=5d1b1de3-1700-0000-f3cd-4dc0350a0000 pid=2613->guuid=c7e4a91d-1800-0000-f3cd-4dc0b00a0000 pid=2736 execve guuid=036fee1d-1800-0000-f3cd-4dc0b10a0000 pid=2737 /usr/bin/bash guuid=5d1b1de3-1700-0000-f3cd-4dc0350a0000 pid=2613->guuid=036fee1d-1800-0000-f3cd-4dc0b10a0000 pid=2737 clone guuid=7ea51e1e-1800-0000-f3cd-4dc0b40a0000 pid=2740 /usr/bin/rm delete-file guuid=5d1b1de3-1700-0000-f3cd-4dc0350a0000 pid=2613->guuid=7ea51e1e-1800-0000-f3cd-4dc0b40a0000 pid=2740 execve guuid=247c641e-1800-0000-f3cd-4dc0b60a0000 pid=2742 /usr/bin/rm guuid=5d1b1de3-1700-0000-f3cd-4dc0350a0000 pid=2613->guuid=247c641e-1800-0000-f3cd-4dc0b60a0000 pid=2742 execve guuid=3343a51e-1800-0000-f3cd-4dc0b80a0000 pid=2744 /usr/bin/wget net send-data guuid=5d1b1de3-1700-0000-f3cd-4dc0350a0000 pid=2613->guuid=3343a51e-1800-0000-f3cd-4dc0b80a0000 pid=2744 execve guuid=f9d80d21-1800-0000-f3cd-4dc0bf0a0000 pid=2751 /usr/bin/curl net send-data write-file guuid=5d1b1de3-1700-0000-f3cd-4dc0350a0000 pid=2613->guuid=f9d80d21-1800-0000-f3cd-4dc0bf0a0000 pid=2751 execve guuid=b2a18826-1800-0000-f3cd-4dc0cb0a0000 pid=2763 /usr/bin/chmod guuid=5d1b1de3-1700-0000-f3cd-4dc0350a0000 pid=2613->guuid=b2a18826-1800-0000-f3cd-4dc0cb0a0000 pid=2763 execve guuid=5735d726-1800-0000-f3cd-4dc0cc0a0000 pid=2764 /usr/bin/bash guuid=5d1b1de3-1700-0000-f3cd-4dc0350a0000 pid=2613->guuid=5735d726-1800-0000-f3cd-4dc0cc0a0000 pid=2764 clone guuid=a7cb2127-1800-0000-f3cd-4dc0cf0a0000 pid=2767 /usr/bin/rm delete-file guuid=5d1b1de3-1700-0000-f3cd-4dc0350a0000 pid=2613->guuid=a7cb2127-1800-0000-f3cd-4dc0cf0a0000 pid=2767 execve guuid=1f1f6b27-1800-0000-f3cd-4dc0d10a0000 pid=2769 /usr/bin/rm guuid=5d1b1de3-1700-0000-f3cd-4dc0350a0000 pid=2613->guuid=1f1f6b27-1800-0000-f3cd-4dc0d10a0000 pid=2769 execve guuid=c8e6a827-1800-0000-f3cd-4dc0d30a0000 pid=2771 /usr/bin/wget net send-data guuid=5d1b1de3-1700-0000-f3cd-4dc0350a0000 pid=2613->guuid=c8e6a827-1800-0000-f3cd-4dc0d30a0000 pid=2771 execve guuid=9d584d2a-1800-0000-f3cd-4dc0dc0a0000 pid=2780 /usr/bin/curl net send-data write-file guuid=5d1b1de3-1700-0000-f3cd-4dc0350a0000 pid=2613->guuid=9d584d2a-1800-0000-f3cd-4dc0dc0a0000 pid=2780 execve guuid=89d12b32-1800-0000-f3cd-4dc0f20a0000 pid=2802 /usr/bin/chmod guuid=5d1b1de3-1700-0000-f3cd-4dc0350a0000 pid=2613->guuid=89d12b32-1800-0000-f3cd-4dc0f20a0000 pid=2802 execve guuid=e3817632-1800-0000-f3cd-4dc0f40a0000 pid=2804 /usr/bin/bash guuid=5d1b1de3-1700-0000-f3cd-4dc0350a0000 pid=2613->guuid=e3817632-1800-0000-f3cd-4dc0f40a0000 pid=2804 clone guuid=ee53b232-1800-0000-f3cd-4dc0f60a0000 pid=2806 /usr/bin/rm delete-file guuid=5d1b1de3-1700-0000-f3cd-4dc0350a0000 pid=2613->guuid=ee53b232-1800-0000-f3cd-4dc0f60a0000 pid=2806 execve guuid=b2230e33-1800-0000-f3cd-4dc0f80a0000 pid=2808 /usr/bin/rm guuid=5d1b1de3-1700-0000-f3cd-4dc0350a0000 pid=2613->guuid=b2230e33-1800-0000-f3cd-4dc0f80a0000 pid=2808 execve guuid=db5e7d33-1800-0000-f3cd-4dc0fa0a0000 pid=2810 /usr/bin/wget net send-data guuid=5d1b1de3-1700-0000-f3cd-4dc0350a0000 pid=2613->guuid=db5e7d33-1800-0000-f3cd-4dc0fa0a0000 pid=2810 execve guuid=9e1d6836-1800-0000-f3cd-4dc0050b0000 pid=2821 /usr/bin/curl net send-data write-file guuid=5d1b1de3-1700-0000-f3cd-4dc0350a0000 pid=2613->guuid=9e1d6836-1800-0000-f3cd-4dc0050b0000 pid=2821 execve guuid=8539243c-1800-0000-f3cd-4dc0140b0000 pid=2836 /usr/bin/chmod guuid=5d1b1de3-1700-0000-f3cd-4dc0350a0000 pid=2613->guuid=8539243c-1800-0000-f3cd-4dc0140b0000 pid=2836 execve guuid=e2dc6a3c-1800-0000-f3cd-4dc0150b0000 pid=2837 /usr/bin/bash guuid=5d1b1de3-1700-0000-f3cd-4dc0350a0000 pid=2613->guuid=e2dc6a3c-1800-0000-f3cd-4dc0150b0000 pid=2837 clone guuid=ace8ce3c-1800-0000-f3cd-4dc0180b0000 pid=2840 /usr/bin/rm delete-file guuid=5d1b1de3-1700-0000-f3cd-4dc0350a0000 pid=2613->guuid=ace8ce3c-1800-0000-f3cd-4dc0180b0000 pid=2840 execve guuid=4d14133d-1800-0000-f3cd-4dc0190b0000 pid=2841 /usr/bin/rm guuid=5d1b1de3-1700-0000-f3cd-4dc0350a0000 pid=2613->guuid=4d14133d-1800-0000-f3cd-4dc0190b0000 pid=2841 execve guuid=cac1643d-1800-0000-f3cd-4dc01b0b0000 pid=2843 /usr/bin/wget net send-data guuid=5d1b1de3-1700-0000-f3cd-4dc0350a0000 pid=2613->guuid=cac1643d-1800-0000-f3cd-4dc01b0b0000 pid=2843 execve guuid=5b5fe240-1800-0000-f3cd-4dc0220b0000 pid=2850 /usr/bin/curl net send-data write-file guuid=5d1b1de3-1700-0000-f3cd-4dc0350a0000 pid=2613->guuid=5b5fe240-1800-0000-f3cd-4dc0220b0000 pid=2850 execve guuid=750ddb46-1800-0000-f3cd-4dc02d0b0000 pid=2861 /usr/bin/chmod guuid=5d1b1de3-1700-0000-f3cd-4dc0350a0000 pid=2613->guuid=750ddb46-1800-0000-f3cd-4dc02d0b0000 pid=2861 execve guuid=1374d647-1800-0000-f3cd-4dc02e0b0000 pid=2862 /usr/bin/bash guuid=5d1b1de3-1700-0000-f3cd-4dc0350a0000 pid=2613->guuid=1374d647-1800-0000-f3cd-4dc02e0b0000 pid=2862 clone guuid=5d3a6348-1800-0000-f3cd-4dc0300b0000 pid=2864 /usr/bin/rm delete-file guuid=5d1b1de3-1700-0000-f3cd-4dc0350a0000 pid=2613->guuid=5d3a6348-1800-0000-f3cd-4dc0300b0000 pid=2864 execve guuid=e38ead48-1800-0000-f3cd-4dc0320b0000 pid=2866 /usr/bin/rm guuid=5d1b1de3-1700-0000-f3cd-4dc0350a0000 pid=2613->guuid=e38ead48-1800-0000-f3cd-4dc0320b0000 pid=2866 execve guuid=17fcfb48-1800-0000-f3cd-4dc0330b0000 pid=2867 /usr/bin/wget net send-data guuid=5d1b1de3-1700-0000-f3cd-4dc0350a0000 pid=2613->guuid=17fcfb48-1800-0000-f3cd-4dc0330b0000 pid=2867 execve guuid=2fb3a54b-1800-0000-f3cd-4dc03a0b0000 pid=2874 /usr/bin/curl net send-data write-file guuid=5d1b1de3-1700-0000-f3cd-4dc0350a0000 pid=2613->guuid=2fb3a54b-1800-0000-f3cd-4dc03a0b0000 pid=2874 execve guuid=a16c474f-1800-0000-f3cd-4dc0440b0000 pid=2884 /usr/bin/chmod guuid=5d1b1de3-1700-0000-f3cd-4dc0350a0000 pid=2613->guuid=a16c474f-1800-0000-f3cd-4dc0440b0000 pid=2884 execve guuid=7932884f-1800-0000-f3cd-4dc0460b0000 pid=2886 /usr/bin/bash guuid=5d1b1de3-1700-0000-f3cd-4dc0350a0000 pid=2613->guuid=7932884f-1800-0000-f3cd-4dc0460b0000 pid=2886 clone guuid=fd2cc14f-1800-0000-f3cd-4dc0480b0000 pid=2888 /usr/bin/rm delete-file guuid=5d1b1de3-1700-0000-f3cd-4dc0350a0000 pid=2613->guuid=fd2cc14f-1800-0000-f3cd-4dc0480b0000 pid=2888 execve guuid=717d2e50-1800-0000-f3cd-4dc04b0b0000 pid=2891 /usr/bin/rm guuid=5d1b1de3-1700-0000-f3cd-4dc0350a0000 pid=2613->guuid=717d2e50-1800-0000-f3cd-4dc04b0b0000 pid=2891 execve guuid=121d6550-1800-0000-f3cd-4dc04d0b0000 pid=2893 /usr/bin/wget net send-data guuid=5d1b1de3-1700-0000-f3cd-4dc0350a0000 pid=2613->guuid=121d6550-1800-0000-f3cd-4dc04d0b0000 pid=2893 execve guuid=7212d352-1800-0000-f3cd-4dc0530b0000 pid=2899 /usr/bin/curl net send-data write-file guuid=5d1b1de3-1700-0000-f3cd-4dc0350a0000 pid=2613->guuid=7212d352-1800-0000-f3cd-4dc0530b0000 pid=2899 execve guuid=5c766458-1800-0000-f3cd-4dc0620b0000 pid=2914 /usr/bin/chmod guuid=5d1b1de3-1700-0000-f3cd-4dc0350a0000 pid=2613->guuid=5c766458-1800-0000-f3cd-4dc0620b0000 pid=2914 execve guuid=2f54cf58-1800-0000-f3cd-4dc0640b0000 pid=2916 /usr/bin/bash guuid=5d1b1de3-1700-0000-f3cd-4dc0350a0000 pid=2613->guuid=2f54cf58-1800-0000-f3cd-4dc0640b0000 pid=2916 clone guuid=56037a59-1800-0000-f3cd-4dc0660b0000 pid=2918 /usr/bin/rm delete-file guuid=5d1b1de3-1700-0000-f3cd-4dc0350a0000 pid=2613->guuid=56037a59-1800-0000-f3cd-4dc0660b0000 pid=2918 execve guuid=143dc259-1800-0000-f3cd-4dc0670b0000 pid=2919 /usr/bin/rm guuid=5d1b1de3-1700-0000-f3cd-4dc0350a0000 pid=2613->guuid=143dc259-1800-0000-f3cd-4dc0670b0000 pid=2919 execve guuid=439f065a-1800-0000-f3cd-4dc0680b0000 pid=2920 /usr/bin/wget net send-data guuid=5d1b1de3-1700-0000-f3cd-4dc0350a0000 pid=2613->guuid=439f065a-1800-0000-f3cd-4dc0680b0000 pid=2920 execve guuid=1aa77e5c-1800-0000-f3cd-4dc0710b0000 pid=2929 /usr/bin/curl net send-data write-file guuid=5d1b1de3-1700-0000-f3cd-4dc0350a0000 pid=2613->guuid=1aa77e5c-1800-0000-f3cd-4dc0710b0000 pid=2929 execve guuid=adc1ff61-1800-0000-f3cd-4dc07d0b0000 pid=2941 /usr/bin/chmod guuid=5d1b1de3-1700-0000-f3cd-4dc0350a0000 pid=2613->guuid=adc1ff61-1800-0000-f3cd-4dc07d0b0000 pid=2941 execve guuid=d8005662-1800-0000-f3cd-4dc07f0b0000 pid=2943 /usr/bin/bash guuid=5d1b1de3-1700-0000-f3cd-4dc0350a0000 pid=2613->guuid=d8005662-1800-0000-f3cd-4dc07f0b0000 pid=2943 clone guuid=f66d8e62-1800-0000-f3cd-4dc0820b0000 pid=2946 /usr/bin/rm delete-file guuid=5d1b1de3-1700-0000-f3cd-4dc0350a0000 pid=2613->guuid=f66d8e62-1800-0000-f3cd-4dc0820b0000 pid=2946 execve guuid=f572df62-1800-0000-f3cd-4dc0840b0000 pid=2948 /usr/bin/rm guuid=5d1b1de3-1700-0000-f3cd-4dc0350a0000 pid=2613->guuid=f572df62-1800-0000-f3cd-4dc0840b0000 pid=2948 execve 5b654972-c9e1-50d8-b372-2dc2a5b9ad66 5.182.210.174:80 guuid=19c1c4e3-1700-0000-f3cd-4dc0370a0000 pid=2615->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=15429ce9-1700-0000-f3cd-4dc0440a0000 pid=2628->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=9acebff6-1700-0000-f3cd-4dc0560a0000 pid=2646 /usr/bin/bash guuid=0a55a2f6-1700-0000-f3cd-4dc0550a0000 pid=2645->guuid=9acebff6-1700-0000-f3cd-4dc0560a0000 pid=2646 clone guuid=d32ba5f7-1700-0000-f3cd-4dc0590a0000 pid=2649->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=17c69afd-1700-0000-f3cd-4dc05c0a0000 pid=2652->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=5d922e03-1800-0000-f3cd-4dc0670a0000 pid=2663 /usr/bin/bash guuid=eabc1403-1800-0000-f3cd-4dc0660a0000 pid=2662->guuid=5d922e03-1800-0000-f3cd-4dc0670a0000 pid=2663 clone guuid=7203c503-1800-0000-f3cd-4dc06b0a0000 pid=2667->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=09d02906-1800-0000-f3cd-4dc0700a0000 pid=2672->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=6168010c-1800-0000-f3cd-4dc07f0a0000 pid=2687 /usr/bin/bash guuid=dd8ee00b-1800-0000-f3cd-4dc07e0a0000 pid=2686->guuid=6168010c-1800-0000-f3cd-4dc07f0a0000 pid=2687 clone guuid=276bfd0c-1800-0000-f3cd-4dc0850a0000 pid=2693->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=0ceaac0f-1800-0000-f3cd-4dc08e0a0000 pid=2702->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=5c953616-1800-0000-f3cd-4dc09a0a0000 pid=2714 /usr/bin/bash guuid=52e52016-1800-0000-f3cd-4dc0990a0000 pid=2713->guuid=5c953616-1800-0000-f3cd-4dc09a0a0000 pid=2714 clone guuid=4f823d17-1800-0000-f3cd-4dc09f0a0000 pid=2719->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=1648d219-1800-0000-f3cd-4dc0a70a0000 pid=2727->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=93aa021e-1800-0000-f3cd-4dc0b30a0000 pid=2739 /usr/bin/bash guuid=036fee1d-1800-0000-f3cd-4dc0b10a0000 pid=2737->guuid=93aa021e-1800-0000-f3cd-4dc0b30a0000 pid=2739 clone guuid=3343a51e-1800-0000-f3cd-4dc0b80a0000 pid=2744->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=f9d80d21-1800-0000-f3cd-4dc0bf0a0000 pid=2751->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=9a37f326-1800-0000-f3cd-4dc0cd0a0000 pid=2765 /usr/bin/bash guuid=5735d726-1800-0000-f3cd-4dc0cc0a0000 pid=2764->guuid=9a37f326-1800-0000-f3cd-4dc0cd0a0000 pid=2765 clone guuid=c8e6a827-1800-0000-f3cd-4dc0d30a0000 pid=2771->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=9d584d2a-1800-0000-f3cd-4dc0dc0a0000 pid=2780->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=fd328e32-1800-0000-f3cd-4dc0f50a0000 pid=2805 /usr/bin/bash guuid=e3817632-1800-0000-f3cd-4dc0f40a0000 pid=2804->guuid=fd328e32-1800-0000-f3cd-4dc0f50a0000 pid=2805 clone guuid=db5e7d33-1800-0000-f3cd-4dc0fa0a0000 pid=2810->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=9e1d6836-1800-0000-f3cd-4dc0050b0000 pid=2821->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=67957f3c-1800-0000-f3cd-4dc0160b0000 pid=2838 /usr/bin/bash guuid=e2dc6a3c-1800-0000-f3cd-4dc0150b0000 pid=2837->guuid=67957f3c-1800-0000-f3cd-4dc0160b0000 pid=2838 clone guuid=cac1643d-1800-0000-f3cd-4dc01b0b0000 pid=2843->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=5b5fe240-1800-0000-f3cd-4dc0220b0000 pid=2850->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=16d01048-1800-0000-f3cd-4dc02f0b0000 pid=2863 /usr/bin/bash guuid=1374d647-1800-0000-f3cd-4dc02e0b0000 pid=2862->guuid=16d01048-1800-0000-f3cd-4dc02f0b0000 pid=2863 clone guuid=17fcfb48-1800-0000-f3cd-4dc0330b0000 pid=2867->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=2fb3a54b-1800-0000-f3cd-4dc03a0b0000 pid=2874->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=e204a14f-1800-0000-f3cd-4dc0470b0000 pid=2887 /usr/bin/bash guuid=7932884f-1800-0000-f3cd-4dc0460b0000 pid=2886->guuid=e204a14f-1800-0000-f3cd-4dc0470b0000 pid=2887 clone guuid=121d6550-1800-0000-f3cd-4dc04d0b0000 pid=2893->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=7212d352-1800-0000-f3cd-4dc0530b0000 pid=2899->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=8d78e758-1800-0000-f3cd-4dc0650b0000 pid=2917 /usr/bin/bash guuid=2f54cf58-1800-0000-f3cd-4dc0640b0000 pid=2916->guuid=8d78e758-1800-0000-f3cd-4dc0650b0000 pid=2917 clone guuid=439f065a-1800-0000-f3cd-4dc0680b0000 pid=2920->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 134B guuid=1aa77e5c-1800-0000-f3cd-4dc0710b0000 pid=2929->5b654972-c9e1-50d8-b372-2dc2a5b9ad66 send: 83B guuid=629d7262-1800-0000-f3cd-4dc0800b0000 pid=2944 /usr/bin/bash guuid=d8005662-1800-0000-f3cd-4dc07f0b0000 pid=2943->guuid=629d7262-1800-0000-f3cd-4dc0800b0000 pid=2944 clone
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/fd2a8216e43edad7fa7e2ac6e7c1d2a52dd288f3ac242e525d74333c8c9c7c28
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fd2a8216e43edad7fa7e2ac6e7c1d2a52dd288f3ac242e525d74333c8c9c7c28/
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-08-08 07:53:28 UTC
File Type:
Text (Shell)
AV detection:
10 of 24 (41.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7uviefxeh3nnp6t6fldopqosuuw5fchtvqsc4us5oqztzde4pqua._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260808-jq6svswwdv/
Behaviour
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.11
Link:
https://yomi.yoroi.company/submissions/fd2a8216e43edad7fa7e2ac6e7c1d2a52dd288f3ac242e525d74333c8c9c7c28

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh fd2a8216e43edad7fa7e2ac6e7c1d2a52dd288f3ac242e525d74333c8c9c7c28

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3897671/
  
Delivery method
Distributed via web download

Comments