🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 fdf1fc9a36c9fa06d23e26dc512f9cd71725298fedc0eca768493c27ab4744b0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: fdf1fc9a36c9fa06d23e26dc512f9cd71725298fedc0eca768493c27ab4744b0
SHA3-384 hash: a62606fcf0e1d58db2c81c03790f2fc8d24ae554608d3178fc9d1769de9409f63a4d3fe8103e9f0d69971198dd5b9f49
SHA1 hash: 42f6a4f6b21eca1df529e71fe40e303d1e530692
MD5 hash: 09f7d18c373623b35f2479d31fa7ba47
humanhash: jersey-cat-west-carpet
File name:fdf1fc9a36c9fa06d23e26dc512f9cd71725298fedc0eca768493c27ab4744b0
Download: download sample
File size:1'584 bytes
First seen:2026-07-27 18:00:59 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 24:0ac6maCaQv/riDBwfXQ50nhOBqToGsYV19u2YTW1:5c6mawcB2FnhOBBGsx01
TLSH T1B03132DA56555E368303CECEB3A33618720C92FB2C47D7A4C9490EFD4A881CDB255BC6
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter Anonymous
Tags:cowrie hermes-noc honeypot sh


Avatar
Anonymous
Captured by Hermes-NOC Cowrie SSH honeypot
URLMalware sample (SHA256 hash)SignatureTags
http://5.182.210.61/3f3707n/an/aua-wget
http://5.182.210.61/4b1651n/an/aua-wget
http://5.182.210.61/13916cn/an/aua-wget
http://5.182.210.61/361156n/an/aua-wget
http://5.182.210.61/774855n/an/aua-wget
http://5.182.210.61/e00c4fn/an/aua-wget
http://5.182.210.61/e5f05fn/an/aua-wget
http://5.182.210.61/416c24n/an/aua-wget
http://5.182.210.61/04c7aan/an/aua-wget
http://5.182.210.61/e5149fn/an/aua-wget
http://5.182.210.61/07add9n/an/aua-wget
http://5.182.210.61/8918c0n/an/aua-wget

Intelligence

File Origin
# of uploads :
1
# of downloads :
71
Origin country :
NL NL
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive mirai
Link:
https://www.filescan.io/uploads/6a679d0491a8b2230739a815/reports/83fdf252-656b-4eb5-9adb-d8fa5dc5333f/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-07-27T15:38:00Z UTC
Last seen:
2026-07-27T18:00:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/fdf1fc9a36c9fa06d23e26dc512f9cd71725298fedc0eca768493c27ab4744b0/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/a4c2570f-90e6-4fea-a670-b4c847671fe0
Behavior Graph:
Download SVG
%3 guuid=e59784b5-1600-0000-b2c2-4422290c0000 pid=3113 /usr/bin/sudo guuid=88eb46b8-1600-0000-b2c2-44222e0c0000 pid=3118 /tmp/sample.bin guuid=e59784b5-1600-0000-b2c2-4422290c0000 pid=3113->guuid=88eb46b8-1600-0000-b2c2-44222e0c0000 pid=3118 execve guuid=3f3964b9-1600-0000-b2c2-4422310c0000 pid=3121 /usr/bin/wget net send-data guuid=88eb46b8-1600-0000-b2c2-44222e0c0000 pid=3118->guuid=3f3964b9-1600-0000-b2c2-4422310c0000 pid=3121 execve guuid=54a55fbf-1600-0000-b2c2-4422390c0000 pid=3129 /usr/bin/curl net send-data write-file guuid=88eb46b8-1600-0000-b2c2-44222e0c0000 pid=3118->guuid=54a55fbf-1600-0000-b2c2-4422390c0000 pid=3129 execve guuid=cd28f6c9-1600-0000-b2c2-4422410c0000 pid=3137 /usr/bin/chmod guuid=88eb46b8-1600-0000-b2c2-44222e0c0000 pid=3118->guuid=cd28f6c9-1600-0000-b2c2-4422410c0000 pid=3137 execve guuid=accbc9ca-1600-0000-b2c2-4422420c0000 pid=3138 /usr/bin/bash guuid=88eb46b8-1600-0000-b2c2-44222e0c0000 pid=3118->guuid=accbc9ca-1600-0000-b2c2-4422420c0000 pid=3138 clone guuid=a17e6dcb-1600-0000-b2c2-4422440c0000 pid=3140 /usr/bin/rm delete-file guuid=88eb46b8-1600-0000-b2c2-44222e0c0000 pid=3118->guuid=a17e6dcb-1600-0000-b2c2-4422440c0000 pid=3140 execve guuid=e44629cc-1600-0000-b2c2-4422450c0000 pid=3141 /usr/bin/rm guuid=88eb46b8-1600-0000-b2c2-44222e0c0000 pid=3118->guuid=e44629cc-1600-0000-b2c2-4422450c0000 pid=3141 execve guuid=6598dacc-1600-0000-b2c2-4422460c0000 pid=3142 /usr/bin/wget net send-data guuid=88eb46b8-1600-0000-b2c2-44222e0c0000 pid=3118->guuid=6598dacc-1600-0000-b2c2-4422460c0000 pid=3142 execve guuid=a770ffcf-1600-0000-b2c2-44224c0c0000 pid=3148 /usr/bin/curl net send-data write-file guuid=88eb46b8-1600-0000-b2c2-44222e0c0000 pid=3118->guuid=a770ffcf-1600-0000-b2c2-44224c0c0000 pid=3148 execve guuid=95c725d4-1600-0000-b2c2-4422590c0000 pid=3161 /usr/bin/chmod guuid=88eb46b8-1600-0000-b2c2-44222e0c0000 pid=3118->guuid=95c725d4-1600-0000-b2c2-4422590c0000 pid=3161 execve guuid=7c6862d4-1600-0000-b2c2-44225b0c0000 pid=3163 /usr/bin/bash guuid=88eb46b8-1600-0000-b2c2-44222e0c0000 pid=3118->guuid=7c6862d4-1600-0000-b2c2-44225b0c0000 pid=3163 clone guuid=699c97d4-1600-0000-b2c2-44225e0c0000 pid=3166 /usr/bin/rm delete-file guuid=88eb46b8-1600-0000-b2c2-44222e0c0000 pid=3118->guuid=699c97d4-1600-0000-b2c2-44225e0c0000 pid=3166 execve guuid=f9fddcd4-1600-0000-b2c2-44225f0c0000 pid=3167 /usr/bin/rm guuid=88eb46b8-1600-0000-b2c2-44222e0c0000 pid=3118->guuid=f9fddcd4-1600-0000-b2c2-44225f0c0000 pid=3167 execve guuid=c7fb1ed5-1600-0000-b2c2-4422610c0000 pid=3169 /usr/bin/wget net send-data guuid=88eb46b8-1600-0000-b2c2-44222e0c0000 pid=3118->guuid=c7fb1ed5-1600-0000-b2c2-4422610c0000 pid=3169 execve guuid=55183ad8-1600-0000-b2c2-44226c0c0000 pid=3180 /usr/bin/curl net send-data write-file guuid=88eb46b8-1600-0000-b2c2-44222e0c0000 pid=3118->guuid=55183ad8-1600-0000-b2c2-44226c0c0000 pid=3180 execve guuid=7e4a1dde-1600-0000-b2c2-4422760c0000 pid=3190 /usr/bin/chmod guuid=88eb46b8-1600-0000-b2c2-44222e0c0000 pid=3118->guuid=7e4a1dde-1600-0000-b2c2-4422760c0000 pid=3190 execve guuid=f62d69de-1600-0000-b2c2-4422780c0000 pid=3192 /usr/bin/bash guuid=88eb46b8-1600-0000-b2c2-44222e0c0000 pid=3118->guuid=f62d69de-1600-0000-b2c2-4422780c0000 pid=3192 clone guuid=c871bbde-1600-0000-b2c2-44227b0c0000 pid=3195 /usr/bin/rm delete-file guuid=88eb46b8-1600-0000-b2c2-44222e0c0000 pid=3118->guuid=c871bbde-1600-0000-b2c2-44227b0c0000 pid=3195 execve guuid=ead21bdf-1600-0000-b2c2-44227d0c0000 pid=3197 /usr/bin/rm guuid=88eb46b8-1600-0000-b2c2-44222e0c0000 pid=3118->guuid=ead21bdf-1600-0000-b2c2-44227d0c0000 pid=3197 execve guuid=627c60df-1600-0000-b2c2-44227f0c0000 pid=3199 /usr/bin/wget net send-data guuid=88eb46b8-1600-0000-b2c2-44222e0c0000 pid=3118->guuid=627c60df-1600-0000-b2c2-44227f0c0000 pid=3199 execve guuid=f18fa8e1-1600-0000-b2c2-4422870c0000 pid=3207 /usr/bin/curl net send-data write-file guuid=88eb46b8-1600-0000-b2c2-44222e0c0000 pid=3118->guuid=f18fa8e1-1600-0000-b2c2-4422870c0000 pid=3207 execve guuid=3a4563e5-1600-0000-b2c2-4422950c0000 pid=3221 /usr/bin/chmod guuid=88eb46b8-1600-0000-b2c2-44222e0c0000 pid=3118->guuid=3a4563e5-1600-0000-b2c2-4422950c0000 pid=3221 execve guuid=ab15a0e5-1600-0000-b2c2-4422970c0000 pid=3223 /usr/bin/bash guuid=88eb46b8-1600-0000-b2c2-44222e0c0000 pid=3118->guuid=ab15a0e5-1600-0000-b2c2-4422970c0000 pid=3223 clone guuid=fd1ef1e5-1600-0000-b2c2-4422990c0000 pid=3225 /usr/bin/rm delete-file guuid=88eb46b8-1600-0000-b2c2-44222e0c0000 pid=3118->guuid=fd1ef1e5-1600-0000-b2c2-4422990c0000 pid=3225 execve guuid=833d60e6-1600-0000-b2c2-44229b0c0000 pid=3227 /usr/bin/rm guuid=88eb46b8-1600-0000-b2c2-44222e0c0000 pid=3118->guuid=833d60e6-1600-0000-b2c2-44229b0c0000 pid=3227 execve guuid=55efb4e6-1600-0000-b2c2-44229c0c0000 pid=3228 /usr/bin/wget net send-data guuid=88eb46b8-1600-0000-b2c2-44222e0c0000 pid=3118->guuid=55efb4e6-1600-0000-b2c2-44229c0c0000 pid=3228 execve guuid=efbe58e9-1600-0000-b2c2-4422a30c0000 pid=3235 /usr/bin/curl net send-data write-file guuid=88eb46b8-1600-0000-b2c2-44222e0c0000 pid=3118->guuid=efbe58e9-1600-0000-b2c2-4422a30c0000 pid=3235 execve guuid=c9ed61ee-1600-0000-b2c2-4422a40c0000 pid=3236 /usr/bin/chmod guuid=88eb46b8-1600-0000-b2c2-44222e0c0000 pid=3118->guuid=c9ed61ee-1600-0000-b2c2-4422a40c0000 pid=3236 execve guuid=4a1ae9ee-1600-0000-b2c2-4422a50c0000 pid=3237 /usr/bin/bash guuid=88eb46b8-1600-0000-b2c2-44222e0c0000 pid=3118->guuid=4a1ae9ee-1600-0000-b2c2-4422a50c0000 pid=3237 clone guuid=368b4bef-1600-0000-b2c2-4422a70c0000 pid=3239 /usr/bin/rm delete-file guuid=88eb46b8-1600-0000-b2c2-44222e0c0000 pid=3118->guuid=368b4bef-1600-0000-b2c2-4422a70c0000 pid=3239 execve guuid=9158dcef-1600-0000-b2c2-4422a80c0000 pid=3240 /usr/bin/rm guuid=88eb46b8-1600-0000-b2c2-44222e0c0000 pid=3118->guuid=9158dcef-1600-0000-b2c2-4422a80c0000 pid=3240 execve guuid=52cf56f0-1600-0000-b2c2-4422a90c0000 pid=3241 /usr/bin/wget net send-data guuid=88eb46b8-1600-0000-b2c2-44222e0c0000 pid=3118->guuid=52cf56f0-1600-0000-b2c2-4422a90c0000 pid=3241 execve guuid=dd1a1ff4-1600-0000-b2c2-4422ab0c0000 pid=3243 /usr/bin/curl net send-data write-file guuid=88eb46b8-1600-0000-b2c2-44222e0c0000 pid=3118->guuid=dd1a1ff4-1600-0000-b2c2-4422ab0c0000 pid=3243 execve guuid=fdd99dfb-1600-0000-b2c2-4422b70c0000 pid=3255 /usr/bin/chmod guuid=88eb46b8-1600-0000-b2c2-44222e0c0000 pid=3118->guuid=fdd99dfb-1600-0000-b2c2-4422b70c0000 pid=3255 execve guuid=6cc0fefb-1600-0000-b2c2-4422b80c0000 pid=3256 /usr/bin/bash guuid=88eb46b8-1600-0000-b2c2-44222e0c0000 pid=3118->guuid=6cc0fefb-1600-0000-b2c2-4422b80c0000 pid=3256 clone guuid=bef959fc-1600-0000-b2c2-4422bb0c0000 pid=3259 /usr/bin/rm delete-file guuid=88eb46b8-1600-0000-b2c2-44222e0c0000 pid=3118->guuid=bef959fc-1600-0000-b2c2-4422bb0c0000 pid=3259 execve guuid=651eb8fc-1600-0000-b2c2-4422be0c0000 pid=3262 /usr/bin/rm guuid=88eb46b8-1600-0000-b2c2-44222e0c0000 pid=3118->guuid=651eb8fc-1600-0000-b2c2-4422be0c0000 pid=3262 execve guuid=f0a413fd-1600-0000-b2c2-4422c00c0000 pid=3264 /usr/bin/wget net send-data guuid=88eb46b8-1600-0000-b2c2-44222e0c0000 pid=3118->guuid=f0a413fd-1600-0000-b2c2-4422c00c0000 pid=3264 execve guuid=92a9efff-1600-0000-b2c2-4422c60c0000 pid=3270 /usr/bin/curl net send-data write-file guuid=88eb46b8-1600-0000-b2c2-44222e0c0000 pid=3118->guuid=92a9efff-1600-0000-b2c2-4422c60c0000 pid=3270 execve guuid=9d004f06-1700-0000-b2c2-4422d60c0000 pid=3286 /usr/bin/chmod guuid=88eb46b8-1600-0000-b2c2-44222e0c0000 pid=3118->guuid=9d004f06-1700-0000-b2c2-4422d60c0000 pid=3286 execve guuid=b597a606-1700-0000-b2c2-4422d70c0000 pid=3287 /usr/bin/bash guuid=88eb46b8-1600-0000-b2c2-44222e0c0000 pid=3118->guuid=b597a606-1700-0000-b2c2-4422d70c0000 pid=3287 clone guuid=a29b0f07-1700-0000-b2c2-4422da0c0000 pid=3290 /usr/bin/rm delete-file guuid=88eb46b8-1600-0000-b2c2-44222e0c0000 pid=3118->guuid=a29b0f07-1700-0000-b2c2-4422da0c0000 pid=3290 execve guuid=4c886b07-1700-0000-b2c2-4422db0c0000 pid=3291 /usr/bin/rm guuid=88eb46b8-1600-0000-b2c2-44222e0c0000 pid=3118->guuid=4c886b07-1700-0000-b2c2-4422db0c0000 pid=3291 execve guuid=71aabe07-1700-0000-b2c2-4422dd0c0000 pid=3293 /usr/bin/wget net send-data guuid=88eb46b8-1600-0000-b2c2-44222e0c0000 pid=3118->guuid=71aabe07-1700-0000-b2c2-4422dd0c0000 pid=3293 execve guuid=6652d10a-1700-0000-b2c2-4422e50c0000 pid=3301 /usr/bin/curl net send-data write-file guuid=88eb46b8-1600-0000-b2c2-44222e0c0000 pid=3118->guuid=6652d10a-1700-0000-b2c2-4422e50c0000 pid=3301 execve guuid=bdb65410-1700-0000-b2c2-4422f10c0000 pid=3313 /usr/bin/chmod guuid=88eb46b8-1600-0000-b2c2-44222e0c0000 pid=3118->guuid=bdb65410-1700-0000-b2c2-4422f10c0000 pid=3313 execve guuid=5575c510-1700-0000-b2c2-4422f30c0000 pid=3315 /usr/bin/bash guuid=88eb46b8-1600-0000-b2c2-44222e0c0000 pid=3118->guuid=5575c510-1700-0000-b2c2-4422f30c0000 pid=3315 clone guuid=bb1d1511-1700-0000-b2c2-4422f60c0000 pid=3318 /usr/bin/rm delete-file guuid=88eb46b8-1600-0000-b2c2-44222e0c0000 pid=3118->guuid=bb1d1511-1700-0000-b2c2-4422f60c0000 pid=3318 execve guuid=443b7011-1700-0000-b2c2-4422f70c0000 pid=3319 /usr/bin/rm guuid=88eb46b8-1600-0000-b2c2-44222e0c0000 pid=3118->guuid=443b7011-1700-0000-b2c2-4422f70c0000 pid=3319 execve guuid=7266c511-1700-0000-b2c2-4422f90c0000 pid=3321 /usr/bin/wget net send-data guuid=88eb46b8-1600-0000-b2c2-44222e0c0000 pid=3118->guuid=7266c511-1700-0000-b2c2-4422f90c0000 pid=3321 execve guuid=1e9b0415-1700-0000-b2c2-4422010d0000 pid=3329 /usr/bin/curl net send-data write-file guuid=88eb46b8-1600-0000-b2c2-44222e0c0000 pid=3118->guuid=1e9b0415-1700-0000-b2c2-4422010d0000 pid=3329 execve guuid=1236161a-1700-0000-b2c2-4422120d0000 pid=3346 /usr/bin/chmod guuid=88eb46b8-1600-0000-b2c2-44222e0c0000 pid=3118->guuid=1236161a-1700-0000-b2c2-4422120d0000 pid=3346 execve guuid=2d84841a-1700-0000-b2c2-4422140d0000 pid=3348 /usr/bin/bash guuid=88eb46b8-1600-0000-b2c2-44222e0c0000 pid=3118->guuid=2d84841a-1700-0000-b2c2-4422140d0000 pid=3348 clone guuid=928fc81a-1700-0000-b2c2-4422170d0000 pid=3351 /usr/bin/rm delete-file guuid=88eb46b8-1600-0000-b2c2-44222e0c0000 pid=3118->guuid=928fc81a-1700-0000-b2c2-4422170d0000 pid=3351 execve guuid=e349251b-1700-0000-b2c2-4422190d0000 pid=3353 /usr/bin/rm guuid=88eb46b8-1600-0000-b2c2-44222e0c0000 pid=3118->guuid=e349251b-1700-0000-b2c2-4422190d0000 pid=3353 execve guuid=578e7c1b-1700-0000-b2c2-44221b0d0000 pid=3355 /usr/bin/wget net send-data guuid=88eb46b8-1600-0000-b2c2-44222e0c0000 pid=3118->guuid=578e7c1b-1700-0000-b2c2-44221b0d0000 pid=3355 execve guuid=dcbc2f1e-1700-0000-b2c2-4422210d0000 pid=3361 /usr/bin/curl net send-data write-file guuid=88eb46b8-1600-0000-b2c2-44222e0c0000 pid=3118->guuid=dcbc2f1e-1700-0000-b2c2-4422210d0000 pid=3361 execve guuid=070f3123-1700-0000-b2c2-44222f0d0000 pid=3375 /usr/bin/chmod guuid=88eb46b8-1600-0000-b2c2-44222e0c0000 pid=3118->guuid=070f3123-1700-0000-b2c2-44222f0d0000 pid=3375 execve guuid=7fe58524-1700-0000-b2c2-4422350d0000 pid=3381 /usr/bin/bash guuid=88eb46b8-1600-0000-b2c2-44222e0c0000 pid=3118->guuid=7fe58524-1700-0000-b2c2-4422350d0000 pid=3381 clone guuid=9f4c3425-1700-0000-b2c2-44223b0d0000 pid=3387 /usr/bin/rm delete-file guuid=88eb46b8-1600-0000-b2c2-44222e0c0000 pid=3118->guuid=9f4c3425-1700-0000-b2c2-44223b0d0000 pid=3387 execve guuid=e39bf225-1700-0000-b2c2-44223f0d0000 pid=3391 /usr/bin/rm guuid=88eb46b8-1600-0000-b2c2-44222e0c0000 pid=3118->guuid=e39bf225-1700-0000-b2c2-44223f0d0000 pid=3391 execve guuid=743f4226-1700-0000-b2c2-4422410d0000 pid=3393 /usr/bin/wget net send-data guuid=88eb46b8-1600-0000-b2c2-44222e0c0000 pid=3118->guuid=743f4226-1700-0000-b2c2-4422410d0000 pid=3393 execve guuid=014e6032-1700-0000-b2c2-4422680d0000 pid=3432 /usr/bin/curl net send-data write-file guuid=88eb46b8-1600-0000-b2c2-44222e0c0000 pid=3118->guuid=014e6032-1700-0000-b2c2-4422680d0000 pid=3432 execve guuid=7909d035-1700-0000-b2c2-4422710d0000 pid=3441 /usr/bin/chmod guuid=88eb46b8-1600-0000-b2c2-44222e0c0000 pid=3118->guuid=7909d035-1700-0000-b2c2-4422710d0000 pid=3441 execve guuid=d3ae0c36-1700-0000-b2c2-4422720d0000 pid=3442 /usr/bin/bash guuid=88eb46b8-1600-0000-b2c2-44222e0c0000 pid=3118->guuid=d3ae0c36-1700-0000-b2c2-4422720d0000 pid=3442 clone guuid=209c3a36-1700-0000-b2c2-4422740d0000 pid=3444 /usr/bin/rm delete-file guuid=88eb46b8-1600-0000-b2c2-44222e0c0000 pid=3118->guuid=209c3a36-1700-0000-b2c2-4422740d0000 pid=3444 execve guuid=95567336-1700-0000-b2c2-4422750d0000 pid=3445 /usr/bin/rm guuid=88eb46b8-1600-0000-b2c2-44222e0c0000 pid=3118->guuid=95567336-1700-0000-b2c2-4422750d0000 pid=3445 execve guuid=9ceaaa36-1700-0000-b2c2-4422760d0000 pid=3446 /usr/bin/wget net send-data guuid=88eb46b8-1600-0000-b2c2-44222e0c0000 pid=3118->guuid=9ceaaa36-1700-0000-b2c2-4422760d0000 pid=3446 execve guuid=1892e538-1700-0000-b2c2-4422770d0000 pid=3447 /usr/bin/curl net send-data write-file guuid=88eb46b8-1600-0000-b2c2-44222e0c0000 pid=3118->guuid=1892e538-1700-0000-b2c2-4422770d0000 pid=3447 execve guuid=97d5933c-1700-0000-b2c2-4422850d0000 pid=3461 /usr/bin/chmod guuid=88eb46b8-1600-0000-b2c2-44222e0c0000 pid=3118->guuid=97d5933c-1700-0000-b2c2-4422850d0000 pid=3461 execve guuid=8366ec3c-1700-0000-b2c2-4422870d0000 pid=3463 /usr/bin/bash guuid=88eb46b8-1600-0000-b2c2-44222e0c0000 pid=3118->guuid=8366ec3c-1700-0000-b2c2-4422870d0000 pid=3463 clone guuid=7951213d-1700-0000-b2c2-4422890d0000 pid=3465 /usr/bin/rm delete-file guuid=88eb46b8-1600-0000-b2c2-44222e0c0000 pid=3118->guuid=7951213d-1700-0000-b2c2-4422890d0000 pid=3465 execve guuid=8478643d-1700-0000-b2c2-44228a0d0000 pid=3466 /usr/bin/rm guuid=88eb46b8-1600-0000-b2c2-44222e0c0000 pid=3118->guuid=8478643d-1700-0000-b2c2-44228a0d0000 pid=3466 execve 9e33e6d7-6ac7-5a65-88f4-941337e56821 5.182.210.61:80 guuid=3f3964b9-1600-0000-b2c2-4422310c0000 pid=3121->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=54a55fbf-1600-0000-b2c2-4422390c0000 pid=3129->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=02ff1dcb-1600-0000-b2c2-4422430c0000 pid=3139 /usr/bin/bash guuid=accbc9ca-1600-0000-b2c2-4422420c0000 pid=3138->guuid=02ff1dcb-1600-0000-b2c2-4422430c0000 pid=3139 clone guuid=6598dacc-1600-0000-b2c2-4422460c0000 pid=3142->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=a770ffcf-1600-0000-b2c2-44224c0c0000 pid=3148->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=e8fe75d4-1600-0000-b2c2-44225c0c0000 pid=3164 /usr/bin/bash guuid=7c6862d4-1600-0000-b2c2-44225b0c0000 pid=3163->guuid=e8fe75d4-1600-0000-b2c2-44225c0c0000 pid=3164 clone guuid=c7fb1ed5-1600-0000-b2c2-4422610c0000 pid=3169->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=55183ad8-1600-0000-b2c2-44226c0c0000 pid=3180->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=0e0e8ede-1600-0000-b2c2-44227a0c0000 pid=3194 /usr/bin/bash guuid=f62d69de-1600-0000-b2c2-4422780c0000 pid=3192->guuid=0e0e8ede-1600-0000-b2c2-44227a0c0000 pid=3194 clone guuid=627c60df-1600-0000-b2c2-44227f0c0000 pid=3199->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=f18fa8e1-1600-0000-b2c2-4422870c0000 pid=3207->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=07c9b8e5-1600-0000-b2c2-4422980c0000 pid=3224 /usr/bin/bash guuid=ab15a0e5-1600-0000-b2c2-4422970c0000 pid=3223->guuid=07c9b8e5-1600-0000-b2c2-4422980c0000 pid=3224 clone guuid=55efb4e6-1600-0000-b2c2-44229c0c0000 pid=3228->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=efbe58e9-1600-0000-b2c2-4422a30c0000 pid=3235->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=761818ef-1600-0000-b2c2-4422a60c0000 pid=3238 /usr/bin/bash guuid=4a1ae9ee-1600-0000-b2c2-4422a50c0000 pid=3237->guuid=761818ef-1600-0000-b2c2-4422a60c0000 pid=3238 clone guuid=52cf56f0-1600-0000-b2c2-4422a90c0000 pid=3241->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=dd1a1ff4-1600-0000-b2c2-4422ab0c0000 pid=3243->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=c7ea32fc-1600-0000-b2c2-4422ba0c0000 pid=3258 /usr/bin/bash guuid=6cc0fefb-1600-0000-b2c2-4422b80c0000 pid=3256->guuid=c7ea32fc-1600-0000-b2c2-4422ba0c0000 pid=3258 clone guuid=f0a413fd-1600-0000-b2c2-4422c00c0000 pid=3264->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=92a9efff-1600-0000-b2c2-4422c60c0000 pid=3270->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=4f9bca06-1700-0000-b2c2-4422d80c0000 pid=3288 /usr/bin/bash guuid=b597a606-1700-0000-b2c2-4422d70c0000 pid=3287->guuid=4f9bca06-1700-0000-b2c2-4422d80c0000 pid=3288 clone guuid=71aabe07-1700-0000-b2c2-4422dd0c0000 pid=3293->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=6652d10a-1700-0000-b2c2-4422e50c0000 pid=3301->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=efefe310-1700-0000-b2c2-4422f40c0000 pid=3316 /usr/bin/bash guuid=5575c510-1700-0000-b2c2-4422f30c0000 pid=3315->guuid=efefe310-1700-0000-b2c2-4422f40c0000 pid=3316 clone guuid=7266c511-1700-0000-b2c2-4422f90c0000 pid=3321->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=1e9b0415-1700-0000-b2c2-4422010d0000 pid=3329->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=3372a11a-1700-0000-b2c2-4422150d0000 pid=3349 /usr/bin/bash guuid=2d84841a-1700-0000-b2c2-4422140d0000 pid=3348->guuid=3372a11a-1700-0000-b2c2-4422150d0000 pid=3349 clone guuid=578e7c1b-1700-0000-b2c2-44221b0d0000 pid=3355->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=dcbc2f1e-1700-0000-b2c2-4422210d0000 pid=3361->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=9699ce24-1700-0000-b2c2-4422380d0000 pid=3384 /usr/bin/bash guuid=7fe58524-1700-0000-b2c2-4422350d0000 pid=3381->guuid=9699ce24-1700-0000-b2c2-4422380d0000 pid=3384 clone guuid=743f4226-1700-0000-b2c2-4422410d0000 pid=3393->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=014e6032-1700-0000-b2c2-4422680d0000 pid=3432->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=b9422236-1700-0000-b2c2-4422730d0000 pid=3443 /usr/bin/bash guuid=d3ae0c36-1700-0000-b2c2-4422720d0000 pid=3442->guuid=b9422236-1700-0000-b2c2-4422730d0000 pid=3443 clone guuid=9ceaaa36-1700-0000-b2c2-4422760d0000 pid=3446->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=1892e538-1700-0000-b2c2-4422770d0000 pid=3447->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=c037023d-1700-0000-b2c2-4422880d0000 pid=3464 /usr/bin/bash guuid=8366ec3c-1700-0000-b2c2-4422870d0000 pid=3463->guuid=c037023d-1700-0000-b2c2-4422880d0000 pid=3464 clone
Score:
99%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/fdf1fc9a36c9fa06d23e26dc512f9cd71725298fedc0eca768493c27ab4744b0
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/fdf1fc9a36c9fa06d23e26dc512f9cd71725298fedc0eca768493c27ab4744b0/
Threat name:
Linux.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-07-27 18:24:44 UTC
AV detection:
11 of 24 (45.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7xy7zgrwzh5anur6e3ofcl4424lskkmp5xaozj3ije6cpk2hisya._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260727-wl9p6syxgs/
Behaviour
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.75
Link:
https://yomi.yoroi.company/submissions/fdf1fc9a36c9fa06d23e26dc512f9cd71725298fedc0eca768493c27ab4744b0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments