Bash malware family
Bash is a malware family tracked by MalwareAnalyzer by Cyble across 2 publicly analyzed samples. First seen 2026-07-28, most recently 2026-07-28. Observed ATT&CK techniques include T1059.004, T1105.
Corpus statistics
- Publicly analyzed samples: 2
- First seen: 2026-07-28
- Last seen: 2026-07-28
- Verdicts: malicious 2
- File types: shell 2
ATT&CK techniques used by Bash
Extracted command-and-control infrastructure
- 64.89.163.215 - 1 sample
- 94.154.43.80 - 1 sample
- http://64.89.163.215/bins/putita.arm - 1 sample
- http://64.89.163.215/bins/putita.arm5 - 1 sample
- http://64.89.163.215/bins/putita.arm6 - 1 sample
- http://64.89.163.215/bins/putita.arm7 - 1 sample
- http://64.89.163.215/bins/putita.m68k - 1 sample
- http://64.89.163.215/bins/putita.mips - 1 sample
- http://64.89.163.215/bins/putita.mipsrouter - 1 sample
- http://64.89.163.215/bins/putita.mpsl - 1 sample
- http://64.89.163.215/bins/putita.ppc - 1 sample
- http://64.89.163.215/bins/putita.sh4 - 1 sample
- http://64.89.163.215/bins/putita.x86 - 1 sample
- http://64.89.163.215/bins/putita.x86_64 - 1 sample
Recent Bash samples
- 78d5460db4f6d3b4ea29595b7f8077d3aa73922fe33ce3a4f18547e73c02d60e.sh - malicious (2026-07-28)
- 21ffeade7a2ca38e1cf578598afb3b6b36034e111e937300bb697dd9cbf3f7e4.sh - malicious (2026-07-28)
Frequently asked about Bash
- What is Bash?
- Bash is a malware family tracked by MalwareAnalyzer by Cyble across 2 publicly analyzed samples. First seen 2026-07-28, most recently 2026-07-28. Observed ATT&CK techniques include T1059.004, T1105.
- How many Bash samples have been analyzed?
- MalwareAnalyzer by Cyble holds 2 publicly analyzed samples attributed to Bash, first seen 2026-07-28 and most recently 2026-07-28. This counts public submissions to this platform only, so it is a measure of what we have seen rather than of the family's total prevalence.
- What MITRE ATT&CK techniques does Bash use?
- Across our Bash samples the most frequently observed techniques are T1059.004 (2), T1105 (2). Counts are the number of analyzed samples in which each technique was observed.
- What file types does Bash use?
- Bash samples in this corpus are distributed as shell (2).
- Does Bash use command-and-control infrastructure?
- Yes. 14 distinct command-and-control indicators have been extracted from Bash samples, either from static configuration or from traffic captured during sandbox detonation. The full list is published on the family page.
- Is Bash malicious?
- 2 of 2 analyzed Bash samples were scored malicious by the fused verdict, which combines multi-engine static scanning, YARA and hash reputation with behavior captured during real sandbox detonation. Each report lists every signal that contributed to its score.
Latest analyzed threats · ATT&CK coverage across the corpus · Threat trends