MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 00c74f2e5c01b344a79102edbd97fd74428ea773ef528579b3a1e1cf8fd553b1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 00c74f2e5c01b344a79102edbd97fd74428ea773ef528579b3a1e1cf8fd553b1
SHA3-384 hash: 2e96c50ed0c636cae7fa211ee265e7c39e133e10d14ee9f2683069ac975c5841832cba7fbc3cf3bcfa8926ae10995e0c
SHA1 hash: c26ee96ecc1be94bdcd024102bf1cfdcdc0dd309
MD5 hash: 90cf7198accac3b8683541cd6ef5cae5
humanhash: aspen-lion-happy-mars
File name:lil
Download: download sample
File size:844 bytes
First seen:2026-08-09 09:03:01 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 24:kXCKysE2hi0ziQvZohaefFsvmD09VuvQX:e9Qp+Msetsvm09VuYX
TLSH T10D01ABDD8810AD00409A9B6C26975558F831C3CF264A8F74BFAC6E3DEB98804B036F94
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh

Intelligence

File Origin
# of uploads :
1
# of downloads :
41
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive mirai
Link:
https://www.filescan.io/uploads/6a78426624c2208cb99f17e6/reports/6f0122dd-3ccb-4f7f-92ef-f14b99279fa3/overview
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/cfdcf513-d311-4b18-be83-a26e5ea477f1
Behavior Graph:
Download SVG
%3 guuid=248f076c-1800-0000-dcd0-f04a290c0000 pid=3113 /usr/bin/sudo guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117 /tmp/sample.bin write-file guuid=248f076c-1800-0000-dcd0-f04a290c0000 pid=3113->guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117 execve guuid=1051c271-1800-0000-dcd0-f04a2f0c0000 pid=3119 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=1051c271-1800-0000-dcd0-f04a2f0c0000 pid=3119 execve guuid=bc8e0773-1800-0000-dcd0-f04a310c0000 pid=3121 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=bc8e0773-1800-0000-dcd0-f04a310c0000 pid=3121 execve guuid=35923275-1800-0000-dcd0-f04a350c0000 pid=3125 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=35923275-1800-0000-dcd0-f04a350c0000 pid=3125 execve guuid=07a81677-1800-0000-dcd0-f04a370c0000 pid=3127 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=07a81677-1800-0000-dcd0-f04a370c0000 pid=3127 execve guuid=90cc5178-1800-0000-dcd0-f04a3b0c0000 pid=3131 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=90cc5178-1800-0000-dcd0-f04a3b0c0000 pid=3131 execve guuid=4cd2a979-1800-0000-dcd0-f04a3e0c0000 pid=3134 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=4cd2a979-1800-0000-dcd0-f04a3e0c0000 pid=3134 execve guuid=ad9dee7a-1800-0000-dcd0-f04a400c0000 pid=3136 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=ad9dee7a-1800-0000-dcd0-f04a400c0000 pid=3136 execve guuid=6dd9427c-1800-0000-dcd0-f04a410c0000 pid=3137 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=6dd9427c-1800-0000-dcd0-f04a410c0000 pid=3137 execve guuid=ccd17d7d-1800-0000-dcd0-f04a440c0000 pid=3140 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=ccd17d7d-1800-0000-dcd0-f04a440c0000 pid=3140 execve guuid=cc917b7e-1800-0000-dcd0-f04a470c0000 pid=3143 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=cc917b7e-1800-0000-dcd0-f04a470c0000 pid=3143 execve guuid=7be6967f-1800-0000-dcd0-f04a4a0c0000 pid=3146 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=7be6967f-1800-0000-dcd0-f04a4a0c0000 pid=3146 execve guuid=1cc2ff80-1800-0000-dcd0-f04a4b0c0000 pid=3147 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=1cc2ff80-1800-0000-dcd0-f04a4b0c0000 pid=3147 execve guuid=35fa4c82-1800-0000-dcd0-f04a4c0c0000 pid=3148 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=35fa4c82-1800-0000-dcd0-f04a4c0c0000 pid=3148 execve guuid=c87ac383-1800-0000-dcd0-f04a4d0c0000 pid=3149 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=c87ac383-1800-0000-dcd0-f04a4d0c0000 pid=3149 execve guuid=b4eca884-1800-0000-dcd0-f04a4e0c0000 pid=3150 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=b4eca884-1800-0000-dcd0-f04a4e0c0000 pid=3150 execve guuid=8efef085-1800-0000-dcd0-f04a500c0000 pid=3152 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=8efef085-1800-0000-dcd0-f04a500c0000 pid=3152 execve guuid=4f8c9986-1800-0000-dcd0-f04a510c0000 pid=3153 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=4f8c9986-1800-0000-dcd0-f04a510c0000 pid=3153 execve guuid=bfd63187-1800-0000-dcd0-f04a520c0000 pid=3154 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=bfd63187-1800-0000-dcd0-f04a520c0000 pid=3154 execve guuid=5edbd187-1800-0000-dcd0-f04a540c0000 pid=3156 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=5edbd187-1800-0000-dcd0-f04a540c0000 pid=3156 execve guuid=ec4d5388-1800-0000-dcd0-f04a560c0000 pid=3158 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=ec4d5388-1800-0000-dcd0-f04a560c0000 pid=3158 execve guuid=009f3e89-1800-0000-dcd0-f04a590c0000 pid=3161 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=009f3e89-1800-0000-dcd0-f04a590c0000 pid=3161 execve guuid=287edf8a-1800-0000-dcd0-f04a5e0c0000 pid=3166 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=287edf8a-1800-0000-dcd0-f04a5e0c0000 pid=3166 execve guuid=4d94e28b-1800-0000-dcd0-f04a620c0000 pid=3170 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=4d94e28b-1800-0000-dcd0-f04a620c0000 pid=3170 execve guuid=6db5518c-1800-0000-dcd0-f04a630c0000 pid=3171 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=6db5518c-1800-0000-dcd0-f04a630c0000 pid=3171 execve guuid=8a3cfe8c-1800-0000-dcd0-f04a660c0000 pid=3174 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=8a3cfe8c-1800-0000-dcd0-f04a660c0000 pid=3174 execve guuid=a481bc8d-1800-0000-dcd0-f04a690c0000 pid=3177 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=a481bc8d-1800-0000-dcd0-f04a690c0000 pid=3177 execve guuid=121b4b8e-1800-0000-dcd0-f04a6b0c0000 pid=3179 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=121b4b8e-1800-0000-dcd0-f04a6b0c0000 pid=3179 execve guuid=5b81aa8e-1800-0000-dcd0-f04a6d0c0000 pid=3181 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=5b81aa8e-1800-0000-dcd0-f04a6d0c0000 pid=3181 execve guuid=2a74068f-1800-0000-dcd0-f04a6f0c0000 pid=3183 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=2a74068f-1800-0000-dcd0-f04a6f0c0000 pid=3183 execve guuid=bb1e688f-1800-0000-dcd0-f04a700c0000 pid=3184 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=bb1e688f-1800-0000-dcd0-f04a700c0000 pid=3184 execve guuid=fb44db8f-1800-0000-dcd0-f04a720c0000 pid=3186 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=fb44db8f-1800-0000-dcd0-f04a720c0000 pid=3186 execve guuid=bb435490-1800-0000-dcd0-f04a730c0000 pid=3187 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=bb435490-1800-0000-dcd0-f04a730c0000 pid=3187 execve guuid=8b490791-1800-0000-dcd0-f04a760c0000 pid=3190 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=8b490791-1800-0000-dcd0-f04a760c0000 pid=3190 execve guuid=b4ac9c91-1800-0000-dcd0-f04a790c0000 pid=3193 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=b4ac9c91-1800-0000-dcd0-f04a790c0000 pid=3193 execve guuid=a8e02e92-1800-0000-dcd0-f04a7c0c0000 pid=3196 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=a8e02e92-1800-0000-dcd0-f04a7c0c0000 pid=3196 execve guuid=c7b7c592-1800-0000-dcd0-f04a7f0c0000 pid=3199 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=c7b7c592-1800-0000-dcd0-f04a7f0c0000 pid=3199 execve guuid=72622393-1800-0000-dcd0-f04a820c0000 pid=3202 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=72622393-1800-0000-dcd0-f04a820c0000 pid=3202 execve guuid=de8d8093-1800-0000-dcd0-f04a830c0000 pid=3203 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=de8d8093-1800-0000-dcd0-f04a830c0000 pid=3203 execve guuid=15ecdc93-1800-0000-dcd0-f04a850c0000 pid=3205 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=15ecdc93-1800-0000-dcd0-f04a850c0000 pid=3205 execve guuid=a4b0b694-1800-0000-dcd0-f04a880c0000 pid=3208 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=a4b0b694-1800-0000-dcd0-f04a880c0000 pid=3208 execve guuid=6fcc3195-1800-0000-dcd0-f04a8a0c0000 pid=3210 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=6fcc3195-1800-0000-dcd0-f04a8a0c0000 pid=3210 execve guuid=b012d895-1800-0000-dcd0-f04a8d0c0000 pid=3213 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=b012d895-1800-0000-dcd0-f04a8d0c0000 pid=3213 execve guuid=d82a7496-1800-0000-dcd0-f04a900c0000 pid=3216 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=d82a7496-1800-0000-dcd0-f04a900c0000 pid=3216 execve guuid=c3561397-1800-0000-dcd0-f04a920c0000 pid=3218 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=c3561397-1800-0000-dcd0-f04a920c0000 pid=3218 execve guuid=3f557d97-1800-0000-dcd0-f04a940c0000 pid=3220 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=3f557d97-1800-0000-dcd0-f04a940c0000 pid=3220 execve guuid=410ae097-1800-0000-dcd0-f04a960c0000 pid=3222 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=410ae097-1800-0000-dcd0-f04a960c0000 pid=3222 execve guuid=a4714998-1800-0000-dcd0-f04a980c0000 pid=3224 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=a4714998-1800-0000-dcd0-f04a980c0000 pid=3224 execve guuid=6126ad98-1800-0000-dcd0-f04a9b0c0000 pid=3227 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=6126ad98-1800-0000-dcd0-f04a9b0c0000 pid=3227 execve guuid=b8e30b99-1800-0000-dcd0-f04a9d0c0000 pid=3229 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=b8e30b99-1800-0000-dcd0-f04a9d0c0000 pid=3229 execve guuid=ff447699-1800-0000-dcd0-f04a9f0c0000 pid=3231 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=ff447699-1800-0000-dcd0-f04a9f0c0000 pid=3231 execve guuid=e913f699-1800-0000-dcd0-f04aa00c0000 pid=3232 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=e913f699-1800-0000-dcd0-f04aa00c0000 pid=3232 execve guuid=8d50729a-1800-0000-dcd0-f04aa10c0000 pid=3233 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=8d50729a-1800-0000-dcd0-f04aa10c0000 pid=3233 execve guuid=074ad59a-1800-0000-dcd0-f04aa30c0000 pid=3235 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=074ad59a-1800-0000-dcd0-f04aa30c0000 pid=3235 execve guuid=23db319b-1800-0000-dcd0-f04aa50c0000 pid=3237 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=23db319b-1800-0000-dcd0-f04aa50c0000 pid=3237 execve guuid=0f118d9b-1800-0000-dcd0-f04aa60c0000 pid=3238 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=0f118d9b-1800-0000-dcd0-f04aa60c0000 pid=3238 execve guuid=9f8ce89b-1800-0000-dcd0-f04aa80c0000 pid=3240 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=9f8ce89b-1800-0000-dcd0-f04aa80c0000 pid=3240 execve guuid=36b65b9c-1800-0000-dcd0-f04aa90c0000 pid=3241 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=36b65b9c-1800-0000-dcd0-f04aa90c0000 pid=3241 execve guuid=030dc89c-1800-0000-dcd0-f04aab0c0000 pid=3243 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=030dc89c-1800-0000-dcd0-f04aab0c0000 pid=3243 execve guuid=2107279d-1800-0000-dcd0-f04aad0c0000 pid=3245 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=2107279d-1800-0000-dcd0-f04aad0c0000 pid=3245 execve guuid=69cec89d-1800-0000-dcd0-f04aaf0c0000 pid=3247 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=69cec89d-1800-0000-dcd0-f04aaf0c0000 pid=3247 execve guuid=41d92e9e-1800-0000-dcd0-f04ab10c0000 pid=3249 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=41d92e9e-1800-0000-dcd0-f04ab10c0000 pid=3249 execve guuid=b587949e-1800-0000-dcd0-f04ab30c0000 pid=3251 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=b587949e-1800-0000-dcd0-f04ab30c0000 pid=3251 execve guuid=6077fb9e-1800-0000-dcd0-f04ab50c0000 pid=3253 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=6077fb9e-1800-0000-dcd0-f04ab50c0000 pid=3253 execve guuid=66e9659f-1800-0000-dcd0-f04ab70c0000 pid=3255 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=66e9659f-1800-0000-dcd0-f04ab70c0000 pid=3255 execve guuid=d25fd39f-1800-0000-dcd0-f04ab90c0000 pid=3257 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=d25fd39f-1800-0000-dcd0-f04ab90c0000 pid=3257 execve guuid=5f7ce2a0-1800-0000-dcd0-f04abd0c0000 pid=3261 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=5f7ce2a0-1800-0000-dcd0-f04abd0c0000 pid=3261 execve guuid=054463a1-1800-0000-dcd0-f04ac00c0000 pid=3264 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=054463a1-1800-0000-dcd0-f04ac00c0000 pid=3264 execve guuid=19ccdca1-1800-0000-dcd0-f04ac20c0000 pid=3266 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=19ccdca1-1800-0000-dcd0-f04ac20c0000 pid=3266 execve guuid=ad683da2-1800-0000-dcd0-f04ac40c0000 pid=3268 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=ad683da2-1800-0000-dcd0-f04ac40c0000 pid=3268 execve guuid=f9f299a2-1800-0000-dcd0-f04ac60c0000 pid=3270 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=f9f299a2-1800-0000-dcd0-f04ac60c0000 pid=3270 execve guuid=8aa7f4a2-1800-0000-dcd0-f04ac70c0000 pid=3271 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=8aa7f4a2-1800-0000-dcd0-f04ac70c0000 pid=3271 execve guuid=bd9652a3-1800-0000-dcd0-f04ac90c0000 pid=3273 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=bd9652a3-1800-0000-dcd0-f04ac90c0000 pid=3273 execve guuid=d1b4b0a3-1800-0000-dcd0-f04acb0c0000 pid=3275 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=d1b4b0a3-1800-0000-dcd0-f04acb0c0000 pid=3275 execve guuid=1dcd3ca4-1800-0000-dcd0-f04acd0c0000 pid=3277 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=1dcd3ca4-1800-0000-dcd0-f04acd0c0000 pid=3277 execve guuid=49f4c6a4-1800-0000-dcd0-f04ad00c0000 pid=3280 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=49f4c6a4-1800-0000-dcd0-f04ad00c0000 pid=3280 execve guuid=20ff58a5-1800-0000-dcd0-f04ad20c0000 pid=3282 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=20ff58a5-1800-0000-dcd0-f04ad20c0000 pid=3282 execve guuid=70c701a6-1800-0000-dcd0-f04ad30c0000 pid=3283 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=70c701a6-1800-0000-dcd0-f04ad30c0000 pid=3283 execve guuid=6e86c3a6-1800-0000-dcd0-f04ad40c0000 pid=3284 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=6e86c3a6-1800-0000-dcd0-f04ad40c0000 pid=3284 execve guuid=74e580a7-1800-0000-dcd0-f04ad50c0000 pid=3285 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=74e580a7-1800-0000-dcd0-f04ad50c0000 pid=3285 execve guuid=59d03ba8-1800-0000-dcd0-f04ad60c0000 pid=3286 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=59d03ba8-1800-0000-dcd0-f04ad60c0000 pid=3286 execve guuid=7f82f9a8-1800-0000-dcd0-f04ad70c0000 pid=3287 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=7f82f9a8-1800-0000-dcd0-f04ad70c0000 pid=3287 execve guuid=f34bc1a9-1800-0000-dcd0-f04ad80c0000 pid=3288 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=f34bc1a9-1800-0000-dcd0-f04ad80c0000 pid=3288 execve guuid=739c4faa-1800-0000-dcd0-f04ad90c0000 pid=3289 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=739c4faa-1800-0000-dcd0-f04ad90c0000 pid=3289 execve guuid=0b1bb7aa-1800-0000-dcd0-f04ada0c0000 pid=3290 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=0b1bb7aa-1800-0000-dcd0-f04ada0c0000 pid=3290 execve guuid=ba3946ab-1800-0000-dcd0-f04adb0c0000 pid=3291 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=ba3946ab-1800-0000-dcd0-f04adb0c0000 pid=3291 execve guuid=3fdb06ac-1800-0000-dcd0-f04adc0c0000 pid=3292 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=3fdb06ac-1800-0000-dcd0-f04adc0c0000 pid=3292 execve guuid=c59edcac-1800-0000-dcd0-f04add0c0000 pid=3293 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=c59edcac-1800-0000-dcd0-f04add0c0000 pid=3293 execve guuid=668e79ad-1800-0000-dcd0-f04ade0c0000 pid=3294 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=668e79ad-1800-0000-dcd0-f04ade0c0000 pid=3294 execve guuid=93daf0ad-1800-0000-dcd0-f04adf0c0000 pid=3295 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=93daf0ad-1800-0000-dcd0-f04adf0c0000 pid=3295 execve guuid=3a9265ae-1800-0000-dcd0-f04ae00c0000 pid=3296 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=3a9265ae-1800-0000-dcd0-f04ae00c0000 pid=3296 execve guuid=0bf6d9ae-1800-0000-dcd0-f04ae10c0000 pid=3297 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=0bf6d9ae-1800-0000-dcd0-f04ae10c0000 pid=3297 execve guuid=bbc34faf-1800-0000-dcd0-f04ae20c0000 pid=3298 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=bbc34faf-1800-0000-dcd0-f04ae20c0000 pid=3298 execve guuid=add3d3af-1800-0000-dcd0-f04ae30c0000 pid=3299 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=add3d3af-1800-0000-dcd0-f04ae30c0000 pid=3299 execve guuid=83ca5bb0-1800-0000-dcd0-f04ae40c0000 pid=3300 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=83ca5bb0-1800-0000-dcd0-f04ae40c0000 pid=3300 execve guuid=b93eddb0-1800-0000-dcd0-f04ae50c0000 pid=3301 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=b93eddb0-1800-0000-dcd0-f04ae50c0000 pid=3301 execve guuid=e6204cb1-1800-0000-dcd0-f04ae60c0000 pid=3302 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=e6204cb1-1800-0000-dcd0-f04ae60c0000 pid=3302 execve guuid=fc76beb1-1800-0000-dcd0-f04ae70c0000 pid=3303 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=fc76beb1-1800-0000-dcd0-f04ae70c0000 pid=3303 execve guuid=4bc72eb2-1800-0000-dcd0-f04ae80c0000 pid=3304 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=4bc72eb2-1800-0000-dcd0-f04ae80c0000 pid=3304 execve guuid=ad13a3b2-1800-0000-dcd0-f04ae90c0000 pid=3305 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=ad13a3b2-1800-0000-dcd0-f04ae90c0000 pid=3305 execve guuid=5f4814b3-1800-0000-dcd0-f04aea0c0000 pid=3306 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=5f4814b3-1800-0000-dcd0-f04aea0c0000 pid=3306 execve guuid=35da8bb3-1800-0000-dcd0-f04aeb0c0000 pid=3307 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=35da8bb3-1800-0000-dcd0-f04aeb0c0000 pid=3307 execve guuid=d41efab3-1800-0000-dcd0-f04aec0c0000 pid=3308 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=d41efab3-1800-0000-dcd0-f04aec0c0000 pid=3308 execve guuid=65cae4b4-1800-0000-dcd0-f04aee0c0000 pid=3310 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=65cae4b4-1800-0000-dcd0-f04aee0c0000 pid=3310 execve guuid=e3d468b5-1800-0000-dcd0-f04aef0c0000 pid=3311 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=e3d468b5-1800-0000-dcd0-f04aef0c0000 pid=3311 execve guuid=ac56ebb5-1800-0000-dcd0-f04af00c0000 pid=3312 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=ac56ebb5-1800-0000-dcd0-f04af00c0000 pid=3312 execve guuid=ae0575b6-1800-0000-dcd0-f04af10c0000 pid=3313 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=ae0575b6-1800-0000-dcd0-f04af10c0000 pid=3313 execve guuid=94f0edb6-1800-0000-dcd0-f04af20c0000 pid=3314 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=94f0edb6-1800-0000-dcd0-f04af20c0000 pid=3314 execve guuid=653a62b7-1800-0000-dcd0-f04af30c0000 pid=3315 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=653a62b7-1800-0000-dcd0-f04af30c0000 pid=3315 execve guuid=9244d6b7-1800-0000-dcd0-f04af40c0000 pid=3316 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=9244d6b7-1800-0000-dcd0-f04af40c0000 pid=3316 execve guuid=88f840b8-1800-0000-dcd0-f04af60c0000 pid=3318 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=88f840b8-1800-0000-dcd0-f04af60c0000 pid=3318 execve guuid=a319abb8-1800-0000-dcd0-f04af80c0000 pid=3320 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=a319abb8-1800-0000-dcd0-f04af80c0000 pid=3320 execve guuid=1cac0ab9-1800-0000-dcd0-f04afa0c0000 pid=3322 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=1cac0ab9-1800-0000-dcd0-f04afa0c0000 pid=3322 execve guuid=27f477b9-1800-0000-dcd0-f04afc0c0000 pid=3324 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=27f477b9-1800-0000-dcd0-f04afc0c0000 pid=3324 execve guuid=242c61ba-1800-0000-dcd0-f04a000d0000 pid=3328 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=242c61ba-1800-0000-dcd0-f04a000d0000 pid=3328 execve guuid=1d7fb6ba-1800-0000-dcd0-f04a020d0000 pid=3330 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=1d7fb6ba-1800-0000-dcd0-f04a020d0000 pid=3330 execve guuid=ecc509bb-1800-0000-dcd0-f04a030d0000 pid=3331 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=ecc509bb-1800-0000-dcd0-f04a030d0000 pid=3331 execve guuid=56775ebb-1800-0000-dcd0-f04a060d0000 pid=3334 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=56775ebb-1800-0000-dcd0-f04a060d0000 pid=3334 execve guuid=8401b7bb-1800-0000-dcd0-f04a070d0000 pid=3335 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=8401b7bb-1800-0000-dcd0-f04a070d0000 pid=3335 execve guuid=901a14bc-1800-0000-dcd0-f04a090d0000 pid=3337 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=901a14bc-1800-0000-dcd0-f04a090d0000 pid=3337 execve guuid=aad37dbc-1800-0000-dcd0-f04a0a0d0000 pid=3338 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=aad37dbc-1800-0000-dcd0-f04a0a0d0000 pid=3338 execve guuid=b4a5f3bc-1800-0000-dcd0-f04a0b0d0000 pid=3339 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=b4a5f3bc-1800-0000-dcd0-f04a0b0d0000 pid=3339 execve guuid=71da57bd-1800-0000-dcd0-f04a0c0d0000 pid=3340 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=71da57bd-1800-0000-dcd0-f04a0c0d0000 pid=3340 execve guuid=34aec5bd-1800-0000-dcd0-f04a0d0d0000 pid=3341 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=34aec5bd-1800-0000-dcd0-f04a0d0d0000 pid=3341 execve guuid=c47a20be-1800-0000-dcd0-f04a0f0d0000 pid=3343 /usr/bin/ls guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=c47a20be-1800-0000-dcd0-f04a0f0d0000 pid=3343 execve guuid=419778be-1800-0000-dcd0-f04a120d0000 pid=3346 /usr/bin/rm guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=419778be-1800-0000-dcd0-f04a120d0000 pid=3346 execve guuid=1220b0be-1800-0000-dcd0-f04a140d0000 pid=3348 /usr/bin/wget net send-data write-file guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=1220b0be-1800-0000-dcd0-f04a140d0000 pid=3348 execve guuid=9e9903da-1800-0000-dcd0-f04a560d0000 pid=3414 /usr/bin/chmod guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=9e9903da-1800-0000-dcd0-f04a560d0000 pid=3414 execve guuid=b7877cda-1800-0000-dcd0-f04a580d0000 pid=3416 /usr/bin/dash guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=b7877cda-1800-0000-dcd0-f04a580d0000 pid=3416 clone guuid=25b269db-1800-0000-dcd0-f04a5c0d0000 pid=3420 /usr/bin/rm guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=25b269db-1800-0000-dcd0-f04a5c0d0000 pid=3420 execve guuid=64f4d4db-1800-0000-dcd0-f04a5e0d0000 pid=3422 /usr/bin/wget net send-data write-file guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=64f4d4db-1800-0000-dcd0-f04a5e0d0000 pid=3422 execve guuid=31ff21f3-1800-0000-dcd0-f04a970d0000 pid=3479 /usr/bin/chmod guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=31ff21f3-1800-0000-dcd0-f04a970d0000 pid=3479 execve guuid=8d2861f3-1800-0000-dcd0-f04a990d0000 pid=3481 /usr/bin/dash guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=8d2861f3-1800-0000-dcd0-f04a990d0000 pid=3481 clone guuid=a3cb03f4-1800-0000-dcd0-f04a9d0d0000 pid=3485 /usr/bin/rm guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=a3cb03f4-1800-0000-dcd0-f04a9d0d0000 pid=3485 execve guuid=5e3e63f4-1800-0000-dcd0-f04a9f0d0000 pid=3487 /usr/bin/wget net send-data write-file guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=5e3e63f4-1800-0000-dcd0-f04a9f0d0000 pid=3487 execve guuid=1e21230c-1900-0000-dcd0-f04ac70d0000 pid=3527 /usr/bin/chmod guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=1e21230c-1900-0000-dcd0-f04ac70d0000 pid=3527 execve guuid=1b305f0c-1900-0000-dcd0-f04ac80d0000 pid=3528 /usr/bin/dash guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=1b305f0c-1900-0000-dcd0-f04ac80d0000 pid=3528 clone guuid=ba14f00c-1900-0000-dcd0-f04aca0d0000 pid=3530 /usr/bin/rm guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=ba14f00c-1900-0000-dcd0-f04aca0d0000 pid=3530 execve guuid=7a8b2f0d-1900-0000-dcd0-f04acb0d0000 pid=3531 /usr/bin/wget net send-data write-file guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=7a8b2f0d-1900-0000-dcd0-f04acb0d0000 pid=3531 execve guuid=a3c5212b-1900-0000-dcd0-f04a1a0e0000 pid=3610 /usr/bin/chmod guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=a3c5212b-1900-0000-dcd0-f04a1a0e0000 pid=3610 execve guuid=8bee6c2b-1900-0000-dcd0-f04a1b0e0000 pid=3611 /usr/bin/dash guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=8bee6c2b-1900-0000-dcd0-f04a1b0e0000 pid=3611 clone guuid=36630a2d-1900-0000-dcd0-f04a220e0000 pid=3618 /usr/bin/rm guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=36630a2d-1900-0000-dcd0-f04a220e0000 pid=3618 execve guuid=a018872d-1900-0000-dcd0-f04a250e0000 pid=3621 /usr/bin/wget net send-data write-file guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=a018872d-1900-0000-dcd0-f04a250e0000 pid=3621 execve guuid=f628474b-1900-0000-dcd0-f04a670e0000 pid=3687 /usr/bin/chmod guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=f628474b-1900-0000-dcd0-f04a670e0000 pid=3687 execve guuid=27f2904b-1900-0000-dcd0-f04a680e0000 pid=3688 /usr/bin/dash guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=27f2904b-1900-0000-dcd0-f04a680e0000 pid=3688 clone guuid=9db2374c-1900-0000-dcd0-f04a6a0e0000 pid=3690 /usr/bin/rm delete-file guuid=b59cf870-1800-0000-dcd0-f04a2d0c0000 pid=3117->guuid=9db2374c-1900-0000-dcd0-f04a6a0e0000 pid=3690 execve 801186e6-5fe8-5959-a7b4-832d8d66e7aa 129.121.114.124:80 guuid=1220b0be-1800-0000-dcd0-f04a140d0000 pid=3348->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 133B guuid=64f4d4db-1800-0000-dcd0-f04a5e0d0000 pid=3422->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 134B guuid=5e3e63f4-1800-0000-dcd0-f04a9f0d0000 pid=3487->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 133B guuid=7a8b2f0d-1900-0000-dcd0-f04acb0d0000 pid=3531->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 133B guuid=a018872d-1900-0000-dcd0-f04a250e0000 pid=3621->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 134B
Score:
94%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/00c74f2e5c01b344a79102edbd97fd74428ea773ef528579b3a1e1cf8fd553b1
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/00c74f2e5c01b344a79102edbd97fd74428ea773ef528579b3a1e1cf8fd553b1/
Gathering data
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=addu6ls4agzujj4ralw33f75orbi5j3t55jik6ntuhq47d6vkoyq._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
discovery linux
Link:
https://tria.ge/reports/260809-k1b7nscl4v/
Behaviour
Reads runtime system information
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.26
Link:
https://yomi.yoroi.company/submissions/00c74f2e5c01b344a79102edbd97fd74428ea773ef528579b3a1e1cf8fd553b1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 00c74f2e5c01b344a79102edbd97fd74428ea773ef528579b3a1e1cf8fd553b1

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3874630/
  
Delivery method
Distributed via web download

Comments