MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 014f5068274dc499a77cac8ec4e0168ed142cdfd29a772a721ca65b35cd467f9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 014f5068274dc499a77cac8ec4e0168ed142cdfd29a772a721ca65b35cd467f9
SHA3-384 hash: e5564b18691a3e48e2f5c4ea75e71d51f6e601728511707aa3e5efccf3f009abcc97e710afdac37a6cc281f850e5db38
SHA1 hash: c92a8b3638c4cc8288c5023a7709abb1838b3d82
MD5 hash: 5eb866b15c92f98ecdf5d3e590705267
humanhash: failed-finch-wisconsin-comet
File name:lil
Download: download sample
File size:844 bytes
First seen:2026-08-09 20:07:42 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkaqCouEgtC9Wz+CxFDCVKnzbRaC1YX:kXCKysE2hi0ziQvZohaq+EynSMDSEw9X
TLSH T18401ABC6D2146A1040EAD99D22976494F832C3C7154B4F79BF6CA43F9F98E04B02AF98
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://129.121.110.105/VOgAn/an/aua-wget
http://129.121.110.105/vJBn/an/aua-wget
http://129.121.110.105/sCyn/an/aua-wget
http://129.121.110.105/ZTMen/an/aua-wget
http://129.121.110.105/JPOn/an/aua-wget

Intelligence

File Origin
# of uploads :
1
# of downloads :
45
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive mirai
Link:
https://www.filescan.io/uploads/6a78de380ebf10d943f11744/reports/d35be82e-2bb8-4d4d-a16f-706028b7e1b5/overview
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/3a2a40b3-9273-4f8c-a513-7e1dfe4ee48e
Behavior Graph:
Download SVG
%3 guuid=0ba448f5-1900-0000-76c1-949cd00a0000 pid=2768 /usr/bin/sudo guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776 /tmp/sample.bin write-file guuid=0ba448f5-1900-0000-76c1-949cd00a0000 pid=2768->guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776 execve guuid=03145bf9-1900-0000-76c1-949cd90a0000 pid=2777 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=03145bf9-1900-0000-76c1-949cd90a0000 pid=2777 execve guuid=11a756fa-1900-0000-76c1-949cdb0a0000 pid=2779 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=11a756fa-1900-0000-76c1-949cdb0a0000 pid=2779 execve guuid=909b03fb-1900-0000-76c1-949cdd0a0000 pid=2781 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=909b03fb-1900-0000-76c1-949cdd0a0000 pid=2781 execve guuid=4e06a8fb-1900-0000-76c1-949cdf0a0000 pid=2783 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=4e06a8fb-1900-0000-76c1-949cdf0a0000 pid=2783 execve guuid=b85a44fc-1900-0000-76c1-949ce00a0000 pid=2784 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=b85a44fc-1900-0000-76c1-949ce00a0000 pid=2784 execve guuid=859edffc-1900-0000-76c1-949ce20a0000 pid=2786 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=859edffc-1900-0000-76c1-949ce20a0000 pid=2786 execve guuid=63397afd-1900-0000-76c1-949ce40a0000 pid=2788 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=63397afd-1900-0000-76c1-949ce40a0000 pid=2788 execve guuid=f13a11fe-1900-0000-76c1-949ce60a0000 pid=2790 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=f13a11fe-1900-0000-76c1-949ce60a0000 pid=2790 execve guuid=1f0f1dff-1900-0000-76c1-949ce70a0000 pid=2791 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=1f0f1dff-1900-0000-76c1-949ce70a0000 pid=2791 execve guuid=4f3c3200-1a00-0000-76c1-949ce80a0000 pid=2792 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=4f3c3200-1a00-0000-76c1-949ce80a0000 pid=2792 execve guuid=72ad3f01-1a00-0000-76c1-949cec0a0000 pid=2796 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=72ad3f01-1a00-0000-76c1-949cec0a0000 pid=2796 execve guuid=b932ba01-1a00-0000-76c1-949cef0a0000 pid=2799 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=b932ba01-1a00-0000-76c1-949cef0a0000 pid=2799 execve guuid=c5d5a802-1a00-0000-76c1-949cf20a0000 pid=2802 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=c5d5a802-1a00-0000-76c1-949cf20a0000 pid=2802 execve guuid=e359b403-1a00-0000-76c1-949cf30a0000 pid=2803 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=e359b403-1a00-0000-76c1-949cf30a0000 pid=2803 execve guuid=5433bc04-1a00-0000-76c1-949cf40a0000 pid=2804 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=5433bc04-1a00-0000-76c1-949cf40a0000 pid=2804 execve guuid=0e5df205-1a00-0000-76c1-949cf50a0000 pid=2805 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=0e5df205-1a00-0000-76c1-949cf50a0000 pid=2805 execve guuid=341ede06-1a00-0000-76c1-949cf70a0000 pid=2807 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=341ede06-1a00-0000-76c1-949cf70a0000 pid=2807 execve guuid=5e178d07-1a00-0000-76c1-949cf80a0000 pid=2808 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=5e178d07-1a00-0000-76c1-949cf80a0000 pid=2808 execve guuid=588d3e08-1a00-0000-76c1-949cfa0a0000 pid=2810 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=588d3e08-1a00-0000-76c1-949cfa0a0000 pid=2810 execve guuid=d03bea08-1a00-0000-76c1-949cfc0a0000 pid=2812 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=d03bea08-1a00-0000-76c1-949cfc0a0000 pid=2812 execve guuid=5f7cba09-1a00-0000-76c1-949c000b0000 pid=2816 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=5f7cba09-1a00-0000-76c1-949c000b0000 pid=2816 execve guuid=9f47570a-1a00-0000-76c1-949c030b0000 pid=2819 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=9f47570a-1a00-0000-76c1-949c030b0000 pid=2819 execve guuid=8ae41b0b-1a00-0000-76c1-949c060b0000 pid=2822 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=8ae41b0b-1a00-0000-76c1-949c060b0000 pid=2822 execve guuid=7800eb0b-1a00-0000-76c1-949c080b0000 pid=2824 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=7800eb0b-1a00-0000-76c1-949c080b0000 pid=2824 execve guuid=68ce910c-1a00-0000-76c1-949c090b0000 pid=2825 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=68ce910c-1a00-0000-76c1-949c090b0000 pid=2825 execve guuid=c37d3f0d-1a00-0000-76c1-949c0a0b0000 pid=2826 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=c37d3f0d-1a00-0000-76c1-949c0a0b0000 pid=2826 execve guuid=cd47e70d-1a00-0000-76c1-949c0b0b0000 pid=2827 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=cd47e70d-1a00-0000-76c1-949c0b0b0000 pid=2827 execve guuid=e23c820e-1a00-0000-76c1-949c0c0b0000 pid=2828 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=e23c820e-1a00-0000-76c1-949c0c0b0000 pid=2828 execve guuid=7782690f-1a00-0000-76c1-949c0d0b0000 pid=2829 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=7782690f-1a00-0000-76c1-949c0d0b0000 pid=2829 execve guuid=d83e7810-1a00-0000-76c1-949c0e0b0000 pid=2830 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=d83e7810-1a00-0000-76c1-949c0e0b0000 pid=2830 execve guuid=18383011-1a00-0000-76c1-949c0f0b0000 pid=2831 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=18383011-1a00-0000-76c1-949c0f0b0000 pid=2831 execve guuid=dee36a12-1a00-0000-76c1-949c100b0000 pid=2832 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=dee36a12-1a00-0000-76c1-949c100b0000 pid=2832 execve guuid=eeb18113-1a00-0000-76c1-949c110b0000 pid=2833 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=eeb18113-1a00-0000-76c1-949c110b0000 pid=2833 execve guuid=c5267f14-1a00-0000-76c1-949c120b0000 pid=2834 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=c5267f14-1a00-0000-76c1-949c120b0000 pid=2834 execve guuid=a9e5ca15-1a00-0000-76c1-949c130b0000 pid=2835 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=a9e5ca15-1a00-0000-76c1-949c130b0000 pid=2835 execve guuid=fe256e16-1a00-0000-76c1-949c140b0000 pid=2836 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=fe256e16-1a00-0000-76c1-949c140b0000 pid=2836 execve guuid=52ce1517-1a00-0000-76c1-949c150b0000 pid=2837 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=52ce1517-1a00-0000-76c1-949c150b0000 pid=2837 execve guuid=e415ae17-1a00-0000-76c1-949c160b0000 pid=2838 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=e415ae17-1a00-0000-76c1-949c160b0000 pid=2838 execve guuid=a5e05b18-1a00-0000-76c1-949c170b0000 pid=2839 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=a5e05b18-1a00-0000-76c1-949c170b0000 pid=2839 execve guuid=fe75dc18-1a00-0000-76c1-949c180b0000 pid=2840 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=fe75dc18-1a00-0000-76c1-949c180b0000 pid=2840 execve guuid=eaba7819-1a00-0000-76c1-949c190b0000 pid=2841 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=eaba7819-1a00-0000-76c1-949c190b0000 pid=2841 execve guuid=c635071a-1a00-0000-76c1-949c1a0b0000 pid=2842 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=c635071a-1a00-0000-76c1-949c1a0b0000 pid=2842 execve guuid=45fb8c1a-1a00-0000-76c1-949c1b0b0000 pid=2843 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=45fb8c1a-1a00-0000-76c1-949c1b0b0000 pid=2843 execve guuid=d218f91a-1a00-0000-76c1-949c1c0b0000 pid=2844 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=d218f91a-1a00-0000-76c1-949c1c0b0000 pid=2844 execve guuid=683b731b-1a00-0000-76c1-949c1d0b0000 pid=2845 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=683b731b-1a00-0000-76c1-949c1d0b0000 pid=2845 execve guuid=0c76f61b-1a00-0000-76c1-949c1e0b0000 pid=2846 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=0c76f61b-1a00-0000-76c1-949c1e0b0000 pid=2846 execve guuid=880a681c-1a00-0000-76c1-949c1f0b0000 pid=2847 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=880a681c-1a00-0000-76c1-949c1f0b0000 pid=2847 execve guuid=ee75d71c-1a00-0000-76c1-949c200b0000 pid=2848 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=ee75d71c-1a00-0000-76c1-949c200b0000 pid=2848 execve guuid=bb55521d-1a00-0000-76c1-949c210b0000 pid=2849 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=bb55521d-1a00-0000-76c1-949c210b0000 pid=2849 execve guuid=f161de1d-1a00-0000-76c1-949c220b0000 pid=2850 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=f161de1d-1a00-0000-76c1-949c220b0000 pid=2850 execve guuid=8580871e-1a00-0000-76c1-949c230b0000 pid=2851 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=8580871e-1a00-0000-76c1-949c230b0000 pid=2851 execve guuid=c8050a1f-1a00-0000-76c1-949c240b0000 pid=2852 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=c8050a1f-1a00-0000-76c1-949c240b0000 pid=2852 execve guuid=ab8ca11f-1a00-0000-76c1-949c250b0000 pid=2853 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=ab8ca11f-1a00-0000-76c1-949c250b0000 pid=2853 execve guuid=871e8b20-1a00-0000-76c1-949c260b0000 pid=2854 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=871e8b20-1a00-0000-76c1-949c260b0000 pid=2854 execve guuid=696c2421-1a00-0000-76c1-949c270b0000 pid=2855 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=696c2421-1a00-0000-76c1-949c270b0000 pid=2855 execve guuid=14efc221-1a00-0000-76c1-949c280b0000 pid=2856 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=14efc221-1a00-0000-76c1-949c280b0000 pid=2856 execve guuid=0ca06722-1a00-0000-76c1-949c290b0000 pid=2857 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=0ca06722-1a00-0000-76c1-949c290b0000 pid=2857 execve guuid=3ae91a23-1a00-0000-76c1-949c2a0b0000 pid=2858 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=3ae91a23-1a00-0000-76c1-949c2a0b0000 pid=2858 execve guuid=cef0bd23-1a00-0000-76c1-949c2b0b0000 pid=2859 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=cef0bd23-1a00-0000-76c1-949c2b0b0000 pid=2859 execve guuid=33963d24-1a00-0000-76c1-949c2c0b0000 pid=2860 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=33963d24-1a00-0000-76c1-949c2c0b0000 pid=2860 execve guuid=2debbe24-1a00-0000-76c1-949c2e0b0000 pid=2862 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=2debbe24-1a00-0000-76c1-949c2e0b0000 pid=2862 execve guuid=28864825-1a00-0000-76c1-949c2f0b0000 pid=2863 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=28864825-1a00-0000-76c1-949c2f0b0000 pid=2863 execve guuid=4723f025-1a00-0000-76c1-949c300b0000 pid=2864 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=4723f025-1a00-0000-76c1-949c300b0000 pid=2864 execve guuid=c26c7b26-1a00-0000-76c1-949c310b0000 pid=2865 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=c26c7b26-1a00-0000-76c1-949c310b0000 pid=2865 execve guuid=f9b9e526-1a00-0000-76c1-949c320b0000 pid=2866 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=f9b9e526-1a00-0000-76c1-949c320b0000 pid=2866 execve guuid=88623e27-1a00-0000-76c1-949c330b0000 pid=2867 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=88623e27-1a00-0000-76c1-949c330b0000 pid=2867 execve guuid=c2e7a227-1a00-0000-76c1-949c340b0000 pid=2868 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=c2e7a227-1a00-0000-76c1-949c340b0000 pid=2868 execve guuid=2a730428-1a00-0000-76c1-949c350b0000 pid=2869 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=2a730428-1a00-0000-76c1-949c350b0000 pid=2869 execve guuid=0bf66028-1a00-0000-76c1-949c360b0000 pid=2870 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=0bf66028-1a00-0000-76c1-949c360b0000 pid=2870 execve guuid=cba0c028-1a00-0000-76c1-949c370b0000 pid=2871 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=cba0c028-1a00-0000-76c1-949c370b0000 pid=2871 execve guuid=56ae2029-1a00-0000-76c1-949c380b0000 pid=2872 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=56ae2029-1a00-0000-76c1-949c380b0000 pid=2872 execve guuid=b19f8129-1a00-0000-76c1-949c390b0000 pid=2873 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=b19f8129-1a00-0000-76c1-949c390b0000 pid=2873 execve guuid=fd9ae029-1a00-0000-76c1-949c3a0b0000 pid=2874 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=fd9ae029-1a00-0000-76c1-949c3a0b0000 pid=2874 execve guuid=6ba25b2a-1a00-0000-76c1-949c3c0b0000 pid=2876 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=6ba25b2a-1a00-0000-76c1-949c3c0b0000 pid=2876 execve guuid=3e8fdf2a-1a00-0000-76c1-949c3d0b0000 pid=2877 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=3e8fdf2a-1a00-0000-76c1-949c3d0b0000 pid=2877 execve guuid=e588682b-1a00-0000-76c1-949c3f0b0000 pid=2879 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=e588682b-1a00-0000-76c1-949c3f0b0000 pid=2879 execve guuid=6222032c-1a00-0000-76c1-949c410b0000 pid=2881 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=6222032c-1a00-0000-76c1-949c410b0000 pid=2881 execve guuid=ad73872c-1a00-0000-76c1-949c420b0000 pid=2882 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=ad73872c-1a00-0000-76c1-949c420b0000 pid=2882 execve guuid=18ff5c2d-1a00-0000-76c1-949c440b0000 pid=2884 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=18ff5c2d-1a00-0000-76c1-949c440b0000 pid=2884 execve guuid=42abbe2d-1a00-0000-76c1-949c460b0000 pid=2886 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=42abbe2d-1a00-0000-76c1-949c460b0000 pid=2886 execve guuid=ee40192e-1a00-0000-76c1-949c470b0000 pid=2887 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=ee40192e-1a00-0000-76c1-949c470b0000 pid=2887 execve guuid=3759792e-1a00-0000-76c1-949c490b0000 pid=2889 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=3759792e-1a00-0000-76c1-949c490b0000 pid=2889 execve guuid=ca29122f-1a00-0000-76c1-949c4a0b0000 pid=2890 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=ca29122f-1a00-0000-76c1-949c4a0b0000 pid=2890 execve guuid=a47aa82f-1a00-0000-76c1-949c4b0b0000 pid=2891 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=a47aa82f-1a00-0000-76c1-949c4b0b0000 pid=2891 execve guuid=153d3d30-1a00-0000-76c1-949c4c0b0000 pid=2892 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=153d3d30-1a00-0000-76c1-949c4c0b0000 pid=2892 execve guuid=3adfd530-1a00-0000-76c1-949c4d0b0000 pid=2893 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=3adfd530-1a00-0000-76c1-949c4d0b0000 pid=2893 execve guuid=90015f31-1a00-0000-76c1-949c4e0b0000 pid=2894 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=90015f31-1a00-0000-76c1-949c4e0b0000 pid=2894 execve guuid=33d14634-1a00-0000-76c1-949c4f0b0000 pid=2895 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=33d14634-1a00-0000-76c1-949c4f0b0000 pid=2895 execve guuid=77a97235-1a00-0000-76c1-949c510b0000 pid=2897 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=77a97235-1a00-0000-76c1-949c510b0000 pid=2897 execve guuid=8f0b9336-1a00-0000-76c1-949c520b0000 pid=2898 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=8f0b9336-1a00-0000-76c1-949c520b0000 pid=2898 execve guuid=8d429b37-1a00-0000-76c1-949c530b0000 pid=2899 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=8d429b37-1a00-0000-76c1-949c530b0000 pid=2899 execve guuid=c21e5938-1a00-0000-76c1-949c550b0000 pid=2901 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=c21e5938-1a00-0000-76c1-949c550b0000 pid=2901 execve guuid=16993039-1a00-0000-76c1-949c570b0000 pid=2903 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=16993039-1a00-0000-76c1-949c570b0000 pid=2903 execve guuid=5485123a-1a00-0000-76c1-949c580b0000 pid=2904 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=5485123a-1a00-0000-76c1-949c580b0000 pid=2904 execve guuid=66e0b53a-1a00-0000-76c1-949c5a0b0000 pid=2906 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=66e0b53a-1a00-0000-76c1-949c5a0b0000 pid=2906 execve guuid=608d633b-1a00-0000-76c1-949c5b0b0000 pid=2907 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=608d633b-1a00-0000-76c1-949c5b0b0000 pid=2907 execve guuid=b51fea3b-1a00-0000-76c1-949c5c0b0000 pid=2908 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=b51fea3b-1a00-0000-76c1-949c5c0b0000 pid=2908 execve guuid=fa6e573c-1a00-0000-76c1-949c5d0b0000 pid=2909 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=fa6e573c-1a00-0000-76c1-949c5d0b0000 pid=2909 execve guuid=b485b33c-1a00-0000-76c1-949c5e0b0000 pid=2910 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=b485b33c-1a00-0000-76c1-949c5e0b0000 pid=2910 execve guuid=261a113d-1a00-0000-76c1-949c5f0b0000 pid=2911 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=261a113d-1a00-0000-76c1-949c5f0b0000 pid=2911 execve guuid=6a406f3d-1a00-0000-76c1-949c610b0000 pid=2913 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=6a406f3d-1a00-0000-76c1-949c610b0000 pid=2913 execve guuid=ab68cb3d-1a00-0000-76c1-949c620b0000 pid=2914 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=ab68cb3d-1a00-0000-76c1-949c620b0000 pid=2914 execve guuid=ac2d2c3e-1a00-0000-76c1-949c630b0000 pid=2915 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=ac2d2c3e-1a00-0000-76c1-949c630b0000 pid=2915 execve guuid=d77a883e-1a00-0000-76c1-949c640b0000 pid=2916 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=d77a883e-1a00-0000-76c1-949c640b0000 pid=2916 execve guuid=49cfe73e-1a00-0000-76c1-949c650b0000 pid=2917 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=49cfe73e-1a00-0000-76c1-949c650b0000 pid=2917 execve guuid=a1644c3f-1a00-0000-76c1-949c660b0000 pid=2918 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=a1644c3f-1a00-0000-76c1-949c660b0000 pid=2918 execve guuid=c160c03f-1a00-0000-76c1-949c670b0000 pid=2919 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=c160c03f-1a00-0000-76c1-949c670b0000 pid=2919 execve guuid=386d2b40-1a00-0000-76c1-949c680b0000 pid=2920 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=386d2b40-1a00-0000-76c1-949c680b0000 pid=2920 execve guuid=f3e89040-1a00-0000-76c1-949c690b0000 pid=2921 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=f3e89040-1a00-0000-76c1-949c690b0000 pid=2921 execve guuid=998c0c41-1a00-0000-76c1-949c6b0b0000 pid=2923 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=998c0c41-1a00-0000-76c1-949c6b0b0000 pid=2923 execve guuid=cefaa441-1a00-0000-76c1-949c6d0b0000 pid=2925 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=cefaa441-1a00-0000-76c1-949c6d0b0000 pid=2925 execve guuid=52851f42-1a00-0000-76c1-949c6e0b0000 pid=2926 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=52851f42-1a00-0000-76c1-949c6e0b0000 pid=2926 execve guuid=3e59b642-1a00-0000-76c1-949c700b0000 pid=2928 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=3e59b642-1a00-0000-76c1-949c700b0000 pid=2928 execve guuid=01f75b43-1a00-0000-76c1-949c710b0000 pid=2929 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=01f75b43-1a00-0000-76c1-949c710b0000 pid=2929 execve guuid=4f632744-1a00-0000-76c1-949c730b0000 pid=2931 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=4f632744-1a00-0000-76c1-949c730b0000 pid=2931 execve guuid=153abb44-1a00-0000-76c1-949c760b0000 pid=2934 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=153abb44-1a00-0000-76c1-949c760b0000 pid=2934 execve guuid=97093545-1a00-0000-76c1-949c770b0000 pid=2935 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=97093545-1a00-0000-76c1-949c770b0000 pid=2935 execve guuid=6c8ae645-1a00-0000-76c1-949c7b0b0000 pid=2939 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=6c8ae645-1a00-0000-76c1-949c7b0b0000 pid=2939 execve guuid=8e0d7746-1a00-0000-76c1-949c7c0b0000 pid=2940 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=8e0d7746-1a00-0000-76c1-949c7c0b0000 pid=2940 execve guuid=1c001e47-1a00-0000-76c1-949c7e0b0000 pid=2942 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=1c001e47-1a00-0000-76c1-949c7e0b0000 pid=2942 execve guuid=ff991848-1a00-0000-76c1-949c7f0b0000 pid=2943 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=ff991848-1a00-0000-76c1-949c7f0b0000 pid=2943 execve guuid=d91ceb48-1a00-0000-76c1-949c800b0000 pid=2944 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=d91ceb48-1a00-0000-76c1-949c800b0000 pid=2944 execve guuid=00fc7f49-1a00-0000-76c1-949c830b0000 pid=2947 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=00fc7f49-1a00-0000-76c1-949c830b0000 pid=2947 execve guuid=042e0e4a-1a00-0000-76c1-949c850b0000 pid=2949 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=042e0e4a-1a00-0000-76c1-949c850b0000 pid=2949 execve guuid=d38eb14a-1a00-0000-76c1-949c880b0000 pid=2952 /usr/bin/ls guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=d38eb14a-1a00-0000-76c1-949c880b0000 pid=2952 execve guuid=b7b2534b-1a00-0000-76c1-949c8b0b0000 pid=2955 /usr/bin/rm guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=b7b2534b-1a00-0000-76c1-949c8b0b0000 pid=2955 execve guuid=50cdac4b-1a00-0000-76c1-949c8d0b0000 pid=2957 /usr/bin/wget net send-data write-file guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=50cdac4b-1a00-0000-76c1-949c8d0b0000 pid=2957 execve guuid=3b53bc52-1a00-0000-76c1-949c940b0000 pid=2964 /usr/bin/chmod guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=3b53bc52-1a00-0000-76c1-949c940b0000 pid=2964 execve guuid=bd92f652-1a00-0000-76c1-949c950b0000 pid=2965 /usr/bin/dash guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=bd92f652-1a00-0000-76c1-949c950b0000 pid=2965 clone guuid=909e7d53-1a00-0000-76c1-949c980b0000 pid=2968 /usr/bin/rm guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=909e7d53-1a00-0000-76c1-949c980b0000 pid=2968 execve guuid=3004ba53-1a00-0000-76c1-949c990b0000 pid=2969 /usr/bin/wget net send-data write-file guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=3004ba53-1a00-0000-76c1-949c990b0000 pid=2969 execve guuid=97b4a457-1a00-0000-76c1-949c9d0b0000 pid=2973 /usr/bin/chmod guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=97b4a457-1a00-0000-76c1-949c9d0b0000 pid=2973 execve guuid=d2171058-1a00-0000-76c1-949c9e0b0000 pid=2974 /usr/bin/dash guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=d2171058-1a00-0000-76c1-949c9e0b0000 pid=2974 clone guuid=6d00f358-1a00-0000-76c1-949ca10b0000 pid=2977 /usr/bin/rm guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=6d00f358-1a00-0000-76c1-949ca10b0000 pid=2977 execve guuid=6acf3559-1a00-0000-76c1-949ca20b0000 pid=2978 /usr/bin/wget net send-data write-file guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=6acf3559-1a00-0000-76c1-949ca20b0000 pid=2978 execve guuid=7b30245e-1a00-0000-76c1-949caa0b0000 pid=2986 /usr/bin/chmod guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=7b30245e-1a00-0000-76c1-949caa0b0000 pid=2986 execve guuid=3b71835e-1a00-0000-76c1-949cac0b0000 pid=2988 /usr/bin/dash guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=3b71835e-1a00-0000-76c1-949cac0b0000 pid=2988 clone guuid=1ca8615f-1a00-0000-76c1-949cae0b0000 pid=2990 /usr/bin/rm guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=1ca8615f-1a00-0000-76c1-949cae0b0000 pid=2990 execve guuid=54b1c35f-1a00-0000-76c1-949cb10b0000 pid=2993 /usr/bin/wget net send-data write-file guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=54b1c35f-1a00-0000-76c1-949cb10b0000 pid=2993 execve guuid=b337e666-1a00-0000-76c1-949cc20b0000 pid=3010 /usr/bin/chmod guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=b337e666-1a00-0000-76c1-949cc20b0000 pid=3010 execve guuid=2e916567-1a00-0000-76c1-949cc30b0000 pid=3011 /usr/bin/dash guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=2e916567-1a00-0000-76c1-949cc30b0000 pid=3011 clone guuid=f6dd3568-1a00-0000-76c1-949cc60b0000 pid=3014 /usr/bin/rm guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=f6dd3568-1a00-0000-76c1-949cc60b0000 pid=3014 execve guuid=43d5a268-1a00-0000-76c1-949cc70b0000 pid=3015 /usr/bin/wget net send-data write-file guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=43d5a268-1a00-0000-76c1-949cc70b0000 pid=3015 execve guuid=0fbdb66d-1a00-0000-76c1-949cce0b0000 pid=3022 /usr/bin/chmod guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=0fbdb66d-1a00-0000-76c1-949cce0b0000 pid=3022 execve guuid=16830e6e-1a00-0000-76c1-949cd00b0000 pid=3024 /usr/bin/dash guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=16830e6e-1a00-0000-76c1-949cd00b0000 pid=3024 clone guuid=42fcfd6e-1a00-0000-76c1-949cd50b0000 pid=3029 /usr/bin/rm delete-file guuid=79ba82f8-1900-0000-76c1-949cd80a0000 pid=2776->guuid=42fcfd6e-1a00-0000-76c1-949cd50b0000 pid=3029 execve 0b1ba66e-2f8f-542f-9f7c-00dd01da057c 129.121.110.105:80 guuid=50cdac4b-1a00-0000-76c1-949c8d0b0000 pid=2957->0b1ba66e-2f8f-542f-9f7c-00dd01da057c send: 134B guuid=3004ba53-1a00-0000-76c1-949c990b0000 pid=2969->0b1ba66e-2f8f-542f-9f7c-00dd01da057c send: 133B guuid=6acf3559-1a00-0000-76c1-949ca20b0000 pid=2978->0b1ba66e-2f8f-542f-9f7c-00dd01da057c send: 133B guuid=54b1c35f-1a00-0000-76c1-949cb10b0000 pid=2993->0b1ba66e-2f8f-542f-9f7c-00dd01da057c send: 134B guuid=43d5a268-1a00-0000-76c1-949cc70b0000 pid=3015->0b1ba66e-2f8f-542f-9f7c-00dd01da057c send: 133B
Score:
94%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/014f5068274dc499a77cac8ec4e0168ed142cdfd29a772a721ca65b35cd467f9
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/014f5068274dc499a77cac8ec4e0168ed142cdfd29a772a721ca65b35cd467f9/
Threat name:
Document-HTML.Downloader.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2026-08-09 20:08:31 UTC
File Type:
Text (Shell)
AV detection:
8 of 37 (21.62%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=afhva2bhjxcjtj34vshmjyawr3iuftp5fgtxfjzbzjs3gxgum74q._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
defense_evasion discovery execution linux persistence privilege_escalation
Link:
https://tria.ge/reports/260809-ywqq6aysd1/
Behaviour
Enumerates kernel/hardware configuration
Reads runtime system information
Writes file to tmp directory
Creates/modifies Cron job
Enumerates running processes
Modifies rc script
Modifies systemd
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.26
Link:
https://yomi.yoroi.company/submissions/014f5068274dc499a77cac8ec4e0168ed142cdfd29a772a721ca65b35cd467f9

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 014f5068274dc499a77cac8ec4e0168ed142cdfd29a772a721ca65b35cd467f9

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3887344/
  
Delivery method
Distributed via web download

Comments