🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 13976fcfba58cc759e3535340ec78464f94d8d2c2806d89ff27868fce9304755. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 13976fcfba58cc759e3535340ec78464f94d8d2c2806d89ff27868fce9304755
SHA3-384 hash: 99dbddc2b34c373ec4f368c401a84ea2fa32f0f9f0035f6b5f0abca004beda91dec507e06e02ce2b940fbac0a714db00
SHA1 hash: eed7952eb8a6fcdb20d2a87f81aee74f2a15003b
MD5 hash: 2419ce8b5846d6a5275eba379c285b01
humanhash: magazine-march-london-stream
File name:lil
Download: download sample
File size:839 bytes
First seen:2026-06-03 19:38:49 UTC
Last seen:2026-06-04 08:49:37 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkaD1It8YXy8IdhUIsd8IixFJAI0HpuX:kXCKysE2hi0ziQvZohaD12m8MWX8NM+X
TLSH T13E018CC9C106961041D9E85C329B6184B811C3DB25468BA8BE7C943EDBAA78C7065F94
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://188.132.232.81/v3irn/an/aelf ua-wget
http://188.132.232.81/TG2Wn/an/aelf ua-wget
http://188.132.232.81/q7qn/an/aelf ua-wget
http://188.132.232.81/m2Ln/an/aelf ua-wget
http://188.132.232.81/ZXmn/an/aelf ua-wget

Intelligence

File Origin
# of uploads :
3
# of downloads :
59
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive
Link:
https://www.filescan.io/uploads/6a2082eb099ef368af1b8817/reports/1c356844-0c73-4ee2-aa58-f7144ebc43c9/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-06-03T16:51:00Z UTC
Last seen:
2026-06-05T06:19:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan-Downloader.Shell.Agent.a
Link:
https://opentip.kaspersky.com/13976fcfba58cc759e3535340ec78464f94d8d2c2806d89ff27868fce9304755/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/a80cf178-464d-4cde-b7d9-2b03214e2d97
Behavior Graph:
Download SVG
%3 guuid=101154b9-1600-0000-579e-6c13de0c0000 pid=3294 /usr/bin/sudo guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302 /tmp/sample.bin write-file guuid=101154b9-1600-0000-579e-6c13de0c0000 pid=3294->guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302 execve guuid=8302bbbb-1600-0000-579e-6c13e80c0000 pid=3304 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=8302bbbb-1600-0000-579e-6c13e80c0000 pid=3304 execve guuid=90f93bbc-1600-0000-579e-6c13ea0c0000 pid=3306 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=90f93bbc-1600-0000-579e-6c13ea0c0000 pid=3306 execve guuid=bb00aabc-1600-0000-579e-6c13ec0c0000 pid=3308 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=bb00aabc-1600-0000-579e-6c13ec0c0000 pid=3308 execve guuid=e5070fbd-1600-0000-579e-6c13ee0c0000 pid=3310 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=e5070fbd-1600-0000-579e-6c13ee0c0000 pid=3310 execve guuid=6cf67cbd-1600-0000-579e-6c13f00c0000 pid=3312 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=6cf67cbd-1600-0000-579e-6c13f00c0000 pid=3312 execve guuid=e517fbbd-1600-0000-579e-6c13f10c0000 pid=3313 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=e517fbbd-1600-0000-579e-6c13f10c0000 pid=3313 execve guuid=651463be-1600-0000-579e-6c13f20c0000 pid=3314 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=651463be-1600-0000-579e-6c13f20c0000 pid=3314 execve guuid=7d08c5be-1600-0000-579e-6c13f40c0000 pid=3316 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=7d08c5be-1600-0000-579e-6c13f40c0000 pid=3316 execve guuid=962886bf-1600-0000-579e-6c13f70c0000 pid=3319 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=962886bf-1600-0000-579e-6c13f70c0000 pid=3319 execve guuid=5275eabf-1600-0000-579e-6c13fa0c0000 pid=3322 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=5275eabf-1600-0000-579e-6c13fa0c0000 pid=3322 execve guuid=def44bc0-1600-0000-579e-6c13fc0c0000 pid=3324 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=def44bc0-1600-0000-579e-6c13fc0c0000 pid=3324 execve guuid=3a34c3c0-1600-0000-579e-6c13fd0c0000 pid=3325 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=3a34c3c0-1600-0000-579e-6c13fd0c0000 pid=3325 execve guuid=efe83ec1-1600-0000-579e-6c13fe0c0000 pid=3326 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=efe83ec1-1600-0000-579e-6c13fe0c0000 pid=3326 execve guuid=7f07bac1-1600-0000-579e-6c13ff0c0000 pid=3327 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=7f07bac1-1600-0000-579e-6c13ff0c0000 pid=3327 execve guuid=09e23fc2-1600-0000-579e-6c13000d0000 pid=3328 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=09e23fc2-1600-0000-579e-6c13000d0000 pid=3328 execve guuid=3077c3c2-1600-0000-579e-6c13010d0000 pid=3329 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=3077c3c2-1600-0000-579e-6c13010d0000 pid=3329 execve guuid=d7b151c3-1600-0000-579e-6c13020d0000 pid=3330 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=d7b151c3-1600-0000-579e-6c13020d0000 pid=3330 execve guuid=2071e2c3-1600-0000-579e-6c13030d0000 pid=3331 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=2071e2c3-1600-0000-579e-6c13030d0000 pid=3331 execve guuid=44bb6fc4-1600-0000-579e-6c13040d0000 pid=3332 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=44bb6fc4-1600-0000-579e-6c13040d0000 pid=3332 execve guuid=f3edf9c4-1600-0000-579e-6c13050d0000 pid=3333 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=f3edf9c4-1600-0000-579e-6c13050d0000 pid=3333 execve guuid=c88b8dc5-1600-0000-579e-6c13060d0000 pid=3334 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=c88b8dc5-1600-0000-579e-6c13060d0000 pid=3334 execve guuid=957912c6-1600-0000-579e-6c13070d0000 pid=3335 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=957912c6-1600-0000-579e-6c13070d0000 pid=3335 execve guuid=dc4593c6-1600-0000-579e-6c13080d0000 pid=3336 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=dc4593c6-1600-0000-579e-6c13080d0000 pid=3336 execve guuid=5cb70dc7-1600-0000-579e-6c13090d0000 pid=3337 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=5cb70dc7-1600-0000-579e-6c13090d0000 pid=3337 execve guuid=0d3086c7-1600-0000-579e-6c130a0d0000 pid=3338 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=0d3086c7-1600-0000-579e-6c130a0d0000 pid=3338 execve guuid=af0f0bc8-1600-0000-579e-6c130b0d0000 pid=3339 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=af0f0bc8-1600-0000-579e-6c130b0d0000 pid=3339 execve guuid=d86385c8-1600-0000-579e-6c130c0d0000 pid=3340 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=d86385c8-1600-0000-579e-6c130c0d0000 pid=3340 execve guuid=8fce0bc9-1600-0000-579e-6c130d0d0000 pid=3341 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=8fce0bc9-1600-0000-579e-6c130d0d0000 pid=3341 execve guuid=22aa90c9-1600-0000-579e-6c130e0d0000 pid=3342 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=22aa90c9-1600-0000-579e-6c130e0d0000 pid=3342 execve guuid=122906ca-1600-0000-579e-6c13100d0000 pid=3344 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=122906ca-1600-0000-579e-6c13100d0000 pid=3344 execve guuid=8e4b70ca-1600-0000-579e-6c13110d0000 pid=3345 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=8e4b70ca-1600-0000-579e-6c13110d0000 pid=3345 execve guuid=68e503cb-1600-0000-579e-6c13130d0000 pid=3347 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=68e503cb-1600-0000-579e-6c13130d0000 pid=3347 execve guuid=d09f79cb-1600-0000-579e-6c13160d0000 pid=3350 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=d09f79cb-1600-0000-579e-6c13160d0000 pid=3350 execve guuid=66ca09cc-1600-0000-579e-6c13180d0000 pid=3352 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=66ca09cc-1600-0000-579e-6c13180d0000 pid=3352 execve guuid=db8767cc-1600-0000-579e-6c131a0d0000 pid=3354 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=db8767cc-1600-0000-579e-6c131a0d0000 pid=3354 execve guuid=1339cdcc-1600-0000-579e-6c131d0d0000 pid=3357 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=1339cdcc-1600-0000-579e-6c131d0d0000 pid=3357 execve guuid=9fa333cd-1600-0000-579e-6c131f0d0000 pid=3359 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=9fa333cd-1600-0000-579e-6c131f0d0000 pid=3359 execve guuid=cdb294cd-1600-0000-579e-6c13210d0000 pid=3361 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=cdb294cd-1600-0000-579e-6c13210d0000 pid=3361 execve guuid=56faf9cd-1600-0000-579e-6c13230d0000 pid=3363 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=56faf9cd-1600-0000-579e-6c13230d0000 pid=3363 execve guuid=af0460ce-1600-0000-579e-6c13250d0000 pid=3365 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=af0460ce-1600-0000-579e-6c13250d0000 pid=3365 execve guuid=73c6e7ce-1600-0000-579e-6c13260d0000 pid=3366 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=73c6e7ce-1600-0000-579e-6c13260d0000 pid=3366 execve guuid=831e6ccf-1600-0000-579e-6c13270d0000 pid=3367 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=831e6ccf-1600-0000-579e-6c13270d0000 pid=3367 execve guuid=a68de2cf-1600-0000-579e-6c13280d0000 pid=3368 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=a68de2cf-1600-0000-579e-6c13280d0000 pid=3368 execve guuid=1d043ed0-1600-0000-579e-6c132b0d0000 pid=3371 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=1d043ed0-1600-0000-579e-6c132b0d0000 pid=3371 execve guuid=ea8f95d0-1600-0000-579e-6c132d0d0000 pid=3373 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=ea8f95d0-1600-0000-579e-6c132d0d0000 pid=3373 execve guuid=7be9edd0-1600-0000-579e-6c132f0d0000 pid=3375 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=7be9edd0-1600-0000-579e-6c132f0d0000 pid=3375 execve guuid=51843fd1-1600-0000-579e-6c13320d0000 pid=3378 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=51843fd1-1600-0000-579e-6c13320d0000 pid=3378 execve guuid=416f98d1-1600-0000-579e-6c13340d0000 pid=3380 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=416f98d1-1600-0000-579e-6c13340d0000 pid=3380 execve guuid=7a13f3d1-1600-0000-579e-6c13350d0000 pid=3381 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=7a13f3d1-1600-0000-579e-6c13350d0000 pid=3381 execve guuid=ca056cd2-1600-0000-579e-6c13360d0000 pid=3382 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=ca056cd2-1600-0000-579e-6c13360d0000 pid=3382 execve guuid=e8cadad2-1600-0000-579e-6c13370d0000 pid=3383 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=e8cadad2-1600-0000-579e-6c13370d0000 pid=3383 execve guuid=16d53ed3-1600-0000-579e-6c13390d0000 pid=3385 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=16d53ed3-1600-0000-579e-6c13390d0000 pid=3385 execve guuid=e2b193d3-1600-0000-579e-6c133b0d0000 pid=3387 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=e2b193d3-1600-0000-579e-6c133b0d0000 pid=3387 execve guuid=ca8af6d3-1600-0000-579e-6c133d0d0000 pid=3389 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=ca8af6d3-1600-0000-579e-6c133d0d0000 pid=3389 execve guuid=30785ad4-1600-0000-579e-6c133f0d0000 pid=3391 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=30785ad4-1600-0000-579e-6c133f0d0000 pid=3391 execve guuid=c08db6d4-1600-0000-579e-6c13410d0000 pid=3393 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=c08db6d4-1600-0000-579e-6c13410d0000 pid=3393 execve guuid=1fbd18d5-1600-0000-579e-6c13430d0000 pid=3395 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=1fbd18d5-1600-0000-579e-6c13430d0000 pid=3395 execve guuid=ce0b7ed5-1600-0000-579e-6c13450d0000 pid=3397 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=ce0b7ed5-1600-0000-579e-6c13450d0000 pid=3397 execve guuid=83f0eed5-1600-0000-579e-6c13460d0000 pid=3398 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=83f0eed5-1600-0000-579e-6c13460d0000 pid=3398 execve guuid=c4e45bd6-1600-0000-579e-6c13470d0000 pid=3399 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=c4e45bd6-1600-0000-579e-6c13470d0000 pid=3399 execve guuid=1cfccbd6-1600-0000-579e-6c13490d0000 pid=3401 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=1cfccbd6-1600-0000-579e-6c13490d0000 pid=3401 execve guuid=d00f50d7-1600-0000-579e-6c134b0d0000 pid=3403 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=d00f50d7-1600-0000-579e-6c134b0d0000 pid=3403 execve guuid=9edbafd7-1600-0000-579e-6c134e0d0000 pid=3406 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=9edbafd7-1600-0000-579e-6c134e0d0000 pid=3406 execve guuid=22e914d8-1600-0000-579e-6c13500d0000 pid=3408 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=22e914d8-1600-0000-579e-6c13500d0000 pid=3408 execve guuid=8b9e77d8-1600-0000-579e-6c13520d0000 pid=3410 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=8b9e77d8-1600-0000-579e-6c13520d0000 pid=3410 execve guuid=eaded2d8-1600-0000-579e-6c13540d0000 pid=3412 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=eaded2d8-1600-0000-579e-6c13540d0000 pid=3412 execve guuid=8cdc38d9-1600-0000-579e-6c13570d0000 pid=3415 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=8cdc38d9-1600-0000-579e-6c13570d0000 pid=3415 execve guuid=e12492d9-1600-0000-579e-6c13590d0000 pid=3417 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=e12492d9-1600-0000-579e-6c13590d0000 pid=3417 execve guuid=c3d5ebd9-1600-0000-579e-6c135b0d0000 pid=3419 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=c3d5ebd9-1600-0000-579e-6c135b0d0000 pid=3419 execve guuid=7b1e45da-1600-0000-579e-6c135c0d0000 pid=3420 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=7b1e45da-1600-0000-579e-6c135c0d0000 pid=3420 execve guuid=d6d5aeda-1600-0000-579e-6c135f0d0000 pid=3423 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=d6d5aeda-1600-0000-579e-6c135f0d0000 pid=3423 execve guuid=489b0adb-1600-0000-579e-6c13610d0000 pid=3425 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=489b0adb-1600-0000-579e-6c13610d0000 pid=3425 execve guuid=fd6964db-1600-0000-579e-6c13640d0000 pid=3428 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=fd6964db-1600-0000-579e-6c13640d0000 pid=3428 execve guuid=bc3453dc-1600-0000-579e-6c13680d0000 pid=3432 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=bc3453dc-1600-0000-579e-6c13680d0000 pid=3432 execve guuid=2919b7dc-1600-0000-579e-6c136a0d0000 pid=3434 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=2919b7dc-1600-0000-579e-6c136a0d0000 pid=3434 execve guuid=caa92cdd-1600-0000-579e-6c136b0d0000 pid=3435 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=caa92cdd-1600-0000-579e-6c136b0d0000 pid=3435 execve guuid=17b1bfdd-1600-0000-579e-6c136c0d0000 pid=3436 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=17b1bfdd-1600-0000-579e-6c136c0d0000 pid=3436 execve guuid=b89a37de-1600-0000-579e-6c136d0d0000 pid=3437 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=b89a37de-1600-0000-579e-6c136d0d0000 pid=3437 execve guuid=9e8599de-1600-0000-579e-6c13700d0000 pid=3440 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=9e8599de-1600-0000-579e-6c13700d0000 pid=3440 execve guuid=ffb328df-1600-0000-579e-6c13720d0000 pid=3442 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=ffb328df-1600-0000-579e-6c13720d0000 pid=3442 execve guuid=fdf7a5df-1600-0000-579e-6c13750d0000 pid=3445 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=fdf7a5df-1600-0000-579e-6c13750d0000 pid=3445 execve guuid=ce3521e0-1600-0000-579e-6c13780d0000 pid=3448 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=ce3521e0-1600-0000-579e-6c13780d0000 pid=3448 execve guuid=2bd495e0-1600-0000-579e-6c137b0d0000 pid=3451 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=2bd495e0-1600-0000-579e-6c137b0d0000 pid=3451 execve guuid=5bb30ce1-1600-0000-579e-6c137d0d0000 pid=3453 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=5bb30ce1-1600-0000-579e-6c137d0d0000 pid=3453 execve guuid=1abb7ae1-1600-0000-579e-6c13800d0000 pid=3456 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=1abb7ae1-1600-0000-579e-6c13800d0000 pid=3456 execve guuid=8990dfe1-1600-0000-579e-6c13830d0000 pid=3459 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=8990dfe1-1600-0000-579e-6c13830d0000 pid=3459 execve guuid=e5623de2-1600-0000-579e-6c13850d0000 pid=3461 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=e5623de2-1600-0000-579e-6c13850d0000 pid=3461 execve guuid=1d3f97e2-1600-0000-579e-6c13870d0000 pid=3463 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=1d3f97e2-1600-0000-579e-6c13870d0000 pid=3463 execve guuid=da75f4e2-1600-0000-579e-6c13890d0000 pid=3465 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=da75f4e2-1600-0000-579e-6c13890d0000 pid=3465 execve guuid=a10b51e3-1600-0000-579e-6c138b0d0000 pid=3467 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=a10b51e3-1600-0000-579e-6c138b0d0000 pid=3467 execve guuid=c8cdace3-1600-0000-579e-6c138d0d0000 pid=3469 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=c8cdace3-1600-0000-579e-6c138d0d0000 pid=3469 execve guuid=0df10be4-1600-0000-579e-6c138f0d0000 pid=3471 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=0df10be4-1600-0000-579e-6c138f0d0000 pid=3471 execve guuid=2fe56ce4-1600-0000-579e-6c13920d0000 pid=3474 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=2fe56ce4-1600-0000-579e-6c13920d0000 pid=3474 execve guuid=8378c6e4-1600-0000-579e-6c13940d0000 pid=3476 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=8378c6e4-1600-0000-579e-6c13940d0000 pid=3476 execve guuid=7c9c3be5-1600-0000-579e-6c13970d0000 pid=3479 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=7c9c3be5-1600-0000-579e-6c13970d0000 pid=3479 execve guuid=25f8a7e5-1600-0000-579e-6c139a0d0000 pid=3482 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=25f8a7e5-1600-0000-579e-6c139a0d0000 pid=3482 execve guuid=b08317e6-1600-0000-579e-6c139c0d0000 pid=3484 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=b08317e6-1600-0000-579e-6c139c0d0000 pid=3484 execve guuid=f7ee77e6-1600-0000-579e-6c139f0d0000 pid=3487 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=f7ee77e6-1600-0000-579e-6c139f0d0000 pid=3487 execve guuid=7f242ce7-1600-0000-579e-6c13a20d0000 pid=3490 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=7f242ce7-1600-0000-579e-6c13a20d0000 pid=3490 execve guuid=7a1888e7-1600-0000-579e-6c13a40d0000 pid=3492 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=7a1888e7-1600-0000-579e-6c13a40d0000 pid=3492 execve guuid=432fe0e7-1600-0000-579e-6c13a70d0000 pid=3495 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=432fe0e7-1600-0000-579e-6c13a70d0000 pid=3495 execve guuid=2bda42e8-1600-0000-579e-6c13a90d0000 pid=3497 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=2bda42e8-1600-0000-579e-6c13a90d0000 pid=3497 execve guuid=85ee9ce8-1600-0000-579e-6c13ab0d0000 pid=3499 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=85ee9ce8-1600-0000-579e-6c13ab0d0000 pid=3499 execve guuid=4eecf4e8-1600-0000-579e-6c13ae0d0000 pid=3502 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=4eecf4e8-1600-0000-579e-6c13ae0d0000 pid=3502 execve guuid=69f54ae9-1600-0000-579e-6c13b00d0000 pid=3504 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=69f54ae9-1600-0000-579e-6c13b00d0000 pid=3504 execve guuid=6c0c9de9-1600-0000-579e-6c13b30d0000 pid=3507 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=6c0c9de9-1600-0000-579e-6c13b30d0000 pid=3507 execve guuid=6bd9f3e9-1600-0000-579e-6c13b50d0000 pid=3509 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=6bd9f3e9-1600-0000-579e-6c13b50d0000 pid=3509 execve guuid=1d6d47ea-1600-0000-579e-6c13b80d0000 pid=3512 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=1d6d47ea-1600-0000-579e-6c13b80d0000 pid=3512 execve guuid=477e9aea-1600-0000-579e-6c13ba0d0000 pid=3514 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=477e9aea-1600-0000-579e-6c13ba0d0000 pid=3514 execve guuid=e625f1ea-1600-0000-579e-6c13bc0d0000 pid=3516 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=e625f1ea-1600-0000-579e-6c13bc0d0000 pid=3516 execve guuid=0ed152eb-1600-0000-579e-6c13bf0d0000 pid=3519 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=0ed152eb-1600-0000-579e-6c13bf0d0000 pid=3519 execve guuid=15f6aaeb-1600-0000-579e-6c13c10d0000 pid=3521 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=15f6aaeb-1600-0000-579e-6c13c10d0000 pid=3521 execve guuid=a7e00aec-1600-0000-579e-6c13c40d0000 pid=3524 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=a7e00aec-1600-0000-579e-6c13c40d0000 pid=3524 execve guuid=a03d66ec-1600-0000-579e-6c13c60d0000 pid=3526 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=a03d66ec-1600-0000-579e-6c13c60d0000 pid=3526 execve guuid=436ac5ec-1600-0000-579e-6c13c90d0000 pid=3529 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=436ac5ec-1600-0000-579e-6c13c90d0000 pid=3529 execve guuid=6b0e21ed-1600-0000-579e-6c13cb0d0000 pid=3531 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=6b0e21ed-1600-0000-579e-6c13cb0d0000 pid=3531 execve guuid=12ec7fed-1600-0000-579e-6c13ce0d0000 pid=3534 /usr/bin/ls guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=12ec7fed-1600-0000-579e-6c13ce0d0000 pid=3534 execve guuid=f1e1efed-1600-0000-579e-6c13d00d0000 pid=3536 /usr/bin/rm guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=f1e1efed-1600-0000-579e-6c13d00d0000 pid=3536 execve guuid=bd0e29ee-1600-0000-579e-6c13d20d0000 pid=3538 /usr/bin/wget net send-data write-file guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=bd0e29ee-1600-0000-579e-6c13d20d0000 pid=3538 execve guuid=0d31e456-1700-0000-579e-6c137b0e0000 pid=3707 /usr/bin/chmod guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=0d31e456-1700-0000-579e-6c137b0e0000 pid=3707 execve guuid=35f25c57-1700-0000-579e-6c137d0e0000 pid=3709 /usr/bin/dash guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=35f25c57-1700-0000-579e-6c137d0e0000 pid=3709 clone guuid=8b7c6d58-1700-0000-579e-6c13810e0000 pid=3713 /usr/bin/rm guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=8b7c6d58-1700-0000-579e-6c13810e0000 pid=3713 execve guuid=aa3fd058-1700-0000-579e-6c13830e0000 pid=3715 /usr/bin/wget net send-data write-file guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=aa3fd058-1700-0000-579e-6c13830e0000 pid=3715 execve guuid=b4956b95-1700-0000-579e-6c130e0f0000 pid=3854 /usr/bin/chmod guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=b4956b95-1700-0000-579e-6c130e0f0000 pid=3854 execve guuid=6a3ce795-1700-0000-579e-6c13100f0000 pid=3856 /usr/bin/dash guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=6a3ce795-1700-0000-579e-6c13100f0000 pid=3856 clone guuid=dba9ec96-1700-0000-579e-6c13140f0000 pid=3860 /usr/bin/rm guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=dba9ec96-1700-0000-579e-6c13140f0000 pid=3860 execve guuid=c3605497-1700-0000-579e-6c13160f0000 pid=3862 /usr/bin/wget net send-data write-file guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=c3605497-1700-0000-579e-6c13160f0000 pid=3862 execve guuid=728d2def-1700-0000-579e-6c13e00f0000 pid=4064 /usr/bin/chmod guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=728d2def-1700-0000-579e-6c13e00f0000 pid=4064 execve guuid=398eb8ef-1700-0000-579e-6c13e10f0000 pid=4065 /usr/bin/dash guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=398eb8ef-1700-0000-579e-6c13e10f0000 pid=4065 clone guuid=818ae1f0-1700-0000-579e-6c13e70f0000 pid=4071 /usr/bin/rm guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=818ae1f0-1700-0000-579e-6c13e70f0000 pid=4071 execve guuid=f3e360f1-1700-0000-579e-6c13ea0f0000 pid=4074 /usr/bin/wget net send-data write-file guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=f3e360f1-1700-0000-579e-6c13ea0f0000 pid=4074 execve guuid=088afa7a-1800-0000-579e-6c131f110000 pid=4383 /usr/bin/chmod guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=088afa7a-1800-0000-579e-6c131f110000 pid=4383 execve guuid=1178367b-1800-0000-579e-6c1323110000 pid=4387 /usr/bin/dash guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=1178367b-1800-0000-579e-6c1323110000 pid=4387 clone guuid=03a3d77b-1800-0000-579e-6c1328110000 pid=4392 /usr/bin/rm guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=03a3d77b-1800-0000-579e-6c1328110000 pid=4392 execve guuid=d4f0237c-1800-0000-579e-6c132a110000 pid=4394 /usr/bin/wget net send-data write-file guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=d4f0237c-1800-0000-579e-6c132a110000 pid=4394 execve guuid=37d3e6cf-1800-0000-579e-6c1334120000 pid=4660 /usr/bin/chmod guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=37d3e6cf-1800-0000-579e-6c1334120000 pid=4660 execve guuid=b40f4cd0-1800-0000-579e-6c1335120000 pid=4661 /usr/bin/dash guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=b40f4cd0-1800-0000-579e-6c1335120000 pid=4661 clone guuid=efcb48d1-1800-0000-579e-6c133a120000 pid=4666 /usr/bin/rm delete-file guuid=920286bb-1600-0000-579e-6c13e60c0000 pid=3302->guuid=efcb48d1-1800-0000-579e-6c133a120000 pid=4666 execve 9554d36e-3083-568e-90da-bb8e3c487b07 188.132.232.81:80 guuid=bd0e29ee-1600-0000-579e-6c13d20d0000 pid=3538->9554d36e-3083-568e-90da-bb8e3c487b07 send: 133B guuid=aa3fd058-1700-0000-579e-6c13830e0000 pid=3715->9554d36e-3083-568e-90da-bb8e3c487b07 send: 133B guuid=c3605497-1700-0000-579e-6c13160f0000 pid=3862->9554d36e-3083-568e-90da-bb8e3c487b07 send: 132B guuid=f3e360f1-1700-0000-579e-6c13ea0f0000 pid=4074->9554d36e-3083-568e-90da-bb8e3c487b07 send: 132B guuid=d4f0237c-1800-0000-579e-6c132a110000 pid=4394->9554d36e-3083-568e-90da-bb8e3c487b07 send: 132B
Score:
95%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/13976fcfba58cc759e3535340ec78464f94d8d2c2806d89ff27868fce9304755
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/13976fcfba58cc759e3535340ec78464f94d8d2c2806d89ff27868fce9304755/
Verdict:
Malicious
Threat:
Trojan-Downloader.Shell.Agent
Link:
https://tip.neiki.dev/file/13976fcfba58cc759e3535340ec78464f94d8d2c2806d89ff27868fce9304755
Threat name:
Win32.Trojan.Vigorf
Create hunting rule
Status:
Malicious
First seen:
2026-06-03 19:39:27 UTC
File Type:
Text (Shell)
AV detection:
9 of 24 (37.50%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=colw7t52ldghlhrvgu2a5r4emt4u3djmfadnrh7spbupz2jqi5kq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
defense_evasion discovery linux
Link:
https://tria.ge/reports/260603-yc5e7sez4m/
Behaviour
Reads runtime system information
Writes file to tmp directory
Enumerates running processes
File and Directory Permissions Modification
Deletes itself
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.26
Link:
https://yomi.yoroi.company/submissions/13976fcfba58cc759e3535340ec78464f94d8d2c2806d89ff27868fce9304755

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 13976fcfba58cc759e3535340ec78464f94d8d2c2806d89ff27868fce9304755

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3856431/
  
Delivery method
Distributed via web download

Comments