🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1a1e913e3f05d8678d07f116db255c735042ff6a569f01f37f9cd8ce3f8e9e21. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 1a1e913e3f05d8678d07f116db255c735042ff6a569f01f37f9cd8ce3f8e9e21
SHA3-384 hash: 92711fb7c4305d19be784264efac1a5493ebfd6c4f9833d6e3f1e0a9ef9de4e44a5bed7931f8b8072fd8a79b921fabf4
SHA1 hash: 1c7d1dd624adefff509ee5a7fbaf29f0e2a83d89
MD5 hash: 100cafe5ec3257879304af81cb083adc
humanhash: cup-romeo-romeo-xray
File name:lil
Download: download sample
File size:840 bytes
First seen:2026-07-18 06:14:38 UTC
Last seen:2026-07-19 00:41:48 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 24:kXCKysE2hi0ziQvZohaY8Z3XIGWmj3XZXX:e9Qp+MsY8ZHIGWmj3XRX
TLSH T15B01AFC68110AD1040A9D95D22E76164F420C3CF268F4B75BFAC6E39FB88D04F07AF84
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://129.121.114.124/sBOn/an/aua-wget
http://129.121.114.124/PYjn/an/aua-wget
http://129.121.114.124/n2w0n/an/aua-wget
http://129.121.114.124/CA3n/an/aua-wget
http://129.121.114.124/b8rn/an/aua-wget

Intelligence

File Origin
# of uploads :
2
# of downloads :
77
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive mirai
Link:
https://www.filescan.io/uploads/6a5b1a172104bec13fcb2f01/reports/69d00cc3-b86c-45c1-8e84-0481f345ade8/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-07-18T03:36:00Z UTC
Last seen:
2026-07-20T00:32:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/1a1e913e3f05d8678d07f116db255c735042ff6a569f01f37f9cd8ce3f8e9e21/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/6a9ceb5b-2617-459a-a017-87c32fa968e8
Behavior Graph:
Download SVG
%3 guuid=892ed62d-1900-0000-5e04-2d47830a0000 pid=2691 /usr/bin/sudo guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695 /tmp/sample.bin write-file guuid=892ed62d-1900-0000-5e04-2d47830a0000 pid=2691->guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695 execve guuid=20daea2f-1900-0000-5e04-2d47880a0000 pid=2696 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=20daea2f-1900-0000-5e04-2d47880a0000 pid=2696 execve guuid=97766e30-1900-0000-5e04-2d478a0a0000 pid=2698 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=97766e30-1900-0000-5e04-2d478a0a0000 pid=2698 execve guuid=edfccd30-1900-0000-5e04-2d478c0a0000 pid=2700 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=edfccd30-1900-0000-5e04-2d478c0a0000 pid=2700 execve guuid=fb2c3431-1900-0000-5e04-2d478f0a0000 pid=2703 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=fb2c3431-1900-0000-5e04-2d478f0a0000 pid=2703 execve guuid=d0b39d31-1900-0000-5e04-2d47910a0000 pid=2705 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=d0b39d31-1900-0000-5e04-2d47910a0000 pid=2705 execve guuid=c8220a32-1900-0000-5e04-2d47930a0000 pid=2707 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=c8220a32-1900-0000-5e04-2d47930a0000 pid=2707 execve guuid=a2d86432-1900-0000-5e04-2d47950a0000 pid=2709 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=a2d86432-1900-0000-5e04-2d47950a0000 pid=2709 execve guuid=a1b7c732-1900-0000-5e04-2d47980a0000 pid=2712 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=a1b7c732-1900-0000-5e04-2d47980a0000 pid=2712 execve guuid=c47d2833-1900-0000-5e04-2d479a0a0000 pid=2714 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=c47d2833-1900-0000-5e04-2d479a0a0000 pid=2714 execve guuid=93da8d33-1900-0000-5e04-2d479b0a0000 pid=2715 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=93da8d33-1900-0000-5e04-2d479b0a0000 pid=2715 execve guuid=8cfc0134-1900-0000-5e04-2d479d0a0000 pid=2717 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=8cfc0134-1900-0000-5e04-2d479d0a0000 pid=2717 execve guuid=344a8534-1900-0000-5e04-2d479e0a0000 pid=2718 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=344a8534-1900-0000-5e04-2d479e0a0000 pid=2718 execve guuid=56ab0435-1900-0000-5e04-2d479f0a0000 pid=2719 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=56ab0435-1900-0000-5e04-2d479f0a0000 pid=2719 execve guuid=8e207f35-1900-0000-5e04-2d47a10a0000 pid=2721 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=8e207f35-1900-0000-5e04-2d47a10a0000 pid=2721 execve guuid=106ffa35-1900-0000-5e04-2d47a30a0000 pid=2723 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=106ffa35-1900-0000-5e04-2d47a30a0000 pid=2723 execve guuid=b7816d36-1900-0000-5e04-2d47a60a0000 pid=2726 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=b7816d36-1900-0000-5e04-2d47a60a0000 pid=2726 execve guuid=80b3d536-1900-0000-5e04-2d47a80a0000 pid=2728 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=80b3d536-1900-0000-5e04-2d47a80a0000 pid=2728 execve guuid=310e3937-1900-0000-5e04-2d47aa0a0000 pid=2730 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=310e3937-1900-0000-5e04-2d47aa0a0000 pid=2730 execve guuid=a4a3d437-1900-0000-5e04-2d47ab0a0000 pid=2731 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=a4a3d437-1900-0000-5e04-2d47ab0a0000 pid=2731 execve guuid=0c2b6d38-1900-0000-5e04-2d47ac0a0000 pid=2732 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=0c2b6d38-1900-0000-5e04-2d47ac0a0000 pid=2732 execve guuid=4a3c0a39-1900-0000-5e04-2d47ad0a0000 pid=2733 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=4a3c0a39-1900-0000-5e04-2d47ad0a0000 pid=2733 execve guuid=faa1c239-1900-0000-5e04-2d47ae0a0000 pid=2734 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=faa1c239-1900-0000-5e04-2d47ae0a0000 pid=2734 execve guuid=a8775d3a-1900-0000-5e04-2d47af0a0000 pid=2735 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=a8775d3a-1900-0000-5e04-2d47af0a0000 pid=2735 execve guuid=1c3cfa3a-1900-0000-5e04-2d47b00a0000 pid=2736 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=1c3cfa3a-1900-0000-5e04-2d47b00a0000 pid=2736 execve guuid=88d5ba3b-1900-0000-5e04-2d47b20a0000 pid=2738 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=88d5ba3b-1900-0000-5e04-2d47b20a0000 pid=2738 execve guuid=0dc0433c-1900-0000-5e04-2d47b30a0000 pid=2739 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=0dc0433c-1900-0000-5e04-2d47b30a0000 pid=2739 execve guuid=8d1ab83c-1900-0000-5e04-2d47b40a0000 pid=2740 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=8d1ab83c-1900-0000-5e04-2d47b40a0000 pid=2740 execve guuid=c061113d-1900-0000-5e04-2d47b60a0000 pid=2742 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=c061113d-1900-0000-5e04-2d47b60a0000 pid=2742 execve guuid=83266c3d-1900-0000-5e04-2d47b90a0000 pid=2745 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=83266c3d-1900-0000-5e04-2d47b90a0000 pid=2745 execve guuid=1938cc3d-1900-0000-5e04-2d47bb0a0000 pid=2747 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=1938cc3d-1900-0000-5e04-2d47bb0a0000 pid=2747 execve guuid=3be13f3e-1900-0000-5e04-2d47bd0a0000 pid=2749 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=3be13f3e-1900-0000-5e04-2d47bd0a0000 pid=2749 execve guuid=4d61aa3e-1900-0000-5e04-2d47bf0a0000 pid=2751 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=4d61aa3e-1900-0000-5e04-2d47bf0a0000 pid=2751 execve guuid=3563153f-1900-0000-5e04-2d47c10a0000 pid=2753 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=3563153f-1900-0000-5e04-2d47c10a0000 pid=2753 execve guuid=f9b4bd3f-1900-0000-5e04-2d47c20a0000 pid=2754 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=f9b4bd3f-1900-0000-5e04-2d47c20a0000 pid=2754 execve guuid=dce34240-1900-0000-5e04-2d47c40a0000 pid=2756 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=dce34240-1900-0000-5e04-2d47c40a0000 pid=2756 execve guuid=9ad5a940-1900-0000-5e04-2d47c60a0000 pid=2758 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=9ad5a940-1900-0000-5e04-2d47c60a0000 pid=2758 execve guuid=92fa0d41-1900-0000-5e04-2d47c90a0000 pid=2761 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=92fa0d41-1900-0000-5e04-2d47c90a0000 pid=2761 execve guuid=a6717e41-1900-0000-5e04-2d47cb0a0000 pid=2763 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=a6717e41-1900-0000-5e04-2d47cb0a0000 pid=2763 execve guuid=bd77e841-1900-0000-5e04-2d47ce0a0000 pid=2766 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=bd77e841-1900-0000-5e04-2d47ce0a0000 pid=2766 execve guuid=17585a42-1900-0000-5e04-2d47d00a0000 pid=2768 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=17585a42-1900-0000-5e04-2d47d00a0000 pid=2768 execve guuid=3bd9eb42-1900-0000-5e04-2d47d10a0000 pid=2769 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=3bd9eb42-1900-0000-5e04-2d47d10a0000 pid=2769 execve guuid=29007743-1900-0000-5e04-2d47d30a0000 pid=2771 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=29007743-1900-0000-5e04-2d47d30a0000 pid=2771 execve guuid=9c1e0044-1900-0000-5e04-2d47d40a0000 pid=2772 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=9c1e0044-1900-0000-5e04-2d47d40a0000 pid=2772 execve guuid=f5ef6d44-1900-0000-5e04-2d47d50a0000 pid=2773 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=f5ef6d44-1900-0000-5e04-2d47d50a0000 pid=2773 execve guuid=c96ed944-1900-0000-5e04-2d47d70a0000 pid=2775 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=c96ed944-1900-0000-5e04-2d47d70a0000 pid=2775 execve guuid=2b8f3445-1900-0000-5e04-2d47d90a0000 pid=2777 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=2b8f3445-1900-0000-5e04-2d47d90a0000 pid=2777 execve guuid=2ad48f45-1900-0000-5e04-2d47db0a0000 pid=2779 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=2ad48f45-1900-0000-5e04-2d47db0a0000 pid=2779 execve guuid=f7d8f445-1900-0000-5e04-2d47de0a0000 pid=2782 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=f7d8f445-1900-0000-5e04-2d47de0a0000 pid=2782 execve guuid=391d5a46-1900-0000-5e04-2d47e00a0000 pid=2784 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=391d5a46-1900-0000-5e04-2d47e00a0000 pid=2784 execve guuid=914fbf46-1900-0000-5e04-2d47e20a0000 pid=2786 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=914fbf46-1900-0000-5e04-2d47e20a0000 pid=2786 execve guuid=c2fd5447-1900-0000-5e04-2d47e40a0000 pid=2788 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=c2fd5447-1900-0000-5e04-2d47e40a0000 pid=2788 execve guuid=a3a3b347-1900-0000-5e04-2d47e70a0000 pid=2791 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=a3a3b347-1900-0000-5e04-2d47e70a0000 pid=2791 execve guuid=605d1148-1900-0000-5e04-2d47e90a0000 pid=2793 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=605d1148-1900-0000-5e04-2d47e90a0000 pid=2793 execve guuid=9fdb7748-1900-0000-5e04-2d47ec0a0000 pid=2796 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=9fdb7748-1900-0000-5e04-2d47ec0a0000 pid=2796 execve guuid=a74e2c49-1900-0000-5e04-2d47ee0a0000 pid=2798 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=a74e2c49-1900-0000-5e04-2d47ee0a0000 pid=2798 execve guuid=33609149-1900-0000-5e04-2d47f00a0000 pid=2800 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=33609149-1900-0000-5e04-2d47f00a0000 pid=2800 execve guuid=7812ef49-1900-0000-5e04-2d47f20a0000 pid=2802 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=7812ef49-1900-0000-5e04-2d47f20a0000 pid=2802 execve guuid=8207524a-1900-0000-5e04-2d47f50a0000 pid=2805 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=8207524a-1900-0000-5e04-2d47f50a0000 pid=2805 execve guuid=1364b44a-1900-0000-5e04-2d47f70a0000 pid=2807 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=1364b44a-1900-0000-5e04-2d47f70a0000 pid=2807 execve guuid=6d43124b-1900-0000-5e04-2d47f90a0000 pid=2809 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=6d43124b-1900-0000-5e04-2d47f90a0000 pid=2809 execve guuid=3bc9724b-1900-0000-5e04-2d47fb0a0000 pid=2811 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=3bc9724b-1900-0000-5e04-2d47fb0a0000 pid=2811 execve guuid=d0b3ce4b-1900-0000-5e04-2d47fd0a0000 pid=2813 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=d0b3ce4b-1900-0000-5e04-2d47fd0a0000 pid=2813 execve guuid=f7ff2f4c-1900-0000-5e04-2d47ff0a0000 pid=2815 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=f7ff2f4c-1900-0000-5e04-2d47ff0a0000 pid=2815 execve guuid=86bc904c-1900-0000-5e04-2d47010b0000 pid=2817 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=86bc904c-1900-0000-5e04-2d47010b0000 pid=2817 execve guuid=c625f94c-1900-0000-5e04-2d47040b0000 pid=2820 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=c625f94c-1900-0000-5e04-2d47040b0000 pid=2820 execve guuid=3d7c574d-1900-0000-5e04-2d47060b0000 pid=2822 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=3d7c574d-1900-0000-5e04-2d47060b0000 pid=2822 execve guuid=fafdbf4d-1900-0000-5e04-2d47080b0000 pid=2824 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=fafdbf4d-1900-0000-5e04-2d47080b0000 pid=2824 execve guuid=2b62324e-1900-0000-5e04-2d47090b0000 pid=2825 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=2b62324e-1900-0000-5e04-2d47090b0000 pid=2825 execve guuid=52b1ad4e-1900-0000-5e04-2d470a0b0000 pid=2826 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=52b1ad4e-1900-0000-5e04-2d470a0b0000 pid=2826 execve guuid=70a1234f-1900-0000-5e04-2d470b0b0000 pid=2827 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=70a1234f-1900-0000-5e04-2d470b0b0000 pid=2827 execve guuid=41e0844f-1900-0000-5e04-2d470d0b0000 pid=2829 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=41e0844f-1900-0000-5e04-2d470d0b0000 pid=2829 execve guuid=7b5f0550-1900-0000-5e04-2d47100b0000 pid=2832 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=7b5f0550-1900-0000-5e04-2d47100b0000 pid=2832 execve guuid=71326750-1900-0000-5e04-2d47120b0000 pid=2834 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=71326750-1900-0000-5e04-2d47120b0000 pid=2834 execve guuid=f744c850-1900-0000-5e04-2d47140b0000 pid=2836 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=f744c850-1900-0000-5e04-2d47140b0000 pid=2836 execve guuid=a01b3a51-1900-0000-5e04-2d47170b0000 pid=2839 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=a01b3a51-1900-0000-5e04-2d47170b0000 pid=2839 execve guuid=9c079851-1900-0000-5e04-2d47180b0000 pid=2840 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=9c079851-1900-0000-5e04-2d47180b0000 pid=2840 execve guuid=1c29fa51-1900-0000-5e04-2d471a0b0000 pid=2842 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=1c29fa51-1900-0000-5e04-2d471a0b0000 pid=2842 execve guuid=e6755752-1900-0000-5e04-2d471d0b0000 pid=2845 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=e6755752-1900-0000-5e04-2d471d0b0000 pid=2845 execve guuid=e309bf52-1900-0000-5e04-2d471f0b0000 pid=2847 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=e309bf52-1900-0000-5e04-2d471f0b0000 pid=2847 execve guuid=eb722153-1900-0000-5e04-2d47220b0000 pid=2850 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=eb722153-1900-0000-5e04-2d47220b0000 pid=2850 execve guuid=38269753-1900-0000-5e04-2d47240b0000 pid=2852 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=38269753-1900-0000-5e04-2d47240b0000 pid=2852 execve guuid=2f75fd53-1900-0000-5e04-2d47270b0000 pid=2855 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=2f75fd53-1900-0000-5e04-2d47270b0000 pid=2855 execve guuid=b5d26454-1900-0000-5e04-2d47290b0000 pid=2857 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=b5d26454-1900-0000-5e04-2d47290b0000 pid=2857 execve guuid=bf40c854-1900-0000-5e04-2d472b0b0000 pid=2859 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=bf40c854-1900-0000-5e04-2d472b0b0000 pid=2859 execve guuid=b3b02255-1900-0000-5e04-2d472e0b0000 pid=2862 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=b3b02255-1900-0000-5e04-2d472e0b0000 pid=2862 execve guuid=81388855-1900-0000-5e04-2d47300b0000 pid=2864 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=81388855-1900-0000-5e04-2d47300b0000 pid=2864 execve guuid=a311e955-1900-0000-5e04-2d47330b0000 pid=2867 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=a311e955-1900-0000-5e04-2d47330b0000 pid=2867 execve guuid=41f76256-1900-0000-5e04-2d47340b0000 pid=2868 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=41f76256-1900-0000-5e04-2d47340b0000 pid=2868 execve guuid=4f47c756-1900-0000-5e04-2d47370b0000 pid=2871 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=4f47c756-1900-0000-5e04-2d47370b0000 pid=2871 execve guuid=c6a92e57-1900-0000-5e04-2d47390b0000 pid=2873 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=c6a92e57-1900-0000-5e04-2d47390b0000 pid=2873 execve guuid=47a89357-1900-0000-5e04-2d473c0b0000 pid=2876 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=47a89357-1900-0000-5e04-2d473c0b0000 pid=2876 execve guuid=4160ef57-1900-0000-5e04-2d473e0b0000 pid=2878 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=4160ef57-1900-0000-5e04-2d473e0b0000 pid=2878 execve guuid=8a7c4d58-1900-0000-5e04-2d47410b0000 pid=2881 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=8a7c4d58-1900-0000-5e04-2d47410b0000 pid=2881 execve guuid=87a7ae58-1900-0000-5e04-2d47430b0000 pid=2883 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=87a7ae58-1900-0000-5e04-2d47430b0000 pid=2883 execve guuid=a4381159-1900-0000-5e04-2d47450b0000 pid=2885 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=a4381159-1900-0000-5e04-2d47450b0000 pid=2885 execve guuid=cb597459-1900-0000-5e04-2d47480b0000 pid=2888 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=cb597459-1900-0000-5e04-2d47480b0000 pid=2888 execve guuid=84a2d959-1900-0000-5e04-2d474a0b0000 pid=2890 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=84a2d959-1900-0000-5e04-2d474a0b0000 pid=2890 execve guuid=7033455a-1900-0000-5e04-2d474d0b0000 pid=2893 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=7033455a-1900-0000-5e04-2d474d0b0000 pid=2893 execve guuid=00b19f5a-1900-0000-5e04-2d474f0b0000 pid=2895 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=00b19f5a-1900-0000-5e04-2d474f0b0000 pid=2895 execve guuid=e65cf95a-1900-0000-5e04-2d47510b0000 pid=2897 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=e65cf95a-1900-0000-5e04-2d47510b0000 pid=2897 execve guuid=c4c7725b-1900-0000-5e04-2d47540b0000 pid=2900 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=c4c7725b-1900-0000-5e04-2d47540b0000 pid=2900 execve guuid=c60bcc5b-1900-0000-5e04-2d47560b0000 pid=2902 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=c60bcc5b-1900-0000-5e04-2d47560b0000 pid=2902 execve guuid=66b72d5c-1900-0000-5e04-2d47590b0000 pid=2905 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=66b72d5c-1900-0000-5e04-2d47590b0000 pid=2905 execve guuid=2f578c5c-1900-0000-5e04-2d475b0b0000 pid=2907 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=2f578c5c-1900-0000-5e04-2d475b0b0000 pid=2907 execve guuid=5b2ef35c-1900-0000-5e04-2d475e0b0000 pid=2910 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=5b2ef35c-1900-0000-5e04-2d475e0b0000 pid=2910 execve guuid=124d535d-1900-0000-5e04-2d47600b0000 pid=2912 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=124d535d-1900-0000-5e04-2d47600b0000 pid=2912 execve guuid=3a25b75d-1900-0000-5e04-2d47620b0000 pid=2914 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=3a25b75d-1900-0000-5e04-2d47620b0000 pid=2914 execve guuid=98471b5e-1900-0000-5e04-2d47660b0000 pid=2918 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=98471b5e-1900-0000-5e04-2d47660b0000 pid=2918 execve guuid=126aa15e-1900-0000-5e04-2d47670b0000 pid=2919 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=126aa15e-1900-0000-5e04-2d47670b0000 pid=2919 execve guuid=ac75195f-1900-0000-5e04-2d47680b0000 pid=2920 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=ac75195f-1900-0000-5e04-2d47680b0000 pid=2920 execve guuid=ed18e15f-1900-0000-5e04-2d476c0b0000 pid=2924 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=ed18e15f-1900-0000-5e04-2d476c0b0000 pid=2924 execve guuid=8c874360-1900-0000-5e04-2d476e0b0000 pid=2926 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=8c874360-1900-0000-5e04-2d476e0b0000 pid=2926 execve guuid=41cca360-1900-0000-5e04-2d47710b0000 pid=2929 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=41cca360-1900-0000-5e04-2d47710b0000 pid=2929 execve guuid=68f60761-1900-0000-5e04-2d47720b0000 pid=2930 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=68f60761-1900-0000-5e04-2d47720b0000 pid=2930 execve guuid=fea86f61-1900-0000-5e04-2d47740b0000 pid=2932 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=fea86f61-1900-0000-5e04-2d47740b0000 pid=2932 execve guuid=13e8f361-1900-0000-5e04-2d47750b0000 pid=2933 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=13e8f361-1900-0000-5e04-2d47750b0000 pid=2933 execve guuid=f7096962-1900-0000-5e04-2d47760b0000 pid=2934 /usr/bin/ls guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=f7096962-1900-0000-5e04-2d47760b0000 pid=2934 execve guuid=4daed662-1900-0000-5e04-2d47770b0000 pid=2935 /usr/bin/rm guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=4daed662-1900-0000-5e04-2d47770b0000 pid=2935 execve guuid=64c81263-1900-0000-5e04-2d47790b0000 pid=2937 /usr/bin/wget net send-data write-file guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=64c81263-1900-0000-5e04-2d47790b0000 pid=2937 execve guuid=e63ef37b-1900-0000-5e04-2d47a20b0000 pid=2978 /usr/bin/chmod guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=e63ef37b-1900-0000-5e04-2d47a20b0000 pid=2978 execve guuid=b42d377c-1900-0000-5e04-2d47a30b0000 pid=2979 /usr/bin/dash guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=b42d377c-1900-0000-5e04-2d47a30b0000 pid=2979 clone guuid=df412f7d-1900-0000-5e04-2d47a70b0000 pid=2983 /usr/bin/rm guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=df412f7d-1900-0000-5e04-2d47a70b0000 pid=2983 execve guuid=57566b7d-1900-0000-5e04-2d47a90b0000 pid=2985 /usr/bin/wget net send-data write-file guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=57566b7d-1900-0000-5e04-2d47a90b0000 pid=2985 execve guuid=e4edf194-1900-0000-5e04-2d47e30b0000 pid=3043 /usr/bin/chmod guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=e4edf194-1900-0000-5e04-2d47e30b0000 pid=3043 execve guuid=21fb3b95-1900-0000-5e04-2d47e40b0000 pid=3044 /usr/bin/dash guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=21fb3b95-1900-0000-5e04-2d47e40b0000 pid=3044 clone guuid=a5d5c695-1900-0000-5e04-2d47e80b0000 pid=3048 /usr/bin/rm guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=a5d5c695-1900-0000-5e04-2d47e80b0000 pid=3048 execve guuid=2cd10496-1900-0000-5e04-2d47ea0b0000 pid=3050 /usr/bin/wget net send-data write-file guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=2cd10496-1900-0000-5e04-2d47ea0b0000 pid=3050 execve guuid=f23982b0-1900-0000-5e04-2d471b0c0000 pid=3099 /usr/bin/chmod guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=f23982b0-1900-0000-5e04-2d471b0c0000 pid=3099 execve guuid=2a9f83b1-1900-0000-5e04-2d471d0c0000 pid=3101 /usr/bin/dash guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=2a9f83b1-1900-0000-5e04-2d471d0c0000 pid=3101 clone guuid=989a83b2-1900-0000-5e04-2d47210c0000 pid=3105 /usr/bin/rm guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=989a83b2-1900-0000-5e04-2d47210c0000 pid=3105 execve guuid=d87ae3b2-1900-0000-5e04-2d47230c0000 pid=3107 /usr/bin/wget net send-data write-file guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=d87ae3b2-1900-0000-5e04-2d47230c0000 pid=3107 execve guuid=6edb6fd1-1900-0000-5e04-2d47540c0000 pid=3156 /usr/bin/chmod guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=6edb6fd1-1900-0000-5e04-2d47540c0000 pid=3156 execve guuid=a132ccd1-1900-0000-5e04-2d47550c0000 pid=3157 /usr/bin/dash guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=a132ccd1-1900-0000-5e04-2d47550c0000 pid=3157 clone guuid=6bebafd2-1900-0000-5e04-2d47580c0000 pid=3160 /usr/bin/rm guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=6bebafd2-1900-0000-5e04-2d47580c0000 pid=3160 execve guuid=024714d3-1900-0000-5e04-2d475a0c0000 pid=3162 /usr/bin/wget net send-data write-file guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=024714d3-1900-0000-5e04-2d475a0c0000 pid=3162 execve guuid=04b9a4f0-1900-0000-5e04-2d478b0c0000 pid=3211 /usr/bin/chmod guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=04b9a4f0-1900-0000-5e04-2d478b0c0000 pid=3211 execve guuid=e842f4f0-1900-0000-5e04-2d478d0c0000 pid=3213 /usr/bin/dash guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=e842f4f0-1900-0000-5e04-2d478d0c0000 pid=3213 clone guuid=193707f2-1900-0000-5e04-2d47930c0000 pid=3219 /usr/bin/rm delete-file guuid=be5c912f-1900-0000-5e04-2d47870a0000 pid=2695->guuid=193707f2-1900-0000-5e04-2d47930c0000 pid=3219 execve 801186e6-5fe8-5959-a7b4-832d8d66e7aa 129.121.114.124:80 guuid=64c81263-1900-0000-5e04-2d47790b0000 pid=2937->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 133B guuid=57566b7d-1900-0000-5e04-2d47a90b0000 pid=2985->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 133B guuid=2cd10496-1900-0000-5e04-2d47ea0b0000 pid=3050->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 134B guuid=d87ae3b2-1900-0000-5e04-2d47230c0000 pid=3107->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 133B guuid=024714d3-1900-0000-5e04-2d475a0c0000 pid=3162->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 133B
Score:
95%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/1a1e913e3f05d8678d07f116db255c735042ff6a569f01f37f9cd8ce3f8e9e21
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/1a1e913e3f05d8678d07f116db255c735042ff6a569f01f37f9cd8ce3f8e9e21/
Threat name:
Document-HTML.Trojan.Bash
Create hunting rule
Status:
Malicious
First seen:
2026-07-18 06:15:58 UTC
File Type:
Text (Shell)
AV detection:
12 of 24 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=dipjcpr7axmgpdih6elnwjk4onief73kk2pqd437ttmm4p4otyqq._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
discovery linux
Link:
https://tria.ge/reports/260718-g1clnaav9l/
Behaviour
Reads runtime system information
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.26
Link:
https://yomi.yoroi.company/submissions/1a1e913e3f05d8678d07f116db255c735042ff6a569f01f37f9cd8ce3f8e9e21

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 1a1e913e3f05d8678d07f116db255c735042ff6a569f01f37f9cd8ce3f8e9e21

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3874630/
  
Delivery method
Distributed via web download

Comments