MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2c97e2d57359fb344b5de8164fa93f8ec2e4cb758a908ec25a1ab742dca9a99c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2c97e2d57359fb344b5de8164fa93f8ec2e4cb758a908ec25a1ab742dca9a99c
SHA3-384 hash: d50547e8cb5225d9f2adde6039d852c23c77800d59c9f2a91c0b3d8c0c0815b21e0ca13b0b81ed347f187d5ce86101f2
SHA1 hash: e4cf3ac30b94c0aa93d27912b16c8f63398d72ff
MD5 hash: 43b96948e81a27c875aa637c5ffb04ee
humanhash: jersey-salami-solar-william
File name:lil
Download: download sample
File size:848 bytes
First seen:2026-07-17 01:07:05 UTC
Last seen:2026-07-17 01:19:23 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 24:kXCKysE2hi0ziQvZohah3yzz+/dBMTAnX:e9Qp+Msh3yz6/MTAnX
TLSH T1EC01CED69500AC2100DE8A1C32971459F820D3CF164A4F38BFAC6E3DEBD8C14B06AFC8
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://129.121.114.124/NLxn/an/aua-wget
http://129.121.114.124/FbVSn/an/aua-wget
http://129.121.114.124/BnSyn/an/aua-wget
http://129.121.114.124/WmDn/an/aua-wget
http://129.121.114.124/rKrgn/an/aua-wget

Intelligence

File Origin
# of uploads :
2
# of downloads :
78
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive mirai
Link:
https://www.filescan.io/uploads/6a598056e700ed39dddd3cea/reports/b377b4a9-7a33-4ad1-a208-bb7d12070fbf/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-07-16T23:09:00Z UTC
Last seen:
2026-07-18T19:10:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/2c97e2d57359fb344b5de8164fa93f8ec2e4cb758a908ec25a1ab742dca9a99c/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/6840bf8d-865e-41d3-8f8f-cfc0caa86339
Behavior Graph:
Download SVG
%3 guuid=f277cb2c-1f00-0000-6586-4d9d3e140000 pid=5182 /usr/bin/sudo guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183 /tmp/sample.bin write-file guuid=f277cb2c-1f00-0000-6586-4d9d3e140000 pid=5182->guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183 execve guuid=c650fc2f-1f00-0000-6586-4d9d40140000 pid=5184 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=c650fc2f-1f00-0000-6586-4d9d40140000 pid=5184 execve guuid=4ef68930-1f00-0000-6586-4d9d41140000 pid=5185 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=4ef68930-1f00-0000-6586-4d9d41140000 pid=5185 execve guuid=11600f31-1f00-0000-6586-4d9d42140000 pid=5186 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=11600f31-1f00-0000-6586-4d9d42140000 pid=5186 execve guuid=fcab8731-1f00-0000-6586-4d9d43140000 pid=5187 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=fcab8731-1f00-0000-6586-4d9d43140000 pid=5187 execve guuid=5363fc31-1f00-0000-6586-4d9d44140000 pid=5188 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=5363fc31-1f00-0000-6586-4d9d44140000 pid=5188 execve guuid=33eb7e32-1f00-0000-6586-4d9d45140000 pid=5189 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=33eb7e32-1f00-0000-6586-4d9d45140000 pid=5189 execve guuid=8c26f332-1f00-0000-6586-4d9d46140000 pid=5190 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=8c26f332-1f00-0000-6586-4d9d46140000 pid=5190 execve guuid=66f47633-1f00-0000-6586-4d9d47140000 pid=5191 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=66f47633-1f00-0000-6586-4d9d47140000 pid=5191 execve guuid=885cfd33-1f00-0000-6586-4d9d48140000 pid=5192 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=885cfd33-1f00-0000-6586-4d9d48140000 pid=5192 execve guuid=bb957934-1f00-0000-6586-4d9d49140000 pid=5193 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=bb957934-1f00-0000-6586-4d9d49140000 pid=5193 execve guuid=5212f534-1f00-0000-6586-4d9d4a140000 pid=5194 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=5212f534-1f00-0000-6586-4d9d4a140000 pid=5194 execve guuid=38787835-1f00-0000-6586-4d9d4b140000 pid=5195 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=38787835-1f00-0000-6586-4d9d4b140000 pid=5195 execve guuid=38d6f435-1f00-0000-6586-4d9d4c140000 pid=5196 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=38d6f435-1f00-0000-6586-4d9d4c140000 pid=5196 execve guuid=09767a36-1f00-0000-6586-4d9d4d140000 pid=5197 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=09767a36-1f00-0000-6586-4d9d4d140000 pid=5197 execve guuid=191d2637-1f00-0000-6586-4d9d4e140000 pid=5198 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=191d2637-1f00-0000-6586-4d9d4e140000 pid=5198 execve guuid=ea30bf37-1f00-0000-6586-4d9d4f140000 pid=5199 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=ea30bf37-1f00-0000-6586-4d9d4f140000 pid=5199 execve guuid=de155438-1f00-0000-6586-4d9d50140000 pid=5200 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=de155438-1f00-0000-6586-4d9d50140000 pid=5200 execve guuid=b5041339-1f00-0000-6586-4d9d51140000 pid=5201 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=b5041339-1f00-0000-6586-4d9d51140000 pid=5201 execve guuid=e35bdb39-1f00-0000-6586-4d9d52140000 pid=5202 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=e35bdb39-1f00-0000-6586-4d9d52140000 pid=5202 execve guuid=eb2eb33a-1f00-0000-6586-4d9d53140000 pid=5203 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=eb2eb33a-1f00-0000-6586-4d9d53140000 pid=5203 execve guuid=8b4e953b-1f00-0000-6586-4d9d54140000 pid=5204 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=8b4e953b-1f00-0000-6586-4d9d54140000 pid=5204 execve guuid=00c1793c-1f00-0000-6586-4d9d55140000 pid=5205 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=00c1793c-1f00-0000-6586-4d9d55140000 pid=5205 execve guuid=32d55f3d-1f00-0000-6586-4d9d56140000 pid=5206 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=32d55f3d-1f00-0000-6586-4d9d56140000 pid=5206 execve guuid=eb25423e-1f00-0000-6586-4d9d57140000 pid=5207 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=eb25423e-1f00-0000-6586-4d9d57140000 pid=5207 execve guuid=9055183f-1f00-0000-6586-4d9d58140000 pid=5208 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=9055183f-1f00-0000-6586-4d9d58140000 pid=5208 execve guuid=391deb3f-1f00-0000-6586-4d9d59140000 pid=5209 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=391deb3f-1f00-0000-6586-4d9d59140000 pid=5209 execve guuid=8a3cc040-1f00-0000-6586-4d9d5a140000 pid=5210 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=8a3cc040-1f00-0000-6586-4d9d5a140000 pid=5210 execve guuid=ef879141-1f00-0000-6586-4d9d5b140000 pid=5211 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=ef879141-1f00-0000-6586-4d9d5b140000 pid=5211 execve guuid=88cbf242-1f00-0000-6586-4d9d5c140000 pid=5212 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=88cbf242-1f00-0000-6586-4d9d5c140000 pid=5212 execve guuid=4e82ac43-1f00-0000-6586-4d9d5d140000 pid=5213 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=4e82ac43-1f00-0000-6586-4d9d5d140000 pid=5213 execve guuid=393b6544-1f00-0000-6586-4d9d5e140000 pid=5214 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=393b6544-1f00-0000-6586-4d9d5e140000 pid=5214 execve guuid=9a57ec44-1f00-0000-6586-4d9d5f140000 pid=5215 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=9a57ec44-1f00-0000-6586-4d9d5f140000 pid=5215 execve guuid=3fc35a45-1f00-0000-6586-4d9d60140000 pid=5216 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=3fc35a45-1f00-0000-6586-4d9d60140000 pid=5216 execve guuid=a0ebe845-1f00-0000-6586-4d9d61140000 pid=5217 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=a0ebe845-1f00-0000-6586-4d9d61140000 pid=5217 execve guuid=e6b36146-1f00-0000-6586-4d9d62140000 pid=5218 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=e6b36146-1f00-0000-6586-4d9d62140000 pid=5218 execve guuid=10aad446-1f00-0000-6586-4d9d63140000 pid=5219 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=10aad446-1f00-0000-6586-4d9d63140000 pid=5219 execve guuid=be285447-1f00-0000-6586-4d9d64140000 pid=5220 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=be285447-1f00-0000-6586-4d9d64140000 pid=5220 execve guuid=efa2cc47-1f00-0000-6586-4d9d65140000 pid=5221 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=efa2cc47-1f00-0000-6586-4d9d65140000 pid=5221 execve guuid=989a4248-1f00-0000-6586-4d9d66140000 pid=5222 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=989a4248-1f00-0000-6586-4d9d66140000 pid=5222 execve guuid=9119b348-1f00-0000-6586-4d9d67140000 pid=5223 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=9119b348-1f00-0000-6586-4d9d67140000 pid=5223 execve guuid=55df2d49-1f00-0000-6586-4d9d68140000 pid=5224 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=55df2d49-1f00-0000-6586-4d9d68140000 pid=5224 execve guuid=e03ba049-1f00-0000-6586-4d9d69140000 pid=5225 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=e03ba049-1f00-0000-6586-4d9d69140000 pid=5225 execve guuid=7d96184a-1f00-0000-6586-4d9d6a140000 pid=5226 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=7d96184a-1f00-0000-6586-4d9d6a140000 pid=5226 execve guuid=afcf914a-1f00-0000-6586-4d9d6b140000 pid=5227 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=afcf914a-1f00-0000-6586-4d9d6b140000 pid=5227 execve guuid=7f3d044b-1f00-0000-6586-4d9d6c140000 pid=5228 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=7f3d044b-1f00-0000-6586-4d9d6c140000 pid=5228 execve guuid=c985794b-1f00-0000-6586-4d9d6d140000 pid=5229 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=c985794b-1f00-0000-6586-4d9d6d140000 pid=5229 execve guuid=0918ea4b-1f00-0000-6586-4d9d6e140000 pid=5230 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=0918ea4b-1f00-0000-6586-4d9d6e140000 pid=5230 execve guuid=44d95a4c-1f00-0000-6586-4d9d6f140000 pid=5231 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=44d95a4c-1f00-0000-6586-4d9d6f140000 pid=5231 execve guuid=b81dcc4c-1f00-0000-6586-4d9d70140000 pid=5232 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=b81dcc4c-1f00-0000-6586-4d9d70140000 pid=5232 execve guuid=cb7a344d-1f00-0000-6586-4d9d71140000 pid=5233 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=cb7a344d-1f00-0000-6586-4d9d71140000 pid=5233 execve guuid=52039f4d-1f00-0000-6586-4d9d72140000 pid=5234 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=52039f4d-1f00-0000-6586-4d9d72140000 pid=5234 execve guuid=f51a104e-1f00-0000-6586-4d9d73140000 pid=5235 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=f51a104e-1f00-0000-6586-4d9d73140000 pid=5235 execve guuid=b4a87c4e-1f00-0000-6586-4d9d74140000 pid=5236 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=b4a87c4e-1f00-0000-6586-4d9d74140000 pid=5236 execve guuid=d71ee24e-1f00-0000-6586-4d9d75140000 pid=5237 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=d71ee24e-1f00-0000-6586-4d9d75140000 pid=5237 execve guuid=f116414f-1f00-0000-6586-4d9d76140000 pid=5238 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=f116414f-1f00-0000-6586-4d9d76140000 pid=5238 execve guuid=c650a94f-1f00-0000-6586-4d9d77140000 pid=5239 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=c650a94f-1f00-0000-6586-4d9d77140000 pid=5239 execve guuid=744f0d50-1f00-0000-6586-4d9d78140000 pid=5240 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=744f0d50-1f00-0000-6586-4d9d78140000 pid=5240 execve guuid=89ac7850-1f00-0000-6586-4d9d79140000 pid=5241 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=89ac7850-1f00-0000-6586-4d9d79140000 pid=5241 execve guuid=8b25de50-1f00-0000-6586-4d9d7a140000 pid=5242 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=8b25de50-1f00-0000-6586-4d9d7a140000 pid=5242 execve guuid=30355051-1f00-0000-6586-4d9d7b140000 pid=5243 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=30355051-1f00-0000-6586-4d9d7b140000 pid=5243 execve guuid=c1d1c251-1f00-0000-6586-4d9d7c140000 pid=5244 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=c1d1c251-1f00-0000-6586-4d9d7c140000 pid=5244 execve guuid=2def4552-1f00-0000-6586-4d9d7d140000 pid=5245 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=2def4552-1f00-0000-6586-4d9d7d140000 pid=5245 execve guuid=932bb152-1f00-0000-6586-4d9d7e140000 pid=5246 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=932bb152-1f00-0000-6586-4d9d7e140000 pid=5246 execve guuid=06591953-1f00-0000-6586-4d9d7f140000 pid=5247 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=06591953-1f00-0000-6586-4d9d7f140000 pid=5247 execve guuid=23158c53-1f00-0000-6586-4d9d80140000 pid=5248 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=23158c53-1f00-0000-6586-4d9d80140000 pid=5248 execve guuid=d2bb0254-1f00-0000-6586-4d9d81140000 pid=5249 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=d2bb0254-1f00-0000-6586-4d9d81140000 pid=5249 execve guuid=5d297754-1f00-0000-6586-4d9d82140000 pid=5250 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=5d297754-1f00-0000-6586-4d9d82140000 pid=5250 execve guuid=f894ec54-1f00-0000-6586-4d9d83140000 pid=5251 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=f894ec54-1f00-0000-6586-4d9d83140000 pid=5251 execve guuid=71e05e55-1f00-0000-6586-4d9d84140000 pid=5252 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=71e05e55-1f00-0000-6586-4d9d84140000 pid=5252 execve guuid=3bd5d055-1f00-0000-6586-4d9d85140000 pid=5253 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=3bd5d055-1f00-0000-6586-4d9d85140000 pid=5253 execve guuid=54d13b56-1f00-0000-6586-4d9d86140000 pid=5254 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=54d13b56-1f00-0000-6586-4d9d86140000 pid=5254 execve guuid=0091ab56-1f00-0000-6586-4d9d87140000 pid=5255 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=0091ab56-1f00-0000-6586-4d9d87140000 pid=5255 execve guuid=b5f41157-1f00-0000-6586-4d9d88140000 pid=5256 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=b5f41157-1f00-0000-6586-4d9d88140000 pid=5256 execve guuid=a9d07357-1f00-0000-6586-4d9d89140000 pid=5257 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=a9d07357-1f00-0000-6586-4d9d89140000 pid=5257 execve guuid=2b83d757-1f00-0000-6586-4d9d8a140000 pid=5258 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=2b83d757-1f00-0000-6586-4d9d8a140000 pid=5258 execve guuid=9dc23b58-1f00-0000-6586-4d9d8b140000 pid=5259 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=9dc23b58-1f00-0000-6586-4d9d8b140000 pid=5259 execve guuid=eef6a558-1f00-0000-6586-4d9d8c140000 pid=5260 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=eef6a558-1f00-0000-6586-4d9d8c140000 pid=5260 execve guuid=a9b61559-1f00-0000-6586-4d9d8d140000 pid=5261 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=a9b61559-1f00-0000-6586-4d9d8d140000 pid=5261 execve guuid=81ef8a59-1f00-0000-6586-4d9d8e140000 pid=5262 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=81ef8a59-1f00-0000-6586-4d9d8e140000 pid=5262 execve guuid=2d8f025a-1f00-0000-6586-4d9d8f140000 pid=5263 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=2d8f025a-1f00-0000-6586-4d9d8f140000 pid=5263 execve guuid=fc2a735a-1f00-0000-6586-4d9d90140000 pid=5264 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=fc2a735a-1f00-0000-6586-4d9d90140000 pid=5264 execve guuid=c1e9ea5a-1f00-0000-6586-4d9d91140000 pid=5265 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=c1e9ea5a-1f00-0000-6586-4d9d91140000 pid=5265 execve guuid=fee7625b-1f00-0000-6586-4d9d92140000 pid=5266 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=fee7625b-1f00-0000-6586-4d9d92140000 pid=5266 execve guuid=ffb5d35b-1f00-0000-6586-4d9d93140000 pid=5267 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=ffb5d35b-1f00-0000-6586-4d9d93140000 pid=5267 execve guuid=012d385c-1f00-0000-6586-4d9d94140000 pid=5268 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=012d385c-1f00-0000-6586-4d9d94140000 pid=5268 execve guuid=8f58975c-1f00-0000-6586-4d9d95140000 pid=5269 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=8f58975c-1f00-0000-6586-4d9d95140000 pid=5269 execve guuid=b28ff55c-1f00-0000-6586-4d9d96140000 pid=5270 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=b28ff55c-1f00-0000-6586-4d9d96140000 pid=5270 execve guuid=c675555d-1f00-0000-6586-4d9d97140000 pid=5271 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=c675555d-1f00-0000-6586-4d9d97140000 pid=5271 execve guuid=f02ad55d-1f00-0000-6586-4d9d98140000 pid=5272 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=f02ad55d-1f00-0000-6586-4d9d98140000 pid=5272 execve guuid=19e94a5e-1f00-0000-6586-4d9d99140000 pid=5273 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=19e94a5e-1f00-0000-6586-4d9d99140000 pid=5273 execve guuid=e7b0af5e-1f00-0000-6586-4d9d9a140000 pid=5274 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=e7b0af5e-1f00-0000-6586-4d9d9a140000 pid=5274 execve guuid=b0a00e5f-1f00-0000-6586-4d9d9b140000 pid=5275 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=b0a00e5f-1f00-0000-6586-4d9d9b140000 pid=5275 execve guuid=3338745f-1f00-0000-6586-4d9d9c140000 pid=5276 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=3338745f-1f00-0000-6586-4d9d9c140000 pid=5276 execve guuid=7d25e85f-1f00-0000-6586-4d9d9d140000 pid=5277 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=7d25e85f-1f00-0000-6586-4d9d9d140000 pid=5277 execve guuid=2d775960-1f00-0000-6586-4d9d9e140000 pid=5278 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=2d775960-1f00-0000-6586-4d9d9e140000 pid=5278 execve guuid=144bc660-1f00-0000-6586-4d9d9f140000 pid=5279 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=144bc660-1f00-0000-6586-4d9d9f140000 pid=5279 execve guuid=22c22861-1f00-0000-6586-4d9da0140000 pid=5280 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=22c22861-1f00-0000-6586-4d9da0140000 pid=5280 execve guuid=c216a761-1f00-0000-6586-4d9da1140000 pid=5281 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=c216a761-1f00-0000-6586-4d9da1140000 pid=5281 execve guuid=b9a62462-1f00-0000-6586-4d9da2140000 pid=5282 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=b9a62462-1f00-0000-6586-4d9da2140000 pid=5282 execve guuid=03551263-1f00-0000-6586-4d9da3140000 pid=5283 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=03551263-1f00-0000-6586-4d9da3140000 pid=5283 execve guuid=9b238e63-1f00-0000-6586-4d9da4140000 pid=5284 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=9b238e63-1f00-0000-6586-4d9da4140000 pid=5284 execve guuid=0e190564-1f00-0000-6586-4d9da6140000 pid=5286 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=0e190564-1f00-0000-6586-4d9da6140000 pid=5286 execve guuid=31b78064-1f00-0000-6586-4d9da7140000 pid=5287 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=31b78064-1f00-0000-6586-4d9da7140000 pid=5287 execve guuid=89a4ff64-1f00-0000-6586-4d9da8140000 pid=5288 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=89a4ff64-1f00-0000-6586-4d9da8140000 pid=5288 execve guuid=6f9d8365-1f00-0000-6586-4d9da9140000 pid=5289 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=6f9d8365-1f00-0000-6586-4d9da9140000 pid=5289 execve guuid=1e530966-1f00-0000-6586-4d9dab140000 pid=5291 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=1e530966-1f00-0000-6586-4d9dab140000 pid=5291 execve guuid=821e8f66-1f00-0000-6586-4d9daf140000 pid=5295 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=821e8f66-1f00-0000-6586-4d9daf140000 pid=5295 execve guuid=63340967-1f00-0000-6586-4d9db1140000 pid=5297 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=63340967-1f00-0000-6586-4d9db1140000 pid=5297 execve guuid=ede38a67-1f00-0000-6586-4d9db3140000 pid=5299 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=ede38a67-1f00-0000-6586-4d9db3140000 pid=5299 execve guuid=04271368-1f00-0000-6586-4d9db4140000 pid=5300 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=04271368-1f00-0000-6586-4d9db4140000 pid=5300 execve guuid=53db9f68-1f00-0000-6586-4d9db5140000 pid=5301 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=53db9f68-1f00-0000-6586-4d9db5140000 pid=5301 execve guuid=4bfb2469-1f00-0000-6586-4d9db6140000 pid=5302 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=4bfb2469-1f00-0000-6586-4d9db6140000 pid=5302 execve guuid=40adaf69-1f00-0000-6586-4d9db7140000 pid=5303 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=40adaf69-1f00-0000-6586-4d9db7140000 pid=5303 execve guuid=71054d6a-1f00-0000-6586-4d9db8140000 pid=5304 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=71054d6a-1f00-0000-6586-4d9db8140000 pid=5304 execve guuid=6df4ea6a-1f00-0000-6586-4d9db9140000 pid=5305 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=6df4ea6a-1f00-0000-6586-4d9db9140000 pid=5305 execve guuid=305a9e6b-1f00-0000-6586-4d9dba140000 pid=5306 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=305a9e6b-1f00-0000-6586-4d9dba140000 pid=5306 execve guuid=82733e6c-1f00-0000-6586-4d9dbb140000 pid=5307 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=82733e6c-1f00-0000-6586-4d9dbb140000 pid=5307 execve guuid=e6585f6d-1f00-0000-6586-4d9dbc140000 pid=5308 /usr/bin/ls guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=e6585f6d-1f00-0000-6586-4d9dbc140000 pid=5308 execve guuid=67c0016e-1f00-0000-6586-4d9dbd140000 pid=5309 /usr/bin/rm guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=67c0016e-1f00-0000-6586-4d9dbd140000 pid=5309 execve guuid=98306f6e-1f00-0000-6586-4d9dbe140000 pid=5310 /usr/bin/wget net send-data write-file guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=98306f6e-1f00-0000-6586-4d9dbe140000 pid=5310 execve guuid=c2e3969e-1f00-0000-6586-4d9dbf140000 pid=5311 /usr/bin/chmod guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=c2e3969e-1f00-0000-6586-4d9dbf140000 pid=5311 execve guuid=c169fd9e-1f00-0000-6586-4d9dc0140000 pid=5312 /tmp/NLx guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=c169fd9e-1f00-0000-6586-4d9dc0140000 pid=5312 execve guuid=ea425ca0-1f00-0000-6586-4d9dc2140000 pid=5314 /usr/bin/rm guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=ea425ca0-1f00-0000-6586-4d9dc2140000 pid=5314 execve guuid=2ea0b5a0-1f00-0000-6586-4d9dc3140000 pid=5315 /usr/bin/wget net send-data write-file guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=2ea0b5a0-1f00-0000-6586-4d9dc3140000 pid=5315 execve guuid=bace2baf-1f00-0000-6586-4d9dc4140000 pid=5316 /usr/bin/chmod guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=bace2baf-1f00-0000-6586-4d9dc4140000 pid=5316 execve guuid=b7b452b0-1f00-0000-6586-4d9dc5140000 pid=5317 /tmp/FbVS guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=b7b452b0-1f00-0000-6586-4d9dc5140000 pid=5317 execve guuid=c5aaebb3-1f00-0000-6586-4d9dc7140000 pid=5319 /usr/bin/rm guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=c5aaebb3-1f00-0000-6586-4d9dc7140000 pid=5319 execve guuid=c5f59fb4-1f00-0000-6586-4d9dc8140000 pid=5320 /usr/bin/wget net send-data write-file guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=c5f59fb4-1f00-0000-6586-4d9dc8140000 pid=5320 execve guuid=f73fecc5-1f00-0000-6586-4d9dc9140000 pid=5321 /usr/bin/chmod guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=f73fecc5-1f00-0000-6586-4d9dc9140000 pid=5321 execve guuid=dd24cac6-1f00-0000-6586-4d9dca140000 pid=5322 /tmp/BnSy guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=dd24cac6-1f00-0000-6586-4d9dca140000 pid=5322 execve guuid=b0b4fbc7-1f00-0000-6586-4d9dcc140000 pid=5324 /usr/bin/rm guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=b0b4fbc7-1f00-0000-6586-4d9dcc140000 pid=5324 execve guuid=e6de77c8-1f00-0000-6586-4d9dcd140000 pid=5325 /usr/bin/wget net send-data write-file guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=e6de77c8-1f00-0000-6586-4d9dcd140000 pid=5325 execve guuid=a4e960ed-1f00-0000-6586-4d9dce140000 pid=5326 /usr/bin/chmod guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=a4e960ed-1f00-0000-6586-4d9dce140000 pid=5326 execve guuid=790863ee-1f00-0000-6586-4d9dcf140000 pid=5327 /tmp/WmD guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=790863ee-1f00-0000-6586-4d9dcf140000 pid=5327 execve guuid=4887b4f0-1f00-0000-6586-4d9dd1140000 pid=5329 /usr/bin/rm guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=4887b4f0-1f00-0000-6586-4d9dd1140000 pid=5329 execve guuid=3b736df1-1f00-0000-6586-4d9dd2140000 pid=5330 /usr/bin/wget net send-data write-file guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=3b736df1-1f00-0000-6586-4d9dd2140000 pid=5330 execve guuid=aba5c101-2000-0000-6586-4d9dd3140000 pid=5331 /usr/bin/chmod guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=aba5c101-2000-0000-6586-4d9dd3140000 pid=5331 execve guuid=2755b607-2000-0000-6586-4d9dd4140000 pid=5332 /tmp/rKrg guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=2755b607-2000-0000-6586-4d9dd4140000 pid=5332 execve guuid=799af710-2000-0000-6586-4d9dd6140000 pid=5334 /usr/bin/rm delete-file guuid=86f3712f-1f00-0000-6586-4d9d3f140000 pid=5183->guuid=799af710-2000-0000-6586-4d9dd6140000 pid=5334 execve 801186e6-5fe8-5959-a7b4-832d8d66e7aa 129.121.114.124:80 guuid=98306f6e-1f00-0000-6586-4d9dbe140000 pid=5310->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 133B guuid=2ea0b5a0-1f00-0000-6586-4d9dc3140000 pid=5315->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 134B guuid=c5f59fb4-1f00-0000-6586-4d9dc8140000 pid=5320->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 134B guuid=e6de77c8-1f00-0000-6586-4d9dcd140000 pid=5325->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 133B guuid=3b736df1-1f00-0000-6586-4d9dd2140000 pid=5330->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 134B
Score:
94%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/2c97e2d57359fb344b5de8164fa93f8ec2e4cb758a908ec25a1ab742dca9a99c
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2c97e2d57359fb344b5de8164fa93f8ec2e4cb758a908ec25a1ab742dca9a99c/
Threat name:
Document-HTML.Trojan.Bash
Create hunting rule
Status:
Malicious
First seen:
2026-07-17 01:07:48 UTC
File Type:
Text (Shell)
AV detection:
10 of 24 (41.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fsl6fvltlh5tis255ale7kj7r3bojs3vrkii5qs2dk3ufxfjvgoa._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
discovery linux
Link:
https://tria.ge/reports/260717-bgyrwsg13n/
Behaviour
Reads runtime system information
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.26
Link:
https://yomi.yoroi.company/submissions/2c97e2d57359fb344b5de8164fa93f8ec2e4cb758a908ec25a1ab742dca9a99c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 2c97e2d57359fb344b5de8164fa93f8ec2e4cb758a908ec25a1ab742dca9a99c

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3874630/
  
Delivery method
Distributed via web download

Comments