MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3aea9c7919327052e692edd2f2c333296cb2a812bda0cb58ea3ee200137b4f29. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3aea9c7919327052e692edd2f2c333296cb2a812bda0cb58ea3ee200137b4f29
SHA3-384 hash: 097868d1ce63d81860ba306147eeaf029adc5902cd7d95b8b08764fc294a81dc9a6c1a4af5fa8458bc8319fc46d994e0
SHA1 hash: bac5ccca295fc85961bac6c138f2b22bec1a7743
MD5 hash: 12c11f40601d50c0d23eff20a93122a7
humanhash: eighteen-hydrogen-vegan-east
File name:lil
Download: download sample
File size:844 bytes
First seen:2026-08-08 08:50:35 UTC
Last seen:2026-08-08 20:38:44 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 24:kXCKysE2hi0ziQvZohan7qFVJjON9PNmKX:e9Qp+Msn7+Vta7mKX
TLSH T1BD01AFC68100AA505099AA2D22A75094F851C3CF154B4B69BFAC6D7DFBD8C14B066F88
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://129.121.114.124/5S4n/an/aua-wget
http://129.121.114.124/xzOQn/an/aua-wget
http://129.121.114.124/TXAn/an/aua-wget
http://129.121.114.124/Mxxn/an/aua-wget
http://129.121.114.124/Hxqhn/an/aua-wget

Intelligence

File Origin
# of uploads :
2
# of downloads :
49
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive mirai
Link:
https://www.filescan.io/uploads/6a76ee060be5721277eb32fd/reports/c04571ba-08a8-41f0-a8c7-43c6d1c272e6/overview
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/93a62dfe-73fa-444d-9ac6-f843d1fd486d
Behavior Graph:
Download SVG
%3 guuid=1d5ff84a-1700-0000-9c98-10a24d0d0000 pid=3405 /usr/bin/sudo guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406 /tmp/sample.bin write-file guuid=1d5ff84a-1700-0000-9c98-10a24d0d0000 pid=3405->guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406 execve guuid=bd19d94e-1700-0000-9c98-10a24f0d0000 pid=3407 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=bd19d94e-1700-0000-9c98-10a24f0d0000 pid=3407 execve guuid=dc1c954f-1700-0000-9c98-10a2510d0000 pid=3409 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=dc1c954f-1700-0000-9c98-10a2510d0000 pid=3409 execve guuid=48f86250-1700-0000-9c98-10a2520d0000 pid=3410 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=48f86250-1700-0000-9c98-10a2520d0000 pid=3410 execve guuid=5317ce50-1700-0000-9c98-10a2530d0000 pid=3411 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=5317ce50-1700-0000-9c98-10a2530d0000 pid=3411 execve guuid=16df3d51-1700-0000-9c98-10a2550d0000 pid=3413 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=16df3d51-1700-0000-9c98-10a2550d0000 pid=3413 execve guuid=218e9c51-1700-0000-9c98-10a2570d0000 pid=3415 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=218e9c51-1700-0000-9c98-10a2570d0000 pid=3415 execve guuid=83e0f751-1700-0000-9c98-10a2590d0000 pid=3417 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=83e0f751-1700-0000-9c98-10a2590d0000 pid=3417 execve guuid=00655552-1700-0000-9c98-10a25c0d0000 pid=3420 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=00655552-1700-0000-9c98-10a25c0d0000 pid=3420 execve guuid=3d48b152-1700-0000-9c98-10a25e0d0000 pid=3422 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=3d48b152-1700-0000-9c98-10a25e0d0000 pid=3422 execve guuid=49cd0f53-1700-0000-9c98-10a2610d0000 pid=3425 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=49cd0f53-1700-0000-9c98-10a2610d0000 pid=3425 execve guuid=646b6e53-1700-0000-9c98-10a2630d0000 pid=3427 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=646b6e53-1700-0000-9c98-10a2630d0000 pid=3427 execve guuid=09b0ce53-1700-0000-9c98-10a2650d0000 pid=3429 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=09b0ce53-1700-0000-9c98-10a2650d0000 pid=3429 execve guuid=c03a2e54-1700-0000-9c98-10a2680d0000 pid=3432 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=c03a2e54-1700-0000-9c98-10a2680d0000 pid=3432 execve guuid=1c8c9054-1700-0000-9c98-10a26a0d0000 pid=3434 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=1c8c9054-1700-0000-9c98-10a26a0d0000 pid=3434 execve guuid=beeced54-1700-0000-9c98-10a26d0d0000 pid=3437 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=beeced54-1700-0000-9c98-10a26d0d0000 pid=3437 execve guuid=74544755-1700-0000-9c98-10a26f0d0000 pid=3439 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=74544755-1700-0000-9c98-10a26f0d0000 pid=3439 execve guuid=1adba255-1700-0000-9c98-10a2710d0000 pid=3441 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=1adba255-1700-0000-9c98-10a2710d0000 pid=3441 execve guuid=d200fe55-1700-0000-9c98-10a2740d0000 pid=3444 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=d200fe55-1700-0000-9c98-10a2740d0000 pid=3444 execve guuid=17246256-1700-0000-9c98-10a2760d0000 pid=3446 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=17246256-1700-0000-9c98-10a2760d0000 pid=3446 execve guuid=46adbd56-1700-0000-9c98-10a2790d0000 pid=3449 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=46adbd56-1700-0000-9c98-10a2790d0000 pid=3449 execve guuid=46ff1c57-1700-0000-9c98-10a27c0d0000 pid=3452 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=46ff1c57-1700-0000-9c98-10a27c0d0000 pid=3452 execve guuid=48d37557-1700-0000-9c98-10a27e0d0000 pid=3454 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=48d37557-1700-0000-9c98-10a27e0d0000 pid=3454 execve guuid=2db8d157-1700-0000-9c98-10a2800d0000 pid=3456 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=2db8d157-1700-0000-9c98-10a2800d0000 pid=3456 execve guuid=df462c58-1700-0000-9c98-10a2830d0000 pid=3459 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=df462c58-1700-0000-9c98-10a2830d0000 pid=3459 execve guuid=b9388c58-1700-0000-9c98-10a2880d0000 pid=3464 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=b9388c58-1700-0000-9c98-10a2880d0000 pid=3464 execve guuid=33614759-1700-0000-9c98-10a28a0d0000 pid=3466 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=33614759-1700-0000-9c98-10a28a0d0000 pid=3466 execve guuid=dbb59b59-1700-0000-9c98-10a28c0d0000 pid=3468 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=dbb59b59-1700-0000-9c98-10a28c0d0000 pid=3468 execve guuid=2e95ec59-1700-0000-9c98-10a28d0d0000 pid=3469 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=2e95ec59-1700-0000-9c98-10a28d0d0000 pid=3469 execve guuid=809a395a-1700-0000-9c98-10a28f0d0000 pid=3471 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=809a395a-1700-0000-9c98-10a28f0d0000 pid=3471 execve guuid=eab4875a-1700-0000-9c98-10a2910d0000 pid=3473 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=eab4875a-1700-0000-9c98-10a2910d0000 pid=3473 execve guuid=1147d65a-1700-0000-9c98-10a2930d0000 pid=3475 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=1147d65a-1700-0000-9c98-10a2930d0000 pid=3475 execve guuid=426c225b-1700-0000-9c98-10a2950d0000 pid=3477 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=426c225b-1700-0000-9c98-10a2950d0000 pid=3477 execve guuid=298a6e5b-1700-0000-9c98-10a2970d0000 pid=3479 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=298a6e5b-1700-0000-9c98-10a2970d0000 pid=3479 execve guuid=df3fbc5b-1700-0000-9c98-10a2990d0000 pid=3481 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=df3fbc5b-1700-0000-9c98-10a2990d0000 pid=3481 execve guuid=f0aa085c-1700-0000-9c98-10a29b0d0000 pid=3483 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=f0aa085c-1700-0000-9c98-10a29b0d0000 pid=3483 execve guuid=0ddd545c-1700-0000-9c98-10a29d0d0000 pid=3485 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=0ddd545c-1700-0000-9c98-10a29d0d0000 pid=3485 execve guuid=6f1aa05c-1700-0000-9c98-10a29e0d0000 pid=3486 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=6f1aa05c-1700-0000-9c98-10a29e0d0000 pid=3486 execve guuid=b081ec5c-1700-0000-9c98-10a2a00d0000 pid=3488 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=b081ec5c-1700-0000-9c98-10a2a00d0000 pid=3488 execve guuid=c8aa395d-1700-0000-9c98-10a2a30d0000 pid=3491 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=c8aa395d-1700-0000-9c98-10a2a30d0000 pid=3491 execve guuid=c128865d-1700-0000-9c98-10a2a40d0000 pid=3492 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=c128865d-1700-0000-9c98-10a2a40d0000 pid=3492 execve guuid=0414fd5d-1700-0000-9c98-10a2a70d0000 pid=3495 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=0414fd5d-1700-0000-9c98-10a2a70d0000 pid=3495 execve guuid=497c635e-1700-0000-9c98-10a2a80d0000 pid=3496 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=497c635e-1700-0000-9c98-10a2a80d0000 pid=3496 execve guuid=715dc45e-1700-0000-9c98-10a2aa0d0000 pid=3498 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=715dc45e-1700-0000-9c98-10a2aa0d0000 pid=3498 execve guuid=b298255f-1700-0000-9c98-10a2ac0d0000 pid=3500 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=b298255f-1700-0000-9c98-10a2ac0d0000 pid=3500 execve guuid=5774885f-1700-0000-9c98-10a2af0d0000 pid=3503 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=5774885f-1700-0000-9c98-10a2af0d0000 pid=3503 execve guuid=ee03e85f-1700-0000-9c98-10a2b10d0000 pid=3505 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=ee03e85f-1700-0000-9c98-10a2b10d0000 pid=3505 execve guuid=94e74060-1700-0000-9c98-10a2b30d0000 pid=3507 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=94e74060-1700-0000-9c98-10a2b30d0000 pid=3507 execve guuid=b077a460-1700-0000-9c98-10a2b50d0000 pid=3509 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=b077a460-1700-0000-9c98-10a2b50d0000 pid=3509 execve guuid=b1af1261-1700-0000-9c98-10a2b70d0000 pid=3511 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=b1af1261-1700-0000-9c98-10a2b70d0000 pid=3511 execve guuid=ce6b7961-1700-0000-9c98-10a2ba0d0000 pid=3514 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=ce6b7961-1700-0000-9c98-10a2ba0d0000 pid=3514 execve guuid=9f1fe461-1700-0000-9c98-10a2bc0d0000 pid=3516 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=9f1fe461-1700-0000-9c98-10a2bc0d0000 pid=3516 execve guuid=410b5762-1700-0000-9c98-10a2bf0d0000 pid=3519 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=410b5762-1700-0000-9c98-10a2bf0d0000 pid=3519 execve guuid=8a0baf62-1700-0000-9c98-10a2c10d0000 pid=3521 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=8a0baf62-1700-0000-9c98-10a2c10d0000 pid=3521 execve guuid=84fd1763-1700-0000-9c98-10a2c30d0000 pid=3523 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=84fd1763-1700-0000-9c98-10a2c30d0000 pid=3523 execve guuid=1b887263-1700-0000-9c98-10a2c50d0000 pid=3525 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=1b887263-1700-0000-9c98-10a2c50d0000 pid=3525 execve guuid=0a2eda63-1700-0000-9c98-10a2c80d0000 pid=3528 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=0a2eda63-1700-0000-9c98-10a2c80d0000 pid=3528 execve guuid=f40d3964-1700-0000-9c98-10a2ca0d0000 pid=3530 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=f40d3964-1700-0000-9c98-10a2ca0d0000 pid=3530 execve guuid=7c5c9864-1700-0000-9c98-10a2cb0d0000 pid=3531 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=7c5c9864-1700-0000-9c98-10a2cb0d0000 pid=3531 execve guuid=28c4f764-1700-0000-9c98-10a2ce0d0000 pid=3534 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=28c4f764-1700-0000-9c98-10a2ce0d0000 pid=3534 execve guuid=b02b5765-1700-0000-9c98-10a2d00d0000 pid=3536 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=b02b5765-1700-0000-9c98-10a2d00d0000 pid=3536 execve guuid=08efb265-1700-0000-9c98-10a2d10d0000 pid=3537 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=08efb265-1700-0000-9c98-10a2d10d0000 pid=3537 execve guuid=23b01366-1700-0000-9c98-10a2d30d0000 pid=3539 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=23b01366-1700-0000-9c98-10a2d30d0000 pid=3539 execve guuid=7f057166-1700-0000-9c98-10a2d50d0000 pid=3541 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=7f057166-1700-0000-9c98-10a2d50d0000 pid=3541 execve guuid=4e78d066-1700-0000-9c98-10a2d70d0000 pid=3543 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=4e78d066-1700-0000-9c98-10a2d70d0000 pid=3543 execve guuid=08342867-1700-0000-9c98-10a2d90d0000 pid=3545 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=08342867-1700-0000-9c98-10a2d90d0000 pid=3545 execve guuid=1b918967-1700-0000-9c98-10a2da0d0000 pid=3546 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=1b918967-1700-0000-9c98-10a2da0d0000 pid=3546 execve guuid=234be267-1700-0000-9c98-10a2dc0d0000 pid=3548 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=234be267-1700-0000-9c98-10a2dc0d0000 pid=3548 execve guuid=b7314068-1700-0000-9c98-10a2dd0d0000 pid=3549 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=b7314068-1700-0000-9c98-10a2dd0d0000 pid=3549 execve guuid=bda49768-1700-0000-9c98-10a2df0d0000 pid=3551 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=bda49768-1700-0000-9c98-10a2df0d0000 pid=3551 execve guuid=04481469-1700-0000-9c98-10a2e30d0000 pid=3555 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=04481469-1700-0000-9c98-10a2e30d0000 pid=3555 execve guuid=eb117f69-1700-0000-9c98-10a2e50d0000 pid=3557 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=eb117f69-1700-0000-9c98-10a2e50d0000 pid=3557 execve guuid=7635f869-1700-0000-9c98-10a2e90d0000 pid=3561 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=7635f869-1700-0000-9c98-10a2e90d0000 pid=3561 execve guuid=b8be686a-1700-0000-9c98-10a2eb0d0000 pid=3563 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=b8be686a-1700-0000-9c98-10a2eb0d0000 pid=3563 execve guuid=02efec6a-1700-0000-9c98-10a2ed0d0000 pid=3565 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=02efec6a-1700-0000-9c98-10a2ed0d0000 pid=3565 execve guuid=7f615e6b-1700-0000-9c98-10a2ee0d0000 pid=3566 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=7f615e6b-1700-0000-9c98-10a2ee0d0000 pid=3566 execve guuid=6746da6b-1700-0000-9c98-10a2ef0d0000 pid=3567 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=6746da6b-1700-0000-9c98-10a2ef0d0000 pid=3567 execve guuid=0cec4c6c-1700-0000-9c98-10a2f00d0000 pid=3568 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=0cec4c6c-1700-0000-9c98-10a2f00d0000 pid=3568 execve guuid=585ec46c-1700-0000-9c98-10a2f10d0000 pid=3569 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=585ec46c-1700-0000-9c98-10a2f10d0000 pid=3569 execve guuid=5704386d-1700-0000-9c98-10a2f20d0000 pid=3570 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=5704386d-1700-0000-9c98-10a2f20d0000 pid=3570 execve guuid=328fe26d-1700-0000-9c98-10a2f30d0000 pid=3571 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=328fe26d-1700-0000-9c98-10a2f30d0000 pid=3571 execve guuid=5696c26e-1700-0000-9c98-10a2f40d0000 pid=3572 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=5696c26e-1700-0000-9c98-10a2f40d0000 pid=3572 execve guuid=105b956f-1700-0000-9c98-10a2f50d0000 pid=3573 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=105b956f-1700-0000-9c98-10a2f50d0000 pid=3573 execve guuid=d8815170-1700-0000-9c98-10a2f60d0000 pid=3574 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=d8815170-1700-0000-9c98-10a2f60d0000 pid=3574 execve guuid=5b5ec770-1700-0000-9c98-10a2f70d0000 pid=3575 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=5b5ec770-1700-0000-9c98-10a2f70d0000 pid=3575 execve guuid=22f93671-1700-0000-9c98-10a2f80d0000 pid=3576 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=22f93671-1700-0000-9c98-10a2f80d0000 pid=3576 execve guuid=34cbae71-1700-0000-9c98-10a2f90d0000 pid=3577 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=34cbae71-1700-0000-9c98-10a2f90d0000 pid=3577 execve guuid=825e4872-1700-0000-9c98-10a2fa0d0000 pid=3578 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=825e4872-1700-0000-9c98-10a2fa0d0000 pid=3578 execve guuid=ad5c0973-1700-0000-9c98-10a2fb0d0000 pid=3579 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=ad5c0973-1700-0000-9c98-10a2fb0d0000 pid=3579 execve guuid=ff3a3574-1700-0000-9c98-10a2ff0d0000 pid=3583 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=ff3a3574-1700-0000-9c98-10a2ff0d0000 pid=3583 execve guuid=86fbd874-1700-0000-9c98-10a2000e0000 pid=3584 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=86fbd874-1700-0000-9c98-10a2000e0000 pid=3584 execve guuid=e4646a75-1700-0000-9c98-10a2020e0000 pid=3586 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=e4646a75-1700-0000-9c98-10a2020e0000 pid=3586 execve guuid=8a75e475-1700-0000-9c98-10a2050e0000 pid=3589 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=8a75e475-1700-0000-9c98-10a2050e0000 pid=3589 execve guuid=9c996676-1700-0000-9c98-10a2090e0000 pid=3593 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=9c996676-1700-0000-9c98-10a2090e0000 pid=3593 execve guuid=1d05f476-1700-0000-9c98-10a20a0e0000 pid=3594 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=1d05f476-1700-0000-9c98-10a20a0e0000 pid=3594 execve guuid=c8f69477-1700-0000-9c98-10a20e0e0000 pid=3598 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=c8f69477-1700-0000-9c98-10a20e0e0000 pid=3598 execve guuid=321b0b78-1700-0000-9c98-10a2120e0000 pid=3602 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=321b0b78-1700-0000-9c98-10a2120e0000 pid=3602 execve guuid=0a6bf578-1700-0000-9c98-10a2130e0000 pid=3603 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=0a6bf578-1700-0000-9c98-10a2130e0000 pid=3603 execve guuid=3da47679-1700-0000-9c98-10a2160e0000 pid=3606 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=3da47679-1700-0000-9c98-10a2160e0000 pid=3606 execve guuid=0e79e679-1700-0000-9c98-10a2180e0000 pid=3608 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=0e79e679-1700-0000-9c98-10a2180e0000 pid=3608 execve guuid=d9ad637a-1700-0000-9c98-10a21a0e0000 pid=3610 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=d9ad637a-1700-0000-9c98-10a21a0e0000 pid=3610 execve guuid=bf9cda7a-1700-0000-9c98-10a21c0e0000 pid=3612 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=bf9cda7a-1700-0000-9c98-10a21c0e0000 pid=3612 execve guuid=2fab3b7b-1700-0000-9c98-10a21e0e0000 pid=3614 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=2fab3b7b-1700-0000-9c98-10a21e0e0000 pid=3614 execve guuid=8ef29e7b-1700-0000-9c98-10a2200e0000 pid=3616 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=8ef29e7b-1700-0000-9c98-10a2200e0000 pid=3616 execve guuid=02edfa7b-1700-0000-9c98-10a2210e0000 pid=3617 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=02edfa7b-1700-0000-9c98-10a2210e0000 pid=3617 execve guuid=31558d7c-1700-0000-9c98-10a2230e0000 pid=3619 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=31558d7c-1700-0000-9c98-10a2230e0000 pid=3619 execve guuid=b86f9c7d-1700-0000-9c98-10a2240e0000 pid=3620 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=b86f9c7d-1700-0000-9c98-10a2240e0000 pid=3620 execve guuid=cd16a77e-1700-0000-9c98-10a2250e0000 pid=3621 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=cd16a77e-1700-0000-9c98-10a2250e0000 pid=3621 execve guuid=3b129d7f-1700-0000-9c98-10a2290e0000 pid=3625 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=3b129d7f-1700-0000-9c98-10a2290e0000 pid=3625 execve guuid=43d38380-1700-0000-9c98-10a22b0e0000 pid=3627 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=43d38380-1700-0000-9c98-10a22b0e0000 pid=3627 execve guuid=d4443381-1700-0000-9c98-10a22e0e0000 pid=3630 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=d4443381-1700-0000-9c98-10a22e0e0000 pid=3630 execve guuid=dd66eb81-1700-0000-9c98-10a2310e0000 pid=3633 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=dd66eb81-1700-0000-9c98-10a2310e0000 pid=3633 execve guuid=b33e9682-1700-0000-9c98-10a2340e0000 pid=3636 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=b33e9682-1700-0000-9c98-10a2340e0000 pid=3636 execve guuid=0dce4983-1700-0000-9c98-10a2360e0000 pid=3638 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=0dce4983-1700-0000-9c98-10a2360e0000 pid=3638 execve guuid=bbee0484-1700-0000-9c98-10a2390e0000 pid=3641 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=bbee0484-1700-0000-9c98-10a2390e0000 pid=3641 execve guuid=66ceb584-1700-0000-9c98-10a23b0e0000 pid=3643 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=66ceb584-1700-0000-9c98-10a23b0e0000 pid=3643 execve guuid=77171f85-1700-0000-9c98-10a23f0e0000 pid=3647 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=77171f85-1700-0000-9c98-10a23f0e0000 pid=3647 execve guuid=45cfba85-1700-0000-9c98-10a2430e0000 pid=3651 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=45cfba85-1700-0000-9c98-10a2430e0000 pid=3651 execve guuid=b8564f86-1700-0000-9c98-10a2450e0000 pid=3653 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=b8564f86-1700-0000-9c98-10a2450e0000 pid=3653 execve guuid=5bfdc886-1700-0000-9c98-10a2470e0000 pid=3655 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=5bfdc886-1700-0000-9c98-10a2470e0000 pid=3655 execve guuid=22852187-1700-0000-9c98-10a2490e0000 pid=3657 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=22852187-1700-0000-9c98-10a2490e0000 pid=3657 execve guuid=3da79087-1700-0000-9c98-10a24c0e0000 pid=3660 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=3da79087-1700-0000-9c98-10a24c0e0000 pid=3660 execve guuid=dd46fc87-1700-0000-9c98-10a24e0e0000 pid=3662 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=dd46fc87-1700-0000-9c98-10a24e0e0000 pid=3662 execve guuid=ec798388-1700-0000-9c98-10a24f0e0000 pid=3663 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=ec798388-1700-0000-9c98-10a24f0e0000 pid=3663 execve guuid=48001189-1700-0000-9c98-10a2500e0000 pid=3664 /usr/bin/ls guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=48001189-1700-0000-9c98-10a2500e0000 pid=3664 execve guuid=7a93a789-1700-0000-9c98-10a2510e0000 pid=3665 /usr/bin/rm guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=7a93a789-1700-0000-9c98-10a2510e0000 pid=3665 execve guuid=ef22028a-1700-0000-9c98-10a2520e0000 pid=3666 /usr/bin/wget net send-data write-file guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=ef22028a-1700-0000-9c98-10a2520e0000 pid=3666 execve guuid=de920fa3-1700-0000-9c98-10a2760e0000 pid=3702 /usr/bin/chmod guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=de920fa3-1700-0000-9c98-10a2760e0000 pid=3702 execve guuid=394389a3-1700-0000-9c98-10a2770e0000 pid=3703 /usr/bin/dash guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=394389a3-1700-0000-9c98-10a2770e0000 pid=3703 clone guuid=a8c96ba4-1700-0000-9c98-10a27c0e0000 pid=3708 /usr/bin/rm guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=a8c96ba4-1700-0000-9c98-10a27c0e0000 pid=3708 execve guuid=a1b4aea4-1700-0000-9c98-10a2800e0000 pid=3712 /usr/bin/wget net send-data write-file guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=a1b4aea4-1700-0000-9c98-10a2800e0000 pid=3712 execve guuid=f1f5babd-1700-0000-9c98-10a2f60e0000 pid=3830 /usr/bin/chmod guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=f1f5babd-1700-0000-9c98-10a2f60e0000 pid=3830 execve guuid=c29216be-1700-0000-9c98-10a2f70e0000 pid=3831 /usr/bin/dash guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=c29216be-1700-0000-9c98-10a2f70e0000 pid=3831 clone guuid=3e0ab5be-1700-0000-9c98-10a2fa0e0000 pid=3834 /usr/bin/rm guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=3e0ab5be-1700-0000-9c98-10a2fa0e0000 pid=3834 execve guuid=e29927bf-1700-0000-9c98-10a2fc0e0000 pid=3836 /usr/bin/wget net send-data write-file guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=e29927bf-1700-0000-9c98-10a2fc0e0000 pid=3836 execve guuid=127a81d9-1700-0000-9c98-10a25a0f0000 pid=3930 /usr/bin/chmod guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=127a81d9-1700-0000-9c98-10a25a0f0000 pid=3930 execve guuid=ce02eed9-1700-0000-9c98-10a25b0f0000 pid=3931 /usr/bin/dash guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=ce02eed9-1700-0000-9c98-10a25b0f0000 pid=3931 clone guuid=a5dc27dc-1700-0000-9c98-10a26a0f0000 pid=3946 /usr/bin/rm guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=a5dc27dc-1700-0000-9c98-10a26a0f0000 pid=3946 execve guuid=71a080dc-1700-0000-9c98-10a26c0f0000 pid=3948 /usr/bin/wget net send-data write-file guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=71a080dc-1700-0000-9c98-10a26c0f0000 pid=3948 execve guuid=feb1b7fb-1700-0000-9c98-10a2e40f0000 pid=4068 /usr/bin/chmod guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=feb1b7fb-1700-0000-9c98-10a2e40f0000 pid=4068 execve guuid=571d22fc-1700-0000-9c98-10a2e80f0000 pid=4072 /usr/bin/dash guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=571d22fc-1700-0000-9c98-10a2e80f0000 pid=4072 clone guuid=4dcca0fd-1700-0000-9c98-10a2ee0f0000 pid=4078 /usr/bin/rm guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=4dcca0fd-1700-0000-9c98-10a2ee0f0000 pid=4078 execve guuid=285ed4fd-1700-0000-9c98-10a2f10f0000 pid=4081 /usr/bin/wget net send-data write-file guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=285ed4fd-1700-0000-9c98-10a2f10f0000 pid=4081 execve guuid=00665b1d-1800-0000-9c98-10a25e100000 pid=4190 /usr/bin/chmod guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=00665b1d-1800-0000-9c98-10a25e100000 pid=4190 execve guuid=56ddd21d-1800-0000-9c98-10a262100000 pid=4194 /usr/bin/dash guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=56ddd21d-1800-0000-9c98-10a262100000 pid=4194 clone guuid=3378de1e-1800-0000-9c98-10a267100000 pid=4199 /usr/bin/rm delete-file guuid=fafb594e-1700-0000-9c98-10a24e0d0000 pid=3406->guuid=3378de1e-1800-0000-9c98-10a267100000 pid=4199 execve 801186e6-5fe8-5959-a7b4-832d8d66e7aa 129.121.114.124:80 guuid=ef22028a-1700-0000-9c98-10a2520e0000 pid=3666->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 133B guuid=a1b4aea4-1700-0000-9c98-10a2800e0000 pid=3712->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 134B guuid=e29927bf-1700-0000-9c98-10a2fc0e0000 pid=3836->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 133B guuid=71a080dc-1700-0000-9c98-10a26c0f0000 pid=3948->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 133B guuid=285ed4fd-1700-0000-9c98-10a2f10f0000 pid=4081->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 134B
Score:
96%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/3aea9c7919327052e692edd2f2c333296cb2a812bda0cb58ea3ee200137b4f29
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3aea9c7919327052e692edd2f2c333296cb2a812bda0cb58ea3ee200137b4f29/
Gathering data
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hlvjy6izgjyffzus5xjpfqztffwlfkasxwqmwwhkh3raae33j4uq._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
discovery linux
Link:
https://tria.ge/reports/260808-ksazmscl9z/
Behaviour
Reads runtime system information
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.26
Link:
https://yomi.yoroi.company/submissions/3aea9c7919327052e692edd2f2c333296cb2a812bda0cb58ea3ee200137b4f29

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 3aea9c7919327052e692edd2f2c333296cb2a812bda0cb58ea3ee200137b4f29

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3874630/
  
Delivery method
Distributed via web download

Comments