MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 439f16970216d388246b290ebf445e20866ddd73bcd32e86b6b5b4f7404bb84e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 439f16970216d388246b290ebf445e20866ddd73bcd32e86b6b5b4f7404bb84e
SHA3-384 hash: 2d4f4555474ecff0ebf926a59311eb99c54f2395c3e6e73dadcc3a2b9926a8e1b55fc1c2899963ffe8005a7f12ffe24c
SHA1 hash: 86e17387d78c1f3d11c1754429a0756c7730b33f
MD5 hash: d120c3be19efd6471f91dcf801fc5d8d
humanhash: batman-victor-mango-rugby
File name:lil
Download: download sample
File size:848 bytes
First seen:2026-07-22 19:34:24 UTC
Last seen:2026-07-23 02:33:57 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkabCSmQn03FCvBnmXCxLEChMa11QC97aX:kXCKysE2hi0ziQvZohabnkFa8+EUOkaX
TLSH T1CE0188CAE110A940819AD4AD26E76094F420C7C7154A8F79FFACA86D9B98D08B03AFD4
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh

Intelligence

File Origin
# of uploads :
2
# of downloads :
68
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive mirai
Link:
https://www.filescan.io/uploads/6a611b44dcd931b1df9b021d/reports/9bf513bb-1c70-4cb8-b574-47813bd49238/overview
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/a479f88d-489a-4233-b422-dfe281cc752d
Behavior Graph:
Download SVG
%3 guuid=f5c07885-1600-0000-c536-8651760c0000 pid=3190 /usr/bin/sudo guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200 /tmp/sample.bin write-file guuid=f5c07885-1600-0000-c536-8651760c0000 pid=3190->guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200 execve guuid=1cac0c88-1600-0000-c536-8651810c0000 pid=3201 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=1cac0c88-1600-0000-c536-8651810c0000 pid=3201 execve guuid=2b4ae488-1600-0000-c536-8651830c0000 pid=3203 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=2b4ae488-1600-0000-c536-8651830c0000 pid=3203 execve guuid=8a274c89-1600-0000-c536-8651840c0000 pid=3204 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=8a274c89-1600-0000-c536-8651840c0000 pid=3204 execve guuid=dbe9a289-1600-0000-c536-8651860c0000 pid=3206 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=dbe9a289-1600-0000-c536-8651860c0000 pid=3206 execve guuid=51a80a8a-1600-0000-c536-8651870c0000 pid=3207 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=51a80a8a-1600-0000-c536-8651870c0000 pid=3207 execve guuid=0311978a-1600-0000-c536-8651880c0000 pid=3208 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=0311978a-1600-0000-c536-8651880c0000 pid=3208 execve guuid=1d5c198b-1600-0000-c536-8651890c0000 pid=3209 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=1d5c198b-1600-0000-c536-8651890c0000 pid=3209 execve guuid=3898968b-1600-0000-c536-86518a0c0000 pid=3210 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=3898968b-1600-0000-c536-86518a0c0000 pid=3210 execve guuid=fdb00e8c-1600-0000-c536-86518d0c0000 pid=3213 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=fdb00e8c-1600-0000-c536-86518d0c0000 pid=3213 execve guuid=4aa1838c-1600-0000-c536-86518f0c0000 pid=3215 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=4aa1838c-1600-0000-c536-86518f0c0000 pid=3215 execve guuid=3007068d-1600-0000-c536-8651910c0000 pid=3217 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=3007068d-1600-0000-c536-8651910c0000 pid=3217 execve guuid=78087c8d-1600-0000-c536-8651930c0000 pid=3219 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=78087c8d-1600-0000-c536-8651930c0000 pid=3219 execve guuid=7f6bf68d-1600-0000-c536-8651950c0000 pid=3221 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=7f6bf68d-1600-0000-c536-8651950c0000 pid=3221 execve guuid=24b2658e-1600-0000-c536-8651960c0000 pid=3222 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=24b2658e-1600-0000-c536-8651960c0000 pid=3222 execve guuid=2acaf18e-1600-0000-c536-8651970c0000 pid=3223 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=2acaf18e-1600-0000-c536-8651970c0000 pid=3223 execve guuid=79858b8f-1600-0000-c536-8651980c0000 pid=3224 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=79858b8f-1600-0000-c536-8651980c0000 pid=3224 execve guuid=f4c93b90-1600-0000-c536-8651990c0000 pid=3225 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=f4c93b90-1600-0000-c536-8651990c0000 pid=3225 execve guuid=ec10da90-1600-0000-c536-86519a0c0000 pid=3226 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=ec10da90-1600-0000-c536-86519a0c0000 pid=3226 execve guuid=11789091-1600-0000-c536-86519b0c0000 pid=3227 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=11789091-1600-0000-c536-86519b0c0000 pid=3227 execve guuid=eac52192-1600-0000-c536-86519c0c0000 pid=3228 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=eac52192-1600-0000-c536-86519c0c0000 pid=3228 execve guuid=8901aa92-1600-0000-c536-86519d0c0000 pid=3229 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=8901aa92-1600-0000-c536-86519d0c0000 pid=3229 execve guuid=3f914a93-1600-0000-c536-86519e0c0000 pid=3230 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=3f914a93-1600-0000-c536-86519e0c0000 pid=3230 execve guuid=e5f5de93-1600-0000-c536-86519f0c0000 pid=3231 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=e5f5de93-1600-0000-c536-86519f0c0000 pid=3231 execve guuid=0a338094-1600-0000-c536-8651a00c0000 pid=3232 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=0a338094-1600-0000-c536-8651a00c0000 pid=3232 execve guuid=297c1d95-1600-0000-c536-8651a10c0000 pid=3233 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=297c1d95-1600-0000-c536-8651a10c0000 pid=3233 execve guuid=82c8a595-1600-0000-c536-8651a20c0000 pid=3234 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=82c8a595-1600-0000-c536-8651a20c0000 pid=3234 execve guuid=b9e43296-1600-0000-c536-8651a30c0000 pid=3235 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=b9e43296-1600-0000-c536-8651a30c0000 pid=3235 execve guuid=c3c2c196-1600-0000-c536-8651a40c0000 pid=3236 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=c3c2c196-1600-0000-c536-8651a40c0000 pid=3236 execve guuid=3cb44897-1600-0000-c536-8651a50c0000 pid=3237 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=3cb44897-1600-0000-c536-8651a50c0000 pid=3237 execve guuid=49debe97-1600-0000-c536-8651a70c0000 pid=3239 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=49debe97-1600-0000-c536-8651a70c0000 pid=3239 execve guuid=82922c98-1600-0000-c536-8651a80c0000 pid=3240 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=82922c98-1600-0000-c536-8651a80c0000 pid=3240 execve guuid=4412a198-1600-0000-c536-8651a90c0000 pid=3241 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=4412a198-1600-0000-c536-8651a90c0000 pid=3241 execve guuid=2db70c99-1600-0000-c536-8651ab0c0000 pid=3243 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=2db70c99-1600-0000-c536-8651ab0c0000 pid=3243 execve guuid=7e6b6b99-1600-0000-c536-8651ad0c0000 pid=3245 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=7e6b6b99-1600-0000-c536-8651ad0c0000 pid=3245 execve guuid=891acf99-1600-0000-c536-8651af0c0000 pid=3247 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=891acf99-1600-0000-c536-8651af0c0000 pid=3247 execve guuid=36243a9a-1600-0000-c536-8651b20c0000 pid=3250 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=36243a9a-1600-0000-c536-8651b20c0000 pid=3250 execve guuid=f3df9f9a-1600-0000-c536-8651b40c0000 pid=3252 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=f3df9f9a-1600-0000-c536-8651b40c0000 pid=3252 execve guuid=509d019b-1600-0000-c536-8651b70c0000 pid=3255 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=509d019b-1600-0000-c536-8651b70c0000 pid=3255 execve guuid=5cf5619b-1600-0000-c536-8651b90c0000 pid=3257 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=5cf5619b-1600-0000-c536-8651b90c0000 pid=3257 execve guuid=01f6c59b-1600-0000-c536-8651bb0c0000 pid=3259 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=01f6c59b-1600-0000-c536-8651bb0c0000 pid=3259 execve guuid=b468329c-1600-0000-c536-8651bd0c0000 pid=3261 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=b468329c-1600-0000-c536-8651bd0c0000 pid=3261 execve guuid=c474b89c-1600-0000-c536-8651be0c0000 pid=3262 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=c474b89c-1600-0000-c536-8651be0c0000 pid=3262 execve guuid=09ae429d-1600-0000-c536-8651bf0c0000 pid=3263 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=09ae429d-1600-0000-c536-8651bf0c0000 pid=3263 execve guuid=305eb49d-1600-0000-c536-8651c10c0000 pid=3265 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=305eb49d-1600-0000-c536-8651c10c0000 pid=3265 execve guuid=ab22379e-1600-0000-c536-8651c30c0000 pid=3267 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=ab22379e-1600-0000-c536-8651c30c0000 pid=3267 execve guuid=509eca9e-1600-0000-c536-8651c60c0000 pid=3270 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=509eca9e-1600-0000-c536-8651c60c0000 pid=3270 execve guuid=7bca579f-1600-0000-c536-8651c90c0000 pid=3273 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=7bca579f-1600-0000-c536-8651c90c0000 pid=3273 execve guuid=88ede59f-1600-0000-c536-8651cb0c0000 pid=3275 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=88ede59f-1600-0000-c536-8651cb0c0000 pid=3275 execve guuid=b3f776a0-1600-0000-c536-8651cc0c0000 pid=3276 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=b3f776a0-1600-0000-c536-8651cc0c0000 pid=3276 execve guuid=edd914a1-1600-0000-c536-8651cf0c0000 pid=3279 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=edd914a1-1600-0000-c536-8651cf0c0000 pid=3279 execve guuid=3ea3aea1-1600-0000-c536-8651d20c0000 pid=3282 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=3ea3aea1-1600-0000-c536-8651d20c0000 pid=3282 execve guuid=10b223a2-1600-0000-c536-8651d40c0000 pid=3284 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=10b223a2-1600-0000-c536-8651d40c0000 pid=3284 execve guuid=47083aa3-1600-0000-c536-8651d60c0000 pid=3286 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=47083aa3-1600-0000-c536-8651d60c0000 pid=3286 execve guuid=7db14ba4-1600-0000-c536-8651d70c0000 pid=3287 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=7db14ba4-1600-0000-c536-8651d70c0000 pid=3287 execve guuid=352cf4a4-1600-0000-c536-8651d80c0000 pid=3288 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=352cf4a4-1600-0000-c536-8651d80c0000 pid=3288 execve guuid=02e08fa5-1600-0000-c536-8651d90c0000 pid=3289 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=02e08fa5-1600-0000-c536-8651d90c0000 pid=3289 execve guuid=b0a031a6-1600-0000-c536-8651da0c0000 pid=3290 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=b0a031a6-1600-0000-c536-8651da0c0000 pid=3290 execve guuid=668bb5a6-1600-0000-c536-8651db0c0000 pid=3291 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=668bb5a6-1600-0000-c536-8651db0c0000 pid=3291 execve guuid=961e27a7-1600-0000-c536-8651dc0c0000 pid=3292 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=961e27a7-1600-0000-c536-8651dc0c0000 pid=3292 execve guuid=f771a3a7-1600-0000-c536-8651dd0c0000 pid=3293 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=f771a3a7-1600-0000-c536-8651dd0c0000 pid=3293 execve guuid=3a322ba8-1600-0000-c536-8651de0c0000 pid=3294 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=3a322ba8-1600-0000-c536-8651de0c0000 pid=3294 execve guuid=319e8ca8-1600-0000-c536-8651e00c0000 pid=3296 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=319e8ca8-1600-0000-c536-8651e00c0000 pid=3296 execve guuid=bb45dea8-1600-0000-c536-8651e10c0000 pid=3297 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=bb45dea8-1600-0000-c536-8651e10c0000 pid=3297 execve guuid=2c5e36a9-1600-0000-c536-8651e30c0000 pid=3299 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=2c5e36a9-1600-0000-c536-8651e30c0000 pid=3299 execve guuid=93d38da9-1600-0000-c536-8651e50c0000 pid=3301 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=93d38da9-1600-0000-c536-8651e50c0000 pid=3301 execve guuid=8e32e4a9-1600-0000-c536-8651e70c0000 pid=3303 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=8e32e4a9-1600-0000-c536-8651e70c0000 pid=3303 execve guuid=48923eaa-1600-0000-c536-8651e90c0000 pid=3305 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=48923eaa-1600-0000-c536-8651e90c0000 pid=3305 execve guuid=f4cc97aa-1600-0000-c536-8651eb0c0000 pid=3307 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=f4cc97aa-1600-0000-c536-8651eb0c0000 pid=3307 execve guuid=10c310ab-1600-0000-c536-8651ee0c0000 pid=3310 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=10c310ab-1600-0000-c536-8651ee0c0000 pid=3310 execve guuid=de1780ab-1600-0000-c536-8651f00c0000 pid=3312 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=de1780ab-1600-0000-c536-8651f00c0000 pid=3312 execve guuid=fc71e1ab-1600-0000-c536-8651f30c0000 pid=3315 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=fc71e1ab-1600-0000-c536-8651f30c0000 pid=3315 execve guuid=106b43ac-1600-0000-c536-8651f40c0000 pid=3316 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=106b43ac-1600-0000-c536-8651f40c0000 pid=3316 execve guuid=9b31a0ac-1600-0000-c536-8651f60c0000 pid=3318 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=9b31a0ac-1600-0000-c536-8651f60c0000 pid=3318 execve guuid=bd0004ad-1600-0000-c536-8651f80c0000 pid=3320 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=bd0004ad-1600-0000-c536-8651f80c0000 pid=3320 execve guuid=be2e64ad-1600-0000-c536-8651fa0c0000 pid=3322 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=be2e64ad-1600-0000-c536-8651fa0c0000 pid=3322 execve guuid=3060c3ad-1600-0000-c536-8651fd0c0000 pid=3325 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=3060c3ad-1600-0000-c536-8651fd0c0000 pid=3325 execve guuid=59691bae-1600-0000-c536-8651ff0c0000 pid=3327 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=59691bae-1600-0000-c536-8651ff0c0000 pid=3327 execve guuid=3f977cae-1600-0000-c536-8651020d0000 pid=3330 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=3f977cae-1600-0000-c536-8651020d0000 pid=3330 execve guuid=96a6deae-1600-0000-c536-8651040d0000 pid=3332 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=96a6deae-1600-0000-c536-8651040d0000 pid=3332 execve guuid=ba034caf-1600-0000-c536-8651050d0000 pid=3333 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=ba034caf-1600-0000-c536-8651050d0000 pid=3333 execve guuid=4ca0b9af-1600-0000-c536-8651070d0000 pid=3335 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=4ca0b9af-1600-0000-c536-8651070d0000 pid=3335 execve guuid=c60060b0-1600-0000-c536-8651090d0000 pid=3337 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=c60060b0-1600-0000-c536-8651090d0000 pid=3337 execve guuid=bb09dcb0-1600-0000-c536-86510c0d0000 pid=3340 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=bb09dcb0-1600-0000-c536-86510c0d0000 pid=3340 execve guuid=f33c5cb1-1600-0000-c536-86510e0d0000 pid=3342 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=f33c5cb1-1600-0000-c536-86510e0d0000 pid=3342 execve guuid=f84cdfb1-1600-0000-c536-8651100d0000 pid=3344 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=f84cdfb1-1600-0000-c536-8651100d0000 pid=3344 execve guuid=a9cc5cb2-1600-0000-c536-8651130d0000 pid=3347 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=a9cc5cb2-1600-0000-c536-8651130d0000 pid=3347 execve guuid=8df2cdb2-1600-0000-c536-8651150d0000 pid=3349 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=8df2cdb2-1600-0000-c536-8651150d0000 pid=3349 execve guuid=1e3120b3-1600-0000-c536-8651180d0000 pid=3352 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=1e3120b3-1600-0000-c536-8651180d0000 pid=3352 execve guuid=fd9873b3-1600-0000-c536-86511a0d0000 pid=3354 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=fd9873b3-1600-0000-c536-86511a0d0000 pid=3354 execve guuid=55a9cab3-1600-0000-c536-86511d0d0000 pid=3357 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=55a9cab3-1600-0000-c536-86511d0d0000 pid=3357 execve guuid=f1fa1fb4-1600-0000-c536-86511f0d0000 pid=3359 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=f1fa1fb4-1600-0000-c536-86511f0d0000 pid=3359 execve guuid=f47874b4-1600-0000-c536-8651220d0000 pid=3362 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=f47874b4-1600-0000-c536-8651220d0000 pid=3362 execve guuid=09e2c6b4-1600-0000-c536-8651230d0000 pid=3363 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=09e2c6b4-1600-0000-c536-8651230d0000 pid=3363 execve guuid=7e0324b5-1600-0000-c536-8651250d0000 pid=3365 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=7e0324b5-1600-0000-c536-8651250d0000 pid=3365 execve guuid=0bf68bb5-1600-0000-c536-8651260d0000 pid=3366 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=0bf68bb5-1600-0000-c536-8651260d0000 pid=3366 execve guuid=fd9ae1b5-1600-0000-c536-8651290d0000 pid=3369 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=fd9ae1b5-1600-0000-c536-8651290d0000 pid=3369 execve guuid=747033b6-1600-0000-c536-86512b0d0000 pid=3371 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=747033b6-1600-0000-c536-86512b0d0000 pid=3371 execve guuid=6f9f87b6-1600-0000-c536-86512d0d0000 pid=3373 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=6f9f87b6-1600-0000-c536-86512d0d0000 pid=3373 execve guuid=7054dbb6-1600-0000-c536-86512f0d0000 pid=3375 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=7054dbb6-1600-0000-c536-86512f0d0000 pid=3375 execve guuid=313031b7-1600-0000-c536-8651310d0000 pid=3377 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=313031b7-1600-0000-c536-8651310d0000 pid=3377 execve guuid=29e584b7-1600-0000-c536-8651330d0000 pid=3379 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=29e584b7-1600-0000-c536-8651330d0000 pid=3379 execve guuid=b248d8b7-1600-0000-c536-8651350d0000 pid=3381 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=b248d8b7-1600-0000-c536-8651350d0000 pid=3381 execve guuid=c4d82cb8-1600-0000-c536-8651370d0000 pid=3383 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=c4d82cb8-1600-0000-c536-8651370d0000 pid=3383 execve guuid=aa1e84b8-1600-0000-c536-8651390d0000 pid=3385 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=aa1e84b8-1600-0000-c536-8651390d0000 pid=3385 execve guuid=6a25d8b8-1600-0000-c536-86513b0d0000 pid=3387 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=6a25d8b8-1600-0000-c536-86513b0d0000 pid=3387 execve guuid=d7f530b9-1600-0000-c536-86513d0d0000 pid=3389 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=d7f530b9-1600-0000-c536-86513d0d0000 pid=3389 execve guuid=bc1c85b9-1600-0000-c536-86513f0d0000 pid=3391 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=bc1c85b9-1600-0000-c536-86513f0d0000 pid=3391 execve guuid=81dfdbb9-1600-0000-c536-8651410d0000 pid=3393 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=81dfdbb9-1600-0000-c536-8651410d0000 pid=3393 execve guuid=21d02fba-1600-0000-c536-8651430d0000 pid=3395 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=21d02fba-1600-0000-c536-8651430d0000 pid=3395 execve guuid=3c6782ba-1600-0000-c536-8651450d0000 pid=3397 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=3c6782ba-1600-0000-c536-8651450d0000 pid=3397 execve guuid=2197d4ba-1600-0000-c536-8651470d0000 pid=3399 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=2197d4ba-1600-0000-c536-8651470d0000 pid=3399 execve guuid=ca3c4dbb-1600-0000-c536-86514a0d0000 pid=3402 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=ca3c4dbb-1600-0000-c536-86514a0d0000 pid=3402 execve guuid=cd3ba3bb-1600-0000-c536-86514c0d0000 pid=3404 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=cd3ba3bb-1600-0000-c536-86514c0d0000 pid=3404 execve guuid=5acff3bb-1600-0000-c536-86514e0d0000 pid=3406 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=5acff3bb-1600-0000-c536-86514e0d0000 pid=3406 execve guuid=f1d644bc-1600-0000-c536-8651500d0000 pid=3408 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=f1d644bc-1600-0000-c536-8651500d0000 pid=3408 execve guuid=d2d3c5bc-1600-0000-c536-8651530d0000 pid=3411 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=d2d3c5bc-1600-0000-c536-8651530d0000 pid=3411 execve guuid=223618bd-1600-0000-c536-8651550d0000 pid=3413 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=223618bd-1600-0000-c536-8651550d0000 pid=3413 execve guuid=c0ee6bbd-1600-0000-c536-8651570d0000 pid=3415 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=c0ee6bbd-1600-0000-c536-8651570d0000 pid=3415 execve guuid=d13ac1bd-1600-0000-c536-8651590d0000 pid=3417 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=d13ac1bd-1600-0000-c536-8651590d0000 pid=3417 execve guuid=5bc316be-1600-0000-c536-86515b0d0000 pid=3419 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=5bc316be-1600-0000-c536-86515b0d0000 pid=3419 execve guuid=133f90be-1600-0000-c536-86515e0d0000 pid=3422 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=133f90be-1600-0000-c536-86515e0d0000 pid=3422 execve guuid=79d8ebbe-1600-0000-c536-8651600d0000 pid=3424 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=79d8ebbe-1600-0000-c536-8651600d0000 pid=3424 execve guuid=49ef40bf-1600-0000-c536-8651620d0000 pid=3426 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=49ef40bf-1600-0000-c536-8651620d0000 pid=3426 execve guuid=89be97bf-1600-0000-c536-8651640d0000 pid=3428 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=89be97bf-1600-0000-c536-8651640d0000 pid=3428 execve guuid=a63bf2bf-1600-0000-c536-8651670d0000 pid=3431 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=a63bf2bf-1600-0000-c536-8651670d0000 pid=3431 execve guuid=59fe7ec0-1600-0000-c536-86516a0d0000 pid=3434 /usr/bin/ls guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=59fe7ec0-1600-0000-c536-86516a0d0000 pid=3434 execve guuid=14a3e0c0-1600-0000-c536-86516c0d0000 pid=3436 /usr/bin/rm guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=14a3e0c0-1600-0000-c536-86516c0d0000 pid=3436 execve guuid=21ac1cc1-1600-0000-c536-86516e0d0000 pid=3438 /usr/bin/wget net send-data write-file guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=21ac1cc1-1600-0000-c536-86516e0d0000 pid=3438 execve guuid=bd10dfc7-1600-0000-c536-8651840d0000 pid=3460 /usr/bin/chmod guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=bd10dfc7-1600-0000-c536-8651840d0000 pid=3460 execve guuid=8f5c46c8-1600-0000-c536-8651860d0000 pid=3462 /usr/bin/dash guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=8f5c46c8-1600-0000-c536-8651860d0000 pid=3462 clone guuid=212825c9-1600-0000-c536-8651890d0000 pid=3465 /usr/bin/rm guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=212825c9-1600-0000-c536-8651890d0000 pid=3465 execve guuid=352a7fc9-1600-0000-c536-86518b0d0000 pid=3467 /usr/bin/wget net send-data write-file guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=352a7fc9-1600-0000-c536-86518b0d0000 pid=3467 execve guuid=9a293fce-1600-0000-c536-8651990d0000 pid=3481 /usr/bin/chmod guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=9a293fce-1600-0000-c536-8651990d0000 pid=3481 execve guuid=18e472ce-1600-0000-c536-86519a0d0000 pid=3482 /usr/bin/dash guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=18e472ce-1600-0000-c536-86519a0d0000 pid=3482 clone guuid=3ae020cf-1600-0000-c536-86519e0d0000 pid=3486 /usr/bin/rm guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=3ae020cf-1600-0000-c536-86519e0d0000 pid=3486 execve guuid=1a706fcf-1600-0000-c536-8651a00d0000 pid=3488 /usr/bin/wget net send-data write-file guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=1a706fcf-1600-0000-c536-8651a00d0000 pid=3488 execve guuid=ea7664e1-1600-0000-c536-8651bc0d0000 pid=3516 /usr/bin/chmod guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=ea7664e1-1600-0000-c536-8651bc0d0000 pid=3516 execve guuid=7b024fe2-1600-0000-c536-8651bf0d0000 pid=3519 /usr/bin/dash guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=7b024fe2-1600-0000-c536-8651bf0d0000 pid=3519 clone guuid=3a8138e3-1600-0000-c536-8651c40d0000 pid=3524 /usr/bin/rm guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=3a8138e3-1600-0000-c536-8651c40d0000 pid=3524 execve guuid=6954d1e3-1600-0000-c536-8651c70d0000 pid=3527 /usr/bin/wget net send-data write-file guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=6954d1e3-1600-0000-c536-8651c70d0000 pid=3527 execve guuid=0d5791e9-1600-0000-c536-8651cf0d0000 pid=3535 /usr/bin/chmod guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=0d5791e9-1600-0000-c536-8651cf0d0000 pid=3535 execve guuid=e7aae7e9-1600-0000-c536-8651d00d0000 pid=3536 /usr/bin/dash guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=e7aae7e9-1600-0000-c536-8651d00d0000 pid=3536 clone guuid=e3b694ea-1600-0000-c536-8651d20d0000 pid=3538 /usr/bin/rm guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=e3b694ea-1600-0000-c536-8651d20d0000 pid=3538 execve guuid=72bbe6ea-1600-0000-c536-8651d30d0000 pid=3539 /usr/bin/wget net send-data write-file guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=72bbe6ea-1600-0000-c536-8651d30d0000 pid=3539 execve guuid=6e09ebf0-1600-0000-c536-8651de0d0000 pid=3550 /usr/bin/chmod guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=6e09ebf0-1600-0000-c536-8651de0d0000 pid=3550 execve guuid=1ad21ef1-1600-0000-c536-8651df0d0000 pid=3551 /usr/bin/dash guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=1ad21ef1-1600-0000-c536-8651df0d0000 pid=3551 clone guuid=77dee8f1-1600-0000-c536-8651e20d0000 pid=3554 /usr/bin/rm delete-file guuid=d0a9da87-1600-0000-c536-8651800c0000 pid=3200->guuid=77dee8f1-1600-0000-c536-8651e20d0000 pid=3554 execve 0b1ba66e-2f8f-542f-9f7c-00dd01da057c 129.121.110.105:80 guuid=21ac1cc1-1600-0000-c536-86516e0d0000 pid=3438->0b1ba66e-2f8f-542f-9f7c-00dd01da057c send: 134B guuid=352a7fc9-1600-0000-c536-86518b0d0000 pid=3467->0b1ba66e-2f8f-542f-9f7c-00dd01da057c send: 134B guuid=1a706fcf-1600-0000-c536-8651a00d0000 pid=3488->0b1ba66e-2f8f-542f-9f7c-00dd01da057c send: 133B guuid=6954d1e3-1600-0000-c536-8651c70d0000 pid=3527->0b1ba66e-2f8f-542f-9f7c-00dd01da057c send: 133B guuid=72bbe6ea-1600-0000-c536-8651d30d0000 pid=3539->0b1ba66e-2f8f-542f-9f7c-00dd01da057c send: 134B
Score:
99%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/439f16970216d388246b290ebf445e20866ddd73bcd32e86b6b5b4f7404bb84e
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/439f16970216d388246b290ebf445e20866ddd73bcd32e86b6b5b4f7404bb84e/
Threat name:
Document-HTML.Browser.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2026-07-22 19:35:41 UTC
File Type:
Text (Shell)
AV detection:
8 of 36 (22.22%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ioprnfycc3jyqjdlfehl6rc6ecdg3xltxtjs5bvwww2poqclxbha._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery execution linux persistence privilege_escalation
Link:
https://tria.ge/reports/260722-yab1wafr5z/
Behaviour
Enumerates kernel/hardware configuration
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
Creates/modifies Cron job
Enumerates running processes
Modifies rc script
Modifies systemd
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 439f16970216d388246b290ebf445e20866ddd73bcd32e86b6b5b4f7404bb84e

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3887344/
  
Delivery method
Distributed via web download

Comments