MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 48593feeaf08dce05dc846bdc9ffa649be6b9605470c8fc4282e7822e16be879. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 48593feeaf08dce05dc846bdc9ffa649be6b9605470c8fc4282e7822e16be879
SHA3-384 hash: 5036d4b933d3d5e03aa66f27684ec7d25f46cb098929854d0c9434eb3dc5ba751d986dfb6a8de6b089bd0f4a71409eb3
SHA1 hash: e31e6441f66300639d951ee44938282d7936f4d5
MD5 hash: 85349d139ad59e1fc0e105c6cc3daf22
humanhash: hawaii-quiet-fish-five
File name:lil
Download: download sample
File size:843 bytes
First seen:2026-06-08 02:50:48 UTC
Last seen:2026-06-08 13:32:29 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 24:kXCKysE2hi0ziQvZoha38FMFaYk0819FlwXX:e9Qp+Ms38FMFaYk0819WX
TLSH T1620159CAC0059A6051C6F8AD26D7A084B42183CB2A858BF9FEEC543D9BA5648B019EA4
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://188.132.232.81/nuabn/an/aelf ua-wget
http://188.132.232.81/y1En/an/aelf ua-wget
http://188.132.232.81/LRIn/an/aelf ua-wget
http://188.132.232.81/4YRXn/an/aelf ua-wget
http://188.132.232.81/vXhKn/an/aelf ua-wget

Intelligence

File Origin
# of uploads :
2
# of downloads :
56
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive
Link:
https://www.filescan.io/uploads/6a262e2b46e44aecc0d45048/reports/08236c8a-4ad3-473e-ae33-c855fbc89034/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-06-07T23:57:00Z UTC
Last seen:
2026-06-09T20:25:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan-Downloader.Shell.Agent.a
Link:
https://opentip.kaspersky.com/48593feeaf08dce05dc846bdc9ffa649be6b9605470c8fc4282e7822e16be879/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/526dbb79-308e-43d4-bc4b-084372c09dd1
Behavior Graph:
Download SVG
%3 guuid=51aae1f4-2800-0000-b6b5-7dbccf040000 pid=1231 /usr/bin/sudo guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240 /tmp/sample.bin write-file guuid=51aae1f4-2800-0000-b6b5-7dbccf040000 pid=1231->guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240 execve guuid=3f17c4f7-2800-0000-b6b5-7dbcda040000 pid=1242 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=3f17c4f7-2800-0000-b6b5-7dbcda040000 pid=1242 execve guuid=d66e2ff8-2800-0000-b6b5-7dbcdc040000 pid=1244 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=d66e2ff8-2800-0000-b6b5-7dbcdc040000 pid=1244 execve guuid=c2e2b0f8-2800-0000-b6b5-7dbcde040000 pid=1246 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=c2e2b0f8-2800-0000-b6b5-7dbcde040000 pid=1246 execve guuid=5e0810f9-2800-0000-b6b5-7dbce0040000 pid=1248 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=5e0810f9-2800-0000-b6b5-7dbce0040000 pid=1248 execve guuid=cb6f69f9-2800-0000-b6b5-7dbce2040000 pid=1250 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=cb6f69f9-2800-0000-b6b5-7dbce2040000 pid=1250 execve guuid=d93c2bfa-2800-0000-b6b5-7dbce5040000 pid=1253 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=d93c2bfa-2800-0000-b6b5-7dbce5040000 pid=1253 execve guuid=25d88cfa-2800-0000-b6b5-7dbce8040000 pid=1256 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=25d88cfa-2800-0000-b6b5-7dbce8040000 pid=1256 execve guuid=1906f1fa-2800-0000-b6b5-7dbcea040000 pid=1258 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=1906f1fa-2800-0000-b6b5-7dbcea040000 pid=1258 execve guuid=70744efb-2800-0000-b6b5-7dbced040000 pid=1261 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=70744efb-2800-0000-b6b5-7dbced040000 pid=1261 execve guuid=a962b6fb-2800-0000-b6b5-7dbcee040000 pid=1262 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=a962b6fb-2800-0000-b6b5-7dbcee040000 pid=1262 execve guuid=822025fc-2800-0000-b6b5-7dbcf0040000 pid=1264 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=822025fc-2800-0000-b6b5-7dbcf0040000 pid=1264 execve guuid=fcd3acfc-2800-0000-b6b5-7dbcf1040000 pid=1265 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=fcd3acfc-2800-0000-b6b5-7dbcf1040000 pid=1265 execve guuid=0f8a25fd-2800-0000-b6b5-7dbcf2040000 pid=1266 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=0f8a25fd-2800-0000-b6b5-7dbcf2040000 pid=1266 execve guuid=5f5083fd-2800-0000-b6b5-7dbcf5040000 pid=1269 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=5f5083fd-2800-0000-b6b5-7dbcf5040000 pid=1269 execve guuid=561ceffd-2800-0000-b6b5-7dbcf7040000 pid=1271 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=561ceffd-2800-0000-b6b5-7dbcf7040000 pid=1271 execve guuid=28b06efe-2800-0000-b6b5-7dbcfa040000 pid=1274 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=28b06efe-2800-0000-b6b5-7dbcfa040000 pid=1274 execve guuid=18b6e0fe-2800-0000-b6b5-7dbcfd040000 pid=1277 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=18b6e0fe-2800-0000-b6b5-7dbcfd040000 pid=1277 execve guuid=29fa9bff-2800-0000-b6b5-7dbcff040000 pid=1279 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=29fa9bff-2800-0000-b6b5-7dbcff040000 pid=1279 execve guuid=55a90b00-2900-0000-b6b5-7dbc01050000 pid=1281 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=55a90b00-2900-0000-b6b5-7dbc01050000 pid=1281 execve guuid=a2588300-2900-0000-b6b5-7dbc02050000 pid=1282 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=a2588300-2900-0000-b6b5-7dbc02050000 pid=1282 execve guuid=c594f100-2900-0000-b6b5-7dbc04050000 pid=1284 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=c594f100-2900-0000-b6b5-7dbc04050000 pid=1284 execve guuid=91e25001-2900-0000-b6b5-7dbc06050000 pid=1286 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=91e25001-2900-0000-b6b5-7dbc06050000 pid=1286 execve guuid=11badc01-2900-0000-b6b5-7dbc09050000 pid=1289 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=11badc01-2900-0000-b6b5-7dbc09050000 pid=1289 execve guuid=64c63902-2900-0000-b6b5-7dbc0c050000 pid=1292 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=64c63902-2900-0000-b6b5-7dbc0c050000 pid=1292 execve guuid=ef769602-2900-0000-b6b5-7dbc0e050000 pid=1294 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=ef769602-2900-0000-b6b5-7dbc0e050000 pid=1294 execve guuid=7b81f602-2900-0000-b6b5-7dbc10050000 pid=1296 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=7b81f602-2900-0000-b6b5-7dbc10050000 pid=1296 execve guuid=78457a03-2900-0000-b6b5-7dbc12050000 pid=1298 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=78457a03-2900-0000-b6b5-7dbc12050000 pid=1298 execve guuid=9af60a04-2900-0000-b6b5-7dbc13050000 pid=1299 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=9af60a04-2900-0000-b6b5-7dbc13050000 pid=1299 execve guuid=a0bb8104-2900-0000-b6b5-7dbc14050000 pid=1300 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=a0bb8104-2900-0000-b6b5-7dbc14050000 pid=1300 execve guuid=75acf704-2900-0000-b6b5-7dbc17050000 pid=1303 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=75acf704-2900-0000-b6b5-7dbc17050000 pid=1303 execve guuid=22c18a05-2900-0000-b6b5-7dbc19050000 pid=1305 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=22c18a05-2900-0000-b6b5-7dbc19050000 pid=1305 execve guuid=c9942806-2900-0000-b6b5-7dbc1b050000 pid=1307 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=c9942806-2900-0000-b6b5-7dbc1b050000 pid=1307 execve guuid=e2259306-2900-0000-b6b5-7dbc1e050000 pid=1310 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=e2259306-2900-0000-b6b5-7dbc1e050000 pid=1310 execve guuid=63512b07-2900-0000-b6b5-7dbc21050000 pid=1313 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=63512b07-2900-0000-b6b5-7dbc21050000 pid=1313 execve guuid=9358ab07-2900-0000-b6b5-7dbc23050000 pid=1315 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=9358ab07-2900-0000-b6b5-7dbc23050000 pid=1315 execve guuid=72dc0e08-2900-0000-b6b5-7dbc25050000 pid=1317 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=72dc0e08-2900-0000-b6b5-7dbc25050000 pid=1317 execve guuid=5ed17008-2900-0000-b6b5-7dbc27050000 pid=1319 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=5ed17008-2900-0000-b6b5-7dbc27050000 pid=1319 execve guuid=0df4cd08-2900-0000-b6b5-7dbc29050000 pid=1321 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=0df4cd08-2900-0000-b6b5-7dbc29050000 pid=1321 execve guuid=315c2909-2900-0000-b6b5-7dbc2b050000 pid=1323 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=315c2909-2900-0000-b6b5-7dbc2b050000 pid=1323 execve guuid=a0128d09-2900-0000-b6b5-7dbc2e050000 pid=1326 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=a0128d09-2900-0000-b6b5-7dbc2e050000 pid=1326 execve guuid=ddfae809-2900-0000-b6b5-7dbc30050000 pid=1328 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=ddfae809-2900-0000-b6b5-7dbc30050000 pid=1328 execve guuid=9d604a0a-2900-0000-b6b5-7dbc32050000 pid=1330 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=9d604a0a-2900-0000-b6b5-7dbc32050000 pid=1330 execve guuid=21dca50a-2900-0000-b6b5-7dbc34050000 pid=1332 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=21dca50a-2900-0000-b6b5-7dbc34050000 pid=1332 execve guuid=39d10b0b-2900-0000-b6b5-7dbc35050000 pid=1333 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=39d10b0b-2900-0000-b6b5-7dbc35050000 pid=1333 execve guuid=697f6d0b-2900-0000-b6b5-7dbc37050000 pid=1335 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=697f6d0b-2900-0000-b6b5-7dbc37050000 pid=1335 execve guuid=2b3dcd0b-2900-0000-b6b5-7dbc39050000 pid=1337 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=2b3dcd0b-2900-0000-b6b5-7dbc39050000 pid=1337 execve guuid=06c5360c-2900-0000-b6b5-7dbc3c050000 pid=1340 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=06c5360c-2900-0000-b6b5-7dbc3c050000 pid=1340 execve guuid=ab51ad0c-2900-0000-b6b5-7dbc3e050000 pid=1342 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=ab51ad0c-2900-0000-b6b5-7dbc3e050000 pid=1342 execve guuid=7db9600d-2900-0000-b6b5-7dbc42050000 pid=1346 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=7db9600d-2900-0000-b6b5-7dbc42050000 pid=1346 execve guuid=f5da440e-2900-0000-b6b5-7dbc44050000 pid=1348 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=f5da440e-2900-0000-b6b5-7dbc44050000 pid=1348 execve guuid=0ec2a00e-2900-0000-b6b5-7dbc46050000 pid=1350 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=0ec2a00e-2900-0000-b6b5-7dbc46050000 pid=1350 execve guuid=99ea130f-2900-0000-b6b5-7dbc49050000 pid=1353 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=99ea130f-2900-0000-b6b5-7dbc49050000 pid=1353 execve guuid=ca6c7f0f-2900-0000-b6b5-7dbc4c050000 pid=1356 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=ca6c7f0f-2900-0000-b6b5-7dbc4c050000 pid=1356 execve guuid=b99c6e10-2900-0000-b6b5-7dbc50050000 pid=1360 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=b99c6e10-2900-0000-b6b5-7dbc50050000 pid=1360 execve guuid=3f97d410-2900-0000-b6b5-7dbc52050000 pid=1362 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=3f97d410-2900-0000-b6b5-7dbc52050000 pid=1362 execve guuid=af213c11-2900-0000-b6b5-7dbc53050000 pid=1363 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=af213c11-2900-0000-b6b5-7dbc53050000 pid=1363 execve guuid=4e429a11-2900-0000-b6b5-7dbc54050000 pid=1364 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=4e429a11-2900-0000-b6b5-7dbc54050000 pid=1364 execve guuid=07fef911-2900-0000-b6b5-7dbc56050000 pid=1366 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=07fef911-2900-0000-b6b5-7dbc56050000 pid=1366 execve guuid=6a2b5612-2900-0000-b6b5-7dbc57050000 pid=1367 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=6a2b5612-2900-0000-b6b5-7dbc57050000 pid=1367 execve guuid=34d1b112-2900-0000-b6b5-7dbc59050000 pid=1369 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=34d1b112-2900-0000-b6b5-7dbc59050000 pid=1369 execve guuid=e4f11113-2900-0000-b6b5-7dbc5a050000 pid=1370 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=e4f11113-2900-0000-b6b5-7dbc5a050000 pid=1370 execve guuid=12c47213-2900-0000-b6b5-7dbc5b050000 pid=1371 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=12c47213-2900-0000-b6b5-7dbc5b050000 pid=1371 execve guuid=648ad213-2900-0000-b6b5-7dbc5c050000 pid=1372 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=648ad213-2900-0000-b6b5-7dbc5c050000 pid=1372 execve guuid=6c953114-2900-0000-b6b5-7dbc5e050000 pid=1374 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=6c953114-2900-0000-b6b5-7dbc5e050000 pid=1374 execve guuid=95f7b114-2900-0000-b6b5-7dbc60050000 pid=1376 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=95f7b114-2900-0000-b6b5-7dbc60050000 pid=1376 execve guuid=5498aa15-2900-0000-b6b5-7dbc64050000 pid=1380 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=5498aa15-2900-0000-b6b5-7dbc64050000 pid=1380 execve guuid=c20b0a16-2900-0000-b6b5-7dbc66050000 pid=1382 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=c20b0a16-2900-0000-b6b5-7dbc66050000 pid=1382 execve guuid=6bda7316-2900-0000-b6b5-7dbc68050000 pid=1384 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=6bda7316-2900-0000-b6b5-7dbc68050000 pid=1384 execve guuid=b63adf16-2900-0000-b6b5-7dbc69050000 pid=1385 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=b63adf16-2900-0000-b6b5-7dbc69050000 pid=1385 execve guuid=5fcb4a17-2900-0000-b6b5-7dbc6c050000 pid=1388 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=5fcb4a17-2900-0000-b6b5-7dbc6c050000 pid=1388 execve guuid=94b8b317-2900-0000-b6b5-7dbc6e050000 pid=1390 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=94b8b317-2900-0000-b6b5-7dbc6e050000 pid=1390 execve guuid=be9d1818-2900-0000-b6b5-7dbc70050000 pid=1392 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=be9d1818-2900-0000-b6b5-7dbc70050000 pid=1392 execve guuid=87f18918-2900-0000-b6b5-7dbc72050000 pid=1394 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=87f18918-2900-0000-b6b5-7dbc72050000 pid=1394 execve guuid=12bd3d19-2900-0000-b6b5-7dbc75050000 pid=1397 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=12bd3d19-2900-0000-b6b5-7dbc75050000 pid=1397 execve guuid=212ada19-2900-0000-b6b5-7dbc77050000 pid=1399 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=212ada19-2900-0000-b6b5-7dbc77050000 pid=1399 execve guuid=36b96d1a-2900-0000-b6b5-7dbc79050000 pid=1401 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=36b96d1a-2900-0000-b6b5-7dbc79050000 pid=1401 execve guuid=40311f1b-2900-0000-b6b5-7dbc7a050000 pid=1402 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=40311f1b-2900-0000-b6b5-7dbc7a050000 pid=1402 execve guuid=6df3b41b-2900-0000-b6b5-7dbc7d050000 pid=1405 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=6df3b41b-2900-0000-b6b5-7dbc7d050000 pid=1405 execve guuid=43573b1c-2900-0000-b6b5-7dbc7f050000 pid=1407 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=43573b1c-2900-0000-b6b5-7dbc7f050000 pid=1407 execve guuid=297ba51c-2900-0000-b6b5-7dbc81050000 pid=1409 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=297ba51c-2900-0000-b6b5-7dbc81050000 pid=1409 execve guuid=89ec0a1d-2900-0000-b6b5-7dbc83050000 pid=1411 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=89ec0a1d-2900-0000-b6b5-7dbc83050000 pid=1411 execve guuid=5fc86b1d-2900-0000-b6b5-7dbc86050000 pid=1414 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=5fc86b1d-2900-0000-b6b5-7dbc86050000 pid=1414 execve guuid=5f34031e-2900-0000-b6b5-7dbc88050000 pid=1416 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=5f34031e-2900-0000-b6b5-7dbc88050000 pid=1416 execve guuid=c1416b1e-2900-0000-b6b5-7dbc8a050000 pid=1418 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=c1416b1e-2900-0000-b6b5-7dbc8a050000 pid=1418 execve guuid=181efa1e-2900-0000-b6b5-7dbc8b050000 pid=1419 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=181efa1e-2900-0000-b6b5-7dbc8b050000 pid=1419 execve guuid=7e53771f-2900-0000-b6b5-7dbc8c050000 pid=1420 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=7e53771f-2900-0000-b6b5-7dbc8c050000 pid=1420 execve guuid=c6f1f11f-2900-0000-b6b5-7dbc8e050000 pid=1422 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=c6f1f11f-2900-0000-b6b5-7dbc8e050000 pid=1422 execve guuid=a5c4a520-2900-0000-b6b5-7dbc91050000 pid=1425 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=a5c4a520-2900-0000-b6b5-7dbc91050000 pid=1425 execve guuid=d2721821-2900-0000-b6b5-7dbc94050000 pid=1428 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=d2721821-2900-0000-b6b5-7dbc94050000 pid=1428 execve guuid=ded98d21-2900-0000-b6b5-7dbc96050000 pid=1430 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=ded98d21-2900-0000-b6b5-7dbc96050000 pid=1430 execve guuid=e3792422-2900-0000-b6b5-7dbc99050000 pid=1433 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=e3792422-2900-0000-b6b5-7dbc99050000 pid=1433 execve guuid=6286c422-2900-0000-b6b5-7dbc9b050000 pid=1435 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=6286c422-2900-0000-b6b5-7dbc9b050000 pid=1435 execve guuid=9f428f23-2900-0000-b6b5-7dbc9d050000 pid=1437 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=9f428f23-2900-0000-b6b5-7dbc9d050000 pid=1437 execve guuid=027a3924-2900-0000-b6b5-7dbca0050000 pid=1440 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=027a3924-2900-0000-b6b5-7dbca0050000 pid=1440 execve guuid=1dbaa424-2900-0000-b6b5-7dbca2050000 pid=1442 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=1dbaa424-2900-0000-b6b5-7dbca2050000 pid=1442 execve guuid=7ddf2825-2900-0000-b6b5-7dbca4050000 pid=1444 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=7ddf2825-2900-0000-b6b5-7dbca4050000 pid=1444 execve guuid=eb859725-2900-0000-b6b5-7dbca6050000 pid=1446 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=eb859725-2900-0000-b6b5-7dbca6050000 pid=1446 execve guuid=82523826-2900-0000-b6b5-7dbca9050000 pid=1449 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=82523826-2900-0000-b6b5-7dbca9050000 pid=1449 execve guuid=4e77d026-2900-0000-b6b5-7dbcab050000 pid=1451 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=4e77d026-2900-0000-b6b5-7dbcab050000 pid=1451 execve guuid=82ac8027-2900-0000-b6b5-7dbcac050000 pid=1452 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=82ac8027-2900-0000-b6b5-7dbcac050000 pid=1452 execve guuid=968c2e28-2900-0000-b6b5-7dbcae050000 pid=1454 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=968c2e28-2900-0000-b6b5-7dbcae050000 pid=1454 execve guuid=fcbcc728-2900-0000-b6b5-7dbcb0050000 pid=1456 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=fcbcc728-2900-0000-b6b5-7dbcb0050000 pid=1456 execve guuid=2e345329-2900-0000-b6b5-7dbcb3050000 pid=1459 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=2e345329-2900-0000-b6b5-7dbcb3050000 pid=1459 execve guuid=5bb91e2a-2900-0000-b6b5-7dbcb6050000 pid=1462 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=5bb91e2a-2900-0000-b6b5-7dbcb6050000 pid=1462 execve guuid=e321792a-2900-0000-b6b5-7dbcb8050000 pid=1464 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=e321792a-2900-0000-b6b5-7dbcb8050000 pid=1464 execve guuid=13eddb2a-2900-0000-b6b5-7dbcba050000 pid=1466 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=13eddb2a-2900-0000-b6b5-7dbcba050000 pid=1466 execve guuid=ab243e2b-2900-0000-b6b5-7dbcbc050000 pid=1468 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=ab243e2b-2900-0000-b6b5-7dbcbc050000 pid=1468 execve guuid=49c1b62b-2900-0000-b6b5-7dbcbd050000 pid=1469 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=49c1b62b-2900-0000-b6b5-7dbcbd050000 pid=1469 execve guuid=3b0a1f2c-2900-0000-b6b5-7dbcbe050000 pid=1470 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=3b0a1f2c-2900-0000-b6b5-7dbcbe050000 pid=1470 execve guuid=9b9e8f2c-2900-0000-b6b5-7dbcc0050000 pid=1472 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=9b9e8f2c-2900-0000-b6b5-7dbcc0050000 pid=1472 execve guuid=48cbea2c-2900-0000-b6b5-7dbcc2050000 pid=1474 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=48cbea2c-2900-0000-b6b5-7dbcc2050000 pid=1474 execve guuid=691a4b2d-2900-0000-b6b5-7dbcc4050000 pid=1476 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=691a4b2d-2900-0000-b6b5-7dbcc4050000 pid=1476 execve guuid=2c6ca12d-2900-0000-b6b5-7dbcc6050000 pid=1478 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=2c6ca12d-2900-0000-b6b5-7dbcc6050000 pid=1478 execve guuid=db65ff2d-2900-0000-b6b5-7dbcc8050000 pid=1480 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=db65ff2d-2900-0000-b6b5-7dbcc8050000 pid=1480 execve guuid=27785a2e-2900-0000-b6b5-7dbcca050000 pid=1482 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=27785a2e-2900-0000-b6b5-7dbcca050000 pid=1482 execve guuid=f3febd2e-2900-0000-b6b5-7dbccc050000 pid=1484 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=f3febd2e-2900-0000-b6b5-7dbccc050000 pid=1484 execve guuid=69a01b2f-2900-0000-b6b5-7dbcce050000 pid=1486 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=69a01b2f-2900-0000-b6b5-7dbcce050000 pid=1486 execve guuid=7a82a52f-2900-0000-b6b5-7dbcd0050000 pid=1488 /usr/bin/ls guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=7a82a52f-2900-0000-b6b5-7dbcd0050000 pid=1488 execve guuid=769d0a30-2900-0000-b6b5-7dbcd1050000 pid=1489 /usr/bin/rm guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=769d0a30-2900-0000-b6b5-7dbcd1050000 pid=1489 execve guuid=d6394a30-2900-0000-b6b5-7dbcd3050000 pid=1491 /usr/bin/wget net send-data write-file guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=d6394a30-2900-0000-b6b5-7dbcd3050000 pid=1491 execve guuid=b5bd4747-2900-0000-b6b5-7dbc08060000 pid=1544 /usr/bin/chmod guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=b5bd4747-2900-0000-b6b5-7dbc08060000 pid=1544 execve guuid=141aba47-2900-0000-b6b5-7dbc0b060000 pid=1547 /tmp/nuab guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=141aba47-2900-0000-b6b5-7dbc0b060000 pid=1547 execve guuid=8ddafd48-2900-0000-b6b5-7dbc10060000 pid=1552 /usr/bin/rm guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=8ddafd48-2900-0000-b6b5-7dbc10060000 pid=1552 execve guuid=26f45549-2900-0000-b6b5-7dbc11060000 pid=1553 /usr/bin/wget net send-data write-file guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=26f45549-2900-0000-b6b5-7dbc11060000 pid=1553 execve guuid=934b0150-2900-0000-b6b5-7dbc1e060000 pid=1566 /usr/bin/chmod guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=934b0150-2900-0000-b6b5-7dbc1e060000 pid=1566 execve guuid=257d3e50-2900-0000-b6b5-7dbc1f060000 pid=1567 /tmp/y1E guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=257d3e50-2900-0000-b6b5-7dbc1f060000 pid=1567 execve guuid=039c7751-2900-0000-b6b5-7dbc25060000 pid=1573 /usr/bin/rm guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=039c7751-2900-0000-b6b5-7dbc25060000 pid=1573 execve guuid=fe78b851-2900-0000-b6b5-7dbc27060000 pid=1575 /usr/bin/wget net send-data write-file guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=fe78b851-2900-0000-b6b5-7dbc27060000 pid=1575 execve guuid=dec45ac9-2900-0000-b6b5-7dbc37070000 pid=1847 /usr/bin/chmod guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=dec45ac9-2900-0000-b6b5-7dbc37070000 pid=1847 execve guuid=248698c9-2900-0000-b6b5-7dbc38070000 pid=1848 /tmp/LRI guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=248698c9-2900-0000-b6b5-7dbc38070000 pid=1848 execve guuid=49c948ca-2900-0000-b6b5-7dbc3a070000 pid=1850 /usr/bin/rm guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=49c948ca-2900-0000-b6b5-7dbc3a070000 pid=1850 execve guuid=c9cf88ca-2900-0000-b6b5-7dbc3b070000 pid=1851 /usr/bin/wget net send-data write-file guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=c9cf88ca-2900-0000-b6b5-7dbc3b070000 pid=1851 execve guuid=71fcb5d0-2900-0000-b6b5-7dbc3c070000 pid=1852 /usr/bin/chmod guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=71fcb5d0-2900-0000-b6b5-7dbc3c070000 pid=1852 execve guuid=2e7826d1-2900-0000-b6b5-7dbc3d070000 pid=1853 /tmp/4YRX guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=2e7826d1-2900-0000-b6b5-7dbc3d070000 pid=1853 execve guuid=0f7307d2-2900-0000-b6b5-7dbc3f070000 pid=1855 /usr/bin/rm guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=0f7307d2-2900-0000-b6b5-7dbc3f070000 pid=1855 execve guuid=40e27ad2-2900-0000-b6b5-7dbc40070000 pid=1856 /usr/bin/wget net send-data write-file guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=40e27ad2-2900-0000-b6b5-7dbc40070000 pid=1856 execve guuid=b9f43dda-2900-0000-b6b5-7dbc47070000 pid=1863 /usr/bin/chmod guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=b9f43dda-2900-0000-b6b5-7dbc47070000 pid=1863 execve guuid=bd317cda-2900-0000-b6b5-7dbc49070000 pid=1865 /tmp/vXhK guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=bd317cda-2900-0000-b6b5-7dbc49070000 pid=1865 execve guuid=d8aa37db-2900-0000-b6b5-7dbc4d070000 pid=1869 /usr/bin/rm delete-file guuid=513872f7-2800-0000-b6b5-7dbcd8040000 pid=1240->guuid=d8aa37db-2900-0000-b6b5-7dbc4d070000 pid=1869 execve 9554d36e-3083-568e-90da-bb8e3c487b07 188.132.232.81:80 guuid=d6394a30-2900-0000-b6b5-7dbcd3050000 pid=1491->9554d36e-3083-568e-90da-bb8e3c487b07 send: 133B guuid=26f45549-2900-0000-b6b5-7dbc11060000 pid=1553->9554d36e-3083-568e-90da-bb8e3c487b07 send: 132B guuid=fe78b851-2900-0000-b6b5-7dbc27060000 pid=1575->9554d36e-3083-568e-90da-bb8e3c487b07 send: 132B guuid=c9cf88ca-2900-0000-b6b5-7dbc3b070000 pid=1851->9554d36e-3083-568e-90da-bb8e3c487b07 send: 133B guuid=40e27ad2-2900-0000-b6b5-7dbc40070000 pid=1856->9554d36e-3083-568e-90da-bb8e3c487b07 send: 133B
Score:
94%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/48593feeaf08dce05dc846bdc9ffa649be6b9605470c8fc4282e7822e16be879
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/48593feeaf08dce05dc846bdc9ffa649be6b9605470c8fc4282e7822e16be879/
Verdict:
Malicious
Threat:
Trojan-Downloader.Shell.Agent
Link:
https://tip.neiki.dev/file/48593feeaf08dce05dc846bdc9ffa649be6b9605470c8fc4282e7822e16be879
Threat name:
Win32.Trojan.Vigorf
Create hunting rule
Status:
Malicious
First seen:
2026-06-08 02:51:31 UTC
File Type:
Text (Shell)
AV detection:
12 of 24 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jbmt73vpbdooaxoii264t75gjg7gxfqfi4gi7rbifz4cfyll5b4q._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
defense_evasion discovery linux
Link:
https://tria.ge/reports/260608-dcdbhagt5w/
Behaviour
Reads runtime system information
Writes file to tmp directory
Enumerates running processes
File and Directory Permissions Modification
Deletes itself
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.26
Link:
https://yomi.yoroi.company/submissions/48593feeaf08dce05dc846bdc9ffa649be6b9605470c8fc4282e7822e16be879

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 48593feeaf08dce05dc846bdc9ffa649be6b9605470c8fc4282e7822e16be879

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3856431/
  
Delivery method
Distributed via web download

Comments