MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 503dca2a79244bb2ad2dbeae2bdab48613fe6d16d4b4d8b16646c816c82c65cb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 503dca2a79244bb2ad2dbeae2bdab48613fe6d16d4b4d8b16646c816c82c65cb
SHA3-384 hash: 3fbb66fb72263de71701c8872b127961555da5785468f036d7a05f0cb9230498cdb305622ceb670d9073339d3050d638
SHA1 hash: 3c424d54c5cdb531d7bc92508d168846a90052a0
MD5 hash: 3876857962bd54c1d1937a7600c817aa
humanhash: cold-georgia-november-purple
File name:ruckus.sh
Download: download sample
File size:2'715 bytes
First seen:2026-09-01 22:10:40 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 24:pKQTxtiXX3NZwdOVBMJr817ODX7QbHl1Xn:pKQVyXd+swJrQ7OPQbHl1X
TLSH T1B5518FC817A20A763C53ADC337AF8C447088AEEE28C29E15E9EC74E4054EDCAB0C4753
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh

Intelligence

File Origin
# of uploads :
1
# of downloads :
42
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/24d6cb14-c996-4913-849b-6f039cc165f7
Behavior Graph:
Download SVG
%3 guuid=c8928e40-1600-0000-dd50-3e5be50b0000 pid=3045 /usr/bin/sudo guuid=96656f43-1600-0000-dd50-3e5beb0b0000 pid=3051 /tmp/sample.bin guuid=c8928e40-1600-0000-dd50-3e5be50b0000 pid=3045->guuid=96656f43-1600-0000-dd50-3e5beb0b0000 pid=3051 execve guuid=5c2bdd43-1600-0000-dd50-3e5bec0b0000 pid=3052 /usr/bin/wget net send-data write-file guuid=96656f43-1600-0000-dd50-3e5beb0b0000 pid=3051->guuid=5c2bdd43-1600-0000-dd50-3e5bec0b0000 pid=3052 execve guuid=fa370651-1600-0000-dd50-3e5bf30b0000 pid=3059 /usr/bin/curl net send-data write-file guuid=96656f43-1600-0000-dd50-3e5beb0b0000 pid=3051->guuid=fa370651-1600-0000-dd50-3e5bf30b0000 pid=3059 execve guuid=ad0dd660-1600-0000-dd50-3e5bfe0b0000 pid=3070 /usr/bin/cat guuid=96656f43-1600-0000-dd50-3e5beb0b0000 pid=3051->guuid=ad0dd660-1600-0000-dd50-3e5bfe0b0000 pid=3070 execve guuid=b34f2a61-1600-0000-dd50-3e5bff0b0000 pid=3071 /usr/bin/chmod guuid=96656f43-1600-0000-dd50-3e5beb0b0000 pid=3051->guuid=b34f2a61-1600-0000-dd50-3e5bff0b0000 pid=3071 execve guuid=04d26c61-1600-0000-dd50-3e5b000c0000 pid=3072 /tmp/WTF guuid=96656f43-1600-0000-dd50-3e5beb0b0000 pid=3051->guuid=04d26c61-1600-0000-dd50-3e5b000c0000 pid=3072 execve guuid=c7353862-1600-0000-dd50-3e5b030c0000 pid=3075 /usr/bin/wget net send-data write-file guuid=96656f43-1600-0000-dd50-3e5beb0b0000 pid=3051->guuid=c7353862-1600-0000-dd50-3e5b030c0000 pid=3075 execve guuid=b7071c6e-1600-0000-dd50-3e5b160c0000 pid=3094 /usr/bin/curl net send-data write-file guuid=96656f43-1600-0000-dd50-3e5beb0b0000 pid=3051->guuid=b7071c6e-1600-0000-dd50-3e5b160c0000 pid=3094 execve guuid=b1c34b81-1600-0000-dd50-3e5b210c0000 pid=3105 /usr/bin/bash guuid=96656f43-1600-0000-dd50-3e5beb0b0000 pid=3051->guuid=b1c34b81-1600-0000-dd50-3e5b210c0000 pid=3105 clone guuid=ba53aa81-1600-0000-dd50-3e5b220c0000 pid=3106 /usr/bin/chmod guuid=96656f43-1600-0000-dd50-3e5beb0b0000 pid=3051->guuid=ba53aa81-1600-0000-dd50-3e5b220c0000 pid=3106 execve guuid=3eca5d82-1600-0000-dd50-3e5b230c0000 pid=3107 /tmp/WTF guuid=96656f43-1600-0000-dd50-3e5beb0b0000 pid=3051->guuid=3eca5d82-1600-0000-dd50-3e5b230c0000 pid=3107 execve guuid=91b92590-1600-0000-dd50-3e5b250c0000 pid=3109 /usr/bin/wget net send-data write-file guuid=96656f43-1600-0000-dd50-3e5beb0b0000 pid=3051->guuid=91b92590-1600-0000-dd50-3e5b250c0000 pid=3109 execve guuid=63da309a-1600-0000-dd50-3e5b370c0000 pid=3127 /usr/bin/curl net send-data write-file guuid=96656f43-1600-0000-dd50-3e5beb0b0000 pid=3051->guuid=63da309a-1600-0000-dd50-3e5b370c0000 pid=3127 execve guuid=59bb84a6-1600-0000-dd50-3e5b3f0c0000 pid=3135 /usr/bin/bash guuid=96656f43-1600-0000-dd50-3e5beb0b0000 pid=3051->guuid=59bb84a6-1600-0000-dd50-3e5b3f0c0000 pid=3135 clone guuid=d54199a7-1600-0000-dd50-3e5b400c0000 pid=3136 /usr/bin/chmod guuid=96656f43-1600-0000-dd50-3e5beb0b0000 pid=3051->guuid=d54199a7-1600-0000-dd50-3e5b400c0000 pid=3136 execve guuid=133919a8-1600-0000-dd50-3e5b410c0000 pid=3137 /tmp/WTF guuid=96656f43-1600-0000-dd50-3e5beb0b0000 pid=3051->guuid=133919a8-1600-0000-dd50-3e5b410c0000 pid=3137 execve guuid=f60582b5-1600-0000-dd50-3e5b580c0000 pid=3160 /usr/bin/wget net send-data write-file guuid=96656f43-1600-0000-dd50-3e5beb0b0000 pid=3051->guuid=f60582b5-1600-0000-dd50-3e5b580c0000 pid=3160 execve guuid=fec623c0-1600-0000-dd50-3e5b5d0c0000 pid=3165 /usr/bin/curl net send-data write-file guuid=96656f43-1600-0000-dd50-3e5beb0b0000 pid=3051->guuid=fec623c0-1600-0000-dd50-3e5b5d0c0000 pid=3165 execve guuid=8483f5cc-1600-0000-dd50-3e5b760c0000 pid=3190 /usr/bin/bash guuid=96656f43-1600-0000-dd50-3e5beb0b0000 pid=3051->guuid=8483f5cc-1600-0000-dd50-3e5b760c0000 pid=3190 clone guuid=79dc26cd-1600-0000-dd50-3e5b770c0000 pid=3191 /usr/bin/chmod guuid=96656f43-1600-0000-dd50-3e5beb0b0000 pid=3051->guuid=79dc26cd-1600-0000-dd50-3e5b770c0000 pid=3191 execve guuid=7432becd-1600-0000-dd50-3e5b790c0000 pid=3193 /tmp/WTF guuid=96656f43-1600-0000-dd50-3e5beb0b0000 pid=3051->guuid=7432becd-1600-0000-dd50-3e5b790c0000 pid=3193 execve guuid=db2238db-1600-0000-dd50-3e5b920c0000 pid=3218 /usr/bin/wget net send-data write-file guuid=96656f43-1600-0000-dd50-3e5beb0b0000 pid=3051->guuid=db2238db-1600-0000-dd50-3e5b920c0000 pid=3218 execve guuid=3788d5ea-1600-0000-dd50-3e5bac0c0000 pid=3244 /usr/bin/curl net send-data write-file guuid=96656f43-1600-0000-dd50-3e5beb0b0000 pid=3051->guuid=3788d5ea-1600-0000-dd50-3e5bac0c0000 pid=3244 execve guuid=7a8c2dfa-1600-0000-dd50-3e5bb50c0000 pid=3253 /usr/bin/bash guuid=96656f43-1600-0000-dd50-3e5beb0b0000 pid=3051->guuid=7a8c2dfa-1600-0000-dd50-3e5bb50c0000 pid=3253 clone guuid=b0444ffa-1600-0000-dd50-3e5bb60c0000 pid=3254 /usr/bin/chmod guuid=96656f43-1600-0000-dd50-3e5beb0b0000 pid=3051->guuid=b0444ffa-1600-0000-dd50-3e5bb60c0000 pid=3254 execve guuid=47cd9bfa-1600-0000-dd50-3e5bb80c0000 pid=3256 /tmp/WTF guuid=96656f43-1600-0000-dd50-3e5beb0b0000 pid=3051->guuid=47cd9bfa-1600-0000-dd50-3e5bb80c0000 pid=3256 execve guuid=9be47c08-1700-0000-dd50-3e5bc30c0000 pid=3267 /usr/bin/wget net send-data write-file guuid=96656f43-1600-0000-dd50-3e5beb0b0000 pid=3051->guuid=9be47c08-1700-0000-dd50-3e5bc30c0000 pid=3267 execve guuid=ac48831d-1700-0000-dd50-3e5bc60c0000 pid=3270 /usr/bin/curl net send-data write-file guuid=96656f43-1600-0000-dd50-3e5beb0b0000 pid=3051->guuid=ac48831d-1700-0000-dd50-3e5bc60c0000 pid=3270 execve guuid=b4186129-1700-0000-dd50-3e5bd60c0000 pid=3286 /usr/bin/bash guuid=96656f43-1600-0000-dd50-3e5beb0b0000 pid=3051->guuid=b4186129-1700-0000-dd50-3e5bd60c0000 pid=3286 clone guuid=55f77b29-1700-0000-dd50-3e5bd70c0000 pid=3287 /usr/bin/chmod guuid=96656f43-1600-0000-dd50-3e5beb0b0000 pid=3051->guuid=55f77b29-1700-0000-dd50-3e5bd70c0000 pid=3287 execve guuid=3057f929-1700-0000-dd50-3e5bd90c0000 pid=3289 /tmp/WTF guuid=96656f43-1600-0000-dd50-3e5beb0b0000 pid=3051->guuid=3057f929-1700-0000-dd50-3e5bd90c0000 pid=3289 execve guuid=6e46ba37-1700-0000-dd50-3e5bfe0c0000 pid=3326 /usr/bin/wget net send-data write-file guuid=96656f43-1600-0000-dd50-3e5beb0b0000 pid=3051->guuid=6e46ba37-1700-0000-dd50-3e5bfe0c0000 pid=3326 execve guuid=ab374441-1700-0000-dd50-3e5b190d0000 pid=3353 /usr/bin/curl net send-data write-file guuid=96656f43-1600-0000-dd50-3e5beb0b0000 pid=3051->guuid=ab374441-1700-0000-dd50-3e5b190d0000 pid=3353 execve guuid=aa49814c-1700-0000-dd50-3e5b460d0000 pid=3398 /usr/bin/bash guuid=96656f43-1600-0000-dd50-3e5beb0b0000 pid=3051->guuid=aa49814c-1700-0000-dd50-3e5b460d0000 pid=3398 clone guuid=db2ba54c-1700-0000-dd50-3e5b480d0000 pid=3400 /usr/bin/chmod guuid=96656f43-1600-0000-dd50-3e5beb0b0000 pid=3051->guuid=db2ba54c-1700-0000-dd50-3e5b480d0000 pid=3400 execve guuid=0d4ff54c-1700-0000-dd50-3e5b4a0d0000 pid=3402 /tmp/WTF guuid=96656f43-1600-0000-dd50-3e5beb0b0000 pid=3051->guuid=0d4ff54c-1700-0000-dd50-3e5b4a0d0000 pid=3402 execve guuid=6b47aa5a-1700-0000-dd50-3e5b690d0000 pid=3433 /usr/bin/wget net send-data write-file guuid=96656f43-1600-0000-dd50-3e5beb0b0000 pid=3051->guuid=6b47aa5a-1700-0000-dd50-3e5b690d0000 pid=3433 execve guuid=13399a65-1700-0000-dd50-3e5b870d0000 pid=3463 /usr/bin/curl net send-data write-file guuid=96656f43-1600-0000-dd50-3e5beb0b0000 pid=3051->guuid=13399a65-1700-0000-dd50-3e5b870d0000 pid=3463 execve guuid=198c8170-1700-0000-dd50-3e5ba80d0000 pid=3496 /usr/bin/bash guuid=96656f43-1600-0000-dd50-3e5beb0b0000 pid=3051->guuid=198c8170-1700-0000-dd50-3e5ba80d0000 pid=3496 clone guuid=0fae9d70-1700-0000-dd50-3e5ba90d0000 pid=3497 /usr/bin/chmod guuid=96656f43-1600-0000-dd50-3e5beb0b0000 pid=3051->guuid=0fae9d70-1700-0000-dd50-3e5ba90d0000 pid=3497 execve guuid=5541ec70-1700-0000-dd50-3e5baa0d0000 pid=3498 /tmp/WTF guuid=96656f43-1600-0000-dd50-3e5beb0b0000 pid=3051->guuid=5541ec70-1700-0000-dd50-3e5baa0d0000 pid=3498 execve guuid=63fc287e-1700-0000-dd50-3e5bd10d0000 pid=3537 /usr/bin/wget net send-data write-file guuid=96656f43-1600-0000-dd50-3e5beb0b0000 pid=3051->guuid=63fc287e-1700-0000-dd50-3e5bd10d0000 pid=3537 execve guuid=297d1c88-1700-0000-dd50-3e5bed0d0000 pid=3565 /usr/bin/curl net send-data write-file guuid=96656f43-1600-0000-dd50-3e5beb0b0000 pid=3051->guuid=297d1c88-1700-0000-dd50-3e5bed0d0000 pid=3565 execve guuid=84d794ac-1700-0000-dd50-3e5b220e0000 pid=3618 /usr/bin/bash guuid=96656f43-1600-0000-dd50-3e5beb0b0000 pid=3051->guuid=84d794ac-1700-0000-dd50-3e5b220e0000 pid=3618 clone guuid=981bd0ac-1700-0000-dd50-3e5b230e0000 pid=3619 /usr/bin/chmod guuid=96656f43-1600-0000-dd50-3e5beb0b0000 pid=3051->guuid=981bd0ac-1700-0000-dd50-3e5b230e0000 pid=3619 execve guuid=a9fd6dad-1700-0000-dd50-3e5b270e0000 pid=3623 /tmp/WTF guuid=96656f43-1600-0000-dd50-3e5beb0b0000 pid=3051->guuid=a9fd6dad-1700-0000-dd50-3e5b270e0000 pid=3623 execve guuid=ed709dbb-1700-0000-dd50-3e5b460e0000 pid=3654 /usr/bin/wget net send-data write-file guuid=96656f43-1600-0000-dd50-3e5beb0b0000 pid=3051->guuid=ed709dbb-1700-0000-dd50-3e5b460e0000 pid=3654 execve guuid=a232b3c6-1700-0000-dd50-3e5b670e0000 pid=3687 /usr/bin/curl net send-data write-file guuid=96656f43-1600-0000-dd50-3e5beb0b0000 pid=3051->guuid=a232b3c6-1700-0000-dd50-3e5b670e0000 pid=3687 execve guuid=536aacd2-1700-0000-dd50-3e5b9a0e0000 pid=3738 /usr/bin/bash guuid=96656f43-1600-0000-dd50-3e5beb0b0000 pid=3051->guuid=536aacd2-1700-0000-dd50-3e5b9a0e0000 pid=3738 clone guuid=1329cdd2-1700-0000-dd50-3e5b9b0e0000 pid=3739 /usr/bin/chmod guuid=96656f43-1600-0000-dd50-3e5beb0b0000 pid=3051->guuid=1329cdd2-1700-0000-dd50-3e5b9b0e0000 pid=3739 execve guuid=b3d144d3-1700-0000-dd50-3e5b9f0e0000 pid=3743 /tmp/WTF guuid=96656f43-1600-0000-dd50-3e5beb0b0000 pid=3051->guuid=b3d144d3-1700-0000-dd50-3e5b9f0e0000 pid=3743 execve guuid=d9ea61e1-1700-0000-dd50-3e5bdd0e0000 pid=3805 /usr/bin/wget net send-data write-file guuid=96656f43-1600-0000-dd50-3e5beb0b0000 pid=3051->guuid=d9ea61e1-1700-0000-dd50-3e5bdd0e0000 pid=3805 execve guuid=177da0eb-1700-0000-dd50-3e5bef0e0000 pid=3823 /usr/bin/curl net send-data write-file guuid=96656f43-1600-0000-dd50-3e5beb0b0000 pid=3051->guuid=177da0eb-1700-0000-dd50-3e5bef0e0000 pid=3823 execve guuid=b9ba0bfa-1700-0000-dd50-3e5b230f0000 pid=3875 /usr/bin/bash guuid=96656f43-1600-0000-dd50-3e5beb0b0000 pid=3051->guuid=b9ba0bfa-1700-0000-dd50-3e5b230f0000 pid=3875 clone guuid=3f8c6ffa-1700-0000-dd50-3e5b250f0000 pid=3877 /usr/bin/chmod guuid=96656f43-1600-0000-dd50-3e5beb0b0000 pid=3051->guuid=3f8c6ffa-1700-0000-dd50-3e5b250f0000 pid=3877 execve guuid=3c8abcfa-1700-0000-dd50-3e5b270f0000 pid=3879 /tmp/WTF guuid=96656f43-1600-0000-dd50-3e5beb0b0000 pid=3051->guuid=3c8abcfa-1700-0000-dd50-3e5b270f0000 pid=3879 execve guuid=5998140a-1800-0000-dd50-3e5b630f0000 pid=3939 /usr/bin/wget net send-data write-file guuid=96656f43-1600-0000-dd50-3e5beb0b0000 pid=3051->guuid=5998140a-1800-0000-dd50-3e5b630f0000 pid=3939 execve guuid=004ab718-1800-0000-dd50-3e5b970f0000 pid=3991 /usr/bin/curl net send-data write-file guuid=96656f43-1600-0000-dd50-3e5beb0b0000 pid=3051->guuid=004ab718-1800-0000-dd50-3e5b970f0000 pid=3991 execve guuid=8e0c2925-1800-0000-dd50-3e5bcd0f0000 pid=4045 /usr/bin/bash guuid=96656f43-1600-0000-dd50-3e5beb0b0000 pid=3051->guuid=8e0c2925-1800-0000-dd50-3e5bcd0f0000 pid=4045 clone guuid=6c434325-1800-0000-dd50-3e5bce0f0000 pid=4046 /usr/bin/chmod guuid=96656f43-1600-0000-dd50-3e5beb0b0000 pid=3051->guuid=6c434325-1800-0000-dd50-3e5bce0f0000 pid=4046 execve guuid=10599b25-1800-0000-dd50-3e5bcf0f0000 pid=4047 /tmp/WTF guuid=96656f43-1600-0000-dd50-3e5beb0b0000 pid=3051->guuid=10599b25-1800-0000-dd50-3e5bcf0f0000 pid=4047 execve guuid=11201533-1800-0000-dd50-3e5bfe0f0000 pid=4094 /usr/bin/wget net send-data write-file guuid=96656f43-1600-0000-dd50-3e5beb0b0000 pid=3051->guuid=11201533-1800-0000-dd50-3e5bfe0f0000 pid=4094 execve guuid=c64f824c-1800-0000-dd50-3e5b1d100000 pid=4125 /usr/bin/curl net send-data write-file guuid=96656f43-1600-0000-dd50-3e5beb0b0000 pid=3051->guuid=c64f824c-1800-0000-dd50-3e5b1d100000 pid=4125 execve guuid=5cb61e58-1800-0000-dd50-3e5b41100000 pid=4161 /usr/bin/bash guuid=96656f43-1600-0000-dd50-3e5beb0b0000 pid=3051->guuid=5cb61e58-1800-0000-dd50-3e5b41100000 pid=4161 clone guuid=96384858-1800-0000-dd50-3e5b43100000 pid=4163 /usr/bin/chmod guuid=96656f43-1600-0000-dd50-3e5beb0b0000 pid=3051->guuid=96384858-1800-0000-dd50-3e5b43100000 pid=4163 execve guuid=219bed58-1800-0000-dd50-3e5b47100000 pid=4167 /tmp/WTF guuid=96656f43-1600-0000-dd50-3e5beb0b0000 pid=3051->guuid=219bed58-1800-0000-dd50-3e5b47100000 pid=4167 execve guuid=1bef9d66-1800-0000-dd50-3e5b83100000 pid=4227 /usr/bin/wget net send-data write-file guuid=96656f43-1600-0000-dd50-3e5beb0b0000 pid=3051->guuid=1bef9d66-1800-0000-dd50-3e5b83100000 pid=4227 execve guuid=00130471-1800-0000-dd50-3e5bb3100000 pid=4275 /usr/bin/curl net send-data write-file guuid=96656f43-1600-0000-dd50-3e5beb0b0000 pid=3051->guuid=00130471-1800-0000-dd50-3e5bb3100000 pid=4275 execve guuid=e869867b-1800-0000-dd50-3e5bcc100000 pid=4300 /usr/bin/bash guuid=96656f43-1600-0000-dd50-3e5beb0b0000 pid=3051->guuid=e869867b-1800-0000-dd50-3e5bcc100000 pid=4300 clone guuid=a513a87b-1800-0000-dd50-3e5bcd100000 pid=4301 /usr/bin/chmod guuid=96656f43-1600-0000-dd50-3e5beb0b0000 pid=3051->guuid=a513a87b-1800-0000-dd50-3e5bcd100000 pid=4301 execve guuid=ef0a3d7c-1800-0000-dd50-3e5bd1100000 pid=4305 /tmp/WTF guuid=96656f43-1600-0000-dd50-3e5beb0b0000 pid=3051->guuid=ef0a3d7c-1800-0000-dd50-3e5bd1100000 pid=4305 execve guuid=467ce789-1800-0000-dd50-3e5b09110000 pid=4361 /usr/bin/wget net send-data write-file guuid=96656f43-1600-0000-dd50-3e5beb0b0000 pid=3051->guuid=467ce789-1800-0000-dd50-3e5b09110000 pid=4361 execve guuid=862e5993-1800-0000-dd50-3e5b27110000 pid=4391 /usr/bin/curl net send-data write-file guuid=96656f43-1600-0000-dd50-3e5beb0b0000 pid=3051->guuid=862e5993-1800-0000-dd50-3e5b27110000 pid=4391 execve guuid=e8d2cea0-1800-0000-dd50-3e5b65110000 pid=4453 /usr/bin/bash guuid=96656f43-1600-0000-dd50-3e5beb0b0000 pid=3051->guuid=e8d2cea0-1800-0000-dd50-3e5b65110000 pid=4453 clone guuid=1912f5a0-1800-0000-dd50-3e5b67110000 pid=4455 /usr/bin/chmod guuid=96656f43-1600-0000-dd50-3e5beb0b0000 pid=3051->guuid=1912f5a0-1800-0000-dd50-3e5b67110000 pid=4455 execve guuid=be9568a1-1800-0000-dd50-3e5b6b110000 pid=4459 /tmp/WTF guuid=96656f43-1600-0000-dd50-3e5beb0b0000 pid=3051->guuid=be9568a1-1800-0000-dd50-3e5b6b110000 pid=4459 execve 68a2f4c7-41e6-5d77-b8ef-ef54db09e0e2 46.151.182.200:80 guuid=5c2bdd43-1600-0000-dd50-3e5bec0b0000 pid=3052->68a2f4c7-41e6-5d77-b8ef-ef54db09e0e2 send: 136B guuid=fa370651-1600-0000-dd50-3e5bf30b0000 pid=3059->68a2f4c7-41e6-5d77-b8ef-ef54db09e0e2 send: 85B guuid=af6b3062-1600-0000-dd50-3e5b020c0000 pid=3074 /tmp/WTF net write-file zombie guuid=04d26c61-1600-0000-dd50-3e5b000c0000 pid=3072->guuid=af6b3062-1600-0000-dd50-3e5b020c0000 pid=3074 clone 8b0a01dc-0728-52c1-8024-c4ba7801b8d6 8.8.8.8:53 guuid=af6b3062-1600-0000-dd50-3e5b020c0000 pid=3074->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=a790cb6b-1600-0000-dd50-3e5b100c0000 pid=3088 /tmp/WTF write-file guuid=af6b3062-1600-0000-dd50-3e5b020c0000 pid=3074->guuid=a790cb6b-1600-0000-dd50-3e5b100c0000 pid=3088 clone guuid=c7353862-1600-0000-dd50-3e5b030c0000 pid=3075->68a2f4c7-41e6-5d77-b8ef-ef54db09e0e2 send: 137B guuid=fbe8d76b-1600-0000-dd50-3e5b120c0000 pid=3090 /tmp/WTF guuid=a790cb6b-1600-0000-dd50-3e5b100c0000 pid=3088->guuid=fbe8d76b-1600-0000-dd50-3e5b120c0000 pid=3090 clone guuid=6183e76b-1600-0000-dd50-3e5b130c0000 pid=3091 /tmp/WTF guuid=a790cb6b-1600-0000-dd50-3e5b100c0000 pid=3088->guuid=6183e76b-1600-0000-dd50-3e5b130c0000 pid=3091 clone guuid=b7071c6e-1600-0000-dd50-3e5b160c0000 pid=3094->68a2f4c7-41e6-5d77-b8ef-ef54db09e0e2 send: 86B guuid=88691490-1600-0000-dd50-3e5b240c0000 pid=3108 /tmp/WTF net write-file zombie guuid=3eca5d82-1600-0000-dd50-3e5b230c0000 pid=3107->guuid=88691490-1600-0000-dd50-3e5b240c0000 pid=3108 clone guuid=88691490-1600-0000-dd50-3e5b240c0000 pid=3108->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=cdb16b90-1600-0000-dd50-3e5b260c0000 pid=3110 /tmp/WTF write-file guuid=88691490-1600-0000-dd50-3e5b240c0000 pid=3108->guuid=cdb16b90-1600-0000-dd50-3e5b260c0000 pid=3110 clone guuid=91b92590-1600-0000-dd50-3e5b250c0000 pid=3109->68a2f4c7-41e6-5d77-b8ef-ef54db09e0e2 send: 136B guuid=7b487b90-1600-0000-dd50-3e5b270c0000 pid=3111 /tmp/WTF guuid=cdb16b90-1600-0000-dd50-3e5b260c0000 pid=3110->guuid=7b487b90-1600-0000-dd50-3e5b270c0000 pid=3111 clone guuid=eccd8290-1600-0000-dd50-3e5b280c0000 pid=3112 /tmp/WTF guuid=cdb16b90-1600-0000-dd50-3e5b260c0000 pid=3110->guuid=eccd8290-1600-0000-dd50-3e5b280c0000 pid=3112 clone guuid=63da309a-1600-0000-dd50-3e5b370c0000 pid=3127->68a2f4c7-41e6-5d77-b8ef-ef54db09e0e2 send: 85B guuid=cc1b77b5-1600-0000-dd50-3e5b570c0000 pid=3159 /tmp/WTF net write-file zombie guuid=133919a8-1600-0000-dd50-3e5b410c0000 pid=3137->guuid=cc1b77b5-1600-0000-dd50-3e5b570c0000 pid=3159 clone guuid=cc1b77b5-1600-0000-dd50-3e5b570c0000 pid=3159->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=4c35bdb5-1600-0000-dd50-3e5b590c0000 pid=3161 /tmp/WTF write-file guuid=cc1b77b5-1600-0000-dd50-3e5b570c0000 pid=3159->guuid=4c35bdb5-1600-0000-dd50-3e5b590c0000 pid=3161 clone guuid=f60582b5-1600-0000-dd50-3e5b580c0000 pid=3160->68a2f4c7-41e6-5d77-b8ef-ef54db09e0e2 send: 137B guuid=e32d10b6-1600-0000-dd50-3e5b5a0c0000 pid=3162 /tmp/WTF guuid=4c35bdb5-1600-0000-dd50-3e5b590c0000 pid=3161->guuid=e32d10b6-1600-0000-dd50-3e5b5a0c0000 pid=3162 clone guuid=33ab21b6-1600-0000-dd50-3e5b5b0c0000 pid=3163 /tmp/WTF guuid=4c35bdb5-1600-0000-dd50-3e5b590c0000 pid=3161->guuid=33ab21b6-1600-0000-dd50-3e5b5b0c0000 pid=3163 clone guuid=fec623c0-1600-0000-dd50-3e5b5d0c0000 pid=3165->68a2f4c7-41e6-5d77-b8ef-ef54db09e0e2 send: 86B guuid=8c192ddb-1600-0000-dd50-3e5b910c0000 pid=3217 /tmp/WTF net write-file zombie guuid=7432becd-1600-0000-dd50-3e5b790c0000 pid=3193->guuid=8c192ddb-1600-0000-dd50-3e5b910c0000 pid=3217 clone guuid=8c192ddb-1600-0000-dd50-3e5b910c0000 pid=3217->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=ce2969db-1600-0000-dd50-3e5b940c0000 pid=3220 /tmp/WTF write-file guuid=8c192ddb-1600-0000-dd50-3e5b910c0000 pid=3217->guuid=ce2969db-1600-0000-dd50-3e5b940c0000 pid=3220 clone guuid=db2238db-1600-0000-dd50-3e5b920c0000 pid=3218->68a2f4c7-41e6-5d77-b8ef-ef54db09e0e2 send: 137B guuid=301f7edb-1600-0000-dd50-3e5b950c0000 pid=3221 /tmp/WTF guuid=ce2969db-1600-0000-dd50-3e5b940c0000 pid=3220->guuid=301f7edb-1600-0000-dd50-3e5b950c0000 pid=3221 clone guuid=ef5087db-1600-0000-dd50-3e5b960c0000 pid=3222 /tmp/WTF guuid=ce2969db-1600-0000-dd50-3e5b940c0000 pid=3220->guuid=ef5087db-1600-0000-dd50-3e5b960c0000 pid=3222 clone guuid=3788d5ea-1600-0000-dd50-3e5bac0c0000 pid=3244->68a2f4c7-41e6-5d77-b8ef-ef54db09e0e2 send: 86B guuid=3bf65808-1700-0000-dd50-3e5bc20c0000 pid=3266 /tmp/WTF net write-file zombie guuid=47cd9bfa-1600-0000-dd50-3e5bb80c0000 pid=3256->guuid=3bf65808-1700-0000-dd50-3e5bc20c0000 pid=3266 clone guuid=3bf65808-1700-0000-dd50-3e5bc20c0000 pid=3266->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=7a4ac51c-1700-0000-dd50-3e5bc40c0000 pid=3268 /tmp/WTF write-file guuid=3bf65808-1700-0000-dd50-3e5bc20c0000 pid=3266->guuid=7a4ac51c-1700-0000-dd50-3e5bc40c0000 pid=3268 clone guuid=9be47c08-1700-0000-dd50-3e5bc30c0000 pid=3267->68a2f4c7-41e6-5d77-b8ef-ef54db09e0e2 send: 139B guuid=fe194d22-1700-0000-dd50-3e5bd00c0000 pid=3280 /tmp/WTF guuid=7a4ac51c-1700-0000-dd50-3e5bc40c0000 pid=3268->guuid=fe194d22-1700-0000-dd50-3e5bd00c0000 pid=3280 clone guuid=e6005622-1700-0000-dd50-3e5bd10c0000 pid=3281 /tmp/WTF guuid=7a4ac51c-1700-0000-dd50-3e5bc40c0000 pid=3268->guuid=e6005622-1700-0000-dd50-3e5bd10c0000 pid=3281 clone guuid=ac48831d-1700-0000-dd50-3e5bc60c0000 pid=3270->68a2f4c7-41e6-5d77-b8ef-ef54db09e0e2 send: 88B guuid=d9b1ad37-1700-0000-dd50-3e5bfd0c0000 pid=3325 /tmp/WTF net write-file zombie guuid=3057f929-1700-0000-dd50-3e5bd90c0000 pid=3289->guuid=d9b1ad37-1700-0000-dd50-3e5bfd0c0000 pid=3325 clone guuid=d9b1ad37-1700-0000-dd50-3e5bfd0c0000 pid=3325->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=305cf137-1700-0000-dd50-3e5b000d0000 pid=3328 /tmp/WTF write-file guuid=d9b1ad37-1700-0000-dd50-3e5bfd0c0000 pid=3325->guuid=305cf137-1700-0000-dd50-3e5b000d0000 pid=3328 clone guuid=6e46ba37-1700-0000-dd50-3e5bfe0c0000 pid=3326->68a2f4c7-41e6-5d77-b8ef-ef54db09e0e2 send: 137B guuid=549efb37-1700-0000-dd50-3e5b010d0000 pid=3329 /tmp/WTF guuid=305cf137-1700-0000-dd50-3e5b000d0000 pid=3328->guuid=549efb37-1700-0000-dd50-3e5b010d0000 pid=3329 clone guuid=148b0538-1700-0000-dd50-3e5b020d0000 pid=3330 /tmp/WTF guuid=305cf137-1700-0000-dd50-3e5b000d0000 pid=3328->guuid=148b0538-1700-0000-dd50-3e5b020d0000 pid=3330 clone guuid=ab374441-1700-0000-dd50-3e5b190d0000 pid=3353->68a2f4c7-41e6-5d77-b8ef-ef54db09e0e2 send: 86B guuid=5a8b995a-1700-0000-dd50-3e5b680d0000 pid=3432 /tmp/WTF net write-file zombie guuid=0d4ff54c-1700-0000-dd50-3e5b4a0d0000 pid=3402->guuid=5a8b995a-1700-0000-dd50-3e5b680d0000 pid=3432 clone guuid=5a8b995a-1700-0000-dd50-3e5b680d0000 pid=3432->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=067ff35a-1700-0000-dd50-3e5b6a0d0000 pid=3434 /tmp/WTF write-file guuid=5a8b995a-1700-0000-dd50-3e5b680d0000 pid=3432->guuid=067ff35a-1700-0000-dd50-3e5b6a0d0000 pid=3434 clone guuid=6b47aa5a-1700-0000-dd50-3e5b690d0000 pid=3433->68a2f4c7-41e6-5d77-b8ef-ef54db09e0e2 send: 136B guuid=3457065b-1700-0000-dd50-3e5b6b0d0000 pid=3435 /tmp/WTF guuid=067ff35a-1700-0000-dd50-3e5b6a0d0000 pid=3434->guuid=3457065b-1700-0000-dd50-3e5b6b0d0000 pid=3435 clone guuid=6c2e0e5b-1700-0000-dd50-3e5b6c0d0000 pid=3436 /tmp/WTF guuid=067ff35a-1700-0000-dd50-3e5b6a0d0000 pid=3434->guuid=6c2e0e5b-1700-0000-dd50-3e5b6c0d0000 pid=3436 clone guuid=13399a65-1700-0000-dd50-3e5b870d0000 pid=3463->68a2f4c7-41e6-5d77-b8ef-ef54db09e0e2 send: 85B guuid=1c8d1a7e-1700-0000-dd50-3e5bd00d0000 pid=3536 /tmp/WTF net write-file zombie guuid=5541ec70-1700-0000-dd50-3e5baa0d0000 pid=3498->guuid=1c8d1a7e-1700-0000-dd50-3e5bd00d0000 pid=3536 clone guuid=1c8d1a7e-1700-0000-dd50-3e5bd00d0000 pid=3536->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=4e57507e-1700-0000-dd50-3e5bd30d0000 pid=3539 /tmp/WTF write-file guuid=1c8d1a7e-1700-0000-dd50-3e5bd00d0000 pid=3536->guuid=4e57507e-1700-0000-dd50-3e5bd30d0000 pid=3539 clone guuid=63fc287e-1700-0000-dd50-3e5bd10d0000 pid=3537->68a2f4c7-41e6-5d77-b8ef-ef54db09e0e2 send: 137B guuid=27e0617e-1700-0000-dd50-3e5bd40d0000 pid=3540 /tmp/WTF guuid=4e57507e-1700-0000-dd50-3e5bd30d0000 pid=3539->guuid=27e0617e-1700-0000-dd50-3e5bd40d0000 pid=3540 clone guuid=b3fc687e-1700-0000-dd50-3e5bd50d0000 pid=3541 /tmp/WTF guuid=4e57507e-1700-0000-dd50-3e5bd30d0000 pid=3539->guuid=b3fc687e-1700-0000-dd50-3e5bd50d0000 pid=3541 clone guuid=297d1c88-1700-0000-dd50-3e5bed0d0000 pid=3565->68a2f4c7-41e6-5d77-b8ef-ef54db09e0e2 send: 86B guuid=d67181bb-1700-0000-dd50-3e5b450e0000 pid=3653 /tmp/WTF net write-file zombie guuid=a9fd6dad-1700-0000-dd50-3e5b270e0000 pid=3623->guuid=d67181bb-1700-0000-dd50-3e5b450e0000 pid=3653 clone guuid=d67181bb-1700-0000-dd50-3e5b450e0000 pid=3653->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=d122c8bb-1700-0000-dd50-3e5b470e0000 pid=3655 /tmp/WTF write-file guuid=d67181bb-1700-0000-dd50-3e5b450e0000 pid=3653->guuid=d122c8bb-1700-0000-dd50-3e5b470e0000 pid=3655 clone guuid=ed709dbb-1700-0000-dd50-3e5b460e0000 pid=3654->68a2f4c7-41e6-5d77-b8ef-ef54db09e0e2 send: 137B guuid=6545d5bb-1700-0000-dd50-3e5b480e0000 pid=3656 /tmp/WTF guuid=d122c8bb-1700-0000-dd50-3e5b470e0000 pid=3655->guuid=6545d5bb-1700-0000-dd50-3e5b480e0000 pid=3656 clone guuid=1524dcbb-1700-0000-dd50-3e5b490e0000 pid=3657 /tmp/WTF guuid=d122c8bb-1700-0000-dd50-3e5b470e0000 pid=3655->guuid=1524dcbb-1700-0000-dd50-3e5b490e0000 pid=3657 clone guuid=a232b3c6-1700-0000-dd50-3e5b670e0000 pid=3687->68a2f4c7-41e6-5d77-b8ef-ef54db09e0e2 send: 86B guuid=1349bce0-1700-0000-dd50-3e5bd60e0000 pid=3798 /tmp/WTF net write-file zombie guuid=b3d144d3-1700-0000-dd50-3e5b9f0e0000 pid=3743->guuid=1349bce0-1700-0000-dd50-3e5bd60e0000 pid=3798 clone guuid=1349bce0-1700-0000-dd50-3e5bd60e0000 pid=3798->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=d7181ae1-1700-0000-dd50-3e5bd90e0000 pid=3801 /tmp/WTF write-file guuid=1349bce0-1700-0000-dd50-3e5bd60e0000 pid=3798->guuid=d7181ae1-1700-0000-dd50-3e5bd90e0000 pid=3801 clone guuid=814126e1-1700-0000-dd50-3e5bda0e0000 pid=3802 /tmp/WTF guuid=d7181ae1-1700-0000-dd50-3e5bd90e0000 pid=3801->guuid=814126e1-1700-0000-dd50-3e5bda0e0000 pid=3802 clone guuid=987f2ee1-1700-0000-dd50-3e5bdb0e0000 pid=3803 /tmp/WTF guuid=d7181ae1-1700-0000-dd50-3e5bd90e0000 pid=3801->guuid=987f2ee1-1700-0000-dd50-3e5bdb0e0000 pid=3803 clone guuid=d9ea61e1-1700-0000-dd50-3e5bdd0e0000 pid=3805->68a2f4c7-41e6-5d77-b8ef-ef54db09e0e2 send: 137B guuid=177da0eb-1700-0000-dd50-3e5bef0e0000 pid=3823->68a2f4c7-41e6-5d77-b8ef-ef54db09e0e2 send: 86B guuid=69b28208-1800-0000-dd50-3e5b550f0000 pid=3925 /tmp/WTF net write-file zombie guuid=3c8abcfa-1700-0000-dd50-3e5b270f0000 pid=3879->guuid=69b28208-1800-0000-dd50-3e5b550f0000 pid=3925 clone guuid=69b28208-1800-0000-dd50-3e5b550f0000 pid=3925->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=ff4bb408-1800-0000-dd50-3e5b570f0000 pid=3927 /tmp/WTF write-file guuid=69b28208-1800-0000-dd50-3e5b550f0000 pid=3925->guuid=ff4bb408-1800-0000-dd50-3e5b570f0000 pid=3927 clone guuid=f22cc208-1800-0000-dd50-3e5b580f0000 pid=3928 /tmp/WTF guuid=ff4bb408-1800-0000-dd50-3e5b570f0000 pid=3927->guuid=f22cc208-1800-0000-dd50-3e5b580f0000 pid=3928 clone guuid=8c70c808-1800-0000-dd50-3e5b590f0000 pid=3929 /tmp/WTF guuid=ff4bb408-1800-0000-dd50-3e5b570f0000 pid=3927->guuid=8c70c808-1800-0000-dd50-3e5b590f0000 pid=3929 clone guuid=5998140a-1800-0000-dd50-3e5b630f0000 pid=3939->68a2f4c7-41e6-5d77-b8ef-ef54db09e0e2 send: 136B guuid=004ab718-1800-0000-dd50-3e5b970f0000 pid=3991->68a2f4c7-41e6-5d77-b8ef-ef54db09e0e2 send: 85B guuid=1ee20033-1800-0000-dd50-3e5bfd0f0000 pid=4093 /tmp/WTF net write-file zombie guuid=10599b25-1800-0000-dd50-3e5bcf0f0000 pid=4047->guuid=1ee20033-1800-0000-dd50-3e5bfd0f0000 pid=4093 clone guuid=1ee20033-1800-0000-dd50-3e5bfd0f0000 pid=4093->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=cdf7c548-1800-0000-dd50-3e5b0b100000 pid=4107 /tmp/WTF write-file guuid=1ee20033-1800-0000-dd50-3e5bfd0f0000 pid=4093->guuid=cdf7c548-1800-0000-dd50-3e5b0b100000 pid=4107 clone guuid=11201533-1800-0000-dd50-3e5bfe0f0000 pid=4094->68a2f4c7-41e6-5d77-b8ef-ef54db09e0e2 send: 136B guuid=f596ef48-1800-0000-dd50-3e5b0c100000 pid=4108 /tmp/WTF guuid=cdf7c548-1800-0000-dd50-3e5b0b100000 pid=4107->guuid=f596ef48-1800-0000-dd50-3e5b0c100000 pid=4108 clone guuid=2a64f748-1800-0000-dd50-3e5b0d100000 pid=4109 /tmp/WTF guuid=cdf7c548-1800-0000-dd50-3e5b0b100000 pid=4107->guuid=2a64f748-1800-0000-dd50-3e5b0d100000 pid=4109 clone guuid=c64f824c-1800-0000-dd50-3e5b1d100000 pid=4125->68a2f4c7-41e6-5d77-b8ef-ef54db09e0e2 send: 85B guuid=66ee8f66-1800-0000-dd50-3e5b82100000 pid=4226 /tmp/WTF net write-file zombie guuid=219bed58-1800-0000-dd50-3e5b47100000 pid=4167->guuid=66ee8f66-1800-0000-dd50-3e5b82100000 pid=4226 clone guuid=66ee8f66-1800-0000-dd50-3e5b82100000 pid=4226->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=cce1c366-1800-0000-dd50-3e5b84100000 pid=4228 /tmp/WTF write-file guuid=66ee8f66-1800-0000-dd50-3e5b82100000 pid=4226->guuid=cce1c366-1800-0000-dd50-3e5b84100000 pid=4228 clone guuid=1bef9d66-1800-0000-dd50-3e5b83100000 pid=4227->68a2f4c7-41e6-5d77-b8ef-ef54db09e0e2 send: 137B guuid=ecd3d566-1800-0000-dd50-3e5b85100000 pid=4229 /tmp/WTF guuid=cce1c366-1800-0000-dd50-3e5b84100000 pid=4228->guuid=ecd3d566-1800-0000-dd50-3e5b85100000 pid=4229 clone guuid=3348dc66-1800-0000-dd50-3e5b86100000 pid=4230 /tmp/WTF guuid=cce1c366-1800-0000-dd50-3e5b84100000 pid=4228->guuid=3348dc66-1800-0000-dd50-3e5b86100000 pid=4230 clone guuid=00130471-1800-0000-dd50-3e5bb3100000 pid=4275->68a2f4c7-41e6-5d77-b8ef-ef54db09e0e2 send: 86B guuid=9f31da89-1800-0000-dd50-3e5b08110000 pid=4360 /tmp/WTF net write-file zombie guuid=ef0a3d7c-1800-0000-dd50-3e5bd1100000 pid=4305->guuid=9f31da89-1800-0000-dd50-3e5b08110000 pid=4360 clone guuid=9f31da89-1800-0000-dd50-3e5b08110000 pid=4360->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=eb99288a-1800-0000-dd50-3e5b0a110000 pid=4362 /tmp/WTF write-file guuid=9f31da89-1800-0000-dd50-3e5b08110000 pid=4360->guuid=eb99288a-1800-0000-dd50-3e5b0a110000 pid=4362 clone guuid=467ce789-1800-0000-dd50-3e5b09110000 pid=4361->68a2f4c7-41e6-5d77-b8ef-ef54db09e0e2 send: 136B guuid=5f04358a-1800-0000-dd50-3e5b0b110000 pid=4363 /tmp/WTF guuid=eb99288a-1800-0000-dd50-3e5b0a110000 pid=4362->guuid=5f04358a-1800-0000-dd50-3e5b0b110000 pid=4363 clone guuid=24173b8a-1800-0000-dd50-3e5b0c110000 pid=4364 /tmp/WTF guuid=eb99288a-1800-0000-dd50-3e5b0a110000 pid=4362->guuid=24173b8a-1800-0000-dd50-3e5b0c110000 pid=4364 clone guuid=862e5993-1800-0000-dd50-3e5b27110000 pid=4391->68a2f4c7-41e6-5d77-b8ef-ef54db09e0e2 send: 85B guuid=d094dcae-1800-0000-dd50-3e5b9b110000 pid=4507 /tmp/WTF net write-file zombie guuid=be9568a1-1800-0000-dd50-3e5b6b110000 pid=4459->guuid=d094dcae-1800-0000-dd50-3e5b9b110000 pid=4507 clone guuid=d094dcae-1800-0000-dd50-3e5b9b110000 pid=4507->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con guuid=77ec13af-1800-0000-dd50-3e5b9d110000 pid=4509 /tmp/WTF net send-data write-config write-file guuid=d094dcae-1800-0000-dd50-3e5b9b110000 pid=4507->guuid=77ec13af-1800-0000-dd50-3e5b9d110000 pid=4509 clone guuid=77ec13af-1800-0000-dd50-3e5b9d110000 pid=4509->8b0a01dc-0728-52c1-8024-c4ba7801b8d6 con ae4ae37b-03d1-540e-ac1d-11e74f766f2a 46.151.182.200:33769 guuid=77ec13af-1800-0000-dd50-3e5b9d110000 pid=4509->ae4ae37b-03d1-540e-ac1d-11e74f766f2a send: 606B a7eef23b-3bd8-5389-bd5c-62af93207a18 127.0.0.1:9 guuid=77ec13af-1800-0000-dd50-3e5b9d110000 pid=4509->a7eef23b-3bd8-5389-bd5c-62af93207a18 send: 4188160B guuid=ef9e1eaf-1800-0000-dd50-3e5b9e110000 pid=4510 /tmp/WTF guuid=77ec13af-1800-0000-dd50-3e5b9d110000 pid=4509->guuid=ef9e1eaf-1800-0000-dd50-3e5b9e110000 pid=4510 clone guuid=1f9026af-1800-0000-dd50-3e5b9f110000 pid=4511 /tmp/WTF guuid=77ec13af-1800-0000-dd50-3e5b9d110000 pid=4509->guuid=1f9026af-1800-0000-dd50-3e5b9f110000 pid=4511 clone guuid=5aa33265-1900-0000-dd50-3e5b48130000 pid=4936 /usr/bin/systemctl guuid=77ec13af-1800-0000-dd50-3e5b9d110000 pid=4509->guuid=5aa33265-1900-0000-dd50-3e5b48130000 pid=4936 execve guuid=e5b6eba0-1900-0000-dd50-3e5ba4130000 pid=5028 /usr/bin/systemctl guuid=77ec13af-1800-0000-dd50-3e5b9d110000 pid=4509->guuid=e5b6eba0-1900-0000-dd50-3e5ba4130000 pid=5028 execve guuid=1ff46cdd-1900-0000-dd50-3e5b70140000 pid=5232 /usr/bin/systemctl guuid=77ec13af-1800-0000-dd50-3e5b9d110000 pid=4509->guuid=1ff46cdd-1900-0000-dd50-3e5b70140000 pid=5232 execve guuid=18574819-1a00-0000-dd50-3e5b7c140000 pid=5244 /usr/bin/systemctl guuid=77ec13af-1800-0000-dd50-3e5b9d110000 pid=4509->guuid=18574819-1a00-0000-dd50-3e5b7c140000 pid=5244 execve guuid=cc3b4057-1a00-0000-dd50-3e5b7d140000 pid=5245 /tmp/WTF guuid=77ec13af-1800-0000-dd50-3e5b9d110000 pid=4509->guuid=cc3b4057-1a00-0000-dd50-3e5b7d140000 pid=5245 clone guuid=d60fed92-1a00-0000-dd50-3e5b7e140000 pid=5246 /tmp/WTF guuid=77ec13af-1800-0000-dd50-3e5b9d110000 pid=4509->guuid=d60fed92-1a00-0000-dd50-3e5b7e140000 pid=5246 clone guuid=7e59a8ce-1a00-0000-dd50-3e5b86140000 pid=5254 /tmp/WTF guuid=77ec13af-1800-0000-dd50-3e5b9d110000 pid=4509->guuid=7e59a8ce-1a00-0000-dd50-3e5b86140000 pid=5254 clone guuid=989bfa0a-1b00-0000-dd50-3e5b87140000 pid=5255 /tmp/WTF guuid=77ec13af-1800-0000-dd50-3e5b9d110000 pid=4509->guuid=989bfa0a-1b00-0000-dd50-3e5b87140000 pid=5255 clone guuid=049fa446-1b00-0000-dd50-3e5b88140000 pid=5256 /tmp/WTF guuid=77ec13af-1800-0000-dd50-3e5b9d110000 pid=4509->guuid=049fa446-1b00-0000-dd50-3e5b88140000 pid=5256 clone guuid=25375982-1b00-0000-dd50-3e5b89140000 pid=5257 /tmp/WTF guuid=77ec13af-1800-0000-dd50-3e5b9d110000 pid=4509->guuid=25375982-1b00-0000-dd50-3e5b89140000 pid=5257 clone guuid=467a7382-1b00-0000-dd50-3e5b8a140000 pid=5258 /tmp/WTF guuid=77ec13af-1800-0000-dd50-3e5b9d110000 pid=4509->guuid=467a7382-1b00-0000-dd50-3e5b8a140000 pid=5258 clone guuid=53c52acc-1b00-0000-dd50-3e5b8c140000 pid=5260 /etc/init.d/network-dispatch guuid=77ec13af-1800-0000-dd50-3e5b9d110000 pid=4509->guuid=53c52acc-1b00-0000-dd50-3e5b8c140000 pid=5260 execve guuid=ebb4830c-1c00-0000-dd50-3e5b9a140000 pid=5274 /tmp/WTF guuid=77ec13af-1800-0000-dd50-3e5b9d110000 pid=4509->guuid=ebb4830c-1c00-0000-dd50-3e5b9a140000 pid=5274 clone guuid=d8e9db4a-1c00-0000-dd50-3e5bad140000 pid=5293 /tmp/WTF guuid=77ec13af-1800-0000-dd50-3e5b9d110000 pid=4509->guuid=d8e9db4a-1c00-0000-dd50-3e5bad140000 pid=5293 clone guuid=4e30fd4a-1c00-0000-dd50-3e5baf140000 pid=5295 /tmp/WTF guuid=77ec13af-1800-0000-dd50-3e5b9d110000 pid=4509->guuid=4e30fd4a-1c00-0000-dd50-3e5baf140000 pid=5295 clone guuid=1ce4e54a-1c00-0000-dd50-3e5bae140000 pid=5294 /tmp/WTF dns net send-data guuid=d8e9db4a-1c00-0000-dd50-3e5bad140000 pid=5293->guuid=1ce4e54a-1c00-0000-dd50-3e5bae140000 pid=5294 clone 4f6baed0-9587-596c-82b3-fd721afe4cc1 10.0.2.3:53 guuid=1ce4e54a-1c00-0000-dd50-3e5bae140000 pid=5294->4f6baed0-9587-596c-82b3-fd721afe4cc1 send: 360B
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/503dca2a79244bb2ad2dbeae2bdab48613fe6d16d4b4d8b16646c816c82c65cb
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/503dca2a79244bb2ad2dbeae2bdab48613fe6d16d4b4d8b16646c816c82c65cb/
Threat name:
Linux.Downloader.Morila
Create hunting rule
Status:
Malicious
First seen:
2026-09-01 22:11:19 UTC
File Type:
Text (Shell)
AV detection:
20 of 36 (55.56%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ka64uktzerf3fljnx2xcxwvuqyj743iw2s2nrmlgi3ebnsbmmxfq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery execution linux persistence privilege_escalation
Link:
https://tria.ge/reports/260901-13877abr5s/
Behaviour
Enumerates kernel/hardware configuration
Reads runtime system information
System Network Configuration Discovery
Writes file to shm directory
Writes file to tmp directory
Changes its process name
Checks CPU configuration
Creates a desktop entry file
Modifies Bash startup script
Creates/modifies Cron job
Creates/modifies environment variables
Deletes log files
Modifies init.d
Modifies rc script
Modifies systemd
Write file to user bin folder
Writes file to system bin folder
File and Directory Permissions Modification
Executes dropped EXE
Modifies Watchdog functionality
Traces itself
Unexpected DNS network traffic destination
Malware family:
Mirai
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/503dca2a7924/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Linux_Shellscript_Downloader
Create hunting rule
Author:albertzsigovits
Description:Generic Approach to Shellscript downloaders
Rule name:MAL_Linux_IoT_MultiArch_BotnetLoader_Generic
Create hunting rule
Author:Anish Bogati
Description:Technique-based detection of IoT/Linux botnet loader shell scripts downloading binaries from numeric IPs, chmodding, and executing multi-architecture payloads
Reference:MalwareBazaar sample lilin.sh

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 503dca2a79244bb2ad2dbeae2bdab48613fe6d16d4b4d8b16646c816c82c65cb

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3910747/
  
Delivery method
Distributed via web download

Comments