MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5e1f87d4b1095c81cf69cdc05621e5b6d19a227943dc6cd26c2896915744f717. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5e1f87d4b1095c81cf69cdc05621e5b6d19a227943dc6cd26c2896915744f717
SHA3-384 hash: ac93d5d42c5f01e95a2f89199d37b6bf6f22493313886bb85dceb322fe61e2182d0ac7a5343726de00f5c8632324a430
SHA1 hash: 74ffecc698a4454b9d90a123c3b3a5f5a852cbb0
MD5 hash: 6faf371da49795e7d6a6a0a220498ebe
humanhash: lemon-mobile-delaware-pizza
File name:p
Download: download sample
File size:830 bytes
First seen:2026-06-08 13:53:58 UTC
Last seen:2026-06-09 06:01:35 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkaqDjIIEsvIsu4yjTLICpEajID0mLs7IaYQ:kXCKysE2hi0ziQvZohaqYk0PLPNteTU7
TLSH T15A01AFCEC102DB108185F89D72D75680B410C3CB59894FF87F9C483DABA97887165F84
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://188.132.232.81/uocn/an/aelf ua-wget
http://188.132.232.81/v4bn/an/aelf ua-wget
http://188.132.232.81/CElnn/an/aelf ua-wget
http://188.132.232.81/owByn/an/aelf ua-wget
http://188.132.232.81/e1bn/an/aelf ua-wget

Intelligence

File Origin
# of uploads :
3
# of downloads :
46
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive
Link:
https://www.filescan.io/uploads/6a26c99a8161ac6cb55d35c1/reports/5724acbb-312d-4be2-8812-23a6da869a34/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-06-08T11:00:00Z UTC
Last seen:
2026-06-08T23:34:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan-Downloader.Shell.Agent.a
Link:
https://opentip.kaspersky.com/5e1f87d4b1095c81cf69cdc05621e5b6d19a227943dc6cd26c2896915744f717/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/66b6987c-7bc5-43e0-8af3-ddb3d3814aeb
Behavior Graph:
Download SVG
%3 guuid=b1a014ab-1a00-0000-5639-51d6f8090000 pid=2552 /usr/bin/sudo guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561 /tmp/sample.bin write-file guuid=b1a014ab-1a00-0000-5639-51d6f8090000 pid=2552->guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561 execve guuid=cdfadead-1a00-0000-5639-51d6030a0000 pid=2563 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=cdfadead-1a00-0000-5639-51d6030a0000 pid=2563 execve guuid=554b82ae-1a00-0000-5639-51d6070a0000 pid=2567 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=554b82ae-1a00-0000-5639-51d6070a0000 pid=2567 execve guuid=a6b71daf-1a00-0000-5639-51d60a0a0000 pid=2570 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=a6b71daf-1a00-0000-5639-51d60a0a0000 pid=2570 execve guuid=1da6c4af-1a00-0000-5639-51d60d0a0000 pid=2573 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=1da6c4af-1a00-0000-5639-51d60d0a0000 pid=2573 execve guuid=c8db6cb0-1a00-0000-5639-51d60f0a0000 pid=2575 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=c8db6cb0-1a00-0000-5639-51d60f0a0000 pid=2575 execve guuid=7bf8e4b0-1a00-0000-5639-51d6110a0000 pid=2577 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=7bf8e4b0-1a00-0000-5639-51d6110a0000 pid=2577 execve guuid=30ab50b1-1a00-0000-5639-51d6120a0000 pid=2578 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=30ab50b1-1a00-0000-5639-51d6120a0000 pid=2578 execve guuid=0670c1b1-1a00-0000-5639-51d6130a0000 pid=2579 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=0670c1b1-1a00-0000-5639-51d6130a0000 pid=2579 execve guuid=62282bb2-1a00-0000-5639-51d6150a0000 pid=2581 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=62282bb2-1a00-0000-5639-51d6150a0000 pid=2581 execve guuid=1e74b5b2-1a00-0000-5639-51d6170a0000 pid=2583 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=1e74b5b2-1a00-0000-5639-51d6170a0000 pid=2583 execve guuid=334a1ab3-1a00-0000-5639-51d61a0a0000 pid=2586 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=334a1ab3-1a00-0000-5639-51d61a0a0000 pid=2586 execve guuid=8ecc7bb3-1a00-0000-5639-51d61c0a0000 pid=2588 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=8ecc7bb3-1a00-0000-5639-51d61c0a0000 pid=2588 execve guuid=f022dab3-1a00-0000-5639-51d61e0a0000 pid=2590 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=f022dab3-1a00-0000-5639-51d61e0a0000 pid=2590 execve guuid=b44751b4-1a00-0000-5639-51d6210a0000 pid=2593 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=b44751b4-1a00-0000-5639-51d6210a0000 pid=2593 execve guuid=514ac7b4-1a00-0000-5639-51d6230a0000 pid=2595 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=514ac7b4-1a00-0000-5639-51d6230a0000 pid=2595 execve guuid=ee8438b5-1a00-0000-5639-51d6250a0000 pid=2597 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=ee8438b5-1a00-0000-5639-51d6250a0000 pid=2597 execve guuid=baefcfb5-1a00-0000-5639-51d6270a0000 pid=2599 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=baefcfb5-1a00-0000-5639-51d6270a0000 pid=2599 execve guuid=f7ea5ab6-1a00-0000-5639-51d6290a0000 pid=2601 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=f7ea5ab6-1a00-0000-5639-51d6290a0000 pid=2601 execve guuid=7462e4b6-1a00-0000-5639-51d62c0a0000 pid=2604 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=7462e4b6-1a00-0000-5639-51d62c0a0000 pid=2604 execve guuid=e7f98db7-1a00-0000-5639-51d62e0a0000 pid=2606 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=e7f98db7-1a00-0000-5639-51d62e0a0000 pid=2606 execve guuid=e03209b8-1a00-0000-5639-51d62f0a0000 pid=2607 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=e03209b8-1a00-0000-5639-51d62f0a0000 pid=2607 execve guuid=efbf84b8-1a00-0000-5639-51d6300a0000 pid=2608 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=efbf84b8-1a00-0000-5639-51d6300a0000 pid=2608 execve guuid=0cc30bb9-1a00-0000-5639-51d6320a0000 pid=2610 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=0cc30bb9-1a00-0000-5639-51d6320a0000 pid=2610 execve guuid=0aac83b9-1a00-0000-5639-51d6350a0000 pid=2613 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=0aac83b9-1a00-0000-5639-51d6350a0000 pid=2613 execve guuid=b25927ba-1a00-0000-5639-51d6370a0000 pid=2615 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=b25927ba-1a00-0000-5639-51d6370a0000 pid=2615 execve guuid=c429cdba-1a00-0000-5639-51d63a0a0000 pid=2618 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=c429cdba-1a00-0000-5639-51d63a0a0000 pid=2618 execve guuid=b33e3bbb-1a00-0000-5639-51d63c0a0000 pid=2620 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=b33e3bbb-1a00-0000-5639-51d63c0a0000 pid=2620 execve guuid=974aeebb-1a00-0000-5639-51d63e0a0000 pid=2622 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=974aeebb-1a00-0000-5639-51d63e0a0000 pid=2622 execve guuid=ea955cbc-1a00-0000-5639-51d6410a0000 pid=2625 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=ea955cbc-1a00-0000-5639-51d6410a0000 pid=2625 execve guuid=dbc0e6bc-1a00-0000-5639-51d6430a0000 pid=2627 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=dbc0e6bc-1a00-0000-5639-51d6430a0000 pid=2627 execve guuid=303470bd-1a00-0000-5639-51d6450a0000 pid=2629 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=303470bd-1a00-0000-5639-51d6450a0000 pid=2629 execve guuid=9c5e2bbe-1a00-0000-5639-51d6480a0000 pid=2632 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=9c5e2bbe-1a00-0000-5639-51d6480a0000 pid=2632 execve guuid=c11dcfbe-1a00-0000-5639-51d64b0a0000 pid=2635 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=c11dcfbe-1a00-0000-5639-51d64b0a0000 pid=2635 execve guuid=6d5677bf-1a00-0000-5639-51d64e0a0000 pid=2638 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=6d5677bf-1a00-0000-5639-51d64e0a0000 pid=2638 execve guuid=addce3bf-1a00-0000-5639-51d6500a0000 pid=2640 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=addce3bf-1a00-0000-5639-51d6500a0000 pid=2640 execve guuid=1b2f48c0-1a00-0000-5639-51d6520a0000 pid=2642 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=1b2f48c0-1a00-0000-5639-51d6520a0000 pid=2642 execve guuid=6f1ea3c0-1a00-0000-5639-51d6540a0000 pid=2644 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=6f1ea3c0-1a00-0000-5639-51d6540a0000 pid=2644 execve guuid=6bba05c1-1a00-0000-5639-51d6560a0000 pid=2646 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=6bba05c1-1a00-0000-5639-51d6560a0000 pid=2646 execve guuid=f9f769c1-1a00-0000-5639-51d6580a0000 pid=2648 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=f9f769c1-1a00-0000-5639-51d6580a0000 pid=2648 execve guuid=f8751fc2-1a00-0000-5639-51d65b0a0000 pid=2651 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=f8751fc2-1a00-0000-5639-51d65b0a0000 pid=2651 execve guuid=4fead8c2-1a00-0000-5639-51d65e0a0000 pid=2654 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=4fead8c2-1a00-0000-5639-51d65e0a0000 pid=2654 execve guuid=660d91c3-1a00-0000-5639-51d6620a0000 pid=2658 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=660d91c3-1a00-0000-5639-51d6620a0000 pid=2658 execve guuid=fcc46ac4-1a00-0000-5639-51d6650a0000 pid=2661 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=fcc46ac4-1a00-0000-5639-51d6650a0000 pid=2661 execve guuid=47aeccc4-1a00-0000-5639-51d6670a0000 pid=2663 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=47aeccc4-1a00-0000-5639-51d6670a0000 pid=2663 execve guuid=91d030c5-1a00-0000-5639-51d6690a0000 pid=2665 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=91d030c5-1a00-0000-5639-51d6690a0000 pid=2665 execve guuid=d4d0e2c5-1a00-0000-5639-51d66c0a0000 pid=2668 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=d4d0e2c5-1a00-0000-5639-51d66c0a0000 pid=2668 execve guuid=d98e9ec6-1a00-0000-5639-51d66e0a0000 pid=2670 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=d98e9ec6-1a00-0000-5639-51d66e0a0000 pid=2670 execve guuid=f2bc48c7-1a00-0000-5639-51d6700a0000 pid=2672 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=f2bc48c7-1a00-0000-5639-51d6700a0000 pid=2672 execve guuid=093ccdc7-1a00-0000-5639-51d6720a0000 pid=2674 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=093ccdc7-1a00-0000-5639-51d6720a0000 pid=2674 execve guuid=7a4e44c8-1a00-0000-5639-51d6750a0000 pid=2677 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=7a4e44c8-1a00-0000-5639-51d6750a0000 pid=2677 execve guuid=3815a8c8-1a00-0000-5639-51d6770a0000 pid=2679 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=3815a8c8-1a00-0000-5639-51d6770a0000 pid=2679 execve guuid=f52c13c9-1a00-0000-5639-51d6790a0000 pid=2681 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=f52c13c9-1a00-0000-5639-51d6790a0000 pid=2681 execve guuid=66e6bec9-1a00-0000-5639-51d67c0a0000 pid=2684 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=66e6bec9-1a00-0000-5639-51d67c0a0000 pid=2684 execve guuid=79d03eca-1a00-0000-5639-51d67f0a0000 pid=2687 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=79d03eca-1a00-0000-5639-51d67f0a0000 pid=2687 execve guuid=da2ba0ca-1a00-0000-5639-51d6810a0000 pid=2689 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=da2ba0ca-1a00-0000-5639-51d6810a0000 pid=2689 execve guuid=88a70ecb-1a00-0000-5639-51d6830a0000 pid=2691 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=88a70ecb-1a00-0000-5639-51d6830a0000 pid=2691 execve guuid=7d0d7dcb-1a00-0000-5639-51d6860a0000 pid=2694 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=7d0d7dcb-1a00-0000-5639-51d6860a0000 pid=2694 execve guuid=79f6e6cb-1a00-0000-5639-51d6880a0000 pid=2696 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=79f6e6cb-1a00-0000-5639-51d6880a0000 pid=2696 execve guuid=7d7745cc-1a00-0000-5639-51d68a0a0000 pid=2698 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=7d7745cc-1a00-0000-5639-51d68a0a0000 pid=2698 execve guuid=d130c6cc-1a00-0000-5639-51d68d0a0000 pid=2701 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=d130c6cc-1a00-0000-5639-51d68d0a0000 pid=2701 execve guuid=726d4acd-1a00-0000-5639-51d6900a0000 pid=2704 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=726d4acd-1a00-0000-5639-51d6900a0000 pid=2704 execve guuid=80f5d3cd-1a00-0000-5639-51d6930a0000 pid=2707 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=80f5d3cd-1a00-0000-5639-51d6930a0000 pid=2707 execve guuid=a02654ce-1a00-0000-5639-51d6950a0000 pid=2709 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=a02654ce-1a00-0000-5639-51d6950a0000 pid=2709 execve guuid=9ea7bace-1a00-0000-5639-51d6970a0000 pid=2711 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=9ea7bace-1a00-0000-5639-51d6970a0000 pid=2711 execve guuid=f8bb13cf-1a00-0000-5639-51d6990a0000 pid=2713 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=f8bb13cf-1a00-0000-5639-51d6990a0000 pid=2713 execve guuid=abb978cf-1a00-0000-5639-51d69b0a0000 pid=2715 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=abb978cf-1a00-0000-5639-51d69b0a0000 pid=2715 execve guuid=547fd3cf-1a00-0000-5639-51d69d0a0000 pid=2717 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=547fd3cf-1a00-0000-5639-51d69d0a0000 pid=2717 execve guuid=40aa30d0-1a00-0000-5639-51d69f0a0000 pid=2719 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=40aa30d0-1a00-0000-5639-51d69f0a0000 pid=2719 execve guuid=28828bd0-1a00-0000-5639-51d6a10a0000 pid=2721 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=28828bd0-1a00-0000-5639-51d6a10a0000 pid=2721 execve guuid=b9c826d1-1a00-0000-5639-51d6a30a0000 pid=2723 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=b9c826d1-1a00-0000-5639-51d6a30a0000 pid=2723 execve guuid=e5dde1d1-1a00-0000-5639-51d6a60a0000 pid=2726 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=e5dde1d1-1a00-0000-5639-51d6a60a0000 pid=2726 execve guuid=fbf994d2-1a00-0000-5639-51d6a90a0000 pid=2729 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=fbf994d2-1a00-0000-5639-51d6a90a0000 pid=2729 execve guuid=b5d848d3-1a00-0000-5639-51d6ac0a0000 pid=2732 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=b5d848d3-1a00-0000-5639-51d6ac0a0000 pid=2732 execve guuid=0c5ff1d3-1a00-0000-5639-51d6ae0a0000 pid=2734 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=0c5ff1d3-1a00-0000-5639-51d6ae0a0000 pid=2734 execve guuid=fad991d4-1a00-0000-5639-51d6b10a0000 pid=2737 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=fad991d4-1a00-0000-5639-51d6b10a0000 pid=2737 execve guuid=b85df1d4-1a00-0000-5639-51d6b30a0000 pid=2739 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=b85df1d4-1a00-0000-5639-51d6b30a0000 pid=2739 execve guuid=b37050d5-1a00-0000-5639-51d6b50a0000 pid=2741 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=b37050d5-1a00-0000-5639-51d6b50a0000 pid=2741 execve guuid=7621b4d5-1a00-0000-5639-51d6b70a0000 pid=2743 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=7621b4d5-1a00-0000-5639-51d6b70a0000 pid=2743 execve guuid=71361dd6-1a00-0000-5639-51d6b90a0000 pid=2745 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=71361dd6-1a00-0000-5639-51d6b90a0000 pid=2745 execve guuid=4c277bd6-1a00-0000-5639-51d6bb0a0000 pid=2747 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=4c277bd6-1a00-0000-5639-51d6bb0a0000 pid=2747 execve guuid=c96d0ed7-1a00-0000-5639-51d6be0a0000 pid=2750 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=c96d0ed7-1a00-0000-5639-51d6be0a0000 pid=2750 execve guuid=43b6acd7-1a00-0000-5639-51d6c10a0000 pid=2753 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=43b6acd7-1a00-0000-5639-51d6c10a0000 pid=2753 execve guuid=06c632d8-1a00-0000-5639-51d6c30a0000 pid=2755 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=06c632d8-1a00-0000-5639-51d6c30a0000 pid=2755 execve guuid=e2a0ced8-1a00-0000-5639-51d6c60a0000 pid=2758 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=e2a0ced8-1a00-0000-5639-51d6c60a0000 pid=2758 execve guuid=286576d9-1a00-0000-5639-51d6c80a0000 pid=2760 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=286576d9-1a00-0000-5639-51d6c80a0000 pid=2760 execve guuid=b2090fda-1a00-0000-5639-51d6ca0a0000 pid=2762 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=b2090fda-1a00-0000-5639-51d6ca0a0000 pid=2762 execve guuid=aa65afda-1a00-0000-5639-51d6cd0a0000 pid=2765 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=aa65afda-1a00-0000-5639-51d6cd0a0000 pid=2765 execve guuid=8e8418db-1a00-0000-5639-51d6cf0a0000 pid=2767 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=8e8418db-1a00-0000-5639-51d6cf0a0000 pid=2767 execve guuid=2a418adb-1a00-0000-5639-51d6d10a0000 pid=2769 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=2a418adb-1a00-0000-5639-51d6d10a0000 pid=2769 execve guuid=0ba9ecdb-1a00-0000-5639-51d6d30a0000 pid=2771 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=0ba9ecdb-1a00-0000-5639-51d6d30a0000 pid=2771 execve guuid=d69954dc-1a00-0000-5639-51d6d50a0000 pid=2773 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=d69954dc-1a00-0000-5639-51d6d50a0000 pid=2773 execve guuid=049ebbdc-1a00-0000-5639-51d6d70a0000 pid=2775 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=049ebbdc-1a00-0000-5639-51d6d70a0000 pid=2775 execve guuid=8f9621dd-1a00-0000-5639-51d6d90a0000 pid=2777 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=8f9621dd-1a00-0000-5639-51d6d90a0000 pid=2777 execve guuid=4e198add-1a00-0000-5639-51d6db0a0000 pid=2779 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=4e198add-1a00-0000-5639-51d6db0a0000 pid=2779 execve guuid=4468fcdd-1a00-0000-5639-51d6dd0a0000 pid=2781 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=4468fcdd-1a00-0000-5639-51d6dd0a0000 pid=2781 execve guuid=2d7770de-1a00-0000-5639-51d6df0a0000 pid=2783 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=2d7770de-1a00-0000-5639-51d6df0a0000 pid=2783 execve guuid=1735dfde-1a00-0000-5639-51d6e10a0000 pid=2785 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=1735dfde-1a00-0000-5639-51d6e10a0000 pid=2785 execve guuid=46a14bdf-1a00-0000-5639-51d6e30a0000 pid=2787 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=46a14bdf-1a00-0000-5639-51d6e30a0000 pid=2787 execve guuid=48a5bfdf-1a00-0000-5639-51d6e50a0000 pid=2789 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=48a5bfdf-1a00-0000-5639-51d6e50a0000 pid=2789 execve guuid=221f65e0-1a00-0000-5639-51d6e80a0000 pid=2792 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=221f65e0-1a00-0000-5639-51d6e80a0000 pid=2792 execve guuid=d395cce0-1a00-0000-5639-51d6ea0a0000 pid=2794 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=d395cce0-1a00-0000-5639-51d6ea0a0000 pid=2794 execve guuid=e58b36e1-1a00-0000-5639-51d6ec0a0000 pid=2796 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=e58b36e1-1a00-0000-5639-51d6ec0a0000 pid=2796 execve guuid=07deabe1-1a00-0000-5639-51d6ee0a0000 pid=2798 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=07deabe1-1a00-0000-5639-51d6ee0a0000 pid=2798 execve guuid=3bd119e2-1a00-0000-5639-51d6f00a0000 pid=2800 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=3bd119e2-1a00-0000-5639-51d6f00a0000 pid=2800 execve guuid=e43396e2-1a00-0000-5639-51d6f30a0000 pid=2803 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=e43396e2-1a00-0000-5639-51d6f30a0000 pid=2803 execve guuid=21aa20e3-1a00-0000-5639-51d6f60a0000 pid=2806 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=21aa20e3-1a00-0000-5639-51d6f60a0000 pid=2806 execve guuid=ba5882e3-1a00-0000-5639-51d6f80a0000 pid=2808 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=ba5882e3-1a00-0000-5639-51d6f80a0000 pid=2808 execve guuid=742be4e3-1a00-0000-5639-51d6fa0a0000 pid=2810 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=742be4e3-1a00-0000-5639-51d6fa0a0000 pid=2810 execve guuid=b13e66e4-1a00-0000-5639-51d6fc0a0000 pid=2812 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=b13e66e4-1a00-0000-5639-51d6fc0a0000 pid=2812 execve guuid=144ad9e4-1a00-0000-5639-51d6fe0a0000 pid=2814 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=144ad9e4-1a00-0000-5639-51d6fe0a0000 pid=2814 execve guuid=4ee03be5-1a00-0000-5639-51d6000b0000 pid=2816 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=4ee03be5-1a00-0000-5639-51d6000b0000 pid=2816 execve guuid=c42bcfe5-1a00-0000-5639-51d6030b0000 pid=2819 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=c42bcfe5-1a00-0000-5639-51d6030b0000 pid=2819 execve guuid=61955ee6-1a00-0000-5639-51d6050b0000 pid=2821 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=61955ee6-1a00-0000-5639-51d6050b0000 pid=2821 execve guuid=e0e7ece6-1a00-0000-5639-51d6080b0000 pid=2824 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=e0e7ece6-1a00-0000-5639-51d6080b0000 pid=2824 execve guuid=10dc75e7-1a00-0000-5639-51d60a0b0000 pid=2826 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=10dc75e7-1a00-0000-5639-51d60a0b0000 pid=2826 execve guuid=81b81ae8-1a00-0000-5639-51d60d0b0000 pid=2829 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=81b81ae8-1a00-0000-5639-51d60d0b0000 pid=2829 execve guuid=4cd0c7e8-1a00-0000-5639-51d6100b0000 pid=2832 /usr/bin/ls guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=4cd0c7e8-1a00-0000-5639-51d6100b0000 pid=2832 execve guuid=72d75de9-1a00-0000-5639-51d6120b0000 pid=2834 /usr/bin/rm guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=72d75de9-1a00-0000-5639-51d6120b0000 pid=2834 execve guuid=207cc3e9-1a00-0000-5639-51d6150b0000 pid=2837 /usr/bin/wget net send-data write-file guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=207cc3e9-1a00-0000-5639-51d6150b0000 pid=2837 execve guuid=08539b2e-1b00-0000-5639-51d6990b0000 pid=2969 /usr/bin/chmod guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=08539b2e-1b00-0000-5639-51d6990b0000 pid=2969 execve guuid=c96ef92e-1b00-0000-5639-51d69b0b0000 pid=2971 /tmp/uoc guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=c96ef92e-1b00-0000-5639-51d69b0b0000 pid=2971 execve guuid=941e3131-1b00-0000-5639-51d6a20b0000 pid=2978 /usr/bin/rm guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=941e3131-1b00-0000-5639-51d6a20b0000 pid=2978 execve guuid=faf06f31-1b00-0000-5639-51d6a30b0000 pid=2979 /usr/bin/wget net send-data write-file guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=faf06f31-1b00-0000-5639-51d6a30b0000 pid=2979 execve guuid=00dba037-1b00-0000-5639-51d6b10b0000 pid=2993 /usr/bin/chmod guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=00dba037-1b00-0000-5639-51d6b10b0000 pid=2993 execve guuid=8d372238-1b00-0000-5639-51d6b20b0000 pid=2994 /usr/bin/dash guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=8d372238-1b00-0000-5639-51d6b20b0000 pid=2994 clone guuid=99a81f39-1b00-0000-5639-51d6b40b0000 pid=2996 /usr/bin/rm guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=99a81f39-1b00-0000-5639-51d6b40b0000 pid=2996 execve guuid=b4256439-1b00-0000-5639-51d6b60b0000 pid=2998 /usr/bin/wget net send-data write-file guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=b4256439-1b00-0000-5639-51d6b60b0000 pid=2998 execve guuid=c79dc43f-1b00-0000-5639-51d6c40b0000 pid=3012 /usr/bin/chmod guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=c79dc43f-1b00-0000-5639-51d6c40b0000 pid=3012 execve guuid=d4612040-1b00-0000-5639-51d6c60b0000 pid=3014 /tmp/CEln guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=d4612040-1b00-0000-5639-51d6c60b0000 pid=3014 execve guuid=2afcec40-1b00-0000-5639-51d6cb0b0000 pid=3019 /usr/bin/rm guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=2afcec40-1b00-0000-5639-51d6cb0b0000 pid=3019 execve guuid=3d782841-1b00-0000-5639-51d6cc0b0000 pid=3020 /usr/bin/wget net send-data write-file guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=3d782841-1b00-0000-5639-51d6cc0b0000 pid=3020 execve guuid=52fc1048-1b00-0000-5639-51d6e10b0000 pid=3041 /usr/bin/chmod guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=52fc1048-1b00-0000-5639-51d6e10b0000 pid=3041 execve guuid=0cb05048-1b00-0000-5639-51d6e30b0000 pid=3043 /tmp/owBy guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=0cb05048-1b00-0000-5639-51d6e30b0000 pid=3043 execve guuid=6fcc4949-1b00-0000-5639-51d6e80b0000 pid=3048 /usr/bin/rm guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=6fcc4949-1b00-0000-5639-51d6e80b0000 pid=3048 execve guuid=0f338849-1b00-0000-5639-51d6e90b0000 pid=3049 /usr/bin/wget net send-data write-file guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=0f338849-1b00-0000-5639-51d6e90b0000 pid=3049 execve guuid=e2742c8c-1b00-0000-5639-51d65b0c0000 pid=3163 /usr/bin/chmod guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=e2742c8c-1b00-0000-5639-51d65b0c0000 pid=3163 execve guuid=a05b708c-1b00-0000-5639-51d65d0c0000 pid=3165 /tmp/e1b guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=a05b708c-1b00-0000-5639-51d65d0c0000 pid=3165 execve guuid=b0de838d-1b00-0000-5639-51d6620c0000 pid=3170 /usr/bin/rm delete-file guuid=7ceb7ead-1a00-0000-5639-51d6010a0000 pid=2561->guuid=b0de838d-1b00-0000-5639-51d6620c0000 pid=3170 execve 9554d36e-3083-568e-90da-bb8e3c487b07 188.132.232.81:80 guuid=207cc3e9-1a00-0000-5639-51d6150b0000 pid=2837->9554d36e-3083-568e-90da-bb8e3c487b07 send: 132B guuid=faf06f31-1b00-0000-5639-51d6a30b0000 pid=2979->9554d36e-3083-568e-90da-bb8e3c487b07 send: 132B guuid=b4256439-1b00-0000-5639-51d6b60b0000 pid=2998->9554d36e-3083-568e-90da-bb8e3c487b07 send: 133B guuid=3d782841-1b00-0000-5639-51d6cc0b0000 pid=3020->9554d36e-3083-568e-90da-bb8e3c487b07 send: 133B guuid=0f338849-1b00-0000-5639-51d6e90b0000 pid=3049->9554d36e-3083-568e-90da-bb8e3c487b07 send: 132B
Score:
97%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/5e1f87d4b1095c81cf69cdc05621e5b6d19a227943dc6cd26c2896915744f717
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5e1f87d4b1095c81cf69cdc05621e5b6d19a227943dc6cd26c2896915744f717/
Verdict:
Malicious
Threat:
Family.MIRAI
Link:
https://tip.neiki.dev/file/5e1f87d4b1095c81cf69cdc05621e5b6d19a227943dc6cd26c2896915744f717
Threat name:
Win32.Trojan.Vigorf
Create hunting rule
Status:
Malicious
First seen:
2026-06-08 13:54:39 UTC
File Type:
Text (Shell)
AV detection:
10 of 24 (41.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lypypvfrbfoidt3jzxafmipfw3izuitzipogzutmfcljcv2e64lq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
defense_evasion discovery linux
Link:
https://tria.ge/reports/260608-q7tm7aev4n/
Behaviour
Reads runtime system information
Writes file to tmp directory
Enumerates running processes
File and Directory Permissions Modification
Deletes itself
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.06
Link:
https://yomi.yoroi.company/submissions/5e1f87d4b1095c81cf69cdc05621e5b6d19a227943dc6cd26c2896915744f717

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 5e1f87d4b1095c81cf69cdc05621e5b6d19a227943dc6cd26c2896915744f717

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3856423/
  
Delivery method
Distributed via web download

Comments