🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5eb2f5249623d59cc69069ada062b35403d7bada955d978db40f09c2b20b2c52. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5eb2f5249623d59cc69069ada062b35403d7bada955d978db40f09c2b20b2c52
SHA3-384 hash: e3a5b83e76613348e443bf3e6b825da052a8bec53a095d41829347fe7840977cd091ca24466336298bff4c84313d118b
SHA1 hash: 17d33eaa2c360c36c5c1bc112add9454af1c77f2
MD5 hash: 7127f076a99bcd294d50ac4deb707915
humanhash: september-quiet-iowa-quiet
File name:lil
Download: download sample
File size:848 bytes
First seen:2026-07-25 04:07:54 UTC
Last seen:2026-07-25 20:14:29 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 12:dOXOsYxcysE+vhCFN0zvy/RQvZowHka7CT1C7JfCxWivC31qFC1HX:kXCKysE2hi0ziQvZoha72MALreHX
TLSH T1C901AFCE8500A91080D9D92C25D76159F410C3CE158A4F69BF6C6E3EEB49D14F076FD4
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://129.121.114.124/ivon/an/aelf ua-wget
http://129.121.114.124/siZn/an/aelf ua-wget
http://129.121.114.124/hRgUn/an/aelf ua-wget
http://129.121.114.124/qMHln/an/aelf ua-wget
http://129.121.114.124/CbgGn/an/aelf ua-wget

Intelligence

File Origin
# of uploads :
2
# of downloads :
93
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive mirai
Link:
https://www.filescan.io/uploads/6a6436ba4ed97d5a09467527/reports/ee07d781-89aa-4b7f-9836-dd124c6b09a3/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-07-25T02:50:00Z UTC
Last seen:
2026-07-26T18:17:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/5eb2f5249623d59cc69069ada062b35403d7bada955d978db40f09c2b20b2c52/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/8d4e66c1-58e2-414c-887e-52a212557886
Behavior Graph:
Download SVG
%3 guuid=632ca3d1-1600-0000-771b-0fa9880d0000 pid=3464 /usr/bin/sudo guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469 /tmp/sample.bin write-file guuid=632ca3d1-1600-0000-771b-0fa9880d0000 pid=3464->guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469 execve guuid=7662d1d6-1600-0000-771b-0fa98f0d0000 pid=3471 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=7662d1d6-1600-0000-771b-0fa98f0d0000 pid=3471 execve guuid=3708f5d7-1600-0000-771b-0fa9900d0000 pid=3472 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=3708f5d7-1600-0000-771b-0fa9900d0000 pid=3472 execve guuid=8edc95d8-1600-0000-771b-0fa9920d0000 pid=3474 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=8edc95d8-1600-0000-771b-0fa9920d0000 pid=3474 execve guuid=72e339d9-1600-0000-771b-0fa9930d0000 pid=3475 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=72e339d9-1600-0000-771b-0fa9930d0000 pid=3475 execve guuid=6a30d5d9-1600-0000-771b-0fa9950d0000 pid=3477 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=6a30d5d9-1600-0000-771b-0fa9950d0000 pid=3477 execve guuid=236a71da-1600-0000-771b-0fa9960d0000 pid=3478 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=236a71da-1600-0000-771b-0fa9960d0000 pid=3478 execve guuid=469f0bdb-1600-0000-771b-0fa9980d0000 pid=3480 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=469f0bdb-1600-0000-771b-0fa9980d0000 pid=3480 execve guuid=537e9edb-1600-0000-771b-0fa9990d0000 pid=3481 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=537e9edb-1600-0000-771b-0fa9990d0000 pid=3481 execve guuid=6f3f31dc-1600-0000-771b-0fa99a0d0000 pid=3482 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=6f3f31dc-1600-0000-771b-0fa99a0d0000 pid=3482 execve guuid=00eadddc-1600-0000-771b-0fa99c0d0000 pid=3484 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=00eadddc-1600-0000-771b-0fa99c0d0000 pid=3484 execve guuid=012774dd-1600-0000-771b-0fa99f0d0000 pid=3487 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=012774dd-1600-0000-771b-0fa99f0d0000 pid=3487 execve guuid=1a8014de-1600-0000-771b-0fa9a10d0000 pid=3489 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=1a8014de-1600-0000-771b-0fa9a10d0000 pid=3489 execve guuid=a50281de-1600-0000-771b-0fa9a40d0000 pid=3492 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=a50281de-1600-0000-771b-0fa9a40d0000 pid=3492 execve guuid=ea460ddf-1600-0000-771b-0fa9a60d0000 pid=3494 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=ea460ddf-1600-0000-771b-0fa9a60d0000 pid=3494 execve guuid=fef2a1df-1600-0000-771b-0fa9a70d0000 pid=3495 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=fef2a1df-1600-0000-771b-0fa9a70d0000 pid=3495 execve guuid=664e14e0-1600-0000-771b-0fa9a90d0000 pid=3497 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=664e14e0-1600-0000-771b-0fa9a90d0000 pid=3497 execve guuid=b53e7ce0-1600-0000-771b-0fa9ac0d0000 pid=3500 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=b53e7ce0-1600-0000-771b-0fa9ac0d0000 pid=3500 execve guuid=6c86dfe0-1600-0000-771b-0fa9ae0d0000 pid=3502 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=6c86dfe0-1600-0000-771b-0fa9ae0d0000 pid=3502 execve guuid=864c44e1-1600-0000-771b-0fa9b10d0000 pid=3505 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=864c44e1-1600-0000-771b-0fa9b10d0000 pid=3505 execve guuid=78bfa4e1-1600-0000-771b-0fa9b30d0000 pid=3507 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=78bfa4e1-1600-0000-771b-0fa9b30d0000 pid=3507 execve guuid=11d10de2-1600-0000-771b-0fa9b60d0000 pid=3510 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=11d10de2-1600-0000-771b-0fa9b60d0000 pid=3510 execve guuid=fa5570e2-1600-0000-771b-0fa9b80d0000 pid=3512 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=fa5570e2-1600-0000-771b-0fa9b80d0000 pid=3512 execve guuid=163ce5e2-1600-0000-771b-0fa9ba0d0000 pid=3514 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=163ce5e2-1600-0000-771b-0fa9ba0d0000 pid=3514 execve guuid=e88b4ee3-1600-0000-771b-0fa9be0d0000 pid=3518 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=e88b4ee3-1600-0000-771b-0fa9be0d0000 pid=3518 execve guuid=5c63ece3-1600-0000-771b-0fa9c00d0000 pid=3520 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=5c63ece3-1600-0000-771b-0fa9c00d0000 pid=3520 execve guuid=cbeb60e4-1600-0000-771b-0fa9c30d0000 pid=3523 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=cbeb60e4-1600-0000-771b-0fa9c30d0000 pid=3523 execve guuid=4372dde4-1600-0000-771b-0fa9c60d0000 pid=3526 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=4372dde4-1600-0000-771b-0fa9c60d0000 pid=3526 execve guuid=fecd55e5-1600-0000-771b-0fa9c80d0000 pid=3528 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=fecd55e5-1600-0000-771b-0fa9c80d0000 pid=3528 execve guuid=d734bde5-1600-0000-771b-0fa9cc0d0000 pid=3532 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=d734bde5-1600-0000-771b-0fa9cc0d0000 pid=3532 execve guuid=476129e6-1600-0000-771b-0fa9cd0d0000 pid=3533 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=476129e6-1600-0000-771b-0fa9cd0d0000 pid=3533 execve guuid=cd9b8fe6-1600-0000-771b-0fa9d10d0000 pid=3537 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=cd9b8fe6-1600-0000-771b-0fa9d10d0000 pid=3537 execve guuid=69ccfde6-1600-0000-771b-0fa9d30d0000 pid=3539 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=69ccfde6-1600-0000-771b-0fa9d30d0000 pid=3539 execve guuid=20fb6ce7-1600-0000-771b-0fa9d50d0000 pid=3541 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=20fb6ce7-1600-0000-771b-0fa9d50d0000 pid=3541 execve guuid=0165e5e7-1600-0000-771b-0fa9d70d0000 pid=3543 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=0165e5e7-1600-0000-771b-0fa9d70d0000 pid=3543 execve guuid=b5f264e8-1600-0000-771b-0fa9d90d0000 pid=3545 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=b5f264e8-1600-0000-771b-0fa9d90d0000 pid=3545 execve guuid=ceecd9e8-1600-0000-771b-0fa9db0d0000 pid=3547 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=ceecd9e8-1600-0000-771b-0fa9db0d0000 pid=3547 execve guuid=5b8e6be9-1600-0000-771b-0fa9de0d0000 pid=3550 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=5b8e6be9-1600-0000-771b-0fa9de0d0000 pid=3550 execve guuid=74bfd4e9-1600-0000-771b-0fa9e00d0000 pid=3552 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=74bfd4e9-1600-0000-771b-0fa9e00d0000 pid=3552 execve guuid=fe1547ea-1600-0000-771b-0fa9e10d0000 pid=3553 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=fe1547ea-1600-0000-771b-0fa9e10d0000 pid=3553 execve guuid=516c0feb-1600-0000-771b-0fa9e20d0000 pid=3554 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=516c0feb-1600-0000-771b-0fa9e20d0000 pid=3554 execve guuid=79dd9eeb-1600-0000-771b-0fa9e60d0000 pid=3558 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=79dd9eeb-1600-0000-771b-0fa9e60d0000 pid=3558 execve guuid=b97a2fec-1600-0000-771b-0fa9ea0d0000 pid=3562 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=b97a2fec-1600-0000-771b-0fa9ea0d0000 pid=3562 execve guuid=7620c2ec-1600-0000-771b-0fa9ec0d0000 pid=3564 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=7620c2ec-1600-0000-771b-0fa9ec0d0000 pid=3564 execve guuid=349b4fed-1600-0000-771b-0fa9ef0d0000 pid=3567 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=349b4fed-1600-0000-771b-0fa9ef0d0000 pid=3567 execve guuid=06bfdbed-1600-0000-771b-0fa9f10d0000 pid=3569 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=06bfdbed-1600-0000-771b-0fa9f10d0000 pid=3569 execve guuid=387435ee-1600-0000-771b-0fa9f40d0000 pid=3572 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=387435ee-1600-0000-771b-0fa9f40d0000 pid=3572 execve guuid=3aff87ee-1600-0000-771b-0fa9f50d0000 pid=3573 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=3aff87ee-1600-0000-771b-0fa9f50d0000 pid=3573 execve guuid=605ddfee-1600-0000-771b-0fa9f70d0000 pid=3575 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=605ddfee-1600-0000-771b-0fa9f70d0000 pid=3575 execve guuid=680e30ef-1600-0000-771b-0fa9f90d0000 pid=3577 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=680e30ef-1600-0000-771b-0fa9f90d0000 pid=3577 execve guuid=9d5b8def-1600-0000-771b-0fa9fa0d0000 pid=3578 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=9d5b8def-1600-0000-771b-0fa9fa0d0000 pid=3578 execve guuid=8f2036f0-1600-0000-771b-0fa9010e0000 pid=3585 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=8f2036f0-1600-0000-771b-0fa9010e0000 pid=3585 execve guuid=765c9df0-1600-0000-771b-0fa9040e0000 pid=3588 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=765c9df0-1600-0000-771b-0fa9040e0000 pid=3588 execve guuid=d49205f1-1600-0000-771b-0fa9060e0000 pid=3590 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=d49205f1-1600-0000-771b-0fa9060e0000 pid=3590 execve guuid=3c0f7bf1-1600-0000-771b-0fa9090e0000 pid=3593 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=3c0f7bf1-1600-0000-771b-0fa9090e0000 pid=3593 execve guuid=85d1f5f1-1600-0000-771b-0fa90b0e0000 pid=3595 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=85d1f5f1-1600-0000-771b-0fa90b0e0000 pid=3595 execve guuid=76214af3-1600-0000-771b-0fa90c0e0000 pid=3596 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=76214af3-1600-0000-771b-0fa90c0e0000 pid=3596 execve guuid=0c001af5-1600-0000-771b-0fa90d0e0000 pid=3597 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=0c001af5-1600-0000-771b-0fa90d0e0000 pid=3597 execve guuid=68b1d8f5-1600-0000-771b-0fa90e0e0000 pid=3598 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=68b1d8f5-1600-0000-771b-0fa90e0e0000 pid=3598 execve guuid=a99292f6-1600-0000-771b-0fa90f0e0000 pid=3599 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=a99292f6-1600-0000-771b-0fa90f0e0000 pid=3599 execve guuid=765c34f7-1600-0000-771b-0fa9100e0000 pid=3600 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=765c34f7-1600-0000-771b-0fa9100e0000 pid=3600 execve guuid=78a9c5f7-1600-0000-771b-0fa9110e0000 pid=3601 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=78a9c5f7-1600-0000-771b-0fa9110e0000 pid=3601 execve guuid=bc768cf8-1600-0000-771b-0fa9120e0000 pid=3602 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=bc768cf8-1600-0000-771b-0fa9120e0000 pid=3602 execve guuid=d8060bf9-1600-0000-771b-0fa9130e0000 pid=3603 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=d8060bf9-1600-0000-771b-0fa9130e0000 pid=3603 execve guuid=23989ef9-1600-0000-771b-0fa9140e0000 pid=3604 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=23989ef9-1600-0000-771b-0fa9140e0000 pid=3604 execve guuid=f54f27fa-1600-0000-771b-0fa9180e0000 pid=3608 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=f54f27fa-1600-0000-771b-0fa9180e0000 pid=3608 execve guuid=447ca9fa-1600-0000-771b-0fa91c0e0000 pid=3612 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=447ca9fa-1600-0000-771b-0fa91c0e0000 pid=3612 execve guuid=4fd634fb-1600-0000-771b-0fa91d0e0000 pid=3613 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=4fd634fb-1600-0000-771b-0fa91d0e0000 pid=3613 execve guuid=7253edfb-1600-0000-771b-0fa9210e0000 pid=3617 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=7253edfb-1600-0000-771b-0fa9210e0000 pid=3617 execve guuid=87a0d9fc-1600-0000-771b-0fa9250e0000 pid=3621 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=87a0d9fc-1600-0000-771b-0fa9250e0000 pid=3621 execve guuid=a975edfd-1600-0000-771b-0fa9260e0000 pid=3622 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=a975edfd-1600-0000-771b-0fa9260e0000 pid=3622 execve guuid=8292adfe-1600-0000-771b-0fa9270e0000 pid=3623 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=8292adfe-1600-0000-771b-0fa9270e0000 pid=3623 execve guuid=c30c4dff-1600-0000-771b-0fa9280e0000 pid=3624 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=c30c4dff-1600-0000-771b-0fa9280e0000 pid=3624 execve guuid=de84e2ff-1600-0000-771b-0fa9290e0000 pid=3625 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=de84e2ff-1600-0000-771b-0fa9290e0000 pid=3625 execve guuid=3be37800-1700-0000-771b-0fa92a0e0000 pid=3626 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=3be37800-1700-0000-771b-0fa92a0e0000 pid=3626 execve guuid=89d50b01-1700-0000-771b-0fa92b0e0000 pid=3627 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=89d50b01-1700-0000-771b-0fa92b0e0000 pid=3627 execve guuid=da56b501-1700-0000-771b-0fa92f0e0000 pid=3631 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=da56b501-1700-0000-771b-0fa92f0e0000 pid=3631 execve guuid=398abd02-1700-0000-771b-0fa9330e0000 pid=3635 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=398abd02-1700-0000-771b-0fa9330e0000 pid=3635 execve guuid=06b53503-1700-0000-771b-0fa9360e0000 pid=3638 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=06b53503-1700-0000-771b-0fa9360e0000 pid=3638 execve guuid=cd8f8f03-1700-0000-771b-0fa9380e0000 pid=3640 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=cd8f8f03-1700-0000-771b-0fa9380e0000 pid=3640 execve guuid=182bfb03-1700-0000-771b-0fa93a0e0000 pid=3642 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=182bfb03-1700-0000-771b-0fa93a0e0000 pid=3642 execve guuid=85be7c04-1700-0000-771b-0fa93b0e0000 pid=3643 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=85be7c04-1700-0000-771b-0fa93b0e0000 pid=3643 execve guuid=a2e90205-1700-0000-771b-0fa93c0e0000 pid=3644 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=a2e90205-1700-0000-771b-0fa93c0e0000 pid=3644 execve guuid=46807a05-1700-0000-771b-0fa93d0e0000 pid=3645 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=46807a05-1700-0000-771b-0fa93d0e0000 pid=3645 execve guuid=037e5006-1700-0000-771b-0fa9400e0000 pid=3648 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=037e5006-1700-0000-771b-0fa9400e0000 pid=3648 execve guuid=8527db06-1700-0000-771b-0fa9420e0000 pid=3650 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=8527db06-1700-0000-771b-0fa9420e0000 pid=3650 execve guuid=0e976808-1700-0000-771b-0fa9460e0000 pid=3654 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=0e976808-1700-0000-771b-0fa9460e0000 pid=3654 execve guuid=360eeb08-1700-0000-771b-0fa9480e0000 pid=3656 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=360eeb08-1700-0000-771b-0fa9480e0000 pid=3656 execve guuid=04df9e09-1700-0000-771b-0fa94c0e0000 pid=3660 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=04df9e09-1700-0000-771b-0fa94c0e0000 pid=3660 execve guuid=163b2a0a-1700-0000-771b-0fa9500e0000 pid=3664 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=163b2a0a-1700-0000-771b-0fa9500e0000 pid=3664 execve guuid=3267c80a-1700-0000-771b-0fa9510e0000 pid=3665 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=3267c80a-1700-0000-771b-0fa9510e0000 pid=3665 execve guuid=842e820b-1700-0000-771b-0fa9540e0000 pid=3668 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=842e820b-1700-0000-771b-0fa9540e0000 pid=3668 execve guuid=b3c6240c-1700-0000-771b-0fa9560e0000 pid=3670 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=b3c6240c-1700-0000-771b-0fa9560e0000 pid=3670 execve guuid=7edfb40c-1700-0000-771b-0fa95a0e0000 pid=3674 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=7edfb40c-1700-0000-771b-0fa95a0e0000 pid=3674 execve guuid=d0ed970d-1700-0000-771b-0fa95e0e0000 pid=3678 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=d0ed970d-1700-0000-771b-0fa95e0e0000 pid=3678 execve guuid=7f05270e-1700-0000-771b-0fa9620e0000 pid=3682 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=7f05270e-1700-0000-771b-0fa9620e0000 pid=3682 execve guuid=5fcbc20e-1700-0000-771b-0fa9650e0000 pid=3685 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=5fcbc20e-1700-0000-771b-0fa9650e0000 pid=3685 execve guuid=628d4b0f-1700-0000-771b-0fa9690e0000 pid=3689 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=628d4b0f-1700-0000-771b-0fa9690e0000 pid=3689 execve guuid=2dfccb0f-1700-0000-771b-0fa96d0e0000 pid=3693 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=2dfccb0f-1700-0000-771b-0fa96d0e0000 pid=3693 execve guuid=ae0d4b10-1700-0000-771b-0fa96e0e0000 pid=3694 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=ae0d4b10-1700-0000-771b-0fa96e0e0000 pid=3694 execve guuid=ec60cc10-1700-0000-771b-0fa96f0e0000 pid=3695 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=ec60cc10-1700-0000-771b-0fa96f0e0000 pid=3695 execve guuid=fc734b11-1700-0000-771b-0fa9700e0000 pid=3696 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=fc734b11-1700-0000-771b-0fa9700e0000 pid=3696 execve guuid=3b54d311-1700-0000-771b-0fa9710e0000 pid=3697 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=3b54d311-1700-0000-771b-0fa9710e0000 pid=3697 execve guuid=83ba5a12-1700-0000-771b-0fa9720e0000 pid=3698 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=83ba5a12-1700-0000-771b-0fa9720e0000 pid=3698 execve guuid=b113da12-1700-0000-771b-0fa9730e0000 pid=3699 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=b113da12-1700-0000-771b-0fa9730e0000 pid=3699 execve guuid=faf66413-1700-0000-771b-0fa9740e0000 pid=3700 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=faf66413-1700-0000-771b-0fa9740e0000 pid=3700 execve guuid=2e9bef13-1700-0000-771b-0fa9750e0000 pid=3701 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=2e9bef13-1700-0000-771b-0fa9750e0000 pid=3701 execve guuid=06f77214-1700-0000-771b-0fa9760e0000 pid=3702 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=06f77214-1700-0000-771b-0fa9760e0000 pid=3702 execve guuid=72a3fb14-1700-0000-771b-0fa9770e0000 pid=3703 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=72a3fb14-1700-0000-771b-0fa9770e0000 pid=3703 execve guuid=86278615-1700-0000-771b-0fa9780e0000 pid=3704 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=86278615-1700-0000-771b-0fa9780e0000 pid=3704 execve guuid=e9542016-1700-0000-771b-0fa9790e0000 pid=3705 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=e9542016-1700-0000-771b-0fa9790e0000 pid=3705 execve guuid=fb82ac16-1700-0000-771b-0fa97a0e0000 pid=3706 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=fb82ac16-1700-0000-771b-0fa97a0e0000 pid=3706 execve guuid=fd723b17-1700-0000-771b-0fa97c0e0000 pid=3708 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=fd723b17-1700-0000-771b-0fa97c0e0000 pid=3708 execve guuid=94344618-1700-0000-771b-0fa9810e0000 pid=3713 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=94344618-1700-0000-771b-0fa9810e0000 pid=3713 execve guuid=7783ed19-1700-0000-771b-0fa9850e0000 pid=3717 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=7783ed19-1700-0000-771b-0fa9850e0000 pid=3717 execve guuid=76269d1a-1700-0000-771b-0fa9870e0000 pid=3719 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=76269d1a-1700-0000-771b-0fa9870e0000 pid=3719 execve guuid=15ec4c1b-1700-0000-771b-0fa98c0e0000 pid=3724 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=15ec4c1b-1700-0000-771b-0fa98c0e0000 pid=3724 execve guuid=28f1191c-1700-0000-771b-0fa9900e0000 pid=3728 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=28f1191c-1700-0000-771b-0fa9900e0000 pid=3728 execve guuid=8f97d31c-1700-0000-771b-0fa9930e0000 pid=3731 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=8f97d31c-1700-0000-771b-0fa9930e0000 pid=3731 execve guuid=da30ae1d-1700-0000-771b-0fa99a0e0000 pid=3738 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=da30ae1d-1700-0000-771b-0fa99a0e0000 pid=3738 execve guuid=8b06321e-1700-0000-771b-0fa99c0e0000 pid=3740 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=8b06321e-1700-0000-771b-0fa99c0e0000 pid=3740 execve guuid=77d8051f-1700-0000-771b-0fa99f0e0000 pid=3743 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=77d8051f-1700-0000-771b-0fa99f0e0000 pid=3743 execve guuid=779af220-1700-0000-771b-0fa9a50e0000 pid=3749 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=779af220-1700-0000-771b-0fa9a50e0000 pid=3749 execve guuid=4bd64022-1700-0000-771b-0fa9a90e0000 pid=3753 /usr/bin/ls guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=4bd64022-1700-0000-771b-0fa9a90e0000 pid=3753 execve guuid=876d0723-1700-0000-771b-0fa9ac0e0000 pid=3756 /usr/bin/rm guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=876d0723-1700-0000-771b-0fa9ac0e0000 pid=3756 execve guuid=cddd5d23-1700-0000-771b-0fa9ae0e0000 pid=3758 /usr/bin/wget net send-data write-file guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=cddd5d23-1700-0000-771b-0fa9ae0e0000 pid=3758 execve guuid=c0fee83b-1700-0000-771b-0fa9240f0000 pid=3876 /usr/bin/chmod guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=c0fee83b-1700-0000-771b-0fa9240f0000 pid=3876 execve guuid=ae6b223c-1700-0000-771b-0fa9280f0000 pid=3880 /usr/bin/dash guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=ae6b223c-1700-0000-771b-0fa9280f0000 pid=3880 clone guuid=6b75ad3c-1700-0000-771b-0fa92d0f0000 pid=3885 /usr/bin/rm guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=6b75ad3c-1700-0000-771b-0fa92d0f0000 pid=3885 execve guuid=8444e53c-1700-0000-771b-0fa92e0f0000 pid=3886 /usr/bin/wget net send-data write-file guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=8444e53c-1700-0000-771b-0fa92e0f0000 pid=3886 execve guuid=fc7c9a54-1700-0000-771b-0fa9900f0000 pid=3984 /usr/bin/chmod guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=fc7c9a54-1700-0000-771b-0fa9900f0000 pid=3984 execve guuid=b4c6d454-1700-0000-771b-0fa9920f0000 pid=3986 /usr/bin/dash guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=b4c6d454-1700-0000-771b-0fa9920f0000 pid=3986 clone guuid=9bf44955-1700-0000-771b-0fa9960f0000 pid=3990 /usr/bin/rm guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=9bf44955-1700-0000-771b-0fa9960f0000 pid=3990 execve guuid=ab868355-1700-0000-771b-0fa9980f0000 pid=3992 /usr/bin/wget net send-data write-file guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=ab868355-1700-0000-771b-0fa9980f0000 pid=3992 execve guuid=b5633a6d-1700-0000-771b-0fa9f60f0000 pid=4086 /usr/bin/chmod guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=b5633a6d-1700-0000-771b-0fa9f60f0000 pid=4086 execve guuid=fb19756d-1700-0000-771b-0fa9f80f0000 pid=4088 /usr/bin/dash guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=fb19756d-1700-0000-771b-0fa9f80f0000 pid=4088 clone guuid=5fb8096f-1700-0000-771b-0fa900100000 pid=4096 /usr/bin/rm guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=5fb8096f-1700-0000-771b-0fa900100000 pid=4096 execve guuid=7b46476f-1700-0000-771b-0fa901100000 pid=4097 /usr/bin/wget net send-data write-file guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=7b46476f-1700-0000-771b-0fa901100000 pid=4097 execve guuid=7abc468c-1700-0000-771b-0fa974100000 pid=4212 /usr/bin/chmod guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=7abc468c-1700-0000-771b-0fa974100000 pid=4212 execve guuid=b4d8848c-1700-0000-771b-0fa978100000 pid=4216 /usr/bin/dash guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=b4d8848c-1700-0000-771b-0fa978100000 pid=4216 clone guuid=c4c3068d-1700-0000-771b-0fa97d100000 pid=4221 /usr/bin/rm guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=c4c3068d-1700-0000-771b-0fa97d100000 pid=4221 execve guuid=eaf8548d-1700-0000-771b-0fa97f100000 pid=4223 /usr/bin/wget net send-data write-file guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=eaf8548d-1700-0000-771b-0fa97f100000 pid=4223 execve guuid=2f335faa-1700-0000-771b-0fa9f5100000 pid=4341 /usr/bin/chmod guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=2f335faa-1700-0000-771b-0fa9f5100000 pid=4341 execve guuid=87b8b0aa-1700-0000-771b-0fa9f7100000 pid=4343 /usr/bin/dash guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=87b8b0aa-1700-0000-771b-0fa9f7100000 pid=4343 clone guuid=cebf62ab-1700-0000-771b-0fa9fb100000 pid=4347 /usr/bin/rm delete-file guuid=987310d6-1600-0000-771b-0fa98d0d0000 pid=3469->guuid=cebf62ab-1700-0000-771b-0fa9fb100000 pid=4347 execve 801186e6-5fe8-5959-a7b4-832d8d66e7aa 129.121.114.124:80 guuid=cddd5d23-1700-0000-771b-0fa9ae0e0000 pid=3758->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 133B guuid=8444e53c-1700-0000-771b-0fa92e0f0000 pid=3886->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 133B guuid=ab868355-1700-0000-771b-0fa9980f0000 pid=3992->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 134B guuid=7b46476f-1700-0000-771b-0fa901100000 pid=4097->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 134B guuid=eaf8548d-1700-0000-771b-0fa97f100000 pid=4223->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 134B
Score:
93%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/5eb2f5249623d59cc69069ada062b35403d7bada955d978db40f09c2b20b2c52
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5eb2f5249623d59cc69069ada062b35403d7bada955d978db40f09c2b20b2c52/
Threat name:
Document-HTML.Trojan.Bash
Create hunting rule
Status:
Malicious
First seen:
2026-07-25 04:08:34 UTC
File Type:
Text (Shell)
AV detection:
11 of 24 (45.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=l2zpkjewepkzzruqngw2ayvtkqb5pow2svozpdnub4e4fmqlfrja._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
discovery linux
Link:
https://tria.ge/reports/260725-eqfjfscl41/
Behaviour
Reads runtime system information
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.26
Link:
https://yomi.yoroi.company/submissions/5eb2f5249623d59cc69069ada062b35403d7bada955d978db40f09c2b20b2c52

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 5eb2f5249623d59cc69069ada062b35403d7bada955d978db40f09c2b20b2c52

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3874630/
  
Delivery method
Distributed via web download

Comments