MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 623c3907d597ae6161a1c33c826ef3fe4eb6849de852e261ce755cdd2d9d33f7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 623c3907d597ae6161a1c33c826ef3fe4eb6849de852e261ce755cdd2d9d33f7
SHA3-384 hash: 3a64b22aa4804ac52bdb2fc389577ead38d32b31c69471380fb20f18fa3cc8dc0579328a0b813b2bb485b1ba406d4173
SHA1 hash: a63122aedaa82c740f14edb1f2f2baf434479c62
MD5 hash: b08fc102614559bbde50eb7bf4a137ba
humanhash: victor-thirteen-table-foxtrot
File name:lil
Download: download sample
File size:847 bytes
First seen:2026-06-09 02:20:26 UTC
Last seen:2026-06-09 09:21:45 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 12:dOXOsYxcysE+vhCFN0zvy/RQvZowHka5IjFaFMvTXIGp7U9I9nIFIuJuMFI2I4X:kXCKysE2hi0ziQvZoha5fFe7kk49RI4X
TLSH T1A70188CFC0158A6014C6E49D32E77148F821C3CB25998FB8BF6C243E8FA8A187095F84
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://188.132.232.81/WgLn/an/aelf ua-wget
http://188.132.232.81/xkxMn/an/aelf ua-wget
http://188.132.232.81/AA4zn/an/aelf ua-wget
http://188.132.232.81/DzrGn/an/aelf ua-wget
http://188.132.232.81/a9Kwn/an/aelf ua-wget

Intelligence

File Origin
# of uploads :
2
# of downloads :
37
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive
Link:
https://www.filescan.io/uploads/6a277874554e843ff86595db/reports/17fe1a96-63e2-43e8-a47e-427f669cb5c8/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-06-08T23:27:00Z UTC
Last seen:
2026-06-11T00:22:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan-Downloader.Shell.Agent.a
Link:
https://opentip.kaspersky.com/623c3907d597ae6161a1c33c826ef3fe4eb6849de852e261ce755cdd2d9d33f7/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/f0238b2a-a852-4e52-9bca-2eec9b359416
Behavior Graph:
Download SVG
%3 guuid=b08e8aac-1a00-0000-0cf7-5af5890c0000 pid=3209 /usr/bin/sudo guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215 /tmp/sample.bin write-file guuid=b08e8aac-1a00-0000-0cf7-5af5890c0000 pid=3209->guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215 execve guuid=15a489af-1a00-0000-0cf7-5af5900c0000 pid=3216 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=15a489af-1a00-0000-0cf7-5af5900c0000 pid=3216 execve guuid=5fe4deb0-1a00-0000-0cf7-5af5920c0000 pid=3218 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=5fe4deb0-1a00-0000-0cf7-5af5920c0000 pid=3218 execve guuid=b89388b1-1a00-0000-0cf7-5af5930c0000 pid=3219 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=b89388b1-1a00-0000-0cf7-5af5930c0000 pid=3219 execve guuid=534d41b2-1a00-0000-0cf7-5af5950c0000 pid=3221 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=534d41b2-1a00-0000-0cf7-5af5950c0000 pid=3221 execve guuid=9068e1b2-1a00-0000-0cf7-5af5960c0000 pid=3222 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=9068e1b2-1a00-0000-0cf7-5af5960c0000 pid=3222 execve guuid=71be6db3-1a00-0000-0cf7-5af5970c0000 pid=3223 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=71be6db3-1a00-0000-0cf7-5af5970c0000 pid=3223 execve guuid=1bc7e4b3-1a00-0000-0cf7-5af59a0c0000 pid=3226 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=1bc7e4b3-1a00-0000-0cf7-5af59a0c0000 pid=3226 execve guuid=90094ab4-1a00-0000-0cf7-5af59c0c0000 pid=3228 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=90094ab4-1a00-0000-0cf7-5af59c0c0000 pid=3228 execve guuid=01c3b2b4-1a00-0000-0cf7-5af59e0c0000 pid=3230 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=01c3b2b4-1a00-0000-0cf7-5af59e0c0000 pid=3230 execve guuid=a20731b5-1a00-0000-0cf7-5af5a00c0000 pid=3232 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=a20731b5-1a00-0000-0cf7-5af5a00c0000 pid=3232 execve guuid=098a9fb5-1a00-0000-0cf7-5af5a10c0000 pid=3233 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=098a9fb5-1a00-0000-0cf7-5af5a10c0000 pid=3233 execve guuid=2c1d80b6-1a00-0000-0cf7-5af5a50c0000 pid=3237 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=2c1d80b6-1a00-0000-0cf7-5af5a50c0000 pid=3237 execve guuid=122f39b7-1a00-0000-0cf7-5af5a80c0000 pid=3240 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=122f39b7-1a00-0000-0cf7-5af5a80c0000 pid=3240 execve guuid=e2dc4db8-1a00-0000-0cf7-5af5a90c0000 pid=3241 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=e2dc4db8-1a00-0000-0cf7-5af5a90c0000 pid=3241 execve guuid=285e08b9-1a00-0000-0cf7-5af5aa0c0000 pid=3242 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=285e08b9-1a00-0000-0cf7-5af5aa0c0000 pid=3242 execve guuid=bbf303ba-1a00-0000-0cf7-5af5ab0c0000 pid=3243 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=bbf303ba-1a00-0000-0cf7-5af5ab0c0000 pid=3243 execve guuid=12e708bb-1a00-0000-0cf7-5af5ac0c0000 pid=3244 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=12e708bb-1a00-0000-0cf7-5af5ac0c0000 pid=3244 execve guuid=941b26bc-1a00-0000-0cf7-5af5ad0c0000 pid=3245 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=941b26bc-1a00-0000-0cf7-5af5ad0c0000 pid=3245 execve guuid=aac812bd-1a00-0000-0cf7-5af5ae0c0000 pid=3246 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=aac812bd-1a00-0000-0cf7-5af5ae0c0000 pid=3246 execve guuid=ea30f1bd-1a00-0000-0cf7-5af5af0c0000 pid=3247 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=ea30f1bd-1a00-0000-0cf7-5af5af0c0000 pid=3247 execve guuid=6ad87abe-1a00-0000-0cf7-5af5b00c0000 pid=3248 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=6ad87abe-1a00-0000-0cf7-5af5b00c0000 pid=3248 execve guuid=aabc12bf-1a00-0000-0cf7-5af5b10c0000 pid=3249 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=aabc12bf-1a00-0000-0cf7-5af5b10c0000 pid=3249 execve guuid=db96a8bf-1a00-0000-0cf7-5af5b20c0000 pid=3250 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=db96a8bf-1a00-0000-0cf7-5af5b20c0000 pid=3250 execve guuid=b92638c0-1a00-0000-0cf7-5af5b30c0000 pid=3251 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=b92638c0-1a00-0000-0cf7-5af5b30c0000 pid=3251 execve guuid=98cee0c0-1a00-0000-0cf7-5af5b40c0000 pid=3252 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=98cee0c0-1a00-0000-0cf7-5af5b40c0000 pid=3252 execve guuid=e3fb7dc1-1a00-0000-0cf7-5af5b50c0000 pid=3253 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=e3fb7dc1-1a00-0000-0cf7-5af5b50c0000 pid=3253 execve guuid=a95d23c2-1a00-0000-0cf7-5af5b60c0000 pid=3254 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=a95d23c2-1a00-0000-0cf7-5af5b60c0000 pid=3254 execve guuid=dec1b0c2-1a00-0000-0cf7-5af5b70c0000 pid=3255 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=dec1b0c2-1a00-0000-0cf7-5af5b70c0000 pid=3255 execve guuid=bfd4bfc3-1a00-0000-0cf7-5af5b80c0000 pid=3256 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=bfd4bfc3-1a00-0000-0cf7-5af5b80c0000 pid=3256 execve guuid=177893c4-1a00-0000-0cf7-5af5b90c0000 pid=3257 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=177893c4-1a00-0000-0cf7-5af5b90c0000 pid=3257 execve guuid=b89e8ac5-1a00-0000-0cf7-5af5ba0c0000 pid=3258 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=b89e8ac5-1a00-0000-0cf7-5af5ba0c0000 pid=3258 execve guuid=e559a0c6-1a00-0000-0cf7-5af5bb0c0000 pid=3259 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=e559a0c6-1a00-0000-0cf7-5af5bb0c0000 pid=3259 execve guuid=968583c7-1a00-0000-0cf7-5af5bc0c0000 pid=3260 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=968583c7-1a00-0000-0cf7-5af5bc0c0000 pid=3260 execve guuid=90be15c8-1a00-0000-0cf7-5af5bd0c0000 pid=3261 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=90be15c8-1a00-0000-0cf7-5af5bd0c0000 pid=3261 execve guuid=57e2a0c8-1a00-0000-0cf7-5af5be0c0000 pid=3262 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=57e2a0c8-1a00-0000-0cf7-5af5be0c0000 pid=3262 execve guuid=928539c9-1a00-0000-0cf7-5af5bf0c0000 pid=3263 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=928539c9-1a00-0000-0cf7-5af5bf0c0000 pid=3263 execve guuid=3ec9d6c9-1a00-0000-0cf7-5af5c00c0000 pid=3264 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=3ec9d6c9-1a00-0000-0cf7-5af5c00c0000 pid=3264 execve guuid=180f61ca-1a00-0000-0cf7-5af5c10c0000 pid=3265 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=180f61ca-1a00-0000-0cf7-5af5c10c0000 pid=3265 execve guuid=d29154cb-1a00-0000-0cf7-5af5c20c0000 pid=3266 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=d29154cb-1a00-0000-0cf7-5af5c20c0000 pid=3266 execve guuid=ff4ae2cb-1a00-0000-0cf7-5af5c30c0000 pid=3267 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=ff4ae2cb-1a00-0000-0cf7-5af5c30c0000 pid=3267 execve guuid=13e8a6cc-1a00-0000-0cf7-5af5c40c0000 pid=3268 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=13e8a6cc-1a00-0000-0cf7-5af5c40c0000 pid=3268 execve guuid=56704fcd-1a00-0000-0cf7-5af5c50c0000 pid=3269 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=56704fcd-1a00-0000-0cf7-5af5c50c0000 pid=3269 execve guuid=ad6ff8cd-1a00-0000-0cf7-5af5c70c0000 pid=3271 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=ad6ff8cd-1a00-0000-0cf7-5af5c70c0000 pid=3271 execve guuid=246795ce-1a00-0000-0cf7-5af5c80c0000 pid=3272 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=246795ce-1a00-0000-0cf7-5af5c80c0000 pid=3272 execve guuid=ce6173cf-1a00-0000-0cf7-5af5c90c0000 pid=3273 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=ce6173cf-1a00-0000-0cf7-5af5c90c0000 pid=3273 execve guuid=e8c623d0-1a00-0000-0cf7-5af5cc0c0000 pid=3276 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=e8c623d0-1a00-0000-0cf7-5af5cc0c0000 pid=3276 execve guuid=4b351dd1-1a00-0000-0cf7-5af5cf0c0000 pid=3279 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=4b351dd1-1a00-0000-0cf7-5af5cf0c0000 pid=3279 execve guuid=68d6b7d1-1a00-0000-0cf7-5af5d20c0000 pid=3282 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=68d6b7d1-1a00-0000-0cf7-5af5d20c0000 pid=3282 execve guuid=c5bf22d2-1a00-0000-0cf7-5af5d40c0000 pid=3284 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=c5bf22d2-1a00-0000-0cf7-5af5d40c0000 pid=3284 execve guuid=d4a116d3-1a00-0000-0cf7-5af5d50c0000 pid=3285 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=d4a116d3-1a00-0000-0cf7-5af5d50c0000 pid=3285 execve guuid=27d1f5d3-1a00-0000-0cf7-5af5d70c0000 pid=3287 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=27d1f5d3-1a00-0000-0cf7-5af5d70c0000 pid=3287 execve guuid=162567d4-1a00-0000-0cf7-5af5d90c0000 pid=3289 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=162567d4-1a00-0000-0cf7-5af5d90c0000 pid=3289 execve guuid=fdb541d5-1a00-0000-0cf7-5af5db0c0000 pid=3291 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=fdb541d5-1a00-0000-0cf7-5af5db0c0000 pid=3291 execve guuid=b069b3d5-1a00-0000-0cf7-5af5dd0c0000 pid=3293 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=b069b3d5-1a00-0000-0cf7-5af5dd0c0000 pid=3293 execve guuid=38c42fd6-1a00-0000-0cf7-5af5df0c0000 pid=3295 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=38c42fd6-1a00-0000-0cf7-5af5df0c0000 pid=3295 execve guuid=7aa931d7-1a00-0000-0cf7-5af5e10c0000 pid=3297 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=7aa931d7-1a00-0000-0cf7-5af5e10c0000 pid=3297 execve guuid=8c04c7d7-1a00-0000-0cf7-5af5e30c0000 pid=3299 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=8c04c7d7-1a00-0000-0cf7-5af5e30c0000 pid=3299 execve guuid=12634fd8-1a00-0000-0cf7-5af5e50c0000 pid=3301 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=12634fd8-1a00-0000-0cf7-5af5e50c0000 pid=3301 execve guuid=4ad1f7d8-1a00-0000-0cf7-5af5e70c0000 pid=3303 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=4ad1f7d8-1a00-0000-0cf7-5af5e70c0000 pid=3303 execve guuid=f4dfbdd9-1a00-0000-0cf7-5af5eb0c0000 pid=3307 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=f4dfbdd9-1a00-0000-0cf7-5af5eb0c0000 pid=3307 execve guuid=38ef64da-1a00-0000-0cf7-5af5ed0c0000 pid=3309 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=38ef64da-1a00-0000-0cf7-5af5ed0c0000 pid=3309 execve guuid=38d837db-1a00-0000-0cf7-5af5ee0c0000 pid=3310 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=38d837db-1a00-0000-0cf7-5af5ee0c0000 pid=3310 execve guuid=7d1638dc-1a00-0000-0cf7-5af5ef0c0000 pid=3311 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=7d1638dc-1a00-0000-0cf7-5af5ef0c0000 pid=3311 execve guuid=4a482fdd-1a00-0000-0cf7-5af5f00c0000 pid=3312 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=4a482fdd-1a00-0000-0cf7-5af5f00c0000 pid=3312 execve guuid=735232de-1a00-0000-0cf7-5af5f10c0000 pid=3313 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=735232de-1a00-0000-0cf7-5af5f10c0000 pid=3313 execve guuid=fb413bdf-1a00-0000-0cf7-5af5f20c0000 pid=3314 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=fb413bdf-1a00-0000-0cf7-5af5f20c0000 pid=3314 execve guuid=cc4b54e0-1a00-0000-0cf7-5af5f30c0000 pid=3315 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=cc4b54e0-1a00-0000-0cf7-5af5f30c0000 pid=3315 execve guuid=153cefe0-1a00-0000-0cf7-5af5f40c0000 pid=3316 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=153cefe0-1a00-0000-0cf7-5af5f40c0000 pid=3316 execve guuid=4a2aa6e1-1a00-0000-0cf7-5af5f60c0000 pid=3318 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=4a2aa6e1-1a00-0000-0cf7-5af5f60c0000 pid=3318 execve guuid=eda0a7e2-1a00-0000-0cf7-5af5f70c0000 pid=3319 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=eda0a7e2-1a00-0000-0cf7-5af5f70c0000 pid=3319 execve guuid=1af779e3-1a00-0000-0cf7-5af5f80c0000 pid=3320 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=1af779e3-1a00-0000-0cf7-5af5f80c0000 pid=3320 execve guuid=b42bdce3-1a00-0000-0cf7-5af5fa0c0000 pid=3322 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=b42bdce3-1a00-0000-0cf7-5af5fa0c0000 pid=3322 execve guuid=a5073ee4-1a00-0000-0cf7-5af5fc0c0000 pid=3324 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=a5073ee4-1a00-0000-0cf7-5af5fc0c0000 pid=3324 execve guuid=b99aa8e4-1a00-0000-0cf7-5af5fe0c0000 pid=3326 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=b99aa8e4-1a00-0000-0cf7-5af5fe0c0000 pid=3326 execve guuid=da7820e5-1a00-0000-0cf7-5af5000d0000 pid=3328 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=da7820e5-1a00-0000-0cf7-5af5000d0000 pid=3328 execve guuid=84f495e5-1a00-0000-0cf7-5af5020d0000 pid=3330 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=84f495e5-1a00-0000-0cf7-5af5020d0000 pid=3330 execve guuid=ca330de6-1a00-0000-0cf7-5af5040d0000 pid=3332 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=ca330de6-1a00-0000-0cf7-5af5040d0000 pid=3332 execve guuid=cb127fe6-1a00-0000-0cf7-5af5060d0000 pid=3334 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=cb127fe6-1a00-0000-0cf7-5af5060d0000 pid=3334 execve guuid=426beee6-1a00-0000-0cf7-5af5080d0000 pid=3336 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=426beee6-1a00-0000-0cf7-5af5080d0000 pid=3336 execve guuid=38fe6ae7-1a00-0000-0cf7-5af50a0d0000 pid=3338 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=38fe6ae7-1a00-0000-0cf7-5af50a0d0000 pid=3338 execve guuid=284412e8-1a00-0000-0cf7-5af50d0d0000 pid=3341 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=284412e8-1a00-0000-0cf7-5af50d0d0000 pid=3341 execve guuid=421396e8-1a00-0000-0cf7-5af50f0d0000 pid=3343 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=421396e8-1a00-0000-0cf7-5af50f0d0000 pid=3343 execve guuid=936647e9-1a00-0000-0cf7-5af5110d0000 pid=3345 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=936647e9-1a00-0000-0cf7-5af5110d0000 pid=3345 execve guuid=c45a30ea-1a00-0000-0cf7-5af5120d0000 pid=3346 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=c45a30ea-1a00-0000-0cf7-5af5120d0000 pid=3346 execve guuid=2a8124eb-1a00-0000-0cf7-5af5130d0000 pid=3347 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=2a8124eb-1a00-0000-0cf7-5af5130d0000 pid=3347 execve guuid=ff6ba2eb-1a00-0000-0cf7-5af5150d0000 pid=3349 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=ff6ba2eb-1a00-0000-0cf7-5af5150d0000 pid=3349 execve guuid=639d1fec-1a00-0000-0cf7-5af5160d0000 pid=3350 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=639d1fec-1a00-0000-0cf7-5af5160d0000 pid=3350 execve guuid=82859eec-1a00-0000-0cf7-5af5170d0000 pid=3351 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=82859eec-1a00-0000-0cf7-5af5170d0000 pid=3351 execve guuid=503e3eed-1a00-0000-0cf7-5af5180d0000 pid=3352 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=503e3eed-1a00-0000-0cf7-5af5180d0000 pid=3352 execve guuid=d2afcbed-1a00-0000-0cf7-5af5190d0000 pid=3353 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=d2afcbed-1a00-0000-0cf7-5af5190d0000 pid=3353 execve guuid=9b7450ee-1a00-0000-0cf7-5af51b0d0000 pid=3355 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=9b7450ee-1a00-0000-0cf7-5af51b0d0000 pid=3355 execve guuid=13e1beee-1a00-0000-0cf7-5af51d0d0000 pid=3357 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=13e1beee-1a00-0000-0cf7-5af51d0d0000 pid=3357 execve guuid=31a533ef-1a00-0000-0cf7-5af51f0d0000 pid=3359 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=31a533ef-1a00-0000-0cf7-5af51f0d0000 pid=3359 execve guuid=50f5acef-1a00-0000-0cf7-5af5210d0000 pid=3361 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=50f5acef-1a00-0000-0cf7-5af5210d0000 pid=3361 execve guuid=e1d518f0-1a00-0000-0cf7-5af5230d0000 pid=3363 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=e1d518f0-1a00-0000-0cf7-5af5230d0000 pid=3363 execve guuid=51f294f0-1a00-0000-0cf7-5af5250d0000 pid=3365 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=51f294f0-1a00-0000-0cf7-5af5250d0000 pid=3365 execve guuid=480927f1-1a00-0000-0cf7-5af5260d0000 pid=3366 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=480927f1-1a00-0000-0cf7-5af5260d0000 pid=3366 execve guuid=d2efd0f1-1a00-0000-0cf7-5af5270d0000 pid=3367 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=d2efd0f1-1a00-0000-0cf7-5af5270d0000 pid=3367 execve guuid=11787cf2-1a00-0000-0cf7-5af5280d0000 pid=3368 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=11787cf2-1a00-0000-0cf7-5af5280d0000 pid=3368 execve guuid=317748f3-1a00-0000-0cf7-5af5290d0000 pid=3369 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=317748f3-1a00-0000-0cf7-5af5290d0000 pid=3369 execve guuid=d6e418f4-1a00-0000-0cf7-5af52a0d0000 pid=3370 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=d6e418f4-1a00-0000-0cf7-5af52a0d0000 pid=3370 execve guuid=b8b0ccf4-1a00-0000-0cf7-5af52b0d0000 pid=3371 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=b8b0ccf4-1a00-0000-0cf7-5af52b0d0000 pid=3371 execve guuid=b980b4f5-1a00-0000-0cf7-5af52c0d0000 pid=3372 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=b980b4f5-1a00-0000-0cf7-5af52c0d0000 pid=3372 execve guuid=947b48f6-1a00-0000-0cf7-5af52d0d0000 pid=3373 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=947b48f6-1a00-0000-0cf7-5af52d0d0000 pid=3373 execve guuid=bb0335f7-1a00-0000-0cf7-5af52f0d0000 pid=3375 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=bb0335f7-1a00-0000-0cf7-5af52f0d0000 pid=3375 execve guuid=d4ecdef7-1a00-0000-0cf7-5af5300d0000 pid=3376 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=d4ecdef7-1a00-0000-0cf7-5af5300d0000 pid=3376 execve guuid=f6457af8-1a00-0000-0cf7-5af5320d0000 pid=3378 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=f6457af8-1a00-0000-0cf7-5af5320d0000 pid=3378 execve guuid=b43be5f8-1a00-0000-0cf7-5af5340d0000 pid=3380 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=b43be5f8-1a00-0000-0cf7-5af5340d0000 pid=3380 execve guuid=973f4df9-1a00-0000-0cf7-5af5360d0000 pid=3382 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=973f4df9-1a00-0000-0cf7-5af5360d0000 pid=3382 execve guuid=7be7c1f9-1a00-0000-0cf7-5af5380d0000 pid=3384 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=7be7c1f9-1a00-0000-0cf7-5af5380d0000 pid=3384 execve guuid=cdb937fa-1a00-0000-0cf7-5af53a0d0000 pid=3386 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=cdb937fa-1a00-0000-0cf7-5af53a0d0000 pid=3386 execve guuid=bc7de5fa-1a00-0000-0cf7-5af53d0d0000 pid=3389 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=bc7de5fa-1a00-0000-0cf7-5af53d0d0000 pid=3389 execve guuid=b198a5fb-1a00-0000-0cf7-5af5400d0000 pid=3392 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=b198a5fb-1a00-0000-0cf7-5af5400d0000 pid=3392 execve guuid=84164bfc-1a00-0000-0cf7-5af5430d0000 pid=3395 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=84164bfc-1a00-0000-0cf7-5af5430d0000 pid=3395 execve guuid=00fce4fc-1a00-0000-0cf7-5af5460d0000 pid=3398 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=00fce4fc-1a00-0000-0cf7-5af5460d0000 pid=3398 execve guuid=820e5ffd-1a00-0000-0cf7-5af5490d0000 pid=3401 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=820e5ffd-1a00-0000-0cf7-5af5490d0000 pid=3401 execve guuid=9ca4e3fd-1a00-0000-0cf7-5af54b0d0000 pid=3403 /usr/bin/ls guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=9ca4e3fd-1a00-0000-0cf7-5af54b0d0000 pid=3403 execve guuid=46ab57fe-1a00-0000-0cf7-5af54d0d0000 pid=3405 /usr/bin/rm guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=46ab57fe-1a00-0000-0cf7-5af54d0d0000 pid=3405 execve guuid=c72ceefe-1a00-0000-0cf7-5af54f0d0000 pid=3407 /usr/bin/wget net send-data write-file guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=c72ceefe-1a00-0000-0cf7-5af54f0d0000 pid=3407 execve guuid=9dd37008-1b00-0000-0cf7-5af5640d0000 pid=3428 /usr/bin/chmod guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=9dd37008-1b00-0000-0cf7-5af5640d0000 pid=3428 execve guuid=9db8f408-1b00-0000-0cf7-5af5650d0000 pid=3429 /tmp/WgL guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=9db8f408-1b00-0000-0cf7-5af5650d0000 pid=3429 execve guuid=df21300a-1b00-0000-0cf7-5af5680d0000 pid=3432 /usr/bin/rm guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=df21300a-1b00-0000-0cf7-5af5680d0000 pid=3432 execve guuid=29fc750a-1b00-0000-0cf7-5af56b0d0000 pid=3435 /usr/bin/wget net send-data write-file guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=29fc750a-1b00-0000-0cf7-5af56b0d0000 pid=3435 execve guuid=6352d610-1b00-0000-0cf7-5af5760d0000 pid=3446 /usr/bin/chmod guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=6352d610-1b00-0000-0cf7-5af5760d0000 pid=3446 execve guuid=77cc1611-1b00-0000-0cf7-5af5780d0000 pid=3448 /tmp/xkxM guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=77cc1611-1b00-0000-0cf7-5af5780d0000 pid=3448 execve guuid=62dbf411-1b00-0000-0cf7-5af57c0d0000 pid=3452 /usr/bin/rm guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=62dbf411-1b00-0000-0cf7-5af57c0d0000 pid=3452 execve guuid=31a46a12-1b00-0000-0cf7-5af57f0d0000 pid=3455 /usr/bin/wget net send-data write-file guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=31a46a12-1b00-0000-0cf7-5af57f0d0000 pid=3455 execve guuid=92eb001a-1b00-0000-0cf7-5af58e0d0000 pid=3470 /usr/bin/chmod guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=92eb001a-1b00-0000-0cf7-5af58e0d0000 pid=3470 execve guuid=a8e2821a-1b00-0000-0cf7-5af58f0d0000 pid=3471 /tmp/AA4z guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=a8e2821a-1b00-0000-0cf7-5af58f0d0000 pid=3471 execve guuid=151bf91b-1b00-0000-0cf7-5af5910d0000 pid=3473 /usr/bin/rm guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=151bf91b-1b00-0000-0cf7-5af5910d0000 pid=3473 execve guuid=576acd1c-1b00-0000-0cf7-5af5920d0000 pid=3474 /usr/bin/wget net send-data write-file guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=576acd1c-1b00-0000-0cf7-5af5920d0000 pid=3474 execve guuid=c04ed65f-1b00-0000-0cf7-5af5d10d0000 pid=3537 /usr/bin/chmod guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=c04ed65f-1b00-0000-0cf7-5af5d10d0000 pid=3537 execve guuid=38122160-1b00-0000-0cf7-5af5d20d0000 pid=3538 /tmp/DzrG guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=38122160-1b00-0000-0cf7-5af5d20d0000 pid=3538 execve guuid=fee30c61-1b00-0000-0cf7-5af5d50d0000 pid=3541 /usr/bin/rm guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=fee30c61-1b00-0000-0cf7-5af5d50d0000 pid=3541 execve guuid=0c995461-1b00-0000-0cf7-5af5d60d0000 pid=3542 /usr/bin/wget net send-data write-file guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=0c995461-1b00-0000-0cf7-5af5d60d0000 pid=3542 execve guuid=bb1ed167-1b00-0000-0cf7-5af5e70d0000 pid=3559 /usr/bin/chmod guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=bb1ed167-1b00-0000-0cf7-5af5e70d0000 pid=3559 execve guuid=7be24068-1b00-0000-0cf7-5af5e90d0000 pid=3561 /tmp/a9Kw guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=7be24068-1b00-0000-0cf7-5af5e90d0000 pid=3561 execve guuid=98b62269-1b00-0000-0cf7-5af5ed0d0000 pid=3565 /usr/bin/rm delete-file guuid=f2c950af-1a00-0000-0cf7-5af58f0c0000 pid=3215->guuid=98b62269-1b00-0000-0cf7-5af5ed0d0000 pid=3565 execve 9554d36e-3083-568e-90da-bb8e3c487b07 188.132.232.81:80 guuid=c72ceefe-1a00-0000-0cf7-5af54f0d0000 pid=3407->9554d36e-3083-568e-90da-bb8e3c487b07 send: 132B guuid=29fc750a-1b00-0000-0cf7-5af56b0d0000 pid=3435->9554d36e-3083-568e-90da-bb8e3c487b07 send: 133B guuid=31a46a12-1b00-0000-0cf7-5af57f0d0000 pid=3455->9554d36e-3083-568e-90da-bb8e3c487b07 send: 133B guuid=576acd1c-1b00-0000-0cf7-5af5920d0000 pid=3474->9554d36e-3083-568e-90da-bb8e3c487b07 send: 133B guuid=0c995461-1b00-0000-0cf7-5af5d60d0000 pid=3542->9554d36e-3083-568e-90da-bb8e3c487b07 send: 133B
Score:
94%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/623c3907d597ae6161a1c33c826ef3fe4eb6849de852e261ce755cdd2d9d33f7
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/623c3907d597ae6161a1c33c826ef3fe4eb6849de852e261ce755cdd2d9d33f7/
Verdict:
Malicious
Threat:
Family.MIRAI
Link:
https://tip.neiki.dev/file/623c3907d597ae6161a1c33c826ef3fe4eb6849de852e261ce755cdd2d9d33f7
Threat name:
Win32.Trojan.Vigorf
Create hunting rule
Status:
Malicious
First seen:
2026-06-09 02:21:40 UTC
File Type:
Text (Shell)
AV detection:
10 of 23 (43.48%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mi6dsb6vs6xgcynbym6ie3xt7zhlnbe55bjoeyooovon2lm5gp3q._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
defense_evasion discovery linux
Link:
https://tria.ge/reports/260609-csqq4aax61/
Behaviour
Reads runtime system information
Writes file to tmp directory
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.26
Link:
https://yomi.yoroi.company/submissions/623c3907d597ae6161a1c33c826ef3fe4eb6849de852e261ce755cdd2d9d33f7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 623c3907d597ae6161a1c33c826ef3fe4eb6849de852e261ce755cdd2d9d33f7

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3856431/
  
Delivery method
Distributed via web download

Comments