MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 62e99fe42356690d0d6f03e331b13f213b07d1e450e6ee9526d0bc0500905bd6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 62e99fe42356690d0d6f03e331b13f213b07d1e450e6ee9526d0bc0500905bd6
SHA3-384 hash: bd3ef52b48e845639c1620b513c894d67fc344eff7f5277cbee838b1d3f4dadf1f11ba8872a84da18f5e5d0298cbafb4
SHA1 hash: 1c478433bb36f720751321d86f91234f42eec13d
MD5 hash: e6419b2c12c29b75847a945ed1104b2d
humanhash: triple-burger-shade-gee
File name:lil
Download: download sample
File size:844 bytes
First seen:2026-08-10 20:09:47 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 24:kXCKysE2hi0ziQvZohauXIvEqbTflB1zeX:e9Qp+MsmIvEGTj1zeX
TLSH T18B01CECDD130951050AAE86C32DB6064F821C3C7194B4F76BFACA47E9BDCE04B026FA9
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh

Intelligence

File Origin
# of uploads :
1
# of downloads :
41
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Gathering data
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive
Link:
https://www.filescan.io/uploads/6a7a303a101d9766d45f0d30/reports/09ae6517-9aea-4600-a50c-229c5428ff61/overview
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/f588f03c-6f8f-404e-b755-86f75d06f503
Behavior Graph:
Download SVG
%3 guuid=00fb0631-1900-0000-d7f4-728d3f0d0000 pid=3391 /usr/bin/sudo guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405 /tmp/sample.bin write-file guuid=00fb0631-1900-0000-d7f4-728d3f0d0000 pid=3391->guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405 execve guuid=73419237-1900-0000-d7f4-728d500d0000 pid=3408 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=73419237-1900-0000-d7f4-728d500d0000 pid=3408 execve guuid=a95ebd39-1900-0000-d7f4-728d510d0000 pid=3409 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=a95ebd39-1900-0000-d7f4-728d510d0000 pid=3409 execve guuid=0b4ef43a-1900-0000-d7f4-728d520d0000 pid=3410 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=0b4ef43a-1900-0000-d7f4-728d520d0000 pid=3410 execve guuid=a266203c-1900-0000-d7f4-728d530d0000 pid=3411 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=a266203c-1900-0000-d7f4-728d530d0000 pid=3411 execve guuid=80c4363d-1900-0000-d7f4-728d540d0000 pid=3412 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=80c4363d-1900-0000-d7f4-728d540d0000 pid=3412 execve guuid=1cf9643e-1900-0000-d7f4-728d550d0000 pid=3413 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=1cf9643e-1900-0000-d7f4-728d550d0000 pid=3413 execve guuid=67193d3f-1900-0000-d7f4-728d560d0000 pid=3414 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=67193d3f-1900-0000-d7f4-728d560d0000 pid=3414 execve guuid=bca3f03f-1900-0000-d7f4-728d570d0000 pid=3415 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=bca3f03f-1900-0000-d7f4-728d570d0000 pid=3415 execve guuid=144b0e41-1900-0000-d7f4-728d590d0000 pid=3417 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=144b0e41-1900-0000-d7f4-728d590d0000 pid=3417 execve guuid=9e502142-1900-0000-d7f4-728d5a0d0000 pid=3418 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=9e502142-1900-0000-d7f4-728d5a0d0000 pid=3418 execve guuid=68213543-1900-0000-d7f4-728d5b0d0000 pid=3419 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=68213543-1900-0000-d7f4-728d5b0d0000 pid=3419 execve guuid=f8a30c44-1900-0000-d7f4-728d5e0d0000 pid=3422 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=f8a30c44-1900-0000-d7f4-728d5e0d0000 pid=3422 execve guuid=103f0c45-1900-0000-d7f4-728d600d0000 pid=3424 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=103f0c45-1900-0000-d7f4-728d600d0000 pid=3424 execve guuid=7cbd0c46-1900-0000-d7f4-728d620d0000 pid=3426 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=7cbd0c46-1900-0000-d7f4-728d620d0000 pid=3426 execve guuid=5f89c946-1900-0000-d7f4-728d640d0000 pid=3428 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=5f89c946-1900-0000-d7f4-728d640d0000 pid=3428 execve guuid=cda7b447-1900-0000-d7f4-728d660d0000 pid=3430 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=cda7b447-1900-0000-d7f4-728d660d0000 pid=3430 execve guuid=7c623348-1900-0000-d7f4-728d670d0000 pid=3431 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=7c623348-1900-0000-d7f4-728d670d0000 pid=3431 execve guuid=d0d4af48-1900-0000-d7f4-728d680d0000 pid=3432 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=d0d4af48-1900-0000-d7f4-728d680d0000 pid=3432 execve guuid=80c34249-1900-0000-d7f4-728d6a0d0000 pid=3434 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=80c34249-1900-0000-d7f4-728d6a0d0000 pid=3434 execve guuid=877dd149-1900-0000-d7f4-728d6c0d0000 pid=3436 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=877dd149-1900-0000-d7f4-728d6c0d0000 pid=3436 execve guuid=906f964a-1900-0000-d7f4-728d6f0d0000 pid=3439 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=906f964a-1900-0000-d7f4-728d6f0d0000 pid=3439 execve guuid=82f0244b-1900-0000-d7f4-728d720d0000 pid=3442 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=82f0244b-1900-0000-d7f4-728d720d0000 pid=3442 execve guuid=5272b64b-1900-0000-d7f4-728d750d0000 pid=3445 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=5272b64b-1900-0000-d7f4-728d750d0000 pid=3445 execve guuid=b06b9f4c-1900-0000-d7f4-728d790d0000 pid=3449 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=b06b9f4c-1900-0000-d7f4-728d790d0000 pid=3449 execve guuid=ca0fa14d-1900-0000-d7f4-728d7c0d0000 pid=3452 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=ca0fa14d-1900-0000-d7f4-728d7c0d0000 pid=3452 execve guuid=7333c04e-1900-0000-d7f4-728d800d0000 pid=3456 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=7333c04e-1900-0000-d7f4-728d800d0000 pid=3456 execve guuid=b5e33451-1900-0000-d7f4-728d8b0d0000 pid=3467 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=b5e33451-1900-0000-d7f4-728d8b0d0000 pid=3467 execve guuid=10150e52-1900-0000-d7f4-728d8c0d0000 pid=3468 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=10150e52-1900-0000-d7f4-728d8c0d0000 pid=3468 execve guuid=23530953-1900-0000-d7f4-728d8e0d0000 pid=3470 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=23530953-1900-0000-d7f4-728d8e0d0000 pid=3470 execve guuid=24acea53-1900-0000-d7f4-728d8f0d0000 pid=3471 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=24acea53-1900-0000-d7f4-728d8f0d0000 pid=3471 execve guuid=80cd7355-1900-0000-d7f4-728d920d0000 pid=3474 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=80cd7355-1900-0000-d7f4-728d920d0000 pid=3474 execve guuid=8a9d2756-1900-0000-d7f4-728d940d0000 pid=3476 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=8a9d2756-1900-0000-d7f4-728d940d0000 pid=3476 execve guuid=f4d09056-1900-0000-d7f4-728d960d0000 pid=3478 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=f4d09056-1900-0000-d7f4-728d960d0000 pid=3478 execve guuid=8bf3ee56-1900-0000-d7f4-728d980d0000 pid=3480 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=8bf3ee56-1900-0000-d7f4-728d980d0000 pid=3480 execve guuid=e3a35157-1900-0000-d7f4-728d9a0d0000 pid=3482 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=e3a35157-1900-0000-d7f4-728d9a0d0000 pid=3482 execve guuid=0289df57-1900-0000-d7f4-728d9d0d0000 pid=3485 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=0289df57-1900-0000-d7f4-728d9d0d0000 pid=3485 execve guuid=e1ac3758-1900-0000-d7f4-728d9f0d0000 pid=3487 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=e1ac3758-1900-0000-d7f4-728d9f0d0000 pid=3487 execve guuid=54a9a558-1900-0000-d7f4-728da00d0000 pid=3488 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=54a9a558-1900-0000-d7f4-728da00d0000 pid=3488 execve guuid=53913559-1900-0000-d7f4-728da40d0000 pid=3492 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=53913559-1900-0000-d7f4-728da40d0000 pid=3492 execve guuid=29bdb959-1900-0000-d7f4-728da60d0000 pid=3494 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=29bdb959-1900-0000-d7f4-728da60d0000 pid=3494 execve guuid=b789495a-1900-0000-d7f4-728da90d0000 pid=3497 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=b789495a-1900-0000-d7f4-728da90d0000 pid=3497 execve guuid=e409e15a-1900-0000-d7f4-728dab0d0000 pid=3499 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=e409e15a-1900-0000-d7f4-728dab0d0000 pid=3499 execve guuid=da327e5b-1900-0000-d7f4-728dae0d0000 pid=3502 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=da327e5b-1900-0000-d7f4-728dae0d0000 pid=3502 execve guuid=4bc8055c-1900-0000-d7f4-728db00d0000 pid=3504 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=4bc8055c-1900-0000-d7f4-728db00d0000 pid=3504 execve guuid=6ca1785c-1900-0000-d7f4-728db20d0000 pid=3506 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=6ca1785c-1900-0000-d7f4-728db20d0000 pid=3506 execve guuid=1599f95c-1900-0000-d7f4-728db40d0000 pid=3508 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=1599f95c-1900-0000-d7f4-728db40d0000 pid=3508 execve guuid=44149c5d-1900-0000-d7f4-728db70d0000 pid=3511 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=44149c5d-1900-0000-d7f4-728db70d0000 pid=3511 execve guuid=d7c8795e-1900-0000-d7f4-728dba0d0000 pid=3514 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=d7c8795e-1900-0000-d7f4-728dba0d0000 pid=3514 execve guuid=93676e5f-1900-0000-d7f4-728dbd0d0000 pid=3517 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=93676e5f-1900-0000-d7f4-728dbd0d0000 pid=3517 execve guuid=a8194960-1900-0000-d7f4-728dc10d0000 pid=3521 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=a8194960-1900-0000-d7f4-728dc10d0000 pid=3521 execve guuid=24f51261-1900-0000-d7f4-728dc20d0000 pid=3522 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=24f51261-1900-0000-d7f4-728dc20d0000 pid=3522 execve guuid=6aacec61-1900-0000-d7f4-728dc30d0000 pid=3523 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=6aacec61-1900-0000-d7f4-728dc30d0000 pid=3523 execve guuid=3cc94362-1900-0000-d7f4-728dc40d0000 pid=3524 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=3cc94362-1900-0000-d7f4-728dc40d0000 pid=3524 execve guuid=6c41a062-1900-0000-d7f4-728dc50d0000 pid=3525 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=6c41a062-1900-0000-d7f4-728dc50d0000 pid=3525 execve guuid=4cdcfd62-1900-0000-d7f4-728dc60d0000 pid=3526 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=4cdcfd62-1900-0000-d7f4-728dc60d0000 pid=3526 execve guuid=b4d45763-1900-0000-d7f4-728dc70d0000 pid=3527 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=b4d45763-1900-0000-d7f4-728dc70d0000 pid=3527 execve guuid=5fc2b463-1900-0000-d7f4-728dc80d0000 pid=3528 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=5fc2b463-1900-0000-d7f4-728dc80d0000 pid=3528 execve guuid=67351164-1900-0000-d7f4-728dc90d0000 pid=3529 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=67351164-1900-0000-d7f4-728dc90d0000 pid=3529 execve guuid=dc0e6664-1900-0000-d7f4-728dca0d0000 pid=3530 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=dc0e6664-1900-0000-d7f4-728dca0d0000 pid=3530 execve guuid=3fc0c064-1900-0000-d7f4-728dcb0d0000 pid=3531 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=3fc0c064-1900-0000-d7f4-728dcb0d0000 pid=3531 execve guuid=54241b65-1900-0000-d7f4-728dcc0d0000 pid=3532 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=54241b65-1900-0000-d7f4-728dcc0d0000 pid=3532 execve guuid=304d7965-1900-0000-d7f4-728dce0d0000 pid=3534 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=304d7965-1900-0000-d7f4-728dce0d0000 pid=3534 execve guuid=2b799766-1900-0000-d7f4-728dd30d0000 pid=3539 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=2b799766-1900-0000-d7f4-728dd30d0000 pid=3539 execve guuid=335fc067-1900-0000-d7f4-728dd90d0000 pid=3545 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=335fc067-1900-0000-d7f4-728dd90d0000 pid=3545 execve guuid=558d7368-1900-0000-d7f4-728dda0d0000 pid=3546 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=558d7368-1900-0000-d7f4-728dda0d0000 pid=3546 execve guuid=dd1dfc68-1900-0000-d7f4-728ddd0d0000 pid=3549 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=dd1dfc68-1900-0000-d7f4-728ddd0d0000 pid=3549 execve guuid=51b37a69-1900-0000-d7f4-728de10d0000 pid=3553 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=51b37a69-1900-0000-d7f4-728de10d0000 pid=3553 execve guuid=bae2016a-1900-0000-d7f4-728de40d0000 pid=3556 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=bae2016a-1900-0000-d7f4-728de40d0000 pid=3556 execve guuid=2104876a-1900-0000-d7f4-728de70d0000 pid=3559 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=2104876a-1900-0000-d7f4-728de70d0000 pid=3559 execve guuid=2542fd6a-1900-0000-d7f4-728de90d0000 pid=3561 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=2542fd6a-1900-0000-d7f4-728de90d0000 pid=3561 execve guuid=1a229f6b-1900-0000-d7f4-728deb0d0000 pid=3563 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=1a229f6b-1900-0000-d7f4-728deb0d0000 pid=3563 execve guuid=e374ae6c-1900-0000-d7f4-728def0d0000 pid=3567 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=e374ae6c-1900-0000-d7f4-728def0d0000 pid=3567 execve guuid=d8c4b66d-1900-0000-d7f4-728df00d0000 pid=3568 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=d8c4b66d-1900-0000-d7f4-728df00d0000 pid=3568 execve guuid=36bac66e-1900-0000-d7f4-728df30d0000 pid=3571 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=36bac66e-1900-0000-d7f4-728df30d0000 pid=3571 execve guuid=d09f8c6f-1900-0000-d7f4-728df80d0000 pid=3576 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=d09f8c6f-1900-0000-d7f4-728df80d0000 pid=3576 execve guuid=fc7b2370-1900-0000-d7f4-728dfc0d0000 pid=3580 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=fc7b2370-1900-0000-d7f4-728dfc0d0000 pid=3580 execve guuid=77eea070-1900-0000-d7f4-728d000e0000 pid=3584 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=77eea070-1900-0000-d7f4-728d000e0000 pid=3584 execve guuid=f2223771-1900-0000-d7f4-728d030e0000 pid=3587 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=f2223771-1900-0000-d7f4-728d030e0000 pid=3587 execve guuid=ca98d271-1900-0000-d7f4-728d050e0000 pid=3589 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=ca98d271-1900-0000-d7f4-728d050e0000 pid=3589 execve guuid=87ee5c72-1900-0000-d7f4-728d070e0000 pid=3591 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=87ee5c72-1900-0000-d7f4-728d070e0000 pid=3591 execve guuid=fc45e872-1900-0000-d7f4-728d0a0e0000 pid=3594 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=fc45e872-1900-0000-d7f4-728d0a0e0000 pid=3594 execve guuid=ab1f7173-1900-0000-d7f4-728d0c0e0000 pid=3596 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=ab1f7173-1900-0000-d7f4-728d0c0e0000 pid=3596 execve guuid=54202674-1900-0000-d7f4-728d0e0e0000 pid=3598 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=54202674-1900-0000-d7f4-728d0e0e0000 pid=3598 execve guuid=750cd074-1900-0000-d7f4-728d0f0e0000 pid=3599 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=750cd074-1900-0000-d7f4-728d0f0e0000 pid=3599 execve guuid=e81eaa75-1900-0000-d7f4-728d100e0000 pid=3600 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=e81eaa75-1900-0000-d7f4-728d100e0000 pid=3600 execve guuid=2a39c176-1900-0000-d7f4-728d140e0000 pid=3604 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=2a39c176-1900-0000-d7f4-728d140e0000 pid=3604 execve guuid=4e9ebc77-1900-0000-d7f4-728d190e0000 pid=3609 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=4e9ebc77-1900-0000-d7f4-728d190e0000 pid=3609 execve guuid=9bf4bd78-1900-0000-d7f4-728d1d0e0000 pid=3613 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=9bf4bd78-1900-0000-d7f4-728d1d0e0000 pid=3613 execve guuid=9b15ae79-1900-0000-d7f4-728d210e0000 pid=3617 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=9b15ae79-1900-0000-d7f4-728d210e0000 pid=3617 execve guuid=0cfefb7a-1900-0000-d7f4-728d260e0000 pid=3622 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=0cfefb7a-1900-0000-d7f4-728d260e0000 pid=3622 execve guuid=4085387d-1900-0000-d7f4-728d2e0e0000 pid=3630 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=4085387d-1900-0000-d7f4-728d2e0e0000 pid=3630 execve guuid=ac299b7e-1900-0000-d7f4-728d310e0000 pid=3633 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=ac299b7e-1900-0000-d7f4-728d310e0000 pid=3633 execve guuid=55d7bf7f-1900-0000-d7f4-728d320e0000 pid=3634 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=55d7bf7f-1900-0000-d7f4-728d320e0000 pid=3634 execve guuid=3c86e180-1900-0000-d7f4-728d330e0000 pid=3635 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=3c86e180-1900-0000-d7f4-728d330e0000 pid=3635 execve guuid=4552f881-1900-0000-d7f4-728d340e0000 pid=3636 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=4552f881-1900-0000-d7f4-728d340e0000 pid=3636 execve guuid=171e9c82-1900-0000-d7f4-728d350e0000 pid=3637 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=171e9c82-1900-0000-d7f4-728d350e0000 pid=3637 execve guuid=762c5383-1900-0000-d7f4-728d360e0000 pid=3638 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=762c5383-1900-0000-d7f4-728d360e0000 pid=3638 execve guuid=76d3fb83-1900-0000-d7f4-728d370e0000 pid=3639 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=76d3fb83-1900-0000-d7f4-728d370e0000 pid=3639 execve guuid=b44bb384-1900-0000-d7f4-728d380e0000 pid=3640 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=b44bb384-1900-0000-d7f4-728d380e0000 pid=3640 execve guuid=c70f6985-1900-0000-d7f4-728d390e0000 pid=3641 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=c70f6985-1900-0000-d7f4-728d390e0000 pid=3641 execve guuid=45a30a86-1900-0000-d7f4-728d3a0e0000 pid=3642 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=45a30a86-1900-0000-d7f4-728d3a0e0000 pid=3642 execve guuid=2abdb386-1900-0000-d7f4-728d3b0e0000 pid=3643 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=2abdb386-1900-0000-d7f4-728d3b0e0000 pid=3643 execve guuid=6bf04987-1900-0000-d7f4-728d3c0e0000 pid=3644 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=6bf04987-1900-0000-d7f4-728d3c0e0000 pid=3644 execve guuid=55fae987-1900-0000-d7f4-728d3d0e0000 pid=3645 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=55fae987-1900-0000-d7f4-728d3d0e0000 pid=3645 execve guuid=1a89a588-1900-0000-d7f4-728d3e0e0000 pid=3646 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=1a89a588-1900-0000-d7f4-728d3e0e0000 pid=3646 execve guuid=b5638589-1900-0000-d7f4-728d3f0e0000 pid=3647 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=b5638589-1900-0000-d7f4-728d3f0e0000 pid=3647 execve guuid=c3c67c8a-1900-0000-d7f4-728d400e0000 pid=3648 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=c3c67c8a-1900-0000-d7f4-728d400e0000 pid=3648 execve guuid=5688668b-1900-0000-d7f4-728d410e0000 pid=3649 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=5688668b-1900-0000-d7f4-728d410e0000 pid=3649 execve guuid=8168f18b-1900-0000-d7f4-728d420e0000 pid=3650 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=8168f18b-1900-0000-d7f4-728d420e0000 pid=3650 execve guuid=4824b08c-1900-0000-d7f4-728d430e0000 pid=3651 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=4824b08c-1900-0000-d7f4-728d430e0000 pid=3651 execve guuid=7391108d-1900-0000-d7f4-728d470e0000 pid=3655 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=7391108d-1900-0000-d7f4-728d470e0000 pid=3655 execve guuid=5691818d-1900-0000-d7f4-728d480e0000 pid=3656 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=5691818d-1900-0000-d7f4-728d480e0000 pid=3656 execve guuid=f509008e-1900-0000-d7f4-728d4c0e0000 pid=3660 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=f509008e-1900-0000-d7f4-728d4c0e0000 pid=3660 execve guuid=34ce5b8e-1900-0000-d7f4-728d4e0e0000 pid=3662 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=34ce5b8e-1900-0000-d7f4-728d4e0e0000 pid=3662 execve guuid=2740b48e-1900-0000-d7f4-728d510e0000 pid=3665 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=2740b48e-1900-0000-d7f4-728d510e0000 pid=3665 execve guuid=44e3158f-1900-0000-d7f4-728d530e0000 pid=3667 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=44e3158f-1900-0000-d7f4-728d530e0000 pid=3667 execve guuid=01797e8f-1900-0000-d7f4-728d560e0000 pid=3670 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=01797e8f-1900-0000-d7f4-728d560e0000 pid=3670 execve guuid=699e0490-1900-0000-d7f4-728d570e0000 pid=3671 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=699e0490-1900-0000-d7f4-728d570e0000 pid=3671 execve guuid=0234bd90-1900-0000-d7f4-728d580e0000 pid=3672 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=0234bd90-1900-0000-d7f4-728d580e0000 pid=3672 execve guuid=dfcebe91-1900-0000-d7f4-728d590e0000 pid=3673 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=dfcebe91-1900-0000-d7f4-728d590e0000 pid=3673 execve guuid=bcb7c392-1900-0000-d7f4-728d5a0e0000 pid=3674 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=bcb7c392-1900-0000-d7f4-728d5a0e0000 pid=3674 execve guuid=fedb9993-1900-0000-d7f4-728d5b0e0000 pid=3675 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=fedb9993-1900-0000-d7f4-728d5b0e0000 pid=3675 execve guuid=83bd3694-1900-0000-d7f4-728d5c0e0000 pid=3676 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=83bd3694-1900-0000-d7f4-728d5c0e0000 pid=3676 execve guuid=218bc194-1900-0000-d7f4-728d600e0000 pid=3680 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=218bc194-1900-0000-d7f4-728d600e0000 pid=3680 execve guuid=d8163e95-1900-0000-d7f4-728d640e0000 pid=3684 /usr/bin/ls guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=d8163e95-1900-0000-d7f4-728d640e0000 pid=3684 execve guuid=b0a3eb95-1900-0000-d7f4-728d660e0000 pid=3686 /usr/bin/rm guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=b0a3eb95-1900-0000-d7f4-728d660e0000 pid=3686 execve guuid=841b2c96-1900-0000-d7f4-728d680e0000 pid=3688 /usr/bin/wget net send-data write-file guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=841b2c96-1900-0000-d7f4-728d680e0000 pid=3688 execve guuid=4a5452a1-1900-0000-d7f4-728d780e0000 pid=3704 /usr/bin/chmod guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=4a5452a1-1900-0000-d7f4-728d780e0000 pid=3704 execve guuid=ed7582a2-1900-0000-d7f4-728d7b0e0000 pid=3707 /usr/bin/dash guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=ed7582a2-1900-0000-d7f4-728d7b0e0000 pid=3707 clone guuid=51381da5-1900-0000-d7f4-728d880e0000 pid=3720 /usr/bin/rm guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=51381da5-1900-0000-d7f4-728d880e0000 pid=3720 execve guuid=f9b3b8a5-1900-0000-d7f4-728d8d0e0000 pid=3725 /usr/bin/wget net send-data write-file guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=f9b3b8a5-1900-0000-d7f4-728d8d0e0000 pid=3725 execve guuid=bac9d5ab-1900-0000-d7f4-728da90e0000 pid=3753 /usr/bin/chmod guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=bac9d5ab-1900-0000-d7f4-728da90e0000 pid=3753 execve guuid=91e73dad-1900-0000-d7f4-728dae0e0000 pid=3758 /usr/bin/dash guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=91e73dad-1900-0000-d7f4-728dae0e0000 pid=3758 clone guuid=2dc5b3ae-1900-0000-d7f4-728db20e0000 pid=3762 /usr/bin/rm guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=2dc5b3ae-1900-0000-d7f4-728db20e0000 pid=3762 execve guuid=a5821aaf-1900-0000-d7f4-728db40e0000 pid=3764 /usr/bin/wget net send-data write-file guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=a5821aaf-1900-0000-d7f4-728db40e0000 pid=3764 execve guuid=9df7feb2-1900-0000-d7f4-728dbe0e0000 pid=3774 /usr/bin/chmod guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=9df7feb2-1900-0000-d7f4-728dbe0e0000 pid=3774 execve guuid=5e5c3fb3-1900-0000-d7f4-728dbf0e0000 pid=3775 /usr/bin/dash guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=5e5c3fb3-1900-0000-d7f4-728dbf0e0000 pid=3775 clone guuid=7ca4f8b3-1900-0000-d7f4-728dc20e0000 pid=3778 /usr/bin/rm guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=7ca4f8b3-1900-0000-d7f4-728dc20e0000 pid=3778 execve guuid=366a42b4-1900-0000-d7f4-728dc40e0000 pid=3780 /usr/bin/wget net send-data write-file guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=366a42b4-1900-0000-d7f4-728dc40e0000 pid=3780 execve guuid=8957fab8-1900-0000-d7f4-728dcd0e0000 pid=3789 /usr/bin/chmod guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=8957fab8-1900-0000-d7f4-728dcd0e0000 pid=3789 execve guuid=984830b9-1900-0000-d7f4-728dd20e0000 pid=3794 /usr/bin/dash guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=984830b9-1900-0000-d7f4-728dd20e0000 pid=3794 clone guuid=fb07b5b9-1900-0000-d7f4-728dd70e0000 pid=3799 /usr/bin/rm guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=fb07b5b9-1900-0000-d7f4-728dd70e0000 pid=3799 execve guuid=406001ba-1900-0000-d7f4-728dd90e0000 pid=3801 /usr/bin/wget net send-data write-file guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=406001ba-1900-0000-d7f4-728dd90e0000 pid=3801 execve guuid=3fce86be-1900-0000-d7f4-728df10e0000 pid=3825 /usr/bin/chmod guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=3fce86be-1900-0000-d7f4-728df10e0000 pid=3825 execve guuid=cb24cfbe-1900-0000-d7f4-728df40e0000 pid=3828 /usr/bin/dash guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=cb24cfbe-1900-0000-d7f4-728df40e0000 pid=3828 clone guuid=e08da5bf-1900-0000-d7f4-728dfa0e0000 pid=3834 /usr/bin/rm delete-file guuid=04e87436-1900-0000-d7f4-728d4d0d0000 pid=3405->guuid=e08da5bf-1900-0000-d7f4-728dfa0e0000 pid=3834 execve 0b1ba66e-2f8f-542f-9f7c-00dd01da057c 129.121.110.105:80 guuid=841b2c96-1900-0000-d7f4-728d680e0000 pid=3688->0b1ba66e-2f8f-542f-9f7c-00dd01da057c send: 134B guuid=f9b3b8a5-1900-0000-d7f4-728d8d0e0000 pid=3725->0b1ba66e-2f8f-542f-9f7c-00dd01da057c send: 133B guuid=a5821aaf-1900-0000-d7f4-728db40e0000 pid=3764->0b1ba66e-2f8f-542f-9f7c-00dd01da057c send: 133B guuid=366a42b4-1900-0000-d7f4-728dc40e0000 pid=3780->0b1ba66e-2f8f-542f-9f7c-00dd01da057c send: 134B guuid=406001ba-1900-0000-d7f4-728dd90e0000 pid=3801->0b1ba66e-2f8f-542f-9f7c-00dd01da057c send: 133B
Score:
98%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/62e99fe42356690d0d6f03e331b13f213b07d1e450e6ee9526d0bc0500905bd6
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/62e99fe42356690d0d6f03e331b13f213b07d1e450e6ee9526d0bc0500905bd6/
Gathering data
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mluz7zbdkzuq2dlpaprtdmj7ee5qpupekdto5fjg2c6akaeqlpla._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
discovery linux
Link:
https://tria.ge/reports/260810-yxy4xsac95/
Behaviour
Reads runtime system information
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 62e99fe42356690d0d6f03e331b13f213b07d1e450e6ee9526d0bc0500905bd6

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3887344/
  
Delivery method
Distributed via web download

Comments