MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 64e7b02ce2afe734c786e5a8a378edd7252672dfdbfb6cbd39805dbe6e750efb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 64e7b02ce2afe734c786e5a8a378edd7252672dfdbfb6cbd39805dbe6e750efb
SHA3-384 hash: d5901a7ae0a50c415ed28bbad780a9aa2a1727508a533cda6f768b91acca0b4c1af91f4f6bd8cd90f531dba8ca2fb8cb
SHA1 hash: 545a5b785b40744a780044debb9c12cb202fe858
MD5 hash: 4b2d8761f4a71962c44116a657c7ac77
humanhash: maine-victor-hotel-purple
File name:lil
Download: download sample
File size:848 bytes
First seen:2026-07-17 05:56:52 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkapKCtXiMOCxfmSCHgNjC0/0W4CFXIX:kXCKysE2hi0ziQvZohaIHRKrF/kxX
TLSH T1E901ABCAD560490040EAD95D22D75064F871C3C7164B8F79BF6DB43DEB9CE04B066F88
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://129.121.110.105/JHkPn/an/an/a
http://129.121.110.105/W8Hn/an/an/a
http://129.121.110.105/0KXsn/an/an/a
http://129.121.110.105/oNrIn/an/an/a
http://129.121.110.105/EpDn/an/an/a

Intelligence

File Origin
# of uploads :
1
# of downloads :
57
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive mirai
Link:
https://www.filescan.io/uploads/6a59c447011598279d99aeb7/reports/989da500-e663-42ca-a5ee-22625008d9f5/overview
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/21990975-b6df-4d03-bb7a-700e4ba39852
Behavior Graph:
Download SVG
%3 guuid=8395bf63-1900-0000-46a3-b917fd0e0000 pid=3837 /usr/bin/sudo guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845 /tmp/sample.bin write-file guuid=8395bf63-1900-0000-46a3-b917fd0e0000 pid=3837->guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845 execve guuid=219b4b67-1900-0000-46a3-b917060f0000 pid=3846 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=219b4b67-1900-0000-46a3-b917060f0000 pid=3846 execve guuid=7e98f867-1900-0000-46a3-b917080f0000 pid=3848 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=7e98f867-1900-0000-46a3-b917080f0000 pid=3848 execve guuid=ca5d5c68-1900-0000-46a3-b9170b0f0000 pid=3851 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=ca5d5c68-1900-0000-46a3-b9170b0f0000 pid=3851 execve guuid=387cc568-1900-0000-46a3-b9170d0f0000 pid=3853 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=387cc568-1900-0000-46a3-b9170d0f0000 pid=3853 execve guuid=cfec3a69-1900-0000-46a3-b9170f0f0000 pid=3855 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=cfec3a69-1900-0000-46a3-b9170f0f0000 pid=3855 execve guuid=ee27ae69-1900-0000-46a3-b917110f0000 pid=3857 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=ee27ae69-1900-0000-46a3-b917110f0000 pid=3857 execve guuid=3fc3186a-1900-0000-46a3-b917120f0000 pid=3858 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=3fc3186a-1900-0000-46a3-b917120f0000 pid=3858 execve guuid=b86ca46a-1900-0000-46a3-b917160f0000 pid=3862 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=b86ca46a-1900-0000-46a3-b917160f0000 pid=3862 execve guuid=ee59626b-1900-0000-46a3-b917170f0000 pid=3863 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=ee59626b-1900-0000-46a3-b917170f0000 pid=3863 execve guuid=dc0ff46b-1900-0000-46a3-b9171b0f0000 pid=3867 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=dc0ff46b-1900-0000-46a3-b9171b0f0000 pid=3867 execve guuid=b27c796c-1900-0000-46a3-b9171f0f0000 pid=3871 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=b27c796c-1900-0000-46a3-b9171f0f0000 pid=3871 execve guuid=0ada216d-1900-0000-46a3-b917230f0000 pid=3875 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=0ada216d-1900-0000-46a3-b917230f0000 pid=3875 execve guuid=abf4a46d-1900-0000-46a3-b917270f0000 pid=3879 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=abf4a46d-1900-0000-46a3-b917270f0000 pid=3879 execve guuid=b160256e-1900-0000-46a3-b917290f0000 pid=3881 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=b160256e-1900-0000-46a3-b917290f0000 pid=3881 execve guuid=15b1c16e-1900-0000-46a3-b9172e0f0000 pid=3886 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=15b1c16e-1900-0000-46a3-b9172e0f0000 pid=3886 execve guuid=a6a9336f-1900-0000-46a3-b9172f0f0000 pid=3887 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=a6a9336f-1900-0000-46a3-b9172f0f0000 pid=3887 execve guuid=1912d86f-1900-0000-46a3-b917330f0000 pid=3891 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=1912d86f-1900-0000-46a3-b917330f0000 pid=3891 execve guuid=25305170-1900-0000-46a3-b917350f0000 pid=3893 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=25305170-1900-0000-46a3-b917350f0000 pid=3893 execve guuid=b86dcb70-1900-0000-46a3-b917380f0000 pid=3896 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=b86dcb70-1900-0000-46a3-b917380f0000 pid=3896 execve guuid=2be23d71-1900-0000-46a3-b9173a0f0000 pid=3898 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=2be23d71-1900-0000-46a3-b9173a0f0000 pid=3898 execve guuid=ff0bb371-1900-0000-46a3-b9173d0f0000 pid=3901 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=ff0bb371-1900-0000-46a3-b9173d0f0000 pid=3901 execve guuid=990e4b72-1900-0000-46a3-b9173f0f0000 pid=3903 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=990e4b72-1900-0000-46a3-b9173f0f0000 pid=3903 execve guuid=8e07e572-1900-0000-46a3-b917410f0000 pid=3905 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=8e07e572-1900-0000-46a3-b917410f0000 pid=3905 execve guuid=41387973-1900-0000-46a3-b917440f0000 pid=3908 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=41387973-1900-0000-46a3-b917440f0000 pid=3908 execve guuid=60fc1974-1900-0000-46a3-b917460f0000 pid=3910 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=60fc1974-1900-0000-46a3-b917460f0000 pid=3910 execve guuid=ff10a874-1900-0000-46a3-b9174a0f0000 pid=3914 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=ff10a874-1900-0000-46a3-b9174a0f0000 pid=3914 execve guuid=48c43475-1900-0000-46a3-b9174b0f0000 pid=3915 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=48c43475-1900-0000-46a3-b9174b0f0000 pid=3915 execve guuid=60dbb275-1900-0000-46a3-b9174f0f0000 pid=3919 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=60dbb275-1900-0000-46a3-b9174f0f0000 pid=3919 execve guuid=caf22b76-1900-0000-46a3-b917530f0000 pid=3923 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=caf22b76-1900-0000-46a3-b917530f0000 pid=3923 execve guuid=2e12c576-1900-0000-46a3-b917570f0000 pid=3927 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=2e12c576-1900-0000-46a3-b917570f0000 pid=3927 execve guuid=354f2577-1900-0000-46a3-b9175b0f0000 pid=3931 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=354f2577-1900-0000-46a3-b9175b0f0000 pid=3931 execve guuid=5f0a8677-1900-0000-46a3-b9175c0f0000 pid=3932 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=5f0a8677-1900-0000-46a3-b9175c0f0000 pid=3932 execve guuid=4940e277-1900-0000-46a3-b9175e0f0000 pid=3934 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=4940e277-1900-0000-46a3-b9175e0f0000 pid=3934 execve guuid=c7d55278-1900-0000-46a3-b917610f0000 pid=3937 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=c7d55278-1900-0000-46a3-b917610f0000 pid=3937 execve guuid=c902c778-1900-0000-46a3-b917640f0000 pid=3940 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=c902c778-1900-0000-46a3-b917640f0000 pid=3940 execve guuid=1fb93479-1900-0000-46a3-b917670f0000 pid=3943 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=1fb93479-1900-0000-46a3-b917670f0000 pid=3943 execve guuid=172ead79-1900-0000-46a3-b917690f0000 pid=3945 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=172ead79-1900-0000-46a3-b917690f0000 pid=3945 execve guuid=249c367a-1900-0000-46a3-b9176d0f0000 pid=3949 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=249c367a-1900-0000-46a3-b9176d0f0000 pid=3949 execve guuid=b997f67a-1900-0000-46a3-b917710f0000 pid=3953 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=b997f67a-1900-0000-46a3-b917710f0000 pid=3953 execve guuid=3f57997b-1900-0000-46a3-b917740f0000 pid=3956 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=3f57997b-1900-0000-46a3-b917740f0000 pid=3956 execve guuid=37f4137c-1900-0000-46a3-b917770f0000 pid=3959 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=37f4137c-1900-0000-46a3-b917770f0000 pid=3959 execve guuid=fa29a67c-1900-0000-46a3-b9177a0f0000 pid=3962 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=fa29a67c-1900-0000-46a3-b9177a0f0000 pid=3962 execve guuid=de7e277d-1900-0000-46a3-b9177c0f0000 pid=3964 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=de7e277d-1900-0000-46a3-b9177c0f0000 pid=3964 execve guuid=6577977d-1900-0000-46a3-b9177e0f0000 pid=3966 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=6577977d-1900-0000-46a3-b9177e0f0000 pid=3966 execve guuid=48bd3f7e-1900-0000-46a3-b917820f0000 pid=3970 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=48bd3f7e-1900-0000-46a3-b917820f0000 pid=3970 execve guuid=ec85a87e-1900-0000-46a3-b917860f0000 pid=3974 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=ec85a87e-1900-0000-46a3-b917860f0000 pid=3974 execve guuid=58b94d7f-1900-0000-46a3-b917890f0000 pid=3977 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=58b94d7f-1900-0000-46a3-b917890f0000 pid=3977 execve guuid=3bbeff7f-1900-0000-46a3-b9178d0f0000 pid=3981 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=3bbeff7f-1900-0000-46a3-b9178d0f0000 pid=3981 execve guuid=af617580-1900-0000-46a3-b917910f0000 pid=3985 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=af617580-1900-0000-46a3-b917910f0000 pid=3985 execve guuid=380e0681-1900-0000-46a3-b917950f0000 pid=3989 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=380e0681-1900-0000-46a3-b917950f0000 pid=3989 execve guuid=f1cc8281-1900-0000-46a3-b917960f0000 pid=3990 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=f1cc8281-1900-0000-46a3-b917960f0000 pid=3990 execve guuid=9f80ff81-1900-0000-46a3-b917990f0000 pid=3993 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=9f80ff81-1900-0000-46a3-b917990f0000 pid=3993 execve guuid=ed72a982-1900-0000-46a3-b9179c0f0000 pid=3996 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=ed72a982-1900-0000-46a3-b9179c0f0000 pid=3996 execve guuid=a2f45d83-1900-0000-46a3-b9179e0f0000 pid=3998 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=a2f45d83-1900-0000-46a3-b9179e0f0000 pid=3998 execve guuid=710b2984-1900-0000-46a3-b917a20f0000 pid=4002 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=710b2984-1900-0000-46a3-b917a20f0000 pid=4002 execve guuid=9a5eb884-1900-0000-46a3-b917a60f0000 pid=4006 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=9a5eb884-1900-0000-46a3-b917a60f0000 pid=4006 execve guuid=4a4c2f85-1900-0000-46a3-b917a80f0000 pid=4008 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=4a4c2f85-1900-0000-46a3-b917a80f0000 pid=4008 execve guuid=ea15a685-1900-0000-46a3-b917aa0f0000 pid=4010 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=ea15a685-1900-0000-46a3-b917aa0f0000 pid=4010 execve guuid=3d2d1286-1900-0000-46a3-b917ac0f0000 pid=4012 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=3d2d1286-1900-0000-46a3-b917ac0f0000 pid=4012 execve guuid=ba93a386-1900-0000-46a3-b917af0f0000 pid=4015 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=ba93a386-1900-0000-46a3-b917af0f0000 pid=4015 execve guuid=8cac1a87-1900-0000-46a3-b917b00f0000 pid=4016 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=8cac1a87-1900-0000-46a3-b917b00f0000 pid=4016 execve guuid=ae5dc487-1900-0000-46a3-b917b30f0000 pid=4019 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=ae5dc487-1900-0000-46a3-b917b30f0000 pid=4019 execve guuid=f0164888-1900-0000-46a3-b917b50f0000 pid=4021 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=f0164888-1900-0000-46a3-b917b50f0000 pid=4021 execve guuid=5536ea88-1900-0000-46a3-b917b90f0000 pid=4025 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=5536ea88-1900-0000-46a3-b917b90f0000 pid=4025 execve guuid=a685c889-1900-0000-46a3-b917bd0f0000 pid=4029 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=a685c889-1900-0000-46a3-b917bd0f0000 pid=4029 execve guuid=c43b5f8a-1900-0000-46a3-b917bf0f0000 pid=4031 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=c43b5f8a-1900-0000-46a3-b917bf0f0000 pid=4031 execve guuid=13f9ff8a-1900-0000-46a3-b917c10f0000 pid=4033 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=13f9ff8a-1900-0000-46a3-b917c10f0000 pid=4033 execve guuid=9f80828b-1900-0000-46a3-b917c50f0000 pid=4037 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=9f80828b-1900-0000-46a3-b917c50f0000 pid=4037 execve guuid=9b5c1d8c-1900-0000-46a3-b917c90f0000 pid=4041 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=9b5c1d8c-1900-0000-46a3-b917c90f0000 pid=4041 execve guuid=e86b998c-1900-0000-46a3-b917cb0f0000 pid=4043 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=e86b998c-1900-0000-46a3-b917cb0f0000 pid=4043 execve guuid=428e298d-1900-0000-46a3-b917cd0f0000 pid=4045 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=428e298d-1900-0000-46a3-b917cd0f0000 pid=4045 execve guuid=8858d98d-1900-0000-46a3-b917cf0f0000 pid=4047 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=8858d98d-1900-0000-46a3-b917cf0f0000 pid=4047 execve guuid=a0cf488e-1900-0000-46a3-b917d20f0000 pid=4050 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=a0cf488e-1900-0000-46a3-b917d20f0000 pid=4050 execve guuid=0c6fc08e-1900-0000-46a3-b917d50f0000 pid=4053 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=0c6fc08e-1900-0000-46a3-b917d50f0000 pid=4053 execve guuid=6dc7258f-1900-0000-46a3-b917d80f0000 pid=4056 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=6dc7258f-1900-0000-46a3-b917d80f0000 pid=4056 execve guuid=d30a8d8f-1900-0000-46a3-b917db0f0000 pid=4059 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=d30a8d8f-1900-0000-46a3-b917db0f0000 pid=4059 execve guuid=41b3f18f-1900-0000-46a3-b917dd0f0000 pid=4061 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=41b3f18f-1900-0000-46a3-b917dd0f0000 pid=4061 execve guuid=40b46c90-1900-0000-46a3-b917de0f0000 pid=4062 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=40b46c90-1900-0000-46a3-b917de0f0000 pid=4062 execve guuid=e7eaf090-1900-0000-46a3-b917e10f0000 pid=4065 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=e7eaf090-1900-0000-46a3-b917e10f0000 pid=4065 execve guuid=4320f691-1900-0000-46a3-b917e60f0000 pid=4070 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=4320f691-1900-0000-46a3-b917e60f0000 pid=4070 execve guuid=d3111393-1900-0000-46a3-b917ea0f0000 pid=4074 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=d3111393-1900-0000-46a3-b917ea0f0000 pid=4074 execve guuid=c9c0be93-1900-0000-46a3-b917ee0f0000 pid=4078 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=c9c0be93-1900-0000-46a3-b917ee0f0000 pid=4078 execve guuid=57124894-1900-0000-46a3-b917f10f0000 pid=4081 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=57124894-1900-0000-46a3-b917f10f0000 pid=4081 execve guuid=e54ab094-1900-0000-46a3-b917f30f0000 pid=4083 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=e54ab094-1900-0000-46a3-b917f30f0000 pid=4083 execve guuid=72e53f95-1900-0000-46a3-b917f50f0000 pid=4085 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=72e53f95-1900-0000-46a3-b917f50f0000 pid=4085 execve guuid=9f88c795-1900-0000-46a3-b917f80f0000 pid=4088 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=9f88c795-1900-0000-46a3-b917f80f0000 pid=4088 execve guuid=acd84796-1900-0000-46a3-b917fb0f0000 pid=4091 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=acd84796-1900-0000-46a3-b917fb0f0000 pid=4091 execve guuid=fa88b896-1900-0000-46a3-b917fc0f0000 pid=4092 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=fa88b896-1900-0000-46a3-b917fc0f0000 pid=4092 execve guuid=4a315a97-1900-0000-46a3-b917fd0f0000 pid=4093 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=4a315a97-1900-0000-46a3-b917fd0f0000 pid=4093 execve guuid=5af4fd97-1900-0000-46a3-b91701100000 pid=4097 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=5af4fd97-1900-0000-46a3-b91701100000 pid=4097 execve guuid=bdeaad98-1900-0000-46a3-b91705100000 pid=4101 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=bdeaad98-1900-0000-46a3-b91705100000 pid=4101 execve guuid=8b9d1699-1900-0000-46a3-b91707100000 pid=4103 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=8b9d1699-1900-0000-46a3-b91707100000 pid=4103 execve guuid=c4a77699-1900-0000-46a3-b9170a100000 pid=4106 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=c4a77699-1900-0000-46a3-b9170a100000 pid=4106 execve guuid=5531d499-1900-0000-46a3-b9170c100000 pid=4108 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=5531d499-1900-0000-46a3-b9170c100000 pid=4108 execve guuid=79e1379a-1900-0000-46a3-b9170e100000 pid=4110 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=79e1379a-1900-0000-46a3-b9170e100000 pid=4110 execve guuid=9797bc9a-1900-0000-46a3-b91711100000 pid=4113 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=9797bc9a-1900-0000-46a3-b91711100000 pid=4113 execve guuid=f56b2e9b-1900-0000-46a3-b91713100000 pid=4115 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=f56b2e9b-1900-0000-46a3-b91713100000 pid=4115 execve guuid=26edbe9b-1900-0000-46a3-b91714100000 pid=4116 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=26edbe9b-1900-0000-46a3-b91714100000 pid=4116 execve guuid=4e8a389c-1900-0000-46a3-b91718100000 pid=4120 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=4e8a389c-1900-0000-46a3-b91718100000 pid=4120 execve guuid=942cb59c-1900-0000-46a3-b9171b100000 pid=4123 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=942cb59c-1900-0000-46a3-b9171b100000 pid=4123 execve guuid=8e5f289d-1900-0000-46a3-b9171d100000 pid=4125 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=8e5f289d-1900-0000-46a3-b9171d100000 pid=4125 execve guuid=4b4c979d-1900-0000-46a3-b91720100000 pid=4128 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=4b4c979d-1900-0000-46a3-b91720100000 pid=4128 execve guuid=912d289e-1900-0000-46a3-b91723100000 pid=4131 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=912d289e-1900-0000-46a3-b91723100000 pid=4131 execve guuid=0b1eb99e-1900-0000-46a3-b91725100000 pid=4133 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=0b1eb99e-1900-0000-46a3-b91725100000 pid=4133 execve guuid=85ab309f-1900-0000-46a3-b91727100000 pid=4135 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=85ab309f-1900-0000-46a3-b91727100000 pid=4135 execve guuid=b8bb899f-1900-0000-46a3-b9172a100000 pid=4138 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=b8bb899f-1900-0000-46a3-b9172a100000 pid=4138 execve guuid=3470eb9f-1900-0000-46a3-b9172e100000 pid=4142 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=3470eb9f-1900-0000-46a3-b9172e100000 pid=4142 execve guuid=103b4ba0-1900-0000-46a3-b9172f100000 pid=4143 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=103b4ba0-1900-0000-46a3-b9172f100000 pid=4143 execve guuid=44e7afa0-1900-0000-46a3-b91733100000 pid=4147 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=44e7afa0-1900-0000-46a3-b91733100000 pid=4147 execve guuid=52b316a1-1900-0000-46a3-b91734100000 pid=4148 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=52b316a1-1900-0000-46a3-b91734100000 pid=4148 execve guuid=e02c81a1-1900-0000-46a3-b91737100000 pid=4151 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=e02c81a1-1900-0000-46a3-b91737100000 pid=4151 execve guuid=3af6fda1-1900-0000-46a3-b9173a100000 pid=4154 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=3af6fda1-1900-0000-46a3-b9173a100000 pid=4154 execve guuid=a1805ea2-1900-0000-46a3-b9173d100000 pid=4157 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=a1805ea2-1900-0000-46a3-b9173d100000 pid=4157 execve guuid=080cbea2-1900-0000-46a3-b9173f100000 pid=4159 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=080cbea2-1900-0000-46a3-b9173f100000 pid=4159 execve guuid=60a020a3-1900-0000-46a3-b91741100000 pid=4161 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=60a020a3-1900-0000-46a3-b91741100000 pid=4161 execve guuid=aa65a5a3-1900-0000-46a3-b91742100000 pid=4162 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=aa65a5a3-1900-0000-46a3-b91742100000 pid=4162 execve guuid=e46f06a4-1900-0000-46a3-b91746100000 pid=4166 /usr/bin/ls guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=e46f06a4-1900-0000-46a3-b91746100000 pid=4166 execve guuid=dc9c7aa4-1900-0000-46a3-b91749100000 pid=4169 /usr/bin/rm guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=dc9c7aa4-1900-0000-46a3-b91749100000 pid=4169 execve guuid=cd45b7a4-1900-0000-46a3-b9174b100000 pid=4171 /usr/bin/wget net send-data write-file guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=cd45b7a4-1900-0000-46a3-b9174b100000 pid=4171 execve guuid=2b4c9caa-1900-0000-46a3-b91761100000 pid=4193 /usr/bin/chmod guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=2b4c9caa-1900-0000-46a3-b91761100000 pid=4193 execve guuid=528eeeaa-1900-0000-46a3-b91762100000 pid=4194 /usr/bin/dash guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=528eeeaa-1900-0000-46a3-b91762100000 pid=4194 clone guuid=c321d7ab-1900-0000-46a3-b91768100000 pid=4200 /usr/bin/rm guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=c321d7ab-1900-0000-46a3-b91768100000 pid=4200 execve guuid=774d27ac-1900-0000-46a3-b9176a100000 pid=4202 /usr/bin/wget net send-data write-file guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=774d27ac-1900-0000-46a3-b9176a100000 pid=4202 execve guuid=9c7b45b1-1900-0000-46a3-b9177a100000 pid=4218 /usr/bin/chmod guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=9c7b45b1-1900-0000-46a3-b9177a100000 pid=4218 execve guuid=07b27db1-1900-0000-46a3-b9177b100000 pid=4219 /usr/bin/dash guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=07b27db1-1900-0000-46a3-b9177b100000 pid=4219 clone guuid=19d1b6b2-1900-0000-46a3-b9177f100000 pid=4223 /usr/bin/rm guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=19d1b6b2-1900-0000-46a3-b9177f100000 pid=4223 execve guuid=719ff8b2-1900-0000-46a3-b91780100000 pid=4224 /usr/bin/wget net send-data write-file guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=719ff8b2-1900-0000-46a3-b91780100000 pid=4224 execve guuid=3e52c8b7-1900-0000-46a3-b9178a100000 pid=4234 /usr/bin/chmod guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=3e52c8b7-1900-0000-46a3-b9178a100000 pid=4234 execve guuid=29bb49b8-1900-0000-46a3-b9178b100000 pid=4235 /usr/bin/dash guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=29bb49b8-1900-0000-46a3-b9178b100000 pid=4235 clone guuid=8cd200b9-1900-0000-46a3-b91793100000 pid=4243 /usr/bin/rm guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=8cd200b9-1900-0000-46a3-b91793100000 pid=4243 execve guuid=a09846b9-1900-0000-46a3-b91794100000 pid=4244 /usr/bin/wget net send-data write-file guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=a09846b9-1900-0000-46a3-b91794100000 pid=4244 execve guuid=766d24bd-1900-0000-46a3-b917a5100000 pid=4261 /usr/bin/chmod guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=766d24bd-1900-0000-46a3-b917a5100000 pid=4261 execve guuid=c1d762bd-1900-0000-46a3-b917a7100000 pid=4263 /usr/bin/dash guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=c1d762bd-1900-0000-46a3-b917a7100000 pid=4263 clone guuid=f52ff5bd-1900-0000-46a3-b917ab100000 pid=4267 /usr/bin/rm guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=f52ff5bd-1900-0000-46a3-b917ab100000 pid=4267 execve guuid=3d0957be-1900-0000-46a3-b917ad100000 pid=4269 /usr/bin/wget net send-data write-file guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=3d0957be-1900-0000-46a3-b917ad100000 pid=4269 execve guuid=dd14fbc2-1900-0000-46a3-b917c2100000 pid=4290 /usr/bin/chmod guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=dd14fbc2-1900-0000-46a3-b917c2100000 pid=4290 execve guuid=987036c3-1900-0000-46a3-b917c4100000 pid=4292 /usr/bin/dash guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=987036c3-1900-0000-46a3-b917c4100000 pid=4292 clone guuid=e57969c4-1900-0000-46a3-b917c9100000 pid=4297 /usr/bin/rm delete-file guuid=6a30d966-1900-0000-46a3-b917050f0000 pid=3845->guuid=e57969c4-1900-0000-46a3-b917c9100000 pid=4297 execve 0b1ba66e-2f8f-542f-9f7c-00dd01da057c 129.121.110.105:80 guuid=cd45b7a4-1900-0000-46a3-b9174b100000 pid=4171->0b1ba66e-2f8f-542f-9f7c-00dd01da057c send: 134B guuid=774d27ac-1900-0000-46a3-b9176a100000 pid=4202->0b1ba66e-2f8f-542f-9f7c-00dd01da057c send: 133B guuid=719ff8b2-1900-0000-46a3-b91780100000 pid=4224->0b1ba66e-2f8f-542f-9f7c-00dd01da057c send: 134B guuid=a09846b9-1900-0000-46a3-b91794100000 pid=4244->0b1ba66e-2f8f-542f-9f7c-00dd01da057c send: 134B guuid=3d0957be-1900-0000-46a3-b917ad100000 pid=4269->0b1ba66e-2f8f-542f-9f7c-00dd01da057c send: 133B
Score:
97%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/64e7b02ce2afe734c786e5a8a378edd7252672dfdbfb6cbd39805dbe6e750efb
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/64e7b02ce2afe734c786e5a8a378edd7252672dfdbfb6cbd39805dbe6e750efb/
Threat name:
Document-HTML.Browser.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2026-07-17 05:57:35 UTC
File Type:
Text (Shell)
AV detection:
7 of 36 (19.44%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mtt3alhcv7ttjr4g4wukg6hn24ssm4w73p5wzpjzqbo343tvb35q._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260717-gnvayafv91/
Behaviour
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
Enumerates running processes
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.26
Link:
https://yomi.yoroi.company/submissions/64e7b02ce2afe734c786e5a8a378edd7252672dfdbfb6cbd39805dbe6e750efb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 64e7b02ce2afe734c786e5a8a378edd7252672dfdbfb6cbd39805dbe6e750efb

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3887344/
  
Delivery method
Distributed via web download

Comments