MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 69c0f0287ba4b3986700a024c6cc9a5db66892d36310c9d244b4791fa4abc6c8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 69c0f0287ba4b3986700a024c6cc9a5db66892d36310c9d244b4791fa4abc6c8
SHA3-384 hash: 0e99eb962c5da6787791a59fa3599dfef6ebc1e388451379b431d91b2e362fa8a5a579ab0373219514f807e8c60cef4f
SHA1 hash: a6481a7412ee5a601aab2d38b69203db5e7ace0a
MD5 hash: dbb8071faf5200f2ca74666afb1215d4
humanhash: maryland-cup-winter-nebraska
File name:lil
Download: download sample
File size:848 bytes
First seen:2026-07-17 08:24:18 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkatFCoFWFCpVJ1CxgKCDVPSCb84uX:kXCKysE2hi0ziQvZoha3FAFO1qF5+8/X
TLSH T19E01AFCFD2545A0050A9C95C279B50A4F830C3CF67870B69BFACA47D9BC8E14B067F9A
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://129.121.110.105/E3wwn/an/an/a
http://129.121.110.105/Kz59n/an/an/a
http://129.121.110.105/YlUn/an/an/a
http://129.121.110.105/xzyn/an/an/a
http://129.121.110.105/NYDRn/an/an/a

Intelligence

File Origin
# of uploads :
1
# of downloads :
55
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive mirai
Link:
https://www.filescan.io/uploads/6a59e6bcaaf99569f1e02381/reports/dc0ba1f3-5029-422b-ab8b-e1bde1d3f713/overview
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/1dc1ac50-d771-422c-b83f-14c5225cb107
Behavior Graph:
Download SVG
%3 guuid=e7476a63-1900-0000-6fa0-e40d36140000 pid=5174 /usr/bin/sudo guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175 /tmp/sample.bin write-file guuid=e7476a63-1900-0000-6fa0-e40d36140000 pid=5174->guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175 execve guuid=3bd4bc67-1900-0000-6fa0-e40d38140000 pid=5176 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=3bd4bc67-1900-0000-6fa0-e40d38140000 pid=5176 execve guuid=6e115869-1900-0000-6fa0-e40d39140000 pid=5177 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=6e115869-1900-0000-6fa0-e40d39140000 pid=5177 execve guuid=4b38e769-1900-0000-6fa0-e40d3a140000 pid=5178 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=4b38e769-1900-0000-6fa0-e40d3a140000 pid=5178 execve guuid=f48a756a-1900-0000-6fa0-e40d3b140000 pid=5179 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=f48a756a-1900-0000-6fa0-e40d3b140000 pid=5179 execve guuid=c43c086b-1900-0000-6fa0-e40d3c140000 pid=5180 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=c43c086b-1900-0000-6fa0-e40d3c140000 pid=5180 execve guuid=31c3916b-1900-0000-6fa0-e40d3d140000 pid=5181 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=31c3916b-1900-0000-6fa0-e40d3d140000 pid=5181 execve guuid=6c4a256c-1900-0000-6fa0-e40d3e140000 pid=5182 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=6c4a256c-1900-0000-6fa0-e40d3e140000 pid=5182 execve guuid=0ba0ba6c-1900-0000-6fa0-e40d3f140000 pid=5183 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=0ba0ba6c-1900-0000-6fa0-e40d3f140000 pid=5183 execve guuid=a9ef656d-1900-0000-6fa0-e40d40140000 pid=5184 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=a9ef656d-1900-0000-6fa0-e40d40140000 pid=5184 execve guuid=a997f46d-1900-0000-6fa0-e40d41140000 pid=5185 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=a997f46d-1900-0000-6fa0-e40d41140000 pid=5185 execve guuid=8db6876e-1900-0000-6fa0-e40d42140000 pid=5186 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=8db6876e-1900-0000-6fa0-e40d42140000 pid=5186 execve guuid=2b971e6f-1900-0000-6fa0-e40d43140000 pid=5187 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=2b971e6f-1900-0000-6fa0-e40d43140000 pid=5187 execve guuid=2834c26f-1900-0000-6fa0-e40d44140000 pid=5188 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=2834c26f-1900-0000-6fa0-e40d44140000 pid=5188 execve guuid=b2146170-1900-0000-6fa0-e40d45140000 pid=5189 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=b2146170-1900-0000-6fa0-e40d45140000 pid=5189 execve guuid=f77af470-1900-0000-6fa0-e40d46140000 pid=5190 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=f77af470-1900-0000-6fa0-e40d46140000 pid=5190 execve guuid=40e67971-1900-0000-6fa0-e40d47140000 pid=5191 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=40e67971-1900-0000-6fa0-e40d47140000 pid=5191 execve guuid=854d0a72-1900-0000-6fa0-e40d48140000 pid=5192 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=854d0a72-1900-0000-6fa0-e40d48140000 pid=5192 execve guuid=2ab29272-1900-0000-6fa0-e40d49140000 pid=5193 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=2ab29272-1900-0000-6fa0-e40d49140000 pid=5193 execve guuid=76af1d73-1900-0000-6fa0-e40d4a140000 pid=5194 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=76af1d73-1900-0000-6fa0-e40d4a140000 pid=5194 execve guuid=9051a373-1900-0000-6fa0-e40d4b140000 pid=5195 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=9051a373-1900-0000-6fa0-e40d4b140000 pid=5195 execve guuid=57973f74-1900-0000-6fa0-e40d4c140000 pid=5196 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=57973f74-1900-0000-6fa0-e40d4c140000 pid=5196 execve guuid=77e2d174-1900-0000-6fa0-e40d4d140000 pid=5197 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=77e2d174-1900-0000-6fa0-e40d4d140000 pid=5197 execve guuid=86987175-1900-0000-6fa0-e40d4e140000 pid=5198 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=86987175-1900-0000-6fa0-e40d4e140000 pid=5198 execve guuid=ee341376-1900-0000-6fa0-e40d4f140000 pid=5199 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=ee341376-1900-0000-6fa0-e40d4f140000 pid=5199 execve guuid=6e91a776-1900-0000-6fa0-e40d50140000 pid=5200 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=6e91a776-1900-0000-6fa0-e40d50140000 pid=5200 execve guuid=61ce4577-1900-0000-6fa0-e40d51140000 pid=5201 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=61ce4577-1900-0000-6fa0-e40d51140000 pid=5201 execve guuid=1849de77-1900-0000-6fa0-e40d52140000 pid=5202 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=1849de77-1900-0000-6fa0-e40d52140000 pid=5202 execve guuid=cb456a78-1900-0000-6fa0-e40d53140000 pid=5203 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=cb456a78-1900-0000-6fa0-e40d53140000 pid=5203 execve guuid=7d08f778-1900-0000-6fa0-e40d54140000 pid=5204 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=7d08f778-1900-0000-6fa0-e40d54140000 pid=5204 execve guuid=96927179-1900-0000-6fa0-e40d55140000 pid=5205 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=96927179-1900-0000-6fa0-e40d55140000 pid=5205 execve guuid=c0f1f679-1900-0000-6fa0-e40d56140000 pid=5206 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=c0f1f679-1900-0000-6fa0-e40d56140000 pid=5206 execve guuid=47e1757a-1900-0000-6fa0-e40d57140000 pid=5207 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=47e1757a-1900-0000-6fa0-e40d57140000 pid=5207 execve guuid=cda2017b-1900-0000-6fa0-e40d58140000 pid=5208 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=cda2017b-1900-0000-6fa0-e40d58140000 pid=5208 execve guuid=7a0c8d7b-1900-0000-6fa0-e40d59140000 pid=5209 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=7a0c8d7b-1900-0000-6fa0-e40d59140000 pid=5209 execve guuid=f9db137c-1900-0000-6fa0-e40d5a140000 pid=5210 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=f9db137c-1900-0000-6fa0-e40d5a140000 pid=5210 execve guuid=2889857c-1900-0000-6fa0-e40d5b140000 pid=5211 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=2889857c-1900-0000-6fa0-e40d5b140000 pid=5211 execve guuid=ef046d7d-1900-0000-6fa0-e40d5c140000 pid=5212 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=ef046d7d-1900-0000-6fa0-e40d5c140000 pid=5212 execve guuid=f8b4f07d-1900-0000-6fa0-e40d5d140000 pid=5213 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=f8b4f07d-1900-0000-6fa0-e40d5d140000 pid=5213 execve guuid=a075737e-1900-0000-6fa0-e40d5e140000 pid=5214 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=a075737e-1900-0000-6fa0-e40d5e140000 pid=5214 execve guuid=4650fb7e-1900-0000-6fa0-e40d5f140000 pid=5215 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=4650fb7e-1900-0000-6fa0-e40d5f140000 pid=5215 execve guuid=dd51e07f-1900-0000-6fa0-e40d60140000 pid=5216 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=dd51e07f-1900-0000-6fa0-e40d60140000 pid=5216 execve guuid=6f78a981-1900-0000-6fa0-e40d61140000 pid=5217 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=6f78a981-1900-0000-6fa0-e40d61140000 pid=5217 execve guuid=b8739f82-1900-0000-6fa0-e40d62140000 pid=5218 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=b8739f82-1900-0000-6fa0-e40d62140000 pid=5218 execve guuid=79833583-1900-0000-6fa0-e40d63140000 pid=5219 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=79833583-1900-0000-6fa0-e40d63140000 pid=5219 execve guuid=a18dac83-1900-0000-6fa0-e40d64140000 pid=5220 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=a18dac83-1900-0000-6fa0-e40d64140000 pid=5220 execve guuid=3fe52784-1900-0000-6fa0-e40d65140000 pid=5221 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=3fe52784-1900-0000-6fa0-e40d65140000 pid=5221 execve guuid=88ffaf84-1900-0000-6fa0-e40d66140000 pid=5222 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=88ffaf84-1900-0000-6fa0-e40d66140000 pid=5222 execve guuid=d2652b85-1900-0000-6fa0-e40d67140000 pid=5223 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=d2652b85-1900-0000-6fa0-e40d67140000 pid=5223 execve guuid=8d1dae85-1900-0000-6fa0-e40d68140000 pid=5224 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=8d1dae85-1900-0000-6fa0-e40d68140000 pid=5224 execve guuid=f7213086-1900-0000-6fa0-e40d69140000 pid=5225 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=f7213086-1900-0000-6fa0-e40d69140000 pid=5225 execve guuid=b844a286-1900-0000-6fa0-e40d6a140000 pid=5226 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=b844a286-1900-0000-6fa0-e40d6a140000 pid=5226 execve guuid=92e91387-1900-0000-6fa0-e40d6b140000 pid=5227 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=92e91387-1900-0000-6fa0-e40d6b140000 pid=5227 execve guuid=9bdd9087-1900-0000-6fa0-e40d6c140000 pid=5228 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=9bdd9087-1900-0000-6fa0-e40d6c140000 pid=5228 execve guuid=49661688-1900-0000-6fa0-e40d6d140000 pid=5229 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=49661688-1900-0000-6fa0-e40d6d140000 pid=5229 execve guuid=138a8c88-1900-0000-6fa0-e40d6e140000 pid=5230 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=138a8c88-1900-0000-6fa0-e40d6e140000 pid=5230 execve guuid=02971b89-1900-0000-6fa0-e40d6f140000 pid=5231 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=02971b89-1900-0000-6fa0-e40d6f140000 pid=5231 execve guuid=2f6c9b89-1900-0000-6fa0-e40d70140000 pid=5232 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=2f6c9b89-1900-0000-6fa0-e40d70140000 pid=5232 execve guuid=a841368a-1900-0000-6fa0-e40d71140000 pid=5233 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=a841368a-1900-0000-6fa0-e40d71140000 pid=5233 execve guuid=8de7db8a-1900-0000-6fa0-e40d72140000 pid=5234 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=8de7db8a-1900-0000-6fa0-e40d72140000 pid=5234 execve guuid=03e5618b-1900-0000-6fa0-e40d73140000 pid=5235 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=03e5618b-1900-0000-6fa0-e40d73140000 pid=5235 execve guuid=bd70e38b-1900-0000-6fa0-e40d74140000 pid=5236 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=bd70e38b-1900-0000-6fa0-e40d74140000 pid=5236 execve guuid=a7e35e8c-1900-0000-6fa0-e40d75140000 pid=5237 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=a7e35e8c-1900-0000-6fa0-e40d75140000 pid=5237 execve guuid=3386db8c-1900-0000-6fa0-e40d76140000 pid=5238 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=3386db8c-1900-0000-6fa0-e40d76140000 pid=5238 execve guuid=9745558d-1900-0000-6fa0-e40d77140000 pid=5239 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=9745558d-1900-0000-6fa0-e40d77140000 pid=5239 execve guuid=f135c58d-1900-0000-6fa0-e40d78140000 pid=5240 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=f135c58d-1900-0000-6fa0-e40d78140000 pid=5240 execve guuid=c6bc458e-1900-0000-6fa0-e40d79140000 pid=5241 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=c6bc458e-1900-0000-6fa0-e40d79140000 pid=5241 execve guuid=c607b98e-1900-0000-6fa0-e40d7a140000 pid=5242 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=c607b98e-1900-0000-6fa0-e40d7a140000 pid=5242 execve guuid=b7cc398f-1900-0000-6fa0-e40d7b140000 pid=5243 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=b7cc398f-1900-0000-6fa0-e40d7b140000 pid=5243 execve guuid=6d7ebd8f-1900-0000-6fa0-e40d7c140000 pid=5244 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=6d7ebd8f-1900-0000-6fa0-e40d7c140000 pid=5244 execve guuid=29247c90-1900-0000-6fa0-e40d7d140000 pid=5245 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=29247c90-1900-0000-6fa0-e40d7d140000 pid=5245 execve guuid=84167b91-1900-0000-6fa0-e40d7e140000 pid=5246 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=84167b91-1900-0000-6fa0-e40d7e140000 pid=5246 execve guuid=6b6dc893-1900-0000-6fa0-e40d7f140000 pid=5247 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=6b6dc893-1900-0000-6fa0-e40d7f140000 pid=5247 execve guuid=6b967c95-1900-0000-6fa0-e40d80140000 pid=5248 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=6b967c95-1900-0000-6fa0-e40d80140000 pid=5248 execve guuid=00052497-1900-0000-6fa0-e40d81140000 pid=5249 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=00052497-1900-0000-6fa0-e40d81140000 pid=5249 execve guuid=3a5bb298-1900-0000-6fa0-e40d82140000 pid=5250 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=3a5bb298-1900-0000-6fa0-e40d82140000 pid=5250 execve guuid=68134a9a-1900-0000-6fa0-e40d83140000 pid=5251 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=68134a9a-1900-0000-6fa0-e40d83140000 pid=5251 execve guuid=e98ed69a-1900-0000-6fa0-e40d84140000 pid=5252 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=e98ed69a-1900-0000-6fa0-e40d84140000 pid=5252 execve guuid=7cad719b-1900-0000-6fa0-e40d85140000 pid=5253 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=7cad719b-1900-0000-6fa0-e40d85140000 pid=5253 execve guuid=c5a1999c-1900-0000-6fa0-e40d86140000 pid=5254 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=c5a1999c-1900-0000-6fa0-e40d86140000 pid=5254 execve guuid=e170399d-1900-0000-6fa0-e40d87140000 pid=5255 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=e170399d-1900-0000-6fa0-e40d87140000 pid=5255 execve guuid=9955d39d-1900-0000-6fa0-e40d88140000 pid=5256 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=9955d39d-1900-0000-6fa0-e40d88140000 pid=5256 execve guuid=14be689e-1900-0000-6fa0-e40d89140000 pid=5257 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=14be689e-1900-0000-6fa0-e40d89140000 pid=5257 execve guuid=645d039f-1900-0000-6fa0-e40d8a140000 pid=5258 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=645d039f-1900-0000-6fa0-e40d8a140000 pid=5258 execve guuid=6499979f-1900-0000-6fa0-e40d8b140000 pid=5259 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=6499979f-1900-0000-6fa0-e40d8b140000 pid=5259 execve guuid=a5e933a0-1900-0000-6fa0-e40d8c140000 pid=5260 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=a5e933a0-1900-0000-6fa0-e40d8c140000 pid=5260 execve guuid=1e1bc3a0-1900-0000-6fa0-e40d8d140000 pid=5261 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=1e1bc3a0-1900-0000-6fa0-e40d8d140000 pid=5261 execve guuid=dd1754a1-1900-0000-6fa0-e40d8e140000 pid=5262 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=dd1754a1-1900-0000-6fa0-e40d8e140000 pid=5262 execve guuid=5ad1e6a1-1900-0000-6fa0-e40d8f140000 pid=5263 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=5ad1e6a1-1900-0000-6fa0-e40d8f140000 pid=5263 execve guuid=bc8177a2-1900-0000-6fa0-e40d90140000 pid=5264 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=bc8177a2-1900-0000-6fa0-e40d90140000 pid=5264 execve guuid=f32607a3-1900-0000-6fa0-e40d91140000 pid=5265 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=f32607a3-1900-0000-6fa0-e40d91140000 pid=5265 execve guuid=bbdf7aa3-1900-0000-6fa0-e40d92140000 pid=5266 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=bbdf7aa3-1900-0000-6fa0-e40d92140000 pid=5266 execve guuid=02acdea3-1900-0000-6fa0-e40d93140000 pid=5267 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=02acdea3-1900-0000-6fa0-e40d93140000 pid=5267 execve guuid=c0f951a4-1900-0000-6fa0-e40d94140000 pid=5268 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=c0f951a4-1900-0000-6fa0-e40d94140000 pid=5268 execve guuid=77c8c7a4-1900-0000-6fa0-e40d95140000 pid=5269 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=77c8c7a4-1900-0000-6fa0-e40d95140000 pid=5269 execve guuid=62824ba5-1900-0000-6fa0-e40d96140000 pid=5270 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=62824ba5-1900-0000-6fa0-e40d96140000 pid=5270 execve guuid=f812bca5-1900-0000-6fa0-e40d97140000 pid=5271 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=f812bca5-1900-0000-6fa0-e40d97140000 pid=5271 execve guuid=76372da6-1900-0000-6fa0-e40d98140000 pid=5272 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=76372da6-1900-0000-6fa0-e40d98140000 pid=5272 execve guuid=f02abfa6-1900-0000-6fa0-e40d99140000 pid=5273 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=f02abfa6-1900-0000-6fa0-e40d99140000 pid=5273 execve guuid=e8ea6ca7-1900-0000-6fa0-e40d9a140000 pid=5274 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=e8ea6ca7-1900-0000-6fa0-e40d9a140000 pid=5274 execve guuid=53cd19a8-1900-0000-6fa0-e40d9b140000 pid=5275 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=53cd19a8-1900-0000-6fa0-e40d9b140000 pid=5275 execve guuid=f270b2a8-1900-0000-6fa0-e40d9c140000 pid=5276 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=f270b2a8-1900-0000-6fa0-e40d9c140000 pid=5276 execve guuid=aecc41a9-1900-0000-6fa0-e40d9d140000 pid=5277 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=aecc41a9-1900-0000-6fa0-e40d9d140000 pid=5277 execve guuid=6f1ecba9-1900-0000-6fa0-e40d9e140000 pid=5278 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=6f1ecba9-1900-0000-6fa0-e40d9e140000 pid=5278 execve guuid=02b15daa-1900-0000-6fa0-e40d9f140000 pid=5279 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=02b15daa-1900-0000-6fa0-e40d9f140000 pid=5279 execve guuid=a95eebaa-1900-0000-6fa0-e40da0140000 pid=5280 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=a95eebaa-1900-0000-6fa0-e40da0140000 pid=5280 execve guuid=eb8f6eab-1900-0000-6fa0-e40da1140000 pid=5281 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=eb8f6eab-1900-0000-6fa0-e40da1140000 pid=5281 execve guuid=2a1be6ab-1900-0000-6fa0-e40da2140000 pid=5282 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=2a1be6ab-1900-0000-6fa0-e40da2140000 pid=5282 execve guuid=700d77ac-1900-0000-6fa0-e40da3140000 pid=5283 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=700d77ac-1900-0000-6fa0-e40da3140000 pid=5283 execve guuid=1fc020ad-1900-0000-6fa0-e40da4140000 pid=5284 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=1fc020ad-1900-0000-6fa0-e40da4140000 pid=5284 execve guuid=e119aaad-1900-0000-6fa0-e40da5140000 pid=5285 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=e119aaad-1900-0000-6fa0-e40da5140000 pid=5285 execve guuid=02c836ae-1900-0000-6fa0-e40da6140000 pid=5286 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=02c836ae-1900-0000-6fa0-e40da6140000 pid=5286 execve guuid=6b59bfae-1900-0000-6fa0-e40da7140000 pid=5287 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=6b59bfae-1900-0000-6fa0-e40da7140000 pid=5287 execve guuid=32b8abaf-1900-0000-6fa0-e40da8140000 pid=5288 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=32b8abaf-1900-0000-6fa0-e40da8140000 pid=5288 execve guuid=915666b0-1900-0000-6fa0-e40da9140000 pid=5289 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=915666b0-1900-0000-6fa0-e40da9140000 pid=5289 execve guuid=f7250bb1-1900-0000-6fa0-e40daa140000 pid=5290 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=f7250bb1-1900-0000-6fa0-e40daa140000 pid=5290 execve guuid=4fad82b1-1900-0000-6fa0-e40dab140000 pid=5291 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=4fad82b1-1900-0000-6fa0-e40dab140000 pid=5291 execve guuid=c56b79b2-1900-0000-6fa0-e40dac140000 pid=5292 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=c56b79b2-1900-0000-6fa0-e40dac140000 pid=5292 execve guuid=8d0686b3-1900-0000-6fa0-e40dad140000 pid=5293 /usr/bin/ls guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=8d0686b3-1900-0000-6fa0-e40dad140000 pid=5293 execve guuid=3f647db4-1900-0000-6fa0-e40dae140000 pid=5294 /usr/bin/rm guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=3f647db4-1900-0000-6fa0-e40dae140000 pid=5294 execve guuid=a26cd1b4-1900-0000-6fa0-e40daf140000 pid=5295 /usr/bin/wget net send-data write-file guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=a26cd1b4-1900-0000-6fa0-e40daf140000 pid=5295 execve guuid=1dc6a0bd-1900-0000-6fa0-e40db0140000 pid=5296 /usr/bin/chmod guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=1dc6a0bd-1900-0000-6fa0-e40db0140000 pid=5296 execve guuid=86af80be-1900-0000-6fa0-e40db1140000 pid=5297 /usr/bin/dash guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=86af80be-1900-0000-6fa0-e40db1140000 pid=5297 clone guuid=0fa863c0-1900-0000-6fa0-e40db3140000 pid=5299 /usr/bin/rm guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=0fa863c0-1900-0000-6fa0-e40db3140000 pid=5299 execve guuid=ec68bbc0-1900-0000-6fa0-e40db4140000 pid=5300 /usr/bin/wget net send-data write-file guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=ec68bbc0-1900-0000-6fa0-e40db4140000 pid=5300 execve guuid=e8782dc5-1900-0000-6fa0-e40db5140000 pid=5301 /usr/bin/chmod guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=e8782dc5-1900-0000-6fa0-e40db5140000 pid=5301 execve guuid=df438bc5-1900-0000-6fa0-e40db6140000 pid=5302 /usr/bin/dash guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=df438bc5-1900-0000-6fa0-e40db6140000 pid=5302 clone guuid=160854c6-1900-0000-6fa0-e40db8140000 pid=5304 /usr/bin/rm guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=160854c6-1900-0000-6fa0-e40db8140000 pid=5304 execve guuid=3299a6c6-1900-0000-6fa0-e40db9140000 pid=5305 /usr/bin/wget net send-data write-file guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=3299a6c6-1900-0000-6fa0-e40db9140000 pid=5305 execve guuid=fd7010cb-1900-0000-6fa0-e40dba140000 pid=5306 /usr/bin/chmod guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=fd7010cb-1900-0000-6fa0-e40dba140000 pid=5306 execve guuid=922167cb-1900-0000-6fa0-e40dbb140000 pid=5307 /usr/bin/dash guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=922167cb-1900-0000-6fa0-e40dbb140000 pid=5307 clone guuid=31c387cc-1900-0000-6fa0-e40dbd140000 pid=5309 /usr/bin/rm guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=31c387cc-1900-0000-6fa0-e40dbd140000 pid=5309 execve guuid=8cdda4cd-1900-0000-6fa0-e40dbe140000 pid=5310 /usr/bin/wget net send-data write-file guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=8cdda4cd-1900-0000-6fa0-e40dbe140000 pid=5310 execve guuid=d6e2cbd4-1900-0000-6fa0-e40dbf140000 pid=5311 /usr/bin/chmod guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=d6e2cbd4-1900-0000-6fa0-e40dbf140000 pid=5311 execve guuid=e47572d5-1900-0000-6fa0-e40dc0140000 pid=5312 /usr/bin/dash guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=e47572d5-1900-0000-6fa0-e40dc0140000 pid=5312 clone guuid=76cf6cd8-1900-0000-6fa0-e40dc2140000 pid=5314 /usr/bin/rm guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=76cf6cd8-1900-0000-6fa0-e40dc2140000 pid=5314 execve guuid=ba1ac3d8-1900-0000-6fa0-e40dc3140000 pid=5315 /usr/bin/wget net send-data write-file guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=ba1ac3d8-1900-0000-6fa0-e40dc3140000 pid=5315 execve guuid=60035fdd-1900-0000-6fa0-e40dc4140000 pid=5316 /usr/bin/chmod guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=60035fdd-1900-0000-6fa0-e40dc4140000 pid=5316 execve guuid=43f449de-1900-0000-6fa0-e40dc5140000 pid=5317 /usr/bin/dash guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=43f449de-1900-0000-6fa0-e40dc5140000 pid=5317 clone guuid=5dedcedf-1900-0000-6fa0-e40dc7140000 pid=5319 /usr/bin/rm delete-file guuid=9afb0467-1900-0000-6fa0-e40d37140000 pid=5175->guuid=5dedcedf-1900-0000-6fa0-e40dc7140000 pid=5319 execve 0b1ba66e-2f8f-542f-9f7c-00dd01da057c 129.121.110.105:80 guuid=a26cd1b4-1900-0000-6fa0-e40daf140000 pid=5295->0b1ba66e-2f8f-542f-9f7c-00dd01da057c send: 134B guuid=ec68bbc0-1900-0000-6fa0-e40db4140000 pid=5300->0b1ba66e-2f8f-542f-9f7c-00dd01da057c send: 134B guuid=3299a6c6-1900-0000-6fa0-e40db9140000 pid=5305->0b1ba66e-2f8f-542f-9f7c-00dd01da057c send: 133B guuid=8cdda4cd-1900-0000-6fa0-e40dbe140000 pid=5310->0b1ba66e-2f8f-542f-9f7c-00dd01da057c send: 133B guuid=ba1ac3d8-1900-0000-6fa0-e40dc3140000 pid=5315->0b1ba66e-2f8f-542f-9f7c-00dd01da057c send: 134B
Score:
97%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/69c0f0287ba4b3986700a024c6cc9a5db66892d36310c9d244b4791fa4abc6c8
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/69c0f0287ba4b3986700a024c6cc9a5db66892d36310c9d244b4791fa4abc6c8/
Threat name:
Document-HTML.Browser.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2026-07-17 08:25:53 UTC
File Type:
Text (Shell)
AV detection:
7 of 36 (19.44%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nhapakd3uszzqzyauasmnte2lw3grewtmmimtusewr4r7jfly3ea._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260717-kayb8afv7q/
Behaviour
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
Enumerates running processes
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.26
Link:
https://yomi.yoroi.company/submissions/69c0f0287ba4b3986700a024c6cc9a5db66892d36310c9d244b4791fa4abc6c8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 69c0f0287ba4b3986700a024c6cc9a5db66892d36310c9d244b4791fa4abc6c8

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3887344/
  
Delivery method
Distributed via web download

Comments