🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 75b4ad0d28327c63a52c94ea6f67b5da3f843840f8259055f280bdf3fdc07ef7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 75b4ad0d28327c63a52c94ea6f67b5da3f843840f8259055f280bdf3fdc07ef7
SHA3-384 hash: 63467b771b8ee0bb4c060870f5631aa1be3d02363bfdd01d7ab10d1018b27e6accf784ed761381d46c0029a40ed60319
SHA1 hash: 7f5d96777f2299aca34caa746fe6ec70e250df52
MD5 hash: 33795b3f11921b018406a643971bf7d7
humanhash: indigo-mockingbird-tennessee-mexico
File name:lil
Download: download sample
File size:847 bytes
First seen:2026-06-05 20:05:25 UTC
Last seen:2026-06-06 18:23:08 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkaTICfWYIFoFFzI7n1fFI64qFIbQJuX:kXCKysE2hi0ziQvZohaT9yozCfRlFluX
TLSH T17601A3DDC025DBA051D5F45D21975045F421C3CB25858BA4BF9C583D9BB4E18705AFD8
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://188.132.232.81/qUbzn/an/aelf ua-wget
http://188.132.232.81/qX2nn/an/aelf ua-wget
http://188.132.232.81/gSNn/an/aelf ua-wget
http://188.132.232.81/yjJkn/an/aelf ua-wget
http://188.132.232.81/Lqcun/an/aelf ua-wget

Intelligence

File Origin
# of uploads :
5
# of downloads :
51
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive
Link:
https://www.filescan.io/uploads/6a232c1446e44aecc0d1ea0d/reports/7b71109d-35da-407d-b0ee-ce227058f58e/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-06-05T17:15:00Z UTC
Last seen:
2026-06-06T22:07:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan-Downloader.Shell.Agent.a
Link:
https://opentip.kaspersky.com/75b4ad0d28327c63a52c94ea6f67b5da3f843840f8259055f280bdf3fdc07ef7/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/0a7d7bf9-eeeb-41e4-9fac-946e5dbbd5d6
Behavior Graph:
Download SVG
%3 guuid=e6b30a5c-1800-0000-7a24-1d4c7a0b0000 pid=2938 /usr/bin/sudo guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945 /tmp/sample.bin write-file guuid=e6b30a5c-1800-0000-7a24-1d4c7a0b0000 pid=2938->guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945 execve guuid=3271065e-1800-0000-7a24-1d4c830b0000 pid=2947 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=3271065e-1800-0000-7a24-1d4c830b0000 pid=2947 execve guuid=08d8fc5e-1800-0000-7a24-1d4c850b0000 pid=2949 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=08d8fc5e-1800-0000-7a24-1d4c850b0000 pid=2949 execve guuid=6331a95f-1800-0000-7a24-1d4c870b0000 pid=2951 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=6331a95f-1800-0000-7a24-1d4c870b0000 pid=2951 execve guuid=e8b43f60-1800-0000-7a24-1d4c8a0b0000 pid=2954 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=e8b43f60-1800-0000-7a24-1d4c8a0b0000 pid=2954 execve guuid=0a4cb460-1800-0000-7a24-1d4c8c0b0000 pid=2956 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=0a4cb460-1800-0000-7a24-1d4c8c0b0000 pid=2956 execve guuid=60ea2a61-1800-0000-7a24-1d4c8e0b0000 pid=2958 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=60ea2a61-1800-0000-7a24-1d4c8e0b0000 pid=2958 execve guuid=4e69b361-1800-0000-7a24-1d4c900b0000 pid=2960 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=4e69b361-1800-0000-7a24-1d4c900b0000 pid=2960 execve guuid=b6ed2762-1800-0000-7a24-1d4c930b0000 pid=2963 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=b6ed2762-1800-0000-7a24-1d4c930b0000 pid=2963 execve guuid=143ab462-1800-0000-7a24-1d4c940b0000 pid=2964 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=143ab462-1800-0000-7a24-1d4c940b0000 pid=2964 execve guuid=26596863-1800-0000-7a24-1d4c960b0000 pid=2966 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=26596863-1800-0000-7a24-1d4c960b0000 pid=2966 execve guuid=0d500964-1800-0000-7a24-1d4c970b0000 pid=2967 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=0d500964-1800-0000-7a24-1d4c970b0000 pid=2967 execve guuid=66fc9f64-1800-0000-7a24-1d4c980b0000 pid=2968 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=66fc9f64-1800-0000-7a24-1d4c980b0000 pid=2968 execve guuid=46f16a65-1800-0000-7a24-1d4c9a0b0000 pid=2970 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=46f16a65-1800-0000-7a24-1d4c9a0b0000 pid=2970 execve guuid=b2d21066-1800-0000-7a24-1d4c9d0b0000 pid=2973 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=b2d21066-1800-0000-7a24-1d4c9d0b0000 pid=2973 execve guuid=46359b66-1800-0000-7a24-1d4c9f0b0000 pid=2975 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=46359b66-1800-0000-7a24-1d4c9f0b0000 pid=2975 execve guuid=8b392a67-1800-0000-7a24-1d4ca10b0000 pid=2977 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=8b392a67-1800-0000-7a24-1d4ca10b0000 pid=2977 execve guuid=a6c5ab67-1800-0000-7a24-1d4ca40b0000 pid=2980 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=a6c5ab67-1800-0000-7a24-1d4ca40b0000 pid=2980 execve guuid=f6bf1468-1800-0000-7a24-1d4ca60b0000 pid=2982 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=f6bf1468-1800-0000-7a24-1d4ca60b0000 pid=2982 execve guuid=de32b268-1800-0000-7a24-1d4ca70b0000 pid=2983 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=de32b268-1800-0000-7a24-1d4ca70b0000 pid=2983 execve guuid=3c393969-1800-0000-7a24-1d4ca80b0000 pid=2984 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=3c393969-1800-0000-7a24-1d4ca80b0000 pid=2984 execve guuid=43bdaf69-1800-0000-7a24-1d4caa0b0000 pid=2986 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=43bdaf69-1800-0000-7a24-1d4caa0b0000 pid=2986 execve guuid=0d5e1a6a-1800-0000-7a24-1d4cac0b0000 pid=2988 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=0d5e1a6a-1800-0000-7a24-1d4cac0b0000 pid=2988 execve guuid=dcee7f6a-1800-0000-7a24-1d4cae0b0000 pid=2990 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=dcee7f6a-1800-0000-7a24-1d4cae0b0000 pid=2990 execve guuid=4d7ce96a-1800-0000-7a24-1d4cb00b0000 pid=2992 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=4d7ce96a-1800-0000-7a24-1d4cb00b0000 pid=2992 execve guuid=e6d24e6b-1800-0000-7a24-1d4cb30b0000 pid=2995 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=e6d24e6b-1800-0000-7a24-1d4cb30b0000 pid=2995 execve guuid=2c99156c-1800-0000-7a24-1d4cb60b0000 pid=2998 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=2c99156c-1800-0000-7a24-1d4cb60b0000 pid=2998 execve guuid=f01d6f6c-1800-0000-7a24-1d4cb80b0000 pid=3000 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=f01d6f6c-1800-0000-7a24-1d4cb80b0000 pid=3000 execve guuid=4b1cca6c-1800-0000-7a24-1d4cbb0b0000 pid=3003 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=4b1cca6c-1800-0000-7a24-1d4cbb0b0000 pid=3003 execve guuid=9dfe2e6d-1800-0000-7a24-1d4cbd0b0000 pid=3005 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=9dfe2e6d-1800-0000-7a24-1d4cbd0b0000 pid=3005 execve guuid=78378f6d-1800-0000-7a24-1d4cc00b0000 pid=3008 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=78378f6d-1800-0000-7a24-1d4cc00b0000 pid=3008 execve guuid=1244eb6d-1800-0000-7a24-1d4cc20b0000 pid=3010 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=1244eb6d-1800-0000-7a24-1d4cc20b0000 pid=3010 execve guuid=6f79496e-1800-0000-7a24-1d4cc50b0000 pid=3013 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=6f79496e-1800-0000-7a24-1d4cc50b0000 pid=3013 execve guuid=b34eaa6e-1800-0000-7a24-1d4cc70b0000 pid=3015 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=b34eaa6e-1800-0000-7a24-1d4cc70b0000 pid=3015 execve guuid=1117106f-1800-0000-7a24-1d4cc90b0000 pid=3017 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=1117106f-1800-0000-7a24-1d4cc90b0000 pid=3017 execve guuid=e8b9906f-1800-0000-7a24-1d4cca0b0000 pid=3018 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=e8b9906f-1800-0000-7a24-1d4cca0b0000 pid=3018 execve guuid=db25f96f-1800-0000-7a24-1d4ccc0b0000 pid=3020 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=db25f96f-1800-0000-7a24-1d4ccc0b0000 pid=3020 execve guuid=556b7c70-1800-0000-7a24-1d4ccd0b0000 pid=3021 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=556b7c70-1800-0000-7a24-1d4ccd0b0000 pid=3021 execve guuid=22c8f370-1800-0000-7a24-1d4cce0b0000 pid=3022 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=22c8f370-1800-0000-7a24-1d4cce0b0000 pid=3022 execve guuid=ce946d71-1800-0000-7a24-1d4ccf0b0000 pid=3023 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=ce946d71-1800-0000-7a24-1d4ccf0b0000 pid=3023 execve guuid=5b6ad771-1800-0000-7a24-1d4cd20b0000 pid=3026 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=5b6ad771-1800-0000-7a24-1d4cd20b0000 pid=3026 execve guuid=b58c8072-1800-0000-7a24-1d4cd50b0000 pid=3029 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=b58c8072-1800-0000-7a24-1d4cd50b0000 pid=3029 execve guuid=c77ce572-1800-0000-7a24-1d4cd70b0000 pid=3031 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=c77ce572-1800-0000-7a24-1d4cd70b0000 pid=3031 execve guuid=33fc4773-1800-0000-7a24-1d4cd90b0000 pid=3033 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=33fc4773-1800-0000-7a24-1d4cd90b0000 pid=3033 execve guuid=5f9bc673-1800-0000-7a24-1d4cdb0b0000 pid=3035 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=5f9bc673-1800-0000-7a24-1d4cdb0b0000 pid=3035 execve guuid=41932d74-1800-0000-7a24-1d4cdd0b0000 pid=3037 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=41932d74-1800-0000-7a24-1d4cdd0b0000 pid=3037 execve guuid=5fae9e74-1800-0000-7a24-1d4ce00b0000 pid=3040 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=5fae9e74-1800-0000-7a24-1d4ce00b0000 pid=3040 execve guuid=b6f82e75-1800-0000-7a24-1d4ce10b0000 pid=3041 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=b6f82e75-1800-0000-7a24-1d4ce10b0000 pid=3041 execve guuid=21d89d75-1800-0000-7a24-1d4ce20b0000 pid=3042 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=21d89d75-1800-0000-7a24-1d4ce20b0000 pid=3042 execve guuid=3d090176-1800-0000-7a24-1d4ce30b0000 pid=3043 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=3d090176-1800-0000-7a24-1d4ce30b0000 pid=3043 execve guuid=c8577a76-1800-0000-7a24-1d4ce40b0000 pid=3044 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=c8577a76-1800-0000-7a24-1d4ce40b0000 pid=3044 execve guuid=bc11e676-1800-0000-7a24-1d4ce50b0000 pid=3045 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=bc11e676-1800-0000-7a24-1d4ce50b0000 pid=3045 execve guuid=ef274777-1800-0000-7a24-1d4ce60b0000 pid=3046 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=ef274777-1800-0000-7a24-1d4ce60b0000 pid=3046 execve guuid=c5a0ae77-1800-0000-7a24-1d4ce70b0000 pid=3047 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=c5a0ae77-1800-0000-7a24-1d4ce70b0000 pid=3047 execve guuid=469d1878-1800-0000-7a24-1d4ce80b0000 pid=3048 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=469d1878-1800-0000-7a24-1d4ce80b0000 pid=3048 execve guuid=4bbaa178-1800-0000-7a24-1d4cea0b0000 pid=3050 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=4bbaa178-1800-0000-7a24-1d4cea0b0000 pid=3050 execve guuid=45ae4e79-1800-0000-7a24-1d4ceb0b0000 pid=3051 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=45ae4e79-1800-0000-7a24-1d4ceb0b0000 pid=3051 execve guuid=c4030d7a-1800-0000-7a24-1d4ced0b0000 pid=3053 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=c4030d7a-1800-0000-7a24-1d4ced0b0000 pid=3053 execve guuid=2e72b17a-1800-0000-7a24-1d4cf00b0000 pid=3056 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=2e72b17a-1800-0000-7a24-1d4cf00b0000 pid=3056 execve guuid=f6075e7b-1800-0000-7a24-1d4cf30b0000 pid=3059 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=f6075e7b-1800-0000-7a24-1d4cf30b0000 pid=3059 execve guuid=4109e57b-1800-0000-7a24-1d4cf60b0000 pid=3062 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=4109e57b-1800-0000-7a24-1d4cf60b0000 pid=3062 execve guuid=250a897c-1800-0000-7a24-1d4cf90b0000 pid=3065 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=250a897c-1800-0000-7a24-1d4cf90b0000 pid=3065 execve guuid=7e811a7d-1800-0000-7a24-1d4cfb0b0000 pid=3067 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=7e811a7d-1800-0000-7a24-1d4cfb0b0000 pid=3067 execve guuid=200b9d7d-1800-0000-7a24-1d4cfc0b0000 pid=3068 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=200b9d7d-1800-0000-7a24-1d4cfc0b0000 pid=3068 execve guuid=42751d7e-1800-0000-7a24-1d4cfe0b0000 pid=3070 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=42751d7e-1800-0000-7a24-1d4cfe0b0000 pid=3070 execve guuid=1eccab7e-1800-0000-7a24-1d4cff0b0000 pid=3071 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=1eccab7e-1800-0000-7a24-1d4cff0b0000 pid=3071 execve guuid=0194237f-1800-0000-7a24-1d4c000c0000 pid=3072 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=0194237f-1800-0000-7a24-1d4c000c0000 pid=3072 execve guuid=26c3a77f-1800-0000-7a24-1d4c030c0000 pid=3075 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=26c3a77f-1800-0000-7a24-1d4c030c0000 pid=3075 execve guuid=dd9d2280-1800-0000-7a24-1d4c060c0000 pid=3078 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=dd9d2280-1800-0000-7a24-1d4c060c0000 pid=3078 execve guuid=385e8c80-1800-0000-7a24-1d4c080c0000 pid=3080 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=385e8c80-1800-0000-7a24-1d4c080c0000 pid=3080 execve guuid=0ae2f680-1800-0000-7a24-1d4c0a0c0000 pid=3082 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=0ae2f680-1800-0000-7a24-1d4c0a0c0000 pid=3082 execve guuid=f7ae6081-1800-0000-7a24-1d4c0d0c0000 pid=3085 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=f7ae6081-1800-0000-7a24-1d4c0d0c0000 pid=3085 execve guuid=2fbb5c82-1800-0000-7a24-1d4c110c0000 pid=3089 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=2fbb5c82-1800-0000-7a24-1d4c110c0000 pid=3089 execve guuid=2b5ae282-1800-0000-7a24-1d4c130c0000 pid=3091 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=2b5ae282-1800-0000-7a24-1d4c130c0000 pid=3091 execve guuid=b4615083-1800-0000-7a24-1d4c160c0000 pid=3094 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=b4615083-1800-0000-7a24-1d4c160c0000 pid=3094 execve guuid=4f7db783-1800-0000-7a24-1d4c180c0000 pid=3096 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=4f7db783-1800-0000-7a24-1d4c180c0000 pid=3096 execve guuid=02221e84-1800-0000-7a24-1d4c1b0c0000 pid=3099 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=02221e84-1800-0000-7a24-1d4c1b0c0000 pid=3099 execve guuid=97819184-1800-0000-7a24-1d4c1d0c0000 pid=3101 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=97819184-1800-0000-7a24-1d4c1d0c0000 pid=3101 execve guuid=e4690385-1800-0000-7a24-1d4c1f0c0000 pid=3103 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=e4690385-1800-0000-7a24-1d4c1f0c0000 pid=3103 execve guuid=d6388085-1800-0000-7a24-1d4c220c0000 pid=3106 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=d6388085-1800-0000-7a24-1d4c220c0000 pid=3106 execve guuid=7ba0e785-1800-0000-7a24-1d4c240c0000 pid=3108 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=7ba0e785-1800-0000-7a24-1d4c240c0000 pid=3108 execve guuid=7e066086-1800-0000-7a24-1d4c270c0000 pid=3111 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=7e066086-1800-0000-7a24-1d4c270c0000 pid=3111 execve guuid=0d53d486-1800-0000-7a24-1d4c2a0c0000 pid=3114 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=0d53d486-1800-0000-7a24-1d4c2a0c0000 pid=3114 execve guuid=a3746f87-1800-0000-7a24-1d4c2d0c0000 pid=3117 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=a3746f87-1800-0000-7a24-1d4c2d0c0000 pid=3117 execve guuid=a717d587-1800-0000-7a24-1d4c2f0c0000 pid=3119 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=a717d587-1800-0000-7a24-1d4c2f0c0000 pid=3119 execve guuid=26364488-1800-0000-7a24-1d4c320c0000 pid=3122 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=26364488-1800-0000-7a24-1d4c320c0000 pid=3122 execve guuid=cd50a788-1800-0000-7a24-1d4c340c0000 pid=3124 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=cd50a788-1800-0000-7a24-1d4c340c0000 pid=3124 execve guuid=baf30489-1800-0000-7a24-1d4c360c0000 pid=3126 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=baf30489-1800-0000-7a24-1d4c360c0000 pid=3126 execve guuid=81b85e89-1800-0000-7a24-1d4c390c0000 pid=3129 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=81b85e89-1800-0000-7a24-1d4c390c0000 pid=3129 execve guuid=825cbb89-1800-0000-7a24-1d4c3b0c0000 pid=3131 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=825cbb89-1800-0000-7a24-1d4c3b0c0000 pid=3131 execve guuid=dd34258a-1800-0000-7a24-1d4c3e0c0000 pid=3134 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=dd34258a-1800-0000-7a24-1d4c3e0c0000 pid=3134 execve guuid=98baa18a-1800-0000-7a24-1d4c400c0000 pid=3136 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=98baa18a-1800-0000-7a24-1d4c400c0000 pid=3136 execve guuid=1f42178b-1800-0000-7a24-1d4c420c0000 pid=3138 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=1f42178b-1800-0000-7a24-1d4c420c0000 pid=3138 execve guuid=2643ac8b-1800-0000-7a24-1d4c440c0000 pid=3140 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=2643ac8b-1800-0000-7a24-1d4c440c0000 pid=3140 execve guuid=17841e8c-1800-0000-7a24-1d4c470c0000 pid=3143 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=17841e8c-1800-0000-7a24-1d4c470c0000 pid=3143 execve guuid=8b358f8c-1800-0000-7a24-1d4c490c0000 pid=3145 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=8b358f8c-1800-0000-7a24-1d4c490c0000 pid=3145 execve guuid=7113208d-1800-0000-7a24-1d4c4c0c0000 pid=3148 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=7113208d-1800-0000-7a24-1d4c4c0c0000 pid=3148 execve guuid=ce428a8d-1800-0000-7a24-1d4c4e0c0000 pid=3150 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=ce428a8d-1800-0000-7a24-1d4c4e0c0000 pid=3150 execve guuid=debf0c8e-1800-0000-7a24-1d4c500c0000 pid=3152 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=debf0c8e-1800-0000-7a24-1d4c500c0000 pid=3152 execve guuid=43a68c8e-1800-0000-7a24-1d4c530c0000 pid=3155 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=43a68c8e-1800-0000-7a24-1d4c530c0000 pid=3155 execve guuid=688c1c8f-1800-0000-7a24-1d4c560c0000 pid=3158 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=688c1c8f-1800-0000-7a24-1d4c560c0000 pid=3158 execve guuid=b685838f-1800-0000-7a24-1d4c580c0000 pid=3160 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=b685838f-1800-0000-7a24-1d4c580c0000 pid=3160 execve guuid=f0d7ed8f-1800-0000-7a24-1d4c5a0c0000 pid=3162 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=f0d7ed8f-1800-0000-7a24-1d4c5a0c0000 pid=3162 execve guuid=762a5890-1800-0000-7a24-1d4c5c0c0000 pid=3164 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=762a5890-1800-0000-7a24-1d4c5c0c0000 pid=3164 execve guuid=cfffcf90-1800-0000-7a24-1d4c600c0000 pid=3168 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=cfffcf90-1800-0000-7a24-1d4c600c0000 pid=3168 execve guuid=08f94291-1800-0000-7a24-1d4c610c0000 pid=3169 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=08f94291-1800-0000-7a24-1d4c610c0000 pid=3169 execve guuid=5feee991-1800-0000-7a24-1d4c640c0000 pid=3172 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=5feee991-1800-0000-7a24-1d4c640c0000 pid=3172 execve guuid=6c4c9692-1800-0000-7a24-1d4c680c0000 pid=3176 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=6c4c9692-1800-0000-7a24-1d4c680c0000 pid=3176 execve guuid=1de64393-1800-0000-7a24-1d4c6a0c0000 pid=3178 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=1de64393-1800-0000-7a24-1d4c6a0c0000 pid=3178 execve guuid=934ab993-1800-0000-7a24-1d4c6d0c0000 pid=3181 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=934ab993-1800-0000-7a24-1d4c6d0c0000 pid=3181 execve guuid=cbbb3294-1800-0000-7a24-1d4c6f0c0000 pid=3183 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=cbbb3294-1800-0000-7a24-1d4c6f0c0000 pid=3183 execve guuid=6208a694-1800-0000-7a24-1d4c710c0000 pid=3185 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=6208a694-1800-0000-7a24-1d4c710c0000 pid=3185 execve guuid=fda21d95-1800-0000-7a24-1d4c740c0000 pid=3188 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=fda21d95-1800-0000-7a24-1d4c740c0000 pid=3188 execve guuid=239ea995-1800-0000-7a24-1d4c750c0000 pid=3189 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=239ea995-1800-0000-7a24-1d4c750c0000 pid=3189 execve guuid=d7b93f96-1800-0000-7a24-1d4c770c0000 pid=3191 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=d7b93f96-1800-0000-7a24-1d4c770c0000 pid=3191 execve guuid=35b8bf96-1800-0000-7a24-1d4c780c0000 pid=3192 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=35b8bf96-1800-0000-7a24-1d4c780c0000 pid=3192 execve guuid=b8f85197-1800-0000-7a24-1d4c790c0000 pid=3193 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=b8f85197-1800-0000-7a24-1d4c790c0000 pid=3193 execve guuid=54c50498-1800-0000-7a24-1d4c7a0c0000 pid=3194 /usr/bin/ls guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=54c50498-1800-0000-7a24-1d4c7a0c0000 pid=3194 execve guuid=14aaad98-1800-0000-7a24-1d4c7c0c0000 pid=3196 /usr/bin/rm guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=14aaad98-1800-0000-7a24-1d4c7c0c0000 pid=3196 execve guuid=f9851599-1800-0000-7a24-1d4c7e0c0000 pid=3198 /usr/bin/wget net send-data write-file guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=f9851599-1800-0000-7a24-1d4c7e0c0000 pid=3198 execve guuid=d6fa9da1-1800-0000-7a24-1d4c8e0c0000 pid=3214 /usr/bin/chmod guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=d6fa9da1-1800-0000-7a24-1d4c8e0c0000 pid=3214 execve guuid=abf6f2a1-1800-0000-7a24-1d4c900c0000 pid=3216 /tmp/qUbz guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=abf6f2a1-1800-0000-7a24-1d4c900c0000 pid=3216 execve guuid=105ad7a2-1800-0000-7a24-1d4c940c0000 pid=3220 /usr/bin/rm guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=105ad7a2-1800-0000-7a24-1d4c940c0000 pid=3220 execve guuid=184034a3-1800-0000-7a24-1d4c960c0000 pid=3222 /usr/bin/wget net send-data write-file guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=184034a3-1800-0000-7a24-1d4c960c0000 pid=3222 execve guuid=69da17aa-1800-0000-7a24-1d4ca10c0000 pid=3233 /usr/bin/chmod guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=69da17aa-1800-0000-7a24-1d4ca10c0000 pid=3233 execve guuid=9d8f63aa-1800-0000-7a24-1d4ca30c0000 pid=3235 /tmp/qX2n guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=9d8f63aa-1800-0000-7a24-1d4ca30c0000 pid=3235 execve guuid=7e33a2ab-1800-0000-7a24-1d4ca80c0000 pid=3240 /usr/bin/rm guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=7e33a2ab-1800-0000-7a24-1d4ca80c0000 pid=3240 execve guuid=fbb4f6ab-1800-0000-7a24-1d4caa0c0000 pid=3242 /usr/bin/wget net send-data write-file guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=fbb4f6ab-1800-0000-7a24-1d4caa0c0000 pid=3242 execve guuid=2fd5bcf0-1800-0000-7a24-1d4c0b0d0000 pid=3339 /usr/bin/chmod guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=2fd5bcf0-1800-0000-7a24-1d4c0b0d0000 pid=3339 execve guuid=fa006bf1-1800-0000-7a24-1d4c0c0d0000 pid=3340 /tmp/gSN guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=fa006bf1-1800-0000-7a24-1d4c0c0d0000 pid=3340 execve guuid=745f93f3-1800-0000-7a24-1d4c0e0d0000 pid=3342 /usr/bin/rm guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=745f93f3-1800-0000-7a24-1d4c0e0d0000 pid=3342 execve guuid=78b6ebf3-1800-0000-7a24-1d4c0f0d0000 pid=3343 /usr/bin/wget net send-data write-file guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=78b6ebf3-1800-0000-7a24-1d4c0f0d0000 pid=3343 execve guuid=796c4afa-1800-0000-7a24-1d4c1a0d0000 pid=3354 /usr/bin/chmod guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=796c4afa-1800-0000-7a24-1d4c1a0d0000 pid=3354 execve guuid=ce5e88fa-1800-0000-7a24-1d4c1b0d0000 pid=3355 /tmp/yjJk guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=ce5e88fa-1800-0000-7a24-1d4c1b0d0000 pid=3355 execve guuid=a68d2ffb-1800-0000-7a24-1d4c1f0d0000 pid=3359 /usr/bin/rm guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=a68d2ffb-1800-0000-7a24-1d4c1f0d0000 pid=3359 execve guuid=f71668fb-1800-0000-7a24-1d4c210d0000 pid=3361 /usr/bin/wget net send-data write-file guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=f71668fb-1800-0000-7a24-1d4c210d0000 pid=3361 execve guuid=d859ed01-1900-0000-7a24-1d4c2a0d0000 pid=3370 /usr/bin/chmod guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=d859ed01-1900-0000-7a24-1d4c2a0d0000 pid=3370 execve guuid=662b4102-1900-0000-7a24-1d4c2b0d0000 pid=3371 /tmp/Lqcu guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=662b4102-1900-0000-7a24-1d4c2b0d0000 pid=3371 execve guuid=515d4a03-1900-0000-7a24-1d4c2d0d0000 pid=3373 /usr/bin/rm delete-file guuid=e3c8c65d-1800-0000-7a24-1d4c810b0000 pid=2945->guuid=515d4a03-1900-0000-7a24-1d4c2d0d0000 pid=3373 execve 9554d36e-3083-568e-90da-bb8e3c487b07 188.132.232.81:80 guuid=f9851599-1800-0000-7a24-1d4c7e0c0000 pid=3198->9554d36e-3083-568e-90da-bb8e3c487b07 send: 133B guuid=184034a3-1800-0000-7a24-1d4c960c0000 pid=3222->9554d36e-3083-568e-90da-bb8e3c487b07 send: 133B guuid=fbb4f6ab-1800-0000-7a24-1d4caa0c0000 pid=3242->9554d36e-3083-568e-90da-bb8e3c487b07 send: 132B guuid=78b6ebf3-1800-0000-7a24-1d4c0f0d0000 pid=3343->9554d36e-3083-568e-90da-bb8e3c487b07 send: 133B guuid=f71668fb-1800-0000-7a24-1d4c210d0000 pid=3361->9554d36e-3083-568e-90da-bb8e3c487b07 send: 133B
Score:
94%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/75b4ad0d28327c63a52c94ea6f67b5da3f843840f8259055f280bdf3fdc07ef7
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/75b4ad0d28327c63a52c94ea6f67b5da3f843840f8259055f280bdf3fdc07ef7/
Verdict:
Malicious
Threat:
Trojan-Downloader.Shell.Agent
Link:
https://tip.neiki.dev/file/75b4ad0d28327c63a52c94ea6f67b5da3f843840f8259055f280bdf3fdc07ef7
Threat name:
Win32.Trojan.Malgent
Create hunting rule
Status:
Malicious
First seen:
2026-06-05 20:05:55 UTC
File Type:
Text (Shell)
AV detection:
9 of 22 (40.91%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ow2k2djigj6ghjjmstvg6z5v3i7yioca7aszavpsqc67h7oap33q._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
defense_evasion discovery linux
Link:
https://tria.ge/reports/260605-yt78esew5m/
Behaviour
Reads runtime system information
Writes file to tmp directory
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.26
Link:
https://yomi.yoroi.company/submissions/75b4ad0d28327c63a52c94ea6f67b5da3f843840f8259055f280bdf3fdc07ef7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 75b4ad0d28327c63a52c94ea6f67b5da3f843840f8259055f280bdf3fdc07ef7

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3856431/
  
Delivery method
Distributed via web download

Comments