🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8e502016a2e93832924a1a4a558ed18b05a13cca02bddcf0bcf9e32aed781753. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8e502016a2e93832924a1a4a558ed18b05a13cca02bddcf0bcf9e32aed781753
SHA3-384 hash: 32f299c9a5d90b0990ac2b178e546d1c00e8944dc2a151d5302dad71038e05b622d7a2dac1bb88f1a9e08168514dc63f
SHA1 hash: 78972c3038b4be9a1d89e97317ff400b47ff3890
MD5 hash: bc9c77eed42680f1b71ddd3eff75bfba
humanhash: oven-arkansas-september-high
File name:lil
Download: download sample
File size:839 bytes
First seen:2026-06-02 07:35:10 UTC
Last seen:2026-06-03 02:00:25 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkaiIS5IDNn/nc1I8OIxcFIsTX:kXCKysE2hi0ziQvZohaiRG/c1Oq+PTX
TLSH T1DC01EFCFC001CB90C1D6F49C32C75584F821C3CB25168BB4BEAC443D8BE6A58B066F84
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://188.132.232.81/4ULn/an/aelf ua-wget
http://188.132.232.81/RKuZn/an/aelf ua-wget
http://188.132.232.81/TRH1n/an/aelf ua-wget
http://188.132.232.81/Yt2n/an/aelf ua-wget
http://188.132.232.81/AmPn/an/aelf ua-wget

Intelligence

File Origin
# of uploads :
2
# of downloads :
60
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive
Link:
https://www.filescan.io/uploads/6a1e87b746e44aecc0c98ab0/reports/b4751977-0844-48ad-866f-ab12929db900/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-06-02T05:03:00Z UTC
Last seen:
2026-06-03T19:31:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan-Downloader.Shell.Agent.a
Link:
https://opentip.kaspersky.com/8e502016a2e93832924a1a4a558ed18b05a13cca02bddcf0bcf9e32aed781753/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/ec0d56dd-1ed3-43c1-83ed-82fc3f6187b5
Behavior Graph:
Download SVG
%3 guuid=4bb7e2d4-1600-0000-8775-d7625a0f0000 pid=3930 /usr/bin/sudo guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939 /tmp/sample.bin write-file guuid=4bb7e2d4-1600-0000-8775-d7625a0f0000 pid=3930->guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939 execve guuid=f9ee55d7-1600-0000-8775-d762650f0000 pid=3941 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=f9ee55d7-1600-0000-8775-d762650f0000 pid=3941 execve guuid=1ac1e5d7-1600-0000-8775-d762690f0000 pid=3945 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=1ac1e5d7-1600-0000-8775-d762690f0000 pid=3945 execve guuid=6c2588d8-1600-0000-8775-d7626a0f0000 pid=3946 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=6c2588d8-1600-0000-8775-d7626a0f0000 pid=3946 execve guuid=683f5ad9-1600-0000-8775-d7626d0f0000 pid=3949 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=683f5ad9-1600-0000-8775-d7626d0f0000 pid=3949 execve guuid=b300b1d9-1600-0000-8775-d762710f0000 pid=3953 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=b300b1d9-1600-0000-8775-d762710f0000 pid=3953 execve guuid=23fe06da-1600-0000-8775-d762730f0000 pid=3955 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=23fe06da-1600-0000-8775-d762730f0000 pid=3955 execve guuid=a69866da-1600-0000-8775-d762750f0000 pid=3957 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=a69866da-1600-0000-8775-d762750f0000 pid=3957 execve guuid=d65fbdda-1600-0000-8775-d762780f0000 pid=3960 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=d65fbdda-1600-0000-8775-d762780f0000 pid=3960 execve guuid=01b70edb-1600-0000-8775-d7627c0f0000 pid=3964 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=01b70edb-1600-0000-8775-d7627c0f0000 pid=3964 execve guuid=d36968db-1600-0000-8775-d7627f0f0000 pid=3967 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=d36968db-1600-0000-8775-d7627f0f0000 pid=3967 execve guuid=a848c4db-1600-0000-8775-d762810f0000 pid=3969 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=a848c4db-1600-0000-8775-d762810f0000 pid=3969 execve guuid=52bc1edc-1600-0000-8775-d762830f0000 pid=3971 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=52bc1edc-1600-0000-8775-d762830f0000 pid=3971 execve guuid=50d67adc-1600-0000-8775-d762860f0000 pid=3974 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=50d67adc-1600-0000-8775-d762860f0000 pid=3974 execve guuid=1d9fd2dc-1600-0000-8775-d762880f0000 pid=3976 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=1d9fd2dc-1600-0000-8775-d762880f0000 pid=3976 execve guuid=eebb27dd-1600-0000-8775-d7628a0f0000 pid=3978 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=eebb27dd-1600-0000-8775-d7628a0f0000 pid=3978 execve guuid=f65882dd-1600-0000-8775-d7628e0f0000 pid=3982 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=f65882dd-1600-0000-8775-d7628e0f0000 pid=3982 execve guuid=f7daf3dd-1600-0000-8775-d7628f0f0000 pid=3983 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=f7daf3dd-1600-0000-8775-d7628f0f0000 pid=3983 execve guuid=e72b4ade-1600-0000-8775-d762930f0000 pid=3987 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=e72b4ade-1600-0000-8775-d762930f0000 pid=3987 execve guuid=0550a4de-1600-0000-8775-d762950f0000 pid=3989 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=0550a4de-1600-0000-8775-d762950f0000 pid=3989 execve guuid=548361df-1600-0000-8775-d762990f0000 pid=3993 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=548361df-1600-0000-8775-d762990f0000 pid=3993 execve guuid=7d76e0df-1600-0000-8775-d7629c0f0000 pid=3996 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=7d76e0df-1600-0000-8775-d7629c0f0000 pid=3996 execve guuid=f5754ee0-1600-0000-8775-d7629f0f0000 pid=3999 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=f5754ee0-1600-0000-8775-d7629f0f0000 pid=3999 execve guuid=4d4cbae0-1600-0000-8775-d762a30f0000 pid=4003 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=4d4cbae0-1600-0000-8775-d762a30f0000 pid=4003 execve guuid=568527e1-1600-0000-8775-d762a60f0000 pid=4006 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=568527e1-1600-0000-8775-d762a60f0000 pid=4006 execve guuid=cfdc8be1-1600-0000-8775-d762a80f0000 pid=4008 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=cfdc8be1-1600-0000-8775-d762a80f0000 pid=4008 execve guuid=ab46fae1-1600-0000-8775-d762aa0f0000 pid=4010 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=ab46fae1-1600-0000-8775-d762aa0f0000 pid=4010 execve guuid=d0b570e2-1600-0000-8775-d762ac0f0000 pid=4012 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=d0b570e2-1600-0000-8775-d762ac0f0000 pid=4012 execve guuid=0f63d3e2-1600-0000-8775-d762b00f0000 pid=4016 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=0f63d3e2-1600-0000-8775-d762b00f0000 pid=4016 execve guuid=ae6d34e3-1600-0000-8775-d762b40f0000 pid=4020 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=ae6d34e3-1600-0000-8775-d762b40f0000 pid=4020 execve guuid=c3f998e3-1600-0000-8775-d762b60f0000 pid=4022 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=c3f998e3-1600-0000-8775-d762b60f0000 pid=4022 execve guuid=6a97ffe3-1600-0000-8775-d762b80f0000 pid=4024 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=6a97ffe3-1600-0000-8775-d762b80f0000 pid=4024 execve guuid=023365e4-1600-0000-8775-d762bb0f0000 pid=4027 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=023365e4-1600-0000-8775-d762bb0f0000 pid=4027 execve guuid=1720c4e4-1600-0000-8775-d762bd0f0000 pid=4029 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=1720c4e4-1600-0000-8775-d762bd0f0000 pid=4029 execve guuid=e8f921e5-1600-0000-8775-d762bf0f0000 pid=4031 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=e8f921e5-1600-0000-8775-d762bf0f0000 pid=4031 execve guuid=f6237be5-1600-0000-8775-d762c10f0000 pid=4033 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=f6237be5-1600-0000-8775-d762c10f0000 pid=4033 execve guuid=4e55d9e5-1600-0000-8775-d762c30f0000 pid=4035 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=4e55d9e5-1600-0000-8775-d762c30f0000 pid=4035 execve guuid=317534e6-1600-0000-8775-d762c70f0000 pid=4039 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=317534e6-1600-0000-8775-d762c70f0000 pid=4039 execve guuid=fb94a3e6-1600-0000-8775-d762c80f0000 pid=4040 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=fb94a3e6-1600-0000-8775-d762c80f0000 pid=4040 execve guuid=0628ffe6-1600-0000-8775-d762cc0f0000 pid=4044 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=0628ffe6-1600-0000-8775-d762cc0f0000 pid=4044 execve guuid=872358e7-1600-0000-8775-d762ce0f0000 pid=4046 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=872358e7-1600-0000-8775-d762ce0f0000 pid=4046 execve guuid=2bf5b0e7-1600-0000-8775-d762d00f0000 pid=4048 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=2bf5b0e7-1600-0000-8775-d762d00f0000 pid=4048 execve guuid=acd80be8-1600-0000-8775-d762d20f0000 pid=4050 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=acd80be8-1600-0000-8775-d762d20f0000 pid=4050 execve guuid=af345ee8-1600-0000-8775-d762d40f0000 pid=4052 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=af345ee8-1600-0000-8775-d762d40f0000 pid=4052 execve guuid=78fbbfe8-1600-0000-8775-d762d70f0000 pid=4055 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=78fbbfe8-1600-0000-8775-d762d70f0000 pid=4055 execve guuid=50f333e9-1600-0000-8775-d762da0f0000 pid=4058 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=50f333e9-1600-0000-8775-d762da0f0000 pid=4058 execve guuid=9531b2e9-1600-0000-8775-d762de0f0000 pid=4062 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=9531b2e9-1600-0000-8775-d762de0f0000 pid=4062 execve guuid=c8a728ea-1600-0000-8775-d762e20f0000 pid=4066 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=c8a728ea-1600-0000-8775-d762e20f0000 pid=4066 execve guuid=e79fa5ea-1600-0000-8775-d762e30f0000 pid=4067 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=e79fa5ea-1600-0000-8775-d762e30f0000 pid=4067 execve guuid=3f7119eb-1600-0000-8775-d762e50f0000 pid=4069 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=3f7119eb-1600-0000-8775-d762e50f0000 pid=4069 execve guuid=cef580eb-1600-0000-8775-d762e70f0000 pid=4071 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=cef580eb-1600-0000-8775-d762e70f0000 pid=4071 execve guuid=c59bf8eb-1600-0000-8775-d762ee0f0000 pid=4078 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=c59bf8eb-1600-0000-8775-d762ee0f0000 pid=4078 execve guuid=c2b94fec-1600-0000-8775-d762ef0f0000 pid=4079 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=c2b94fec-1600-0000-8775-d762ef0f0000 pid=4079 execve guuid=0478a7ec-1600-0000-8775-d762f20f0000 pid=4082 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=0478a7ec-1600-0000-8775-d762f20f0000 pid=4082 execve guuid=1835f3ec-1600-0000-8775-d762f40f0000 pid=4084 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=1835f3ec-1600-0000-8775-d762f40f0000 pid=4084 execve guuid=ba2a5fed-1600-0000-8775-d762f70f0000 pid=4087 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=ba2a5fed-1600-0000-8775-d762f70f0000 pid=4087 execve guuid=6f4ab5ed-1600-0000-8775-d762f90f0000 pid=4089 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=6f4ab5ed-1600-0000-8775-d762f90f0000 pid=4089 execve guuid=e4c907ee-1600-0000-8775-d762fc0f0000 pid=4092 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=e4c907ee-1600-0000-8775-d762fc0f0000 pid=4092 execve guuid=e60f86ee-1600-0000-8775-d762fe0f0000 pid=4094 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=e60f86ee-1600-0000-8775-d762fe0f0000 pid=4094 execve guuid=41e3f7ee-1600-0000-8775-d76202100000 pid=4098 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=41e3f7ee-1600-0000-8775-d76202100000 pid=4098 execve guuid=f727beef-1600-0000-8775-d76205100000 pid=4101 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=f727beef-1600-0000-8775-d76205100000 pid=4101 execve guuid=c60b0ef0-1600-0000-8775-d76208100000 pid=4104 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=c60b0ef0-1600-0000-8775-d76208100000 pid=4104 execve guuid=f185bcf0-1600-0000-8775-d7620b100000 pid=4107 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=f185bcf0-1600-0000-8775-d7620b100000 pid=4107 execve guuid=601c11f1-1600-0000-8775-d7620f100000 pid=4111 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=601c11f1-1600-0000-8775-d7620f100000 pid=4111 execve guuid=da846cf1-1600-0000-8775-d76213100000 pid=4115 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=da846cf1-1600-0000-8775-d76213100000 pid=4115 execve guuid=99d0caf1-1600-0000-8775-d76214100000 pid=4116 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=99d0caf1-1600-0000-8775-d76214100000 pid=4116 execve guuid=49d41ef2-1600-0000-8775-d76217100000 pid=4119 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=49d41ef2-1600-0000-8775-d76217100000 pid=4119 execve guuid=6bec74f2-1600-0000-8775-d76219100000 pid=4121 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=6bec74f2-1600-0000-8775-d76219100000 pid=4121 execve guuid=73a4ccf2-1600-0000-8775-d7621c100000 pid=4124 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=73a4ccf2-1600-0000-8775-d7621c100000 pid=4124 execve guuid=216a2df3-1600-0000-8775-d7621e100000 pid=4126 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=216a2df3-1600-0000-8775-d7621e100000 pid=4126 execve guuid=a33e85f3-1600-0000-8775-d76221100000 pid=4129 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=a33e85f3-1600-0000-8775-d76221100000 pid=4129 execve guuid=8612e8f3-1600-0000-8775-d76222100000 pid=4130 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=8612e8f3-1600-0000-8775-d76222100000 pid=4130 execve guuid=1d4445f4-1600-0000-8775-d76226100000 pid=4134 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=1d4445f4-1600-0000-8775-d76226100000 pid=4134 execve guuid=bae0a0f4-1600-0000-8775-d7622a100000 pid=4138 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=bae0a0f4-1600-0000-8775-d7622a100000 pid=4138 execve guuid=1052fcf4-1600-0000-8775-d7622c100000 pid=4140 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=1052fcf4-1600-0000-8775-d7622c100000 pid=4140 execve guuid=ed9851f5-1600-0000-8775-d7622e100000 pid=4142 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=ed9851f5-1600-0000-8775-d7622e100000 pid=4142 execve guuid=7acba3f5-1600-0000-8775-d76231100000 pid=4145 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=7acba3f5-1600-0000-8775-d76231100000 pid=4145 execve guuid=9c7703f6-1600-0000-8775-d76233100000 pid=4147 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=9c7703f6-1600-0000-8775-d76233100000 pid=4147 execve guuid=8a1964f6-1600-0000-8775-d76236100000 pid=4150 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=8a1964f6-1600-0000-8775-d76236100000 pid=4150 execve guuid=4250c6f6-1600-0000-8775-d76238100000 pid=4152 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=4250c6f6-1600-0000-8775-d76238100000 pid=4152 execve guuid=f1e027f7-1600-0000-8775-d7623c100000 pid=4156 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=f1e027f7-1600-0000-8775-d7623c100000 pid=4156 execve guuid=584392f7-1600-0000-8775-d7623d100000 pid=4157 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=584392f7-1600-0000-8775-d7623d100000 pid=4157 execve guuid=49b4f6f7-1600-0000-8775-d76241100000 pid=4161 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=49b4f6f7-1600-0000-8775-d76241100000 pid=4161 execve guuid=495c52f8-1600-0000-8775-d76243100000 pid=4163 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=495c52f8-1600-0000-8775-d76243100000 pid=4163 execve guuid=a7a2b2f8-1600-0000-8775-d76246100000 pid=4166 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=a7a2b2f8-1600-0000-8775-d76246100000 pid=4166 execve guuid=fc6d0cf9-1600-0000-8775-d76248100000 pid=4168 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=fc6d0cf9-1600-0000-8775-d76248100000 pid=4168 execve guuid=ee676bf9-1600-0000-8775-d7624a100000 pid=4170 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=ee676bf9-1600-0000-8775-d7624a100000 pid=4170 execve guuid=9dffc1f9-1600-0000-8775-d7624d100000 pid=4173 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=9dffc1f9-1600-0000-8775-d7624d100000 pid=4173 execve guuid=d22316fa-1600-0000-8775-d7624f100000 pid=4175 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=d22316fa-1600-0000-8775-d7624f100000 pid=4175 execve guuid=30467ffa-1600-0000-8775-d76250100000 pid=4176 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=30467ffa-1600-0000-8775-d76250100000 pid=4176 execve guuid=8bef63fb-1600-0000-8775-d76254100000 pid=4180 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=8bef63fb-1600-0000-8775-d76254100000 pid=4180 execve guuid=7be0c9fb-1600-0000-8775-d76258100000 pid=4184 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=7be0c9fb-1600-0000-8775-d76258100000 pid=4184 execve guuid=5bd91ffc-1600-0000-8775-d7625a100000 pid=4186 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=5bd91ffc-1600-0000-8775-d7625a100000 pid=4186 execve guuid=396377fc-1600-0000-8775-d7625d100000 pid=4189 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=396377fc-1600-0000-8775-d7625d100000 pid=4189 execve guuid=f14ccefc-1600-0000-8775-d7625f100000 pid=4191 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=f14ccefc-1600-0000-8775-d7625f100000 pid=4191 execve guuid=e07e27fd-1600-0000-8775-d76262100000 pid=4194 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=e07e27fd-1600-0000-8775-d76262100000 pid=4194 execve guuid=08c37bfd-1600-0000-8775-d76264100000 pid=4196 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=08c37bfd-1600-0000-8775-d76264100000 pid=4196 execve guuid=7147e0fd-1600-0000-8775-d76266100000 pid=4198 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=7147e0fd-1600-0000-8775-d76266100000 pid=4198 execve guuid=8f2b56fe-1600-0000-8775-d76267100000 pid=4199 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=8f2b56fe-1600-0000-8775-d76267100000 pid=4199 execve guuid=5d09bffe-1600-0000-8775-d7626b100000 pid=4203 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=5d09bffe-1600-0000-8775-d7626b100000 pid=4203 execve guuid=b0f927ff-1600-0000-8775-d7626c100000 pid=4204 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=b0f927ff-1600-0000-8775-d7626c100000 pid=4204 execve guuid=7c6188ff-1600-0000-8775-d76270100000 pid=4208 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=7c6188ff-1600-0000-8775-d76270100000 pid=4208 execve guuid=9581ebff-1600-0000-8775-d76272100000 pid=4210 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=9581ebff-1600-0000-8775-d76272100000 pid=4210 execve guuid=3e8d4d00-1700-0000-8775-d76274100000 pid=4212 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=3e8d4d00-1700-0000-8775-d76274100000 pid=4212 execve guuid=b154a700-1700-0000-8775-d76278100000 pid=4216 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=b154a700-1700-0000-8775-d76278100000 pid=4216 execve guuid=51270601-1700-0000-8775-d7627c100000 pid=4220 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=51270601-1700-0000-8775-d7627c100000 pid=4220 execve guuid=85c15c01-1700-0000-8775-d7627e100000 pid=4222 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=85c15c01-1700-0000-8775-d7627e100000 pid=4222 execve guuid=2153b701-1700-0000-8775-d76283100000 pid=4227 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=2153b701-1700-0000-8775-d76283100000 pid=4227 execve guuid=12103802-1700-0000-8775-d76287100000 pid=4231 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=12103802-1700-0000-8775-d76287100000 pid=4231 execve guuid=d6b68f02-1700-0000-8775-d76289100000 pid=4233 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=d6b68f02-1700-0000-8775-d76289100000 pid=4233 execve guuid=0c27f302-1700-0000-8775-d7628b100000 pid=4235 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=0c27f302-1700-0000-8775-d7628b100000 pid=4235 execve guuid=06825003-1700-0000-8775-d7628f100000 pid=4239 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=06825003-1700-0000-8775-d7628f100000 pid=4239 execve guuid=cc57b103-1700-0000-8775-d76293100000 pid=4243 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=cc57b103-1700-0000-8775-d76293100000 pid=4243 execve guuid=f44c1304-1700-0000-8775-d76295100000 pid=4245 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=f44c1304-1700-0000-8775-d76295100000 pid=4245 execve guuid=7a3d6e04-1700-0000-8775-d76298100000 pid=4248 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=7a3d6e04-1700-0000-8775-d76298100000 pid=4248 execve guuid=8896c504-1700-0000-8775-d7629a100000 pid=4250 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=8896c504-1700-0000-8775-d7629a100000 pid=4250 execve guuid=dd8d1b05-1700-0000-8775-d7629c100000 pid=4252 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=dd8d1b05-1700-0000-8775-d7629c100000 pid=4252 execve guuid=60f77405-1700-0000-8775-d7629f100000 pid=4255 /usr/bin/ls guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=60f77405-1700-0000-8775-d7629f100000 pid=4255 execve guuid=ed8acc05-1700-0000-8775-d762a3100000 pid=4259 /usr/bin/rm guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=ed8acc05-1700-0000-8775-d762a3100000 pid=4259 execve guuid=148d0806-1700-0000-8775-d762a4100000 pid=4260 /usr/bin/wget net send-data write-file guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=148d0806-1700-0000-8775-d762a4100000 pid=4260 execve guuid=da166f8e-1700-0000-8775-d76210120000 pid=4624 /usr/bin/chmod guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=da166f8e-1700-0000-8775-d76210120000 pid=4624 execve guuid=4988e48e-1700-0000-8775-d76211120000 pid=4625 /usr/bin/dash guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=4988e48e-1700-0000-8775-d76211120000 pid=4625 clone guuid=bce9ec8f-1700-0000-8775-d76216120000 pid=4630 /usr/bin/rm guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=bce9ec8f-1700-0000-8775-d76216120000 pid=4630 execve guuid=50686990-1700-0000-8775-d7621a120000 pid=4634 /usr/bin/wget net send-data write-file guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=50686990-1700-0000-8775-d7621a120000 pid=4634 execve guuid=9cd6be16-1800-0000-8775-d76280130000 pid=4992 /usr/bin/chmod guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=9cd6be16-1800-0000-8775-d76280130000 pid=4992 execve guuid=f3563e17-1800-0000-8775-d76282130000 pid=4994 /usr/bin/dash guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=f3563e17-1800-0000-8775-d76282130000 pid=4994 clone guuid=2da4fe17-1800-0000-8775-d76286130000 pid=4998 /usr/bin/rm guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=2da4fe17-1800-0000-8775-d76286130000 pid=4998 execve guuid=96115318-1800-0000-8775-d76288130000 pid=5000 /usr/bin/wget net send-data write-file guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=96115318-1800-0000-8775-d76288130000 pid=5000 execve guuid=7335b4ef-1800-0000-8775-d762e7140000 pid=5351 /usr/bin/chmod guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=7335b4ef-1800-0000-8775-d762e7140000 pid=5351 execve guuid=db6e84f0-1800-0000-8775-d762e8140000 pid=5352 /usr/bin/dash guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=db6e84f0-1800-0000-8775-d762e8140000 pid=5352 clone guuid=97883cf2-1800-0000-8775-d762ea140000 pid=5354 /usr/bin/rm guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=97883cf2-1800-0000-8775-d762ea140000 pid=5354 execve guuid=1e591ff3-1800-0000-8775-d762eb140000 pid=5355 /usr/bin/wget net send-data write-file guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=1e591ff3-1800-0000-8775-d762eb140000 pid=5355 execve guuid=6872758a-1900-0000-8775-d762ec140000 pid=5356 /usr/bin/chmod guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=6872758a-1900-0000-8775-d762ec140000 pid=5356 execve guuid=7d72c38a-1900-0000-8775-d762ed140000 pid=5357 /usr/bin/dash guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=7d72c38a-1900-0000-8775-d762ed140000 pid=5357 clone guuid=74ed658b-1900-0000-8775-d762ef140000 pid=5359 /usr/bin/rm guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=74ed658b-1900-0000-8775-d762ef140000 pid=5359 execve guuid=405bb88b-1900-0000-8775-d762f0140000 pid=5360 /usr/bin/wget net send-data write-file guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=405bb88b-1900-0000-8775-d762f0140000 pid=5360 execve guuid=d395262c-1a00-0000-8775-d762f8140000 pid=5368 /usr/bin/chmod guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=d395262c-1a00-0000-8775-d762f8140000 pid=5368 execve guuid=5c1a062d-1a00-0000-8775-d762f9140000 pid=5369 /usr/bin/dash guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=5c1a062d-1a00-0000-8775-d762f9140000 pid=5369 clone guuid=aee33c2f-1a00-0000-8775-d762fb140000 pid=5371 /usr/bin/rm delete-file guuid=4446d9d6-1600-0000-8775-d762630f0000 pid=3939->guuid=aee33c2f-1a00-0000-8775-d762fb140000 pid=5371 execve 9554d36e-3083-568e-90da-bb8e3c487b07 188.132.232.81:80 guuid=148d0806-1700-0000-8775-d762a4100000 pid=4260->9554d36e-3083-568e-90da-bb8e3c487b07 send: 132B guuid=50686990-1700-0000-8775-d7621a120000 pid=4634->9554d36e-3083-568e-90da-bb8e3c487b07 send: 133B guuid=96115318-1800-0000-8775-d76288130000 pid=5000->9554d36e-3083-568e-90da-bb8e3c487b07 send: 133B guuid=1e591ff3-1800-0000-8775-d762eb140000 pid=5355->9554d36e-3083-568e-90da-bb8e3c487b07 send: 132B guuid=405bb88b-1900-0000-8775-d762f0140000 pid=5360->9554d36e-3083-568e-90da-bb8e3c487b07 send: 132B
Score:
92%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/8e502016a2e93832924a1a4a558ed18b05a13cca02bddcf0bcf9e32aed781753
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8e502016a2e93832924a1a4a558ed18b05a13cca02bddcf0bcf9e32aed781753/
Verdict:
Malicious
Threat:
Trojan-Downloader.Shell.Agent
Link:
https://tip.neiki.dev/file/8e502016a2e93832924a1a4a558ed18b05a13cca02bddcf0bcf9e32aed781753
Threat name:
Document-HTML.Trojan.Multiverze
Create hunting rule
Status:
Malicious
First seen:
2026-06-02 07:36:11 UTC
File Type:
Text (Shell)
AV detection:
12 of 24 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rzicafvc5e4dfeskdjffldwrrmc2cpgkak65z4f47hrsv3lyc5jq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
defense_evasion discovery linux
Link:
https://tria.ge/reports/260602-jevlfsf19x/
Behaviour
Reads runtime system information
Writes file to tmp directory
Enumerates running processes
File and Directory Permissions Modification
Deletes itself
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.06
Link:
https://yomi.yoroi.company/submissions/8e502016a2e93832924a1a4a558ed18b05a13cca02bddcf0bcf9e32aed781753

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 8e502016a2e93832924a1a4a558ed18b05a13cca02bddcf0bcf9e32aed781753

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3856431/
  
Delivery method
Distributed via web download

Comments