MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 96282f6e46762cc263af994af5ce98d82b9d7291f2d4f16e9ea8139db6830b6f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 96282f6e46762cc263af994af5ce98d82b9d7291f2d4f16e9ea8139db6830b6f
SHA3-384 hash: 16f29aba70d13ed086f369518dd10250e4ec82d44d4f87343c314521735fcaa4a9649c5638e3019980cd5da4806fe9e9
SHA1 hash: 07215d93fe7a47a03f2b8838807bdfc914087a3a
MD5 hash: db43287f7119f004d6dbbb82f3032fe7
humanhash: carolina-indigo-vermont-utah
File name:lil
Download: download sample
File size:844 bytes
First seen:2026-08-09 02:01:58 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 24:kXCKysE2hi0ziQvZoha5mjZQ7FRzAvm4X:e9Qp+Ms5yZQBm+4X
TLSH T17401C2C6E33459004099945D26D76554F430C3C7194A4F7CBFACE53DAB84D14B03AF84
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://129.121.110.105/86Dn/an/an/a
http://129.121.110.105/aWGn/an/an/a
http://129.121.110.105/tbWn/an/an/a
http://129.121.110.105/VFgin/an/an/a
http://129.121.110.105/OLE5n/an/an/a

Intelligence

File Origin
# of uploads :
1
# of downloads :
51
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive mirai
Link:
https://www.filescan.io/uploads/6a77dfb3d0f2f7e942bc02b5/reports/702b8c51-f114-4cb4-a589-f1cd2072735d/overview
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/d214c371-7b72-4890-8cb2-3376b0a5eec4
Behavior Graph:
Download SVG
%3 guuid=ac74cb3f-1800-0000-ed6c-7370760a0000 pid=2678 /usr/bin/sudo guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682 /tmp/sample.bin write-file guuid=ac74cb3f-1800-0000-ed6c-7370760a0000 pid=2678->guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682 execve guuid=1c0fd742-1800-0000-ed6c-73707e0a0000 pid=2686 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=1c0fd742-1800-0000-ed6c-73707e0a0000 pid=2686 execve guuid=3ea3fd43-1800-0000-ed6c-7370800a0000 pid=2688 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=3ea3fd43-1800-0000-ed6c-7370800a0000 pid=2688 execve guuid=f4975345-1800-0000-ed6c-7370820a0000 pid=2690 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=f4975345-1800-0000-ed6c-7370820a0000 pid=2690 execve guuid=36be0346-1800-0000-ed6c-7370830a0000 pid=2691 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=36be0346-1800-0000-ed6c-7370830a0000 pid=2691 execve guuid=d291b046-1800-0000-ed6c-7370850a0000 pid=2693 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=d291b046-1800-0000-ed6c-7370850a0000 pid=2693 execve guuid=ebd70b47-1800-0000-ed6c-7370870a0000 pid=2695 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=ebd70b47-1800-0000-ed6c-7370870a0000 pid=2695 execve guuid=fa476c47-1800-0000-ed6c-7370880a0000 pid=2696 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=fa476c47-1800-0000-ed6c-7370880a0000 pid=2696 execve guuid=16a2c747-1800-0000-ed6c-73708a0a0000 pid=2698 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=16a2c747-1800-0000-ed6c-73708a0a0000 pid=2698 execve guuid=fb1b3548-1800-0000-ed6c-73708c0a0000 pid=2700 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=fb1b3548-1800-0000-ed6c-73708c0a0000 pid=2700 execve guuid=a9b89448-1800-0000-ed6c-73708e0a0000 pid=2702 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=a9b89448-1800-0000-ed6c-73708e0a0000 pid=2702 execve guuid=aad2f748-1800-0000-ed6c-7370900a0000 pid=2704 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=aad2f748-1800-0000-ed6c-7370900a0000 pid=2704 execve guuid=50f78449-1800-0000-ed6c-7370920a0000 pid=2706 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=50f78449-1800-0000-ed6c-7370920a0000 pid=2706 execve guuid=3150ea49-1800-0000-ed6c-7370940a0000 pid=2708 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=3150ea49-1800-0000-ed6c-7370940a0000 pid=2708 execve guuid=c6594c4a-1800-0000-ed6c-7370950a0000 pid=2709 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=c6594c4a-1800-0000-ed6c-7370950a0000 pid=2709 execve guuid=5261cc4a-1800-0000-ed6c-7370970a0000 pid=2711 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=5261cc4a-1800-0000-ed6c-7370970a0000 pid=2711 execve guuid=48065a4b-1800-0000-ed6c-7370980a0000 pid=2712 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=48065a4b-1800-0000-ed6c-7370980a0000 pid=2712 execve guuid=6227224c-1800-0000-ed6c-73709a0a0000 pid=2714 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=6227224c-1800-0000-ed6c-73709a0a0000 pid=2714 execve guuid=b9a0c04c-1800-0000-ed6c-73709c0a0000 pid=2716 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=b9a0c04c-1800-0000-ed6c-73709c0a0000 pid=2716 execve guuid=b4a3274d-1800-0000-ed6c-73709f0a0000 pid=2719 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=b4a3274d-1800-0000-ed6c-73709f0a0000 pid=2719 execve guuid=b2c4944d-1800-0000-ed6c-7370a10a0000 pid=2721 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=b2c4944d-1800-0000-ed6c-7370a10a0000 pid=2721 execve guuid=55aefb4d-1800-0000-ed6c-7370a30a0000 pid=2723 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=55aefb4d-1800-0000-ed6c-7370a30a0000 pid=2723 execve guuid=7fb6634e-1800-0000-ed6c-7370a50a0000 pid=2725 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=7fb6634e-1800-0000-ed6c-7370a50a0000 pid=2725 execve guuid=f130d04e-1800-0000-ed6c-7370a60a0000 pid=2726 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=f130d04e-1800-0000-ed6c-7370a60a0000 pid=2726 execve guuid=4f84394f-1800-0000-ed6c-7370a70a0000 pid=2727 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=4f84394f-1800-0000-ed6c-7370a70a0000 pid=2727 execve guuid=64b7a44f-1800-0000-ed6c-7370a90a0000 pid=2729 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=64b7a44f-1800-0000-ed6c-7370a90a0000 pid=2729 execve guuid=35f32350-1800-0000-ed6c-7370ac0a0000 pid=2732 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=35f32350-1800-0000-ed6c-7370ac0a0000 pid=2732 execve guuid=4f59a550-1800-0000-ed6c-7370ae0a0000 pid=2734 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=4f59a550-1800-0000-ed6c-7370ae0a0000 pid=2734 execve guuid=397f2551-1800-0000-ed6c-7370b10a0000 pid=2737 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=397f2551-1800-0000-ed6c-7370b10a0000 pid=2737 execve guuid=f451a951-1800-0000-ed6c-7370b30a0000 pid=2739 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=f451a951-1800-0000-ed6c-7370b30a0000 pid=2739 execve guuid=25865152-1800-0000-ed6c-7370b40a0000 pid=2740 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=25865152-1800-0000-ed6c-7370b40a0000 pid=2740 execve guuid=d437c652-1800-0000-ed6c-7370b70a0000 pid=2743 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=d437c652-1800-0000-ed6c-7370b70a0000 pid=2743 execve guuid=c81e5e53-1800-0000-ed6c-7370b90a0000 pid=2745 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=c81e5e53-1800-0000-ed6c-7370b90a0000 pid=2745 execve guuid=8c52c153-1800-0000-ed6c-7370bb0a0000 pid=2747 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=8c52c153-1800-0000-ed6c-7370bb0a0000 pid=2747 execve guuid=171d1b54-1800-0000-ed6c-7370be0a0000 pid=2750 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=171d1b54-1800-0000-ed6c-7370be0a0000 pid=2750 execve guuid=40e67554-1800-0000-ed6c-7370bf0a0000 pid=2751 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=40e67554-1800-0000-ed6c-7370bf0a0000 pid=2751 execve guuid=b72be754-1800-0000-ed6c-7370c10a0000 pid=2753 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=b72be754-1800-0000-ed6c-7370c10a0000 pid=2753 execve guuid=16308055-1800-0000-ed6c-7370c20a0000 pid=2754 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=16308055-1800-0000-ed6c-7370c20a0000 pid=2754 execve guuid=7da10356-1800-0000-ed6c-7370c30a0000 pid=2755 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=7da10356-1800-0000-ed6c-7370c30a0000 pid=2755 execve guuid=c9046c56-1800-0000-ed6c-7370c40a0000 pid=2756 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=c9046c56-1800-0000-ed6c-7370c40a0000 pid=2756 execve guuid=152dcb56-1800-0000-ed6c-7370c60a0000 pid=2758 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=152dcb56-1800-0000-ed6c-7370c60a0000 pid=2758 execve guuid=84fc2357-1800-0000-ed6c-7370c80a0000 pid=2760 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=84fc2357-1800-0000-ed6c-7370c80a0000 pid=2760 execve guuid=a07b7657-1800-0000-ed6c-7370ca0a0000 pid=2762 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=a07b7657-1800-0000-ed6c-7370ca0a0000 pid=2762 execve guuid=74d6cb57-1800-0000-ed6c-7370cc0a0000 pid=2764 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=74d6cb57-1800-0000-ed6c-7370cc0a0000 pid=2764 execve guuid=31f03858-1800-0000-ed6c-7370cf0a0000 pid=2767 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=31f03858-1800-0000-ed6c-7370cf0a0000 pid=2767 execve guuid=bb805859-1800-0000-ed6c-7370d10a0000 pid=2769 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=bb805859-1800-0000-ed6c-7370d10a0000 pid=2769 execve guuid=cdc3dc59-1800-0000-ed6c-7370d20a0000 pid=2770 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=cdc3dc59-1800-0000-ed6c-7370d20a0000 pid=2770 execve guuid=6d5f5a5a-1800-0000-ed6c-7370d30a0000 pid=2771 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=6d5f5a5a-1800-0000-ed6c-7370d30a0000 pid=2771 execve guuid=8780c85a-1800-0000-ed6c-7370d50a0000 pid=2773 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=8780c85a-1800-0000-ed6c-7370d50a0000 pid=2773 execve guuid=ba972b5b-1800-0000-ed6c-7370d70a0000 pid=2775 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=ba972b5b-1800-0000-ed6c-7370d70a0000 pid=2775 execve guuid=9aac905b-1800-0000-ed6c-7370d80a0000 pid=2776 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=9aac905b-1800-0000-ed6c-7370d80a0000 pid=2776 execve guuid=85a7fc5b-1800-0000-ed6c-7370da0a0000 pid=2778 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=85a7fc5b-1800-0000-ed6c-7370da0a0000 pid=2778 execve guuid=5d09645c-1800-0000-ed6c-7370dd0a0000 pid=2781 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=5d09645c-1800-0000-ed6c-7370dd0a0000 pid=2781 execve guuid=087ec55c-1800-0000-ed6c-7370df0a0000 pid=2783 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=087ec55c-1800-0000-ed6c-7370df0a0000 pid=2783 execve guuid=ea38245d-1800-0000-ed6c-7370e10a0000 pid=2785 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=ea38245d-1800-0000-ed6c-7370e10a0000 pid=2785 execve guuid=0ce1935d-1800-0000-ed6c-7370e20a0000 pid=2786 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=0ce1935d-1800-0000-ed6c-7370e20a0000 pid=2786 execve guuid=41f7eb5d-1800-0000-ed6c-7370e50a0000 pid=2789 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=41f7eb5d-1800-0000-ed6c-7370e50a0000 pid=2789 execve guuid=39f3465e-1800-0000-ed6c-7370e70a0000 pid=2791 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=39f3465e-1800-0000-ed6c-7370e70a0000 pid=2791 execve guuid=1544ca5e-1800-0000-ed6c-7370ea0a0000 pid=2794 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=1544ca5e-1800-0000-ed6c-7370ea0a0000 pid=2794 execve guuid=b30e455f-1800-0000-ed6c-7370ed0a0000 pid=2797 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=b30e455f-1800-0000-ed6c-7370ed0a0000 pid=2797 execve guuid=c008c55f-1800-0000-ed6c-7370f00a0000 pid=2800 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=c008c55f-1800-0000-ed6c-7370f00a0000 pid=2800 execve guuid=5a134160-1800-0000-ed6c-7370f30a0000 pid=2803 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=5a134160-1800-0000-ed6c-7370f30a0000 pid=2803 execve guuid=e973b860-1800-0000-ed6c-7370f60a0000 pid=2806 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=e973b860-1800-0000-ed6c-7370f60a0000 pid=2806 execve guuid=1c7b3661-1800-0000-ed6c-7370f80a0000 pid=2808 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=1c7b3661-1800-0000-ed6c-7370f80a0000 pid=2808 execve guuid=6f67ac61-1800-0000-ed6c-7370fb0a0000 pid=2811 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=6f67ac61-1800-0000-ed6c-7370fb0a0000 pid=2811 execve guuid=797f1162-1800-0000-ed6c-7370fd0a0000 pid=2813 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=797f1162-1800-0000-ed6c-7370fd0a0000 pid=2813 execve guuid=d59b8762-1800-0000-ed6c-7370ff0a0000 pid=2815 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=d59b8762-1800-0000-ed6c-7370ff0a0000 pid=2815 execve guuid=6226fc62-1800-0000-ed6c-7370020b0000 pid=2818 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=6226fc62-1800-0000-ed6c-7370020b0000 pid=2818 execve guuid=68717563-1800-0000-ed6c-7370050b0000 pid=2821 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=68717563-1800-0000-ed6c-7370050b0000 pid=2821 execve guuid=857cea63-1800-0000-ed6c-7370070b0000 pid=2823 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=857cea63-1800-0000-ed6c-7370070b0000 pid=2823 execve guuid=fcab4c64-1800-0000-ed6c-73700a0b0000 pid=2826 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=fcab4c64-1800-0000-ed6c-73700a0b0000 pid=2826 execve guuid=d058d164-1800-0000-ed6c-73700d0b0000 pid=2829 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=d058d164-1800-0000-ed6c-73700d0b0000 pid=2829 execve guuid=a2703165-1800-0000-ed6c-73700f0b0000 pid=2831 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=a2703165-1800-0000-ed6c-73700f0b0000 pid=2831 execve guuid=76e79765-1800-0000-ed6c-7370110b0000 pid=2833 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=76e79765-1800-0000-ed6c-7370110b0000 pid=2833 execve guuid=69ab0b66-1800-0000-ed6c-7370130b0000 pid=2835 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=69ab0b66-1800-0000-ed6c-7370130b0000 pid=2835 execve guuid=e6e37c66-1800-0000-ed6c-7370150b0000 pid=2837 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=e6e37c66-1800-0000-ed6c-7370150b0000 pid=2837 execve guuid=97f02a67-1800-0000-ed6c-7370190b0000 pid=2841 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=97f02a67-1800-0000-ed6c-7370190b0000 pid=2841 execve guuid=4e87dc67-1800-0000-ed6c-73701c0b0000 pid=2844 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=4e87dc67-1800-0000-ed6c-73701c0b0000 pid=2844 execve guuid=02ac5868-1800-0000-ed6c-73701e0b0000 pid=2846 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=02ac5868-1800-0000-ed6c-73701e0b0000 pid=2846 execve guuid=0af3e668-1800-0000-ed6c-7370200b0000 pid=2848 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=0af3e668-1800-0000-ed6c-7370200b0000 pid=2848 execve guuid=7ec17269-1800-0000-ed6c-7370230b0000 pid=2851 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=7ec17269-1800-0000-ed6c-7370230b0000 pid=2851 execve guuid=ba61016a-1800-0000-ed6c-7370250b0000 pid=2853 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=ba61016a-1800-0000-ed6c-7370250b0000 pid=2853 execve guuid=bc5e676a-1800-0000-ed6c-7370270b0000 pid=2855 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=bc5e676a-1800-0000-ed6c-7370270b0000 pid=2855 execve guuid=625fce6a-1800-0000-ed6c-7370290b0000 pid=2857 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=625fce6a-1800-0000-ed6c-7370290b0000 pid=2857 execve guuid=a8703a6b-1800-0000-ed6c-73702a0b0000 pid=2858 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=a8703a6b-1800-0000-ed6c-73702a0b0000 pid=2858 execve guuid=cd91b46b-1800-0000-ed6c-73702e0b0000 pid=2862 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=cd91b46b-1800-0000-ed6c-73702e0b0000 pid=2862 execve guuid=97d63e6c-1800-0000-ed6c-7370300b0000 pid=2864 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=97d63e6c-1800-0000-ed6c-7370300b0000 pid=2864 execve guuid=c1e3e16c-1800-0000-ed6c-7370320b0000 pid=2866 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=c1e3e16c-1800-0000-ed6c-7370320b0000 pid=2866 execve guuid=ff7b776d-1800-0000-ed6c-7370340b0000 pid=2868 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=ff7b776d-1800-0000-ed6c-7370340b0000 pid=2868 execve guuid=f497e16d-1800-0000-ed6c-7370350b0000 pid=2869 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=f497e16d-1800-0000-ed6c-7370350b0000 pid=2869 execve guuid=9cd96c6e-1800-0000-ed6c-7370370b0000 pid=2871 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=9cd96c6e-1800-0000-ed6c-7370370b0000 pid=2871 execve guuid=2584db6e-1800-0000-ed6c-7370390b0000 pid=2873 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=2584db6e-1800-0000-ed6c-7370390b0000 pid=2873 execve guuid=599b4c6f-1800-0000-ed6c-73703b0b0000 pid=2875 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=599b4c6f-1800-0000-ed6c-73703b0b0000 pid=2875 execve guuid=24ebba6f-1800-0000-ed6c-73703c0b0000 pid=2876 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=24ebba6f-1800-0000-ed6c-73703c0b0000 pid=2876 execve guuid=080c3270-1800-0000-ed6c-73703e0b0000 pid=2878 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=080c3270-1800-0000-ed6c-73703e0b0000 pid=2878 execve guuid=6b298a70-1800-0000-ed6c-7370400b0000 pid=2880 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=6b298a70-1800-0000-ed6c-7370400b0000 pid=2880 execve guuid=0312df70-1800-0000-ed6c-7370430b0000 pid=2883 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=0312df70-1800-0000-ed6c-7370430b0000 pid=2883 execve guuid=cad63371-1800-0000-ed6c-7370450b0000 pid=2885 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=cad63371-1800-0000-ed6c-7370450b0000 pid=2885 execve guuid=cddb8e71-1800-0000-ed6c-7370470b0000 pid=2887 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=cddb8e71-1800-0000-ed6c-7370470b0000 pid=2887 execve guuid=19dbe671-1800-0000-ed6c-7370490b0000 pid=2889 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=19dbe671-1800-0000-ed6c-7370490b0000 pid=2889 execve guuid=2a834872-1800-0000-ed6c-73704a0b0000 pid=2890 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=2a834872-1800-0000-ed6c-73704a0b0000 pid=2890 execve guuid=e0e5f972-1800-0000-ed6c-73704c0b0000 pid=2892 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=e0e5f972-1800-0000-ed6c-73704c0b0000 pid=2892 execve guuid=3c97aa73-1800-0000-ed6c-73704e0b0000 pid=2894 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=3c97aa73-1800-0000-ed6c-73704e0b0000 pid=2894 execve guuid=e82b3e74-1800-0000-ed6c-7370500b0000 pid=2896 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=e82b3e74-1800-0000-ed6c-7370500b0000 pid=2896 execve guuid=67f5ca74-1800-0000-ed6c-7370530b0000 pid=2899 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=67f5ca74-1800-0000-ed6c-7370530b0000 pid=2899 execve guuid=3ed25475-1800-0000-ed6c-7370550b0000 pid=2901 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=3ed25475-1800-0000-ed6c-7370550b0000 pid=2901 execve guuid=088de575-1800-0000-ed6c-7370570b0000 pid=2903 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=088de575-1800-0000-ed6c-7370570b0000 pid=2903 execve guuid=c7497476-1800-0000-ed6c-7370590b0000 pid=2905 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=c7497476-1800-0000-ed6c-7370590b0000 pid=2905 execve guuid=483e0277-1800-0000-ed6c-73705c0b0000 pid=2908 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=483e0277-1800-0000-ed6c-73705c0b0000 pid=2908 execve guuid=b22c9a77-1800-0000-ed6c-73705e0b0000 pid=2910 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=b22c9a77-1800-0000-ed6c-73705e0b0000 pid=2910 execve guuid=fe416878-1800-0000-ed6c-73705f0b0000 pid=2911 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=fe416878-1800-0000-ed6c-73705f0b0000 pid=2911 execve guuid=45973679-1800-0000-ed6c-7370600b0000 pid=2912 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=45973679-1800-0000-ed6c-7370600b0000 pid=2912 execve guuid=95a0ec79-1800-0000-ed6c-7370610b0000 pid=2913 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=95a0ec79-1800-0000-ed6c-7370610b0000 pid=2913 execve guuid=38435f7a-1800-0000-ed6c-7370620b0000 pid=2914 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=38435f7a-1800-0000-ed6c-7370620b0000 pid=2914 execve guuid=5120c57a-1800-0000-ed6c-7370630b0000 pid=2915 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=5120c57a-1800-0000-ed6c-7370630b0000 pid=2915 execve guuid=51502f7b-1800-0000-ed6c-7370640b0000 pid=2916 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=51502f7b-1800-0000-ed6c-7370640b0000 pid=2916 execve guuid=07af997b-1800-0000-ed6c-7370650b0000 pid=2917 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=07af997b-1800-0000-ed6c-7370650b0000 pid=2917 execve guuid=79700e7c-1800-0000-ed6c-7370660b0000 pid=2918 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=79700e7c-1800-0000-ed6c-7370660b0000 pid=2918 execve guuid=16f1777c-1800-0000-ed6c-7370670b0000 pid=2919 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=16f1777c-1800-0000-ed6c-7370670b0000 pid=2919 execve guuid=0c40d67c-1800-0000-ed6c-7370690b0000 pid=2921 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=0c40d67c-1800-0000-ed6c-7370690b0000 pid=2921 execve guuid=c268477d-1800-0000-ed6c-73706a0b0000 pid=2922 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=c268477d-1800-0000-ed6c-73706a0b0000 pid=2922 execve guuid=2888b57d-1800-0000-ed6c-73706b0b0000 pid=2923 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=2888b57d-1800-0000-ed6c-73706b0b0000 pid=2923 execve guuid=ea7e217e-1800-0000-ed6c-73706c0b0000 pid=2924 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=ea7e217e-1800-0000-ed6c-73706c0b0000 pid=2924 execve guuid=eb52887e-1800-0000-ed6c-73706d0b0000 pid=2925 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=eb52887e-1800-0000-ed6c-73706d0b0000 pid=2925 execve guuid=5e2beb7e-1800-0000-ed6c-73706e0b0000 pid=2926 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=5e2beb7e-1800-0000-ed6c-73706e0b0000 pid=2926 execve guuid=7964427f-1800-0000-ed6c-7370700b0000 pid=2928 /usr/bin/ls guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=7964427f-1800-0000-ed6c-7370700b0000 pid=2928 execve guuid=31fb9c7f-1800-0000-ed6c-7370720b0000 pid=2930 /usr/bin/rm guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=31fb9c7f-1800-0000-ed6c-7370720b0000 pid=2930 execve guuid=0e2bcf7f-1800-0000-ed6c-7370740b0000 pid=2932 /usr/bin/wget net send-data write-file guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=0e2bcf7f-1800-0000-ed6c-7370740b0000 pid=2932 execve guuid=d7c12986-1800-0000-ed6c-73707c0b0000 pid=2940 /usr/bin/chmod guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=d7c12986-1800-0000-ed6c-73707c0b0000 pid=2940 execve guuid=a44d7686-1800-0000-ed6c-73707e0b0000 pid=2942 /usr/bin/dash guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=a44d7686-1800-0000-ed6c-73707e0b0000 pid=2942 clone guuid=67641287-1800-0000-ed6c-7370810b0000 pid=2945 /usr/bin/rm guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=67641287-1800-0000-ed6c-7370810b0000 pid=2945 execve guuid=7b9f6187-1800-0000-ed6c-7370830b0000 pid=2947 /usr/bin/wget net send-data write-file guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=7b9f6187-1800-0000-ed6c-7370830b0000 pid=2947 execve guuid=31908e8b-1800-0000-ed6c-73708b0b0000 pid=2955 /usr/bin/chmod guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=31908e8b-1800-0000-ed6c-73708b0b0000 pid=2955 execve guuid=4082e78b-1800-0000-ed6c-73708c0b0000 pid=2956 /usr/bin/dash guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=4082e78b-1800-0000-ed6c-73708c0b0000 pid=2956 clone guuid=b7983191-1800-0000-ed6c-73708e0b0000 pid=2958 /usr/bin/rm guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=b7983191-1800-0000-ed6c-73708e0b0000 pid=2958 execve guuid=4b7ca091-1800-0000-ed6c-73708f0b0000 pid=2959 /usr/bin/wget net send-data write-file guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=4b7ca091-1800-0000-ed6c-73708f0b0000 pid=2959 execve guuid=1c0d6b96-1800-0000-ed6c-7370940b0000 pid=2964 /usr/bin/chmod guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=1c0d6b96-1800-0000-ed6c-7370940b0000 pid=2964 execve guuid=fd36c796-1800-0000-ed6c-7370960b0000 pid=2966 /usr/bin/dash guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=fd36c796-1800-0000-ed6c-7370960b0000 pid=2966 clone guuid=97126097-1800-0000-ed6c-7370990b0000 pid=2969 /usr/bin/rm guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=97126097-1800-0000-ed6c-7370990b0000 pid=2969 execve guuid=239dab97-1800-0000-ed6c-73709b0b0000 pid=2971 /usr/bin/wget net send-data write-file guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=239dab97-1800-0000-ed6c-73709b0b0000 pid=2971 execve guuid=08aa289c-1800-0000-ed6c-7370a30b0000 pid=2979 /usr/bin/chmod guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=08aa289c-1800-0000-ed6c-7370a30b0000 pid=2979 execve guuid=0ad9ab9c-1800-0000-ed6c-7370a60b0000 pid=2982 /usr/bin/dash guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=0ad9ab9c-1800-0000-ed6c-7370a60b0000 pid=2982 clone guuid=148b3e9d-1800-0000-ed6c-7370a90b0000 pid=2985 /usr/bin/rm guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=148b3e9d-1800-0000-ed6c-7370a90b0000 pid=2985 execve guuid=12b8e79d-1800-0000-ed6c-7370ab0b0000 pid=2987 /usr/bin/wget net send-data write-file guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=12b8e79d-1800-0000-ed6c-7370ab0b0000 pid=2987 execve guuid=8a5eeea4-1800-0000-ed6c-7370bc0b0000 pid=3004 /usr/bin/chmod guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=8a5eeea4-1800-0000-ed6c-7370bc0b0000 pid=3004 execve guuid=5ae4caa5-1800-0000-ed6c-7370be0b0000 pid=3006 /usr/bin/dash guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=5ae4caa5-1800-0000-ed6c-7370be0b0000 pid=3006 clone guuid=719fc1a6-1800-0000-ed6c-7370c20b0000 pid=3010 /usr/bin/rm delete-file guuid=a905b741-1800-0000-ed6c-73707a0a0000 pid=2682->guuid=719fc1a6-1800-0000-ed6c-7370c20b0000 pid=3010 execve 0b1ba66e-2f8f-542f-9f7c-00dd01da057c 129.121.110.105:80 guuid=0e2bcf7f-1800-0000-ed6c-7370740b0000 pid=2932->0b1ba66e-2f8f-542f-9f7c-00dd01da057c send: 133B guuid=7b9f6187-1800-0000-ed6c-7370830b0000 pid=2947->0b1ba66e-2f8f-542f-9f7c-00dd01da057c send: 133B guuid=4b7ca091-1800-0000-ed6c-73708f0b0000 pid=2959->0b1ba66e-2f8f-542f-9f7c-00dd01da057c send: 133B guuid=239dab97-1800-0000-ed6c-73709b0b0000 pid=2971->0b1ba66e-2f8f-542f-9f7c-00dd01da057c send: 134B guuid=12b8e79d-1800-0000-ed6c-7370ab0b0000 pid=2987->0b1ba66e-2f8f-542f-9f7c-00dd01da057c send: 134B
Score:
98%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/96282f6e46762cc263af994af5ce98d82b9d7291f2d4f16e9ea8139db6830b6f
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/96282f6e46762cc263af994af5ce98d82b9d7291f2d4f16e9ea8139db6830b6f/
Gathering data
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=syuc63sgoywmey5ptffpltuy3avz24ur6lkpc3u6vajz3nudbnxq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
defense_evasion discovery execution linux persistence privilege_escalation
Link:
https://tria.ge/reports/260809-cgcp4aybpf/
Behaviour
Enumerates kernel/hardware configuration
Reads runtime system information
Writes file to tmp directory
Creates/modifies Cron job
Enumerates running processes
Modifies rc script
Modifies systemd
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.26
Link:
https://yomi.yoroi.company/submissions/96282f6e46762cc263af994af5ce98d82b9d7291f2d4f16e9ea8139db6830b6f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 96282f6e46762cc263af994af5ce98d82b9d7291f2d4f16e9ea8139db6830b6f

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3887344/
  
Delivery method
Distributed via web download

Comments