MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 9a3d1161f32cefd7b28fa38ca355aabfb108b771e30f49f507781d80cc5ae7ca. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 9a3d1161f32cefd7b28fa38ca355aabfb108b771e30f49f507781d80cc5ae7ca
SHA3-384 hash: f1a467b081dde5c6249a21beed2b13bf0740d189f76e1bf1c793e1c4401ca60f3ae49e92326e0a59d26642839eaf1aa0
SHA1 hash: 7ac9331a9788c10a56d25445b61408806da5fdf3
MD5 hash: a6b0f68db815078e93e49a0bd575fd1a
humanhash: december-washington-dakota-happy
File name:lil
Download: download sample
File size:856 bytes
First seen:2026-07-20 07:51:51 UTC
Last seen:2026-07-20 20:28:12 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkasjCFf8C9+UFC2rjoXC09x2RqCmCM3NNX:kXCKysE2hi0ziQvZohawVEFVk19ZhvvX
TLSH T1CB118CC6D0549C0050AA941D25D761A4F831C3C7299B8F6ABF5C942DEB98E14B0A6F88
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://129.121.110.105/gTksn/an/aua-wget
http://129.121.110.105/mrHzn/an/aua-wget
http://129.121.110.105/THKin/an/aua-wget
http://129.121.110.105/GFr2n/an/aua-wget
http://129.121.110.105/Rh1Fn/an/aua-wget

Intelligence

File Origin
# of uploads :
2
# of downloads :
72
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive
Link:
https://www.filescan.io/uploads/6a5dd3bf33d19efd891e6855/reports/28dab67a-2d98-4e10-8dfe-4326d00302cd/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-07-20T05:54:00Z UTC
Last seen:
2026-07-20T06:15:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/9a3d1161f32cefd7b28fa38ca355aabfb108b771e30f49f507781d80cc5ae7ca/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/62af5168-f472-4d49-a2bf-e041bd1b9012
Behavior Graph:
Download SVG
%3 guuid=8a2a3c38-1800-0000-9724-cc9f0f0c0000 pid=3087 /usr/bin/sudo guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090 /tmp/sample.bin write-file guuid=8a2a3c38-1800-0000-9724-cc9f0f0c0000 pid=3087->guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090 execve guuid=6d83ec3b-1800-0000-9724-cc9f140c0000 pid=3092 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=6d83ec3b-1800-0000-9724-cc9f140c0000 pid=3092 execve guuid=2697a83c-1800-0000-9724-cc9f180c0000 pid=3096 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=2697a83c-1800-0000-9724-cc9f180c0000 pid=3096 execve guuid=dbb7103d-1800-0000-9724-cc9f190c0000 pid=3097 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=dbb7103d-1800-0000-9724-cc9f190c0000 pid=3097 execve guuid=c2ed723d-1800-0000-9724-cc9f1c0c0000 pid=3100 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=c2ed723d-1800-0000-9724-cc9f1c0c0000 pid=3100 execve guuid=35df3e3e-1800-0000-9724-cc9f1e0c0000 pid=3102 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=35df3e3e-1800-0000-9724-cc9f1e0c0000 pid=3102 execve guuid=023ca03e-1800-0000-9724-cc9f200c0000 pid=3104 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=023ca03e-1800-0000-9724-cc9f200c0000 pid=3104 execve guuid=31d1153f-1800-0000-9724-cc9f210c0000 pid=3105 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=31d1153f-1800-0000-9724-cc9f210c0000 pid=3105 execve guuid=c7428b3f-1800-0000-9724-cc9f220c0000 pid=3106 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=c7428b3f-1800-0000-9724-cc9f220c0000 pid=3106 execve guuid=9b0cf53f-1800-0000-9724-cc9f240c0000 pid=3108 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=9b0cf53f-1800-0000-9724-cc9f240c0000 pid=3108 execve guuid=fd564e40-1800-0000-9724-cc9f260c0000 pid=3110 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=fd564e40-1800-0000-9724-cc9f260c0000 pid=3110 execve guuid=be1fb140-1800-0000-9724-cc9f290c0000 pid=3113 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=be1fb140-1800-0000-9724-cc9f290c0000 pid=3113 execve guuid=641b1541-1800-0000-9724-cc9f2b0c0000 pid=3115 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=641b1541-1800-0000-9724-cc9f2b0c0000 pid=3115 execve guuid=57f77641-1800-0000-9724-cc9f2e0c0000 pid=3118 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=57f77641-1800-0000-9724-cc9f2e0c0000 pid=3118 execve guuid=8da1dd41-1800-0000-9724-cc9f300c0000 pid=3120 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=8da1dd41-1800-0000-9724-cc9f300c0000 pid=3120 execve guuid=8eef4442-1800-0000-9724-cc9f320c0000 pid=3122 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=8eef4442-1800-0000-9724-cc9f320c0000 pid=3122 execve guuid=6f70ba42-1800-0000-9724-cc9f330c0000 pid=3123 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=6f70ba42-1800-0000-9724-cc9f330c0000 pid=3123 execve guuid=c3c13343-1800-0000-9724-cc9f340c0000 pid=3124 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=c3c13343-1800-0000-9724-cc9f340c0000 pid=3124 execve guuid=2e5da543-1800-0000-9724-cc9f350c0000 pid=3125 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=2e5da543-1800-0000-9724-cc9f350c0000 pid=3125 execve guuid=dc0d0c44-1800-0000-9724-cc9f370c0000 pid=3127 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=dc0d0c44-1800-0000-9724-cc9f370c0000 pid=3127 execve guuid=6e697544-1800-0000-9724-cc9f3a0c0000 pid=3130 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=6e697544-1800-0000-9724-cc9f3a0c0000 pid=3130 execve guuid=fadfda44-1800-0000-9724-cc9f3c0c0000 pid=3132 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=fadfda44-1800-0000-9724-cc9f3c0c0000 pid=3132 execve guuid=b6063c45-1800-0000-9724-cc9f3f0c0000 pid=3135 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=b6063c45-1800-0000-9724-cc9f3f0c0000 pid=3135 execve guuid=0c39b645-1800-0000-9724-cc9f400c0000 pid=3136 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=0c39b645-1800-0000-9724-cc9f400c0000 pid=3136 execve guuid=28e44046-1800-0000-9724-cc9f420c0000 pid=3138 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=28e44046-1800-0000-9724-cc9f420c0000 pid=3138 execve guuid=627c9e46-1800-0000-9724-cc9f450c0000 pid=3141 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=627c9e46-1800-0000-9724-cc9f450c0000 pid=3141 execve guuid=26a00347-1800-0000-9724-cc9f470c0000 pid=3143 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=26a00347-1800-0000-9724-cc9f470c0000 pid=3143 execve guuid=e8d26647-1800-0000-9724-cc9f490c0000 pid=3145 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=e8d26647-1800-0000-9724-cc9f490c0000 pid=3145 execve guuid=7391c047-1800-0000-9724-cc9f4c0c0000 pid=3148 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=7391c047-1800-0000-9724-cc9f4c0c0000 pid=3148 execve guuid=99031c48-1800-0000-9724-cc9f4e0c0000 pid=3150 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=99031c48-1800-0000-9724-cc9f4e0c0000 pid=3150 execve guuid=3ebf7248-1800-0000-9724-cc9f510c0000 pid=3153 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=3ebf7248-1800-0000-9724-cc9f510c0000 pid=3153 execve guuid=bbd1d448-1800-0000-9724-cc9f530c0000 pid=3155 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=bbd1d448-1800-0000-9724-cc9f530c0000 pid=3155 execve guuid=cc724249-1800-0000-9724-cc9f540c0000 pid=3156 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=cc724249-1800-0000-9724-cc9f540c0000 pid=3156 execve guuid=64f0e249-1800-0000-9724-cc9f550c0000 pid=3157 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=64f0e249-1800-0000-9724-cc9f550c0000 pid=3157 execve guuid=ef6b774a-1800-0000-9724-cc9f560c0000 pid=3158 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=ef6b774a-1800-0000-9724-cc9f560c0000 pid=3158 execve guuid=4a41f94a-1800-0000-9724-cc9f570c0000 pid=3159 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=4a41f94a-1800-0000-9724-cc9f570c0000 pid=3159 execve guuid=566c8a4b-1800-0000-9724-cc9f580c0000 pid=3160 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=566c8a4b-1800-0000-9724-cc9f580c0000 pid=3160 execve guuid=14d5224c-1800-0000-9724-cc9f590c0000 pid=3161 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=14d5224c-1800-0000-9724-cc9f590c0000 pid=3161 execve guuid=3d34c24c-1800-0000-9724-cc9f5a0c0000 pid=3162 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=3d34c24c-1800-0000-9724-cc9f5a0c0000 pid=3162 execve guuid=f9264f4d-1800-0000-9724-cc9f5b0c0000 pid=3163 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=f9264f4d-1800-0000-9724-cc9f5b0c0000 pid=3163 execve guuid=f780e84d-1800-0000-9724-cc9f5c0c0000 pid=3164 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=f780e84d-1800-0000-9724-cc9f5c0c0000 pid=3164 execve guuid=80e67c4e-1800-0000-9724-cc9f5d0c0000 pid=3165 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=80e67c4e-1800-0000-9724-cc9f5d0c0000 pid=3165 execve guuid=620e044f-1800-0000-9724-cc9f5e0c0000 pid=3166 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=620e044f-1800-0000-9724-cc9f5e0c0000 pid=3166 execve guuid=9d758a4f-1800-0000-9724-cc9f5f0c0000 pid=3167 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=9d758a4f-1800-0000-9724-cc9f5f0c0000 pid=3167 execve guuid=6dff2650-1800-0000-9724-cc9f600c0000 pid=3168 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=6dff2650-1800-0000-9724-cc9f600c0000 pid=3168 execve guuid=5109cd50-1800-0000-9724-cc9f610c0000 pid=3169 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=5109cd50-1800-0000-9724-cc9f610c0000 pid=3169 execve guuid=f4fa5851-1800-0000-9724-cc9f620c0000 pid=3170 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=f4fa5851-1800-0000-9724-cc9f620c0000 pid=3170 execve guuid=6c22f051-1800-0000-9724-cc9f630c0000 pid=3171 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=6c22f051-1800-0000-9724-cc9f630c0000 pid=3171 execve guuid=13797d52-1800-0000-9724-cc9f640c0000 pid=3172 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=13797d52-1800-0000-9724-cc9f640c0000 pid=3172 execve guuid=7ecf0953-1800-0000-9724-cc9f650c0000 pid=3173 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=7ecf0953-1800-0000-9724-cc9f650c0000 pid=3173 execve guuid=5db38353-1800-0000-9724-cc9f660c0000 pid=3174 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=5db38353-1800-0000-9724-cc9f660c0000 pid=3174 execve guuid=50582054-1800-0000-9724-cc9f670c0000 pid=3175 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=50582054-1800-0000-9724-cc9f670c0000 pid=3175 execve guuid=9576bb54-1800-0000-9724-cc9f680c0000 pid=3176 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=9576bb54-1800-0000-9724-cc9f680c0000 pid=3176 execve guuid=76a24355-1800-0000-9724-cc9f690c0000 pid=3177 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=76a24355-1800-0000-9724-cc9f690c0000 pid=3177 execve guuid=89aad255-1800-0000-9724-cc9f6a0c0000 pid=3178 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=89aad255-1800-0000-9724-cc9f6a0c0000 pid=3178 execve guuid=72465f56-1800-0000-9724-cc9f6b0c0000 pid=3179 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=72465f56-1800-0000-9724-cc9f6b0c0000 pid=3179 execve guuid=9ac41a57-1800-0000-9724-cc9f6c0c0000 pid=3180 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=9ac41a57-1800-0000-9724-cc9f6c0c0000 pid=3180 execve guuid=4f5ca857-1800-0000-9724-cc9f6d0c0000 pid=3181 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=4f5ca857-1800-0000-9724-cc9f6d0c0000 pid=3181 execve guuid=94733058-1800-0000-9724-cc9f6e0c0000 pid=3182 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=94733058-1800-0000-9724-cc9f6e0c0000 pid=3182 execve guuid=80c1b958-1800-0000-9724-cc9f6f0c0000 pid=3183 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=80c1b958-1800-0000-9724-cc9f6f0c0000 pid=3183 execve guuid=a2884a59-1800-0000-9724-cc9f700c0000 pid=3184 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=a2884a59-1800-0000-9724-cc9f700c0000 pid=3184 execve guuid=72eed059-1800-0000-9724-cc9f710c0000 pid=3185 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=72eed059-1800-0000-9724-cc9f710c0000 pid=3185 execve guuid=73405b5a-1800-0000-9724-cc9f720c0000 pid=3186 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=73405b5a-1800-0000-9724-cc9f720c0000 pid=3186 execve guuid=ed8edf5a-1800-0000-9724-cc9f730c0000 pid=3187 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=ed8edf5a-1800-0000-9724-cc9f730c0000 pid=3187 execve guuid=b267705b-1800-0000-9724-cc9f740c0000 pid=3188 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=b267705b-1800-0000-9724-cc9f740c0000 pid=3188 execve guuid=5785ff5b-1800-0000-9724-cc9f750c0000 pid=3189 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=5785ff5b-1800-0000-9724-cc9f750c0000 pid=3189 execve guuid=0acea45c-1800-0000-9724-cc9f770c0000 pid=3191 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=0acea45c-1800-0000-9724-cc9f770c0000 pid=3191 execve guuid=c2b8495d-1800-0000-9724-cc9f780c0000 pid=3192 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=c2b8495d-1800-0000-9724-cc9f780c0000 pid=3192 execve guuid=bd98ce5d-1800-0000-9724-cc9f790c0000 pid=3193 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=bd98ce5d-1800-0000-9724-cc9f790c0000 pid=3193 execve guuid=b131445e-1800-0000-9724-cc9f7b0c0000 pid=3195 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=b131445e-1800-0000-9724-cc9f7b0c0000 pid=3195 execve guuid=fc58695f-1800-0000-9724-cc9f800c0000 pid=3200 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=fc58695f-1800-0000-9724-cc9f800c0000 pid=3200 execve guuid=486ad65f-1800-0000-9724-cc9f820c0000 pid=3202 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=486ad65f-1800-0000-9724-cc9f820c0000 pid=3202 execve guuid=fb0f3c60-1800-0000-9724-cc9f830c0000 pid=3203 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=fb0f3c60-1800-0000-9724-cc9f830c0000 pid=3203 execve guuid=a6baa860-1800-0000-9724-cc9f850c0000 pid=3205 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=a6baa860-1800-0000-9724-cc9f850c0000 pid=3205 execve guuid=b9220a61-1800-0000-9724-cc9f860c0000 pid=3206 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=b9220a61-1800-0000-9724-cc9f860c0000 pid=3206 execve guuid=46ce8c61-1800-0000-9724-cc9f880c0000 pid=3208 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=46ce8c61-1800-0000-9724-cc9f880c0000 pid=3208 execve guuid=1435f561-1800-0000-9724-cc9f8a0c0000 pid=3210 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=1435f561-1800-0000-9724-cc9f8a0c0000 pid=3210 execve guuid=fc3c5f62-1800-0000-9724-cc9f8d0c0000 pid=3213 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=fc3c5f62-1800-0000-9724-cc9f8d0c0000 pid=3213 execve guuid=0da6d962-1800-0000-9724-cc9f8f0c0000 pid=3215 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=0da6d962-1800-0000-9724-cc9f8f0c0000 pid=3215 execve guuid=77e73963-1800-0000-9724-cc9f910c0000 pid=3217 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=77e73963-1800-0000-9724-cc9f910c0000 pid=3217 execve guuid=4020ae63-1800-0000-9724-cc9f920c0000 pid=3218 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=4020ae63-1800-0000-9724-cc9f920c0000 pid=3218 execve guuid=da0e2b64-1800-0000-9724-cc9f930c0000 pid=3219 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=da0e2b64-1800-0000-9724-cc9f930c0000 pid=3219 execve guuid=04498e64-1800-0000-9724-cc9f950c0000 pid=3221 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=04498e64-1800-0000-9724-cc9f950c0000 pid=3221 execve guuid=b16b0b65-1800-0000-9724-cc9f960c0000 pid=3222 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=b16b0b65-1800-0000-9724-cc9f960c0000 pid=3222 execve guuid=15d98365-1800-0000-9724-cc9f970c0000 pid=3223 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=15d98365-1800-0000-9724-cc9f970c0000 pid=3223 execve guuid=4a51f265-1800-0000-9724-cc9f990c0000 pid=3225 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=4a51f265-1800-0000-9724-cc9f990c0000 pid=3225 execve guuid=93286166-1800-0000-9724-cc9f9b0c0000 pid=3227 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=93286166-1800-0000-9724-cc9f9b0c0000 pid=3227 execve guuid=c3f2b866-1800-0000-9724-cc9f9e0c0000 pid=3230 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=c3f2b866-1800-0000-9724-cc9f9e0c0000 pid=3230 execve guuid=820e1567-1800-0000-9724-cc9fa00c0000 pid=3232 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=820e1567-1800-0000-9724-cc9fa00c0000 pid=3232 execve guuid=27d96e67-1800-0000-9724-cc9fa20c0000 pid=3234 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=27d96e67-1800-0000-9724-cc9fa20c0000 pid=3234 execve guuid=0db5e067-1800-0000-9724-cc9fa30c0000 pid=3235 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=0db5e067-1800-0000-9724-cc9fa30c0000 pid=3235 execve guuid=b13d6a68-1800-0000-9724-cc9fa40c0000 pid=3236 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=b13d6a68-1800-0000-9724-cc9fa40c0000 pid=3236 execve guuid=a9df0069-1800-0000-9724-cc9fa50c0000 pid=3237 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=a9df0069-1800-0000-9724-cc9fa50c0000 pid=3237 execve guuid=68a38c69-1800-0000-9724-cc9fa60c0000 pid=3238 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=68a38c69-1800-0000-9724-cc9fa60c0000 pid=3238 execve guuid=0085076a-1800-0000-9724-cc9fa70c0000 pid=3239 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=0085076a-1800-0000-9724-cc9fa70c0000 pid=3239 execve guuid=5789976a-1800-0000-9724-cc9fa80c0000 pid=3240 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=5789976a-1800-0000-9724-cc9fa80c0000 pid=3240 execve guuid=cc8d216b-1800-0000-9724-cc9fa90c0000 pid=3241 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=cc8d216b-1800-0000-9724-cc9fa90c0000 pid=3241 execve guuid=e8b7ad6b-1800-0000-9724-cc9faa0c0000 pid=3242 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=e8b7ad6b-1800-0000-9724-cc9faa0c0000 pid=3242 execve guuid=45ea3b6c-1800-0000-9724-cc9fab0c0000 pid=3243 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=45ea3b6c-1800-0000-9724-cc9fab0c0000 pid=3243 execve guuid=ee48c36c-1800-0000-9724-cc9fac0c0000 pid=3244 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=ee48c36c-1800-0000-9724-cc9fac0c0000 pid=3244 execve guuid=766d3e6d-1800-0000-9724-cc9fad0c0000 pid=3245 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=766d3e6d-1800-0000-9724-cc9fad0c0000 pid=3245 execve guuid=e8d9c36d-1800-0000-9724-cc9fae0c0000 pid=3246 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=e8d9c36d-1800-0000-9724-cc9fae0c0000 pid=3246 execve guuid=45e3446e-1800-0000-9724-cc9faf0c0000 pid=3247 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=45e3446e-1800-0000-9724-cc9faf0c0000 pid=3247 execve guuid=3191ab6e-1800-0000-9724-cc9fb10c0000 pid=3249 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=3191ab6e-1800-0000-9724-cc9fb10c0000 pid=3249 execve guuid=4966306f-1800-0000-9724-cc9fb20c0000 pid=3250 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=4966306f-1800-0000-9724-cc9fb20c0000 pid=3250 execve guuid=a0bda56f-1800-0000-9724-cc9fb30c0000 pid=3251 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=a0bda56f-1800-0000-9724-cc9fb30c0000 pid=3251 execve guuid=b6d81870-1800-0000-9724-cc9fb50c0000 pid=3253 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=b6d81870-1800-0000-9724-cc9fb50c0000 pid=3253 execve guuid=14a18170-1800-0000-9724-cc9fb80c0000 pid=3256 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=14a18170-1800-0000-9724-cc9fb80c0000 pid=3256 execve guuid=bb5af470-1800-0000-9724-cc9fbb0c0000 pid=3259 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=bb5af470-1800-0000-9724-cc9fbb0c0000 pid=3259 execve guuid=47478871-1800-0000-9724-cc9fbd0c0000 pid=3261 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=47478871-1800-0000-9724-cc9fbd0c0000 pid=3261 execve guuid=f5e2f271-1800-0000-9724-cc9fbf0c0000 pid=3263 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=f5e2f271-1800-0000-9724-cc9fbf0c0000 pid=3263 execve guuid=b8475272-1800-0000-9724-cc9fc00c0000 pid=3264 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=b8475272-1800-0000-9724-cc9fc00c0000 pid=3264 execve guuid=32f2ad72-1800-0000-9724-cc9fc20c0000 pid=3266 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=32f2ad72-1800-0000-9724-cc9fc20c0000 pid=3266 execve guuid=c7c50e73-1800-0000-9724-cc9fc40c0000 pid=3268 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=c7c50e73-1800-0000-9724-cc9fc40c0000 pid=3268 execve guuid=d0d86f73-1800-0000-9724-cc9fc60c0000 pid=3270 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=d0d86f73-1800-0000-9724-cc9fc60c0000 pid=3270 execve guuid=2ffacd73-1800-0000-9724-cc9fc80c0000 pid=3272 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=2ffacd73-1800-0000-9724-cc9fc80c0000 pid=3272 execve guuid=b1374a74-1800-0000-9724-cc9fca0c0000 pid=3274 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=b1374a74-1800-0000-9724-cc9fca0c0000 pid=3274 execve guuid=5706cc74-1800-0000-9724-cc9fcc0c0000 pid=3276 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=5706cc74-1800-0000-9724-cc9fcc0c0000 pid=3276 execve guuid=caf24675-1800-0000-9724-cc9fcd0c0000 pid=3277 /usr/bin/ls guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=caf24675-1800-0000-9724-cc9fcd0c0000 pid=3277 execve guuid=28960c76-1800-0000-9724-cc9fcf0c0000 pid=3279 /usr/bin/rm guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=28960c76-1800-0000-9724-cc9fcf0c0000 pid=3279 execve guuid=c101b376-1800-0000-9724-cc9fd00c0000 pid=3280 /usr/bin/wget net send-data write-file guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=c101b376-1800-0000-9724-cc9fd00c0000 pid=3280 execve guuid=f61bee7d-1800-0000-9724-cc9fd80c0000 pid=3288 /usr/bin/chmod guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=f61bee7d-1800-0000-9724-cc9fd80c0000 pid=3288 execve guuid=e7f1327e-1800-0000-9724-cc9fd90c0000 pid=3289 /usr/bin/dash guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=e7f1327e-1800-0000-9724-cc9fd90c0000 pid=3289 clone guuid=540bc37f-1800-0000-9724-cc9fdb0c0000 pid=3291 /usr/bin/rm guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=540bc37f-1800-0000-9724-cc9fdb0c0000 pid=3291 execve guuid=2b06fe7f-1800-0000-9724-cc9fdd0c0000 pid=3293 /usr/bin/wget net send-data write-file guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=2b06fe7f-1800-0000-9724-cc9fdd0c0000 pid=3293 execve guuid=986dbd84-1800-0000-9724-cc9fed0c0000 pid=3309 /usr/bin/chmod guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=986dbd84-1800-0000-9724-cc9fed0c0000 pid=3309 execve guuid=3ebf1e85-1800-0000-9724-cc9fee0c0000 pid=3310 /usr/bin/dash guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=3ebf1e85-1800-0000-9724-cc9fee0c0000 pid=3310 clone guuid=5c4ddc85-1800-0000-9724-cc9ff20c0000 pid=3314 /usr/bin/rm guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=5c4ddc85-1800-0000-9724-cc9ff20c0000 pid=3314 execve guuid=27cf3b86-1800-0000-9724-cc9ff40c0000 pid=3316 /usr/bin/wget net send-data write-file guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=27cf3b86-1800-0000-9724-cc9ff40c0000 pid=3316 execve guuid=8472f98b-1800-0000-9724-cc9f020d0000 pid=3330 /usr/bin/chmod guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=8472f98b-1800-0000-9724-cc9f020d0000 pid=3330 execve guuid=03bb308c-1800-0000-9724-cc9f030d0000 pid=3331 /usr/bin/dash guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=03bb308c-1800-0000-9724-cc9f030d0000 pid=3331 clone guuid=ee11018e-1800-0000-9724-cc9f0b0d0000 pid=3339 /usr/bin/rm guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=ee11018e-1800-0000-9724-cc9f0b0d0000 pid=3339 execve guuid=c505618e-1800-0000-9724-cc9f0c0d0000 pid=3340 /usr/bin/wget net send-data write-file guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=c505618e-1800-0000-9724-cc9f0c0d0000 pid=3340 execve guuid=6dc27e94-1800-0000-9724-cc9f1a0d0000 pid=3354 /usr/bin/chmod guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=6dc27e94-1800-0000-9724-cc9f1a0d0000 pid=3354 execve guuid=14c5f294-1800-0000-9724-cc9f1b0d0000 pid=3355 /usr/bin/dash guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=14c5f294-1800-0000-9724-cc9f1b0d0000 pid=3355 clone guuid=4ddbe196-1800-0000-9724-cc9f200d0000 pid=3360 /usr/bin/rm guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=4ddbe196-1800-0000-9724-cc9f200d0000 pid=3360 execve guuid=31cb2397-1800-0000-9724-cc9f220d0000 pid=3362 /usr/bin/wget net send-data write-file guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=31cb2397-1800-0000-9724-cc9f220d0000 pid=3362 execve guuid=7718599d-1800-0000-9724-cc9f2c0d0000 pid=3372 /usr/bin/chmod guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=7718599d-1800-0000-9724-cc9f2c0d0000 pid=3372 execve guuid=d619ac9d-1800-0000-9724-cc9f2d0d0000 pid=3373 /usr/bin/dash guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=d619ac9d-1800-0000-9724-cc9f2d0d0000 pid=3373 clone guuid=88913f9e-1800-0000-9724-cc9f310d0000 pid=3377 /usr/bin/rm delete-file guuid=edba793b-1800-0000-9724-cc9f120c0000 pid=3090->guuid=88913f9e-1800-0000-9724-cc9f310d0000 pid=3377 execve 0b1ba66e-2f8f-542f-9f7c-00dd01da057c 129.121.110.105:80 guuid=c101b376-1800-0000-9724-cc9fd00c0000 pid=3280->0b1ba66e-2f8f-542f-9f7c-00dd01da057c send: 134B guuid=2b06fe7f-1800-0000-9724-cc9fdd0c0000 pid=3293->0b1ba66e-2f8f-542f-9f7c-00dd01da057c send: 134B guuid=27cf3b86-1800-0000-9724-cc9ff40c0000 pid=3316->0b1ba66e-2f8f-542f-9f7c-00dd01da057c send: 134B guuid=c505618e-1800-0000-9724-cc9f0c0d0000 pid=3340->0b1ba66e-2f8f-542f-9f7c-00dd01da057c send: 134B guuid=31cb2397-1800-0000-9724-cc9f220d0000 pid=3362->0b1ba66e-2f8f-542f-9f7c-00dd01da057c send: 134B
Score:
95%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/9a3d1161f32cefd7b28fa38ca355aabfb108b771e30f49f507781d80cc5ae7ca
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/9a3d1161f32cefd7b28fa38ca355aabfb108b771e30f49f507781d80cc5ae7ca/
Threat name:
Document-HTML.Trojan.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2026-07-20 07:52:33 UTC
File Type:
Text (Shell)
AV detection:
10 of 24 (41.67%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ti6rcyptftx5pmupuogkgvnkx6yqrn3r4mhut5ihpaoybtc247fa._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery execution linux persistence privilege_escalation
Link:
https://tria.ge/reports/260720-jqqrmsax3p/
Behaviour
Enumerates kernel/hardware configuration
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
Creates/modifies Cron job
Enumerates running processes
Modifies rc script
Modifies systemd
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.26
Link:
https://yomi.yoroi.company/submissions/9a3d1161f32cefd7b28fa38ca355aabfb108b771e30f49f507781d80cc5ae7ca

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 9a3d1161f32cefd7b28fa38ca355aabfb108b771e30f49f507781d80cc5ae7ca

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3887344/
  
Delivery method
Distributed via web download

Comments