🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a5f5b7f2eed63b2fad2962b3a2077ddb38530bcbf49e7ad6cd70addefa573958. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a5f5b7f2eed63b2fad2962b3a2077ddb38530bcbf49e7ad6cd70addefa573958
SHA3-384 hash: 30337c1866d832ab30d493fa034f7b0267168a72aab463b647148725c2be083f18ea5ac6526ca43b4735621e55793054
SHA1 hash: dad0727ccc9ef373f30e636613599ae3d070a652
MD5 hash: 70ff5b719918afe2538d3f062ffc39f5
humanhash: echo-green-july-alanine
File name:lil
Download: download sample
File size:852 bytes
First seen:2026-08-05 16:44:37 UTC
Last seen:2026-08-05 18:56:37 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkaeC8F5CPFU8CjSIbT7CsWiRFCEI5fBX:kXCKysE2hi0ziQvZohaeN5Qbm7FF5g5X
TLSH T1920188C58210694080AA9E9C22975059F411C3CE2E5F8F68BF6C6D3DEB98C14B036F8C
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://129.121.114.124/5eMn/an/aua-wget
http://129.121.114.124/AVWFn/an/aua-wget
http://129.121.114.124/ubt5n/an/aua-wget
http://129.121.114.124/CE3Wn/an/aua-wget
http://129.121.114.124/6mOkn/an/aua-wget

Intelligence

File Origin
# of uploads :
2
# of downloads :
77
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive mirai
Link:
https://www.filescan.io/uploads/6a7368b3bd180a3b1aa97015/reports/90794ce9-76e3-4645-8df8-d94961e67455/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-08-05T14:58:00Z UTC
Last seen:
2026-08-05T15:34:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/a5f5b7f2eed63b2fad2962b3a2077ddb38530bcbf49e7ad6cd70addefa573958/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/4b9f8dcc-2f12-4bf0-813f-e8f4e387814d
Behavior Graph:
Download SVG
%3 guuid=0e24a8f1-1600-0000-3334-5a9ab00c0000 pid=3248 /usr/bin/sudo guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250 /tmp/sample.bin write-file guuid=0e24a8f1-1600-0000-3334-5a9ab00c0000 pid=3248->guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250 execve guuid=bb59fff3-1600-0000-3334-5a9ab40c0000 pid=3252 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=bb59fff3-1600-0000-3334-5a9ab40c0000 pid=3252 execve guuid=307484f5-1600-0000-3334-5a9ab70c0000 pid=3255 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=307484f5-1600-0000-3334-5a9ab70c0000 pid=3255 execve guuid=839150f6-1600-0000-3334-5a9ab80c0000 pid=3256 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=839150f6-1600-0000-3334-5a9ab80c0000 pid=3256 execve guuid=ed8cc3f6-1600-0000-3334-5a9ab90c0000 pid=3257 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=ed8cc3f6-1600-0000-3334-5a9ab90c0000 pid=3257 execve guuid=8062aaf7-1600-0000-3334-5a9abb0c0000 pid=3259 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=8062aaf7-1600-0000-3334-5a9abb0c0000 pid=3259 execve guuid=cb0704f8-1600-0000-3334-5a9abd0c0000 pid=3261 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=cb0704f8-1600-0000-3334-5a9abd0c0000 pid=3261 execve guuid=d37056f8-1600-0000-3334-5a9abf0c0000 pid=3263 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=d37056f8-1600-0000-3334-5a9abf0c0000 pid=3263 execve guuid=0ea8adf8-1600-0000-3334-5a9ac20c0000 pid=3266 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=0ea8adf8-1600-0000-3334-5a9ac20c0000 pid=3266 execve guuid=7c3e24f9-1600-0000-3334-5a9ac40c0000 pid=3268 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=7c3e24f9-1600-0000-3334-5a9ac40c0000 pid=3268 execve guuid=dae0def9-1600-0000-3334-5a9ac90c0000 pid=3273 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=dae0def9-1600-0000-3334-5a9ac90c0000 pid=3273 execve guuid=7b18fffa-1600-0000-3334-5a9acd0c0000 pid=3277 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=7b18fffa-1600-0000-3334-5a9acd0c0000 pid=3277 execve guuid=4c6928fc-1600-0000-3334-5a9ad10c0000 pid=3281 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=4c6928fc-1600-0000-3334-5a9ad10c0000 pid=3281 execve guuid=eb412bfd-1600-0000-3334-5a9ad30c0000 pid=3283 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=eb412bfd-1600-0000-3334-5a9ad30c0000 pid=3283 execve guuid=bbd1caff-1600-0000-3334-5a9ad50c0000 pid=3285 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=bbd1caff-1600-0000-3334-5a9ad50c0000 pid=3285 execve guuid=a0847300-1700-0000-3334-5a9ad80c0000 pid=3288 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=a0847300-1700-0000-3334-5a9ad80c0000 pid=3288 execve guuid=638d0d01-1700-0000-3334-5a9adb0c0000 pid=3291 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=638d0d01-1700-0000-3334-5a9adb0c0000 pid=3291 execve guuid=90529c01-1700-0000-3334-5a9add0c0000 pid=3293 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=90529c01-1700-0000-3334-5a9add0c0000 pid=3293 execve guuid=a4b22002-1700-0000-3334-5a9adf0c0000 pid=3295 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=a4b22002-1700-0000-3334-5a9adf0c0000 pid=3295 execve guuid=ff3a9e02-1700-0000-3334-5a9ae20c0000 pid=3298 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=ff3a9e02-1700-0000-3334-5a9ae20c0000 pid=3298 execve guuid=d1822103-1700-0000-3334-5a9ae40c0000 pid=3300 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=d1822103-1700-0000-3334-5a9ae40c0000 pid=3300 execve guuid=f9f0c203-1700-0000-3334-5a9ae60c0000 pid=3302 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=f9f0c203-1700-0000-3334-5a9ae60c0000 pid=3302 execve guuid=60205d04-1700-0000-3334-5a9ae70c0000 pid=3303 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=60205d04-1700-0000-3334-5a9ae70c0000 pid=3303 execve guuid=87b3ee04-1700-0000-3334-5a9ae90c0000 pid=3305 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=87b3ee04-1700-0000-3334-5a9ae90c0000 pid=3305 execve guuid=05c17705-1700-0000-3334-5a9aeb0c0000 pid=3307 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=05c17705-1700-0000-3334-5a9aeb0c0000 pid=3307 execve guuid=951fcd05-1700-0000-3334-5a9aed0c0000 pid=3309 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=951fcd05-1700-0000-3334-5a9aed0c0000 pid=3309 execve guuid=cfc71f06-1700-0000-3334-5a9af00c0000 pid=3312 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=cfc71f06-1700-0000-3334-5a9af00c0000 pid=3312 execve guuid=75e37506-1700-0000-3334-5a9af20c0000 pid=3314 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=75e37506-1700-0000-3334-5a9af20c0000 pid=3314 execve guuid=e89ac606-1700-0000-3334-5a9af40c0000 pid=3316 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=e89ac606-1700-0000-3334-5a9af40c0000 pid=3316 execve guuid=29112907-1700-0000-3334-5a9af70c0000 pid=3319 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=29112907-1700-0000-3334-5a9af70c0000 pid=3319 execve guuid=68d29c07-1700-0000-3334-5a9af90c0000 pid=3321 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=68d29c07-1700-0000-3334-5a9af90c0000 pid=3321 execve guuid=e804f207-1700-0000-3334-5a9afc0c0000 pid=3324 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=e804f207-1700-0000-3334-5a9afc0c0000 pid=3324 execve guuid=aba55408-1700-0000-3334-5a9afe0c0000 pid=3326 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=aba55408-1700-0000-3334-5a9afe0c0000 pid=3326 execve guuid=34b1c408-1700-0000-3334-5a9a010d0000 pid=3329 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=34b1c408-1700-0000-3334-5a9a010d0000 pid=3329 execve guuid=63f92509-1700-0000-3334-5a9a040d0000 pid=3332 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=63f92509-1700-0000-3334-5a9a040d0000 pid=3332 execve guuid=5cd88a09-1700-0000-3334-5a9a060d0000 pid=3334 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=5cd88a09-1700-0000-3334-5a9a060d0000 pid=3334 execve guuid=c3c0ea09-1700-0000-3334-5a9a090d0000 pid=3337 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=c3c0ea09-1700-0000-3334-5a9a090d0000 pid=3337 execve guuid=42c94e0a-1700-0000-3334-5a9a0b0d0000 pid=3339 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=42c94e0a-1700-0000-3334-5a9a0b0d0000 pid=3339 execve guuid=8913b10a-1700-0000-3334-5a9a0e0d0000 pid=3342 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=8913b10a-1700-0000-3334-5a9a0e0d0000 pid=3342 execve guuid=b62a1c0b-1700-0000-3334-5a9a100d0000 pid=3344 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=b62a1c0b-1700-0000-3334-5a9a100d0000 pid=3344 execve guuid=2381860b-1700-0000-3334-5a9a130d0000 pid=3347 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=2381860b-1700-0000-3334-5a9a130d0000 pid=3347 execve guuid=d06ff40b-1700-0000-3334-5a9a160d0000 pid=3350 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=d06ff40b-1700-0000-3334-5a9a160d0000 pid=3350 execve guuid=86467e0c-1700-0000-3334-5a9a190d0000 pid=3353 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=86467e0c-1700-0000-3334-5a9a190d0000 pid=3353 execve guuid=21f1e20c-1700-0000-3334-5a9a1b0d0000 pid=3355 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=21f1e20c-1700-0000-3334-5a9a1b0d0000 pid=3355 execve guuid=8d7c460d-1700-0000-3334-5a9a1d0d0000 pid=3357 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=8d7c460d-1700-0000-3334-5a9a1d0d0000 pid=3357 execve guuid=5c82de0d-1700-0000-3334-5a9a200d0000 pid=3360 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=5c82de0d-1700-0000-3334-5a9a200d0000 pid=3360 execve guuid=9d434a0e-1700-0000-3334-5a9a230d0000 pid=3363 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=9d434a0e-1700-0000-3334-5a9a230d0000 pid=3363 execve guuid=d17f0a0f-1700-0000-3334-5a9a270d0000 pid=3367 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=d17f0a0f-1700-0000-3334-5a9a270d0000 pid=3367 execve guuid=c84a980f-1700-0000-3334-5a9a2a0d0000 pid=3370 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=c84a980f-1700-0000-3334-5a9a2a0d0000 pid=3370 execve guuid=e1e13f10-1700-0000-3334-5a9a2d0d0000 pid=3373 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=e1e13f10-1700-0000-3334-5a9a2d0d0000 pid=3373 execve guuid=92c6e610-1700-0000-3334-5a9a310d0000 pid=3377 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=92c6e610-1700-0000-3334-5a9a310d0000 pid=3377 execve guuid=c9987a11-1700-0000-3334-5a9a350d0000 pid=3381 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=c9987a11-1700-0000-3334-5a9a350d0000 pid=3381 execve guuid=ad718713-1700-0000-3334-5a9a3e0d0000 pid=3390 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=ad718713-1700-0000-3334-5a9a3e0d0000 pid=3390 execve guuid=8af5fb16-1700-0000-3334-5a9a4d0d0000 pid=3405 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=8af5fb16-1700-0000-3334-5a9a4d0d0000 pid=3405 execve guuid=41f85e17-1700-0000-3334-5a9a500d0000 pid=3408 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=41f85e17-1700-0000-3334-5a9a500d0000 pid=3408 execve guuid=f34ca517-1700-0000-3334-5a9a520d0000 pid=3410 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=f34ca517-1700-0000-3334-5a9a520d0000 pid=3410 execve guuid=6ceafd17-1700-0000-3334-5a9a540d0000 pid=3412 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=6ceafd17-1700-0000-3334-5a9a540d0000 pid=3412 execve guuid=8e975618-1700-0000-3334-5a9a570d0000 pid=3415 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=8e975618-1700-0000-3334-5a9a570d0000 pid=3415 execve guuid=ef06b218-1700-0000-3334-5a9a590d0000 pid=3417 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=ef06b218-1700-0000-3334-5a9a590d0000 pid=3417 execve guuid=15bf1219-1700-0000-3334-5a9a5c0d0000 pid=3420 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=15bf1219-1700-0000-3334-5a9a5c0d0000 pid=3420 execve guuid=96a56619-1700-0000-3334-5a9a5e0d0000 pid=3422 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=96a56619-1700-0000-3334-5a9a5e0d0000 pid=3422 execve guuid=3de8c019-1700-0000-3334-5a9a610d0000 pid=3425 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=3de8c019-1700-0000-3334-5a9a610d0000 pid=3425 execve guuid=967a171a-1700-0000-3334-5a9a630d0000 pid=3427 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=967a171a-1700-0000-3334-5a9a630d0000 pid=3427 execve guuid=b5b7691a-1700-0000-3334-5a9a650d0000 pid=3429 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=b5b7691a-1700-0000-3334-5a9a650d0000 pid=3429 execve guuid=e4c2c51a-1700-0000-3334-5a9a6a0d0000 pid=3434 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=e4c2c51a-1700-0000-3334-5a9a6a0d0000 pid=3434 execve guuid=45a71d1b-1700-0000-3334-5a9a6b0d0000 pid=3435 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=45a71d1b-1700-0000-3334-5a9a6b0d0000 pid=3435 execve guuid=d5677a1b-1700-0000-3334-5a9a6c0d0000 pid=3436 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=d5677a1b-1700-0000-3334-5a9a6c0d0000 pid=3436 execve guuid=41386f1c-1700-0000-3334-5a9a6d0d0000 pid=3437 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=41386f1c-1700-0000-3334-5a9a6d0d0000 pid=3437 execve guuid=31a0e81c-1700-0000-3334-5a9a6e0d0000 pid=3438 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=31a0e81c-1700-0000-3334-5a9a6e0d0000 pid=3438 execve guuid=8ba6541d-1700-0000-3334-5a9a6f0d0000 pid=3439 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=8ba6541d-1700-0000-3334-5a9a6f0d0000 pid=3439 execve guuid=6470b31d-1700-0000-3334-5a9a700d0000 pid=3440 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=6470b31d-1700-0000-3334-5a9a700d0000 pid=3440 execve guuid=63cc1d1e-1700-0000-3334-5a9a710d0000 pid=3441 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=63cc1d1e-1700-0000-3334-5a9a710d0000 pid=3441 execve guuid=3881881e-1700-0000-3334-5a9a720d0000 pid=3442 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=3881881e-1700-0000-3334-5a9a720d0000 pid=3442 execve guuid=eeb2f31e-1700-0000-3334-5a9a730d0000 pid=3443 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=eeb2f31e-1700-0000-3334-5a9a730d0000 pid=3443 execve guuid=c6e3601f-1700-0000-3334-5a9a740d0000 pid=3444 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=c6e3601f-1700-0000-3334-5a9a740d0000 pid=3444 execve guuid=5ba3c71f-1700-0000-3334-5a9a780d0000 pid=3448 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=5ba3c71f-1700-0000-3334-5a9a780d0000 pid=3448 execve guuid=d6c83220-1700-0000-3334-5a9a790d0000 pid=3449 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=d6c83220-1700-0000-3334-5a9a790d0000 pid=3449 execve guuid=dc6eb720-1700-0000-3334-5a9a7c0d0000 pid=3452 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=dc6eb720-1700-0000-3334-5a9a7c0d0000 pid=3452 execve guuid=0f7b1521-1700-0000-3334-5a9a7e0d0000 pid=3454 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=0f7b1521-1700-0000-3334-5a9a7e0d0000 pid=3454 execve guuid=d07c7a21-1700-0000-3334-5a9a810d0000 pid=3457 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=d07c7a21-1700-0000-3334-5a9a810d0000 pid=3457 execve guuid=802ce421-1700-0000-3334-5a9a830d0000 pid=3459 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=802ce421-1700-0000-3334-5a9a830d0000 pid=3459 execve guuid=c1546f22-1700-0000-3334-5a9a860d0000 pid=3462 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=c1546f22-1700-0000-3334-5a9a860d0000 pid=3462 execve guuid=384cd622-1700-0000-3334-5a9a880d0000 pid=3464 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=384cd622-1700-0000-3334-5a9a880d0000 pid=3464 execve guuid=f4fd3a23-1700-0000-3334-5a9a8a0d0000 pid=3466 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=f4fd3a23-1700-0000-3334-5a9a8a0d0000 pid=3466 execve guuid=dcee9923-1700-0000-3334-5a9a8b0d0000 pid=3467 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=dcee9923-1700-0000-3334-5a9a8b0d0000 pid=3467 execve guuid=41290d24-1700-0000-3334-5a9a8c0d0000 pid=3468 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=41290d24-1700-0000-3334-5a9a8c0d0000 pid=3468 execve guuid=25847624-1700-0000-3334-5a9a8e0d0000 pid=3470 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=25847624-1700-0000-3334-5a9a8e0d0000 pid=3470 execve guuid=9f0ecf24-1700-0000-3334-5a9a8f0d0000 pid=3471 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=9f0ecf24-1700-0000-3334-5a9a8f0d0000 pid=3471 execve guuid=235c4125-1700-0000-3334-5a9a900d0000 pid=3472 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=235c4125-1700-0000-3334-5a9a900d0000 pid=3472 execve guuid=80ecb325-1700-0000-3334-5a9a910d0000 pid=3473 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=80ecb325-1700-0000-3334-5a9a910d0000 pid=3473 execve guuid=6cfa4926-1700-0000-3334-5a9a920d0000 pid=3474 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=6cfa4926-1700-0000-3334-5a9a920d0000 pid=3474 execve guuid=91acbb26-1700-0000-3334-5a9a940d0000 pid=3476 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=91acbb26-1700-0000-3334-5a9a940d0000 pid=3476 execve guuid=07c02727-1700-0000-3334-5a9a970d0000 pid=3479 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=07c02727-1700-0000-3334-5a9a970d0000 pid=3479 execve guuid=659fa227-1700-0000-3334-5a9a9a0d0000 pid=3482 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=659fa227-1700-0000-3334-5a9a9a0d0000 pid=3482 execve guuid=6800f127-1700-0000-3334-5a9a9c0d0000 pid=3484 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=6800f127-1700-0000-3334-5a9a9c0d0000 pid=3484 execve guuid=5e745928-1700-0000-3334-5a9a9d0d0000 pid=3485 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=5e745928-1700-0000-3334-5a9a9d0d0000 pid=3485 execve guuid=c466cc28-1700-0000-3334-5a9a9e0d0000 pid=3486 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=c466cc28-1700-0000-3334-5a9a9e0d0000 pid=3486 execve guuid=17094029-1700-0000-3334-5a9a9f0d0000 pid=3487 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=17094029-1700-0000-3334-5a9a9f0d0000 pid=3487 execve guuid=653e9f29-1700-0000-3334-5a9aa10d0000 pid=3489 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=653e9f29-1700-0000-3334-5a9aa10d0000 pid=3489 execve guuid=be43162a-1700-0000-3334-5a9aa20d0000 pid=3490 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=be43162a-1700-0000-3334-5a9aa20d0000 pid=3490 execve guuid=a0e97d2a-1700-0000-3334-5a9aa30d0000 pid=3491 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=a0e97d2a-1700-0000-3334-5a9aa30d0000 pid=3491 execve guuid=1b2bde2a-1700-0000-3334-5a9aa50d0000 pid=3493 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=1b2bde2a-1700-0000-3334-5a9aa50d0000 pid=3493 execve guuid=c2ad2e2b-1700-0000-3334-5a9aa70d0000 pid=3495 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=c2ad2e2b-1700-0000-3334-5a9aa70d0000 pid=3495 execve guuid=5a5d7d2b-1700-0000-3334-5a9aaa0d0000 pid=3498 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=5a5d7d2b-1700-0000-3334-5a9aaa0d0000 pid=3498 execve guuid=c8e8cc2b-1700-0000-3334-5a9aac0d0000 pid=3500 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=c8e8cc2b-1700-0000-3334-5a9aac0d0000 pid=3500 execve guuid=9a7a202c-1700-0000-3334-5a9aae0d0000 pid=3502 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=9a7a202c-1700-0000-3334-5a9aae0d0000 pid=3502 execve guuid=8ed06e2c-1700-0000-3334-5a9ab00d0000 pid=3504 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=8ed06e2c-1700-0000-3334-5a9ab00d0000 pid=3504 execve guuid=a48bbf2c-1700-0000-3334-5a9ab20d0000 pid=3506 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=a48bbf2c-1700-0000-3334-5a9ab20d0000 pid=3506 execve guuid=ddaa102d-1700-0000-3334-5a9ab40d0000 pid=3508 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=ddaa102d-1700-0000-3334-5a9ab40d0000 pid=3508 execve guuid=028f5e2d-1700-0000-3334-5a9ab60d0000 pid=3510 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=028f5e2d-1700-0000-3334-5a9ab60d0000 pid=3510 execve guuid=d593aa2d-1700-0000-3334-5a9ab80d0000 pid=3512 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=d593aa2d-1700-0000-3334-5a9ab80d0000 pid=3512 execve guuid=1068fa2d-1700-0000-3334-5a9abb0d0000 pid=3515 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=1068fa2d-1700-0000-3334-5a9abb0d0000 pid=3515 execve guuid=88ab492e-1700-0000-3334-5a9abc0d0000 pid=3516 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=88ab492e-1700-0000-3334-5a9abc0d0000 pid=3516 execve guuid=76ac972e-1700-0000-3334-5a9abe0d0000 pid=3518 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=76ac972e-1700-0000-3334-5a9abe0d0000 pid=3518 execve guuid=47eee32e-1700-0000-3334-5a9ac10d0000 pid=3521 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=47eee32e-1700-0000-3334-5a9ac10d0000 pid=3521 execve guuid=50ea332f-1700-0000-3334-5a9ac20d0000 pid=3522 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=50ea332f-1700-0000-3334-5a9ac20d0000 pid=3522 execve guuid=b527932f-1700-0000-3334-5a9ac30d0000 pid=3523 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=b527932f-1700-0000-3334-5a9ac30d0000 pid=3523 execve guuid=0ec5fe2f-1700-0000-3334-5a9ac40d0000 pid=3524 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=0ec5fe2f-1700-0000-3334-5a9ac40d0000 pid=3524 execve guuid=b53a6230-1700-0000-3334-5a9ac50d0000 pid=3525 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=b53a6230-1700-0000-3334-5a9ac50d0000 pid=3525 execve guuid=adcdca30-1700-0000-3334-5a9ac60d0000 pid=3526 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=adcdca30-1700-0000-3334-5a9ac60d0000 pid=3526 execve guuid=7ff33c31-1700-0000-3334-5a9ac70d0000 pid=3527 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=7ff33c31-1700-0000-3334-5a9ac70d0000 pid=3527 execve guuid=3315a131-1700-0000-3334-5a9ac80d0000 pid=3528 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=3315a131-1700-0000-3334-5a9ac80d0000 pid=3528 execve guuid=f0d80932-1700-0000-3334-5a9ac90d0000 pid=3529 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=f0d80932-1700-0000-3334-5a9ac90d0000 pid=3529 execve guuid=8b897332-1700-0000-3334-5a9aca0d0000 pid=3530 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=8b897332-1700-0000-3334-5a9aca0d0000 pid=3530 execve guuid=9cb4de32-1700-0000-3334-5a9acb0d0000 pid=3531 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=9cb4de32-1700-0000-3334-5a9acb0d0000 pid=3531 execve guuid=930c3633-1700-0000-3334-5a9acd0d0000 pid=3533 /usr/bin/ls guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=930c3633-1700-0000-3334-5a9acd0d0000 pid=3533 execve guuid=ce149e33-1700-0000-3334-5a9ace0d0000 pid=3534 /usr/bin/rm guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=ce149e33-1700-0000-3334-5a9ace0d0000 pid=3534 execve guuid=aa00e133-1700-0000-3334-5a9acf0d0000 pid=3535 /usr/bin/wget net send-data write-file guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=aa00e133-1700-0000-3334-5a9acf0d0000 pid=3535 execve guuid=1508fe4d-1700-0000-3334-5a9a210e0000 pid=3617 /usr/bin/chmod guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=1508fe4d-1700-0000-3334-5a9a210e0000 pid=3617 execve guuid=e2cd534e-1700-0000-3334-5a9a230e0000 pid=3619 /usr/bin/dash guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=e2cd534e-1700-0000-3334-5a9a230e0000 pid=3619 clone guuid=5f1fe54e-1700-0000-3334-5a9a270e0000 pid=3623 /usr/bin/rm guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=5f1fe54e-1700-0000-3334-5a9a270e0000 pid=3623 execve guuid=bd111f4f-1700-0000-3334-5a9a280e0000 pid=3624 /usr/bin/wget net send-data write-file guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=bd111f4f-1700-0000-3334-5a9a280e0000 pid=3624 execve guuid=671b016a-1700-0000-3334-5a9a660e0000 pid=3686 /usr/bin/chmod guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=671b016a-1700-0000-3334-5a9a660e0000 pid=3686 execve guuid=f6ba4c6a-1700-0000-3334-5a9a670e0000 pid=3687 /usr/bin/dash guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=f6ba4c6a-1700-0000-3334-5a9a670e0000 pid=3687 clone guuid=5fc5166b-1700-0000-3334-5a9a690e0000 pid=3689 /usr/bin/rm guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=5fc5166b-1700-0000-3334-5a9a690e0000 pid=3689 execve guuid=d57f616b-1700-0000-3334-5a9a6a0e0000 pid=3690 /usr/bin/wget net send-data write-file guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=d57f616b-1700-0000-3334-5a9a6a0e0000 pid=3690 execve guuid=790d0084-1700-0000-3334-5a9abb0e0000 pid=3771 /usr/bin/chmod guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=790d0084-1700-0000-3334-5a9abb0e0000 pid=3771 execve guuid=53f76384-1700-0000-3334-5a9abe0e0000 pid=3774 /usr/bin/dash guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=53f76384-1700-0000-3334-5a9abe0e0000 pid=3774 clone guuid=c387d984-1700-0000-3334-5a9ac20e0000 pid=3778 /usr/bin/rm guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=c387d984-1700-0000-3334-5a9ac20e0000 pid=3778 execve guuid=38061385-1700-0000-3334-5a9ac30e0000 pid=3779 /usr/bin/wget net send-data write-file guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=38061385-1700-0000-3334-5a9ac30e0000 pid=3779 execve guuid=2f712ba4-1700-0000-3334-5a9a280f0000 pid=3880 /usr/bin/chmod guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=2f712ba4-1700-0000-3334-5a9a280f0000 pid=3880 execve guuid=80a585a4-1700-0000-3334-5a9a2a0f0000 pid=3882 /usr/bin/dash guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=80a585a4-1700-0000-3334-5a9a2a0f0000 pid=3882 clone guuid=07be94a5-1700-0000-3334-5a9a300f0000 pid=3888 /usr/bin/rm guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=07be94a5-1700-0000-3334-5a9a300f0000 pid=3888 execve guuid=3dfe06a6-1700-0000-3334-5a9a320f0000 pid=3890 /usr/bin/wget net send-data write-file guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=3dfe06a6-1700-0000-3334-5a9a320f0000 pid=3890 execve guuid=42854bc4-1700-0000-3334-5a9a960f0000 pid=3990 /usr/bin/chmod guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=42854bc4-1700-0000-3334-5a9a960f0000 pid=3990 execve guuid=ef96f2c4-1700-0000-3334-5a9a980f0000 pid=3992 /usr/bin/dash guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=ef96f2c4-1700-0000-3334-5a9a980f0000 pid=3992 clone guuid=4628eec6-1700-0000-3334-5a9a9e0f0000 pid=3998 /usr/bin/rm delete-file guuid=052da5f3-1600-0000-3334-5a9ab20c0000 pid=3250->guuid=4628eec6-1700-0000-3334-5a9a9e0f0000 pid=3998 execve 801186e6-5fe8-5959-a7b4-832d8d66e7aa 129.121.114.124:80 guuid=aa00e133-1700-0000-3334-5a9acf0d0000 pid=3535->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 133B guuid=bd111f4f-1700-0000-3334-5a9a280e0000 pid=3624->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 134B guuid=d57f616b-1700-0000-3334-5a9a6a0e0000 pid=3690->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 134B guuid=38061385-1700-0000-3334-5a9ac30e0000 pid=3779->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 134B guuid=3dfe06a6-1700-0000-3334-5a9a320f0000 pid=3890->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 134B
Score:
98%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/a5f5b7f2eed63b2fad2962b3a2077ddb38530bcbf49e7ad6cd70addefa573958
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a5f5b7f2eed63b2fad2962b3a2077ddb38530bcbf49e7ad6cd70addefa573958/
Threat name:
Win32.Trojan.Malgent
Create hunting rule
Status:
Malicious
First seen:
2026-08-05 16:45:44 UTC
File Type:
Text (Shell)
AV detection:
13 of 24 (54.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ux23p4xo2y5s7ljjmkz2eb353m4fgc6l6sphvvwnocw556sxhfma._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
discovery linux
Link:
https://tria.ge/reports/260805-t9qk4awzcw/
Behaviour
Reads runtime system information
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.26
Link:
https://yomi.yoroi.company/submissions/a5f5b7f2eed63b2fad2962b3a2077ddb38530bcbf49e7ad6cd70addefa573958

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh a5f5b7f2eed63b2fad2962b3a2077ddb38530bcbf49e7ad6cd70addefa573958

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3874630/
  
Delivery method
Distributed via web download

Comments