MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b5ca6b3cfacf349f24f0a9b6d0d4d4ae6977ce2d93b4bed5682b73cae95409e5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b5ca6b3cfacf349f24f0a9b6d0d4d4ae6977ce2d93b4bed5682b73cae95409e5
SHA3-384 hash: 76f45ddd17cfd972a0c9841ee661af2e6160051358f4d3e59c3d97ae79f4501d5236448f66d2524a76f393a21c0538ca
SHA1 hash: 41b0c1c5a997a1304d0fe9d2bb275198be4fbf30
MD5 hash: 574e92b45163b6a0f4b5a54d4fec45b7
humanhash: queen-quebec-pluto-papa
File name:lil
Download: download sample
File size:852 bytes
First seen:2026-07-12 12:01:09 UTC
Last seen:2026-07-12 23:07:34 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 24:kXCKysE2hi0ziQvZohaFIzrWXbikjnp2IX:e9Qp+MsFIzKXbikjp2IX
TLSH T1A401ABCA8404E802409A9A2C32972055F421C3CF154B4FA9BFAC6E3EEB84C19B066F88
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://129.121.114.124/QKtUn/an/aelf ua-wget
http://129.121.114.124/XoQwn/an/aelf ua-wget
http://129.121.114.124/CKAKn/an/aelf ua-wget
http://129.121.114.124/8l1n/an/aelf ua-wget
http://129.121.114.124/wW6dn/an/aelf ua-wget

Intelligence

File Origin
# of uploads :
2
# of downloads :
70
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive mirai
Link:
https://www.filescan.io/uploads/6a53822a811a393aacfea052/reports/67537053-c7d6-401c-af21-cf9ecde05cb4/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-07-12T09:59:00Z UTC
Last seen:
2026-07-12T17:43:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/b5ca6b3cfacf349f24f0a9b6d0d4d4ae6977ce2d93b4bed5682b73cae95409e5/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/5fc71349-a357-48e2-9c67-91d419a8d6b6
Behavior Graph:
Download SVG
%3 guuid=43b56de2-1900-0000-e987-abd143140000 pid=5187 /usr/bin/sudo guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190 /tmp/sample.bin write-file guuid=43b56de2-1900-0000-e987-abd143140000 pid=5187->guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190 execve guuid=a4a64fe4-1900-0000-e987-abd147140000 pid=5191 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=a4a64fe4-1900-0000-e987-abd147140000 pid=5191 execve guuid=acc5b4e4-1900-0000-e987-abd149140000 pid=5193 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=acc5b4e4-1900-0000-e987-abd149140000 pid=5193 execve guuid=dd7f1fe5-1900-0000-e987-abd14b140000 pid=5195 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=dd7f1fe5-1900-0000-e987-abd14b140000 pid=5195 execve guuid=a99d85e5-1900-0000-e987-abd14e140000 pid=5198 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=a99d85e5-1900-0000-e987-abd14e140000 pid=5198 execve guuid=ed35e2e5-1900-0000-e987-abd150140000 pid=5200 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=ed35e2e5-1900-0000-e987-abd150140000 pid=5200 execve guuid=fa1c41e6-1900-0000-e987-abd151140000 pid=5201 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=fa1c41e6-1900-0000-e987-abd151140000 pid=5201 execve guuid=491ca7e6-1900-0000-e987-abd152140000 pid=5202 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=491ca7e6-1900-0000-e987-abd152140000 pid=5202 execve guuid=082220e7-1900-0000-e987-abd153140000 pid=5203 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=082220e7-1900-0000-e987-abd153140000 pid=5203 execve guuid=6e8383e7-1900-0000-e987-abd154140000 pid=5204 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=6e8383e7-1900-0000-e987-abd154140000 pid=5204 execve guuid=7d58e8e7-1900-0000-e987-abd155140000 pid=5205 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=7d58e8e7-1900-0000-e987-abd155140000 pid=5205 execve guuid=0fa646e8-1900-0000-e987-abd156140000 pid=5206 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=0fa646e8-1900-0000-e987-abd156140000 pid=5206 execve guuid=29aba5e8-1900-0000-e987-abd157140000 pid=5207 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=29aba5e8-1900-0000-e987-abd157140000 pid=5207 execve guuid=a03b02e9-1900-0000-e987-abd158140000 pid=5208 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=a03b02e9-1900-0000-e987-abd158140000 pid=5208 execve guuid=f17768e9-1900-0000-e987-abd159140000 pid=5209 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=f17768e9-1900-0000-e987-abd159140000 pid=5209 execve guuid=dda1cbe9-1900-0000-e987-abd15a140000 pid=5210 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=dda1cbe9-1900-0000-e987-abd15a140000 pid=5210 execve guuid=ae2e2eea-1900-0000-e987-abd15b140000 pid=5211 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=ae2e2eea-1900-0000-e987-abd15b140000 pid=5211 execve guuid=fca188ea-1900-0000-e987-abd15c140000 pid=5212 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=fca188ea-1900-0000-e987-abd15c140000 pid=5212 execve guuid=5a83e7ea-1900-0000-e987-abd15d140000 pid=5213 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=5a83e7ea-1900-0000-e987-abd15d140000 pid=5213 execve guuid=0eba4ceb-1900-0000-e987-abd15e140000 pid=5214 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=0eba4ceb-1900-0000-e987-abd15e140000 pid=5214 execve guuid=dba2b0eb-1900-0000-e987-abd15f140000 pid=5215 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=dba2b0eb-1900-0000-e987-abd15f140000 pid=5215 execve guuid=81d015ec-1900-0000-e987-abd160140000 pid=5216 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=81d015ec-1900-0000-e987-abd160140000 pid=5216 execve guuid=8bf980ec-1900-0000-e987-abd161140000 pid=5217 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=8bf980ec-1900-0000-e987-abd161140000 pid=5217 execve guuid=2e9dedec-1900-0000-e987-abd162140000 pid=5218 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=2e9dedec-1900-0000-e987-abd162140000 pid=5218 execve guuid=b8ce61ed-1900-0000-e987-abd163140000 pid=5219 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=b8ce61ed-1900-0000-e987-abd163140000 pid=5219 execve guuid=c65bc3ed-1900-0000-e987-abd164140000 pid=5220 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=c65bc3ed-1900-0000-e987-abd164140000 pid=5220 execve guuid=38f92eee-1900-0000-e987-abd165140000 pid=5221 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=38f92eee-1900-0000-e987-abd165140000 pid=5221 execve guuid=acef96ee-1900-0000-e987-abd166140000 pid=5222 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=acef96ee-1900-0000-e987-abd166140000 pid=5222 execve guuid=e92507ef-1900-0000-e987-abd167140000 pid=5223 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=e92507ef-1900-0000-e987-abd167140000 pid=5223 execve guuid=b93566ef-1900-0000-e987-abd168140000 pid=5224 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=b93566ef-1900-0000-e987-abd168140000 pid=5224 execve guuid=d617ccef-1900-0000-e987-abd169140000 pid=5225 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=d617ccef-1900-0000-e987-abd169140000 pid=5225 execve guuid=6ea929f0-1900-0000-e987-abd16a140000 pid=5226 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=6ea929f0-1900-0000-e987-abd16a140000 pid=5226 execve guuid=b43893f0-1900-0000-e987-abd16b140000 pid=5227 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=b43893f0-1900-0000-e987-abd16b140000 pid=5227 execve guuid=d392f5f0-1900-0000-e987-abd16c140000 pid=5228 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=d392f5f0-1900-0000-e987-abd16c140000 pid=5228 execve guuid=c78b5df1-1900-0000-e987-abd16d140000 pid=5229 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=c78b5df1-1900-0000-e987-abd16d140000 pid=5229 execve guuid=f33bc7f1-1900-0000-e987-abd16e140000 pid=5230 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=f33bc7f1-1900-0000-e987-abd16e140000 pid=5230 execve guuid=ee8838f2-1900-0000-e987-abd16f140000 pid=5231 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=ee8838f2-1900-0000-e987-abd16f140000 pid=5231 execve guuid=e3fd93f2-1900-0000-e987-abd170140000 pid=5232 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=e3fd93f2-1900-0000-e987-abd170140000 pid=5232 execve guuid=b3fff5f2-1900-0000-e987-abd171140000 pid=5233 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=b3fff5f2-1900-0000-e987-abd171140000 pid=5233 execve guuid=bd7459f3-1900-0000-e987-abd172140000 pid=5234 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=bd7459f3-1900-0000-e987-abd172140000 pid=5234 execve guuid=59ceb3f3-1900-0000-e987-abd173140000 pid=5235 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=59ceb3f3-1900-0000-e987-abd173140000 pid=5235 execve guuid=da711ff4-1900-0000-e987-abd174140000 pid=5236 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=da711ff4-1900-0000-e987-abd174140000 pid=5236 execve guuid=b2998af4-1900-0000-e987-abd175140000 pid=5237 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=b2998af4-1900-0000-e987-abd175140000 pid=5237 execve guuid=b62903f5-1900-0000-e987-abd176140000 pid=5238 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=b62903f5-1900-0000-e987-abd176140000 pid=5238 execve guuid=19347bf5-1900-0000-e987-abd177140000 pid=5239 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=19347bf5-1900-0000-e987-abd177140000 pid=5239 execve guuid=e2cfe2f5-1900-0000-e987-abd179140000 pid=5241 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=e2cfe2f5-1900-0000-e987-abd179140000 pid=5241 execve guuid=857a49f6-1900-0000-e987-abd17a140000 pid=5242 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=857a49f6-1900-0000-e987-abd17a140000 pid=5242 execve guuid=5ca7a5f6-1900-0000-e987-abd17b140000 pid=5243 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=5ca7a5f6-1900-0000-e987-abd17b140000 pid=5243 execve guuid=ec9f03f7-1900-0000-e987-abd17c140000 pid=5244 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=ec9f03f7-1900-0000-e987-abd17c140000 pid=5244 execve guuid=52ca65f7-1900-0000-e987-abd17d140000 pid=5245 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=52ca65f7-1900-0000-e987-abd17d140000 pid=5245 execve guuid=088ec4f7-1900-0000-e987-abd17e140000 pid=5246 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=088ec4f7-1900-0000-e987-abd17e140000 pid=5246 execve guuid=a69644f8-1900-0000-e987-abd17f140000 pid=5247 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=a69644f8-1900-0000-e987-abd17f140000 pid=5247 execve guuid=287dcef8-1900-0000-e987-abd180140000 pid=5248 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=287dcef8-1900-0000-e987-abd180140000 pid=5248 execve guuid=01754ff9-1900-0000-e987-abd181140000 pid=5249 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=01754ff9-1900-0000-e987-abd181140000 pid=5249 execve guuid=a5a7caf9-1900-0000-e987-abd182140000 pid=5250 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=a5a7caf9-1900-0000-e987-abd182140000 pid=5250 execve guuid=2ba152fa-1900-0000-e987-abd183140000 pid=5251 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=2ba152fa-1900-0000-e987-abd183140000 pid=5251 execve guuid=1a9eeafa-1900-0000-e987-abd184140000 pid=5252 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=1a9eeafa-1900-0000-e987-abd184140000 pid=5252 execve guuid=0772d7fb-1900-0000-e987-abd185140000 pid=5253 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=0772d7fb-1900-0000-e987-abd185140000 pid=5253 execve guuid=b90ec6fc-1900-0000-e987-abd186140000 pid=5254 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=b90ec6fc-1900-0000-e987-abd186140000 pid=5254 execve guuid=46eb5afd-1900-0000-e987-abd187140000 pid=5255 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=46eb5afd-1900-0000-e987-abd187140000 pid=5255 execve guuid=10cddbfd-1900-0000-e987-abd188140000 pid=5256 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=10cddbfd-1900-0000-e987-abd188140000 pid=5256 execve guuid=ca3f60fe-1900-0000-e987-abd189140000 pid=5257 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=ca3f60fe-1900-0000-e987-abd189140000 pid=5257 execve guuid=a4cbebfe-1900-0000-e987-abd18a140000 pid=5258 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=a4cbebfe-1900-0000-e987-abd18a140000 pid=5258 execve guuid=39385bff-1900-0000-e987-abd18b140000 pid=5259 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=39385bff-1900-0000-e987-abd18b140000 pid=5259 execve guuid=9b26baff-1900-0000-e987-abd18d140000 pid=5261 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=9b26baff-1900-0000-e987-abd18d140000 pid=5261 execve guuid=3f131e00-1a00-0000-e987-abd18e140000 pid=5262 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=3f131e00-1a00-0000-e987-abd18e140000 pid=5262 execve guuid=97128100-1a00-0000-e987-abd18f140000 pid=5263 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=97128100-1a00-0000-e987-abd18f140000 pid=5263 execve guuid=a47edd00-1a00-0000-e987-abd190140000 pid=5264 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=a47edd00-1a00-0000-e987-abd190140000 pid=5264 execve guuid=ab3b4001-1a00-0000-e987-abd191140000 pid=5265 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=ab3b4001-1a00-0000-e987-abd191140000 pid=5265 execve guuid=f9ad9d01-1a00-0000-e987-abd192140000 pid=5266 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=f9ad9d01-1a00-0000-e987-abd192140000 pid=5266 execve guuid=94ddfa01-1a00-0000-e987-abd193140000 pid=5267 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=94ddfa01-1a00-0000-e987-abd193140000 pid=5267 execve guuid=bdc26102-1a00-0000-e987-abd194140000 pid=5268 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=bdc26102-1a00-0000-e987-abd194140000 pid=5268 execve guuid=7307c202-1a00-0000-e987-abd195140000 pid=5269 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=7307c202-1a00-0000-e987-abd195140000 pid=5269 execve guuid=de102803-1a00-0000-e987-abd196140000 pid=5270 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=de102803-1a00-0000-e987-abd196140000 pid=5270 execve guuid=6ffc9103-1a00-0000-e987-abd197140000 pid=5271 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=6ffc9103-1a00-0000-e987-abd197140000 pid=5271 execve guuid=8895ed03-1a00-0000-e987-abd198140000 pid=5272 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=8895ed03-1a00-0000-e987-abd198140000 pid=5272 execve guuid=6def4204-1a00-0000-e987-abd199140000 pid=5273 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=6def4204-1a00-0000-e987-abd199140000 pid=5273 execve guuid=36739904-1a00-0000-e987-abd19a140000 pid=5274 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=36739904-1a00-0000-e987-abd19a140000 pid=5274 execve guuid=36e3f304-1a00-0000-e987-abd19b140000 pid=5275 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=36e3f304-1a00-0000-e987-abd19b140000 pid=5275 execve guuid=73dd4a05-1a00-0000-e987-abd19c140000 pid=5276 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=73dd4a05-1a00-0000-e987-abd19c140000 pid=5276 execve guuid=f83aa605-1a00-0000-e987-abd19e140000 pid=5278 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=f83aa605-1a00-0000-e987-abd19e140000 pid=5278 execve guuid=372e0406-1a00-0000-e987-abd19f140000 pid=5279 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=372e0406-1a00-0000-e987-abd19f140000 pid=5279 execve guuid=0e7c5e06-1a00-0000-e987-abd1a0140000 pid=5280 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=0e7c5e06-1a00-0000-e987-abd1a0140000 pid=5280 execve guuid=6578c406-1a00-0000-e987-abd1a1140000 pid=5281 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=6578c406-1a00-0000-e987-abd1a1140000 pid=5281 execve guuid=2a4b2907-1a00-0000-e987-abd1a2140000 pid=5282 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=2a4b2907-1a00-0000-e987-abd1a2140000 pid=5282 execve guuid=e6f18907-1a00-0000-e987-abd1a3140000 pid=5283 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=e6f18907-1a00-0000-e987-abd1a3140000 pid=5283 execve guuid=db10e107-1a00-0000-e987-abd1a4140000 pid=5284 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=db10e107-1a00-0000-e987-abd1a4140000 pid=5284 execve guuid=8beb4308-1a00-0000-e987-abd1a5140000 pid=5285 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=8beb4308-1a00-0000-e987-abd1a5140000 pid=5285 execve guuid=8a24ac08-1a00-0000-e987-abd1a6140000 pid=5286 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=8a24ac08-1a00-0000-e987-abd1a6140000 pid=5286 execve guuid=7a361109-1a00-0000-e987-abd1a7140000 pid=5287 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=7a361109-1a00-0000-e987-abd1a7140000 pid=5287 execve guuid=a9da7f09-1a00-0000-e987-abd1a8140000 pid=5288 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=a9da7f09-1a00-0000-e987-abd1a8140000 pid=5288 execve guuid=7920ea09-1a00-0000-e987-abd1a9140000 pid=5289 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=7920ea09-1a00-0000-e987-abd1a9140000 pid=5289 execve guuid=1d8e4d0a-1a00-0000-e987-abd1aa140000 pid=5290 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=1d8e4d0a-1a00-0000-e987-abd1aa140000 pid=5290 execve guuid=38c9be10-1a00-0000-e987-abd1b4140000 pid=5300 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=38c9be10-1a00-0000-e987-abd1b4140000 pid=5300 execve guuid=d9112811-1a00-0000-e987-abd1b5140000 pid=5301 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=d9112811-1a00-0000-e987-abd1b5140000 pid=5301 execve guuid=aff09f11-1a00-0000-e987-abd1b7140000 pid=5303 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=aff09f11-1a00-0000-e987-abd1b7140000 pid=5303 execve guuid=97210b12-1a00-0000-e987-abd1b9140000 pid=5305 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=97210b12-1a00-0000-e987-abd1b9140000 pid=5305 execve guuid=f1f56812-1a00-0000-e987-abd1bb140000 pid=5307 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=f1f56812-1a00-0000-e987-abd1bb140000 pid=5307 execve guuid=c6d3c112-1a00-0000-e987-abd1bc140000 pid=5308 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=c6d3c112-1a00-0000-e987-abd1bc140000 pid=5308 execve guuid=7e3d1913-1a00-0000-e987-abd1be140000 pid=5310 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=7e3d1913-1a00-0000-e987-abd1be140000 pid=5310 execve guuid=43dd6a13-1a00-0000-e987-abd1c0140000 pid=5312 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=43dd6a13-1a00-0000-e987-abd1c0140000 pid=5312 execve guuid=0ae1c413-1a00-0000-e987-abd1c2140000 pid=5314 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=0ae1c413-1a00-0000-e987-abd1c2140000 pid=5314 execve guuid=5d4e1914-1a00-0000-e987-abd1c4140000 pid=5316 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=5d4e1914-1a00-0000-e987-abd1c4140000 pid=5316 execve guuid=c9c0ef20-1a00-0000-e987-abd1c5140000 pid=5317 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=c9c0ef20-1a00-0000-e987-abd1c5140000 pid=5317 execve guuid=0483ab21-1a00-0000-e987-abd1c6140000 pid=5318 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=0483ab21-1a00-0000-e987-abd1c6140000 pid=5318 execve guuid=69437322-1a00-0000-e987-abd1c7140000 pid=5319 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=69437322-1a00-0000-e987-abd1c7140000 pid=5319 execve guuid=bdf31123-1a00-0000-e987-abd1c8140000 pid=5320 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=bdf31123-1a00-0000-e987-abd1c8140000 pid=5320 execve guuid=0b01d823-1a00-0000-e987-abd1c9140000 pid=5321 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=0b01d823-1a00-0000-e987-abd1c9140000 pid=5321 execve guuid=7e2a9f24-1a00-0000-e987-abd1ca140000 pid=5322 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=7e2a9f24-1a00-0000-e987-abd1ca140000 pid=5322 execve guuid=a5d37125-1a00-0000-e987-abd1cb140000 pid=5323 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=a5d37125-1a00-0000-e987-abd1cb140000 pid=5323 execve guuid=ac953c26-1a00-0000-e987-abd1cc140000 pid=5324 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=ac953c26-1a00-0000-e987-abd1cc140000 pid=5324 execve guuid=c261fe26-1a00-0000-e987-abd1cd140000 pid=5325 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=c261fe26-1a00-0000-e987-abd1cd140000 pid=5325 execve guuid=2a85d727-1a00-0000-e987-abd1ce140000 pid=5326 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=2a85d727-1a00-0000-e987-abd1ce140000 pid=5326 execve guuid=436a8828-1a00-0000-e987-abd1cf140000 pid=5327 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=436a8828-1a00-0000-e987-abd1cf140000 pid=5327 execve guuid=0aab3c29-1a00-0000-e987-abd1d0140000 pid=5328 /usr/bin/ls guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=0aab3c29-1a00-0000-e987-abd1d0140000 pid=5328 execve guuid=95b12a2a-1a00-0000-e987-abd1d1140000 pid=5329 /usr/bin/rm guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=95b12a2a-1a00-0000-e987-abd1d1140000 pid=5329 execve guuid=0ee7ab2a-1a00-0000-e987-abd1d2140000 pid=5330 /usr/bin/wget net send-data write-file guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=0ee7ab2a-1a00-0000-e987-abd1d2140000 pid=5330 execve guuid=588dea37-1a00-0000-e987-abd1d3140000 pid=5331 /usr/bin/chmod guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=588dea37-1a00-0000-e987-abd1d3140000 pid=5331 execve guuid=0b0a2638-1a00-0000-e987-abd1d4140000 pid=5332 /tmp/QKtU guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=0b0a2638-1a00-0000-e987-abd1d4140000 pid=5332 execve guuid=a7defe38-1a00-0000-e987-abd1d6140000 pid=5334 /usr/bin/rm guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=a7defe38-1a00-0000-e987-abd1d6140000 pid=5334 execve guuid=d2707539-1a00-0000-e987-abd1d7140000 pid=5335 /usr/bin/wget net send-data write-file guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=d2707539-1a00-0000-e987-abd1d7140000 pid=5335 execve guuid=5f8a8c46-1a00-0000-e987-abd1d8140000 pid=5336 /usr/bin/chmod guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=5f8a8c46-1a00-0000-e987-abd1d8140000 pid=5336 execve guuid=26210447-1a00-0000-e987-abd1d9140000 pid=5337 /tmp/XoQw guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=26210447-1a00-0000-e987-abd1d9140000 pid=5337 execve guuid=75987148-1a00-0000-e987-abd1db140000 pid=5339 /usr/bin/rm guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=75987148-1a00-0000-e987-abd1db140000 pid=5339 execve guuid=3599f648-1a00-0000-e987-abd1dc140000 pid=5340 /usr/bin/wget net send-data write-file guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=3599f648-1a00-0000-e987-abd1dc140000 pid=5340 execve guuid=b0316756-1a00-0000-e987-abd1dd140000 pid=5341 /usr/bin/chmod guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=b0316756-1a00-0000-e987-abd1dd140000 pid=5341 execve guuid=4298e656-1a00-0000-e987-abd1de140000 pid=5342 /tmp/CKAK guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=4298e656-1a00-0000-e987-abd1de140000 pid=5342 execve guuid=45fd2c58-1a00-0000-e987-abd1e0140000 pid=5344 /usr/bin/rm guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=45fd2c58-1a00-0000-e987-abd1e0140000 pid=5344 execve guuid=7e8e8758-1a00-0000-e987-abd1e1140000 pid=5345 /usr/bin/wget net send-data write-file guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=7e8e8758-1a00-0000-e987-abd1e1140000 pid=5345 execve guuid=60194865-1a00-0000-e987-abd1e2140000 pid=5346 /usr/bin/chmod guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=60194865-1a00-0000-e987-abd1e2140000 pid=5346 execve guuid=1c6f9065-1a00-0000-e987-abd1e3140000 pid=5347 /tmp/8l1 guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=1c6f9065-1a00-0000-e987-abd1e3140000 pid=5347 execve guuid=c5945366-1a00-0000-e987-abd1e5140000 pid=5349 /usr/bin/rm guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=c5945366-1a00-0000-e987-abd1e5140000 pid=5349 execve guuid=523d9866-1a00-0000-e987-abd1e6140000 pid=5350 /usr/bin/wget net send-data write-file guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=523d9866-1a00-0000-e987-abd1e6140000 pid=5350 execve guuid=29e14473-1a00-0000-e987-abd1e7140000 pid=5351 /usr/bin/chmod guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=29e14473-1a00-0000-e987-abd1e7140000 pid=5351 execve guuid=7a0d8873-1a00-0000-e987-abd1e8140000 pid=5352 /tmp/wW6d guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=7a0d8873-1a00-0000-e987-abd1e8140000 pid=5352 execve guuid=00464f74-1a00-0000-e987-abd1ea140000 pid=5354 /usr/bin/rm delete-file guuid=e9e912e4-1900-0000-e987-abd146140000 pid=5190->guuid=00464f74-1a00-0000-e987-abd1ea140000 pid=5354 execve 801186e6-5fe8-5959-a7b4-832d8d66e7aa 129.121.114.124:80 guuid=0ee7ab2a-1a00-0000-e987-abd1d2140000 pid=5330->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 134B guuid=d2707539-1a00-0000-e987-abd1d7140000 pid=5335->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 134B guuid=3599f648-1a00-0000-e987-abd1dc140000 pid=5340->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 134B guuid=7e8e8758-1a00-0000-e987-abd1e1140000 pid=5345->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 133B guuid=523d9866-1a00-0000-e987-abd1e6140000 pid=5350->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 134B
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b5ca6b3cfacf349f24f0a9b6d0d4d4ae6977ce2d93b4bed5682b73cae95409e5/
Threat name:
Document-HTML.Trojan.Bash
Create hunting rule
Status:
Malicious
First seen:
2026-07-12 12:02:09 UTC
File Type:
Text (Shell)
AV detection:
11 of 24 (45.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wxfgwph2z42j6jhqvg3nbvguvzuxptrnso2l5vlifnz4v2kubhsq._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
discovery linux
Link:
https://tria.ge/reports/260712-n7atzaht5p/
Behaviour
Reads runtime system information
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.26
Link:
https://yomi.yoroi.company/submissions/b5ca6b3cfacf349f24f0a9b6d0d4d4ae6977ce2d93b4bed5682b73cae95409e5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh b5ca6b3cfacf349f24f0a9b6d0d4d4ae6977ce2d93b4bed5682b73cae95409e5

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3874630/
  
Delivery method
Distributed via web download

Comments