MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b88ffb509409384a8190be6d022df92f537a5d3ce728efa2e4ab18ae7e76f5d5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b88ffb509409384a8190be6d022df92f537a5d3ce728efa2e4ab18ae7e76f5d5
SHA3-384 hash: d6a6adab70695add6b9af7e791c7593690470d8f904e6191f9609150de87151752772fbb3b37615d92d5274e4354973a
SHA1 hash: 16d79ca4744aa1178c22fad25bf8dc9f2a5e58e1
MD5 hash: 69bb8d8218ed4f7f293a736c748bfa52
humanhash: kitten-eight-skylark-speaker
File name:lil
Download: download sample
File size:840 bytes
First seen:2026-08-08 01:04:42 UTC
Last seen:2026-08-08 07:34:21 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 24:kXCKysE2hi0ziQvZohaF1GFoMqJB/XZ5jb3EX:e9Qp+MsF1SQfPTb3EX
TLSH T18E018EDAE160961040AAD91D22975194F830C3C7194A4FB5FF6C647DAB8DD14B07AF98
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://129.121.110.105/xkwn/an/aua-wget
http://129.121.110.105/lWCn/an/aua-wget
http://129.121.110.105/4yKQn/an/aua-wget
http://129.121.110.105/fXdn/an/aua-wget
http://129.121.110.105/ot7n/an/aua-wget

Intelligence

File Origin
# of uploads :
3
# of downloads :
57
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive mirai
Link:
https://www.filescan.io/uploads/6a7680e746b4a5cbf7d35131/reports/916aee98-c163-448e-be0d-c6cae2c37248/overview
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/fb06f31d-82b1-4726-b00d-c8e5328a9a77
Behavior Graph:
Download SVG
%3 guuid=8b5205e7-1800-0000-261a-5f38d9080000 pid=2265 /usr/bin/sudo guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269 /tmp/sample.bin write-file guuid=8b5205e7-1800-0000-261a-5f38d9080000 pid=2265->guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269 execve guuid=b4e6e7ed-1800-0000-261a-5f38de080000 pid=2270 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=b4e6e7ed-1800-0000-261a-5f38de080000 pid=2270 execve guuid=e3c678f1-1800-0000-261a-5f38e0080000 pid=2272 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=e3c678f1-1800-0000-261a-5f38e0080000 pid=2272 execve guuid=1f3f58f2-1800-0000-261a-5f38e1080000 pid=2273 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=1f3f58f2-1800-0000-261a-5f38e1080000 pid=2273 execve guuid=edbd94f3-1800-0000-261a-5f38e3080000 pid=2275 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=edbd94f3-1800-0000-261a-5f38e3080000 pid=2275 execve guuid=4e7f55f4-1800-0000-261a-5f38e4080000 pid=2276 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=4e7f55f4-1800-0000-261a-5f38e4080000 pid=2276 execve guuid=cb7438f5-1800-0000-261a-5f38e6080000 pid=2278 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=cb7438f5-1800-0000-261a-5f38e6080000 pid=2278 execve guuid=447fdbf5-1800-0000-261a-5f38e8080000 pid=2280 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=447fdbf5-1800-0000-261a-5f38e8080000 pid=2280 execve guuid=241f79f6-1800-0000-261a-5f38e9080000 pid=2281 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=241f79f6-1800-0000-261a-5f38e9080000 pid=2281 execve guuid=b7bd12f9-1800-0000-261a-5f38ec080000 pid=2284 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=b7bd12f9-1800-0000-261a-5f38ec080000 pid=2284 execve guuid=da66caf9-1800-0000-261a-5f38ee080000 pid=2286 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=da66caf9-1800-0000-261a-5f38ee080000 pid=2286 execve guuid=aa407afb-1800-0000-261a-5f38f2080000 pid=2290 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=aa407afb-1800-0000-261a-5f38f2080000 pid=2290 execve guuid=b60a1cfc-1800-0000-261a-5f38f4080000 pid=2292 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=b60a1cfc-1800-0000-261a-5f38f4080000 pid=2292 execve guuid=2e1e8bfc-1800-0000-261a-5f38f5080000 pid=2293 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=2e1e8bfc-1800-0000-261a-5f38f5080000 pid=2293 execve guuid=ea460efd-1800-0000-261a-5f38f6080000 pid=2294 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=ea460efd-1800-0000-261a-5f38f6080000 pid=2294 execve guuid=7ea283ff-1800-0000-261a-5f38f7080000 pid=2295 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=7ea283ff-1800-0000-261a-5f38f7080000 pid=2295 execve guuid=23223d01-1900-0000-261a-5f38f8080000 pid=2296 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=23223d01-1900-0000-261a-5f38f8080000 pid=2296 execve guuid=33592102-1900-0000-261a-5f38f9080000 pid=2297 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=33592102-1900-0000-261a-5f38f9080000 pid=2297 execve guuid=5a9e6f03-1900-0000-261a-5f38fa080000 pid=2298 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=5a9e6f03-1900-0000-261a-5f38fa080000 pid=2298 execve guuid=b8bb6a04-1900-0000-261a-5f38fb080000 pid=2299 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=b8bb6a04-1900-0000-261a-5f38fb080000 pid=2299 execve guuid=16b27a05-1900-0000-261a-5f38fc080000 pid=2300 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=16b27a05-1900-0000-261a-5f38fc080000 pid=2300 execve guuid=62c43a06-1900-0000-261a-5f38fd080000 pid=2301 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=62c43a06-1900-0000-261a-5f38fd080000 pid=2301 execve guuid=9a49f806-1900-0000-261a-5f38ff080000 pid=2303 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=9a49f806-1900-0000-261a-5f38ff080000 pid=2303 execve guuid=f830b507-1900-0000-261a-5f3800090000 pid=2304 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=f830b507-1900-0000-261a-5f3800090000 pid=2304 execve guuid=dbb0d208-1900-0000-261a-5f3801090000 pid=2305 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=dbb0d208-1900-0000-261a-5f3801090000 pid=2305 execve guuid=15147409-1900-0000-261a-5f3802090000 pid=2306 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=15147409-1900-0000-261a-5f3802090000 pid=2306 execve guuid=35b0100a-1900-0000-261a-5f3803090000 pid=2307 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=35b0100a-1900-0000-261a-5f3803090000 pid=2307 execve guuid=4645bf0a-1900-0000-261a-5f3804090000 pid=2308 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=4645bf0a-1900-0000-261a-5f3804090000 pid=2308 execve guuid=b452650b-1900-0000-261a-5f3806090000 pid=2310 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=b452650b-1900-0000-261a-5f3806090000 pid=2310 execve guuid=a5b1060c-1900-0000-261a-5f3808090000 pid=2312 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=a5b1060c-1900-0000-261a-5f3808090000 pid=2312 execve guuid=cedfa70c-1900-0000-261a-5f380a090000 pid=2314 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=cedfa70c-1900-0000-261a-5f380a090000 pid=2314 execve guuid=b7b9470d-1900-0000-261a-5f380c090000 pid=2316 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=b7b9470d-1900-0000-261a-5f380c090000 pid=2316 execve guuid=01e6e70d-1900-0000-261a-5f380d090000 pid=2317 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=01e6e70d-1900-0000-261a-5f380d090000 pid=2317 execve guuid=3cf01f0f-1900-0000-261a-5f380f090000 pid=2319 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=3cf01f0f-1900-0000-261a-5f380f090000 pid=2319 execve guuid=6fc89610-1900-0000-261a-5f3811090000 pid=2321 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=6fc89610-1900-0000-261a-5f3811090000 pid=2321 execve guuid=698c5711-1900-0000-261a-5f3813090000 pid=2323 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=698c5711-1900-0000-261a-5f3813090000 pid=2323 execve guuid=9bc31e12-1900-0000-261a-5f3815090000 pid=2325 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=9bc31e12-1900-0000-261a-5f3815090000 pid=2325 execve guuid=972dca12-1900-0000-261a-5f3816090000 pid=2326 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=972dca12-1900-0000-261a-5f3816090000 pid=2326 execve guuid=cd3fa113-1900-0000-261a-5f3817090000 pid=2327 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=cd3fa113-1900-0000-261a-5f3817090000 pid=2327 execve guuid=7153ca14-1900-0000-261a-5f3818090000 pid=2328 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=7153ca14-1900-0000-261a-5f3818090000 pid=2328 execve guuid=4afa4717-1900-0000-261a-5f3819090000 pid=2329 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=4afa4717-1900-0000-261a-5f3819090000 pid=2329 execve guuid=d29e2518-1900-0000-261a-5f381b090000 pid=2331 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=d29e2518-1900-0000-261a-5f381b090000 pid=2331 execve guuid=557edb18-1900-0000-261a-5f381c090000 pid=2332 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=557edb18-1900-0000-261a-5f381c090000 pid=2332 execve guuid=0e109319-1900-0000-261a-5f381d090000 pid=2333 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=0e109319-1900-0000-261a-5f381d090000 pid=2333 execve guuid=8d57541a-1900-0000-261a-5f381e090000 pid=2334 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=8d57541a-1900-0000-261a-5f381e090000 pid=2334 execve guuid=5249ff1a-1900-0000-261a-5f381f090000 pid=2335 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=5249ff1a-1900-0000-261a-5f381f090000 pid=2335 execve guuid=68b8b51b-1900-0000-261a-5f3820090000 pid=2336 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=68b8b51b-1900-0000-261a-5f3820090000 pid=2336 execve guuid=354c571c-1900-0000-261a-5f3821090000 pid=2337 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=354c571c-1900-0000-261a-5f3821090000 pid=2337 execve guuid=78700b1d-1900-0000-261a-5f3822090000 pid=2338 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=78700b1d-1900-0000-261a-5f3822090000 pid=2338 execve guuid=7108ac1d-1900-0000-261a-5f3823090000 pid=2339 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=7108ac1d-1900-0000-261a-5f3823090000 pid=2339 execve guuid=45ec4c1e-1900-0000-261a-5f3825090000 pid=2341 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=45ec4c1e-1900-0000-261a-5f3825090000 pid=2341 execve guuid=1bb1f91e-1900-0000-261a-5f3826090000 pid=2342 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=1bb1f91e-1900-0000-261a-5f3826090000 pid=2342 execve guuid=252b8b1f-1900-0000-261a-5f3828090000 pid=2344 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=252b8b1f-1900-0000-261a-5f3828090000 pid=2344 execve guuid=2afb3520-1900-0000-261a-5f3829090000 pid=2345 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=2afb3520-1900-0000-261a-5f3829090000 pid=2345 execve guuid=3dd0db20-1900-0000-261a-5f382a090000 pid=2346 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=3dd0db20-1900-0000-261a-5f382a090000 pid=2346 execve guuid=cb9d8221-1900-0000-261a-5f382c090000 pid=2348 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=cb9d8221-1900-0000-261a-5f382c090000 pid=2348 execve guuid=aab72522-1900-0000-261a-5f382e090000 pid=2350 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=aab72522-1900-0000-261a-5f382e090000 pid=2350 execve guuid=aa5dca22-1900-0000-261a-5f3830090000 pid=2352 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=aa5dca22-1900-0000-261a-5f3830090000 pid=2352 execve guuid=1f877123-1900-0000-261a-5f3832090000 pid=2354 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=1f877123-1900-0000-261a-5f3832090000 pid=2354 execve guuid=f5f31024-1900-0000-261a-5f3834090000 pid=2356 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=f5f31024-1900-0000-261a-5f3834090000 pid=2356 execve guuid=200ab624-1900-0000-261a-5f3837090000 pid=2359 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=200ab624-1900-0000-261a-5f3837090000 pid=2359 execve guuid=15796525-1900-0000-261a-5f3838090000 pid=2360 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=15796525-1900-0000-261a-5f3838090000 pid=2360 execve guuid=35792c26-1900-0000-261a-5f383a090000 pid=2362 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=35792c26-1900-0000-261a-5f383a090000 pid=2362 execve guuid=6b0ceb26-1900-0000-261a-5f383b090000 pid=2363 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=6b0ceb26-1900-0000-261a-5f383b090000 pid=2363 execve guuid=9d7c9a27-1900-0000-261a-5f383d090000 pid=2365 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=9d7c9a27-1900-0000-261a-5f383d090000 pid=2365 execve guuid=02a83e28-1900-0000-261a-5f383e090000 pid=2366 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=02a83e28-1900-0000-261a-5f383e090000 pid=2366 execve guuid=d359ee28-1900-0000-261a-5f383f090000 pid=2367 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=d359ee28-1900-0000-261a-5f383f090000 pid=2367 execve guuid=521f9729-1900-0000-261a-5f3840090000 pid=2368 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=521f9729-1900-0000-261a-5f3840090000 pid=2368 execve guuid=4c603a2a-1900-0000-261a-5f3842090000 pid=2370 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=4c603a2a-1900-0000-261a-5f3842090000 pid=2370 execve guuid=7ebee12a-1900-0000-261a-5f3844090000 pid=2372 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=7ebee12a-1900-0000-261a-5f3844090000 pid=2372 execve guuid=fe70832b-1900-0000-261a-5f3845090000 pid=2373 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=fe70832b-1900-0000-261a-5f3845090000 pid=2373 execve guuid=0fac182c-1900-0000-261a-5f3848090000 pid=2376 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=0fac182c-1900-0000-261a-5f3848090000 pid=2376 execve guuid=0f99c22c-1900-0000-261a-5f384a090000 pid=2378 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=0f99c22c-1900-0000-261a-5f384a090000 pid=2378 execve guuid=28d2632d-1900-0000-261a-5f384c090000 pid=2380 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=28d2632d-1900-0000-261a-5f384c090000 pid=2380 execve guuid=b0d70b2e-1900-0000-261a-5f384e090000 pid=2382 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=b0d70b2e-1900-0000-261a-5f384e090000 pid=2382 execve guuid=8843a82e-1900-0000-261a-5f3850090000 pid=2384 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=8843a82e-1900-0000-261a-5f3850090000 pid=2384 execve guuid=1099422f-1900-0000-261a-5f3851090000 pid=2385 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=1099422f-1900-0000-261a-5f3851090000 pid=2385 execve guuid=c19bf12f-1900-0000-261a-5f3852090000 pid=2386 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=c19bf12f-1900-0000-261a-5f3852090000 pid=2386 execve guuid=1860d431-1900-0000-261a-5f3853090000 pid=2387 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=1860d431-1900-0000-261a-5f3853090000 pid=2387 execve guuid=140acd32-1900-0000-261a-5f3855090000 pid=2389 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=140acd32-1900-0000-261a-5f3855090000 pid=2389 execve guuid=12788433-1900-0000-261a-5f3856090000 pid=2390 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=12788433-1900-0000-261a-5f3856090000 pid=2390 execve guuid=7c644134-1900-0000-261a-5f3857090000 pid=2391 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=7c644134-1900-0000-261a-5f3857090000 pid=2391 execve guuid=dabfe634-1900-0000-261a-5f3858090000 pid=2392 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=dabfe634-1900-0000-261a-5f3858090000 pid=2392 execve guuid=8829a536-1900-0000-261a-5f385a090000 pid=2394 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=8829a536-1900-0000-261a-5f385a090000 pid=2394 execve guuid=d3758237-1900-0000-261a-5f385b090000 pid=2395 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=d3758237-1900-0000-261a-5f385b090000 pid=2395 execve guuid=bc594d38-1900-0000-261a-5f385d090000 pid=2397 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=bc594d38-1900-0000-261a-5f385d090000 pid=2397 execve guuid=643c063a-1900-0000-261a-5f3861090000 pid=2401 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=643c063a-1900-0000-261a-5f3861090000 pid=2401 execve guuid=57f9353b-1900-0000-261a-5f3863090000 pid=2403 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=57f9353b-1900-0000-261a-5f3863090000 pid=2403 execve guuid=e785ef3b-1900-0000-261a-5f3864090000 pid=2404 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=e785ef3b-1900-0000-261a-5f3864090000 pid=2404 execve guuid=492b823d-1900-0000-261a-5f3868090000 pid=2408 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=492b823d-1900-0000-261a-5f3868090000 pid=2408 execve guuid=9e867b3e-1900-0000-261a-5f386a090000 pid=2410 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=9e867b3e-1900-0000-261a-5f386a090000 pid=2410 execve guuid=2a7b6d3f-1900-0000-261a-5f386c090000 pid=2412 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=2a7b6d3f-1900-0000-261a-5f386c090000 pid=2412 execve guuid=4f821040-1900-0000-261a-5f386e090000 pid=2414 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=4f821040-1900-0000-261a-5f386e090000 pid=2414 execve guuid=cfe03041-1900-0000-261a-5f386f090000 pid=2415 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=cfe03041-1900-0000-261a-5f386f090000 pid=2415 execve guuid=e2d0d241-1900-0000-261a-5f3871090000 pid=2417 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=e2d0d241-1900-0000-261a-5f3871090000 pid=2417 execve guuid=a8534b43-1900-0000-261a-5f3874090000 pid=2420 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=a8534b43-1900-0000-261a-5f3874090000 pid=2420 execve guuid=de8b0644-1900-0000-261a-5f3875090000 pid=2421 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=de8b0644-1900-0000-261a-5f3875090000 pid=2421 execve guuid=09449944-1900-0000-261a-5f3877090000 pid=2423 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=09449944-1900-0000-261a-5f3877090000 pid=2423 execve guuid=de132745-1900-0000-261a-5f3878090000 pid=2424 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=de132745-1900-0000-261a-5f3878090000 pid=2424 execve guuid=ae390246-1900-0000-261a-5f387a090000 pid=2426 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=ae390246-1900-0000-261a-5f387a090000 pid=2426 execve guuid=91c5db48-1900-0000-261a-5f387d090000 pid=2429 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=91c5db48-1900-0000-261a-5f387d090000 pid=2429 execve guuid=d23fb84a-1900-0000-261a-5f387e090000 pid=2430 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=d23fb84a-1900-0000-261a-5f387e090000 pid=2430 execve guuid=1c95924b-1900-0000-261a-5f387f090000 pid=2431 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=1c95924b-1900-0000-261a-5f387f090000 pid=2431 execve guuid=14d3584c-1900-0000-261a-5f3880090000 pid=2432 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=14d3584c-1900-0000-261a-5f3880090000 pid=2432 execve guuid=f91f884d-1900-0000-261a-5f3881090000 pid=2433 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=f91f884d-1900-0000-261a-5f3881090000 pid=2433 execve guuid=4911104f-1900-0000-261a-5f3883090000 pid=2435 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=4911104f-1900-0000-261a-5f3883090000 pid=2435 execve guuid=1e341f50-1900-0000-261a-5f3885090000 pid=2437 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=1e341f50-1900-0000-261a-5f3885090000 pid=2437 execve guuid=2a513b51-1900-0000-261a-5f3888090000 pid=2440 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=2a513b51-1900-0000-261a-5f3888090000 pid=2440 execve guuid=d4be7e52-1900-0000-261a-5f388a090000 pid=2442 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=d4be7e52-1900-0000-261a-5f388a090000 pid=2442 execve guuid=899cc253-1900-0000-261a-5f388d090000 pid=2445 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=899cc253-1900-0000-261a-5f388d090000 pid=2445 execve guuid=0d396e55-1900-0000-261a-5f3891090000 pid=2449 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=0d396e55-1900-0000-261a-5f3891090000 pid=2449 execve guuid=e3f27f57-1900-0000-261a-5f3893090000 pid=2451 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=e3f27f57-1900-0000-261a-5f3893090000 pid=2451 execve guuid=d2451b59-1900-0000-261a-5f3898090000 pid=2456 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=d2451b59-1900-0000-261a-5f3898090000 pid=2456 execve guuid=94be535a-1900-0000-261a-5f389b090000 pid=2459 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=94be535a-1900-0000-261a-5f389b090000 pid=2459 execve guuid=ef73575b-1900-0000-261a-5f389d090000 pid=2461 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=ef73575b-1900-0000-261a-5f389d090000 pid=2461 execve guuid=0a5a405c-1900-0000-261a-5f38a0090000 pid=2464 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=0a5a405c-1900-0000-261a-5f38a0090000 pid=2464 execve guuid=ddc8015d-1900-0000-261a-5f38a2090000 pid=2466 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=ddc8015d-1900-0000-261a-5f38a2090000 pid=2466 execve guuid=94b6b75d-1900-0000-261a-5f38a4090000 pid=2468 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=94b6b75d-1900-0000-261a-5f38a4090000 pid=2468 execve guuid=832b6d5e-1900-0000-261a-5f38a6090000 pid=2470 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=832b6d5e-1900-0000-261a-5f38a6090000 pid=2470 execve guuid=991b1a5f-1900-0000-261a-5f38a9090000 pid=2473 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=991b1a5f-1900-0000-261a-5f38a9090000 pid=2473 execve guuid=5ebed85f-1900-0000-261a-5f38ac090000 pid=2476 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=5ebed85f-1900-0000-261a-5f38ac090000 pid=2476 execve guuid=74637960-1900-0000-261a-5f38ae090000 pid=2478 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=74637960-1900-0000-261a-5f38ae090000 pid=2478 execve guuid=d53e4261-1900-0000-261a-5f38b1090000 pid=2481 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=d53e4261-1900-0000-261a-5f38b1090000 pid=2481 execve guuid=824f3362-1900-0000-261a-5f38b4090000 pid=2484 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=824f3362-1900-0000-261a-5f38b4090000 pid=2484 execve guuid=4ebb0663-1900-0000-261a-5f38b6090000 pid=2486 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=4ebb0663-1900-0000-261a-5f38b6090000 pid=2486 execve guuid=9118cf64-1900-0000-261a-5f38b8090000 pid=2488 /usr/bin/ls guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=9118cf64-1900-0000-261a-5f38b8090000 pid=2488 execve guuid=55ab7066-1900-0000-261a-5f38bb090000 pid=2491 /usr/bin/rm guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=55ab7066-1900-0000-261a-5f38bb090000 pid=2491 execve guuid=2289b866-1900-0000-261a-5f38bc090000 pid=2492 /usr/bin/wget net send-data write-file guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=2289b866-1900-0000-261a-5f38bc090000 pid=2492 execve guuid=b6cab679-1900-0000-261a-5f38c9090000 pid=2505 /usr/bin/chmod guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=b6cab679-1900-0000-261a-5f38c9090000 pid=2505 execve guuid=69a2677a-1900-0000-261a-5f38cb090000 pid=2507 /usr/bin/dash guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=69a2677a-1900-0000-261a-5f38cb090000 pid=2507 clone guuid=21fddd7c-1900-0000-261a-5f38d1090000 pid=2513 /usr/bin/rm guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=21fddd7c-1900-0000-261a-5f38d1090000 pid=2513 execve guuid=9759927d-1900-0000-261a-5f38d2090000 pid=2514 /usr/bin/wget net send-data write-file guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=9759927d-1900-0000-261a-5f38d2090000 pid=2514 execve guuid=c6817d83-1900-0000-261a-5f38d7090000 pid=2519 /usr/bin/chmod guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=c6817d83-1900-0000-261a-5f38d7090000 pid=2519 execve guuid=420e5c84-1900-0000-261a-5f38d8090000 pid=2520 /usr/bin/dash guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=420e5c84-1900-0000-261a-5f38d8090000 pid=2520 clone guuid=cf637386-1900-0000-261a-5f38db090000 pid=2523 /usr/bin/rm guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=cf637386-1900-0000-261a-5f38db090000 pid=2523 execve guuid=b7dc7187-1900-0000-261a-5f38dd090000 pid=2525 /usr/bin/wget net send-data write-file guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=b7dc7187-1900-0000-261a-5f38dd090000 pid=2525 execve guuid=67ef048f-1900-0000-261a-5f38e7090000 pid=2535 /usr/bin/chmod guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=67ef048f-1900-0000-261a-5f38e7090000 pid=2535 execve guuid=070bbb8f-1900-0000-261a-5f38e8090000 pid=2536 /usr/bin/dash guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=070bbb8f-1900-0000-261a-5f38e8090000 pid=2536 clone guuid=ff62db91-1900-0000-261a-5f38eb090000 pid=2539 /usr/bin/rm guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=ff62db91-1900-0000-261a-5f38eb090000 pid=2539 execve guuid=63de6c92-1900-0000-261a-5f38ed090000 pid=2541 /usr/bin/wget net send-data write-file guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=63de6c92-1900-0000-261a-5f38ed090000 pid=2541 execve guuid=85b6a898-1900-0000-261a-5f38f3090000 pid=2547 /usr/bin/chmod guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=85b6a898-1900-0000-261a-5f38f3090000 pid=2547 execve guuid=cc6b7d99-1900-0000-261a-5f38f4090000 pid=2548 /usr/bin/dash guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=cc6b7d99-1900-0000-261a-5f38f4090000 pid=2548 clone guuid=bbce0b9b-1900-0000-261a-5f38f7090000 pid=2551 /usr/bin/rm guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=bbce0b9b-1900-0000-261a-5f38f7090000 pid=2551 execve guuid=40778b9b-1900-0000-261a-5f38fa090000 pid=2554 /usr/bin/wget net send-data write-file guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=40778b9b-1900-0000-261a-5f38fa090000 pid=2554 execve guuid=0ea4d6a3-1900-0000-261a-5f38040a0000 pid=2564 /usr/bin/chmod guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=0ea4d6a3-1900-0000-261a-5f38040a0000 pid=2564 execve guuid=f229e9a4-1900-0000-261a-5f38070a0000 pid=2567 /usr/bin/dash guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=f229e9a4-1900-0000-261a-5f38070a0000 pid=2567 clone guuid=ae6996a6-1900-0000-261a-5f380a0a0000 pid=2570 /usr/bin/rm delete-file guuid=d6bab2ec-1800-0000-261a-5f38dd080000 pid=2269->guuid=ae6996a6-1900-0000-261a-5f380a0a0000 pid=2570 execve 0b1ba66e-2f8f-542f-9f7c-00dd01da057c 129.121.110.105:80 guuid=2289b866-1900-0000-261a-5f38bc090000 pid=2492->0b1ba66e-2f8f-542f-9f7c-00dd01da057c send: 133B guuid=9759927d-1900-0000-261a-5f38d2090000 pid=2514->0b1ba66e-2f8f-542f-9f7c-00dd01da057c send: 133B guuid=b7dc7187-1900-0000-261a-5f38dd090000 pid=2525->0b1ba66e-2f8f-542f-9f7c-00dd01da057c send: 134B guuid=63de6c92-1900-0000-261a-5f38ed090000 pid=2541->0b1ba66e-2f8f-542f-9f7c-00dd01da057c send: 133B guuid=40778b9b-1900-0000-261a-5f38fa090000 pid=2554->0b1ba66e-2f8f-542f-9f7c-00dd01da057c send: 133B
Score:
97%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/b88ffb509409384a8190be6d022df92f537a5d3ce728efa2e4ab18ae7e76f5d5
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b88ffb509409384a8190be6d022df92f537a5d3ce728efa2e4ab18ae7e76f5d5/
Gathering data
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xch7wueube4evamqxzwqelpzf5jxuxj444uo7ixevmmk47tw6xkq._file
Result
Malware family:
n/a
Score:
  9/10
Tags:
antivm defense_evasion discovery execution linux persistence privilege_escalation
Link:
https://tria.ge/reports/260808-bfwk5sxanb/
Behaviour
Enumerates kernel/hardware configuration
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
Creates/modifies Cron job
Enumerates running processes
Modifies rc script
Modifies systemd
File and Directory Permissions Modification
Executes dropped EXE
Creates a large amount of network flows
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.26
Link:
https://yomi.yoroi.company/submissions/b88ffb509409384a8190be6d022df92f537a5d3ce728efa2e4ab18ae7e76f5d5

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh b88ffb509409384a8190be6d022df92f537a5d3ce728efa2e4ab18ae7e76f5d5

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3887344/
  
Delivery method
Distributed via web download

Comments