MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bb58d33eb60e8773345e972c17577a227e54a663ecefdf004d3bdc40e3c26cab. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bb58d33eb60e8773345e972c17577a227e54a663ecefdf004d3bdc40e3c26cab
SHA3-384 hash: f7152914945afef570a182da3a8bb71173f3aeb0cbbefd722790a533cda4fa30ac3e3ff6e5131bc0da65237ccbee2f46
SHA1 hash: 0f05ea641dc148ebd3a9882d532b760858a89c80
MD5 hash: b0352d51fbb3727f073277acdb72bf49
humanhash: fanta-sixteen-diet-aspen
File name:lil
Download: download sample
File size:844 bytes
First seen:2026-08-04 05:14:40 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 24:kXCKysE2hi0ziQvZohaC14DQO8oKDO1DX:e9Qp+MsC14SoKyDX
TLSH T1190188D68110AF1040AED95D329B6554F432C3CE1A5B4F75BF9C6E7DEB88904F026ED4
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://129.121.114.124/P3Bn/an/aua-wget
http://129.121.114.124/f2mn/an/aua-wget
http://129.121.114.124/Sg2sn/an/aua-wget
http://129.121.114.124/dLNn/an/aua-wget
http://129.121.114.124/bsLIn/an/aua-wget

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive
Link:
https://www.filescan.io/uploads/6a71757d4b00e4fe30c56731/reports/29871323-81dc-4166-a932-5369615fa039/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-08-04T03:13:00Z UTC
Last seen:
2026-08-04T03:44:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/bb58d33eb60e8773345e972c17577a227e54a663ecefdf004d3bdc40e3c26cab/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/e7ef740d-ef21-437d-8340-c4175b48fc11
Behavior Graph:
Download SVG
%3 guuid=f0656002-1900-0000-42b3-a86c550c0000 pid=3157 /usr/bin/sudo guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162 /tmp/sample.bin write-file guuid=f0656002-1900-0000-42b3-a86c550c0000 pid=3157->guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162 execve guuid=9136d506-1900-0000-42b3-a86c5c0c0000 pid=3164 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=9136d506-1900-0000-42b3-a86c5c0c0000 pid=3164 execve guuid=c999e507-1900-0000-42b3-a86c5e0c0000 pid=3166 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=c999e507-1900-0000-42b3-a86c5e0c0000 pid=3166 execve guuid=30d45f08-1900-0000-42b3-a86c5f0c0000 pid=3167 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=30d45f08-1900-0000-42b3-a86c5f0c0000 pid=3167 execve guuid=6fb5c709-1900-0000-42b3-a86c640c0000 pid=3172 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=6fb5c709-1900-0000-42b3-a86c640c0000 pid=3172 execve guuid=5a412f0a-1900-0000-42b3-a86c650c0000 pid=3173 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=5a412f0a-1900-0000-42b3-a86c650c0000 pid=3173 execve guuid=5312400b-1900-0000-42b3-a86c6a0c0000 pid=3178 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=5312400b-1900-0000-42b3-a86c6a0c0000 pid=3178 execve guuid=f836020c-1900-0000-42b3-a86c6d0c0000 pid=3181 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=f836020c-1900-0000-42b3-a86c6d0c0000 pid=3181 execve guuid=c6ebcd0c-1900-0000-42b3-a86c6f0c0000 pid=3183 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=c6ebcd0c-1900-0000-42b3-a86c6f0c0000 pid=3183 execve guuid=02185c0d-1900-0000-42b3-a86c710c0000 pid=3185 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=02185c0d-1900-0000-42b3-a86c710c0000 pid=3185 execve guuid=cd64ed0d-1900-0000-42b3-a86c730c0000 pid=3187 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=cd64ed0d-1900-0000-42b3-a86c730c0000 pid=3187 execve guuid=b555000f-1900-0000-42b3-a86c780c0000 pid=3192 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=b555000f-1900-0000-42b3-a86c780c0000 pid=3192 execve guuid=dadccd0f-1900-0000-42b3-a86c7a0c0000 pid=3194 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=dadccd0f-1900-0000-42b3-a86c7a0c0000 pid=3194 execve guuid=37c24710-1900-0000-42b3-a86c7b0c0000 pid=3195 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=37c24710-1900-0000-42b3-a86c7b0c0000 pid=3195 execve guuid=41a4b910-1900-0000-42b3-a86c7c0c0000 pid=3196 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=41a4b910-1900-0000-42b3-a86c7c0c0000 pid=3196 execve guuid=c9d02211-1900-0000-42b3-a86c7d0c0000 pid=3197 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=c9d02211-1900-0000-42b3-a86c7d0c0000 pid=3197 execve guuid=322f8011-1900-0000-42b3-a86c7f0c0000 pid=3199 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=322f8011-1900-0000-42b3-a86c7f0c0000 pid=3199 execve guuid=a216dd11-1900-0000-42b3-a86c820c0000 pid=3202 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=a216dd11-1900-0000-42b3-a86c820c0000 pid=3202 execve guuid=f8be3e12-1900-0000-42b3-a86c840c0000 pid=3204 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=f8be3e12-1900-0000-42b3-a86c840c0000 pid=3204 execve guuid=ef9c9d12-1900-0000-42b3-a86c860c0000 pid=3206 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=ef9c9d12-1900-0000-42b3-a86c860c0000 pid=3206 execve guuid=4bf70a13-1900-0000-42b3-a86c890c0000 pid=3209 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=4bf70a13-1900-0000-42b3-a86c890c0000 pid=3209 execve guuid=e7487413-1900-0000-42b3-a86c8b0c0000 pid=3211 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=e7487413-1900-0000-42b3-a86c8b0c0000 pid=3211 execve guuid=b126e213-1900-0000-42b3-a86c8e0c0000 pid=3214 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=b126e213-1900-0000-42b3-a86c8e0c0000 pid=3214 execve guuid=356b4514-1900-0000-42b3-a86c910c0000 pid=3217 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=356b4514-1900-0000-42b3-a86c910c0000 pid=3217 execve guuid=0657b014-1900-0000-42b3-a86c930c0000 pid=3219 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=0657b014-1900-0000-42b3-a86c930c0000 pid=3219 execve guuid=47c81615-1900-0000-42b3-a86c950c0000 pid=3221 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=47c81615-1900-0000-42b3-a86c950c0000 pid=3221 execve guuid=e53d8e15-1900-0000-42b3-a86c980c0000 pid=3224 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=e53d8e15-1900-0000-42b3-a86c980c0000 pid=3224 execve guuid=5d510116-1900-0000-42b3-a86c9a0c0000 pid=3226 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=5d510116-1900-0000-42b3-a86c9a0c0000 pid=3226 execve guuid=31be6f16-1900-0000-42b3-a86c9c0c0000 pid=3228 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=31be6f16-1900-0000-42b3-a86c9c0c0000 pid=3228 execve guuid=7b81e616-1900-0000-42b3-a86c9d0c0000 pid=3229 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=7b81e616-1900-0000-42b3-a86c9d0c0000 pid=3229 execve guuid=f83fb617-1900-0000-42b3-a86c9f0c0000 pid=3231 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=f83fb617-1900-0000-42b3-a86c9f0c0000 pid=3231 execve guuid=dce38f18-1900-0000-42b3-a86ca00c0000 pid=3232 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=dce38f18-1900-0000-42b3-a86ca00c0000 pid=3232 execve guuid=11ae2b19-1900-0000-42b3-a86ca30c0000 pid=3235 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=11ae2b19-1900-0000-42b3-a86ca30c0000 pid=3235 execve guuid=adefc319-1900-0000-42b3-a86ca60c0000 pid=3238 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=adefc319-1900-0000-42b3-a86ca60c0000 pid=3238 execve guuid=fc165a1a-1900-0000-42b3-a86ca90c0000 pid=3241 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=fc165a1a-1900-0000-42b3-a86ca90c0000 pid=3241 execve guuid=4205221b-1900-0000-42b3-a86caa0c0000 pid=3242 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=4205221b-1900-0000-42b3-a86caa0c0000 pid=3242 execve guuid=c6c8121c-1900-0000-42b3-a86cab0c0000 pid=3243 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=c6c8121c-1900-0000-42b3-a86cab0c0000 pid=3243 execve guuid=bd96031d-1900-0000-42b3-a86cac0c0000 pid=3244 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=bd96031d-1900-0000-42b3-a86cac0c0000 pid=3244 execve guuid=6e2ef51d-1900-0000-42b3-a86cad0c0000 pid=3245 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=6e2ef51d-1900-0000-42b3-a86cad0c0000 pid=3245 execve guuid=8601e11e-1900-0000-42b3-a86cae0c0000 pid=3246 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=8601e11e-1900-0000-42b3-a86cae0c0000 pid=3246 execve guuid=5ce9c51f-1900-0000-42b3-a86caf0c0000 pid=3247 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=5ce9c51f-1900-0000-42b3-a86caf0c0000 pid=3247 execve guuid=31bf3d20-1900-0000-42b3-a86cb00c0000 pid=3248 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=31bf3d20-1900-0000-42b3-a86cb00c0000 pid=3248 execve guuid=0d11ba20-1900-0000-42b3-a86cb10c0000 pid=3249 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=0d11ba20-1900-0000-42b3-a86cb10c0000 pid=3249 execve guuid=a6c23221-1900-0000-42b3-a86cb20c0000 pid=3250 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=a6c23221-1900-0000-42b3-a86cb20c0000 pid=3250 execve guuid=c890a921-1900-0000-42b3-a86cb30c0000 pid=3251 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=c890a921-1900-0000-42b3-a86cb30c0000 pid=3251 execve guuid=227b1a22-1900-0000-42b3-a86cb40c0000 pid=3252 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=227b1a22-1900-0000-42b3-a86cb40c0000 pid=3252 execve guuid=16919222-1900-0000-42b3-a86cb50c0000 pid=3253 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=16919222-1900-0000-42b3-a86cb50c0000 pid=3253 execve guuid=cc6b1d23-1900-0000-42b3-a86cb60c0000 pid=3254 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=cc6b1d23-1900-0000-42b3-a86cb60c0000 pid=3254 execve guuid=ce5a0e24-1900-0000-42b3-a86cb70c0000 pid=3255 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=ce5a0e24-1900-0000-42b3-a86cb70c0000 pid=3255 execve guuid=525fa824-1900-0000-42b3-a86cb80c0000 pid=3256 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=525fa824-1900-0000-42b3-a86cb80c0000 pid=3256 execve guuid=39981e25-1900-0000-42b3-a86cba0c0000 pid=3258 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=39981e25-1900-0000-42b3-a86cba0c0000 pid=3258 execve guuid=aca68825-1900-0000-42b3-a86cbb0c0000 pid=3259 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=aca68825-1900-0000-42b3-a86cbb0c0000 pid=3259 execve guuid=0360fe25-1900-0000-42b3-a86cbc0c0000 pid=3260 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=0360fe25-1900-0000-42b3-a86cbc0c0000 pid=3260 execve guuid=5d346026-1900-0000-42b3-a86cbd0c0000 pid=3261 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=5d346026-1900-0000-42b3-a86cbd0c0000 pid=3261 execve guuid=ad66df26-1900-0000-42b3-a86cbe0c0000 pid=3262 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=ad66df26-1900-0000-42b3-a86cbe0c0000 pid=3262 execve guuid=5c776a27-1900-0000-42b3-a86cc00c0000 pid=3264 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=5c776a27-1900-0000-42b3-a86cc00c0000 pid=3264 execve guuid=556dff27-1900-0000-42b3-a86cc20c0000 pid=3266 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=556dff27-1900-0000-42b3-a86cc20c0000 pid=3266 execve guuid=664a9d28-1900-0000-42b3-a86cc40c0000 pid=3268 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=664a9d28-1900-0000-42b3-a86cc40c0000 pid=3268 execve guuid=78843f29-1900-0000-42b3-a86cc60c0000 pid=3270 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=78843f29-1900-0000-42b3-a86cc60c0000 pid=3270 execve guuid=8442dc29-1900-0000-42b3-a86cc90c0000 pid=3273 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=8442dc29-1900-0000-42b3-a86cc90c0000 pid=3273 execve guuid=eb48722a-1900-0000-42b3-a86ccb0c0000 pid=3275 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=eb48722a-1900-0000-42b3-a86ccb0c0000 pid=3275 execve guuid=6b39ff2a-1900-0000-42b3-a86ccd0c0000 pid=3277 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=6b39ff2a-1900-0000-42b3-a86ccd0c0000 pid=3277 execve guuid=35a1922b-1900-0000-42b3-a86ccf0c0000 pid=3279 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=35a1922b-1900-0000-42b3-a86ccf0c0000 pid=3279 execve guuid=2b9f242c-1900-0000-42b3-a86cd10c0000 pid=3281 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=2b9f242c-1900-0000-42b3-a86cd10c0000 pid=3281 execve guuid=41278a2c-1900-0000-42b3-a86cd20c0000 pid=3282 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=41278a2c-1900-0000-42b3-a86cd20c0000 pid=3282 execve guuid=e5ece02c-1900-0000-42b3-a86cd30c0000 pid=3283 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=e5ece02c-1900-0000-42b3-a86cd30c0000 pid=3283 execve guuid=c58a752d-1900-0000-42b3-a86cd40c0000 pid=3284 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=c58a752d-1900-0000-42b3-a86cd40c0000 pid=3284 execve guuid=6878ff2d-1900-0000-42b3-a86cd50c0000 pid=3285 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=6878ff2d-1900-0000-42b3-a86cd50c0000 pid=3285 execve guuid=70c1c92e-1900-0000-42b3-a86cd70c0000 pid=3287 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=70c1c92e-1900-0000-42b3-a86cd70c0000 pid=3287 execve guuid=113f602f-1900-0000-42b3-a86cda0c0000 pid=3290 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=113f602f-1900-0000-42b3-a86cda0c0000 pid=3290 execve guuid=37d3e02f-1900-0000-42b3-a86cdd0c0000 pid=3293 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=37d3e02f-1900-0000-42b3-a86cdd0c0000 pid=3293 execve guuid=80146030-1900-0000-42b3-a86ce00c0000 pid=3296 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=80146030-1900-0000-42b3-a86ce00c0000 pid=3296 execve guuid=4540d430-1900-0000-42b3-a86ce20c0000 pid=3298 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=4540d430-1900-0000-42b3-a86ce20c0000 pid=3298 execve guuid=e43d4a31-1900-0000-42b3-a86ce40c0000 pid=3300 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=e43d4a31-1900-0000-42b3-a86ce40c0000 pid=3300 execve guuid=eba4b631-1900-0000-42b3-a86ce60c0000 pid=3302 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=eba4b631-1900-0000-42b3-a86ce60c0000 pid=3302 execve guuid=a7531332-1900-0000-42b3-a86ce80c0000 pid=3304 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=a7531332-1900-0000-42b3-a86ce80c0000 pid=3304 execve guuid=19a47c32-1900-0000-42b3-a86ceb0c0000 pid=3307 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=19a47c32-1900-0000-42b3-a86ceb0c0000 pid=3307 execve guuid=b4e1f032-1900-0000-42b3-a86ced0c0000 pid=3309 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=b4e1f032-1900-0000-42b3-a86ced0c0000 pid=3309 execve guuid=eeb15833-1900-0000-42b3-a86cef0c0000 pid=3311 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=eeb15833-1900-0000-42b3-a86cef0c0000 pid=3311 execve guuid=3e7fe033-1900-0000-42b3-a86cf10c0000 pid=3313 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=3e7fe033-1900-0000-42b3-a86cf10c0000 pid=3313 execve guuid=7d6b7f34-1900-0000-42b3-a86cf40c0000 pid=3316 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=7d6b7f34-1900-0000-42b3-a86cf40c0000 pid=3316 execve guuid=cbfce934-1900-0000-42b3-a86cf60c0000 pid=3318 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=cbfce934-1900-0000-42b3-a86cf60c0000 pid=3318 execve guuid=a1124a35-1900-0000-42b3-a86cf80c0000 pid=3320 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=a1124a35-1900-0000-42b3-a86cf80c0000 pid=3320 execve guuid=345aab35-1900-0000-42b3-a86cfb0c0000 pid=3323 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=345aab35-1900-0000-42b3-a86cfb0c0000 pid=3323 execve guuid=dabb0e36-1900-0000-42b3-a86cfd0c0000 pid=3325 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=dabb0e36-1900-0000-42b3-a86cfd0c0000 pid=3325 execve guuid=a486ac36-1900-0000-42b3-a86c000d0000 pid=3328 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=a486ac36-1900-0000-42b3-a86c000d0000 pid=3328 execve guuid=08564c37-1900-0000-42b3-a86c020d0000 pid=3330 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=08564c37-1900-0000-42b3-a86c020d0000 pid=3330 execve guuid=9132e337-1900-0000-42b3-a86c050d0000 pid=3333 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=9132e337-1900-0000-42b3-a86c050d0000 pid=3333 execve guuid=ff5f9338-1900-0000-42b3-a86c090d0000 pid=3337 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=ff5f9338-1900-0000-42b3-a86c090d0000 pid=3337 execve guuid=abc90939-1900-0000-42b3-a86c0b0d0000 pid=3339 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=abc90939-1900-0000-42b3-a86c0b0d0000 pid=3339 execve guuid=da9d8739-1900-0000-42b3-a86c0d0d0000 pid=3341 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=da9d8739-1900-0000-42b3-a86c0d0d0000 pid=3341 execve guuid=537d013a-1900-0000-42b3-a86c0f0d0000 pid=3343 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=537d013a-1900-0000-42b3-a86c0f0d0000 pid=3343 execve guuid=80627c3a-1900-0000-42b3-a86c110d0000 pid=3345 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=80627c3a-1900-0000-42b3-a86c110d0000 pid=3345 execve guuid=ab3af43a-1900-0000-42b3-a86c120d0000 pid=3346 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=ab3af43a-1900-0000-42b3-a86c120d0000 pid=3346 execve guuid=1dcc773b-1900-0000-42b3-a86c140d0000 pid=3348 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=1dcc773b-1900-0000-42b3-a86c140d0000 pid=3348 execve guuid=bb17523c-1900-0000-42b3-a86c180d0000 pid=3352 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=bb17523c-1900-0000-42b3-a86c180d0000 pid=3352 execve guuid=ab3faf3c-1900-0000-42b3-a86c1a0d0000 pid=3354 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=ab3faf3c-1900-0000-42b3-a86c1a0d0000 pid=3354 execve guuid=98aa083d-1900-0000-42b3-a86c1d0d0000 pid=3357 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=98aa083d-1900-0000-42b3-a86c1d0d0000 pid=3357 execve guuid=3c95673d-1900-0000-42b3-a86c1f0d0000 pid=3359 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=3c95673d-1900-0000-42b3-a86c1f0d0000 pid=3359 execve guuid=bf3acd3d-1900-0000-42b3-a86c220d0000 pid=3362 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=bf3acd3d-1900-0000-42b3-a86c220d0000 pid=3362 execve guuid=d226263e-1900-0000-42b3-a86c240d0000 pid=3364 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=d226263e-1900-0000-42b3-a86c240d0000 pid=3364 execve guuid=f4c1833e-1900-0000-42b3-a86c270d0000 pid=3367 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=f4c1833e-1900-0000-42b3-a86c270d0000 pid=3367 execve guuid=c870dd3e-1900-0000-42b3-a86c290d0000 pid=3369 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=c870dd3e-1900-0000-42b3-a86c290d0000 pid=3369 execve guuid=cf9b323f-1900-0000-42b3-a86c2c0d0000 pid=3372 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=cf9b323f-1900-0000-42b3-a86c2c0d0000 pid=3372 execve guuid=a292e13f-1900-0000-42b3-a86c2e0d0000 pid=3374 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=a292e13f-1900-0000-42b3-a86c2e0d0000 pid=3374 execve guuid=8eb34740-1900-0000-42b3-a86c2f0d0000 pid=3375 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=8eb34740-1900-0000-42b3-a86c2f0d0000 pid=3375 execve guuid=207ac840-1900-0000-42b3-a86c320d0000 pid=3378 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=207ac840-1900-0000-42b3-a86c320d0000 pid=3378 execve guuid=22aa6441-1900-0000-42b3-a86c350d0000 pid=3381 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=22aa6441-1900-0000-42b3-a86c350d0000 pid=3381 execve guuid=8858ff41-1900-0000-42b3-a86c380d0000 pid=3384 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=8858ff41-1900-0000-42b3-a86c380d0000 pid=3384 execve guuid=05f79242-1900-0000-42b3-a86c3b0d0000 pid=3387 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=05f79242-1900-0000-42b3-a86c3b0d0000 pid=3387 execve guuid=f0002e43-1900-0000-42b3-a86c3e0d0000 pid=3390 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=f0002e43-1900-0000-42b3-a86c3e0d0000 pid=3390 execve guuid=06fdc743-1900-0000-42b3-a86c400d0000 pid=3392 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=06fdc743-1900-0000-42b3-a86c400d0000 pid=3392 execve guuid=0e2d6344-1900-0000-42b3-a86c430d0000 pid=3395 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=0e2d6344-1900-0000-42b3-a86c430d0000 pid=3395 execve guuid=88c5f844-1900-0000-42b3-a86c460d0000 pid=3398 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=88c5f844-1900-0000-42b3-a86c460d0000 pid=3398 execve guuid=238b9445-1900-0000-42b3-a86c4a0d0000 pid=3402 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=238b9445-1900-0000-42b3-a86c4a0d0000 pid=3402 execve guuid=154b2c46-1900-0000-42b3-a86c4d0d0000 pid=3405 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=154b2c46-1900-0000-42b3-a86c4d0d0000 pid=3405 execve guuid=573ccc46-1900-0000-42b3-a86c500d0000 pid=3408 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=573ccc46-1900-0000-42b3-a86c500d0000 pid=3408 execve guuid=14086347-1900-0000-42b3-a86c530d0000 pid=3411 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=14086347-1900-0000-42b3-a86c530d0000 pid=3411 execve guuid=32afef47-1900-0000-42b3-a86c550d0000 pid=3413 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=32afef47-1900-0000-42b3-a86c550d0000 pid=3413 execve guuid=93a65548-1900-0000-42b3-a86c570d0000 pid=3415 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=93a65548-1900-0000-42b3-a86c570d0000 pid=3415 execve guuid=ad5daf48-1900-0000-42b3-a86c590d0000 pid=3417 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=ad5daf48-1900-0000-42b3-a86c590d0000 pid=3417 execve guuid=063d0749-1900-0000-42b3-a86c5b0d0000 pid=3419 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=063d0749-1900-0000-42b3-a86c5b0d0000 pid=3419 execve guuid=20276349-1900-0000-42b3-a86c5e0d0000 pid=3422 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=20276349-1900-0000-42b3-a86c5e0d0000 pid=3422 execve guuid=00a9d049-1900-0000-42b3-a86c600d0000 pid=3424 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=00a9d049-1900-0000-42b3-a86c600d0000 pid=3424 execve guuid=03d12a4a-1900-0000-42b3-a86c630d0000 pid=3427 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=03d12a4a-1900-0000-42b3-a86c630d0000 pid=3427 execve guuid=d1fb844a-1900-0000-42b3-a86c650d0000 pid=3429 /usr/bin/ls guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=d1fb844a-1900-0000-42b3-a86c650d0000 pid=3429 execve guuid=cbfcfc4a-1900-0000-42b3-a86c680d0000 pid=3432 /usr/bin/rm guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=cbfcfc4a-1900-0000-42b3-a86c680d0000 pid=3432 execve guuid=48f0454b-1900-0000-42b3-a86c6a0d0000 pid=3434 /usr/bin/wget net send-data write-file guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=48f0454b-1900-0000-42b3-a86c6a0d0000 pid=3434 execve guuid=3965b459-1900-0000-42b3-a86c900d0000 pid=3472 /usr/bin/chmod guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=3965b459-1900-0000-42b3-a86c900d0000 pid=3472 execve guuid=abcd325a-1900-0000-42b3-a86c920d0000 pid=3474 /tmp/P3B guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=abcd325a-1900-0000-42b3-a86c920d0000 pid=3474 execve guuid=2e243f5b-1900-0000-42b3-a86c960d0000 pid=3478 /usr/bin/rm guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=2e243f5b-1900-0000-42b3-a86c960d0000 pid=3478 execve guuid=7476c75b-1900-0000-42b3-a86c980d0000 pid=3480 /usr/bin/wget net send-data write-file guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=7476c75b-1900-0000-42b3-a86c980d0000 pid=3480 execve guuid=2b632e69-1900-0000-42b3-a86caf0d0000 pid=3503 /usr/bin/chmod guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=2b632e69-1900-0000-42b3-a86caf0d0000 pid=3503 execve guuid=390d9969-1900-0000-42b3-a86cb00d0000 pid=3504 /tmp/f2m guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=390d9969-1900-0000-42b3-a86cb00d0000 pid=3504 execve guuid=5e4c806b-1900-0000-42b3-a86cb20d0000 pid=3506 /usr/bin/rm guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=5e4c806b-1900-0000-42b3-a86cb20d0000 pid=3506 execve guuid=7d6bbe6b-1900-0000-42b3-a86cb60d0000 pid=3510 /usr/bin/wget net send-data write-file guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=7d6bbe6b-1900-0000-42b3-a86cb60d0000 pid=3510 execve guuid=b5762e78-1900-0000-42b3-a86cc90d0000 pid=3529 /usr/bin/chmod guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=b5762e78-1900-0000-42b3-a86cc90d0000 pid=3529 execve guuid=6cd59778-1900-0000-42b3-a86cca0d0000 pid=3530 /tmp/Sg2s guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=6cd59778-1900-0000-42b3-a86cca0d0000 pid=3530 execve guuid=2d188b79-1900-0000-42b3-a86ccf0d0000 pid=3535 /usr/bin/rm guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=2d188b79-1900-0000-42b3-a86ccf0d0000 pid=3535 execve guuid=56e4da79-1900-0000-42b3-a86cd10d0000 pid=3537 /usr/bin/wget net send-data write-file guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=56e4da79-1900-0000-42b3-a86cd10d0000 pid=3537 execve guuid=8ebc9b86-1900-0000-42b3-a86cdf0d0000 pid=3551 /usr/bin/chmod guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=8ebc9b86-1900-0000-42b3-a86cdf0d0000 pid=3551 execve guuid=2323d986-1900-0000-42b3-a86ce00d0000 pid=3552 /tmp/dLN guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=2323d986-1900-0000-42b3-a86ce00d0000 pid=3552 execve guuid=eebbd887-1900-0000-42b3-a86ce20d0000 pid=3554 /usr/bin/rm guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=eebbd887-1900-0000-42b3-a86ce20d0000 pid=3554 execve guuid=93b12388-1900-0000-42b3-a86ce30d0000 pid=3555 /usr/bin/wget net send-data write-file guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=93b12388-1900-0000-42b3-a86ce30d0000 pid=3555 execve guuid=163b1894-1900-0000-42b3-a86c070e0000 pid=3591 /usr/bin/chmod guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=163b1894-1900-0000-42b3-a86c070e0000 pid=3591 execve guuid=7fa65d94-1900-0000-42b3-a86c090e0000 pid=3593 /tmp/bsLI guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=7fa65d94-1900-0000-42b3-a86c090e0000 pid=3593 execve guuid=badd5a95-1900-0000-42b3-a86c0d0e0000 pid=3597 /usr/bin/rm delete-file guuid=1263fc05-1900-0000-42b3-a86c5a0c0000 pid=3162->guuid=badd5a95-1900-0000-42b3-a86c0d0e0000 pid=3597 execve 801186e6-5fe8-5959-a7b4-832d8d66e7aa 129.121.114.124:80 guuid=48f0454b-1900-0000-42b3-a86c6a0d0000 pid=3434->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 133B guuid=7476c75b-1900-0000-42b3-a86c980d0000 pid=3480->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 133B guuid=7d6bbe6b-1900-0000-42b3-a86cb60d0000 pid=3510->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 134B guuid=56e4da79-1900-0000-42b3-a86cd10d0000 pid=3537->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 133B guuid=93b12388-1900-0000-42b3-a86ce30d0000 pid=3555->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 134B
Score:
93%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/bb58d33eb60e8773345e972c17577a227e54a663ecefdf004d3bdc40e3c26cab
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bb58d33eb60e8773345e972c17577a227e54a663ecefdf004d3bdc40e3c26cab/
Threat name:
Document-HTML.Downloader.Bash
Create hunting rule
Status:
Malicious
First seen:
2026-08-04 05:15:46 UTC
File Type:
Text (Shell)
AV detection:
11 of 36 (30.56%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xnmngpvwb2dxgnc6s4wbov32ej7fjjtd5tx56acnhpoeby6cnsvq._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
discovery linux
Link:
https://tria.ge/reports/260804-fxxxrawwby/
Behaviour
Reads runtime system information
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.26
Link:
https://yomi.yoroi.company/submissions/bb58d33eb60e8773345e972c17577a227e54a663ecefdf004d3bdc40e3c26cab

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh bb58d33eb60e8773345e972c17577a227e54a663ecefdf004d3bdc40e3c26cab

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3874630/
  
Delivery method
Distributed via web download

Comments