🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bcb93b961d7188b32745b05b700959ba49d5b05ea870d9eeed2e2db63e8b7575. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: bcb93b961d7188b32745b05b700959ba49d5b05ea870d9eeed2e2db63e8b7575
SHA3-384 hash: d92349f2277ba59e5852dbd031cd70aaa5b306d631193b46abae2e97bef517ca4435a7194532c624950e063fab887f31
SHA1 hash: a7648ce4b2ab87e898e28f2fbf943006162d2153
MD5 hash: daa3501c18296893f7a6928b91cbfec7
humanhash: zulu-beer-nitrogen-victor
File name:lil
Download: download sample
File size:844 bytes
First seen:2026-07-04 01:27:53 UTC
Last seen:2026-07-04 21:58:36 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkacC7mwC2t2CMeCZ6U88C6qX:kXCKysE2hi0ziQvZohacExkGU13qX
TLSH T15C01AFC988149C2040AE992D229764D4F410C3CE164B8F75BFAC7D39EBD891CB076F89
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://129.121.114.124/cPq5n/an/an/a
http://129.121.114.124/k8zn/an/an/a
http://129.121.114.124/Mxzn/an/aelf ua-wget
http://129.121.114.124/MQYn/an/an/a
http://129.121.114.124/nFtKn/an/an/a

Intelligence

File Origin
# of uploads :
5
# of downloads :
59
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
downloader evasive mirai
Link:
https://www.filescan.io/uploads/6a4861c2541fbed279911cf0/reports/890ba611-1911-4550-8984-3a65f50fb41e/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-07-03T22:34:00Z UTC
Last seen:
2026-07-05T19:30:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan-Downloader.Shell.Agent.a
Link:
https://opentip.kaspersky.com/bcb93b961d7188b32745b05b700959ba49d5b05ea870d9eeed2e2db63e8b7575/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/865fa551-9513-46aa-bc1c-f6d31ab2fb1c
Behavior Graph:
Download SVG
%3 guuid=7f03e567-1900-0000-eb95-f584cd0f0000 pid=4045 /usr/bin/sudo guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056 /tmp/sample.bin write-file guuid=7f03e567-1900-0000-eb95-f584cd0f0000 pid=4045->guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056 execve guuid=d1d9e66a-1900-0000-eb95-f584dc0f0000 pid=4060 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=d1d9e66a-1900-0000-eb95-f584dc0f0000 pid=4060 execve guuid=16b7f96b-1900-0000-eb95-f584e10f0000 pid=4065 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=16b7f96b-1900-0000-eb95-f584e10f0000 pid=4065 execve guuid=fbf1b66c-1900-0000-eb95-f584e60f0000 pid=4070 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=fbf1b66c-1900-0000-eb95-f584e60f0000 pid=4070 execve guuid=93e4686d-1900-0000-eb95-f584e70f0000 pid=4071 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=93e4686d-1900-0000-eb95-f584e70f0000 pid=4071 execve guuid=83771a6e-1900-0000-eb95-f584eb0f0000 pid=4075 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=83771a6e-1900-0000-eb95-f584eb0f0000 pid=4075 execve guuid=9928b06e-1900-0000-eb95-f584ed0f0000 pid=4077 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=9928b06e-1900-0000-eb95-f584ed0f0000 pid=4077 execve guuid=7862656f-1900-0000-eb95-f584f10f0000 pid=4081 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=7862656f-1900-0000-eb95-f584f10f0000 pid=4081 execve guuid=3b56c96f-1900-0000-eb95-f584f30f0000 pid=4083 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=3b56c96f-1900-0000-eb95-f584f30f0000 pid=4083 execve guuid=3f7f2e70-1900-0000-eb95-f584f40f0000 pid=4084 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=3f7f2e70-1900-0000-eb95-f584f40f0000 pid=4084 execve guuid=86a1c570-1900-0000-eb95-f584f90f0000 pid=4089 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=86a1c570-1900-0000-eb95-f584f90f0000 pid=4089 execve guuid=4b4f7f71-1900-0000-eb95-f584fc0f0000 pid=4092 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=4b4f7f71-1900-0000-eb95-f584fc0f0000 pid=4092 execve guuid=12383272-1900-0000-eb95-f584ff0f0000 pid=4095 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=12383272-1900-0000-eb95-f584ff0f0000 pid=4095 execve guuid=5f6adf72-1900-0000-eb95-f58402100000 pid=4098 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=5f6adf72-1900-0000-eb95-f58402100000 pid=4098 execve guuid=56a38573-1900-0000-eb95-f58406100000 pid=4102 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=56a38573-1900-0000-eb95-f58406100000 pid=4102 execve guuid=2faf5374-1900-0000-eb95-f58408100000 pid=4104 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=2faf5374-1900-0000-eb95-f58408100000 pid=4104 execve guuid=9ac04975-1900-0000-eb95-f5840b100000 pid=4107 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=9ac04975-1900-0000-eb95-f5840b100000 pid=4107 execve guuid=7850d375-1900-0000-eb95-f5840e100000 pid=4110 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=7850d375-1900-0000-eb95-f5840e100000 pid=4110 execve guuid=a33a5876-1900-0000-eb95-f58411100000 pid=4113 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=a33a5876-1900-0000-eb95-f58411100000 pid=4113 execve guuid=2150d676-1900-0000-eb95-f58414100000 pid=4116 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=2150d676-1900-0000-eb95-f58414100000 pid=4116 execve guuid=0e533f77-1900-0000-eb95-f58415100000 pid=4117 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=0e533f77-1900-0000-eb95-f58415100000 pid=4117 execve guuid=214db477-1900-0000-eb95-f58416100000 pid=4118 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=214db477-1900-0000-eb95-f58416100000 pid=4118 execve guuid=0df83478-1900-0000-eb95-f58417100000 pid=4119 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=0df83478-1900-0000-eb95-f58417100000 pid=4119 execve guuid=1701b878-1900-0000-eb95-f58418100000 pid=4120 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=1701b878-1900-0000-eb95-f58418100000 pid=4120 execve guuid=13c13979-1900-0000-eb95-f58419100000 pid=4121 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=13c13979-1900-0000-eb95-f58419100000 pid=4121 execve guuid=f889b779-1900-0000-eb95-f5841a100000 pid=4122 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=f889b779-1900-0000-eb95-f5841a100000 pid=4122 execve guuid=2ab8247a-1900-0000-eb95-f5841b100000 pid=4123 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=2ab8247a-1900-0000-eb95-f5841b100000 pid=4123 execve guuid=9979a17a-1900-0000-eb95-f5841c100000 pid=4124 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=9979a17a-1900-0000-eb95-f5841c100000 pid=4124 execve guuid=a3bb327b-1900-0000-eb95-f5841d100000 pid=4125 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=a3bb327b-1900-0000-eb95-f5841d100000 pid=4125 execve guuid=d945a27b-1900-0000-eb95-f58421100000 pid=4129 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=d945a27b-1900-0000-eb95-f58421100000 pid=4129 execve guuid=7951017c-1900-0000-eb95-f58422100000 pid=4130 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=7951017c-1900-0000-eb95-f58422100000 pid=4130 execve guuid=38b6687c-1900-0000-eb95-f58423100000 pid=4131 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=38b6687c-1900-0000-eb95-f58423100000 pid=4131 execve guuid=7bc3d17c-1900-0000-eb95-f58424100000 pid=4132 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=7bc3d17c-1900-0000-eb95-f58424100000 pid=4132 execve guuid=7e4a347d-1900-0000-eb95-f58426100000 pid=4134 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=7e4a347d-1900-0000-eb95-f58426100000 pid=4134 execve guuid=08f7527e-1900-0000-eb95-f5842c100000 pid=4140 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=08f7527e-1900-0000-eb95-f5842c100000 pid=4140 execve guuid=117bad7e-1900-0000-eb95-f5842f100000 pid=4143 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=117bad7e-1900-0000-eb95-f5842f100000 pid=4143 execve guuid=08c9407f-1900-0000-eb95-f58434100000 pid=4148 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=08c9407f-1900-0000-eb95-f58434100000 pid=4148 execve guuid=5f23a67f-1900-0000-eb95-f58436100000 pid=4150 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=5f23a67f-1900-0000-eb95-f58436100000 pid=4150 execve guuid=2bb00980-1900-0000-eb95-f58439100000 pid=4153 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=2bb00980-1900-0000-eb95-f58439100000 pid=4153 execve guuid=6fcf7180-1900-0000-eb95-f5843b100000 pid=4155 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=6fcf7180-1900-0000-eb95-f5843b100000 pid=4155 execve guuid=fea8d280-1900-0000-eb95-f5843e100000 pid=4158 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=fea8d280-1900-0000-eb95-f5843e100000 pid=4158 execve guuid=41e83a81-1900-0000-eb95-f58440100000 pid=4160 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=41e83a81-1900-0000-eb95-f58440100000 pid=4160 execve guuid=0242a181-1900-0000-eb95-f58442100000 pid=4162 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=0242a181-1900-0000-eb95-f58442100000 pid=4162 execve guuid=de85fc81-1900-0000-eb95-f58446100000 pid=4166 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=de85fc81-1900-0000-eb95-f58446100000 pid=4166 execve guuid=84475782-1900-0000-eb95-f5844a100000 pid=4170 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=84475782-1900-0000-eb95-f5844a100000 pid=4170 execve guuid=1083c682-1900-0000-eb95-f5844c100000 pid=4172 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=1083c682-1900-0000-eb95-f5844c100000 pid=4172 execve guuid=7d7e2483-1900-0000-eb95-f5844f100000 pid=4175 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=7d7e2483-1900-0000-eb95-f5844f100000 pid=4175 execve guuid=d3278683-1900-0000-eb95-f58451100000 pid=4177 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=d3278683-1900-0000-eb95-f58451100000 pid=4177 execve guuid=bb56e783-1900-0000-eb95-f58454100000 pid=4180 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=bb56e783-1900-0000-eb95-f58454100000 pid=4180 execve guuid=b0f04284-1900-0000-eb95-f58456100000 pid=4182 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=b0f04284-1900-0000-eb95-f58456100000 pid=4182 execve guuid=711c9e84-1900-0000-eb95-f58458100000 pid=4184 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=711c9e84-1900-0000-eb95-f58458100000 pid=4184 execve guuid=ea6af984-1900-0000-eb95-f5845c100000 pid=4188 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=ea6af984-1900-0000-eb95-f5845c100000 pid=4188 execve guuid=e1c04e85-1900-0000-eb95-f58460100000 pid=4192 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=e1c04e85-1900-0000-eb95-f58460100000 pid=4192 execve guuid=fdb3af85-1900-0000-eb95-f58463100000 pid=4195 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=fdb3af85-1900-0000-eb95-f58463100000 pid=4195 execve guuid=cce80886-1900-0000-eb95-f58467100000 pid=4199 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=cce80886-1900-0000-eb95-f58467100000 pid=4199 execve guuid=2fc06286-1900-0000-eb95-f5846b100000 pid=4203 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=2fc06286-1900-0000-eb95-f5846b100000 pid=4203 execve guuid=8a8aba86-1900-0000-eb95-f5846d100000 pid=4205 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=8a8aba86-1900-0000-eb95-f5846d100000 pid=4205 execve guuid=585a1f87-1900-0000-eb95-f5846f100000 pid=4207 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=585a1f87-1900-0000-eb95-f5846f100000 pid=4207 execve guuid=5e21b587-1900-0000-eb95-f58472100000 pid=4210 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=5e21b587-1900-0000-eb95-f58472100000 pid=4210 execve guuid=e0ad4f88-1900-0000-eb95-f58476100000 pid=4214 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=e0ad4f88-1900-0000-eb95-f58476100000 pid=4214 execve guuid=ed15e488-1900-0000-eb95-f58479100000 pid=4217 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=ed15e488-1900-0000-eb95-f58479100000 pid=4217 execve guuid=68295389-1900-0000-eb95-f5847c100000 pid=4220 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=68295389-1900-0000-eb95-f5847c100000 pid=4220 execve guuid=4b6bbc89-1900-0000-eb95-f58480100000 pid=4224 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=4b6bbc89-1900-0000-eb95-f58480100000 pid=4224 execve guuid=d56e128a-1900-0000-eb95-f58481100000 pid=4225 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=d56e128a-1900-0000-eb95-f58481100000 pid=4225 execve guuid=d5d9b58a-1900-0000-eb95-f58483100000 pid=4227 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=d5d9b58a-1900-0000-eb95-f58483100000 pid=4227 execve guuid=68e32e8b-1900-0000-eb95-f58485100000 pid=4229 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=68e32e8b-1900-0000-eb95-f58485100000 pid=4229 execve guuid=998adb8b-1900-0000-eb95-f5848c100000 pid=4236 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=998adb8b-1900-0000-eb95-f5848c100000 pid=4236 execve guuid=d94aa08c-1900-0000-eb95-f5848d100000 pid=4237 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=d94aa08c-1900-0000-eb95-f5848d100000 pid=4237 execve guuid=5f5a408d-1900-0000-eb95-f58490100000 pid=4240 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=5f5a408d-1900-0000-eb95-f58490100000 pid=4240 execve guuid=e2e1ce8d-1900-0000-eb95-f58494100000 pid=4244 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=e2e1ce8d-1900-0000-eb95-f58494100000 pid=4244 execve guuid=89af5b8e-1900-0000-eb95-f58498100000 pid=4248 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=89af5b8e-1900-0000-eb95-f58498100000 pid=4248 execve guuid=41a3e38e-1900-0000-eb95-f5849a100000 pid=4250 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=41a3e38e-1900-0000-eb95-f5849a100000 pid=4250 execve guuid=e2057c8f-1900-0000-eb95-f5849e100000 pid=4254 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=e2057c8f-1900-0000-eb95-f5849e100000 pid=4254 execve guuid=1defd98f-1900-0000-eb95-f584a0100000 pid=4256 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=1defd98f-1900-0000-eb95-f584a0100000 pid=4256 execve guuid=96404790-1900-0000-eb95-f584a4100000 pid=4260 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=96404790-1900-0000-eb95-f584a4100000 pid=4260 execve guuid=9481b690-1900-0000-eb95-f584a6100000 pid=4262 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=9481b690-1900-0000-eb95-f584a6100000 pid=4262 execve guuid=17682091-1900-0000-eb95-f584a8100000 pid=4264 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=17682091-1900-0000-eb95-f584a8100000 pid=4264 execve guuid=f6a99291-1900-0000-eb95-f584ac100000 pid=4268 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=f6a99291-1900-0000-eb95-f584ac100000 pid=4268 execve guuid=19840492-1900-0000-eb95-f584b0100000 pid=4272 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=19840492-1900-0000-eb95-f584b0100000 pid=4272 execve guuid=bb859f92-1900-0000-eb95-f584b2100000 pid=4274 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=bb859f92-1900-0000-eb95-f584b2100000 pid=4274 execve guuid=15934493-1900-0000-eb95-f584b7100000 pid=4279 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=15934493-1900-0000-eb95-f584b7100000 pid=4279 execve guuid=c187c393-1900-0000-eb95-f584b8100000 pid=4280 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=c187c393-1900-0000-eb95-f584b8100000 pid=4280 execve guuid=da6a6694-1900-0000-eb95-f584bd100000 pid=4285 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=da6a6694-1900-0000-eb95-f584bd100000 pid=4285 execve guuid=84eed894-1900-0000-eb95-f584bf100000 pid=4287 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=84eed894-1900-0000-eb95-f584bf100000 pid=4287 execve guuid=ef595095-1900-0000-eb95-f584c3100000 pid=4291 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=ef595095-1900-0000-eb95-f584c3100000 pid=4291 execve guuid=30d0e495-1900-0000-eb95-f584c7100000 pid=4295 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=30d0e495-1900-0000-eb95-f584c7100000 pid=4295 execve guuid=0d195b96-1900-0000-eb95-f584c9100000 pid=4297 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=0d195b96-1900-0000-eb95-f584c9100000 pid=4297 execve guuid=9d66dc96-1900-0000-eb95-f584cb100000 pid=4299 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=9d66dc96-1900-0000-eb95-f584cb100000 pid=4299 execve guuid=a7655697-1900-0000-eb95-f584cd100000 pid=4301 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=a7655697-1900-0000-eb95-f584cd100000 pid=4301 execve guuid=38c4e497-1900-0000-eb95-f584d0100000 pid=4304 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=38c4e497-1900-0000-eb95-f584d0100000 pid=4304 execve guuid=4f9c5c98-1900-0000-eb95-f584d2100000 pid=4306 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=4f9c5c98-1900-0000-eb95-f584d2100000 pid=4306 execve guuid=2c6ae798-1900-0000-eb95-f584d4100000 pid=4308 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=2c6ae798-1900-0000-eb95-f584d4100000 pid=4308 execve guuid=c8678699-1900-0000-eb95-f584d7100000 pid=4311 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=c8678699-1900-0000-eb95-f584d7100000 pid=4311 execve guuid=22e1e599-1900-0000-eb95-f584d8100000 pid=4312 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=22e1e599-1900-0000-eb95-f584d8100000 pid=4312 execve guuid=47c3929a-1900-0000-eb95-f584da100000 pid=4314 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=47c3929a-1900-0000-eb95-f584da100000 pid=4314 execve guuid=4b56359b-1900-0000-eb95-f584dd100000 pid=4317 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=4b56359b-1900-0000-eb95-f584dd100000 pid=4317 execve guuid=a3e8c89b-1900-0000-eb95-f584e1100000 pid=4321 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=a3e8c89b-1900-0000-eb95-f584e1100000 pid=4321 execve guuid=c2256b9c-1900-0000-eb95-f584e5100000 pid=4325 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=c2256b9c-1900-0000-eb95-f584e5100000 pid=4325 execve guuid=fbb45d9d-1900-0000-eb95-f584ec100000 pid=4332 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=fbb45d9d-1900-0000-eb95-f584ec100000 pid=4332 execve guuid=e889d19d-1900-0000-eb95-f584ed100000 pid=4333 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=e889d19d-1900-0000-eb95-f584ed100000 pid=4333 execve guuid=29b6409e-1900-0000-eb95-f584ef100000 pid=4335 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=29b6409e-1900-0000-eb95-f584ef100000 pid=4335 execve guuid=9ae2b29e-1900-0000-eb95-f584f1100000 pid=4337 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=9ae2b29e-1900-0000-eb95-f584f1100000 pid=4337 execve guuid=f6e4519f-1900-0000-eb95-f584f4100000 pid=4340 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=f6e4519f-1900-0000-eb95-f584f4100000 pid=4340 execve guuid=bb4deb9f-1900-0000-eb95-f584f7100000 pid=4343 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=bb4deb9f-1900-0000-eb95-f584f7100000 pid=4343 execve guuid=8cd897a0-1900-0000-eb95-f584f8100000 pid=4344 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=8cd897a0-1900-0000-eb95-f584f8100000 pid=4344 execve guuid=456e5da1-1900-0000-eb95-f584f9100000 pid=4345 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=456e5da1-1900-0000-eb95-f584f9100000 pid=4345 execve guuid=49e50aa2-1900-0000-eb95-f584fa100000 pid=4346 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=49e50aa2-1900-0000-eb95-f584fa100000 pid=4346 execve guuid=59c981a2-1900-0000-eb95-f584fe100000 pid=4350 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=59c981a2-1900-0000-eb95-f584fe100000 pid=4350 execve guuid=3a8b4ea3-1900-0000-eb95-f58401110000 pid=4353 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=3a8b4ea3-1900-0000-eb95-f58401110000 pid=4353 execve guuid=4d9cb0a3-1900-0000-eb95-f58403110000 pid=4355 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=4d9cb0a3-1900-0000-eb95-f58403110000 pid=4355 execve guuid=6a040ba4-1900-0000-eb95-f58406110000 pid=4358 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=6a040ba4-1900-0000-eb95-f58406110000 pid=4358 execve guuid=ef7576a4-1900-0000-eb95-f5840a110000 pid=4362 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=ef7576a4-1900-0000-eb95-f5840a110000 pid=4362 execve guuid=2c2c05a5-1900-0000-eb95-f5840e110000 pid=4366 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=2c2c05a5-1900-0000-eb95-f5840e110000 pid=4366 execve guuid=f5ab8ea5-1900-0000-eb95-f58410110000 pid=4368 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=f5ab8ea5-1900-0000-eb95-f58410110000 pid=4368 execve guuid=3a3106a6-1900-0000-eb95-f58413110000 pid=4371 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=3a3106a6-1900-0000-eb95-f58413110000 pid=4371 execve guuid=d41c8da6-1900-0000-eb95-f58416110000 pid=4374 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=d41c8da6-1900-0000-eb95-f58416110000 pid=4374 execve guuid=5ee118a7-1900-0000-eb95-f58418110000 pid=4376 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=5ee118a7-1900-0000-eb95-f58418110000 pid=4376 execve guuid=9eca95a7-1900-0000-eb95-f5841a110000 pid=4378 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=9eca95a7-1900-0000-eb95-f5841a110000 pid=4378 execve guuid=bdda0ea8-1900-0000-eb95-f5841e110000 pid=4382 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=bdda0ea8-1900-0000-eb95-f5841e110000 pid=4382 execve guuid=affcb0a8-1900-0000-eb95-f5841f110000 pid=4383 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=affcb0a8-1900-0000-eb95-f5841f110000 pid=4383 execve guuid=fa5644a9-1900-0000-eb95-f58421110000 pid=4385 /usr/bin/ls guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=fa5644a9-1900-0000-eb95-f58421110000 pid=4385 execve guuid=446e37aa-1900-0000-eb95-f58426110000 pid=4390 /usr/bin/rm guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=446e37aa-1900-0000-eb95-f58426110000 pid=4390 execve guuid=76989baa-1900-0000-eb95-f58428110000 pid=4392 /usr/bin/wget net send-data write-file guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=76989baa-1900-0000-eb95-f58428110000 pid=4392 execve guuid=e81c35c6-1900-0000-eb95-f58482110000 pid=4482 /usr/bin/chmod guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=e81c35c6-1900-0000-eb95-f58482110000 pid=4482 execve guuid=425fbdc6-1900-0000-eb95-f58483110000 pid=4483 /usr/bin/dash guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=425fbdc6-1900-0000-eb95-f58483110000 pid=4483 clone guuid=a7088ac7-1900-0000-eb95-f58488110000 pid=4488 /usr/bin/rm guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=a7088ac7-1900-0000-eb95-f58488110000 pid=4488 execve guuid=fef7e0c7-1900-0000-eb95-f58489110000 pid=4489 /usr/bin/wget net send-data write-file guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=fef7e0c7-1900-0000-eb95-f58489110000 pid=4489 execve guuid=b13591df-1900-0000-eb95-f584d6110000 pid=4566 /usr/bin/chmod guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=b13591df-1900-0000-eb95-f584d6110000 pid=4566 execve guuid=84e21ee0-1900-0000-eb95-f584d7110000 pid=4567 /usr/bin/dash guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=84e21ee0-1900-0000-eb95-f584d7110000 pid=4567 clone guuid=412ac4e0-1900-0000-eb95-f584da110000 pid=4570 /usr/bin/rm guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=412ac4e0-1900-0000-eb95-f584da110000 pid=4570 execve guuid=3e480ee1-1900-0000-eb95-f584dc110000 pid=4572 /usr/bin/wget net send-data write-file guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=3e480ee1-1900-0000-eb95-f584dc110000 pid=4572 execve guuid=bbcb0bff-1900-0000-eb95-f58445120000 pid=4677 /usr/bin/chmod guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=bbcb0bff-1900-0000-eb95-f58445120000 pid=4677 execve guuid=b83a4cff-1900-0000-eb95-f58447120000 pid=4679 /usr/bin/dash guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=b83a4cff-1900-0000-eb95-f58447120000 pid=4679 clone guuid=1ed1d9ff-1900-0000-eb95-f5844b120000 pid=4683 /usr/bin/rm guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=1ed1d9ff-1900-0000-eb95-f5844b120000 pid=4683 execve guuid=36611b00-1a00-0000-eb95-f5844d120000 pid=4685 /usr/bin/wget net send-data write-file guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=36611b00-1a00-0000-eb95-f5844d120000 pid=4685 execve guuid=27306f1f-1a00-0000-eb95-f58496120000 pid=4758 /usr/bin/chmod guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=27306f1f-1a00-0000-eb95-f58496120000 pid=4758 execve guuid=989dc61f-1a00-0000-eb95-f5849a120000 pid=4762 /usr/bin/dash guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=989dc61f-1a00-0000-eb95-f5849a120000 pid=4762 clone guuid=ddb79120-1a00-0000-eb95-f5849e120000 pid=4766 /usr/bin/rm guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=ddb79120-1a00-0000-eb95-f5849e120000 pid=4766 execve guuid=02dffb20-1a00-0000-eb95-f584a1120000 pid=4769 /usr/bin/wget net send-data write-file guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=02dffb20-1a00-0000-eb95-f584a1120000 pid=4769 execve guuid=cc8fad40-1a00-0000-eb95-f584cf120000 pid=4815 /usr/bin/chmod guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=cc8fad40-1a00-0000-eb95-f584cf120000 pid=4815 execve guuid=d7698541-1a00-0000-eb95-f584d0120000 pid=4816 /usr/bin/dash guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=d7698541-1a00-0000-eb95-f584d0120000 pid=4816 clone guuid=e6224742-1a00-0000-eb95-f584d2120000 pid=4818 /usr/bin/rm delete-file guuid=70d09a6a-1900-0000-eb95-f584d80f0000 pid=4056->guuid=e6224742-1a00-0000-eb95-f584d2120000 pid=4818 execve 801186e6-5fe8-5959-a7b4-832d8d66e7aa 129.121.114.124:80 guuid=76989baa-1900-0000-eb95-f58428110000 pid=4392->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 134B guuid=fef7e0c7-1900-0000-eb95-f58489110000 pid=4489->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 133B guuid=3e480ee1-1900-0000-eb95-f584dc110000 pid=4572->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 133B guuid=36611b00-1a00-0000-eb95-f5844d120000 pid=4685->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 133B guuid=02dffb20-1a00-0000-eb95-f584a1120000 pid=4769->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 134B
Score:
98%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/bcb93b961d7188b32745b05b700959ba49d5b05ea870d9eeed2e2db63e8b7575
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/bcb93b961d7188b32745b05b700959ba49d5b05ea870d9eeed2e2db63e8b7575/
Verdict:
Malicious
Threat:
Family.MIRAI
Link:
https://tip.neiki.dev/file/bcb93b961d7188b32745b05b700959ba49d5b05ea870d9eeed2e2db63e8b7575
Threat name:
Win32.Trojan.Vigorf
Create hunting rule
Status:
Malicious
First seen:
2026-07-04 01:28:59 UTC
File Type:
Text (Shell)
AV detection:
12 of 24 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xs4txfq5ogelgj2fwbnxackzxje5lmc6vbynt3xnfyw3mpulov2q._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
discovery linux
Link:
https://tria.ge/reports/260704-bv1hmsh18x/
Behaviour
Reads runtime system information
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.26
Link:
https://yomi.yoroi.company/submissions/bcb93b961d7188b32745b05b700959ba49d5b05ea870d9eeed2e2db63e8b7575

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh bcb93b961d7188b32745b05b700959ba49d5b05ea870d9eeed2e2db63e8b7575

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3874630/
  
Delivery method
Distributed via web download

Comments