MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 befe57fb3ee33e278f6a826918027ef3702c2cd2369bf0cb97d82f1b4513100c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: befe57fb3ee33e278f6a826918027ef3702c2cd2369bf0cb97d82f1b4513100c
SHA3-384 hash: 7b20555efce62f433e0320afa3ff0d97468ed0a51128c4db41f03865e5afac6603676393215c681eaac1835b52eb6a0c
SHA1 hash: e5090e3c4ce43eb9f150c1c273ef4bcee2e33677
MD5 hash: 6e8fc346dab3c754388ced103851e880
humanhash: cola-network-don-delaware
File name:lil
Download: download sample
File size:852 bytes
First seen:2026-07-14 12:56:45 UTC
Last seen:2026-07-14 23:01:23 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 24:kXCKysE2hi0ziQvZoha+j/60FRh3EtGN6WU0EX:e9Qp+Ms+b/f3E0dfEX
TLSH T11101AFCA8540A900429D9A6C22A75498F821C3CE1A460F25BFACAD7DEB84D14B02AFDC
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://129.121.114.124/8Gt6n/an/an/a
http://129.121.114.124/rGHqn/an/an/a
http://129.121.114.124/dvPin/an/an/a
http://129.121.114.124/ws7n/an/an/a
http://129.121.114.124/IZL0n/an/an/a

Intelligence

File Origin
# of uploads :
2
# of downloads :
60
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive
Link:
https://www.filescan.io/uploads/6a5632423c4622281e02518f/reports/042e40c5-1db2-4a35-8e46-df36355ee693/overview
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/44c4faf5-6008-4d59-8317-04808a3f1c51
Behavior Graph:
Download SVG
%3 guuid=4de93bdc-1e00-0000-65e4-075039140000 pid=5177 /usr/bin/sudo guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178 /tmp/sample.bin write-file guuid=4de93bdc-1e00-0000-65e4-075039140000 pid=5177->guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178 execve guuid=76cc9bdf-1e00-0000-65e4-07503b140000 pid=5179 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=76cc9bdf-1e00-0000-65e4-07503b140000 pid=5179 execve guuid=1e2e2fe0-1e00-0000-65e4-07503c140000 pid=5180 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=1e2e2fe0-1e00-0000-65e4-07503c140000 pid=5180 execve guuid=acb8ade0-1e00-0000-65e4-07503d140000 pid=5181 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=acb8ade0-1e00-0000-65e4-07503d140000 pid=5181 execve guuid=75ba21e1-1e00-0000-65e4-07503e140000 pid=5182 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=75ba21e1-1e00-0000-65e4-07503e140000 pid=5182 execve guuid=0ae79fe1-1e00-0000-65e4-07503f140000 pid=5183 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=0ae79fe1-1e00-0000-65e4-07503f140000 pid=5183 execve guuid=980022e2-1e00-0000-65e4-075040140000 pid=5184 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=980022e2-1e00-0000-65e4-075040140000 pid=5184 execve guuid=287bace2-1e00-0000-65e4-075041140000 pid=5185 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=287bace2-1e00-0000-65e4-075041140000 pid=5185 execve guuid=ea0333e3-1e00-0000-65e4-075042140000 pid=5186 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=ea0333e3-1e00-0000-65e4-075042140000 pid=5186 execve guuid=1fc4b1e3-1e00-0000-65e4-075043140000 pid=5187 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=1fc4b1e3-1e00-0000-65e4-075043140000 pid=5187 execve guuid=a4eafbe4-1e00-0000-65e4-075044140000 pid=5188 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=a4eafbe4-1e00-0000-65e4-075044140000 pid=5188 execve guuid=7409b1e5-1e00-0000-65e4-075045140000 pid=5189 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=7409b1e5-1e00-0000-65e4-075045140000 pid=5189 execve guuid=81da57e6-1e00-0000-65e4-075046140000 pid=5190 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=81da57e6-1e00-0000-65e4-075046140000 pid=5190 execve guuid=5a2319e7-1e00-0000-65e4-075047140000 pid=5191 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=5a2319e7-1e00-0000-65e4-075047140000 pid=5191 execve guuid=7b58c2e7-1e00-0000-65e4-075048140000 pid=5192 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=7b58c2e7-1e00-0000-65e4-075048140000 pid=5192 execve guuid=43b96ce8-1e00-0000-65e4-075049140000 pid=5193 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=43b96ce8-1e00-0000-65e4-075049140000 pid=5193 execve guuid=d1003fe9-1e00-0000-65e4-07504a140000 pid=5194 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=d1003fe9-1e00-0000-65e4-07504a140000 pid=5194 execve guuid=e93416ea-1e00-0000-65e4-07504b140000 pid=5195 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=e93416ea-1e00-0000-65e4-07504b140000 pid=5195 execve guuid=14e9dfea-1e00-0000-65e4-07504c140000 pid=5196 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=14e9dfea-1e00-0000-65e4-07504c140000 pid=5196 execve guuid=45fda5eb-1e00-0000-65e4-07504d140000 pid=5197 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=45fda5eb-1e00-0000-65e4-07504d140000 pid=5197 execve guuid=0c0b66ec-1e00-0000-65e4-07504e140000 pid=5198 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=0c0b66ec-1e00-0000-65e4-07504e140000 pid=5198 execve guuid=17591eed-1e00-0000-65e4-07504f140000 pid=5199 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=17591eed-1e00-0000-65e4-07504f140000 pid=5199 execve guuid=6976e6ed-1e00-0000-65e4-075050140000 pid=5200 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=6976e6ed-1e00-0000-65e4-075050140000 pid=5200 execve guuid=02939cee-1e00-0000-65e4-075051140000 pid=5201 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=02939cee-1e00-0000-65e4-075051140000 pid=5201 execve guuid=ef0d4cef-1e00-0000-65e4-075052140000 pid=5202 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=ef0d4cef-1e00-0000-65e4-075052140000 pid=5202 execve guuid=0bea0af0-1e00-0000-65e4-075053140000 pid=5203 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=0bea0af0-1e00-0000-65e4-075053140000 pid=5203 execve guuid=6df9a4f0-1e00-0000-65e4-075054140000 pid=5204 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=6df9a4f0-1e00-0000-65e4-075054140000 pid=5204 execve guuid=67cb1bf1-1e00-0000-65e4-075055140000 pid=5205 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=67cb1bf1-1e00-0000-65e4-075055140000 pid=5205 execve guuid=4f2bd8f1-1e00-0000-65e4-075056140000 pid=5206 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=4f2bd8f1-1e00-0000-65e4-075056140000 pid=5206 execve guuid=29725ff2-1e00-0000-65e4-075057140000 pid=5207 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=29725ff2-1e00-0000-65e4-075057140000 pid=5207 execve guuid=21894ff3-1e00-0000-65e4-075058140000 pid=5208 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=21894ff3-1e00-0000-65e4-075058140000 pid=5208 execve guuid=c8c7eff3-1e00-0000-65e4-075059140000 pid=5209 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=c8c7eff3-1e00-0000-65e4-075059140000 pid=5209 execve guuid=00c665f4-1e00-0000-65e4-07505a140000 pid=5210 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=00c665f4-1e00-0000-65e4-07505a140000 pid=5210 execve guuid=3604e1f4-1e00-0000-65e4-07505b140000 pid=5211 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=3604e1f4-1e00-0000-65e4-07505b140000 pid=5211 execve guuid=748aabf5-1e00-0000-65e4-07505c140000 pid=5212 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=748aabf5-1e00-0000-65e4-07505c140000 pid=5212 execve guuid=3efa67f6-1e00-0000-65e4-07505d140000 pid=5213 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=3efa67f6-1e00-0000-65e4-07505d140000 pid=5213 execve guuid=c99b20f7-1e00-0000-65e4-07505e140000 pid=5214 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=c99b20f7-1e00-0000-65e4-07505e140000 pid=5214 execve guuid=2578d6f7-1e00-0000-65e4-07505f140000 pid=5215 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=2578d6f7-1e00-0000-65e4-07505f140000 pid=5215 execve guuid=487e95f8-1e00-0000-65e4-075060140000 pid=5216 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=487e95f8-1e00-0000-65e4-075060140000 pid=5216 execve guuid=3e0158f9-1e00-0000-65e4-075061140000 pid=5217 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=3e0158f9-1e00-0000-65e4-075061140000 pid=5217 execve guuid=c85031fa-1e00-0000-65e4-075062140000 pid=5218 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=c85031fa-1e00-0000-65e4-075062140000 pid=5218 execve guuid=1c32f5fa-1e00-0000-65e4-075063140000 pid=5219 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=1c32f5fa-1e00-0000-65e4-075063140000 pid=5219 execve guuid=0879c1fb-1e00-0000-65e4-075064140000 pid=5220 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=0879c1fb-1e00-0000-65e4-075064140000 pid=5220 execve guuid=04938afc-1e00-0000-65e4-075065140000 pid=5221 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=04938afc-1e00-0000-65e4-075065140000 pid=5221 execve guuid=53b440fd-1e00-0000-65e4-075066140000 pid=5222 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=53b440fd-1e00-0000-65e4-075066140000 pid=5222 execve guuid=58d317fe-1e00-0000-65e4-075067140000 pid=5223 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=58d317fe-1e00-0000-65e4-075067140000 pid=5223 execve guuid=97b2eefe-1e00-0000-65e4-075068140000 pid=5224 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=97b2eefe-1e00-0000-65e4-075068140000 pid=5224 execve guuid=c221cbff-1e00-0000-65e4-075069140000 pid=5225 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=c221cbff-1e00-0000-65e4-075069140000 pid=5225 execve guuid=d51ca700-1f00-0000-65e4-07506a140000 pid=5226 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=d51ca700-1f00-0000-65e4-07506a140000 pid=5226 execve guuid=fa429101-1f00-0000-65e4-07506b140000 pid=5227 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=fa429101-1f00-0000-65e4-07506b140000 pid=5227 execve guuid=4de85802-1f00-0000-65e4-07506c140000 pid=5228 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=4de85802-1f00-0000-65e4-07506c140000 pid=5228 execve guuid=bed41003-1f00-0000-65e4-07506d140000 pid=5229 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=bed41003-1f00-0000-65e4-07506d140000 pid=5229 execve guuid=1309db03-1f00-0000-65e4-07506e140000 pid=5230 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=1309db03-1f00-0000-65e4-07506e140000 pid=5230 execve guuid=5a96a604-1f00-0000-65e4-07506f140000 pid=5231 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=5a96a604-1f00-0000-65e4-07506f140000 pid=5231 execve guuid=1a2d6005-1f00-0000-65e4-075070140000 pid=5232 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=1a2d6005-1f00-0000-65e4-075070140000 pid=5232 execve guuid=9d8b3306-1f00-0000-65e4-075071140000 pid=5233 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=9d8b3306-1f00-0000-65e4-075071140000 pid=5233 execve guuid=53630007-1f00-0000-65e4-075072140000 pid=5234 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=53630007-1f00-0000-65e4-075072140000 pid=5234 execve guuid=eaabc307-1f00-0000-65e4-075073140000 pid=5235 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=eaabc307-1f00-0000-65e4-075073140000 pid=5235 execve guuid=deb37e08-1f00-0000-65e4-075074140000 pid=5236 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=deb37e08-1f00-0000-65e4-075074140000 pid=5236 execve guuid=eeeb4609-1f00-0000-65e4-075075140000 pid=5237 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=eeeb4609-1f00-0000-65e4-075075140000 pid=5237 execve guuid=a127170a-1f00-0000-65e4-075076140000 pid=5238 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=a127170a-1f00-0000-65e4-075076140000 pid=5238 execve guuid=3722e60a-1f00-0000-65e4-075077140000 pid=5239 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=3722e60a-1f00-0000-65e4-075077140000 pid=5239 execve guuid=f671a60b-1f00-0000-65e4-075078140000 pid=5240 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=f671a60b-1f00-0000-65e4-075078140000 pid=5240 execve guuid=b23e6a0c-1f00-0000-65e4-075079140000 pid=5241 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=b23e6a0c-1f00-0000-65e4-075079140000 pid=5241 execve guuid=f9571d0d-1f00-0000-65e4-07507a140000 pid=5242 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=f9571d0d-1f00-0000-65e4-07507a140000 pid=5242 execve guuid=7021ee0d-1f00-0000-65e4-07507b140000 pid=5243 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=7021ee0d-1f00-0000-65e4-07507b140000 pid=5243 execve guuid=fbbd9f0e-1f00-0000-65e4-07507c140000 pid=5244 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=fbbd9f0e-1f00-0000-65e4-07507c140000 pid=5244 execve guuid=e5444b0f-1f00-0000-65e4-07507d140000 pid=5245 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=e5444b0f-1f00-0000-65e4-07507d140000 pid=5245 execve guuid=df34ff0f-1f00-0000-65e4-07507e140000 pid=5246 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=df34ff0f-1f00-0000-65e4-07507e140000 pid=5246 execve guuid=04999810-1f00-0000-65e4-07507f140000 pid=5247 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=04999810-1f00-0000-65e4-07507f140000 pid=5247 execve guuid=3b694d11-1f00-0000-65e4-075080140000 pid=5248 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=3b694d11-1f00-0000-65e4-075080140000 pid=5248 execve guuid=e7323412-1f00-0000-65e4-075081140000 pid=5249 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=e7323412-1f00-0000-65e4-075081140000 pid=5249 execve guuid=29b30113-1f00-0000-65e4-075082140000 pid=5250 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=29b30113-1f00-0000-65e4-075082140000 pid=5250 execve guuid=8004df13-1f00-0000-65e4-075083140000 pid=5251 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=8004df13-1f00-0000-65e4-075083140000 pid=5251 execve guuid=2f675714-1f00-0000-65e4-075084140000 pid=5252 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=2f675714-1f00-0000-65e4-075084140000 pid=5252 execve guuid=90544a15-1f00-0000-65e4-075085140000 pid=5253 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=90544a15-1f00-0000-65e4-075085140000 pid=5253 execve guuid=ccffd415-1f00-0000-65e4-075086140000 pid=5254 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=ccffd415-1f00-0000-65e4-075086140000 pid=5254 execve guuid=379f6c16-1f00-0000-65e4-075087140000 pid=5255 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=379f6c16-1f00-0000-65e4-075087140000 pid=5255 execve guuid=77200817-1f00-0000-65e4-075088140000 pid=5256 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=77200817-1f00-0000-65e4-075088140000 pid=5256 execve guuid=9d0cd217-1f00-0000-65e4-075089140000 pid=5257 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=9d0cd217-1f00-0000-65e4-075089140000 pid=5257 execve guuid=5e867418-1f00-0000-65e4-07508a140000 pid=5258 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=5e867418-1f00-0000-65e4-07508a140000 pid=5258 execve guuid=c067e618-1f00-0000-65e4-07508b140000 pid=5259 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=c067e618-1f00-0000-65e4-07508b140000 pid=5259 execve guuid=26b15c19-1f00-0000-65e4-07508c140000 pid=5260 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=26b15c19-1f00-0000-65e4-07508c140000 pid=5260 execve guuid=aaccdf19-1f00-0000-65e4-07508d140000 pid=5261 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=aaccdf19-1f00-0000-65e4-07508d140000 pid=5261 execve guuid=15d6511a-1f00-0000-65e4-07508e140000 pid=5262 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=15d6511a-1f00-0000-65e4-07508e140000 pid=5262 execve guuid=1827be1a-1f00-0000-65e4-07508f140000 pid=5263 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=1827be1a-1f00-0000-65e4-07508f140000 pid=5263 execve guuid=30dd271b-1f00-0000-65e4-075090140000 pid=5264 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=30dd271b-1f00-0000-65e4-075090140000 pid=5264 execve guuid=4cbbb21b-1f00-0000-65e4-075091140000 pid=5265 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=4cbbb21b-1f00-0000-65e4-075091140000 pid=5265 execve guuid=67b11c1c-1f00-0000-65e4-075092140000 pid=5266 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=67b11c1c-1f00-0000-65e4-075092140000 pid=5266 execve guuid=f59a931c-1f00-0000-65e4-075093140000 pid=5267 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=f59a931c-1f00-0000-65e4-075093140000 pid=5267 execve guuid=23bf021d-1f00-0000-65e4-075094140000 pid=5268 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=23bf021d-1f00-0000-65e4-075094140000 pid=5268 execve guuid=9cf07f1d-1f00-0000-65e4-075095140000 pid=5269 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=9cf07f1d-1f00-0000-65e4-075095140000 pid=5269 execve guuid=ff53ec1d-1f00-0000-65e4-075096140000 pid=5270 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=ff53ec1d-1f00-0000-65e4-075096140000 pid=5270 execve guuid=0af05c1e-1f00-0000-65e4-075097140000 pid=5271 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=0af05c1e-1f00-0000-65e4-075097140000 pid=5271 execve guuid=7dbdd71e-1f00-0000-65e4-075098140000 pid=5272 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=7dbdd71e-1f00-0000-65e4-075098140000 pid=5272 execve guuid=980e641f-1f00-0000-65e4-075099140000 pid=5273 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=980e641f-1f00-0000-65e4-075099140000 pid=5273 execve guuid=76e9cc1f-1f00-0000-65e4-07509a140000 pid=5274 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=76e9cc1f-1f00-0000-65e4-07509a140000 pid=5274 execve guuid=a20a3520-1f00-0000-65e4-07509b140000 pid=5275 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=a20a3520-1f00-0000-65e4-07509b140000 pid=5275 execve guuid=3a429820-1f00-0000-65e4-07509c140000 pid=5276 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=3a429820-1f00-0000-65e4-07509c140000 pid=5276 execve guuid=b0a21e21-1f00-0000-65e4-07509d140000 pid=5277 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=b0a21e21-1f00-0000-65e4-07509d140000 pid=5277 execve guuid=caf2a621-1f00-0000-65e4-07509e140000 pid=5278 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=caf2a621-1f00-0000-65e4-07509e140000 pid=5278 execve guuid=03052d22-1f00-0000-65e4-07509f140000 pid=5279 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=03052d22-1f00-0000-65e4-07509f140000 pid=5279 execve guuid=5694ab22-1f00-0000-65e4-0750a0140000 pid=5280 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=5694ab22-1f00-0000-65e4-0750a0140000 pid=5280 execve guuid=e75a2623-1f00-0000-65e4-0750a1140000 pid=5281 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=e75a2623-1f00-0000-65e4-0750a1140000 pid=5281 execve guuid=9dbc9623-1f00-0000-65e4-0750a2140000 pid=5282 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=9dbc9623-1f00-0000-65e4-0750a2140000 pid=5282 execve guuid=99350a24-1f00-0000-65e4-0750a3140000 pid=5283 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=99350a24-1f00-0000-65e4-0750a3140000 pid=5283 execve guuid=b8899a24-1f00-0000-65e4-0750a4140000 pid=5284 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=b8899a24-1f00-0000-65e4-0750a4140000 pid=5284 execve guuid=a2f63625-1f00-0000-65e4-0750a5140000 pid=5285 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=a2f63625-1f00-0000-65e4-0750a5140000 pid=5285 execve guuid=e192db25-1f00-0000-65e4-0750a6140000 pid=5286 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=e192db25-1f00-0000-65e4-0750a6140000 pid=5286 execve guuid=8c2b7a26-1f00-0000-65e4-0750a7140000 pid=5287 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=8c2b7a26-1f00-0000-65e4-0750a7140000 pid=5287 execve guuid=80cdeb26-1f00-0000-65e4-0750a8140000 pid=5288 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=80cdeb26-1f00-0000-65e4-0750a8140000 pid=5288 execve guuid=af9ba327-1f00-0000-65e4-0750a9140000 pid=5289 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=af9ba327-1f00-0000-65e4-0750a9140000 pid=5289 execve guuid=ab355a28-1f00-0000-65e4-0750aa140000 pid=5290 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=ab355a28-1f00-0000-65e4-0750aa140000 pid=5290 execve guuid=0e202729-1f00-0000-65e4-0750ab140000 pid=5291 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=0e202729-1f00-0000-65e4-0750ab140000 pid=5291 execve guuid=2880f129-1f00-0000-65e4-0750ac140000 pid=5292 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=2880f129-1f00-0000-65e4-0750ac140000 pid=5292 execve guuid=3760bc2a-1f00-0000-65e4-0750ad140000 pid=5293 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=3760bc2a-1f00-0000-65e4-0750ad140000 pid=5293 execve guuid=5d50782b-1f00-0000-65e4-0750ae140000 pid=5294 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=5d50782b-1f00-0000-65e4-0750ae140000 pid=5294 execve guuid=2182172c-1f00-0000-65e4-0750af140000 pid=5295 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=2182172c-1f00-0000-65e4-0750af140000 pid=5295 execve guuid=e2b6a22c-1f00-0000-65e4-0750b0140000 pid=5296 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=e2b6a22c-1f00-0000-65e4-0750b0140000 pid=5296 execve guuid=1e6f362d-1f00-0000-65e4-0750b1140000 pid=5297 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=1e6f362d-1f00-0000-65e4-0750b1140000 pid=5297 execve guuid=883cf62d-1f00-0000-65e4-0750b2140000 pid=5298 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=883cf62d-1f00-0000-65e4-0750b2140000 pid=5298 execve guuid=313b982e-1f00-0000-65e4-0750b3140000 pid=5299 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=313b982e-1f00-0000-65e4-0750b3140000 pid=5299 execve guuid=9e58492f-1f00-0000-65e4-0750b4140000 pid=5300 /usr/bin/ls guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=9e58492f-1f00-0000-65e4-0750b4140000 pid=5300 execve guuid=6eb1fb2f-1f00-0000-65e4-0750b5140000 pid=5301 /usr/bin/rm guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=6eb1fb2f-1f00-0000-65e4-0750b5140000 pid=5301 execve guuid=d8f07630-1f00-0000-65e4-0750b6140000 pid=5302 /usr/bin/wget net send-data write-file guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=d8f07630-1f00-0000-65e4-0750b6140000 pid=5302 execve guuid=9ab0d84c-1f00-0000-65e4-0750b7140000 pid=5303 /usr/bin/chmod guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=9ab0d84c-1f00-0000-65e4-0750b7140000 pid=5303 execve guuid=56684e4d-1f00-0000-65e4-0750b8140000 pid=5304 /usr/bin/dash guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=56684e4d-1f00-0000-65e4-0750b8140000 pid=5304 clone guuid=f6d15e4e-1f00-0000-65e4-0750ba140000 pid=5306 /usr/bin/rm guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=f6d15e4e-1f00-0000-65e4-0750ba140000 pid=5306 execve guuid=ddc3b44e-1f00-0000-65e4-0750bb140000 pid=5307 /usr/bin/wget net send-data write-file guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=ddc3b44e-1f00-0000-65e4-0750bb140000 pid=5307 execve guuid=9a28fe66-1f00-0000-65e4-0750bc140000 pid=5308 /usr/bin/chmod guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=9a28fe66-1f00-0000-65e4-0750bc140000 pid=5308 execve guuid=b5c37667-1f00-0000-65e4-0750bd140000 pid=5309 /usr/bin/dash guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=b5c37667-1f00-0000-65e4-0750bd140000 pid=5309 clone guuid=81840f68-1f00-0000-65e4-0750bf140000 pid=5311 /usr/bin/rm guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=81840f68-1f00-0000-65e4-0750bf140000 pid=5311 execve guuid=3d6e5968-1f00-0000-65e4-0750c0140000 pid=5312 /usr/bin/wget net send-data write-file guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=3d6e5968-1f00-0000-65e4-0750c0140000 pid=5312 execve guuid=8dddbf81-1f00-0000-65e4-0750c1140000 pid=5313 /usr/bin/chmod guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=8dddbf81-1f00-0000-65e4-0750c1140000 pid=5313 execve guuid=4abe0c82-1f00-0000-65e4-0750c2140000 pid=5314 /usr/bin/dash guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=4abe0c82-1f00-0000-65e4-0750c2140000 pid=5314 clone guuid=c17c1084-1f00-0000-65e4-0750c4140000 pid=5316 /usr/bin/rm guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=c17c1084-1f00-0000-65e4-0750c4140000 pid=5316 execve guuid=16585884-1f00-0000-65e4-0750c5140000 pid=5317 /usr/bin/wget net send-data write-file guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=16585884-1f00-0000-65e4-0750c5140000 pid=5317 execve guuid=13fe3d9c-1f00-0000-65e4-0750c6140000 pid=5318 /usr/bin/chmod guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=13fe3d9c-1f00-0000-65e4-0750c6140000 pid=5318 execve guuid=6709879c-1f00-0000-65e4-0750c7140000 pid=5319 /usr/bin/dash guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=6709879c-1f00-0000-65e4-0750c7140000 pid=5319 clone guuid=08a6249d-1f00-0000-65e4-0750c9140000 pid=5321 /usr/bin/rm guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=08a6249d-1f00-0000-65e4-0750c9140000 pid=5321 execve guuid=5c1c6b9d-1f00-0000-65e4-0750ca140000 pid=5322 /usr/bin/wget net send-data write-file guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=5c1c6b9d-1f00-0000-65e4-0750ca140000 pid=5322 execve guuid=82282db5-1f00-0000-65e4-0750d2140000 pid=5330 /usr/bin/chmod guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=82282db5-1f00-0000-65e4-0750d2140000 pid=5330 execve guuid=507c84b5-1f00-0000-65e4-0750d3140000 pid=5331 /usr/bin/dash guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=507c84b5-1f00-0000-65e4-0750d3140000 pid=5331 clone guuid=7a7fbfb6-1f00-0000-65e4-0750d5140000 pid=5333 /usr/bin/rm delete-file guuid=3b14efde-1e00-0000-65e4-07503a140000 pid=5178->guuid=7a7fbfb6-1f00-0000-65e4-0750d5140000 pid=5333 execve 801186e6-5fe8-5959-a7b4-832d8d66e7aa 129.121.114.124:80 guuid=d8f07630-1f00-0000-65e4-0750b6140000 pid=5302->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 134B guuid=ddc3b44e-1f00-0000-65e4-0750bb140000 pid=5307->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 134B guuid=3d6e5968-1f00-0000-65e4-0750c0140000 pid=5312->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 134B guuid=16585884-1f00-0000-65e4-0750c5140000 pid=5317->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 133B guuid=5c1c6b9d-1f00-0000-65e4-0750ca140000 pid=5322->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 134B
Score:
97%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/befe57fb3ee33e278f6a826918027ef3702c2cd2369bf0cb97d82f1b4513100c
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/befe57fb3ee33e278f6a826918027ef3702c2cd2369bf0cb97d82f1b4513100c/
Threat name:
Document-HTML.Downloader.Bash
Create hunting rule
Status:
Malicious
First seen:
2026-07-14 12:58:29 UTC
File Type:
Text (Shell)
AV detection:
9 of 36 (25.00%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=x37fp6z64m7cpd3kqjurqat66nycylgsg2n7bs4x3axrwritcaga._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
discovery linux
Link:
https://tria.ge/reports/260714-p67yradt9m/
Behaviour
Reads runtime system information
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.26
Link:
https://yomi.yoroi.company/submissions/befe57fb3ee33e278f6a826918027ef3702c2cd2369bf0cb97d82f1b4513100c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh befe57fb3ee33e278f6a826918027ef3702c2cd2369bf0cb97d82f1b4513100c

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3874630/
  
Delivery method
Distributed via web download

Comments