MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d3c060e3dfaa2fdca0d8aa47913e9772c81525148aa6d9f5d443ec4f24ef9877. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d3c060e3dfaa2fdca0d8aa47913e9772c81525148aa6d9f5d443ec4f24ef9877
SHA3-384 hash: 2903f04de1f9e1d021e1e0e7a8ef8d9b5a69f6f0bd790dc0e8814dc64baec41d86fef22666caf4ebeb2a4215b5155d4c
SHA1 hash: c2401bdc4f40ac34a7e6d9dca577fe9b8aa715b6
MD5 hash: d33ce2e4961f58136588ff6c5c9aa76c
humanhash: black-three-vermont-bacon
File name:lil
Download: download sample
File size:844 bytes
First seen:2026-08-05 14:18:49 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 24:kXCKysE2hi0ziQvZohaeLvICp6ikBprOlYX:e9Qp+MseLvICp6xBprOaX
TLSH T17E01AFCA8040AC105099A96C22975594F820C3CF25964BA5FFBC6D7EEB94C14B0B6F98
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://129.121.114.124/Lxkn/an/aua-wget
http://129.121.114.124/ZmUn/an/aua-wget
http://129.121.114.124/dzQan/an/aua-wget
http://129.121.114.124/KX8n/an/aua-wget
http://129.121.114.124/lWaCn/an/aua-wget

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive
Link:
https://www.filescan.io/uploads/6a73466e65cf2cf15c6b5c21/reports/5f01a988-c0f6-4526-be1d-1a3d45319573/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-08-05T11:40:00Z UTC
Last seen:
2026-08-05T12:54:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/d3c060e3dfaa2fdca0d8aa47913e9772c81525148aa6d9f5d443ec4f24ef9877/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/289f9c20-4873-4003-84ce-5fb3a416a25a
Behavior Graph:
Download SVG
%3 guuid=0cb64d15-1b00-0000-baff-b0bae4080000 pid=2276 /usr/bin/sudo guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280 /tmp/sample.bin write-file guuid=0cb64d15-1b00-0000-baff-b0bae4080000 pid=2276->guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280 execve guuid=ba9eee19-1b00-0000-baff-b0bae9080000 pid=2281 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=ba9eee19-1b00-0000-baff-b0bae9080000 pid=2281 execve guuid=444a891b-1b00-0000-baff-b0baea080000 pid=2282 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=444a891b-1b00-0000-baff-b0baea080000 pid=2282 execve guuid=67ea581c-1b00-0000-baff-b0baeb080000 pid=2283 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=67ea581c-1b00-0000-baff-b0baeb080000 pid=2283 execve guuid=c85b061d-1b00-0000-baff-b0baed080000 pid=2285 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=c85b061d-1b00-0000-baff-b0baed080000 pid=2285 execve guuid=85bea81d-1b00-0000-baff-b0baef080000 pid=2287 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=85bea81d-1b00-0000-baff-b0baef080000 pid=2287 execve guuid=6ee8351e-1b00-0000-baff-b0baf1080000 pid=2289 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=6ee8351e-1b00-0000-baff-b0baf1080000 pid=2289 execve guuid=9685db1e-1b00-0000-baff-b0baf3080000 pid=2291 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=9685db1e-1b00-0000-baff-b0baf3080000 pid=2291 execve guuid=f1aa561f-1b00-0000-baff-b0baf5080000 pid=2293 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=f1aa561f-1b00-0000-baff-b0baf5080000 pid=2293 execve guuid=7ac6bf1f-1b00-0000-baff-b0baf7080000 pid=2295 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=7ac6bf1f-1b00-0000-baff-b0baf7080000 pid=2295 execve guuid=91102520-1b00-0000-baff-b0baf9080000 pid=2297 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=91102520-1b00-0000-baff-b0baf9080000 pid=2297 execve guuid=16a18520-1b00-0000-baff-b0bafb080000 pid=2299 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=16a18520-1b00-0000-baff-b0bafb080000 pid=2299 execve guuid=55f4f220-1b00-0000-baff-b0bafd080000 pid=2301 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=55f4f220-1b00-0000-baff-b0bafd080000 pid=2301 execve guuid=68316d21-1b00-0000-baff-b0bafe080000 pid=2302 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=68316d21-1b00-0000-baff-b0bafe080000 pid=2302 execve guuid=03e9e121-1b00-0000-baff-b0baff080000 pid=2303 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=03e9e121-1b00-0000-baff-b0baff080000 pid=2303 execve guuid=1a777022-1b00-0000-baff-b0ba00090000 pid=2304 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=1a777022-1b00-0000-baff-b0ba00090000 pid=2304 execve guuid=f1aa1223-1b00-0000-baff-b0ba01090000 pid=2305 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=f1aa1223-1b00-0000-baff-b0ba01090000 pid=2305 execve guuid=2ddb7623-1b00-0000-baff-b0ba03090000 pid=2307 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=2ddb7623-1b00-0000-baff-b0ba03090000 pid=2307 execve guuid=955eef23-1b00-0000-baff-b0ba04090000 pid=2308 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=955eef23-1b00-0000-baff-b0ba04090000 pid=2308 execve guuid=147ea224-1b00-0000-baff-b0ba05090000 pid=2309 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=147ea224-1b00-0000-baff-b0ba05090000 pid=2309 execve guuid=df9f8525-1b00-0000-baff-b0ba06090000 pid=2310 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=df9f8525-1b00-0000-baff-b0ba06090000 pid=2310 execve guuid=71c43c26-1b00-0000-baff-b0ba08090000 pid=2312 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=71c43c26-1b00-0000-baff-b0ba08090000 pid=2312 execve guuid=6515d726-1b00-0000-baff-b0ba0a090000 pid=2314 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=6515d726-1b00-0000-baff-b0ba0a090000 pid=2314 execve guuid=f5718c27-1b00-0000-baff-b0ba0d090000 pid=2317 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=f5718c27-1b00-0000-baff-b0ba0d090000 pid=2317 execve guuid=6f6edf28-1b00-0000-baff-b0ba0f090000 pid=2319 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=6f6edf28-1b00-0000-baff-b0ba0f090000 pid=2319 execve guuid=1afc9729-1b00-0000-baff-b0ba11090000 pid=2321 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=1afc9729-1b00-0000-baff-b0ba11090000 pid=2321 execve guuid=12064b2a-1b00-0000-baff-b0ba13090000 pid=2323 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=12064b2a-1b00-0000-baff-b0ba13090000 pid=2323 execve guuid=47f6f22a-1b00-0000-baff-b0ba16090000 pid=2326 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=47f6f22a-1b00-0000-baff-b0ba16090000 pid=2326 execve guuid=78cd962b-1b00-0000-baff-b0ba18090000 pid=2328 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=78cd962b-1b00-0000-baff-b0ba18090000 pid=2328 execve guuid=8b785c2c-1b00-0000-baff-b0ba1a090000 pid=2330 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=8b785c2c-1b00-0000-baff-b0ba1a090000 pid=2330 execve guuid=70cd2a2d-1b00-0000-baff-b0ba1b090000 pid=2331 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=70cd2a2d-1b00-0000-baff-b0ba1b090000 pid=2331 execve guuid=74c6132e-1b00-0000-baff-b0ba1c090000 pid=2332 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=74c6132e-1b00-0000-baff-b0ba1c090000 pid=2332 execve guuid=e661dd2e-1b00-0000-baff-b0ba1e090000 pid=2334 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=e661dd2e-1b00-0000-baff-b0ba1e090000 pid=2334 execve guuid=c70d6d2f-1b00-0000-baff-b0ba20090000 pid=2336 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=c70d6d2f-1b00-0000-baff-b0ba20090000 pid=2336 execve guuid=6b5d1430-1b00-0000-baff-b0ba22090000 pid=2338 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=6b5d1430-1b00-0000-baff-b0ba22090000 pid=2338 execve guuid=da8ebd30-1b00-0000-baff-b0ba25090000 pid=2341 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=da8ebd30-1b00-0000-baff-b0ba25090000 pid=2341 execve guuid=94586d31-1b00-0000-baff-b0ba27090000 pid=2343 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=94586d31-1b00-0000-baff-b0ba27090000 pid=2343 execve guuid=b7cb1632-1b00-0000-baff-b0ba29090000 pid=2345 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=b7cb1632-1b00-0000-baff-b0ba29090000 pid=2345 execve guuid=3e569d32-1b00-0000-baff-b0ba2b090000 pid=2347 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=3e569d32-1b00-0000-baff-b0ba2b090000 pid=2347 execve guuid=37a11a33-1b00-0000-baff-b0ba2d090000 pid=2349 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=37a11a33-1b00-0000-baff-b0ba2d090000 pid=2349 execve guuid=c8e29833-1b00-0000-baff-b0ba2e090000 pid=2350 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=c8e29833-1b00-0000-baff-b0ba2e090000 pid=2350 execve guuid=07b54634-1b00-0000-baff-b0ba2f090000 pid=2351 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=07b54634-1b00-0000-baff-b0ba2f090000 pid=2351 execve guuid=efbad334-1b00-0000-baff-b0ba32090000 pid=2354 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=efbad334-1b00-0000-baff-b0ba32090000 pid=2354 execve guuid=c3d77d35-1b00-0000-baff-b0ba34090000 pid=2356 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=c3d77d35-1b00-0000-baff-b0ba34090000 pid=2356 execve guuid=59d41736-1b00-0000-baff-b0ba36090000 pid=2358 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=59d41736-1b00-0000-baff-b0ba36090000 pid=2358 execve guuid=28daac36-1b00-0000-baff-b0ba38090000 pid=2360 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=28daac36-1b00-0000-baff-b0ba38090000 pid=2360 execve guuid=3c035437-1b00-0000-baff-b0ba3b090000 pid=2363 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=3c035437-1b00-0000-baff-b0ba3b090000 pid=2363 execve guuid=02f1dc37-1b00-0000-baff-b0ba3d090000 pid=2365 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=02f1dc37-1b00-0000-baff-b0ba3d090000 pid=2365 execve guuid=d3298838-1b00-0000-baff-b0ba40090000 pid=2368 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=d3298838-1b00-0000-baff-b0ba40090000 pid=2368 execve guuid=a9282439-1b00-0000-baff-b0ba42090000 pid=2370 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=a9282439-1b00-0000-baff-b0ba42090000 pid=2370 execve guuid=0402033a-1b00-0000-baff-b0ba44090000 pid=2372 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=0402033a-1b00-0000-baff-b0ba44090000 pid=2372 execve guuid=4c62cd3a-1b00-0000-baff-b0ba47090000 pid=2375 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=4c62cd3a-1b00-0000-baff-b0ba47090000 pid=2375 execve guuid=80a57a3b-1b00-0000-baff-b0ba49090000 pid=2377 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=80a57a3b-1b00-0000-baff-b0ba49090000 pid=2377 execve guuid=4fad243c-1b00-0000-baff-b0ba4b090000 pid=2379 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=4fad243c-1b00-0000-baff-b0ba4b090000 pid=2379 execve guuid=9fb2c73c-1b00-0000-baff-b0ba4e090000 pid=2382 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=9fb2c73c-1b00-0000-baff-b0ba4e090000 pid=2382 execve guuid=578eb13d-1b00-0000-baff-b0ba4f090000 pid=2383 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=578eb13d-1b00-0000-baff-b0ba4f090000 pid=2383 execve guuid=ce09643e-1b00-0000-baff-b0ba50090000 pid=2384 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=ce09643e-1b00-0000-baff-b0ba50090000 pid=2384 execve guuid=544e1c3f-1b00-0000-baff-b0ba51090000 pid=2385 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=544e1c3f-1b00-0000-baff-b0ba51090000 pid=2385 execve guuid=732e0140-1b00-0000-baff-b0ba52090000 pid=2386 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=732e0140-1b00-0000-baff-b0ba52090000 pid=2386 execve guuid=18f8a840-1b00-0000-baff-b0ba53090000 pid=2387 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=18f8a840-1b00-0000-baff-b0ba53090000 pid=2387 execve guuid=ebdd7741-1b00-0000-baff-b0ba55090000 pid=2389 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=ebdd7741-1b00-0000-baff-b0ba55090000 pid=2389 execve guuid=f9804442-1b00-0000-baff-b0ba56090000 pid=2390 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=f9804442-1b00-0000-baff-b0ba56090000 pid=2390 execve guuid=30233743-1b00-0000-baff-b0ba59090000 pid=2393 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=30233743-1b00-0000-baff-b0ba59090000 pid=2393 execve guuid=2ad0df43-1b00-0000-baff-b0ba5b090000 pid=2395 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=2ad0df43-1b00-0000-baff-b0ba5b090000 pid=2395 execve guuid=bc9e8844-1b00-0000-baff-b0ba5d090000 pid=2397 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=bc9e8844-1b00-0000-baff-b0ba5d090000 pid=2397 execve guuid=cb3f4745-1b00-0000-baff-b0ba5e090000 pid=2398 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=cb3f4745-1b00-0000-baff-b0ba5e090000 pid=2398 execve guuid=bf8fe545-1b00-0000-baff-b0ba61090000 pid=2401 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=bf8fe545-1b00-0000-baff-b0ba61090000 pid=2401 execve guuid=936f9146-1b00-0000-baff-b0ba63090000 pid=2403 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=936f9146-1b00-0000-baff-b0ba63090000 pid=2403 execve guuid=9ff95a47-1b00-0000-baff-b0ba66090000 pid=2406 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=9ff95a47-1b00-0000-baff-b0ba66090000 pid=2406 execve guuid=388d0748-1b00-0000-baff-b0ba68090000 pid=2408 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=388d0748-1b00-0000-baff-b0ba68090000 pid=2408 execve guuid=4b20a848-1b00-0000-baff-b0ba69090000 pid=2409 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=4b20a848-1b00-0000-baff-b0ba69090000 pid=2409 execve guuid=3b5ba24a-1b00-0000-baff-b0ba6a090000 pid=2410 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=3b5ba24a-1b00-0000-baff-b0ba6a090000 pid=2410 execve guuid=4a5a894b-1b00-0000-baff-b0ba6c090000 pid=2412 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=4a5a894b-1b00-0000-baff-b0ba6c090000 pid=2412 execve guuid=d7bf684c-1b00-0000-baff-b0ba6d090000 pid=2413 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=d7bf684c-1b00-0000-baff-b0ba6d090000 pid=2413 execve guuid=0d03334d-1b00-0000-baff-b0ba6e090000 pid=2414 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=0d03334d-1b00-0000-baff-b0ba6e090000 pid=2414 execve guuid=18b5f54d-1b00-0000-baff-b0ba70090000 pid=2416 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=18b5f54d-1b00-0000-baff-b0ba70090000 pid=2416 execve guuid=28ba994e-1b00-0000-baff-b0ba72090000 pid=2418 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=28ba994e-1b00-0000-baff-b0ba72090000 pid=2418 execve guuid=8a453d50-1b00-0000-baff-b0ba74090000 pid=2420 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=8a453d50-1b00-0000-baff-b0ba74090000 pid=2420 execve guuid=204a2251-1b00-0000-baff-b0ba77090000 pid=2423 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=204a2251-1b00-0000-baff-b0ba77090000 pid=2423 execve guuid=e450f151-1b00-0000-baff-b0ba79090000 pid=2425 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=e450f151-1b00-0000-baff-b0ba79090000 pid=2425 execve guuid=178fe252-1b00-0000-baff-b0ba7b090000 pid=2427 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=178fe252-1b00-0000-baff-b0ba7b090000 pid=2427 execve guuid=7ac68c54-1b00-0000-baff-b0ba7d090000 pid=2429 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=7ac68c54-1b00-0000-baff-b0ba7d090000 pid=2429 execve guuid=49671f56-1b00-0000-baff-b0ba80090000 pid=2432 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=49671f56-1b00-0000-baff-b0ba80090000 pid=2432 execve guuid=141d1457-1b00-0000-baff-b0ba81090000 pid=2433 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=141d1457-1b00-0000-baff-b0ba81090000 pid=2433 execve guuid=3d53c057-1b00-0000-baff-b0ba83090000 pid=2435 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=3d53c057-1b00-0000-baff-b0ba83090000 pid=2435 execve guuid=55567a58-1b00-0000-baff-b0ba84090000 pid=2436 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=55567a58-1b00-0000-baff-b0ba84090000 pid=2436 execve guuid=4f582859-1b00-0000-baff-b0ba87090000 pid=2439 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=4f582859-1b00-0000-baff-b0ba87090000 pid=2439 execve guuid=2c8bd759-1b00-0000-baff-b0ba89090000 pid=2441 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=2c8bd759-1b00-0000-baff-b0ba89090000 pid=2441 execve guuid=2ce3ac5a-1b00-0000-baff-b0ba8c090000 pid=2444 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=2ce3ac5a-1b00-0000-baff-b0ba8c090000 pid=2444 execve guuid=ee25565b-1b00-0000-baff-b0ba8e090000 pid=2446 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=ee25565b-1b00-0000-baff-b0ba8e090000 pid=2446 execve guuid=7cc70e5c-1b00-0000-baff-b0ba91090000 pid=2449 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=7cc70e5c-1b00-0000-baff-b0ba91090000 pid=2449 execve guuid=cb5cb65c-1b00-0000-baff-b0ba93090000 pid=2451 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=cb5cb65c-1b00-0000-baff-b0ba93090000 pid=2451 execve guuid=fb23645d-1b00-0000-baff-b0ba96090000 pid=2454 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=fb23645d-1b00-0000-baff-b0ba96090000 pid=2454 execve guuid=f30a085e-1b00-0000-baff-b0ba97090000 pid=2455 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=f30a085e-1b00-0000-baff-b0ba97090000 pid=2455 execve guuid=faf9ba5e-1b00-0000-baff-b0ba98090000 pid=2456 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=faf9ba5e-1b00-0000-baff-b0ba98090000 pid=2456 execve guuid=b9c1f760-1b00-0000-baff-b0ba9c090000 pid=2460 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=b9c1f760-1b00-0000-baff-b0ba9c090000 pid=2460 execve guuid=84919761-1b00-0000-baff-b0ba9e090000 pid=2462 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=84919761-1b00-0000-baff-b0ba9e090000 pid=2462 execve guuid=fae04862-1b00-0000-baff-b0baa1090000 pid=2465 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=fae04862-1b00-0000-baff-b0baa1090000 pid=2465 execve guuid=9780fe63-1b00-0000-baff-b0baa5090000 pid=2469 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=9780fe63-1b00-0000-baff-b0baa5090000 pid=2469 execve guuid=81a2a664-1b00-0000-baff-b0baa6090000 pid=2470 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=81a2a664-1b00-0000-baff-b0baa6090000 pid=2470 execve guuid=47676065-1b00-0000-baff-b0baa9090000 pid=2473 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=47676065-1b00-0000-baff-b0baa9090000 pid=2473 execve guuid=e006f565-1b00-0000-baff-b0baab090000 pid=2475 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=e006f565-1b00-0000-baff-b0baab090000 pid=2475 execve guuid=4fcd9b66-1b00-0000-baff-b0baad090000 pid=2477 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=4fcd9b66-1b00-0000-baff-b0baad090000 pid=2477 execve guuid=8dac4667-1b00-0000-baff-b0baae090000 pid=2478 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=8dac4667-1b00-0000-baff-b0baae090000 pid=2478 execve guuid=ad6fb268-1b00-0000-baff-b0baaf090000 pid=2479 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=ad6fb268-1b00-0000-baff-b0baaf090000 pid=2479 execve guuid=d210ad69-1b00-0000-baff-b0bab0090000 pid=2480 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=d210ad69-1b00-0000-baff-b0bab0090000 pid=2480 execve guuid=62a89f6b-1b00-0000-baff-b0bab1090000 pid=2481 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=62a89f6b-1b00-0000-baff-b0bab1090000 pid=2481 execve guuid=0993136d-1b00-0000-baff-b0bab2090000 pid=2482 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=0993136d-1b00-0000-baff-b0bab2090000 pid=2482 execve guuid=fd6cd76d-1b00-0000-baff-b0bab3090000 pid=2483 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=fd6cd76d-1b00-0000-baff-b0bab3090000 pid=2483 execve guuid=f914886e-1b00-0000-baff-b0bab4090000 pid=2484 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=f914886e-1b00-0000-baff-b0bab4090000 pid=2484 execve guuid=d1de2d6f-1b00-0000-baff-b0bab5090000 pid=2485 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=d1de2d6f-1b00-0000-baff-b0bab5090000 pid=2485 execve guuid=1778e36f-1b00-0000-baff-b0bab6090000 pid=2486 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=1778e36f-1b00-0000-baff-b0bab6090000 pid=2486 execve guuid=6759a070-1b00-0000-baff-b0bab8090000 pid=2488 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=6759a070-1b00-0000-baff-b0bab8090000 pid=2488 execve guuid=95db4c71-1b00-0000-baff-b0bab9090000 pid=2489 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=95db4c71-1b00-0000-baff-b0bab9090000 pid=2489 execve guuid=7e4c0572-1b00-0000-baff-b0baba090000 pid=2490 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=7e4c0572-1b00-0000-baff-b0baba090000 pid=2490 execve guuid=9997c572-1b00-0000-baff-b0babb090000 pid=2491 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=9997c572-1b00-0000-baff-b0babb090000 pid=2491 execve guuid=e343f973-1b00-0000-baff-b0babc090000 pid=2492 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=e343f973-1b00-0000-baff-b0babc090000 pid=2492 execve guuid=150e4375-1b00-0000-baff-b0babd090000 pid=2493 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=150e4375-1b00-0000-baff-b0babd090000 pid=2493 execve guuid=a0e99076-1b00-0000-baff-b0babe090000 pid=2494 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=a0e99076-1b00-0000-baff-b0babe090000 pid=2494 execve guuid=1a814f77-1b00-0000-baff-b0babf090000 pid=2495 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=1a814f77-1b00-0000-baff-b0babf090000 pid=2495 execve guuid=4dd34f78-1b00-0000-baff-b0bac2090000 pid=2498 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=4dd34f78-1b00-0000-baff-b0bac2090000 pid=2498 execve guuid=7d65db78-1b00-0000-baff-b0bac3090000 pid=2499 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=7d65db78-1b00-0000-baff-b0bac3090000 pid=2499 execve guuid=cd299c79-1b00-0000-baff-b0bac5090000 pid=2501 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=cd299c79-1b00-0000-baff-b0bac5090000 pid=2501 execve guuid=700d727a-1b00-0000-baff-b0bac7090000 pid=2503 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=700d727a-1b00-0000-baff-b0bac7090000 pid=2503 execve guuid=f9c6f87a-1b00-0000-baff-b0bac8090000 pid=2504 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=f9c6f87a-1b00-0000-baff-b0bac8090000 pid=2504 execve guuid=1c2c5e7c-1b00-0000-baff-b0bacb090000 pid=2507 /usr/bin/ls guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=1c2c5e7c-1b00-0000-baff-b0bacb090000 pid=2507 execve guuid=d4af1b7d-1b00-0000-baff-b0bacd090000 pid=2509 /usr/bin/rm guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=d4af1b7d-1b00-0000-baff-b0bacd090000 pid=2509 execve guuid=dcef247e-1b00-0000-baff-b0bacf090000 pid=2511 /usr/bin/wget net send-data write-file guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=dcef247e-1b00-0000-baff-b0bacf090000 pid=2511 execve guuid=0376969e-1b00-0000-baff-b0bae2090000 pid=2530 /usr/bin/chmod guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=0376969e-1b00-0000-baff-b0bae2090000 pid=2530 execve guuid=3c1c279f-1b00-0000-baff-b0bae4090000 pid=2532 /usr/bin/dash guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=3c1c279f-1b00-0000-baff-b0bae4090000 pid=2532 clone guuid=142555a1-1b00-0000-baff-b0bae8090000 pid=2536 /usr/bin/rm guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=142555a1-1b00-0000-baff-b0bae8090000 pid=2536 execve guuid=d36d06a2-1b00-0000-baff-b0baea090000 pid=2538 /usr/bin/wget net send-data write-file guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=d36d06a2-1b00-0000-baff-b0baea090000 pid=2538 execve guuid=f502cdc1-1b00-0000-baff-b0ba070a0000 pid=2567 /usr/bin/chmod guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=f502cdc1-1b00-0000-baff-b0ba070a0000 pid=2567 execve guuid=d9aae5c2-1b00-0000-baff-b0ba080a0000 pid=2568 /usr/bin/dash guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=d9aae5c2-1b00-0000-baff-b0ba080a0000 pid=2568 clone guuid=8a3697c4-1b00-0000-baff-b0ba0a0a0000 pid=2570 /usr/bin/rm guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=8a3697c4-1b00-0000-baff-b0ba0a0a0000 pid=2570 execve guuid=3ff72fc5-1b00-0000-baff-b0ba0b0a0000 pid=2571 /usr/bin/wget net send-data write-file guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=3ff72fc5-1b00-0000-baff-b0ba0b0a0000 pid=2571 execve guuid=d4c598e0-1b00-0000-baff-b0ba2c0a0000 pid=2604 /usr/bin/chmod guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=d4c598e0-1b00-0000-baff-b0ba2c0a0000 pid=2604 execve guuid=d70123e1-1b00-0000-baff-b0ba2d0a0000 pid=2605 /usr/bin/dash guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=d70123e1-1b00-0000-baff-b0ba2d0a0000 pid=2605 clone guuid=5f112fe2-1b00-0000-baff-b0ba310a0000 pid=2609 /usr/bin/rm guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=5f112fe2-1b00-0000-baff-b0ba310a0000 pid=2609 execve guuid=c820a8e2-1b00-0000-baff-b0ba330a0000 pid=2611 /usr/bin/wget net send-data write-file guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=c820a8e2-1b00-0000-baff-b0ba330a0000 pid=2611 execve guuid=f347be01-1c00-0000-baff-b0ba700a0000 pid=2672 /usr/bin/chmod guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=f347be01-1c00-0000-baff-b0ba700a0000 pid=2672 execve guuid=3fa92d02-1c00-0000-baff-b0ba730a0000 pid=2675 /usr/bin/dash guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=3fa92d02-1c00-0000-baff-b0ba730a0000 pid=2675 clone guuid=d924f202-1c00-0000-baff-b0ba770a0000 pid=2679 /usr/bin/rm guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=d924f202-1c00-0000-baff-b0ba770a0000 pid=2679 execve guuid=85803803-1c00-0000-baff-b0ba780a0000 pid=2680 /usr/bin/wget net send-data write-file guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=85803803-1c00-0000-baff-b0ba780a0000 pid=2680 execve guuid=9fc70620-1c00-0000-baff-b0bab70a0000 pid=2743 /usr/bin/chmod guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=9fc70620-1c00-0000-baff-b0bab70a0000 pid=2743 execve guuid=8e986320-1c00-0000-baff-b0bab80a0000 pid=2744 /usr/bin/dash guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=8e986320-1c00-0000-baff-b0bab80a0000 pid=2744 clone guuid=4b58e621-1c00-0000-baff-b0babc0a0000 pid=2748 /usr/bin/rm delete-file guuid=bba15319-1b00-0000-baff-b0bae8080000 pid=2280->guuid=4b58e621-1c00-0000-baff-b0babc0a0000 pid=2748 execve 801186e6-5fe8-5959-a7b4-832d8d66e7aa 129.121.114.124:80 guuid=dcef247e-1b00-0000-baff-b0bacf090000 pid=2511->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 133B guuid=d36d06a2-1b00-0000-baff-b0baea090000 pid=2538->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 133B guuid=3ff72fc5-1b00-0000-baff-b0ba0b0a0000 pid=2571->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 134B guuid=c820a8e2-1b00-0000-baff-b0ba330a0000 pid=2611->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 133B guuid=85803803-1c00-0000-baff-b0ba780a0000 pid=2680->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 134B
Score:
95%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/d3c060e3dfaa2fdca0d8aa47913e9772c81525148aa6d9f5d443ec4f24ef9877
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d3c060e3dfaa2fdca0d8aa47913e9772c81525148aa6d9f5d443ec4f24ef9877/
Threat name:
Document-HTML.Downloader.Bash
Create hunting rule
Status:
Malicious
First seen:
2026-08-05 14:19:30 UTC
File Type:
Text (Shell)
AV detection:
16 of 38 (42.11%)
Threat level:
  3/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2pagby67vix5zigyvjdzcpuxolebkjiurktnt5ouipwe6jhptb3q._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
discovery linux
Link:
https://tria.ge/reports/260805-rm2nqshq3z/
Behaviour
Reads runtime system information
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.26
Link:
https://yomi.yoroi.company/submissions/d3c060e3dfaa2fdca0d8aa47913e9772c81525148aa6d9f5d443ec4f24ef9877

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh d3c060e3dfaa2fdca0d8aa47913e9772c81525148aa6d9f5d443ec4f24ef9877

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3874630/
  
Delivery method
Distributed via web download

Comments