🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e1e0f3ece12b9128689fb8962ae10075e574e467dbeceb9983deb11ccf0c3132. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e1e0f3ece12b9128689fb8962ae10075e574e467dbeceb9983deb11ccf0c3132
SHA3-384 hash: 3dd5d7d83d863178e1a7e862408ea6c9f8dd9997f350a6c7f90e747248e14ed717fba5ef6ec4d394aac6e0adfdfd2b82
SHA1 hash: 155386d67a7e8f26d6b02db83f41d06ceecdc798
MD5 hash: eb063b444667bbc12b149c88054fc868
humanhash: july-island-grey-december
File name:lil
Download: download sample
File size:843 bytes
First seen:2026-06-05 07:34:36 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 24:kXCKysE2hi0ziQvZoharqKMj6V6X+N8uX:e9Qp+Msrqnj64+NzX
TLSH T1D401AFDEC1169B2090D5E89C6297514CB820C3CB25558FB8BEAC983D9BE9B587019F98
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://188.132.232.81/gXkn/an/aelf ua-wget
http://188.132.232.81/hksn/an/aelf ua-wget
http://188.132.232.81/oHK7n/an/aelf ua-wget
http://188.132.232.81/VWgmn/an/aelf ua-wget
http://188.132.232.81/LVUDn/an/aelf ua-wget

Intelligence

File Origin
# of uploads :
1
# of downloads :
55
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive
Link:
https://www.filescan.io/uploads/6a227c3f46e44aecc0d0ed5c/reports/1943888d-e131-4774-aa82-82e1c56fba76/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-06-05T05:47:00Z UTC
Last seen:
2026-06-05T06:01:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/e1e0f3ece12b9128689fb8962ae10075e574e467dbeceb9983deb11ccf0c3132/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/70e17e92-904d-495b-bd19-b1ee349e51b4
Behavior Graph:
Download SVG
%3 guuid=1411e913-1700-0000-8dae-a5b7480e0000 pid=3656 /usr/bin/sudo guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666 /tmp/sample.bin write-file guuid=1411e913-1700-0000-8dae-a5b7480e0000 pid=3656->guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666 execve guuid=2352b816-1700-0000-8dae-a5b7540e0000 pid=3668 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=2352b816-1700-0000-8dae-a5b7540e0000 pid=3668 execve guuid=129c3b17-1700-0000-8dae-a5b7570e0000 pid=3671 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=129c3b17-1700-0000-8dae-a5b7570e0000 pid=3671 execve guuid=5877e117-1700-0000-8dae-a5b75b0e0000 pid=3675 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=5877e117-1700-0000-8dae-a5b75b0e0000 pid=3675 execve guuid=2a496518-1700-0000-8dae-a5b75f0e0000 pid=3679 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=2a496518-1700-0000-8dae-a5b75f0e0000 pid=3679 execve guuid=00cce618-1700-0000-8dae-a5b7610e0000 pid=3681 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=00cce618-1700-0000-8dae-a5b7610e0000 pid=3681 execve guuid=1cfd6619-1700-0000-8dae-a5b7640e0000 pid=3684 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=1cfd6619-1700-0000-8dae-a5b7640e0000 pid=3684 execve guuid=3ac7de19-1700-0000-8dae-a5b7660e0000 pid=3686 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=3ac7de19-1700-0000-8dae-a5b7660e0000 pid=3686 execve guuid=7fcb5a1a-1700-0000-8dae-a5b7690e0000 pid=3689 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=7fcb5a1a-1700-0000-8dae-a5b7690e0000 pid=3689 execve guuid=6833d81a-1700-0000-8dae-a5b76b0e0000 pid=3691 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=6833d81a-1700-0000-8dae-a5b76b0e0000 pid=3691 execve guuid=4010571b-1700-0000-8dae-a5b76d0e0000 pid=3693 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=4010571b-1700-0000-8dae-a5b76d0e0000 pid=3693 execve guuid=910bd91b-1700-0000-8dae-a5b7700e0000 pid=3696 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=910bd91b-1700-0000-8dae-a5b7700e0000 pid=3696 execve guuid=8d895a1c-1700-0000-8dae-a5b7720e0000 pid=3698 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=8d895a1c-1700-0000-8dae-a5b7720e0000 pid=3698 execve guuid=20ceda1c-1700-0000-8dae-a5b7750e0000 pid=3701 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=20ceda1c-1700-0000-8dae-a5b7750e0000 pid=3701 execve guuid=5681571d-1700-0000-8dae-a5b7770e0000 pid=3703 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=5681571d-1700-0000-8dae-a5b7770e0000 pid=3703 execve guuid=d6c3d51d-1700-0000-8dae-a5b77b0e0000 pid=3707 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=d6c3d51d-1700-0000-8dae-a5b77b0e0000 pid=3707 execve guuid=d23d5b1e-1700-0000-8dae-a5b77c0e0000 pid=3708 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=d23d5b1e-1700-0000-8dae-a5b77c0e0000 pid=3708 execve guuid=ad7bdf1e-1700-0000-8dae-a5b7800e0000 pid=3712 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=ad7bdf1e-1700-0000-8dae-a5b7800e0000 pid=3712 execve guuid=e229591f-1700-0000-8dae-a5b7840e0000 pid=3716 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=e229591f-1700-0000-8dae-a5b7840e0000 pid=3716 execve guuid=5b3ccd1f-1700-0000-8dae-a5b7880e0000 pid=3720 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=5b3ccd1f-1700-0000-8dae-a5b7880e0000 pid=3720 execve guuid=62524320-1700-0000-8dae-a5b78c0e0000 pid=3724 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=62524320-1700-0000-8dae-a5b78c0e0000 pid=3724 execve guuid=94f9b420-1700-0000-8dae-a5b78e0e0000 pid=3726 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=94f9b420-1700-0000-8dae-a5b78e0e0000 pid=3726 execve guuid=a8210921-1700-0000-8dae-a5b7900e0000 pid=3728 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=a8210921-1700-0000-8dae-a5b7900e0000 pid=3728 execve guuid=789a5f21-1700-0000-8dae-a5b7940e0000 pid=3732 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=789a5f21-1700-0000-8dae-a5b7940e0000 pid=3732 execve guuid=e730b521-1700-0000-8dae-a5b7980e0000 pid=3736 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=e730b521-1700-0000-8dae-a5b7980e0000 pid=3736 execve guuid=69f40922-1700-0000-8dae-a5b79a0e0000 pid=3738 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=69f40922-1700-0000-8dae-a5b79a0e0000 pid=3738 execve guuid=85496422-1700-0000-8dae-a5b79d0e0000 pid=3741 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=85496422-1700-0000-8dae-a5b79d0e0000 pid=3741 execve guuid=5cc4bb22-1700-0000-8dae-a5b7a00e0000 pid=3744 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=5cc4bb22-1700-0000-8dae-a5b7a00e0000 pid=3744 execve guuid=ecc52123-1700-0000-8dae-a5b7a40e0000 pid=3748 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=ecc52123-1700-0000-8dae-a5b7a40e0000 pid=3748 execve guuid=e3cf7f23-1700-0000-8dae-a5b7a70e0000 pid=3751 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=e3cf7f23-1700-0000-8dae-a5b7a70e0000 pid=3751 execve guuid=7dcee123-1700-0000-8dae-a5b7ab0e0000 pid=3755 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=7dcee123-1700-0000-8dae-a5b7ab0e0000 pid=3755 execve guuid=43dd3e24-1700-0000-8dae-a5b7af0e0000 pid=3759 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=43dd3e24-1700-0000-8dae-a5b7af0e0000 pid=3759 execve guuid=3b5ca124-1700-0000-8dae-a5b7b10e0000 pid=3761 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=3b5ca124-1700-0000-8dae-a5b7b10e0000 pid=3761 execve guuid=5b240725-1700-0000-8dae-a5b7b40e0000 pid=3764 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=5b240725-1700-0000-8dae-a5b7b40e0000 pid=3764 execve guuid=22ba5925-1700-0000-8dae-a5b7b70e0000 pid=3767 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=22ba5925-1700-0000-8dae-a5b7b70e0000 pid=3767 execve guuid=2056b025-1700-0000-8dae-a5b7bb0e0000 pid=3771 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=2056b025-1700-0000-8dae-a5b7bb0e0000 pid=3771 execve guuid=cdfd0926-1700-0000-8dae-a5b7bd0e0000 pid=3773 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=cdfd0926-1700-0000-8dae-a5b7bd0e0000 pid=3773 execve guuid=c3346226-1700-0000-8dae-a5b7c00e0000 pid=3776 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=c3346226-1700-0000-8dae-a5b7c00e0000 pid=3776 execve guuid=3882be26-1700-0000-8dae-a5b7c20e0000 pid=3778 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=3882be26-1700-0000-8dae-a5b7c20e0000 pid=3778 execve guuid=07821c27-1700-0000-8dae-a5b7c50e0000 pid=3781 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=07821c27-1700-0000-8dae-a5b7c50e0000 pid=3781 execve guuid=3dac7327-1700-0000-8dae-a5b7c70e0000 pid=3783 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=3dac7327-1700-0000-8dae-a5b7c70e0000 pid=3783 execve guuid=6c9ccb27-1700-0000-8dae-a5b7c90e0000 pid=3785 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=6c9ccb27-1700-0000-8dae-a5b7c90e0000 pid=3785 execve guuid=98631c28-1700-0000-8dae-a5b7cc0e0000 pid=3788 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=98631c28-1700-0000-8dae-a5b7cc0e0000 pid=3788 execve guuid=afa46e28-1700-0000-8dae-a5b7ce0e0000 pid=3790 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=afa46e28-1700-0000-8dae-a5b7ce0e0000 pid=3790 execve guuid=f977c028-1700-0000-8dae-a5b7d00e0000 pid=3792 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=f977c028-1700-0000-8dae-a5b7d00e0000 pid=3792 execve guuid=abc71129-1700-0000-8dae-a5b7d30e0000 pid=3795 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=abc71129-1700-0000-8dae-a5b7d30e0000 pid=3795 execve guuid=40876529-1700-0000-8dae-a5b7d50e0000 pid=3797 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=40876529-1700-0000-8dae-a5b7d50e0000 pid=3797 execve guuid=da90b529-1700-0000-8dae-a5b7d70e0000 pid=3799 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=da90b529-1700-0000-8dae-a5b7d70e0000 pid=3799 execve guuid=79f1082a-1700-0000-8dae-a5b7da0e0000 pid=3802 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=79f1082a-1700-0000-8dae-a5b7da0e0000 pid=3802 execve guuid=78705b2a-1700-0000-8dae-a5b7dc0e0000 pid=3804 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=78705b2a-1700-0000-8dae-a5b7dc0e0000 pid=3804 execve guuid=bd80b12a-1700-0000-8dae-a5b7de0e0000 pid=3806 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=bd80b12a-1700-0000-8dae-a5b7de0e0000 pid=3806 execve guuid=4eb5042b-1700-0000-8dae-a5b7e10e0000 pid=3809 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=4eb5042b-1700-0000-8dae-a5b7e10e0000 pid=3809 execve guuid=a043582b-1700-0000-8dae-a5b7e30e0000 pid=3811 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=a043582b-1700-0000-8dae-a5b7e30e0000 pid=3811 execve guuid=c8a0aa2b-1700-0000-8dae-a5b7e50e0000 pid=3813 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=c8a0aa2b-1700-0000-8dae-a5b7e50e0000 pid=3813 execve guuid=ad52002c-1700-0000-8dae-a5b7e80e0000 pid=3816 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=ad52002c-1700-0000-8dae-a5b7e80e0000 pid=3816 execve guuid=ad125a2c-1700-0000-8dae-a5b7ec0e0000 pid=3820 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=ad125a2c-1700-0000-8dae-a5b7ec0e0000 pid=3820 execve guuid=6bfda72c-1700-0000-8dae-a5b7ef0e0000 pid=3823 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=6bfda72c-1700-0000-8dae-a5b7ef0e0000 pid=3823 execve guuid=74ac052d-1700-0000-8dae-a5b7f20e0000 pid=3826 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=74ac052d-1700-0000-8dae-a5b7f20e0000 pid=3826 execve guuid=f194662d-1700-0000-8dae-a5b7f40e0000 pid=3828 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=f194662d-1700-0000-8dae-a5b7f40e0000 pid=3828 execve guuid=ad3eca2d-1700-0000-8dae-a5b7f80e0000 pid=3832 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=ad3eca2d-1700-0000-8dae-a5b7f80e0000 pid=3832 execve guuid=62621a2e-1700-0000-8dae-a5b7fa0e0000 pid=3834 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=62621a2e-1700-0000-8dae-a5b7fa0e0000 pid=3834 execve guuid=907f722e-1700-0000-8dae-a5b7fc0e0000 pid=3836 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=907f722e-1700-0000-8dae-a5b7fc0e0000 pid=3836 execve guuid=13a8d92e-1700-0000-8dae-a5b7ff0e0000 pid=3839 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=13a8d92e-1700-0000-8dae-a5b7ff0e0000 pid=3839 execve guuid=60242d2f-1700-0000-8dae-a5b7020f0000 pid=3842 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=60242d2f-1700-0000-8dae-a5b7020f0000 pid=3842 execve guuid=5a48802f-1700-0000-8dae-a5b7050f0000 pid=3845 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=5a48802f-1700-0000-8dae-a5b7050f0000 pid=3845 execve guuid=b6ced42f-1700-0000-8dae-a5b7080f0000 pid=3848 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=b6ced42f-1700-0000-8dae-a5b7080f0000 pid=3848 execve guuid=8d3b2330-1700-0000-8dae-a5b70b0f0000 pid=3851 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=8d3b2330-1700-0000-8dae-a5b70b0f0000 pid=3851 execve guuid=a5847730-1700-0000-8dae-a5b70e0f0000 pid=3854 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=a5847730-1700-0000-8dae-a5b70e0f0000 pid=3854 execve guuid=22b9cc30-1700-0000-8dae-a5b7110f0000 pid=3857 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=22b9cc30-1700-0000-8dae-a5b7110f0000 pid=3857 execve guuid=24ea1e31-1700-0000-8dae-a5b7150f0000 pid=3861 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=24ea1e31-1700-0000-8dae-a5b7150f0000 pid=3861 execve guuid=b94f7731-1700-0000-8dae-a5b7170f0000 pid=3863 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=b94f7731-1700-0000-8dae-a5b7170f0000 pid=3863 execve guuid=7192cb31-1700-0000-8dae-a5b71a0f0000 pid=3866 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=7192cb31-1700-0000-8dae-a5b71a0f0000 pid=3866 execve guuid=d95d1d32-1700-0000-8dae-a5b71e0f0000 pid=3870 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=d95d1d32-1700-0000-8dae-a5b71e0f0000 pid=3870 execve guuid=01887a32-1700-0000-8dae-a5b7220f0000 pid=3874 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=01887a32-1700-0000-8dae-a5b7220f0000 pid=3874 execve guuid=c2d5d932-1700-0000-8dae-a5b7250f0000 pid=3877 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=c2d5d932-1700-0000-8dae-a5b7250f0000 pid=3877 execve guuid=e3d93733-1700-0000-8dae-a5b7280f0000 pid=3880 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=e3d93733-1700-0000-8dae-a5b7280f0000 pid=3880 execve guuid=ca149733-1700-0000-8dae-a5b72a0f0000 pid=3882 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=ca149733-1700-0000-8dae-a5b72a0f0000 pid=3882 execve guuid=0c76fc33-1700-0000-8dae-a5b7320f0000 pid=3890 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=0c76fc33-1700-0000-8dae-a5b7320f0000 pid=3890 execve guuid=f5d45634-1700-0000-8dae-a5b7330f0000 pid=3891 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=f5d45634-1700-0000-8dae-a5b7330f0000 pid=3891 execve guuid=1bb0aa34-1700-0000-8dae-a5b7340f0000 pid=3892 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=1bb0aa34-1700-0000-8dae-a5b7340f0000 pid=3892 execve guuid=fc110335-1700-0000-8dae-a5b7370f0000 pid=3895 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=fc110335-1700-0000-8dae-a5b7370f0000 pid=3895 execve guuid=7fdd5c35-1700-0000-8dae-a5b7390f0000 pid=3897 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=7fdd5c35-1700-0000-8dae-a5b7390f0000 pid=3897 execve guuid=68babd35-1700-0000-8dae-a5b73c0f0000 pid=3900 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=68babd35-1700-0000-8dae-a5b73c0f0000 pid=3900 execve guuid=8d4a1636-1700-0000-8dae-a5b73e0f0000 pid=3902 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=8d4a1636-1700-0000-8dae-a5b73e0f0000 pid=3902 execve guuid=6e0b7036-1700-0000-8dae-a5b7410f0000 pid=3905 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=6e0b7036-1700-0000-8dae-a5b7410f0000 pid=3905 execve guuid=b55ac936-1700-0000-8dae-a5b7430f0000 pid=3907 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=b55ac936-1700-0000-8dae-a5b7430f0000 pid=3907 execve guuid=af511d37-1700-0000-8dae-a5b7470f0000 pid=3911 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=af511d37-1700-0000-8dae-a5b7470f0000 pid=3911 execve guuid=105a6a37-1700-0000-8dae-a5b7480f0000 pid=3912 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=105a6a37-1700-0000-8dae-a5b7480f0000 pid=3912 execve guuid=d317c037-1700-0000-8dae-a5b74c0f0000 pid=3916 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=d317c037-1700-0000-8dae-a5b74c0f0000 pid=3916 execve guuid=31e01938-1700-0000-8dae-a5b7500f0000 pid=3920 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=31e01938-1700-0000-8dae-a5b7500f0000 pid=3920 execve guuid=c6586a38-1700-0000-8dae-a5b7540f0000 pid=3924 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=c6586a38-1700-0000-8dae-a5b7540f0000 pid=3924 execve guuid=f58eb838-1700-0000-8dae-a5b7550f0000 pid=3925 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=f58eb838-1700-0000-8dae-a5b7550f0000 pid=3925 execve guuid=f6641039-1700-0000-8dae-a5b7590f0000 pid=3929 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=f6641039-1700-0000-8dae-a5b7590f0000 pid=3929 execve guuid=17ed6639-1700-0000-8dae-a5b75c0f0000 pid=3932 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=17ed6639-1700-0000-8dae-a5b75c0f0000 pid=3932 execve guuid=908aee39-1700-0000-8dae-a5b75f0f0000 pid=3935 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=908aee39-1700-0000-8dae-a5b75f0f0000 pid=3935 execve guuid=6f2a4d3a-1700-0000-8dae-a5b7610f0000 pid=3937 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=6f2a4d3a-1700-0000-8dae-a5b7610f0000 pid=3937 execve guuid=282aaa3a-1700-0000-8dae-a5b7640f0000 pid=3940 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=282aaa3a-1700-0000-8dae-a5b7640f0000 pid=3940 execve guuid=6daf023b-1700-0000-8dae-a5b7660f0000 pid=3942 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=6daf023b-1700-0000-8dae-a5b7660f0000 pid=3942 execve guuid=2b625e3b-1700-0000-8dae-a5b76a0f0000 pid=3946 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=2b625e3b-1700-0000-8dae-a5b76a0f0000 pid=3946 execve guuid=7c3bb53b-1700-0000-8dae-a5b76e0f0000 pid=3950 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=7c3bb53b-1700-0000-8dae-a5b76e0f0000 pid=3950 execve guuid=17c9163c-1700-0000-8dae-a5b7700f0000 pid=3952 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=17c9163c-1700-0000-8dae-a5b7700f0000 pid=3952 execve guuid=fe5e6f3c-1700-0000-8dae-a5b7720f0000 pid=3954 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=fe5e6f3c-1700-0000-8dae-a5b7720f0000 pid=3954 execve guuid=31a3cc3c-1700-0000-8dae-a5b7740f0000 pid=3956 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=31a3cc3c-1700-0000-8dae-a5b7740f0000 pid=3956 execve guuid=a154283d-1700-0000-8dae-a5b7770f0000 pid=3959 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=a154283d-1700-0000-8dae-a5b7770f0000 pid=3959 execve guuid=68c4833d-1700-0000-8dae-a5b7790f0000 pid=3961 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=68c4833d-1700-0000-8dae-a5b7790f0000 pid=3961 execve guuid=fe48e23d-1700-0000-8dae-a5b77c0f0000 pid=3964 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=fe48e23d-1700-0000-8dae-a5b77c0f0000 pid=3964 execve guuid=a0b93c3e-1700-0000-8dae-a5b77d0f0000 pid=3965 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=a0b93c3e-1700-0000-8dae-a5b77d0f0000 pid=3965 execve guuid=86918e3e-1700-0000-8dae-a5b7810f0000 pid=3969 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=86918e3e-1700-0000-8dae-a5b7810f0000 pid=3969 execve guuid=977de43e-1700-0000-8dae-a5b7850f0000 pid=3973 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=977de43e-1700-0000-8dae-a5b7850f0000 pid=3973 execve guuid=031d393f-1700-0000-8dae-a5b7870f0000 pid=3975 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=031d393f-1700-0000-8dae-a5b7870f0000 pid=3975 execve guuid=72c48e3f-1700-0000-8dae-a5b78b0f0000 pid=3979 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=72c48e3f-1700-0000-8dae-a5b78b0f0000 pid=3979 execve guuid=a275e83f-1700-0000-8dae-a5b78d0f0000 pid=3981 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=a275e83f-1700-0000-8dae-a5b78d0f0000 pid=3981 execve guuid=e7c78240-1700-0000-8dae-a5b7920f0000 pid=3986 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=e7c78240-1700-0000-8dae-a5b7920f0000 pid=3986 execve guuid=b8b94441-1700-0000-8dae-a5b7960f0000 pid=3990 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=b8b94441-1700-0000-8dae-a5b7960f0000 pid=3990 execve guuid=cf6ea441-1700-0000-8dae-a5b7990f0000 pid=3993 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=cf6ea441-1700-0000-8dae-a5b7990f0000 pid=3993 execve guuid=1971fa41-1700-0000-8dae-a5b79c0f0000 pid=3996 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=1971fa41-1700-0000-8dae-a5b79c0f0000 pid=3996 execve guuid=7cb24e42-1700-0000-8dae-a5b79e0f0000 pid=3998 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=7cb24e42-1700-0000-8dae-a5b79e0f0000 pid=3998 execve guuid=3ab9a442-1700-0000-8dae-a5b7a20f0000 pid=4002 /usr/bin/ls guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=3ab9a442-1700-0000-8dae-a5b7a20f0000 pid=4002 execve guuid=e31cff42-1700-0000-8dae-a5b7a50f0000 pid=4005 /usr/bin/rm guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=e31cff42-1700-0000-8dae-a5b7a50f0000 pid=4005 execve guuid=4e3a3543-1700-0000-8dae-a5b7a70f0000 pid=4007 /usr/bin/wget net send-data write-file guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=4e3a3543-1700-0000-8dae-a5b7a70f0000 pid=4007 execve guuid=7b6db7c4-1700-0000-8dae-a5b7f2100000 pid=4338 /usr/bin/chmod guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=7b6db7c4-1700-0000-8dae-a5b7f2100000 pid=4338 execve guuid=52af04c5-1700-0000-8dae-a5b7f6100000 pid=4342 /tmp/gXk guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=52af04c5-1700-0000-8dae-a5b7f6100000 pid=4342 execve guuid=b54a9ec6-1700-0000-8dae-a5b7fc100000 pid=4348 /usr/bin/rm guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=b54a9ec6-1700-0000-8dae-a5b7fc100000 pid=4348 execve guuid=14cfe1c6-1700-0000-8dae-a5b7fe100000 pid=4350 /usr/bin/wget net send-data write-file guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=14cfe1c6-1700-0000-8dae-a5b7fe100000 pid=4350 execve guuid=81ed02ce-1700-0000-8dae-a5b71f110000 pid=4383 /usr/bin/chmod guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=81ed02ce-1700-0000-8dae-a5b71f110000 pid=4383 execve guuid=0ff740ce-1700-0000-8dae-a5b721110000 pid=4385 /tmp/hks guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=0ff740ce-1700-0000-8dae-a5b721110000 pid=4385 execve guuid=6e6da3cf-1700-0000-8dae-a5b72a110000 pid=4394 /usr/bin/rm guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=6e6da3cf-1700-0000-8dae-a5b72a110000 pid=4394 execve guuid=db71d9cf-1700-0000-8dae-a5b72c110000 pid=4396 /usr/bin/wget net send-data write-file guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=db71d9cf-1700-0000-8dae-a5b72c110000 pid=4396 execve guuid=eecbf8d5-1700-0000-8dae-a5b73f110000 pid=4415 /usr/bin/chmod guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=eecbf8d5-1700-0000-8dae-a5b73f110000 pid=4415 execve guuid=a80737d6-1700-0000-8dae-a5b743110000 pid=4419 /tmp/oHK7 guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=a80737d6-1700-0000-8dae-a5b743110000 pid=4419 execve guuid=e1a2e1d6-1700-0000-8dae-a5b746110000 pid=4422 /usr/bin/rm guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=e1a2e1d6-1700-0000-8dae-a5b746110000 pid=4422 execve guuid=4adb2bd7-1700-0000-8dae-a5b748110000 pid=4424 /usr/bin/wget net send-data write-file guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=4adb2bd7-1700-0000-8dae-a5b748110000 pid=4424 execve guuid=65c0691a-1800-0000-8dae-a5b7f8110000 pid=4600 /usr/bin/chmod guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=65c0691a-1800-0000-8dae-a5b7f8110000 pid=4600 execve guuid=1477e71a-1800-0000-8dae-a5b7fb110000 pid=4603 /tmp/VWgm guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=1477e71a-1800-0000-8dae-a5b7fb110000 pid=4603 execve guuid=48b6731c-1800-0000-8dae-a5b7fe110000 pid=4606 /usr/bin/rm guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=48b6731c-1800-0000-8dae-a5b7fe110000 pid=4606 execve guuid=e6f5ab1c-1800-0000-8dae-a5b701120000 pid=4609 /usr/bin/wget net send-data write-file guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=e6f5ab1c-1800-0000-8dae-a5b701120000 pid=4609 execve guuid=062e1323-1800-0000-8dae-a5b712120000 pid=4626 /usr/bin/chmod guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=062e1323-1800-0000-8dae-a5b712120000 pid=4626 execve guuid=0b3f7f23-1800-0000-8dae-a5b713120000 pid=4627 /tmp/LVUD guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=0b3f7f23-1800-0000-8dae-a5b713120000 pid=4627 execve guuid=a7769f24-1800-0000-8dae-a5b717120000 pid=4631 /usr/bin/rm delete-file guuid=18395816-1700-0000-8dae-a5b7520e0000 pid=3666->guuid=a7769f24-1800-0000-8dae-a5b717120000 pid=4631 execve 9554d36e-3083-568e-90da-bb8e3c487b07 188.132.232.81:80 guuid=4e3a3543-1700-0000-8dae-a5b7a70f0000 pid=4007->9554d36e-3083-568e-90da-bb8e3c487b07 send: 132B guuid=14cfe1c6-1700-0000-8dae-a5b7fe100000 pid=4350->9554d36e-3083-568e-90da-bb8e3c487b07 send: 132B guuid=db71d9cf-1700-0000-8dae-a5b72c110000 pid=4396->9554d36e-3083-568e-90da-bb8e3c487b07 send: 133B guuid=4adb2bd7-1700-0000-8dae-a5b748110000 pid=4424->9554d36e-3083-568e-90da-bb8e3c487b07 send: 133B guuid=e6f5ab1c-1800-0000-8dae-a5b701120000 pid=4609->9554d36e-3083-568e-90da-bb8e3c487b07 send: 133B
Score:
95%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/e1e0f3ece12b9128689fb8962ae10075e574e467dbeceb9983deb11ccf0c3132
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e1e0f3ece12b9128689fb8962ae10075e574e467dbeceb9983deb11ccf0c3132/
Verdict:
Malicious
Link:
https://tip.neiki.dev/file/e1e0f3ece12b9128689fb8962ae10075e574e467dbeceb9983deb11ccf0c3132
Threat name:
Script.Trojan.Multiverze
Create hunting rule
Status:
Malicious
First seen:
2026-06-05 07:35:15 UTC
File Type:
Text (Shell)
AV detection:
9 of 22 (40.91%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4hqph3hbfoisq2e7xclcvyiaoxsxjzdh3pwoxgmd32yrztymgeza._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
defense_evasion discovery linux
Link:
https://tria.ge/reports/260605-jexqtadv3m/
Behaviour
Reads runtime system information
Writes file to tmp directory
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh e1e0f3ece12b9128689fb8962ae10075e574e467dbeceb9983deb11ccf0c3132

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3856431/
  
Delivery method
Distributed via web download

Comments