🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 eb3f5b3d6037feb5d12bc542aeae18970ad06991a8b953e34e4c7af2581df342. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: eb3f5b3d6037feb5d12bc542aeae18970ad06991a8b953e34e4c7af2581df342
SHA3-384 hash: e683fe9b67a392a74231dbe6db1dd9a32a8a8a3d2637e75ea93ad79e7a56733a92b29d7ecb2b93a4820b22f9aa1684fc
SHA1 hash: bd0804f868c02fbdfbc3c85b985d0fb24318d4f3
MD5 hash: f2aa688cca37f0389a5943437b6fb2e6
humanhash: pennsylvania-west-march-low
File name:lil
Download: download sample
File size:843 bytes
First seen:2026-06-09 20:07:56 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 24:kXCKysE2hi0ziQvZohaDMF8cMIvGeE5n/sGJX:e9Qp+MsDEMIuN5/JX
TLSH T1770182CEC405DB9041D5E89D21EB5448B825C3DB29458FB5FF6C583D8BB96187016F94
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://188.132.232.81/VOEin/an/aelf ua-wget
http://188.132.232.81/Wtfhn/an/aelf ua-wget
http://188.132.232.81/6W5n/an/aelf ua-wget
http://188.132.232.81/tzon/an/aelf ua-wget
http://188.132.232.81/3aEIn/an/aelf ua-wget

Intelligence

File Origin
# of uploads :
1
# of downloads :
38
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive
Link:
https://www.filescan.io/uploads/6a2872bdbf16337e43bec82b/reports/93387bf5-dd80-4fa5-b316-16ef0b797d80/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-06-09T17:14:00Z UTC
Last seen:
2026-06-09T17:57:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan-Downloader.Shell.Agent.a
Link:
https://opentip.kaspersky.com/eb3f5b3d6037feb5d12bc542aeae18970ad06991a8b953e34e4c7af2581df342/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/18ac7df3-162a-407f-bfc6-40def3565f74
Behavior Graph:
Download SVG
%3 guuid=f1ffd2d9-1900-0000-b3eb-f59900090000 pid=2304 /usr/bin/sudo guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308 /tmp/sample.bin write-file guuid=f1ffd2d9-1900-0000-b3eb-f59900090000 pid=2304->guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308 execve guuid=a15e59dc-1900-0000-b3eb-f59905090000 pid=2309 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=a15e59dc-1900-0000-b3eb-f59905090000 pid=2309 execve guuid=b9430ddd-1900-0000-b3eb-f59906090000 pid=2310 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=b9430ddd-1900-0000-b3eb-f59906090000 pid=2310 execve guuid=77ef77dd-1900-0000-b3eb-f59907090000 pid=2311 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=77ef77dd-1900-0000-b3eb-f59907090000 pid=2311 execve guuid=9cbdd3dd-1900-0000-b3eb-f59908090000 pid=2312 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=9cbdd3dd-1900-0000-b3eb-f59908090000 pid=2312 execve guuid=559634de-1900-0000-b3eb-f59909090000 pid=2313 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=559634de-1900-0000-b3eb-f59909090000 pid=2313 execve guuid=2c5794de-1900-0000-b3eb-f5990a090000 pid=2314 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=2c5794de-1900-0000-b3eb-f5990a090000 pid=2314 execve guuid=b9e7f2de-1900-0000-b3eb-f5990b090000 pid=2315 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=b9e7f2de-1900-0000-b3eb-f5990b090000 pid=2315 execve guuid=37af50df-1900-0000-b3eb-f5990c090000 pid=2316 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=37af50df-1900-0000-b3eb-f5990c090000 pid=2316 execve guuid=77b7b0df-1900-0000-b3eb-f5990d090000 pid=2317 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=77b7b0df-1900-0000-b3eb-f5990d090000 pid=2317 execve guuid=e9c717e0-1900-0000-b3eb-f5990e090000 pid=2318 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=e9c717e0-1900-0000-b3eb-f5990e090000 pid=2318 execve guuid=da5f7ee0-1900-0000-b3eb-f5990f090000 pid=2319 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=da5f7ee0-1900-0000-b3eb-f5990f090000 pid=2319 execve guuid=4574e0e0-1900-0000-b3eb-f59910090000 pid=2320 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=4574e0e0-1900-0000-b3eb-f59910090000 pid=2320 execve guuid=a8db3fe1-1900-0000-b3eb-f59911090000 pid=2321 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=a8db3fe1-1900-0000-b3eb-f59911090000 pid=2321 execve guuid=53e0b5e1-1900-0000-b3eb-f59912090000 pid=2322 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=53e0b5e1-1900-0000-b3eb-f59912090000 pid=2322 execve guuid=66b111e2-1900-0000-b3eb-f59913090000 pid=2323 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=66b111e2-1900-0000-b3eb-f59913090000 pid=2323 execve guuid=91bc7ee2-1900-0000-b3eb-f59914090000 pid=2324 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=91bc7ee2-1900-0000-b3eb-f59914090000 pid=2324 execve guuid=e7dcdde2-1900-0000-b3eb-f59915090000 pid=2325 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=e7dcdde2-1900-0000-b3eb-f59915090000 pid=2325 execve guuid=600940e3-1900-0000-b3eb-f59916090000 pid=2326 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=600940e3-1900-0000-b3eb-f59916090000 pid=2326 execve guuid=ca88c5e3-1900-0000-b3eb-f59917090000 pid=2327 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=ca88c5e3-1900-0000-b3eb-f59917090000 pid=2327 execve guuid=904731e4-1900-0000-b3eb-f59918090000 pid=2328 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=904731e4-1900-0000-b3eb-f59918090000 pid=2328 execve guuid=26d5b8e4-1900-0000-b3eb-f59919090000 pid=2329 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=26d5b8e4-1900-0000-b3eb-f59919090000 pid=2329 execve guuid=b69f26e5-1900-0000-b3eb-f5991a090000 pid=2330 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=b69f26e5-1900-0000-b3eb-f5991a090000 pid=2330 execve guuid=76d7cde5-1900-0000-b3eb-f5991b090000 pid=2331 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=76d7cde5-1900-0000-b3eb-f5991b090000 pid=2331 execve guuid=e4bc3be6-1900-0000-b3eb-f5991c090000 pid=2332 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=e4bc3be6-1900-0000-b3eb-f5991c090000 pid=2332 execve guuid=e97fcae6-1900-0000-b3eb-f5991d090000 pid=2333 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=e97fcae6-1900-0000-b3eb-f5991d090000 pid=2333 execve guuid=191842e7-1900-0000-b3eb-f5991e090000 pid=2334 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=191842e7-1900-0000-b3eb-f5991e090000 pid=2334 execve guuid=5dd6e1e7-1900-0000-b3eb-f5991f090000 pid=2335 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=5dd6e1e7-1900-0000-b3eb-f5991f090000 pid=2335 execve guuid=2fa04de8-1900-0000-b3eb-f59920090000 pid=2336 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=2fa04de8-1900-0000-b3eb-f59920090000 pid=2336 execve guuid=589ee2e8-1900-0000-b3eb-f59921090000 pid=2337 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=589ee2e8-1900-0000-b3eb-f59921090000 pid=2337 execve guuid=df77aae9-1900-0000-b3eb-f59922090000 pid=2338 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=df77aae9-1900-0000-b3eb-f59922090000 pid=2338 execve guuid=48ef0bea-1900-0000-b3eb-f59923090000 pid=2339 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=48ef0bea-1900-0000-b3eb-f59923090000 pid=2339 execve guuid=5ce271ea-1900-0000-b3eb-f59924090000 pid=2340 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=5ce271ea-1900-0000-b3eb-f59924090000 pid=2340 execve guuid=14a2d6ea-1900-0000-b3eb-f59925090000 pid=2341 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=14a2d6ea-1900-0000-b3eb-f59925090000 pid=2341 execve guuid=21dd3beb-1900-0000-b3eb-f59926090000 pid=2342 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=21dd3beb-1900-0000-b3eb-f59926090000 pid=2342 execve guuid=3f539ceb-1900-0000-b3eb-f59927090000 pid=2343 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=3f539ceb-1900-0000-b3eb-f59927090000 pid=2343 execve guuid=a457ffeb-1900-0000-b3eb-f59928090000 pid=2344 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=a457ffeb-1900-0000-b3eb-f59928090000 pid=2344 execve guuid=92c6aeec-1900-0000-b3eb-f59929090000 pid=2345 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=92c6aeec-1900-0000-b3eb-f59929090000 pid=2345 execve guuid=37fa0ded-1900-0000-b3eb-f5992a090000 pid=2346 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=37fa0ded-1900-0000-b3eb-f5992a090000 pid=2346 execve guuid=3cb0b3ed-1900-0000-b3eb-f5992b090000 pid=2347 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=3cb0b3ed-1900-0000-b3eb-f5992b090000 pid=2347 execve guuid=6e2a24ee-1900-0000-b3eb-f5992c090000 pid=2348 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=6e2a24ee-1900-0000-b3eb-f5992c090000 pid=2348 execve guuid=d374cdee-1900-0000-b3eb-f5992d090000 pid=2349 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=d374cdee-1900-0000-b3eb-f5992d090000 pid=2349 execve guuid=8b1b3bef-1900-0000-b3eb-f5992e090000 pid=2350 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=8b1b3bef-1900-0000-b3eb-f5992e090000 pid=2350 execve guuid=c077e9ef-1900-0000-b3eb-f5992f090000 pid=2351 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=c077e9ef-1900-0000-b3eb-f5992f090000 pid=2351 execve guuid=02545af0-1900-0000-b3eb-f59930090000 pid=2352 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=02545af0-1900-0000-b3eb-f59930090000 pid=2352 execve guuid=d8670bf1-1900-0000-b3eb-f59931090000 pid=2353 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=d8670bf1-1900-0000-b3eb-f59931090000 pid=2353 execve guuid=a3fa7ef1-1900-0000-b3eb-f59932090000 pid=2354 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=a3fa7ef1-1900-0000-b3eb-f59932090000 pid=2354 execve guuid=534933f2-1900-0000-b3eb-f59933090000 pid=2355 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=534933f2-1900-0000-b3eb-f59933090000 pid=2355 execve guuid=1dd38bf2-1900-0000-b3eb-f59934090000 pid=2356 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=1dd38bf2-1900-0000-b3eb-f59934090000 pid=2356 execve guuid=b45024f3-1900-0000-b3eb-f59935090000 pid=2357 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=b45024f3-1900-0000-b3eb-f59935090000 pid=2357 execve guuid=a8059ef3-1900-0000-b3eb-f59936090000 pid=2358 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=a8059ef3-1900-0000-b3eb-f59936090000 pid=2358 execve guuid=e89c3ef4-1900-0000-b3eb-f59937090000 pid=2359 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=e89c3ef4-1900-0000-b3eb-f59937090000 pid=2359 execve guuid=0b85c6f4-1900-0000-b3eb-f59938090000 pid=2360 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=0b85c6f4-1900-0000-b3eb-f59938090000 pid=2360 execve guuid=684b56f5-1900-0000-b3eb-f59939090000 pid=2361 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=684b56f5-1900-0000-b3eb-f59939090000 pid=2361 execve guuid=e471fcf5-1900-0000-b3eb-f5993a090000 pid=2362 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=e471fcf5-1900-0000-b3eb-f5993a090000 pid=2362 execve guuid=691d8df6-1900-0000-b3eb-f5993b090000 pid=2363 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=691d8df6-1900-0000-b3eb-f5993b090000 pid=2363 execve guuid=0cf537f7-1900-0000-b3eb-f5993c090000 pid=2364 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=0cf537f7-1900-0000-b3eb-f5993c090000 pid=2364 execve guuid=14e5d3f7-1900-0000-b3eb-f5993d090000 pid=2365 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=14e5d3f7-1900-0000-b3eb-f5993d090000 pid=2365 execve guuid=74216cf8-1900-0000-b3eb-f5993e090000 pid=2366 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=74216cf8-1900-0000-b3eb-f5993e090000 pid=2366 execve guuid=85ecf3f8-1900-0000-b3eb-f5993f090000 pid=2367 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=85ecf3f8-1900-0000-b3eb-f5993f090000 pid=2367 execve guuid=b1a1a9f9-1900-0000-b3eb-f59940090000 pid=2368 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=b1a1a9f9-1900-0000-b3eb-f59940090000 pid=2368 execve guuid=3d9e19fa-1900-0000-b3eb-f59941090000 pid=2369 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=3d9e19fa-1900-0000-b3eb-f59941090000 pid=2369 execve guuid=fad817fb-1900-0000-b3eb-f59942090000 pid=2370 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=fad817fb-1900-0000-b3eb-f59942090000 pid=2370 execve guuid=be43aefb-1900-0000-b3eb-f59943090000 pid=2371 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=be43aefb-1900-0000-b3eb-f59943090000 pid=2371 execve guuid=451c62fc-1900-0000-b3eb-f59944090000 pid=2372 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=451c62fc-1900-0000-b3eb-f59944090000 pid=2372 execve guuid=fd6c16fd-1900-0000-b3eb-f59945090000 pid=2373 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=fd6c16fd-1900-0000-b3eb-f59945090000 pid=2373 execve guuid=d40cbdfd-1900-0000-b3eb-f59946090000 pid=2374 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=d40cbdfd-1900-0000-b3eb-f59946090000 pid=2374 execve guuid=3da52efe-1900-0000-b3eb-f59947090000 pid=2375 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=3da52efe-1900-0000-b3eb-f59947090000 pid=2375 execve guuid=f55593fe-1900-0000-b3eb-f59948090000 pid=2376 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=f55593fe-1900-0000-b3eb-f59948090000 pid=2376 execve guuid=9a930bff-1900-0000-b3eb-f59949090000 pid=2377 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=9a930bff-1900-0000-b3eb-f59949090000 pid=2377 execve guuid=c8d48bff-1900-0000-b3eb-f5994a090000 pid=2378 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=c8d48bff-1900-0000-b3eb-f5994a090000 pid=2378 execve guuid=fc260100-1a00-0000-b3eb-f5994b090000 pid=2379 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=fc260100-1a00-0000-b3eb-f5994b090000 pid=2379 execve guuid=74e9cc00-1a00-0000-b3eb-f5994d090000 pid=2381 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=74e9cc00-1a00-0000-b3eb-f5994d090000 pid=2381 execve guuid=ddbc7a01-1a00-0000-b3eb-f5994f090000 pid=2383 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=ddbc7a01-1a00-0000-b3eb-f5994f090000 pid=2383 execve guuid=c70c1302-1a00-0000-b3eb-f59952090000 pid=2386 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=c70c1302-1a00-0000-b3eb-f59952090000 pid=2386 execve guuid=5bd38a02-1a00-0000-b3eb-f59954090000 pid=2388 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=5bd38a02-1a00-0000-b3eb-f59954090000 pid=2388 execve guuid=6f959f03-1a00-0000-b3eb-f59957090000 pid=2391 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=6f959f03-1a00-0000-b3eb-f59957090000 pid=2391 execve guuid=16373704-1a00-0000-b3eb-f59958090000 pid=2392 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=16373704-1a00-0000-b3eb-f59958090000 pid=2392 execve guuid=1abbd404-1a00-0000-b3eb-f59959090000 pid=2393 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=1abbd404-1a00-0000-b3eb-f59959090000 pid=2393 execve guuid=1535af05-1a00-0000-b3eb-f5995a090000 pid=2394 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=1535af05-1a00-0000-b3eb-f5995a090000 pid=2394 execve guuid=a2bc3a06-1a00-0000-b3eb-f5995b090000 pid=2395 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=a2bc3a06-1a00-0000-b3eb-f5995b090000 pid=2395 execve guuid=86f2bd06-1a00-0000-b3eb-f5995c090000 pid=2396 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=86f2bd06-1a00-0000-b3eb-f5995c090000 pid=2396 execve guuid=02722f07-1a00-0000-b3eb-f5995d090000 pid=2397 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=02722f07-1a00-0000-b3eb-f5995d090000 pid=2397 execve guuid=4e78b407-1a00-0000-b3eb-f5995e090000 pid=2398 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=4e78b407-1a00-0000-b3eb-f5995e090000 pid=2398 execve guuid=68ef5608-1a00-0000-b3eb-f5995f090000 pid=2399 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=68ef5608-1a00-0000-b3eb-f5995f090000 pid=2399 execve guuid=19e80409-1a00-0000-b3eb-f59960090000 pid=2400 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=19e80409-1a00-0000-b3eb-f59960090000 pid=2400 execve guuid=a3f9ae09-1a00-0000-b3eb-f59961090000 pid=2401 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=a3f9ae09-1a00-0000-b3eb-f59961090000 pid=2401 execve guuid=8a754d0a-1a00-0000-b3eb-f59962090000 pid=2402 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=8a754d0a-1a00-0000-b3eb-f59962090000 pid=2402 execve guuid=0bca040b-1a00-0000-b3eb-f59963090000 pid=2403 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=0bca040b-1a00-0000-b3eb-f59963090000 pid=2403 execve guuid=2b05970b-1a00-0000-b3eb-f59964090000 pid=2404 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=2b05970b-1a00-0000-b3eb-f59964090000 pid=2404 execve guuid=b931d70c-1a00-0000-b3eb-f59965090000 pid=2405 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=b931d70c-1a00-0000-b3eb-f59965090000 pid=2405 execve guuid=ff66800d-1a00-0000-b3eb-f59966090000 pid=2406 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=ff66800d-1a00-0000-b3eb-f59966090000 pid=2406 execve guuid=bfbb420e-1a00-0000-b3eb-f59967090000 pid=2407 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=bfbb420e-1a00-0000-b3eb-f59967090000 pid=2407 execve guuid=a80fb10e-1a00-0000-b3eb-f59968090000 pid=2408 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=a80fb10e-1a00-0000-b3eb-f59968090000 pid=2408 execve guuid=86bc220f-1a00-0000-b3eb-f5996a090000 pid=2410 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=86bc220f-1a00-0000-b3eb-f5996a090000 pid=2410 execve guuid=6f118a0f-1a00-0000-b3eb-f5996b090000 pid=2411 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=6f118a0f-1a00-0000-b3eb-f5996b090000 pid=2411 execve guuid=e204f50f-1a00-0000-b3eb-f5996e090000 pid=2414 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=e204f50f-1a00-0000-b3eb-f5996e090000 pid=2414 execve guuid=abd97e10-1a00-0000-b3eb-f59970090000 pid=2416 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=abd97e10-1a00-0000-b3eb-f59970090000 pid=2416 execve guuid=7848f110-1a00-0000-b3eb-f59973090000 pid=2419 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=7848f110-1a00-0000-b3eb-f59973090000 pid=2419 execve guuid=1c509111-1a00-0000-b3eb-f59976090000 pid=2422 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=1c509111-1a00-0000-b3eb-f59976090000 pid=2422 execve guuid=240b0212-1a00-0000-b3eb-f59978090000 pid=2424 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=240b0212-1a00-0000-b3eb-f59978090000 pid=2424 execve guuid=ff888512-1a00-0000-b3eb-f5997a090000 pid=2426 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=ff888512-1a00-0000-b3eb-f5997a090000 pid=2426 execve guuid=3c0a2313-1a00-0000-b3eb-f5997c090000 pid=2428 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=3c0a2313-1a00-0000-b3eb-f5997c090000 pid=2428 execve guuid=eab7b113-1a00-0000-b3eb-f5997f090000 pid=2431 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=eab7b113-1a00-0000-b3eb-f5997f090000 pid=2431 execve guuid=3fe62614-1a00-0000-b3eb-f59981090000 pid=2433 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=3fe62614-1a00-0000-b3eb-f59981090000 pid=2433 execve guuid=0480a614-1a00-0000-b3eb-f59983090000 pid=2435 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=0480a614-1a00-0000-b3eb-f59983090000 pid=2435 execve guuid=40551f15-1a00-0000-b3eb-f59986090000 pid=2438 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=40551f15-1a00-0000-b3eb-f59986090000 pid=2438 execve guuid=665ea415-1a00-0000-b3eb-f59989090000 pid=2441 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=665ea415-1a00-0000-b3eb-f59989090000 pid=2441 execve guuid=cc5d3016-1a00-0000-b3eb-f5998a090000 pid=2442 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=cc5d3016-1a00-0000-b3eb-f5998a090000 pid=2442 execve guuid=e43fc216-1a00-0000-b3eb-f5998c090000 pid=2444 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=e43fc216-1a00-0000-b3eb-f5998c090000 pid=2444 execve guuid=e84a7417-1a00-0000-b3eb-f5998d090000 pid=2445 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=e84a7417-1a00-0000-b3eb-f5998d090000 pid=2445 execve guuid=da80e417-1a00-0000-b3eb-f5998f090000 pid=2447 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=da80e417-1a00-0000-b3eb-f5998f090000 pid=2447 execve guuid=06d64818-1a00-0000-b3eb-f59991090000 pid=2449 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=06d64818-1a00-0000-b3eb-f59991090000 pid=2449 execve guuid=3737a418-1a00-0000-b3eb-f59993090000 pid=2451 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=3737a418-1a00-0000-b3eb-f59993090000 pid=2451 execve guuid=13a40219-1a00-0000-b3eb-f59996090000 pid=2454 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=13a40219-1a00-0000-b3eb-f59996090000 pid=2454 execve guuid=6a3e6119-1a00-0000-b3eb-f59998090000 pid=2456 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=6a3e6119-1a00-0000-b3eb-f59998090000 pid=2456 execve guuid=0952b919-1a00-0000-b3eb-f5999a090000 pid=2458 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=0952b919-1a00-0000-b3eb-f5999a090000 pid=2458 execve guuid=f3ef1f1a-1a00-0000-b3eb-f5999b090000 pid=2459 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=f3ef1f1a-1a00-0000-b3eb-f5999b090000 pid=2459 execve guuid=f72c931a-1a00-0000-b3eb-f5999c090000 pid=2460 /usr/bin/ls guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=f72c931a-1a00-0000-b3eb-f5999c090000 pid=2460 execve guuid=2e08fc1a-1a00-0000-b3eb-f5999e090000 pid=2462 /usr/bin/rm guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=2e08fc1a-1a00-0000-b3eb-f5999e090000 pid=2462 execve guuid=9955591b-1a00-0000-b3eb-f599a0090000 pid=2464 /usr/bin/wget net send-data write-file guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=9955591b-1a00-0000-b3eb-f599a0090000 pid=2464 execve guuid=3f69a923-1a00-0000-b3eb-f599b3090000 pid=2483 /usr/bin/chmod guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=3f69a923-1a00-0000-b3eb-f599b3090000 pid=2483 execve guuid=5c360324-1a00-0000-b3eb-f599b6090000 pid=2486 /tmp/VOEi guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=5c360324-1a00-0000-b3eb-f599b6090000 pid=2486 execve guuid=f8061125-1a00-0000-b3eb-f599b9090000 pid=2489 /usr/bin/rm guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=f8061125-1a00-0000-b3eb-f599b9090000 pid=2489 execve guuid=bd596325-1a00-0000-b3eb-f599bb090000 pid=2491 /usr/bin/wget net send-data write-file guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=bd596325-1a00-0000-b3eb-f599bb090000 pid=2491 execve guuid=e58ffd2b-1a00-0000-b3eb-f599c7090000 pid=2503 /usr/bin/chmod guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=e58ffd2b-1a00-0000-b3eb-f599c7090000 pid=2503 execve guuid=2857842c-1a00-0000-b3eb-f599c8090000 pid=2504 /tmp/Wtfh guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=2857842c-1a00-0000-b3eb-f599c8090000 pid=2504 execve guuid=55c1bc2d-1a00-0000-b3eb-f599cd090000 pid=2509 /usr/bin/rm guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=55c1bc2d-1a00-0000-b3eb-f599cd090000 pid=2509 execve guuid=d72f172e-1a00-0000-b3eb-f599ce090000 pid=2510 /usr/bin/wget net send-data write-file guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=d72f172e-1a00-0000-b3eb-f599ce090000 pid=2510 execve guuid=b80d8134-1a00-0000-b3eb-f599d8090000 pid=2520 /usr/bin/chmod guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=b80d8134-1a00-0000-b3eb-f599d8090000 pid=2520 execve guuid=2e0ee234-1a00-0000-b3eb-f599d9090000 pid=2521 /tmp/6W5 guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=2e0ee234-1a00-0000-b3eb-f599d9090000 pid=2521 execve guuid=f373fb36-1a00-0000-b3eb-f599df090000 pid=2527 /usr/bin/rm guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=f373fb36-1a00-0000-b3eb-f599df090000 pid=2527 execve guuid=b0d24d37-1a00-0000-b3eb-f599e1090000 pid=2529 /usr/bin/wget net send-data write-file guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=b0d24d37-1a00-0000-b3eb-f599e1090000 pid=2529 execve guuid=142eac3d-1a00-0000-b3eb-f599ee090000 pid=2542 /usr/bin/chmod guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=142eac3d-1a00-0000-b3eb-f599ee090000 pid=2542 execve guuid=0804f33d-1a00-0000-b3eb-f599f0090000 pid=2544 /tmp/tzo guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=0804f33d-1a00-0000-b3eb-f599f0090000 pid=2544 execve guuid=5d56703f-1a00-0000-b3eb-f599f5090000 pid=2549 /usr/bin/rm guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=5d56703f-1a00-0000-b3eb-f599f5090000 pid=2549 execve guuid=21fda53f-1a00-0000-b3eb-f599f6090000 pid=2550 /usr/bin/wget net send-data write-file guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=21fda53f-1a00-0000-b3eb-f599f6090000 pid=2550 execve guuid=3844eb62-1a00-0000-b3eb-f5994a0a0000 pid=2634 /usr/bin/chmod guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=3844eb62-1a00-0000-b3eb-f5994a0a0000 pid=2634 execve guuid=21f14463-1a00-0000-b3eb-f5994b0a0000 pid=2635 /tmp/3aEI guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=21f14463-1a00-0000-b3eb-f5994b0a0000 pid=2635 execve guuid=f860d065-1a00-0000-b3eb-f599500a0000 pid=2640 /usr/bin/rm delete-file guuid=f36f1ddc-1900-0000-b3eb-f59904090000 pid=2308->guuid=f860d065-1a00-0000-b3eb-f599500a0000 pid=2640 execve 9554d36e-3083-568e-90da-bb8e3c487b07 188.132.232.81:80 guuid=9955591b-1a00-0000-b3eb-f599a0090000 pid=2464->9554d36e-3083-568e-90da-bb8e3c487b07 send: 133B guuid=bd596325-1a00-0000-b3eb-f599bb090000 pid=2491->9554d36e-3083-568e-90da-bb8e3c487b07 send: 133B guuid=d72f172e-1a00-0000-b3eb-f599ce090000 pid=2510->9554d36e-3083-568e-90da-bb8e3c487b07 send: 132B guuid=b0d24d37-1a00-0000-b3eb-f599e1090000 pid=2529->9554d36e-3083-568e-90da-bb8e3c487b07 send: 132B guuid=21fda53f-1a00-0000-b3eb-f599f6090000 pid=2550->9554d36e-3083-568e-90da-bb8e3c487b07 send: 133B
Score:
98%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/eb3f5b3d6037feb5d12bc542aeae18970ad06991a8b953e34e4c7af2581df342
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/eb3f5b3d6037feb5d12bc542aeae18970ad06991a8b953e34e4c7af2581df342/
Threat name:
Win32.Trojan.Malgent
Create hunting rule
Status:
Malicious
First seen:
2026-06-09 20:08:33 UTC
File Type:
Text (Shell)
AV detection:
11 of 23 (47.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5m7vwplag77llujlyvbk5lqys4fna2mrvc4vhy2ojr5pewa56nba._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
defense_evasion discovery linux
Link:
https://tria.ge/reports/260609-ywry8ahy6l/
Behaviour
Reads runtime system information
Writes file to tmp directory
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.26
Link:
https://yomi.yoroi.company/submissions/eb3f5b3d6037feb5d12bc542aeae18970ad06991a8b953e34e4c7af2581df342

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh eb3f5b3d6037feb5d12bc542aeae18970ad06991a8b953e34e4c7af2581df342

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3856431/
  
Delivery method
Distributed via web download

Comments