MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 eea8cf03c487ba1571d4d3891912bb28dcd9fcc57124b463f7986be390a2d002. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: eea8cf03c487ba1571d4d3891912bb28dcd9fcc57124b463f7986be390a2d002
SHA3-384 hash: 2b305048404c08515af826d87a87414c0bd6701e7a726ba23dbb328b35d5cec03780d8d81a9b318c7700bb7db49d8c77
SHA1 hash: a619b064e16569d9c209f9d3320733b0a05b3e8d
MD5 hash: d40dc7f99724f70bbdf529c3382d4219
humanhash: iowa-island-sad-april
File name:lil
Download: download sample
File size:843 bytes
First seen:2026-06-08 15:16:39 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 24:kXCKysE2hi0ziQvZohaXFZn92N8+O3p3FbX:e9Qp+MsXFZo/O3NFbX
TLSH T1E5018CDEC016EB5041D5E89C229B9084B421C3DB36568FF9BFAC187D8BB9E187055F84
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://188.132.232.81/59iun/an/aelf ua-wget
http://188.132.232.81/6987n/an/aelf ua-wget
http://188.132.232.81/gWen/an/aelf ua-wget
http://188.132.232.81/Lqcyn/an/aelf ua-wget
http://188.132.232.81/oxEn/an/aelf ua-wget

Intelligence

File Origin
# of uploads :
1
# of downloads :
44
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive
Link:
https://www.filescan.io/uploads/6a26dd071f652d68656fbfbf/reports/09db6464-7009-41c3-b70d-d860daca3519/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-06-08T12:27:00Z UTC
Last seen:
2026-06-08T12:39:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan-Downloader.Shell.Agent.a
Link:
https://opentip.kaspersky.com/eea8cf03c487ba1571d4d3891912bb28dcd9fcc57124b463f7986be390a2d002/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/402f5cf8-91b1-410e-8a5a-e729983071a9
Behavior Graph:
Download SVG
%3 guuid=807d8b47-1900-0000-4021-453b9d0d0000 pid=3485 /usr/bin/sudo guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486 /tmp/sample.bin write-file guuid=807d8b47-1900-0000-4021-453b9d0d0000 pid=3485->guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486 execve guuid=959f6f49-1900-0000-4021-453b9f0d0000 pid=3487 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=959f6f49-1900-0000-4021-453b9f0d0000 pid=3487 execve guuid=b8a5104a-1900-0000-4021-453ba00d0000 pid=3488 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=b8a5104a-1900-0000-4021-453ba00d0000 pid=3488 execve guuid=a4276e4a-1900-0000-4021-453ba10d0000 pid=3489 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=a4276e4a-1900-0000-4021-453ba10d0000 pid=3489 execve guuid=966dc94a-1900-0000-4021-453ba20d0000 pid=3490 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=966dc94a-1900-0000-4021-453ba20d0000 pid=3490 execve guuid=2dd5214b-1900-0000-4021-453ba30d0000 pid=3491 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=2dd5214b-1900-0000-4021-453ba30d0000 pid=3491 execve guuid=6aa67d4b-1900-0000-4021-453ba40d0000 pid=3492 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=6aa67d4b-1900-0000-4021-453ba40d0000 pid=3492 execve guuid=7a92d84b-1900-0000-4021-453ba50d0000 pid=3493 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=7a92d84b-1900-0000-4021-453ba50d0000 pid=3493 execve guuid=faef384c-1900-0000-4021-453ba60d0000 pid=3494 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=faef384c-1900-0000-4021-453ba60d0000 pid=3494 execve guuid=9fa3954c-1900-0000-4021-453ba70d0000 pid=3495 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=9fa3954c-1900-0000-4021-453ba70d0000 pid=3495 execve guuid=825bf44c-1900-0000-4021-453ba80d0000 pid=3496 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=825bf44c-1900-0000-4021-453ba80d0000 pid=3496 execve guuid=335b504d-1900-0000-4021-453bac0d0000 pid=3500 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=335b504d-1900-0000-4021-453bac0d0000 pid=3500 execve guuid=c0b2ad4d-1900-0000-4021-453bad0d0000 pid=3501 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=c0b2ad4d-1900-0000-4021-453bad0d0000 pid=3501 execve guuid=a3451d4e-1900-0000-4021-453baf0d0000 pid=3503 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=a3451d4e-1900-0000-4021-453baf0d0000 pid=3503 execve guuid=ddeb8a4e-1900-0000-4021-453bb10d0000 pid=3505 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=ddeb8a4e-1900-0000-4021-453bb10d0000 pid=3505 execve guuid=d4a5064f-1900-0000-4021-453bb30d0000 pid=3507 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=d4a5064f-1900-0000-4021-453bb30d0000 pid=3507 execve guuid=af68774f-1900-0000-4021-453bb50d0000 pid=3509 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=af68774f-1900-0000-4021-453bb50d0000 pid=3509 execve guuid=f074dd4f-1900-0000-4021-453bb80d0000 pid=3512 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=f074dd4f-1900-0000-4021-453bb80d0000 pid=3512 execve guuid=d3664550-1900-0000-4021-453bbb0d0000 pid=3515 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=d3664550-1900-0000-4021-453bbb0d0000 pid=3515 execve guuid=62e1a050-1900-0000-4021-453bbd0d0000 pid=3517 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=62e1a050-1900-0000-4021-453bbd0d0000 pid=3517 execve guuid=a90aff50-1900-0000-4021-453bbf0d0000 pid=3519 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=a90aff50-1900-0000-4021-453bbf0d0000 pid=3519 execve guuid=c3a26851-1900-0000-4021-453bc10d0000 pid=3521 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=c3a26851-1900-0000-4021-453bc10d0000 pid=3521 execve guuid=f657d151-1900-0000-4021-453bc20d0000 pid=3522 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=f657d151-1900-0000-4021-453bc20d0000 pid=3522 execve guuid=0fd73952-1900-0000-4021-453bc30d0000 pid=3523 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=0fd73952-1900-0000-4021-453bc30d0000 pid=3523 execve guuid=69c7a452-1900-0000-4021-453bc50d0000 pid=3525 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=69c7a452-1900-0000-4021-453bc50d0000 pid=3525 execve guuid=13e60853-1900-0000-4021-453bc70d0000 pid=3527 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=13e60853-1900-0000-4021-453bc70d0000 pid=3527 execve guuid=995a6f53-1900-0000-4021-453bc90d0000 pid=3529 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=995a6f53-1900-0000-4021-453bc90d0000 pid=3529 execve guuid=7926d553-1900-0000-4021-453bcb0d0000 pid=3531 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=7926d553-1900-0000-4021-453bcb0d0000 pid=3531 execve guuid=2a843954-1900-0000-4021-453bce0d0000 pid=3534 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=2a843954-1900-0000-4021-453bce0d0000 pid=3534 execve guuid=5514b354-1900-0000-4021-453bcf0d0000 pid=3535 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=5514b354-1900-0000-4021-453bcf0d0000 pid=3535 execve guuid=dd5e3355-1900-0000-4021-453bd00d0000 pid=3536 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=dd5e3355-1900-0000-4021-453bd00d0000 pid=3536 execve guuid=419ac255-1900-0000-4021-453bd10d0000 pid=3537 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=419ac255-1900-0000-4021-453bd10d0000 pid=3537 execve guuid=0d135a56-1900-0000-4021-453bd20d0000 pid=3538 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=0d135a56-1900-0000-4021-453bd20d0000 pid=3538 execve guuid=5c0aef56-1900-0000-4021-453bd30d0000 pid=3539 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=5c0aef56-1900-0000-4021-453bd30d0000 pid=3539 execve guuid=975e7157-1900-0000-4021-453bd50d0000 pid=3541 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=975e7157-1900-0000-4021-453bd50d0000 pid=3541 execve guuid=5e556e58-1900-0000-4021-453bd60d0000 pid=3542 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=5e556e58-1900-0000-4021-453bd60d0000 pid=3542 execve guuid=ccdde658-1900-0000-4021-453bd70d0000 pid=3543 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=ccdde658-1900-0000-4021-453bd70d0000 pid=3543 execve guuid=bfb45659-1900-0000-4021-453bda0d0000 pid=3546 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=bfb45659-1900-0000-4021-453bda0d0000 pid=3546 execve guuid=f74fc059-1900-0000-4021-453bdc0d0000 pid=3548 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=f74fc059-1900-0000-4021-453bdc0d0000 pid=3548 execve guuid=6f0b325a-1900-0000-4021-453bdf0d0000 pid=3551 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=6f0b325a-1900-0000-4021-453bdf0d0000 pid=3551 execve guuid=151ac55a-1900-0000-4021-453be10d0000 pid=3553 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=151ac55a-1900-0000-4021-453be10d0000 pid=3553 execve guuid=6d96575b-1900-0000-4021-453be40d0000 pid=3556 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=6d96575b-1900-0000-4021-453be40d0000 pid=3556 execve guuid=6671d55b-1900-0000-4021-453be60d0000 pid=3558 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=6671d55b-1900-0000-4021-453be60d0000 pid=3558 execve guuid=8ee73b5c-1900-0000-4021-453be80d0000 pid=3560 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=8ee73b5c-1900-0000-4021-453be80d0000 pid=3560 execve guuid=7a4aa85c-1900-0000-4021-453bea0d0000 pid=3562 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=7a4aa85c-1900-0000-4021-453bea0d0000 pid=3562 execve guuid=4f61085d-1900-0000-4021-453bed0d0000 pid=3565 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=4f61085d-1900-0000-4021-453bed0d0000 pid=3565 execve guuid=472f995d-1900-0000-4021-453bef0d0000 pid=3567 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=472f995d-1900-0000-4021-453bef0d0000 pid=3567 execve guuid=3ce65a5e-1900-0000-4021-453bf20d0000 pid=3570 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=3ce65a5e-1900-0000-4021-453bf20d0000 pid=3570 execve guuid=a4670a5f-1900-0000-4021-453bf30d0000 pid=3571 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=a4670a5f-1900-0000-4021-453bf30d0000 pid=3571 execve guuid=4946b55f-1900-0000-4021-453bf40d0000 pid=3572 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=4946b55f-1900-0000-4021-453bf40d0000 pid=3572 execve guuid=79487c60-1900-0000-4021-453bf50d0000 pid=3573 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=79487c60-1900-0000-4021-453bf50d0000 pid=3573 execve guuid=08f63061-1900-0000-4021-453bf60d0000 pid=3574 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=08f63061-1900-0000-4021-453bf60d0000 pid=3574 execve guuid=1f20d261-1900-0000-4021-453bf70d0000 pid=3575 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=1f20d261-1900-0000-4021-453bf70d0000 pid=3575 execve guuid=2ea3a662-1900-0000-4021-453bf80d0000 pid=3576 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=2ea3a662-1900-0000-4021-453bf80d0000 pid=3576 execve guuid=abce6563-1900-0000-4021-453bf90d0000 pid=3577 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=abce6563-1900-0000-4021-453bf90d0000 pid=3577 execve guuid=16a4e763-1900-0000-4021-453bfa0d0000 pid=3578 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=16a4e763-1900-0000-4021-453bfa0d0000 pid=3578 execve guuid=8d496a64-1900-0000-4021-453bfb0d0000 pid=3579 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=8d496a64-1900-0000-4021-453bfb0d0000 pid=3579 execve guuid=cd06f364-1900-0000-4021-453bfd0d0000 pid=3581 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=cd06f364-1900-0000-4021-453bfd0d0000 pid=3581 execve guuid=ee477b65-1900-0000-4021-453bfe0d0000 pid=3582 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=ee477b65-1900-0000-4021-453bfe0d0000 pid=3582 execve guuid=ab71f865-1900-0000-4021-453bff0d0000 pid=3583 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=ab71f865-1900-0000-4021-453bff0d0000 pid=3583 execve guuid=60ab5f66-1900-0000-4021-453b020e0000 pid=3586 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=60ab5f66-1900-0000-4021-453b020e0000 pid=3586 execve guuid=c0823667-1900-0000-4021-453b050e0000 pid=3589 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=c0823667-1900-0000-4021-453b050e0000 pid=3589 execve guuid=d505b867-1900-0000-4021-453b080e0000 pid=3592 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=d505b867-1900-0000-4021-453b080e0000 pid=3592 execve guuid=4ecc2d68-1900-0000-4021-453b0a0e0000 pid=3594 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=4ecc2d68-1900-0000-4021-453b0a0e0000 pid=3594 execve guuid=51298e68-1900-0000-4021-453b0d0e0000 pid=3597 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=51298e68-1900-0000-4021-453b0d0e0000 pid=3597 execve guuid=5399ee68-1900-0000-4021-453b0f0e0000 pid=3599 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=5399ee68-1900-0000-4021-453b0f0e0000 pid=3599 execve guuid=18de5269-1900-0000-4021-453b120e0000 pid=3602 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=18de5269-1900-0000-4021-453b120e0000 pid=3602 execve guuid=cf6aba69-1900-0000-4021-453b140e0000 pid=3604 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=cf6aba69-1900-0000-4021-453b140e0000 pid=3604 execve guuid=e655296a-1900-0000-4021-453b160e0000 pid=3606 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=e655296a-1900-0000-4021-453b160e0000 pid=3606 execve guuid=e650be6a-1900-0000-4021-453b190e0000 pid=3609 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=e650be6a-1900-0000-4021-453b190e0000 pid=3609 execve guuid=fd1e396b-1900-0000-4021-453b1b0e0000 pid=3611 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=fd1e396b-1900-0000-4021-453b1b0e0000 pid=3611 execve guuid=4c33ae6b-1900-0000-4021-453b1d0e0000 pid=3613 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=4c33ae6b-1900-0000-4021-453b1d0e0000 pid=3613 execve guuid=a27b2d6c-1900-0000-4021-453b200e0000 pid=3616 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=a27b2d6c-1900-0000-4021-453b200e0000 pid=3616 execve guuid=f056bf6c-1900-0000-4021-453b230e0000 pid=3619 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=f056bf6c-1900-0000-4021-453b230e0000 pid=3619 execve guuid=89575d6d-1900-0000-4021-453b250e0000 pid=3621 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=89575d6d-1900-0000-4021-453b250e0000 pid=3621 execve guuid=aff3c06d-1900-0000-4021-453b280e0000 pid=3624 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=aff3c06d-1900-0000-4021-453b280e0000 pid=3624 execve guuid=2cd2666e-1900-0000-4021-453b2b0e0000 pid=3627 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=2cd2666e-1900-0000-4021-453b2b0e0000 pid=3627 execve guuid=3f73bf6e-1900-0000-4021-453b2d0e0000 pid=3629 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=3f73bf6e-1900-0000-4021-453b2d0e0000 pid=3629 execve guuid=1590186f-1900-0000-4021-453b320e0000 pid=3634 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=1590186f-1900-0000-4021-453b320e0000 pid=3634 execve guuid=28547e6f-1900-0000-4021-453b330e0000 pid=3635 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=28547e6f-1900-0000-4021-453b330e0000 pid=3635 execve guuid=f7b5dd6f-1900-0000-4021-453b350e0000 pid=3637 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=f7b5dd6f-1900-0000-4021-453b350e0000 pid=3637 execve guuid=22434570-1900-0000-4021-453b370e0000 pid=3639 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=22434570-1900-0000-4021-453b370e0000 pid=3639 execve guuid=7f0ca970-1900-0000-4021-453b380e0000 pid=3640 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=7f0ca970-1900-0000-4021-453b380e0000 pid=3640 execve guuid=490e1071-1900-0000-4021-453b3a0e0000 pid=3642 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=490e1071-1900-0000-4021-453b3a0e0000 pid=3642 execve guuid=3a087a71-1900-0000-4021-453b3d0e0000 pid=3645 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=3a087a71-1900-0000-4021-453b3d0e0000 pid=3645 execve guuid=4e11d571-1900-0000-4021-453b3e0e0000 pid=3646 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=4e11d571-1900-0000-4021-453b3e0e0000 pid=3646 execve guuid=344e7c72-1900-0000-4021-453b410e0000 pid=3649 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=344e7c72-1900-0000-4021-453b410e0000 pid=3649 execve guuid=77441e73-1900-0000-4021-453b450e0000 pid=3653 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=77441e73-1900-0000-4021-453b450e0000 pid=3653 execve guuid=3bcb9373-1900-0000-4021-453b470e0000 pid=3655 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=3bcb9373-1900-0000-4021-453b470e0000 pid=3655 execve guuid=297ef573-1900-0000-4021-453b490e0000 pid=3657 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=297ef573-1900-0000-4021-453b490e0000 pid=3657 execve guuid=e1f77e74-1900-0000-4021-453b4c0e0000 pid=3660 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=e1f77e74-1900-0000-4021-453b4c0e0000 pid=3660 execve guuid=f4711675-1900-0000-4021-453b4f0e0000 pid=3663 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=f4711675-1900-0000-4021-453b4f0e0000 pid=3663 execve guuid=2c3ea875-1900-0000-4021-453b520e0000 pid=3666 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=2c3ea875-1900-0000-4021-453b520e0000 pid=3666 execve guuid=4abb2276-1900-0000-4021-453b550e0000 pid=3669 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=4abb2276-1900-0000-4021-453b550e0000 pid=3669 execve guuid=32869976-1900-0000-4021-453b570e0000 pid=3671 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=32869976-1900-0000-4021-453b570e0000 pid=3671 execve guuid=c1a40077-1900-0000-4021-453b590e0000 pid=3673 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=c1a40077-1900-0000-4021-453b590e0000 pid=3673 execve guuid=39106d77-1900-0000-4021-453b5c0e0000 pid=3676 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=39106d77-1900-0000-4021-453b5c0e0000 pid=3676 execve guuid=6fa9dd77-1900-0000-4021-453b5e0e0000 pid=3678 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=6fa9dd77-1900-0000-4021-453b5e0e0000 pid=3678 execve guuid=5f386678-1900-0000-4021-453b600e0000 pid=3680 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=5f386678-1900-0000-4021-453b600e0000 pid=3680 execve guuid=ef0ac978-1900-0000-4021-453b620e0000 pid=3682 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=ef0ac978-1900-0000-4021-453b620e0000 pid=3682 execve guuid=442b2c79-1900-0000-4021-453b650e0000 pid=3685 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=442b2c79-1900-0000-4021-453b650e0000 pid=3685 execve guuid=ea268979-1900-0000-4021-453b670e0000 pid=3687 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=ea268979-1900-0000-4021-453b670e0000 pid=3687 execve guuid=9897e579-1900-0000-4021-453b690e0000 pid=3689 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=9897e579-1900-0000-4021-453b690e0000 pid=3689 execve guuid=aeeb447a-1900-0000-4021-453b6b0e0000 pid=3691 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=aeeb447a-1900-0000-4021-453b6b0e0000 pid=3691 execve guuid=309ea57a-1900-0000-4021-453b6e0e0000 pid=3694 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=309ea57a-1900-0000-4021-453b6e0e0000 pid=3694 execve guuid=2c0f0c7b-1900-0000-4021-453b700e0000 pid=3696 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=2c0f0c7b-1900-0000-4021-453b700e0000 pid=3696 execve guuid=6bb66d7b-1900-0000-4021-453b720e0000 pid=3698 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=6bb66d7b-1900-0000-4021-453b720e0000 pid=3698 execve guuid=b76dc97b-1900-0000-4021-453b740e0000 pid=3700 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=b76dc97b-1900-0000-4021-453b740e0000 pid=3700 execve guuid=dc53277c-1900-0000-4021-453b770e0000 pid=3703 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=dc53277c-1900-0000-4021-453b770e0000 pid=3703 execve guuid=13807e7c-1900-0000-4021-453b790e0000 pid=3705 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=13807e7c-1900-0000-4021-453b790e0000 pid=3705 execve guuid=c36ed67c-1900-0000-4021-453b7b0e0000 pid=3707 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=c36ed67c-1900-0000-4021-453b7b0e0000 pid=3707 execve guuid=44b32e7d-1900-0000-4021-453b7c0e0000 pid=3708 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=44b32e7d-1900-0000-4021-453b7c0e0000 pid=3708 execve guuid=1e28917d-1900-0000-4021-453b7e0e0000 pid=3710 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=1e28917d-1900-0000-4021-453b7e0e0000 pid=3710 execve guuid=28c7ec7d-1900-0000-4021-453b800e0000 pid=3712 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=28c7ec7d-1900-0000-4021-453b800e0000 pid=3712 execve guuid=2cfe4c7e-1900-0000-4021-453b820e0000 pid=3714 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=2cfe4c7e-1900-0000-4021-453b820e0000 pid=3714 execve guuid=b2b1a57e-1900-0000-4021-453b850e0000 pid=3717 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=b2b1a57e-1900-0000-4021-453b850e0000 pid=3717 execve guuid=ed86037f-1900-0000-4021-453b870e0000 pid=3719 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=ed86037f-1900-0000-4021-453b870e0000 pid=3719 execve guuid=6ed0647f-1900-0000-4021-453b8a0e0000 pid=3722 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=6ed0647f-1900-0000-4021-453b8a0e0000 pid=3722 execve guuid=2ccfc37f-1900-0000-4021-453b8c0e0000 pid=3724 /usr/bin/ls guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=2ccfc37f-1900-0000-4021-453b8c0e0000 pid=3724 execve guuid=e0882180-1900-0000-4021-453b8e0e0000 pid=3726 /usr/bin/rm guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=e0882180-1900-0000-4021-453b8e0e0000 pid=3726 execve guuid=d6c05a80-1900-0000-4021-453b900e0000 pid=3728 /usr/bin/wget net send-data write-file guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=d6c05a80-1900-0000-4021-453b900e0000 pid=3728 execve guuid=0aab4c88-1900-0000-4021-453bae0e0000 pid=3758 /usr/bin/chmod guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=0aab4c88-1900-0000-4021-453bae0e0000 pid=3758 execve guuid=6cab8c88-1900-0000-4021-453baf0e0000 pid=3759 /tmp/59iu guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=6cab8c88-1900-0000-4021-453baf0e0000 pid=3759 execve guuid=9f584e8a-1900-0000-4021-453bb60e0000 pid=3766 /usr/bin/rm guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=9f584e8a-1900-0000-4021-453bb60e0000 pid=3766 execve guuid=4901878a-1900-0000-4021-453bb80e0000 pid=3768 /usr/bin/wget net send-data write-file guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=4901878a-1900-0000-4021-453bb80e0000 pid=3768 execve guuid=e9659f96-1900-0000-4021-453bc70e0000 pid=3783 /usr/bin/chmod guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=e9659f96-1900-0000-4021-453bc70e0000 pid=3783 execve guuid=5e6bed96-1900-0000-4021-453bc80e0000 pid=3784 /tmp/6987 guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=5e6bed96-1900-0000-4021-453bc80e0000 pid=3784 execve guuid=b3d5c097-1900-0000-4021-453bca0e0000 pid=3786 /usr/bin/rm guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=b3d5c097-1900-0000-4021-453bca0e0000 pid=3786 execve guuid=2dcf0b98-1900-0000-4021-453bcb0e0000 pid=3787 /usr/bin/wget net send-data write-file guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=2dcf0b98-1900-0000-4021-453bcb0e0000 pid=3787 execve guuid=d240b99f-1900-0000-4021-453bcc0e0000 pid=3788 /usr/bin/chmod guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=d240b99f-1900-0000-4021-453bcc0e0000 pid=3788 execve guuid=33c801a0-1900-0000-4021-453bce0e0000 pid=3790 /tmp/gWe guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=33c801a0-1900-0000-4021-453bce0e0000 pid=3790 execve guuid=cd02b0a0-1900-0000-4021-453bd50e0000 pid=3797 /usr/bin/rm guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=cd02b0a0-1900-0000-4021-453bd50e0000 pid=3797 execve guuid=41f0f0a0-1900-0000-4021-453bd60e0000 pid=3798 /usr/bin/wget net send-data write-file guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=41f0f0a0-1900-0000-4021-453bd60e0000 pid=3798 execve guuid=db0669b6-1900-0000-4021-453b1d0f0000 pid=3869 /usr/bin/chmod guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=db0669b6-1900-0000-4021-453b1d0f0000 pid=3869 execve guuid=2afaa3b6-1900-0000-4021-453b210f0000 pid=3873 /tmp/Lqcy guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=2afaa3b6-1900-0000-4021-453b210f0000 pid=3873 execve guuid=feca7bb7-1900-0000-4021-453b250f0000 pid=3877 /usr/bin/rm guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=feca7bb7-1900-0000-4021-453b250f0000 pid=3877 execve guuid=79ffc2b7-1900-0000-4021-453b270f0000 pid=3879 /usr/bin/wget net send-data write-file guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=79ffc2b7-1900-0000-4021-453b270f0000 pid=3879 execve guuid=4669aff9-1900-0000-4021-453b0a100000 pid=4106 /usr/bin/chmod guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=4669aff9-1900-0000-4021-453b0a100000 pid=4106 execve guuid=423eedf9-1900-0000-4021-453b0d100000 pid=4109 /tmp/oxE guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=423eedf9-1900-0000-4021-453b0d100000 pid=4109 execve guuid=6565c3fb-1900-0000-4021-453b16100000 pid=4118 /usr/bin/rm delete-file guuid=3da62f49-1900-0000-4021-453b9e0d0000 pid=3486->guuid=6565c3fb-1900-0000-4021-453b16100000 pid=4118 execve 9554d36e-3083-568e-90da-bb8e3c487b07 188.132.232.81:80 guuid=d6c05a80-1900-0000-4021-453b900e0000 pid=3728->9554d36e-3083-568e-90da-bb8e3c487b07 send: 133B guuid=4901878a-1900-0000-4021-453bb80e0000 pid=3768->9554d36e-3083-568e-90da-bb8e3c487b07 send: 133B guuid=2dcf0b98-1900-0000-4021-453bcb0e0000 pid=3787->9554d36e-3083-568e-90da-bb8e3c487b07 send: 132B guuid=41f0f0a0-1900-0000-4021-453bd60e0000 pid=3798->9554d36e-3083-568e-90da-bb8e3c487b07 send: 133B guuid=79ffc2b7-1900-0000-4021-453b270f0000 pid=3879->9554d36e-3083-568e-90da-bb8e3c487b07 send: 132B
Score:
99%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/eea8cf03c487ba1571d4d3891912bb28dcd9fcc57124b463f7986be390a2d002
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/eea8cf03c487ba1571d4d3891912bb28dcd9fcc57124b463f7986be390a2d002/
Verdict:
Malicious
Threat:
Family.MIRAI
Link:
https://tip.neiki.dev/file/eea8cf03c487ba1571d4d3891912bb28dcd9fcc57124b463f7986be390a2d002
Threat name:
Win32.Trojan.Vigorf
Create hunting rule
Status:
Malicious
First seen:
2026-06-08 15:17:27 UTC
File Type:
Text (Shell)
AV detection:
10 of 24 (41.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=52um6a6eq65bk4ou2oersev3fdont7gfoesliy7xtbv6hefc2aba._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
defense_evasion discovery linux
Link:
https://tria.ge/reports/260608-spbqrsfw7m/
Behaviour
Reads runtime system information
Writes file to tmp directory
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.26
Link:
https://yomi.yoroi.company/submissions/eea8cf03c487ba1571d4d3891912bb28dcd9fcc57124b463f7986be390a2d002

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh eea8cf03c487ba1571d4d3891912bb28dcd9fcc57124b463f7986be390a2d002

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3856431/
  
Delivery method
Distributed via web download

Comments