MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f2d6256881cddd0aca9e3594faf0e54bab197c2d9b8ea1c6293c6b3cdac9b784. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f2d6256881cddd0aca9e3594faf0e54bab197c2d9b8ea1c6293c6b3cdac9b784
SHA3-384 hash: abf06c31a4b33d9b901bf015eb1d0ed9582cd47d6f18cc7cfdb09d1f9733f685bd6aa1ce1ed1d2f2acfc25608dd5b537
SHA1 hash: b7ace4811dd322f145d10c431f54c93bd3dd99db
MD5 hash: 2ec8bb63402af9e9947ecaea5990ad31
humanhash: west-fruit-monkey-illinois
File name:lil
Download: download sample
File size:843 bytes
First seen:2026-06-06 14:43:16 UTC
Last seen:2026-06-07 03:31:48 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 24:kXCKysE2hi0ziQvZohaOzJ2qRBEEvCYp6X:e9Qp+MsOIQ6EvCYp6X
TLSH T146018CCEC4269A1041D6D85C22E75044B820C3CB254A8FAABF5C147E8F69E547015FD4
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://188.132.232.81/VoXdn/an/aelf ua-wget
http://188.132.232.81/8V4sn/an/aelf ua-wget
http://188.132.232.81/V41n/an/aelf ua-wget
http://188.132.232.81/MTkZn/an/aelf ua-wget
http://188.132.232.81/cEen/an/aelf ua-wget

Intelligence

File Origin
# of uploads :
3
# of downloads :
58
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive
Link:
https://www.filescan.io/uploads/6a24320b099ef368af23cf90/reports/593a8f9c-a078-4fb1-86e2-ecfe7fedc55c/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-06-06T11:51:00Z UTC
Last seen:
2026-06-08T01:40:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan-Downloader.Shell.Agent.a
Link:
https://opentip.kaspersky.com/f2d6256881cddd0aca9e3594faf0e54bab197c2d9b8ea1c6293c6b3cdac9b784/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/577198d2-7974-45b4-8077-386ef0356476
Behavior Graph:
Download SVG
%3 guuid=e526cbd9-1600-0000-7d67-cef5440d0000 pid=3396 /usr/bin/sudo guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404 /tmp/sample.bin write-file guuid=e526cbd9-1600-0000-7d67-cef5440d0000 pid=3396->guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404 execve guuid=35d4d8db-1600-0000-7d67-cef54e0d0000 pid=3406 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=35d4d8db-1600-0000-7d67-cef54e0d0000 pid=3406 execve guuid=f5f440dc-1600-0000-7d67-cef5500d0000 pid=3408 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=f5f440dc-1600-0000-7d67-cef5500d0000 pid=3408 execve guuid=9675a3dc-1600-0000-7d67-cef5520d0000 pid=3410 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=9675a3dc-1600-0000-7d67-cef5520d0000 pid=3410 execve guuid=0a2225dd-1600-0000-7d67-cef5550d0000 pid=3413 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=0a2225dd-1600-0000-7d67-cef5550d0000 pid=3413 execve guuid=81da79dd-1600-0000-7d67-cef5580d0000 pid=3416 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=81da79dd-1600-0000-7d67-cef5580d0000 pid=3416 execve guuid=258acbdd-1600-0000-7d67-cef55a0d0000 pid=3418 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=258acbdd-1600-0000-7d67-cef55a0d0000 pid=3418 execve guuid=5f9921de-1600-0000-7d67-cef55c0d0000 pid=3420 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=5f9921de-1600-0000-7d67-cef55c0d0000 pid=3420 execve guuid=2958f1de-1600-0000-7d67-cef5600d0000 pid=3424 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=2958f1de-1600-0000-7d67-cef5600d0000 pid=3424 execve guuid=94b75bdf-1600-0000-7d67-cef5620d0000 pid=3426 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=94b75bdf-1600-0000-7d67-cef5620d0000 pid=3426 execve guuid=f1bec2df-1600-0000-7d67-cef5650d0000 pid=3429 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=f1bec2df-1600-0000-7d67-cef5650d0000 pid=3429 execve guuid=a04c5be0-1600-0000-7d67-cef5680d0000 pid=3432 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=a04c5be0-1600-0000-7d67-cef5680d0000 pid=3432 execve guuid=e409c0e0-1600-0000-7d67-cef56a0d0000 pid=3434 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=e409c0e0-1600-0000-7d67-cef56a0d0000 pid=3434 execve guuid=81d622e1-1600-0000-7d67-cef56d0d0000 pid=3437 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=81d622e1-1600-0000-7d67-cef56d0d0000 pid=3437 execve guuid=5d3cabe1-1600-0000-7d67-cef56f0d0000 pid=3439 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=5d3cabe1-1600-0000-7d67-cef56f0d0000 pid=3439 execve guuid=fe5017e2-1600-0000-7d67-cef5720d0000 pid=3442 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=fe5017e2-1600-0000-7d67-cef5720d0000 pid=3442 execve guuid=6cf680e2-1600-0000-7d67-cef5740d0000 pid=3444 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=6cf680e2-1600-0000-7d67-cef5740d0000 pid=3444 execve guuid=cd3e11e3-1600-0000-7d67-cef5770d0000 pid=3447 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=cd3e11e3-1600-0000-7d67-cef5770d0000 pid=3447 execve guuid=090886e3-1600-0000-7d67-cef57a0d0000 pid=3450 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=090886e3-1600-0000-7d67-cef57a0d0000 pid=3450 execve guuid=ff3df3e3-1600-0000-7d67-cef57c0d0000 pid=3452 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=ff3df3e3-1600-0000-7d67-cef57c0d0000 pid=3452 execve guuid=4d5663e4-1600-0000-7d67-cef57e0d0000 pid=3454 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=4d5663e4-1600-0000-7d67-cef57e0d0000 pid=3454 execve guuid=4bb1d7e4-1600-0000-7d67-cef5800d0000 pid=3456 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=4bb1d7e4-1600-0000-7d67-cef5800d0000 pid=3456 execve guuid=0b2538e5-1600-0000-7d67-cef5830d0000 pid=3459 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=0b2538e5-1600-0000-7d67-cef5830d0000 pid=3459 execve guuid=4cd396e5-1600-0000-7d67-cef5850d0000 pid=3461 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=4cd396e5-1600-0000-7d67-cef5850d0000 pid=3461 execve guuid=1fb1f3e5-1600-0000-7d67-cef5870d0000 pid=3463 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=1fb1f3e5-1600-0000-7d67-cef5870d0000 pid=3463 execve guuid=35274be6-1600-0000-7d67-cef58a0d0000 pid=3466 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=35274be6-1600-0000-7d67-cef58a0d0000 pid=3466 execve guuid=f589a1e6-1600-0000-7d67-cef58c0d0000 pid=3468 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=f589a1e6-1600-0000-7d67-cef58c0d0000 pid=3468 execve guuid=bd11fae6-1600-0000-7d67-cef58f0d0000 pid=3471 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=bd11fae6-1600-0000-7d67-cef58f0d0000 pid=3471 execve guuid=f04858e7-1600-0000-7d67-cef5910d0000 pid=3473 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=f04858e7-1600-0000-7d67-cef5910d0000 pid=3473 execve guuid=41bec7e7-1600-0000-7d67-cef5940d0000 pid=3476 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=41bec7e7-1600-0000-7d67-cef5940d0000 pid=3476 execve guuid=fdd433e8-1600-0000-7d67-cef5960d0000 pid=3478 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=fdd433e8-1600-0000-7d67-cef5960d0000 pid=3478 execve guuid=8c689be8-1600-0000-7d67-cef5980d0000 pid=3480 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=8c689be8-1600-0000-7d67-cef5980d0000 pid=3480 execve guuid=ee9ffbe8-1600-0000-7d67-cef59b0d0000 pid=3483 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=ee9ffbe8-1600-0000-7d67-cef59b0d0000 pid=3483 execve guuid=f42255e9-1600-0000-7d67-cef59d0d0000 pid=3485 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=f42255e9-1600-0000-7d67-cef59d0d0000 pid=3485 execve guuid=b734b1e9-1600-0000-7d67-cef59f0d0000 pid=3487 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=b734b1e9-1600-0000-7d67-cef59f0d0000 pid=3487 execve guuid=78861dea-1600-0000-7d67-cef5a20d0000 pid=3490 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=78861dea-1600-0000-7d67-cef5a20d0000 pid=3490 execve guuid=9e7d8cea-1600-0000-7d67-cef5a40d0000 pid=3492 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=9e7d8cea-1600-0000-7d67-cef5a40d0000 pid=3492 execve guuid=88c1f0ea-1600-0000-7d67-cef5a70d0000 pid=3495 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=88c1f0ea-1600-0000-7d67-cef5a70d0000 pid=3495 execve guuid=25cf4eeb-1600-0000-7d67-cef5a90d0000 pid=3497 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=25cf4eeb-1600-0000-7d67-cef5a90d0000 pid=3497 execve guuid=50b9b7eb-1600-0000-7d67-cef5ab0d0000 pid=3499 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=50b9b7eb-1600-0000-7d67-cef5ab0d0000 pid=3499 execve guuid=53f516ec-1600-0000-7d67-cef5ae0d0000 pid=3502 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=53f516ec-1600-0000-7d67-cef5ae0d0000 pid=3502 execve guuid=43666eec-1600-0000-7d67-cef5b00d0000 pid=3504 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=43666eec-1600-0000-7d67-cef5b00d0000 pid=3504 execve guuid=8c96c9ec-1600-0000-7d67-cef5b20d0000 pid=3506 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=8c96c9ec-1600-0000-7d67-cef5b20d0000 pid=3506 execve guuid=ae1521ed-1600-0000-7d67-cef5b50d0000 pid=3509 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=ae1521ed-1600-0000-7d67-cef5b50d0000 pid=3509 execve guuid=3a9e7ced-1600-0000-7d67-cef5b70d0000 pid=3511 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=3a9e7ced-1600-0000-7d67-cef5b70d0000 pid=3511 execve guuid=d7bfd7ed-1600-0000-7d67-cef5b90d0000 pid=3513 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=d7bfd7ed-1600-0000-7d67-cef5b90d0000 pid=3513 execve guuid=4b6c33ee-1600-0000-7d67-cef5bc0d0000 pid=3516 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=4b6c33ee-1600-0000-7d67-cef5bc0d0000 pid=3516 execve guuid=0b2693ee-1600-0000-7d67-cef5bd0d0000 pid=3517 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=0b2693ee-1600-0000-7d67-cef5bd0d0000 pid=3517 execve guuid=1240f9ee-1600-0000-7d67-cef5c00d0000 pid=3520 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=1240f9ee-1600-0000-7d67-cef5c00d0000 pid=3520 execve guuid=1a704fef-1600-0000-7d67-cef5c20d0000 pid=3522 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=1a704fef-1600-0000-7d67-cef5c20d0000 pid=3522 execve guuid=6d5ba6ef-1600-0000-7d67-cef5c50d0000 pid=3525 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=6d5ba6ef-1600-0000-7d67-cef5c50d0000 pid=3525 execve guuid=e348faef-1600-0000-7d67-cef5c70d0000 pid=3527 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=e348faef-1600-0000-7d67-cef5c70d0000 pid=3527 execve guuid=41144ff0-1600-0000-7d67-cef5c90d0000 pid=3529 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=41144ff0-1600-0000-7d67-cef5c90d0000 pid=3529 execve guuid=6607a1f0-1600-0000-7d67-cef5cc0d0000 pid=3532 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=6607a1f0-1600-0000-7d67-cef5cc0d0000 pid=3532 execve guuid=5a396ff1-1600-0000-7d67-cef5cf0d0000 pid=3535 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=5a396ff1-1600-0000-7d67-cef5cf0d0000 pid=3535 execve guuid=7a79cff1-1600-0000-7d67-cef5d20d0000 pid=3538 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=7a79cff1-1600-0000-7d67-cef5d20d0000 pid=3538 execve guuid=506a37f2-1600-0000-7d67-cef5d70d0000 pid=3543 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=506a37f2-1600-0000-7d67-cef5d70d0000 pid=3543 execve guuid=6c479df2-1600-0000-7d67-cef5d80d0000 pid=3544 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=6c479df2-1600-0000-7d67-cef5d80d0000 pid=3544 execve guuid=1134fff2-1600-0000-7d67-cef5d90d0000 pid=3545 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=1134fff2-1600-0000-7d67-cef5d90d0000 pid=3545 execve guuid=078665f3-1600-0000-7d67-cef5da0d0000 pid=3546 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=078665f3-1600-0000-7d67-cef5da0d0000 pid=3546 execve guuid=237fc3f3-1600-0000-7d67-cef5db0d0000 pid=3547 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=237fc3f3-1600-0000-7d67-cef5db0d0000 pid=3547 execve guuid=53d424f4-1600-0000-7d67-cef5dc0d0000 pid=3548 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=53d424f4-1600-0000-7d67-cef5dc0d0000 pid=3548 execve guuid=9cd185f4-1600-0000-7d67-cef5dd0d0000 pid=3549 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=9cd185f4-1600-0000-7d67-cef5dd0d0000 pid=3549 execve guuid=6329eaf4-1600-0000-7d67-cef5de0d0000 pid=3550 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=6329eaf4-1600-0000-7d67-cef5de0d0000 pid=3550 execve guuid=54c84ff5-1600-0000-7d67-cef5df0d0000 pid=3551 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=54c84ff5-1600-0000-7d67-cef5df0d0000 pid=3551 execve guuid=fea8b2f5-1600-0000-7d67-cef5e00d0000 pid=3552 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=fea8b2f5-1600-0000-7d67-cef5e00d0000 pid=3552 execve guuid=94a11af6-1600-0000-7d67-cef5e10d0000 pid=3553 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=94a11af6-1600-0000-7d67-cef5e10d0000 pid=3553 execve guuid=a37a78f6-1600-0000-7d67-cef5e20d0000 pid=3554 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=a37a78f6-1600-0000-7d67-cef5e20d0000 pid=3554 execve guuid=5803d3f6-1600-0000-7d67-cef5e30d0000 pid=3555 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=5803d3f6-1600-0000-7d67-cef5e30d0000 pid=3555 execve guuid=431442f7-1600-0000-7d67-cef5e70d0000 pid=3559 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=431442f7-1600-0000-7d67-cef5e70d0000 pid=3559 execve guuid=4c35c4f7-1600-0000-7d67-cef5e90d0000 pid=3561 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=4c35c4f7-1600-0000-7d67-cef5e90d0000 pid=3561 execve guuid=3cc47ef8-1600-0000-7d67-cef5ec0d0000 pid=3564 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=3cc47ef8-1600-0000-7d67-cef5ec0d0000 pid=3564 execve guuid=9576e4f8-1600-0000-7d67-cef5ee0d0000 pid=3566 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=9576e4f8-1600-0000-7d67-cef5ee0d0000 pid=3566 execve guuid=09db3df9-1600-0000-7d67-cef5f10d0000 pid=3569 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=09db3df9-1600-0000-7d67-cef5f10d0000 pid=3569 execve guuid=6e62a2f9-1600-0000-7d67-cef5f30d0000 pid=3571 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=6e62a2f9-1600-0000-7d67-cef5f30d0000 pid=3571 execve guuid=ee4100fa-1600-0000-7d67-cef5f60d0000 pid=3574 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=ee4100fa-1600-0000-7d67-cef5f60d0000 pid=3574 execve guuid=d66964fa-1600-0000-7d67-cef5f80d0000 pid=3576 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=d66964fa-1600-0000-7d67-cef5f80d0000 pid=3576 execve guuid=24a1ddfa-1600-0000-7d67-cef5f90d0000 pid=3577 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=24a1ddfa-1600-0000-7d67-cef5f90d0000 pid=3577 execve guuid=7a4656fb-1600-0000-7d67-cef5fa0d0000 pid=3578 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=7a4656fb-1600-0000-7d67-cef5fa0d0000 pid=3578 execve guuid=98a0ddfb-1600-0000-7d67-cef5fb0d0000 pid=3579 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=98a0ddfb-1600-0000-7d67-cef5fb0d0000 pid=3579 execve guuid=016359fc-1600-0000-7d67-cef5fc0d0000 pid=3580 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=016359fc-1600-0000-7d67-cef5fc0d0000 pid=3580 execve guuid=785dd0fc-1600-0000-7d67-cef5fe0d0000 pid=3582 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=785dd0fc-1600-0000-7d67-cef5fe0d0000 pid=3582 execve guuid=d52856fd-1600-0000-7d67-cef5ff0d0000 pid=3583 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=d52856fd-1600-0000-7d67-cef5ff0d0000 pid=3583 execve guuid=7080edfd-1600-0000-7d67-cef5000e0000 pid=3584 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=7080edfd-1600-0000-7d67-cef5000e0000 pid=3584 execve guuid=4bb96cfe-1600-0000-7d67-cef5030e0000 pid=3587 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=4bb96cfe-1600-0000-7d67-cef5030e0000 pid=3587 execve guuid=460ae8fe-1600-0000-7d67-cef5050e0000 pid=3589 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=460ae8fe-1600-0000-7d67-cef5050e0000 pid=3589 execve guuid=afa062ff-1600-0000-7d67-cef5070e0000 pid=3591 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=afa062ff-1600-0000-7d67-cef5070e0000 pid=3591 execve guuid=051ddcff-1600-0000-7d67-cef50a0e0000 pid=3594 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=051ddcff-1600-0000-7d67-cef50a0e0000 pid=3594 execve guuid=88b45a00-1700-0000-7d67-cef50b0e0000 pid=3595 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=88b45a00-1700-0000-7d67-cef50b0e0000 pid=3595 execve guuid=5dabe400-1700-0000-7d67-cef50c0e0000 pid=3596 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=5dabe400-1700-0000-7d67-cef50c0e0000 pid=3596 execve guuid=25cf7e01-1700-0000-7d67-cef50d0e0000 pid=3597 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=25cf7e01-1700-0000-7d67-cef50d0e0000 pid=3597 execve guuid=2ea40202-1700-0000-7d67-cef50f0e0000 pid=3599 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=2ea40202-1700-0000-7d67-cef50f0e0000 pid=3599 execve guuid=d60f8502-1700-0000-7d67-cef5100e0000 pid=3600 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=d60f8502-1700-0000-7d67-cef5100e0000 pid=3600 execve guuid=38d0ff02-1700-0000-7d67-cef5120e0000 pid=3602 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=38d0ff02-1700-0000-7d67-cef5120e0000 pid=3602 execve guuid=42717903-1700-0000-7d67-cef5140e0000 pid=3604 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=42717903-1700-0000-7d67-cef5140e0000 pid=3604 execve guuid=b16bfb03-1700-0000-7d67-cef5160e0000 pid=3606 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=b16bfb03-1700-0000-7d67-cef5160e0000 pid=3606 execve guuid=1f73a204-1700-0000-7d67-cef5190e0000 pid=3609 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=1f73a204-1700-0000-7d67-cef5190e0000 pid=3609 execve guuid=5d944205-1700-0000-7d67-cef51c0e0000 pid=3612 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=5d944205-1700-0000-7d67-cef51c0e0000 pid=3612 execve guuid=70a3d405-1700-0000-7d67-cef51e0e0000 pid=3614 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=70a3d405-1700-0000-7d67-cef51e0e0000 pid=3614 execve guuid=ce0a5906-1700-0000-7d67-cef5210e0000 pid=3617 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=ce0a5906-1700-0000-7d67-cef5210e0000 pid=3617 execve guuid=d597dc06-1700-0000-7d67-cef5230e0000 pid=3619 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=d597dc06-1700-0000-7d67-cef5230e0000 pid=3619 execve guuid=2d926307-1700-0000-7d67-cef5250e0000 pid=3621 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=2d926307-1700-0000-7d67-cef5250e0000 pid=3621 execve guuid=b28ee907-1700-0000-7d67-cef5270e0000 pid=3623 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=b28ee907-1700-0000-7d67-cef5270e0000 pid=3623 execve guuid=f0127108-1700-0000-7d67-cef52a0e0000 pid=3626 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=f0127108-1700-0000-7d67-cef52a0e0000 pid=3626 execve guuid=b6e5fb08-1700-0000-7d67-cef52c0e0000 pid=3628 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=b6e5fb08-1700-0000-7d67-cef52c0e0000 pid=3628 execve guuid=5aff6e09-1700-0000-7d67-cef52d0e0000 pid=3629 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=5aff6e09-1700-0000-7d67-cef52d0e0000 pid=3629 execve guuid=44cde709-1700-0000-7d67-cef52e0e0000 pid=3630 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=44cde709-1700-0000-7d67-cef52e0e0000 pid=3630 execve guuid=39c15f0a-1700-0000-7d67-cef5300e0000 pid=3632 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=39c15f0a-1700-0000-7d67-cef5300e0000 pid=3632 execve guuid=3e72d80a-1700-0000-7d67-cef5320e0000 pid=3634 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=3e72d80a-1700-0000-7d67-cef5320e0000 pid=3634 execve guuid=841d4f0b-1700-0000-7d67-cef5340e0000 pid=3636 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=841d4f0b-1700-0000-7d67-cef5340e0000 pid=3636 execve guuid=0cbdc70b-1700-0000-7d67-cef5360e0000 pid=3638 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=0cbdc70b-1700-0000-7d67-cef5360e0000 pid=3638 execve guuid=9d34440c-1700-0000-7d67-cef5380e0000 pid=3640 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=9d34440c-1700-0000-7d67-cef5380e0000 pid=3640 execve guuid=8b2cbf0c-1700-0000-7d67-cef53b0e0000 pid=3643 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=8b2cbf0c-1700-0000-7d67-cef53b0e0000 pid=3643 execve guuid=500b360d-1700-0000-7d67-cef53d0e0000 pid=3645 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=500b360d-1700-0000-7d67-cef53d0e0000 pid=3645 execve guuid=da2eaf0d-1700-0000-7d67-cef53f0e0000 pid=3647 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=da2eaf0d-1700-0000-7d67-cef53f0e0000 pid=3647 execve guuid=6b9b200e-1700-0000-7d67-cef5410e0000 pid=3649 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=6b9b200e-1700-0000-7d67-cef5410e0000 pid=3649 execve guuid=5a2a9c0e-1700-0000-7d67-cef5440e0000 pid=3652 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=5a2a9c0e-1700-0000-7d67-cef5440e0000 pid=3652 execve guuid=c06c1f0f-1700-0000-7d67-cef5460e0000 pid=3654 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=c06c1f0f-1700-0000-7d67-cef5460e0000 pid=3654 execve guuid=ab48ad0f-1700-0000-7d67-cef5480e0000 pid=3656 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=ab48ad0f-1700-0000-7d67-cef5480e0000 pid=3656 execve guuid=b5ff3610-1700-0000-7d67-cef54a0e0000 pid=3658 /usr/bin/ls guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=b5ff3610-1700-0000-7d67-cef54a0e0000 pid=3658 execve guuid=d74bbe10-1700-0000-7d67-cef54d0e0000 pid=3661 /usr/bin/rm guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=d74bbe10-1700-0000-7d67-cef54d0e0000 pid=3661 execve guuid=f7441211-1700-0000-7d67-cef54f0e0000 pid=3663 /usr/bin/wget net send-data write-file guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=f7441211-1700-0000-7d67-cef54f0e0000 pid=3663 execve guuid=7cdc1918-1700-0000-7d67-cef5610e0000 pid=3681 /usr/bin/chmod guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=7cdc1918-1700-0000-7d67-cef5610e0000 pid=3681 execve guuid=d4de6b18-1700-0000-7d67-cef5620e0000 pid=3682 /tmp/VoXd guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=d4de6b18-1700-0000-7d67-cef5620e0000 pid=3682 execve guuid=d58a4d19-1700-0000-7d67-cef5660e0000 pid=3686 /usr/bin/rm guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=d58a4d19-1700-0000-7d67-cef5660e0000 pid=3686 execve guuid=af7f9619-1700-0000-7d67-cef5680e0000 pid=3688 /usr/bin/wget net send-data write-file guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=af7f9619-1700-0000-7d67-cef5680e0000 pid=3688 execve guuid=3da52123-1700-0000-7d67-cef5740e0000 pid=3700 /usr/bin/chmod guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=3da52123-1700-0000-7d67-cef5740e0000 pid=3700 execve guuid=10008923-1700-0000-7d67-cef5750e0000 pid=3701 /tmp/8V4s guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=10008923-1700-0000-7d67-cef5750e0000 pid=3701 execve guuid=6daebc24-1700-0000-7d67-cef57c0e0000 pid=3708 /usr/bin/rm guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=6daebc24-1700-0000-7d67-cef57c0e0000 pid=3708 execve guuid=70b2f824-1700-0000-7d67-cef57d0e0000 pid=3709 /usr/bin/wget net send-data write-file guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=70b2f824-1700-0000-7d67-cef57d0e0000 pid=3709 execve guuid=46829f67-1700-0000-7d67-cef5520f0000 pid=3922 /usr/bin/chmod guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=46829f67-1700-0000-7d67-cef5520f0000 pid=3922 execve guuid=42bc1968-1700-0000-7d67-cef5550f0000 pid=3925 /tmp/V41 guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=42bc1968-1700-0000-7d67-cef5550f0000 pid=3925 execve guuid=4d8eed69-1700-0000-7d67-cef5630f0000 pid=3939 /usr/bin/rm guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=4d8eed69-1700-0000-7d67-cef5630f0000 pid=3939 execve guuid=88b43a6a-1700-0000-7d67-cef5660f0000 pid=3942 /usr/bin/wget net send-data write-file guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=88b43a6a-1700-0000-7d67-cef5660f0000 pid=3942 execve guuid=fcfbf6fa-1700-0000-7d67-cef550110000 pid=4432 /usr/bin/chmod guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=fcfbf6fa-1700-0000-7d67-cef550110000 pid=4432 execve guuid=c9b776fb-1700-0000-7d67-cef551110000 pid=4433 /tmp/MTkZ guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=c9b776fb-1700-0000-7d67-cef551110000 pid=4433 execve guuid=cb6975fc-1700-0000-7d67-cef553110000 pid=4435 /usr/bin/rm guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=cb6975fc-1700-0000-7d67-cef553110000 pid=4435 execve guuid=abe9bafc-1700-0000-7d67-cef557110000 pid=4439 /usr/bin/wget net send-data write-file guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=abe9bafc-1700-0000-7d67-cef557110000 pid=4439 execve guuid=5ae11504-1800-0000-7d67-cef570110000 pid=4464 /usr/bin/chmod guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=5ae11504-1800-0000-7d67-cef570110000 pid=4464 execve guuid=3262b404-1800-0000-7d67-cef574110000 pid=4468 /tmp/cEe guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=3262b404-1800-0000-7d67-cef574110000 pid=4468 execve guuid=87ee3606-1800-0000-7d67-cef57c110000 pid=4476 /usr/bin/rm delete-file guuid=9ce99ddb-1600-0000-7d67-cef54c0d0000 pid=3404->guuid=87ee3606-1800-0000-7d67-cef57c110000 pid=4476 execve 9554d36e-3083-568e-90da-bb8e3c487b07 188.132.232.81:80 guuid=f7441211-1700-0000-7d67-cef54f0e0000 pid=3663->9554d36e-3083-568e-90da-bb8e3c487b07 send: 133B guuid=af7f9619-1700-0000-7d67-cef5680e0000 pid=3688->9554d36e-3083-568e-90da-bb8e3c487b07 send: 133B guuid=70b2f824-1700-0000-7d67-cef57d0e0000 pid=3709->9554d36e-3083-568e-90da-bb8e3c487b07 send: 132B guuid=88b43a6a-1700-0000-7d67-cef5660f0000 pid=3942->9554d36e-3083-568e-90da-bb8e3c487b07 send: 133B guuid=abe9bafc-1700-0000-7d67-cef557110000 pid=4439->9554d36e-3083-568e-90da-bb8e3c487b07 send: 132B
Score:
94%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/f2d6256881cddd0aca9e3594faf0e54bab197c2d9b8ea1c6293c6b3cdac9b784
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f2d6256881cddd0aca9e3594faf0e54bab197c2d9b8ea1c6293c6b3cdac9b784/
Verdict:
Malicious
Threat:
Trojan-Downloader.Shell.Agent
Link:
https://tip.neiki.dev/file/f2d6256881cddd0aca9e3594faf0e54bab197c2d9b8ea1c6293c6b3cdac9b784
Threat name:
Win32.Trojan.Vigorf
Create hunting rule
Status:
Malicious
First seen:
2026-06-06 14:44:32 UTC
File Type:
Text (Shell)
AV detection:
11 of 23 (47.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6llck2ebzxoqvsu6gwkpv4hfjovrs7bntohkdrrjhrvtzwwjw6ca._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
defense_evasion discovery linux
Link:
https://tria.ge/reports/260606-r3rtgahw5m/
Behaviour
Reads runtime system information
Writes file to tmp directory
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.26
Link:
https://yomi.yoroi.company/submissions/f2d6256881cddd0aca9e3594faf0e54bab197c2d9b8ea1c6293c6b3cdac9b784

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh f2d6256881cddd0aca9e3594faf0e54bab197c2d9b8ea1c6293c6b3cdac9b784

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3856431/
  
Delivery method
Distributed via web download

Comments