MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f2e0c0e0c1b9c6d4a9d180dc71b4d48320cc8a47a3455103d3b7e9fbfe16dd1e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f2e0c0e0c1b9c6d4a9d180dc71b4d48320cc8a47a3455103d3b7e9fbfe16dd1e
SHA3-384 hash: 0ed7603f431040981a4e9d59fda9badbb2c0cb8934002f84b1f5290322f6e06207c81ddee1e16c2df8a97a6afe301d61
SHA1 hash: c08a2359bb5059e95fba25a8686abd1fcb7bf7f5
MD5 hash: 3c167b6cebc19c8ee7ecb7c9d722effb
humanhash: hamper-queen-muppet-high
File name:lil
Download: download sample
File size:847 bytes
First seen:2026-06-10 01:45:51 UTC
Last seen:2026-06-10 13:09:06 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 24:kXCKysE2hi0ziQvZohakxeiP/4z8R8BrX:e9Qp+Msk8i4zdJX
TLSH T19C01AFCDC0078B6050C6F4AD32E76554B820C3CB26858FA5FE6C543E8BA57487069F99
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://188.132.232.81/4pbYn/an/aelf ua-wget
http://188.132.232.81/Wdxqn/an/aelf ua-wget
http://188.132.232.81/TvBRn/an/aelf ua-wget
http://188.132.232.81/SiOXn/an/aelf ua-wget
http://188.132.232.81/JkKn/an/aelf ua-wget

Intelligence

File Origin
# of uploads :
2
# of downloads :
41
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
File Type:
unix shell
First seen:
2026-06-09T23:31:00Z UTC
Last seen:
2026-06-11T22:21:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/f2e0c0e0c1b9c6d4a9d180dc71b4d48320cc8a47a3455103d3b7e9fbfe16dd1e/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/0718e69f-e331-409a-931c-81b21f2e356d
Behavior Graph:
Download SVG
%3 guuid=e80461bd-1900-0000-9387-2306c2070000 pid=1986 /usr/bin/sudo guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992 /tmp/sample.bin write-file guuid=e80461bd-1900-0000-9387-2306c2070000 pid=1986->guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992 execve guuid=b24760c0-1900-0000-9387-2306c9070000 pid=1993 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=b24760c0-1900-0000-9387-2306c9070000 pid=1993 execve guuid=4f466fc1-1900-0000-9387-2306ca070000 pid=1994 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=4f466fc1-1900-0000-9387-2306ca070000 pid=1994 execve guuid=924e5ec2-1900-0000-9387-2306cb070000 pid=1995 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=924e5ec2-1900-0000-9387-2306cb070000 pid=1995 execve guuid=0a0b3fc3-1900-0000-9387-2306cc070000 pid=1996 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=0a0b3fc3-1900-0000-9387-2306cc070000 pid=1996 execve guuid=a49f25c4-1900-0000-9387-2306cd070000 pid=1997 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=a49f25c4-1900-0000-9387-2306cd070000 pid=1997 execve guuid=e55602c5-1900-0000-9387-2306ce070000 pid=1998 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=e55602c5-1900-0000-9387-2306ce070000 pid=1998 execve guuid=e745ecc5-1900-0000-9387-2306cf070000 pid=1999 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=e745ecc5-1900-0000-9387-2306cf070000 pid=1999 execve guuid=b4ade0c6-1900-0000-9387-2306d0070000 pid=2000 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=b4ade0c6-1900-0000-9387-2306d0070000 pid=2000 execve guuid=5ab8dbc7-1900-0000-9387-2306d1070000 pid=2001 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=5ab8dbc7-1900-0000-9387-2306d1070000 pid=2001 execve guuid=e1d9bec8-1900-0000-9387-2306d2070000 pid=2002 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=e1d9bec8-1900-0000-9387-2306d2070000 pid=2002 execve guuid=b08f3aca-1900-0000-9387-2306d3070000 pid=2003 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=b08f3aca-1900-0000-9387-2306d3070000 pid=2003 execve guuid=14b6d4ca-1900-0000-9387-2306d4070000 pid=2004 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=14b6d4ca-1900-0000-9387-2306d4070000 pid=2004 execve guuid=26fb97cb-1900-0000-9387-2306d5070000 pid=2005 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=26fb97cb-1900-0000-9387-2306d5070000 pid=2005 execve guuid=306084cc-1900-0000-9387-2306d6070000 pid=2006 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=306084cc-1900-0000-9387-2306d6070000 pid=2006 execve guuid=52db5ecd-1900-0000-9387-2306d7070000 pid=2007 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=52db5ecd-1900-0000-9387-2306d7070000 pid=2007 execve guuid=1aa4e4ce-1900-0000-9387-2306d8070000 pid=2008 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=1aa4e4ce-1900-0000-9387-2306d8070000 pid=2008 execve guuid=7b1461cf-1900-0000-9387-2306da070000 pid=2010 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=7b1461cf-1900-0000-9387-2306da070000 pid=2010 execve guuid=9c940dd0-1900-0000-9387-2306db070000 pid=2011 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=9c940dd0-1900-0000-9387-2306db070000 pid=2011 execve guuid=dd25c8d0-1900-0000-9387-2306dc070000 pid=2012 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=dd25c8d0-1900-0000-9387-2306dc070000 pid=2012 execve guuid=35c26dd1-1900-0000-9387-2306de070000 pid=2014 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=35c26dd1-1900-0000-9387-2306de070000 pid=2014 execve guuid=c1ca0dd2-1900-0000-9387-2306e1070000 pid=2017 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=c1ca0dd2-1900-0000-9387-2306e1070000 pid=2017 execve guuid=83b6abd2-1900-0000-9387-2306e3070000 pid=2019 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=83b6abd2-1900-0000-9387-2306e3070000 pid=2019 execve guuid=f37f4dd3-1900-0000-9387-2306e6070000 pid=2022 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=f37f4dd3-1900-0000-9387-2306e6070000 pid=2022 execve guuid=5894c1d3-1900-0000-9387-2306e7070000 pid=2023 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=5894c1d3-1900-0000-9387-2306e7070000 pid=2023 execve guuid=073044d4-1900-0000-9387-2306e9070000 pid=2025 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=073044d4-1900-0000-9387-2306e9070000 pid=2025 execve guuid=e1c05bd5-1900-0000-9387-2306ea070000 pid=2026 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=e1c05bd5-1900-0000-9387-2306ea070000 pid=2026 execve guuid=8ce4f1d5-1900-0000-9387-2306eb070000 pid=2027 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=8ce4f1d5-1900-0000-9387-2306eb070000 pid=2027 execve guuid=e1d4b3d6-1900-0000-9387-2306ee070000 pid=2030 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=e1d4b3d6-1900-0000-9387-2306ee070000 pid=2030 execve guuid=78d256d7-1900-0000-9387-2306f0070000 pid=2032 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=78d256d7-1900-0000-9387-2306f0070000 pid=2032 execve guuid=d3bbbbd7-1900-0000-9387-2306f2070000 pid=2034 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=d3bbbbd7-1900-0000-9387-2306f2070000 pid=2034 execve guuid=b89e60d8-1900-0000-9387-2306f4070000 pid=2036 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=b89e60d8-1900-0000-9387-2306f4070000 pid=2036 execve guuid=1c1c01d9-1900-0000-9387-2306f6070000 pid=2038 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=1c1c01d9-1900-0000-9387-2306f6070000 pid=2038 execve guuid=735a99d9-1900-0000-9387-2306f8070000 pid=2040 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=735a99d9-1900-0000-9387-2306f8070000 pid=2040 execve guuid=88e84bda-1900-0000-9387-2306f9070000 pid=2041 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=88e84bda-1900-0000-9387-2306f9070000 pid=2041 execve guuid=709c23db-1900-0000-9387-2306fa070000 pid=2042 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=709c23db-1900-0000-9387-2306fa070000 pid=2042 execve guuid=8304c8db-1900-0000-9387-2306fd070000 pid=2045 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=8304c8db-1900-0000-9387-2306fd070000 pid=2045 execve guuid=49ee70dc-1900-0000-9387-2306ff070000 pid=2047 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=49ee70dc-1900-0000-9387-2306ff070000 pid=2047 execve guuid=a2cc34dd-1900-0000-9387-230602080000 pid=2050 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=a2cc34dd-1900-0000-9387-230602080000 pid=2050 execve guuid=b30cf8dd-1900-0000-9387-230604080000 pid=2052 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=b30cf8dd-1900-0000-9387-230604080000 pid=2052 execve guuid=1e1289de-1900-0000-9387-230605080000 pid=2053 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=1e1289de-1900-0000-9387-230605080000 pid=2053 execve guuid=9c733bdf-1900-0000-9387-230606080000 pid=2054 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=9c733bdf-1900-0000-9387-230606080000 pid=2054 execve guuid=a8f7dadf-1900-0000-9387-230608080000 pid=2056 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=a8f7dadf-1900-0000-9387-230608080000 pid=2056 execve guuid=91bf80e0-1900-0000-9387-230609080000 pid=2057 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=91bf80e0-1900-0000-9387-230609080000 pid=2057 execve guuid=56064ae1-1900-0000-9387-23060a080000 pid=2058 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=56064ae1-1900-0000-9387-23060a080000 pid=2058 execve guuid=02f3eee1-1900-0000-9387-23060c080000 pid=2060 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=02f3eee1-1900-0000-9387-23060c080000 pid=2060 execve guuid=d7d564e2-1900-0000-9387-23060e080000 pid=2062 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=d7d564e2-1900-0000-9387-23060e080000 pid=2062 execve guuid=03b412e3-1900-0000-9387-230611080000 pid=2065 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=03b412e3-1900-0000-9387-230611080000 pid=2065 execve guuid=183e31e4-1900-0000-9387-230614080000 pid=2068 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=183e31e4-1900-0000-9387-230614080000 pid=2068 execve guuid=c2e9d3e4-1900-0000-9387-230616080000 pid=2070 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=c2e9d3e4-1900-0000-9387-230616080000 pid=2070 execve guuid=f08d6ee5-1900-0000-9387-230617080000 pid=2071 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=f08d6ee5-1900-0000-9387-230617080000 pid=2071 execve guuid=efbe00e6-1900-0000-9387-230618080000 pid=2072 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=efbe00e6-1900-0000-9387-230618080000 pid=2072 execve guuid=4fb3a1e6-1900-0000-9387-230619080000 pid=2073 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=4fb3a1e6-1900-0000-9387-230619080000 pid=2073 execve guuid=9db60be7-1900-0000-9387-23061b080000 pid=2075 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=9db60be7-1900-0000-9387-23061b080000 pid=2075 execve guuid=7d52abe7-1900-0000-9387-23061e080000 pid=2078 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=7d52abe7-1900-0000-9387-23061e080000 pid=2078 execve guuid=84843be8-1900-0000-9387-230621080000 pid=2081 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=84843be8-1900-0000-9387-230621080000 pid=2081 execve guuid=0c08dfe8-1900-0000-9387-230623080000 pid=2083 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=0c08dfe8-1900-0000-9387-230623080000 pid=2083 execve guuid=767250e9-1900-0000-9387-230625080000 pid=2085 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=767250e9-1900-0000-9387-230625080000 pid=2085 execve guuid=3495dee9-1900-0000-9387-230628080000 pid=2088 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=3495dee9-1900-0000-9387-230628080000 pid=2088 execve guuid=fe68b5ea-1900-0000-9387-23062a080000 pid=2090 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=fe68b5ea-1900-0000-9387-23062a080000 pid=2090 execve guuid=06c751eb-1900-0000-9387-23062c080000 pid=2092 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=06c751eb-1900-0000-9387-23062c080000 pid=2092 execve guuid=7eb200ec-1900-0000-9387-23062e080000 pid=2094 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=7eb200ec-1900-0000-9387-23062e080000 pid=2094 execve guuid=d600b6ec-1900-0000-9387-230631080000 pid=2097 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=d600b6ec-1900-0000-9387-230631080000 pid=2097 execve guuid=e4702fed-1900-0000-9387-230633080000 pid=2099 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=e4702fed-1900-0000-9387-230633080000 pid=2099 execve guuid=97eca4ed-1900-0000-9387-230635080000 pid=2101 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=97eca4ed-1900-0000-9387-230635080000 pid=2101 execve guuid=e2fa42ee-1900-0000-9387-230638080000 pid=2104 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=e2fa42ee-1900-0000-9387-230638080000 pid=2104 execve guuid=4db3b4ee-1900-0000-9387-230639080000 pid=2105 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=4db3b4ee-1900-0000-9387-230639080000 pid=2105 execve guuid=3eae3aef-1900-0000-9387-23063a080000 pid=2106 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=3eae3aef-1900-0000-9387-23063a080000 pid=2106 execve guuid=8226c2ef-1900-0000-9387-23063b080000 pid=2107 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=8226c2ef-1900-0000-9387-23063b080000 pid=2107 execve guuid=c9430df1-1900-0000-9387-23063e080000 pid=2110 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=c9430df1-1900-0000-9387-23063e080000 pid=2110 execve guuid=9dd9b1f1-1900-0000-9387-230640080000 pid=2112 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=9dd9b1f1-1900-0000-9387-230640080000 pid=2112 execve guuid=95b74ff2-1900-0000-9387-230642080000 pid=2114 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=95b74ff2-1900-0000-9387-230642080000 pid=2114 execve guuid=a7f0edf2-1900-0000-9387-230645080000 pid=2117 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=a7f0edf2-1900-0000-9387-230645080000 pid=2117 execve guuid=08bfa3f3-1900-0000-9387-230647080000 pid=2119 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=08bfa3f3-1900-0000-9387-230647080000 pid=2119 execve guuid=e40726f4-1900-0000-9387-230648080000 pid=2120 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=e40726f4-1900-0000-9387-230648080000 pid=2120 execve guuid=9086c5f4-1900-0000-9387-23064a080000 pid=2122 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=9086c5f4-1900-0000-9387-23064a080000 pid=2122 execve guuid=e7b324f5-1900-0000-9387-23064c080000 pid=2124 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=e7b324f5-1900-0000-9387-23064c080000 pid=2124 execve guuid=870b8ef5-1900-0000-9387-23064f080000 pid=2127 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=870b8ef5-1900-0000-9387-23064f080000 pid=2127 execve guuid=693cf9f5-1900-0000-9387-230651080000 pid=2129 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=693cf9f5-1900-0000-9387-230651080000 pid=2129 execve guuid=b99273f6-1900-0000-9387-230653080000 pid=2131 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=b99273f6-1900-0000-9387-230653080000 pid=2131 execve guuid=f9230ff7-1900-0000-9387-230655080000 pid=2133 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=f9230ff7-1900-0000-9387-230655080000 pid=2133 execve guuid=104fb7f7-1900-0000-9387-230656080000 pid=2134 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=104fb7f7-1900-0000-9387-230656080000 pid=2134 execve guuid=5ab621f8-1900-0000-9387-230658080000 pid=2136 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=5ab621f8-1900-0000-9387-230658080000 pid=2136 execve guuid=2e7a9bf8-1900-0000-9387-23065b080000 pid=2139 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=2e7a9bf8-1900-0000-9387-23065b080000 pid=2139 execve guuid=172a0df9-1900-0000-9387-23065d080000 pid=2141 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=172a0df9-1900-0000-9387-23065d080000 pid=2141 execve guuid=b3427bf9-1900-0000-9387-23065f080000 pid=2143 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=b3427bf9-1900-0000-9387-23065f080000 pid=2143 execve guuid=9803ecf9-1900-0000-9387-230661080000 pid=2145 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=9803ecf9-1900-0000-9387-230661080000 pid=2145 execve guuid=108155fa-1900-0000-9387-230663080000 pid=2147 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=108155fa-1900-0000-9387-230663080000 pid=2147 execve guuid=e04abafa-1900-0000-9387-230664080000 pid=2148 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=e04abafa-1900-0000-9387-230664080000 pid=2148 execve guuid=5c0032fb-1900-0000-9387-230666080000 pid=2150 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=5c0032fb-1900-0000-9387-230666080000 pid=2150 execve guuid=5253a9fb-1900-0000-9387-230669080000 pid=2153 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=5253a9fb-1900-0000-9387-230669080000 pid=2153 execve guuid=0e2f2cfc-1900-0000-9387-23066b080000 pid=2155 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=0e2f2cfc-1900-0000-9387-23066b080000 pid=2155 execve guuid=8a7b92fc-1900-0000-9387-23066d080000 pid=2157 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=8a7b92fc-1900-0000-9387-23066d080000 pid=2157 execve guuid=6c8a08fd-1900-0000-9387-23066f080000 pid=2159 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=6c8a08fd-1900-0000-9387-23066f080000 pid=2159 execve guuid=be0a9ffd-1900-0000-9387-230671080000 pid=2161 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=be0a9ffd-1900-0000-9387-230671080000 pid=2161 execve guuid=bd9748fe-1900-0000-9387-230672080000 pid=2162 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=bd9748fe-1900-0000-9387-230672080000 pid=2162 execve guuid=dc06d7fe-1900-0000-9387-230675080000 pid=2165 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=dc06d7fe-1900-0000-9387-230675080000 pid=2165 execve guuid=1db37aff-1900-0000-9387-230678080000 pid=2168 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=1db37aff-1900-0000-9387-230678080000 pid=2168 execve guuid=8bcbe4ff-1900-0000-9387-23067a080000 pid=2170 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=8bcbe4ff-1900-0000-9387-23067a080000 pid=2170 execve guuid=a94e6700-1a00-0000-9387-23067d080000 pid=2173 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=a94e6700-1a00-0000-9387-23067d080000 pid=2173 execve guuid=cdbfff00-1a00-0000-9387-23067f080000 pid=2175 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=cdbfff00-1a00-0000-9387-23067f080000 pid=2175 execve guuid=2cbc8601-1a00-0000-9387-230681080000 pid=2177 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=2cbc8601-1a00-0000-9387-230681080000 pid=2177 execve guuid=da270802-1a00-0000-9387-230682080000 pid=2178 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=da270802-1a00-0000-9387-230682080000 pid=2178 execve guuid=48728002-1a00-0000-9387-230684080000 pid=2180 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=48728002-1a00-0000-9387-230684080000 pid=2180 execve guuid=b9d9e602-1a00-0000-9387-230687080000 pid=2183 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=b9d9e602-1a00-0000-9387-230687080000 pid=2183 execve guuid=e2574403-1a00-0000-9387-230689080000 pid=2185 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=e2574403-1a00-0000-9387-230689080000 pid=2185 execve guuid=7e89cc03-1a00-0000-9387-23068c080000 pid=2188 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=7e89cc03-1a00-0000-9387-23068c080000 pid=2188 execve guuid=92105e04-1a00-0000-9387-23068e080000 pid=2190 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=92105e04-1a00-0000-9387-23068e080000 pid=2190 execve guuid=33d3fa04-1a00-0000-9387-23068f080000 pid=2191 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=33d3fa04-1a00-0000-9387-23068f080000 pid=2191 execve guuid=70bb7005-1a00-0000-9387-230691080000 pid=2193 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=70bb7005-1a00-0000-9387-230691080000 pid=2193 execve guuid=444b0706-1a00-0000-9387-230693080000 pid=2195 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=444b0706-1a00-0000-9387-230693080000 pid=2195 execve guuid=bd598b06-1a00-0000-9387-230696080000 pid=2198 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=bd598b06-1a00-0000-9387-230696080000 pid=2198 execve guuid=b7ce7f07-1a00-0000-9387-230699080000 pid=2201 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=b7ce7f07-1a00-0000-9387-230699080000 pid=2201 execve guuid=6ee02308-1a00-0000-9387-23069b080000 pid=2203 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=6ee02308-1a00-0000-9387-23069b080000 pid=2203 execve guuid=28e3e208-1a00-0000-9387-23069c080000 pid=2204 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=28e3e208-1a00-0000-9387-23069c080000 pid=2204 execve guuid=52cffa09-1a00-0000-9387-2306a0080000 pid=2208 /usr/bin/ls guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=52cffa09-1a00-0000-9387-2306a0080000 pid=2208 execve guuid=849c530a-1a00-0000-9387-2306a2080000 pid=2210 /usr/bin/rm guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=849c530a-1a00-0000-9387-2306a2080000 pid=2210 execve guuid=961e8f0a-1a00-0000-9387-2306a4080000 pid=2212 /usr/bin/wget net send-data write-file guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=961e8f0a-1a00-0000-9387-2306a4080000 pid=2212 execve guuid=9ea2cd1c-1a00-0000-9387-2306b4080000 pid=2228 /usr/bin/chmod guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=9ea2cd1c-1a00-0000-9387-2306b4080000 pid=2228 execve guuid=7e5d0b1d-1a00-0000-9387-2306b5080000 pid=2229 /tmp/4pbY guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=7e5d0b1d-1a00-0000-9387-2306b5080000 pid=2229 execve guuid=48610b1e-1a00-0000-9387-2306b9080000 pid=2233 /usr/bin/rm guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=48610b1e-1a00-0000-9387-2306b9080000 pid=2233 execve guuid=b0b37f1e-1a00-0000-9387-2306bb080000 pid=2235 /usr/bin/wget net send-data write-file guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=b0b37f1e-1a00-0000-9387-2306bb080000 pid=2235 execve guuid=f06d0134-1a00-0000-9387-2306ec080000 pid=2284 /usr/bin/chmod guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=f06d0134-1a00-0000-9387-2306ec080000 pid=2284 execve guuid=b2584f34-1a00-0000-9387-2306ee080000 pid=2286 /tmp/Wdxq guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=b2584f34-1a00-0000-9387-2306ee080000 pid=2286 execve guuid=1e831235-1a00-0000-9387-2306f3080000 pid=2291 /usr/bin/rm guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=1e831235-1a00-0000-9387-2306f3080000 pid=2291 execve guuid=66665135-1a00-0000-9387-2306f4080000 pid=2292 /usr/bin/wget net send-data write-file guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=66665135-1a00-0000-9387-2306f4080000 pid=2292 execve guuid=89d7764b-1a00-0000-9387-23062a090000 pid=2346 /usr/bin/chmod guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=89d7764b-1a00-0000-9387-23062a090000 pid=2346 execve guuid=42bcc24b-1a00-0000-9387-23062c090000 pid=2348 /tmp/TvBR guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=42bcc24b-1a00-0000-9387-23062c090000 pid=2348 execve guuid=527ef04c-1a00-0000-9387-230632090000 pid=2354 /usr/bin/rm guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=527ef04c-1a00-0000-9387-230632090000 pid=2354 execve guuid=bf85394d-1a00-0000-9387-230633090000 pid=2355 /usr/bin/wget net send-data write-file guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=bf85394d-1a00-0000-9387-230633090000 pid=2355 execve guuid=eab28ba1-1a00-0000-9387-2306d5090000 pid=2517 /usr/bin/chmod guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=eab28ba1-1a00-0000-9387-2306d5090000 pid=2517 execve guuid=1dc8dba1-1a00-0000-9387-2306d6090000 pid=2518 /tmp/SiOX guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=1dc8dba1-1a00-0000-9387-2306d6090000 pid=2518 execve guuid=fd13c4a2-1a00-0000-9387-2306da090000 pid=2522 /usr/bin/rm guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=fd13c4a2-1a00-0000-9387-2306da090000 pid=2522 execve guuid=95e504a3-1a00-0000-9387-2306dc090000 pid=2524 /usr/bin/wget net send-data write-file guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=95e504a3-1a00-0000-9387-2306dc090000 pid=2524 execve guuid=8d6749a9-1a00-0000-9387-2306e9090000 pid=2537 /usr/bin/chmod guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=8d6749a9-1a00-0000-9387-2306e9090000 pid=2537 execve guuid=27aea6a9-1a00-0000-9387-2306ea090000 pid=2538 /tmp/JkK guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=27aea6a9-1a00-0000-9387-2306ea090000 pid=2538 execve guuid=60a808ab-1a00-0000-9387-2306ef090000 pid=2543 /usr/bin/rm delete-file guuid=0422e6bf-1900-0000-9387-2306c8070000 pid=1992->guuid=60a808ab-1a00-0000-9387-2306ef090000 pid=2543 execve 9554d36e-3083-568e-90da-bb8e3c487b07 188.132.232.81:80 guuid=961e8f0a-1a00-0000-9387-2306a4080000 pid=2212->9554d36e-3083-568e-90da-bb8e3c487b07 send: 133B guuid=b0b37f1e-1a00-0000-9387-2306bb080000 pid=2235->9554d36e-3083-568e-90da-bb8e3c487b07 send: 133B guuid=66665135-1a00-0000-9387-2306f4080000 pid=2292->9554d36e-3083-568e-90da-bb8e3c487b07 send: 133B guuid=bf85394d-1a00-0000-9387-230633090000 pid=2355->9554d36e-3083-568e-90da-bb8e3c487b07 send: 133B guuid=95e504a3-1a00-0000-9387-2306dc090000 pid=2524->9554d36e-3083-568e-90da-bb8e3c487b07 send: 132B
Score:
94%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/f2e0c0e0c1b9c6d4a9d180dc71b4d48320cc8a47a3455103d3b7e9fbfe16dd1e
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f2e0c0e0c1b9c6d4a9d180dc71b4d48320cc8a47a3455103d3b7e9fbfe16dd1e/
Threat name:
Win32.Trojan.Bash
Create hunting rule
Status:
Malicious
First seen:
2026-06-10 01:46:33 UTC
File Type:
Text (Shell)
AV detection:
11 of 24 (45.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6lqmbygbxhdnjkorqdohdnguqmqmzcshuncvca6tw7u7x7qw3upa._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
defense_evasion discovery linux
Link:
https://tria.ge/reports/260610-b68ndsc19k/
Behaviour
Reads runtime system information
Writes file to tmp directory
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.26
Link:
https://yomi.yoroi.company/submissions/f2e0c0e0c1b9c6d4a9d180dc71b4d48320cc8a47a3455103d3b7e9fbfe16dd1e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh f2e0c0e0c1b9c6d4a9d180dc71b4d48320cc8a47a3455103d3b7e9fbfe16dd1e

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3856431/
  
Delivery method
Distributed via web download

Comments