MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ff591fcf9b62bf02aaf8b9f3e64fd14e6eb4d2d4275cffee0aa9cdd863c82840. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ff591fcf9b62bf02aaf8b9f3e64fd14e6eb4d2d4275cffee0aa9cdd863c82840
SHA3-384 hash: b46a14861b2b9b8de6eb04bac67a40ce8b420f7b9f66706488058b9ee891a4e369884be8da24479ba019a8175ab0a4ac
SHA1 hash: 59b9ecb9a26ed63705b912533f2aee45f8ecb4db
MD5 hash: e130c90ba2a2f60d4ec0eae7d7b8c75d
humanhash: delta-cup-queen-lake
File name:lil
Download: download sample
File size:844 bytes
First seen:2026-08-04 20:11:00 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkaE88CKC19CoKC3x8CPN1dCVXX:kXCKysE2hi0ziQvZohaUC/Ud+wXX
TLSH T17101ABCAD114E81050AAD95C32D76055F821C3C7264B8B65BFACA83DEB94D18B076FA4
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://129.121.110.105/E4Dpn/an/aua-wget
http://129.121.110.105/LFSon/an/aua-wget
http://129.121.110.105/BFgn/an/aua-wget
http://129.121.110.105/1h4n/an/aua-wget
http://129.121.110.105/3fOn/an/aua-wget

Intelligence

File Origin
# of uploads :
1
# of downloads :
64
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive mirai
Link:
https://www.filescan.io/uploads/6a7247729273bc9d2997748d/reports/0bfa23f2-5768-4793-b2b8-80aae6c4c238/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-08-04T17:34:00Z UTC
Last seen:
2026-08-04T18:57:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan-Downloader.Shell.Agent.a
Link:
https://opentip.kaspersky.com/ff591fcf9b62bf02aaf8b9f3e64fd14e6eb4d2d4275cffee0aa9cdd863c82840/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/d186cb24-78f5-48cc-bb3c-5e8668c088ac
Behavior Graph:
Download SVG
%3 guuid=10c6e5ba-1800-0000-827b-8c24870c0000 pid=3207 /usr/bin/sudo guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208 /tmp/sample.bin write-file guuid=10c6e5ba-1800-0000-827b-8c24870c0000 pid=3207->guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208 execve guuid=99d789bf-1800-0000-827b-8c24890c0000 pid=3209 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=99d789bf-1800-0000-827b-8c24890c0000 pid=3209 execve guuid=af6a90c0-1800-0000-827b-8c248a0c0000 pid=3210 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=af6a90c0-1800-0000-827b-8c248a0c0000 pid=3210 execve guuid=08a422c1-1800-0000-827b-8c248b0c0000 pid=3211 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=08a422c1-1800-0000-827b-8c248b0c0000 pid=3211 execve guuid=f4559bc1-1800-0000-827b-8c248d0c0000 pid=3213 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=f4559bc1-1800-0000-827b-8c248d0c0000 pid=3213 execve guuid=245a1ec2-1800-0000-827b-8c248e0c0000 pid=3214 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=245a1ec2-1800-0000-827b-8c248e0c0000 pid=3214 execve guuid=08b49ac2-1800-0000-827b-8c248f0c0000 pid=3215 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=08b49ac2-1800-0000-827b-8c248f0c0000 pid=3215 execve guuid=291f0fc3-1800-0000-827b-8c24900c0000 pid=3216 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=291f0fc3-1800-0000-827b-8c24900c0000 pid=3216 execve guuid=3bc86bc3-1800-0000-827b-8c24930c0000 pid=3219 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=3bc86bc3-1800-0000-827b-8c24930c0000 pid=3219 execve guuid=ee13c7c3-1800-0000-827b-8c24950c0000 pid=3221 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=ee13c7c3-1800-0000-827b-8c24950c0000 pid=3221 execve guuid=404224c4-1800-0000-827b-8c24980c0000 pid=3224 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=404224c4-1800-0000-827b-8c24980c0000 pid=3224 execve guuid=03167ec4-1800-0000-827b-8c249a0c0000 pid=3226 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=03167ec4-1800-0000-827b-8c249a0c0000 pid=3226 execve guuid=72f4d9c4-1800-0000-827b-8c249d0c0000 pid=3229 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=72f4d9c4-1800-0000-827b-8c249d0c0000 pid=3229 execve guuid=488733c5-1800-0000-827b-8c249f0c0000 pid=3231 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=488733c5-1800-0000-827b-8c249f0c0000 pid=3231 execve guuid=4d4191c5-1800-0000-827b-8c24a10c0000 pid=3233 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=4d4191c5-1800-0000-827b-8c24a10c0000 pid=3233 execve guuid=e794f5c5-1800-0000-827b-8c24a30c0000 pid=3235 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=e794f5c5-1800-0000-827b-8c24a30c0000 pid=3235 execve guuid=9ca467c6-1800-0000-827b-8c24a40c0000 pid=3236 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=9ca467c6-1800-0000-827b-8c24a40c0000 pid=3236 execve guuid=e698cbc6-1800-0000-827b-8c24a50c0000 pid=3237 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=e698cbc6-1800-0000-827b-8c24a50c0000 pid=3237 execve guuid=d79820c7-1800-0000-827b-8c24a70c0000 pid=3239 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=d79820c7-1800-0000-827b-8c24a70c0000 pid=3239 execve guuid=c5f177c7-1800-0000-827b-8c24aa0c0000 pid=3242 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=c5f177c7-1800-0000-827b-8c24aa0c0000 pid=3242 execve guuid=0bc7cac7-1800-0000-827b-8c24ac0c0000 pid=3244 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=0bc7cac7-1800-0000-827b-8c24ac0c0000 pid=3244 execve guuid=608521c8-1800-0000-827b-8c24ae0c0000 pid=3246 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=608521c8-1800-0000-827b-8c24ae0c0000 pid=3246 execve guuid=9b8a75c8-1800-0000-827b-8c24b00c0000 pid=3248 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=9b8a75c8-1800-0000-827b-8c24b00c0000 pid=3248 execve guuid=c246cac8-1800-0000-827b-8c24b20c0000 pid=3250 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=c246cac8-1800-0000-827b-8c24b20c0000 pid=3250 execve guuid=0a7227c9-1800-0000-827b-8c24b30c0000 pid=3251 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=0a7227c9-1800-0000-827b-8c24b30c0000 pid=3251 execve guuid=e4137cc9-1800-0000-827b-8c24b60c0000 pid=3254 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=e4137cc9-1800-0000-827b-8c24b60c0000 pid=3254 execve guuid=949ad5c9-1800-0000-827b-8c24b80c0000 pid=3256 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=949ad5c9-1800-0000-827b-8c24b80c0000 pid=3256 execve guuid=e06929ca-1800-0000-827b-8c24ba0c0000 pid=3258 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=e06929ca-1800-0000-827b-8c24ba0c0000 pid=3258 execve guuid=0c277eca-1800-0000-827b-8c24bd0c0000 pid=3261 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=0c277eca-1800-0000-827b-8c24bd0c0000 pid=3261 execve guuid=8969d3ca-1800-0000-827b-8c24be0c0000 pid=3262 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=8969d3ca-1800-0000-827b-8c24be0c0000 pid=3262 execve guuid=95b227cb-1800-0000-827b-8c24bf0c0000 pid=3263 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=95b227cb-1800-0000-827b-8c24bf0c0000 pid=3263 execve guuid=dd7482cb-1800-0000-827b-8c24c00c0000 pid=3264 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=dd7482cb-1800-0000-827b-8c24c00c0000 pid=3264 execve guuid=49c9d6cb-1800-0000-827b-8c24c20c0000 pid=3266 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=49c9d6cb-1800-0000-827b-8c24c20c0000 pid=3266 execve guuid=ac7393cc-1800-0000-827b-8c24c30c0000 pid=3267 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=ac7393cc-1800-0000-827b-8c24c30c0000 pid=3267 execve guuid=56213ccd-1800-0000-827b-8c24c70c0000 pid=3271 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=56213ccd-1800-0000-827b-8c24c70c0000 pid=3271 execve guuid=f265dccd-1800-0000-827b-8c24ca0c0000 pid=3274 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=f265dccd-1800-0000-827b-8c24ca0c0000 pid=3274 execve guuid=7cfe75ce-1800-0000-827b-8c24cd0c0000 pid=3277 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=7cfe75ce-1800-0000-827b-8c24cd0c0000 pid=3277 execve guuid=1b610acf-1800-0000-827b-8c24d10c0000 pid=3281 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=1b610acf-1800-0000-827b-8c24d10c0000 pid=3281 execve guuid=ed729dcf-1800-0000-827b-8c24d30c0000 pid=3283 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=ed729dcf-1800-0000-827b-8c24d30c0000 pid=3283 execve guuid=a6623ed0-1800-0000-827b-8c24d50c0000 pid=3285 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=a6623ed0-1800-0000-827b-8c24d50c0000 pid=3285 execve guuid=654ad1d0-1800-0000-827b-8c24d90c0000 pid=3289 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=654ad1d0-1800-0000-827b-8c24d90c0000 pid=3289 execve guuid=853968d1-1800-0000-827b-8c24dc0c0000 pid=3292 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=853968d1-1800-0000-827b-8c24dc0c0000 pid=3292 execve guuid=2482f9d1-1800-0000-827b-8c24df0c0000 pid=3295 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=2482f9d1-1800-0000-827b-8c24df0c0000 pid=3295 execve guuid=3aab82d2-1800-0000-827b-8c24e10c0000 pid=3297 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=3aab82d2-1800-0000-827b-8c24e10c0000 pid=3297 execve guuid=1b1011d3-1800-0000-827b-8c24e30c0000 pid=3299 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=1b1011d3-1800-0000-827b-8c24e30c0000 pid=3299 execve guuid=937164d3-1800-0000-827b-8c24e60c0000 pid=3302 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=937164d3-1800-0000-827b-8c24e60c0000 pid=3302 execve guuid=c909b7d3-1800-0000-827b-8c24e80c0000 pid=3304 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=c909b7d3-1800-0000-827b-8c24e80c0000 pid=3304 execve guuid=7c5a0cd4-1800-0000-827b-8c24ea0c0000 pid=3306 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=7c5a0cd4-1800-0000-827b-8c24ea0c0000 pid=3306 execve guuid=aec161d4-1800-0000-827b-8c24ed0c0000 pid=3309 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=aec161d4-1800-0000-827b-8c24ed0c0000 pid=3309 execve guuid=e2dcb4d4-1800-0000-827b-8c24ef0c0000 pid=3311 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=e2dcb4d4-1800-0000-827b-8c24ef0c0000 pid=3311 execve guuid=3cce0bd5-1800-0000-827b-8c24f10c0000 pid=3313 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=3cce0bd5-1800-0000-827b-8c24f10c0000 pid=3313 execve guuid=ccb751d5-1800-0000-827b-8c24f30c0000 pid=3315 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=ccb751d5-1800-0000-827b-8c24f30c0000 pid=3315 execve guuid=e482a5d5-1800-0000-827b-8c24f60c0000 pid=3318 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=e482a5d5-1800-0000-827b-8c24f60c0000 pid=3318 execve guuid=e072fbd5-1800-0000-827b-8c24f80c0000 pid=3320 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=e072fbd5-1800-0000-827b-8c24f80c0000 pid=3320 execve guuid=40ff4fd6-1800-0000-827b-8c24fa0c0000 pid=3322 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=40ff4fd6-1800-0000-827b-8c24fa0c0000 pid=3322 execve guuid=7fd9a6d6-1800-0000-827b-8c24fd0c0000 pid=3325 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=7fd9a6d6-1800-0000-827b-8c24fd0c0000 pid=3325 execve guuid=cae9fad6-1800-0000-827b-8c24fe0c0000 pid=3326 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=cae9fad6-1800-0000-827b-8c24fe0c0000 pid=3326 execve guuid=873c56d7-1800-0000-827b-8c24000d0000 pid=3328 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=873c56d7-1800-0000-827b-8c24000d0000 pid=3328 execve guuid=1c29bbd7-1800-0000-827b-8c24010d0000 pid=3329 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=1c29bbd7-1800-0000-827b-8c24010d0000 pid=3329 execve guuid=2ae114d8-1800-0000-827b-8c24040d0000 pid=3332 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=2ae114d8-1800-0000-827b-8c24040d0000 pid=3332 execve guuid=aec569d8-1800-0000-827b-8c24060d0000 pid=3334 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=aec569d8-1800-0000-827b-8c24060d0000 pid=3334 execve guuid=3dfbc7d8-1800-0000-827b-8c24080d0000 pid=3336 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=3dfbc7d8-1800-0000-827b-8c24080d0000 pid=3336 execve guuid=56b31dd9-1800-0000-827b-8c240b0d0000 pid=3339 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=56b31dd9-1800-0000-827b-8c240b0d0000 pid=3339 execve guuid=2bd46fd9-1800-0000-827b-8c240d0d0000 pid=3341 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=2bd46fd9-1800-0000-827b-8c240d0d0000 pid=3341 execve guuid=a37dc4d9-1800-0000-827b-8c240f0d0000 pid=3343 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=a37dc4d9-1800-0000-827b-8c240f0d0000 pid=3343 execve guuid=11b91bda-1800-0000-827b-8c24120d0000 pid=3346 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=11b91bda-1800-0000-827b-8c24120d0000 pid=3346 execve guuid=21316fda-1800-0000-827b-8c24140d0000 pid=3348 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=21316fda-1800-0000-827b-8c24140d0000 pid=3348 execve guuid=c503c8da-1800-0000-827b-8c24170d0000 pid=3351 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=c503c8da-1800-0000-827b-8c24170d0000 pid=3351 execve guuid=c37d1edb-1800-0000-827b-8c24190d0000 pid=3353 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=c37d1edb-1800-0000-827b-8c24190d0000 pid=3353 execve guuid=d86a75db-1800-0000-827b-8c241c0d0000 pid=3356 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=d86a75db-1800-0000-827b-8c241c0d0000 pid=3356 execve guuid=1effc9db-1800-0000-827b-8c241e0d0000 pid=3358 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=1effc9db-1800-0000-827b-8c241e0d0000 pid=3358 execve guuid=098920dc-1800-0000-827b-8c24200d0000 pid=3360 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=098920dc-1800-0000-827b-8c24200d0000 pid=3360 execve guuid=d14675dc-1800-0000-827b-8c24230d0000 pid=3363 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=d14675dc-1800-0000-827b-8c24230d0000 pid=3363 execve guuid=c0d6c9dc-1800-0000-827b-8c24250d0000 pid=3365 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=c0d6c9dc-1800-0000-827b-8c24250d0000 pid=3365 execve guuid=b0aa20dd-1800-0000-827b-8c24280d0000 pid=3368 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=b0aa20dd-1800-0000-827b-8c24280d0000 pid=3368 execve guuid=253976dd-1800-0000-827b-8c242a0d0000 pid=3370 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=253976dd-1800-0000-827b-8c242a0d0000 pid=3370 execve guuid=f4f2cddd-1800-0000-827b-8c242d0d0000 pid=3373 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=f4f2cddd-1800-0000-827b-8c242d0d0000 pid=3373 execve guuid=08c720de-1800-0000-827b-8c242f0d0000 pid=3375 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=08c720de-1800-0000-827b-8c242f0d0000 pid=3375 execve guuid=f54c75de-1800-0000-827b-8c24320d0000 pid=3378 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=f54c75de-1800-0000-827b-8c24320d0000 pid=3378 execve guuid=2da6ccde-1800-0000-827b-8c24340d0000 pid=3380 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=2da6ccde-1800-0000-827b-8c24340d0000 pid=3380 execve guuid=22901fdf-1800-0000-827b-8c24370d0000 pid=3383 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=22901fdf-1800-0000-827b-8c24370d0000 pid=3383 execve guuid=0e3b74df-1800-0000-827b-8c24390d0000 pid=3385 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=0e3b74df-1800-0000-827b-8c24390d0000 pid=3385 execve guuid=9615c9df-1800-0000-827b-8c243b0d0000 pid=3387 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=9615c9df-1800-0000-827b-8c243b0d0000 pid=3387 execve guuid=e59e1be0-1800-0000-827b-8c243e0d0000 pid=3390 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=e59e1be0-1800-0000-827b-8c243e0d0000 pid=3390 execve guuid=940270e0-1800-0000-827b-8c24400d0000 pid=3392 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=940270e0-1800-0000-827b-8c24400d0000 pid=3392 execve guuid=4041c4e0-1800-0000-827b-8c24420d0000 pid=3394 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=4041c4e0-1800-0000-827b-8c24420d0000 pid=3394 execve guuid=e2041ae1-1800-0000-827b-8c24450d0000 pid=3397 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=e2041ae1-1800-0000-827b-8c24450d0000 pid=3397 execve guuid=da1371e1-1800-0000-827b-8c24470d0000 pid=3399 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=da1371e1-1800-0000-827b-8c24470d0000 pid=3399 execve guuid=06ddc6e1-1800-0000-827b-8c244a0d0000 pid=3402 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=06ddc6e1-1800-0000-827b-8c244a0d0000 pid=3402 execve guuid=7dc3d0e2-1800-0000-827b-8c244f0d0000 pid=3407 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=7dc3d0e2-1800-0000-827b-8c244f0d0000 pid=3407 execve guuid=bad585e3-1800-0000-827b-8c24530d0000 pid=3411 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=bad585e3-1800-0000-827b-8c24530d0000 pid=3411 execve guuid=647b7ce4-1800-0000-827b-8c24580d0000 pid=3416 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=647b7ce4-1800-0000-827b-8c24580d0000 pid=3416 execve guuid=ddfb50e5-1800-0000-827b-8c245c0d0000 pid=3420 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=ddfb50e5-1800-0000-827b-8c245c0d0000 pid=3420 execve guuid=becba7e5-1800-0000-827b-8c245e0d0000 pid=3422 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=becba7e5-1800-0000-827b-8c245e0d0000 pid=3422 execve guuid=8caffbe5-1800-0000-827b-8c24610d0000 pid=3425 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=8caffbe5-1800-0000-827b-8c24610d0000 pid=3425 execve guuid=a81d4fe6-1800-0000-827b-8c24630d0000 pid=3427 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=a81d4fe6-1800-0000-827b-8c24630d0000 pid=3427 execve guuid=cd6aa4e6-1800-0000-827b-8c24660d0000 pid=3430 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=cd6aa4e6-1800-0000-827b-8c24660d0000 pid=3430 execve guuid=9419fbe6-1800-0000-827b-8c24680d0000 pid=3432 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=9419fbe6-1800-0000-827b-8c24680d0000 pid=3432 execve guuid=74794fe7-1800-0000-827b-8c246a0d0000 pid=3434 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=74794fe7-1800-0000-827b-8c246a0d0000 pid=3434 execve guuid=5bdca7e7-1800-0000-827b-8c246d0d0000 pid=3437 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=5bdca7e7-1800-0000-827b-8c246d0d0000 pid=3437 execve guuid=7f69fce7-1800-0000-827b-8c246f0d0000 pid=3439 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=7f69fce7-1800-0000-827b-8c246f0d0000 pid=3439 execve guuid=331251e8-1800-0000-827b-8c24720d0000 pid=3442 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=331251e8-1800-0000-827b-8c24720d0000 pid=3442 execve guuid=5429a3e8-1800-0000-827b-8c24740d0000 pid=3444 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=5429a3e8-1800-0000-827b-8c24740d0000 pid=3444 execve guuid=0656f5e8-1800-0000-827b-8c24760d0000 pid=3446 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=0656f5e8-1800-0000-827b-8c24760d0000 pid=3446 execve guuid=a44250e9-1800-0000-827b-8c24790d0000 pid=3449 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=a44250e9-1800-0000-827b-8c24790d0000 pid=3449 execve guuid=f2fea5e9-1800-0000-827b-8c247b0d0000 pid=3451 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=f2fea5e9-1800-0000-827b-8c247b0d0000 pid=3451 execve guuid=ed63fce9-1800-0000-827b-8c247d0d0000 pid=3453 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=ed63fce9-1800-0000-827b-8c247d0d0000 pid=3453 execve guuid=309751ea-1800-0000-827b-8c24800d0000 pid=3456 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=309751ea-1800-0000-827b-8c24800d0000 pid=3456 execve guuid=5ca1a5ea-1800-0000-827b-8c24820d0000 pid=3458 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=5ca1a5ea-1800-0000-827b-8c24820d0000 pid=3458 execve guuid=0fa8fcea-1800-0000-827b-8c24840d0000 pid=3460 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=0fa8fcea-1800-0000-827b-8c24840d0000 pid=3460 execve guuid=8c4251eb-1800-0000-827b-8c24870d0000 pid=3463 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=8c4251eb-1800-0000-827b-8c24870d0000 pid=3463 execve guuid=8f8fa7eb-1800-0000-827b-8c24890d0000 pid=3465 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=8f8fa7eb-1800-0000-827b-8c24890d0000 pid=3465 execve guuid=2baff9eb-1800-0000-827b-8c248c0d0000 pid=3468 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=2baff9eb-1800-0000-827b-8c248c0d0000 pid=3468 execve guuid=9d974fec-1800-0000-827b-8c248e0d0000 pid=3470 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=9d974fec-1800-0000-827b-8c248e0d0000 pid=3470 execve guuid=c655a8ec-1800-0000-827b-8c24900d0000 pid=3472 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=c655a8ec-1800-0000-827b-8c24900d0000 pid=3472 execve guuid=97a9fcec-1800-0000-827b-8c24930d0000 pid=3475 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=97a9fcec-1800-0000-827b-8c24930d0000 pid=3475 execve guuid=6fd356ed-1800-0000-827b-8c24950d0000 pid=3477 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=6fd356ed-1800-0000-827b-8c24950d0000 pid=3477 execve guuid=9260aced-1800-0000-827b-8c24980d0000 pid=3480 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=9260aced-1800-0000-827b-8c24980d0000 pid=3480 execve guuid=b00309ee-1800-0000-827b-8c249a0d0000 pid=3482 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=b00309ee-1800-0000-827b-8c249a0d0000 pid=3482 execve guuid=68c55fee-1800-0000-827b-8c249c0d0000 pid=3484 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=68c55fee-1800-0000-827b-8c249c0d0000 pid=3484 execve guuid=78f202ef-1800-0000-827b-8c24a30d0000 pid=3491 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=78f202ef-1800-0000-827b-8c24a30d0000 pid=3491 execve guuid=5dc971ef-1800-0000-827b-8c24a40d0000 pid=3492 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=5dc971ef-1800-0000-827b-8c24a40d0000 pid=3492 execve guuid=fe320ff0-1800-0000-827b-8c24a50d0000 pid=3493 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=fe320ff0-1800-0000-827b-8c24a50d0000 pid=3493 execve guuid=abf47ef0-1800-0000-827b-8c24a60d0000 pid=3494 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=abf47ef0-1800-0000-827b-8c24a60d0000 pid=3494 execve guuid=3afbf1f0-1800-0000-827b-8c24a70d0000 pid=3495 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=3afbf1f0-1800-0000-827b-8c24a70d0000 pid=3495 execve guuid=58a56af1-1800-0000-827b-8c24a80d0000 pid=3496 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=58a56af1-1800-0000-827b-8c24a80d0000 pid=3496 execve guuid=213edff1-1800-0000-827b-8c24a90d0000 pid=3497 /usr/bin/ls guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=213edff1-1800-0000-827b-8c24a90d0000 pid=3497 execve guuid=6acc41f2-1800-0000-827b-8c24aa0d0000 pid=3498 /usr/bin/rm guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=6acc41f2-1800-0000-827b-8c24aa0d0000 pid=3498 execve guuid=0af982f2-1800-0000-827b-8c24ab0d0000 pid=3499 /usr/bin/wget net send-data write-file guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=0af982f2-1800-0000-827b-8c24ab0d0000 pid=3499 execve guuid=88b6cdf6-1800-0000-827b-8c24b30d0000 pid=3507 /usr/bin/chmod guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=88b6cdf6-1800-0000-827b-8c24b30d0000 pid=3507 execve guuid=e45c13f7-1800-0000-827b-8c24b50d0000 pid=3509 /tmp/E4Dp guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=e45c13f7-1800-0000-827b-8c24b50d0000 pid=3509 execve guuid=5293d5f7-1800-0000-827b-8c24b90d0000 pid=3513 /usr/bin/rm guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=5293d5f7-1800-0000-827b-8c24b90d0000 pid=3513 execve guuid=0e2310f8-1800-0000-827b-8c24bb0d0000 pid=3515 /usr/bin/wget net send-data write-file guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=0e2310f8-1800-0000-827b-8c24bb0d0000 pid=3515 execve guuid=c30f90fa-1800-0000-827b-8c24bf0d0000 pid=3519 /usr/bin/chmod guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=c30f90fa-1800-0000-827b-8c24bf0d0000 pid=3519 execve guuid=9078d8fa-1800-0000-827b-8c24c00d0000 pid=3520 /tmp/LFSo guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=9078d8fa-1800-0000-827b-8c24c00d0000 pid=3520 execve guuid=8a8c60fc-1800-0000-827b-8c24c50d0000 pid=3525 /usr/bin/rm guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=8a8c60fc-1800-0000-827b-8c24c50d0000 pid=3525 execve guuid=a6c49afc-1800-0000-827b-8c24c70d0000 pid=3527 /usr/bin/wget net send-data write-file guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=a6c49afc-1800-0000-827b-8c24c70d0000 pid=3527 execve guuid=f95905ff-1800-0000-827b-8c24cb0d0000 pid=3531 /usr/bin/chmod guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=f95905ff-1800-0000-827b-8c24cb0d0000 pid=3531 execve guuid=eb115cff-1800-0000-827b-8c24cc0d0000 pid=3532 /tmp/BFg guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=eb115cff-1800-0000-827b-8c24cc0d0000 pid=3532 execve guuid=79ad4000-1900-0000-827b-8c24d10d0000 pid=3537 /usr/bin/rm guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=79ad4000-1900-0000-827b-8c24d10d0000 pid=3537 execve guuid=f8d58800-1900-0000-827b-8c24d30d0000 pid=3539 /usr/bin/wget net send-data write-file guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=f8d58800-1900-0000-827b-8c24d30d0000 pid=3539 execve guuid=9c7f6e03-1900-0000-827b-8c24dc0d0000 pid=3548 /usr/bin/chmod guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=9c7f6e03-1900-0000-827b-8c24dc0d0000 pid=3548 execve guuid=eba2bb03-1900-0000-827b-8c24dd0d0000 pid=3549 /tmp/1h4 guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=eba2bb03-1900-0000-827b-8c24dd0d0000 pid=3549 execve guuid=e5e74805-1900-0000-827b-8c24e20d0000 pid=3554 /usr/bin/rm guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=e5e74805-1900-0000-827b-8c24e20d0000 pid=3554 execve guuid=fda1ad05-1900-0000-827b-8c24e40d0000 pid=3556 /usr/bin/wget net send-data write-file guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=fda1ad05-1900-0000-827b-8c24e40d0000 pid=3556 execve guuid=8c99ef0b-1900-0000-827b-8c24eb0d0000 pid=3563 /usr/bin/chmod guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=8c99ef0b-1900-0000-827b-8c24eb0d0000 pid=3563 execve guuid=4c153e0c-1900-0000-827b-8c24ee0d0000 pid=3566 /tmp/3fO guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=4c153e0c-1900-0000-827b-8c24ee0d0000 pid=3566 execve guuid=1313410e-1900-0000-827b-8c24f40d0000 pid=3572 /usr/bin/rm delete-file guuid=49dc8dbe-1800-0000-827b-8c24880c0000 pid=3208->guuid=1313410e-1900-0000-827b-8c24f40d0000 pid=3572 execve 0b1ba66e-2f8f-542f-9f7c-00dd01da057c 129.121.110.105:80 guuid=0af982f2-1800-0000-827b-8c24ab0d0000 pid=3499->0b1ba66e-2f8f-542f-9f7c-00dd01da057c send: 134B guuid=0e2310f8-1800-0000-827b-8c24bb0d0000 pid=3515->0b1ba66e-2f8f-542f-9f7c-00dd01da057c send: 134B guuid=a6c49afc-1800-0000-827b-8c24c70d0000 pid=3527->0b1ba66e-2f8f-542f-9f7c-00dd01da057c send: 133B guuid=f8d58800-1900-0000-827b-8c24d30d0000 pid=3539->0b1ba66e-2f8f-542f-9f7c-00dd01da057c send: 133B guuid=fda1ad05-1900-0000-827b-8c24e40d0000 pid=3556->0b1ba66e-2f8f-542f-9f7c-00dd01da057c send: 133B
Score:
98%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/ff591fcf9b62bf02aaf8b9f3e64fd14e6eb4d2d4275cffee0aa9cdd863c82840
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ff591fcf9b62bf02aaf8b9f3e64fd14e6eb4d2d4275cffee0aa9cdd863c82840/
Threat name:
Win32.Trojan.Malgent
Create hunting rule
Status:
Malicious
First seen:
2026-08-04 20:11:35 UTC
File Type:
Text (Shell)
AV detection:
11 of 24 (45.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=75mr7t43mk7qfkxyxhz6mt6rjzxljuwue5op73qkvhg5qy6ifbaa._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
discovery linux
Link:
https://tria.ge/reports/260804-yyhtbsyfkc/
Behaviour
Reads runtime system information
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.26
Link:
https://yomi.yoroi.company/submissions/ff591fcf9b62bf02aaf8b9f3e64fd14e6eb4d2d4275cffee0aa9cdd863c82840

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh ff591fcf9b62bf02aaf8b9f3e64fd14e6eb4d2d4275cffee0aa9cdd863c82840

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3887344/
  
Delivery method
Distributed via web download

Comments