MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 036c343cd3825c27561c09b0bdd04bcb6ef5a44394d0743a5ba5796edd2cff8b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 8


Intelligence 8 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 036c343cd3825c27561c09b0bdd04bcb6ef5a44394d0743a5ba5796edd2cff8b
SHA3-384 hash: 91c83925cf642800922b68f862843b28a5a56efe1d91c7bd3f790cd43502c7faf5627614d679101493ffb4501e847756
SHA1 hash: fb49c1a8b3664a844fbaa07b5d5acebfd8664bdd
MD5 hash: 22c344f299d9438e3871b025b91230e6
humanhash: fourteen-california-lamp-juliet
File name:k.php
Download: download sample
File size:19'499 bytes
First seen:2026-03-10 21:19:25 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 384:CKO0M3vgRjGlsaq77zsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:CKMmjfHzsP4cbddr7zsP4cbddrk
TLSH T1B0925CB916496C79BBC0DE7D9F3C7F0CADE881C02218A39CBA4F39715A2069DDA0535D
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh

Intelligence

File Origin
# of uploads :
1
# of downloads :
56
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.MulDrop.187.3571.5644.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive masquerade
Link:
https://www.filescan.io/uploads/69b08b149eaae846594755a8/reports/abf868ff-3299-45b5-aa2c-b87a0cb4ff01/overview
Verdict:
Malicious
File Type:
unix shell
Detections:
HEUR:Trojan-Downloader.Shell.Agent.bc
Link:
https://opentip.kaspersky.com/036c343cd3825c27561c09b0bdd04bcb6ef5a44394d0743a5ba5796edd2cff8b/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/87abbfe1-1d89-45b4-a8c2-27a3e36fb284
Behavior Graph:
Download SVG
%3 guuid=2fe13717-1800-0000-1419-8fbd800c0000 pid=3200 /usr/bin/sudo guuid=612fb519-1800-0000-1419-8fbd830c0000 pid=3203 /tmp/sample.bin guuid=2fe13717-1800-0000-1419-8fbd800c0000 pid=3200->guuid=612fb519-1800-0000-1419-8fbd830c0000 pid=3203 execve guuid=8861071a-1800-0000-1419-8fbd850c0000 pid=3205 /usr/bin/bash guuid=612fb519-1800-0000-1419-8fbd830c0000 pid=3203->guuid=8861071a-1800-0000-1419-8fbd850c0000 pid=3205 clone guuid=c64b161a-1800-0000-1419-8fbd870c0000 pid=3207 /usr/bin/bash guuid=612fb519-1800-0000-1419-8fbd830c0000 pid=3203->guuid=c64b161a-1800-0000-1419-8fbd870c0000 pid=3207 clone guuid=67b9501a-1800-0000-1419-8fbd880c0000 pid=3208 /usr/bin/mkdir guuid=612fb519-1800-0000-1419-8fbd830c0000 pid=3203->guuid=67b9501a-1800-0000-1419-8fbd880c0000 pid=3208 execve guuid=f03cb31a-1800-0000-1419-8fbd8a0c0000 pid=3210 /usr/bin/mkdir guuid=612fb519-1800-0000-1419-8fbd830c0000 pid=3203->guuid=f03cb31a-1800-0000-1419-8fbd8a0c0000 pid=3210 execve guuid=2b900a1b-1800-0000-1419-8fbd8c0c0000 pid=3212 /usr/bin/mkdir guuid=612fb519-1800-0000-1419-8fbd830c0000 pid=3203->guuid=2b900a1b-1800-0000-1419-8fbd8c0c0000 pid=3212 execve guuid=07d95f1b-1800-0000-1419-8fbd8e0c0000 pid=3214 /usr/bin/mkdir guuid=612fb519-1800-0000-1419-8fbd830c0000 pid=3203->guuid=07d95f1b-1800-0000-1419-8fbd8e0c0000 pid=3214 execve guuid=a3efaf1b-1800-0000-1419-8fbd900c0000 pid=3216 /usr/bin/mkdir guuid=612fb519-1800-0000-1419-8fbd830c0000 pid=3203->guuid=a3efaf1b-1800-0000-1419-8fbd900c0000 pid=3216 execve guuid=1f0e0d1c-1800-0000-1419-8fbd930c0000 pid=3219 /usr/bin/mkdir guuid=612fb519-1800-0000-1419-8fbd830c0000 pid=3203->guuid=1f0e0d1c-1800-0000-1419-8fbd930c0000 pid=3219 execve guuid=f138631c-1800-0000-1419-8fbd950c0000 pid=3221 /usr/bin/mkdir guuid=612fb519-1800-0000-1419-8fbd830c0000 pid=3203->guuid=f138631c-1800-0000-1419-8fbd950c0000 pid=3221 execve guuid=8d6fc91c-1800-0000-1419-8fbd960c0000 pid=3222 /usr/bin/cp guuid=612fb519-1800-0000-1419-8fbd830c0000 pid=3203->guuid=8d6fc91c-1800-0000-1419-8fbd960c0000 pid=3222 execve guuid=3b45461d-1800-0000-1419-8fbd970c0000 pid=3223 /usr/bin/cp guuid=612fb519-1800-0000-1419-8fbd830c0000 pid=3203->guuid=3b45461d-1800-0000-1419-8fbd970c0000 pid=3223 execve guuid=070e211e-1800-0000-1419-8fbd980c0000 pid=3224 /usr/bin/cp guuid=612fb519-1800-0000-1419-8fbd830c0000 pid=3203->guuid=070e211e-1800-0000-1419-8fbd980c0000 pid=3224 execve guuid=854bcd1e-1800-0000-1419-8fbd990c0000 pid=3225 /usr/bin/cp guuid=612fb519-1800-0000-1419-8fbd830c0000 pid=3203->guuid=854bcd1e-1800-0000-1419-8fbd990c0000 pid=3225 execve guuid=7192581f-1800-0000-1419-8fbd9a0c0000 pid=3226 /usr/bin/cp guuid=612fb519-1800-0000-1419-8fbd830c0000 pid=3203->guuid=7192581f-1800-0000-1419-8fbd9a0c0000 pid=3226 execve guuid=b4ebd71f-1800-0000-1419-8fbd9b0c0000 pid=3227 /usr/bin/cp guuid=612fb519-1800-0000-1419-8fbd830c0000 pid=3203->guuid=b4ebd71f-1800-0000-1419-8fbd9b0c0000 pid=3227 execve guuid=3c430321-1800-0000-1419-8fbd9c0c0000 pid=3228 /usr/bin/cp guuid=612fb519-1800-0000-1419-8fbd830c0000 pid=3203->guuid=3c430321-1800-0000-1419-8fbd9c0c0000 pid=3228 execve guuid=664dc821-1800-0000-1419-8fbd9d0c0000 pid=3229 /usr/bin/cp guuid=612fb519-1800-0000-1419-8fbd830c0000 pid=3203->guuid=664dc821-1800-0000-1419-8fbd9d0c0000 pid=3229 execve guuid=1d4d8f22-1800-0000-1419-8fbd9e0c0000 pid=3230 /usr/bin/cp guuid=612fb519-1800-0000-1419-8fbd830c0000 pid=3203->guuid=1d4d8f22-1800-0000-1419-8fbd9e0c0000 pid=3230 execve guuid=a335a723-1800-0000-1419-8fbd9f0c0000 pid=3231 /usr/bin/cp guuid=612fb519-1800-0000-1419-8fbd830c0000 pid=3203->guuid=a335a723-1800-0000-1419-8fbd9f0c0000 pid=3231 execve guuid=4eb9b524-1800-0000-1419-8fbda00c0000 pid=3232 /usr/bin/cp guuid=612fb519-1800-0000-1419-8fbd830c0000 pid=3203->guuid=4eb9b524-1800-0000-1419-8fbda00c0000 pid=3232 execve guuid=49a49625-1800-0000-1419-8fbda10c0000 pid=3233 /usr/bin/cp guuid=612fb519-1800-0000-1419-8fbd830c0000 pid=3203->guuid=49a49625-1800-0000-1419-8fbda10c0000 pid=3233 execve guuid=227d2926-1800-0000-1419-8fbda20c0000 pid=3234 /usr/bin/cp guuid=612fb519-1800-0000-1419-8fbd830c0000 pid=3203->guuid=227d2926-1800-0000-1419-8fbda20c0000 pid=3234 execve guuid=3b71b126-1800-0000-1419-8fbda30c0000 pid=3235 /usr/bin/cp guuid=612fb519-1800-0000-1419-8fbd830c0000 pid=3203->guuid=3b71b126-1800-0000-1419-8fbda30c0000 pid=3235 execve guuid=91058a27-1800-0000-1419-8fbda40c0000 pid=3236 /usr/bin/cp guuid=612fb519-1800-0000-1419-8fbd830c0000 pid=3203->guuid=91058a27-1800-0000-1419-8fbda40c0000 pid=3236 execve guuid=79960728-1800-0000-1419-8fbda50c0000 pid=3237 /usr/bin/touch guuid=612fb519-1800-0000-1419-8fbd830c0000 pid=3203->guuid=79960728-1800-0000-1419-8fbda50c0000 pid=3237 execve guuid=73926128-1800-0000-1419-8fbda60c0000 pid=3238 /usr/bin/bash guuid=612fb519-1800-0000-1419-8fbd830c0000 pid=3203->guuid=73926128-1800-0000-1419-8fbda60c0000 pid=3238 clone guuid=59306e28-1800-0000-1419-8fbda70c0000 pid=3239 /usr/bin/bash guuid=612fb519-1800-0000-1419-8fbd830c0000 pid=3203->guuid=59306e28-1800-0000-1419-8fbda70c0000 pid=3239 clone guuid=fcb2e028-1800-0000-1419-8fbda80c0000 pid=3240 /usr/bin/bash guuid=612fb519-1800-0000-1419-8fbd830c0000 pid=3203->guuid=fcb2e028-1800-0000-1419-8fbda80c0000 pid=3240 clone guuid=2c67ea28-1800-0000-1419-8fbda90c0000 pid=3241 /usr/bin/base64 write-file guuid=612fb519-1800-0000-1419-8fbd830c0000 pid=3203->guuid=2c67ea28-1800-0000-1419-8fbda90c0000 pid=3241 execve guuid=c112ee29-1800-0000-1419-8fbdaa0c0000 pid=3242 /usr/bin/bash guuid=612fb519-1800-0000-1419-8fbd830c0000 pid=3203->guuid=c112ee29-1800-0000-1419-8fbdaa0c0000 pid=3242 execve guuid=63d46531-1800-0000-1419-8fbdbb0c0000 pid=3259 /usr/bin/rm delete-file guuid=612fb519-1800-0000-1419-8fbd830c0000 pid=3203->guuid=63d46531-1800-0000-1419-8fbdbb0c0000 pid=3259 execve guuid=156fc531-1800-0000-1419-8fbdbc0c0000 pid=3260 /usr/bin/bash guuid=612fb519-1800-0000-1419-8fbd830c0000 pid=3203->guuid=156fc531-1800-0000-1419-8fbdbc0c0000 pid=3260 clone guuid=248ecf31-1800-0000-1419-8fbdbd0c0000 pid=3261 /usr/bin/bash guuid=612fb519-1800-0000-1419-8fbd830c0000 pid=3203->guuid=248ecf31-1800-0000-1419-8fbdbd0c0000 pid=3261 clone guuid=81432d32-1800-0000-1419-8fbdbf0c0000 pid=3263 /usr/bin/bash guuid=612fb519-1800-0000-1419-8fbd830c0000 pid=3203->guuid=81432d32-1800-0000-1419-8fbdbf0c0000 pid=3263 execve guuid=befecc32-1800-0000-1419-8fbdc10c0000 pid=3265 /usr/bin/rm guuid=612fb519-1800-0000-1419-8fbd830c0000 pid=3203->guuid=befecc32-1800-0000-1419-8fbdc10c0000 pid=3265 execve guuid=5069942a-1800-0000-1419-8fbdab0c0000 pid=3243 /usr/bin/bash guuid=c112ee29-1800-0000-1419-8fbdaa0c0000 pid=3242->guuid=5069942a-1800-0000-1419-8fbdab0c0000 pid=3243 clone guuid=abb4a22a-1800-0000-1419-8fbdac0c0000 pid=3244 /usr/bin/bash guuid=c112ee29-1800-0000-1419-8fbdaa0c0000 pid=3242->guuid=abb4a22a-1800-0000-1419-8fbdac0c0000 pid=3244 clone guuid=27b6052b-1800-0000-1419-8fbdad0c0000 pid=3245 /usr/bin/ls guuid=c112ee29-1800-0000-1419-8fbdaa0c0000 pid=3242->guuid=27b6052b-1800-0000-1419-8fbdad0c0000 pid=3245 execve guuid=9d02aa2b-1800-0000-1419-8fbdae0c0000 pid=3246 /usr/bin/cat guuid=c112ee29-1800-0000-1419-8fbdaa0c0000 pid=3242->guuid=9d02aa2b-1800-0000-1419-8fbdae0c0000 pid=3246 execve guuid=1aea062c-1800-0000-1419-8fbdaf0c0000 pid=3247 /usr/bin/ls guuid=c112ee29-1800-0000-1419-8fbdaa0c0000 pid=3242->guuid=1aea062c-1800-0000-1419-8fbdaf0c0000 pid=3247 execve guuid=6d079d2c-1800-0000-1419-8fbdb00c0000 pid=3248 /usr/bin/mkdir guuid=c112ee29-1800-0000-1419-8fbdaa0c0000 pid=3242->guuid=6d079d2c-1800-0000-1419-8fbdb00c0000 pid=3248 execve guuid=38a01a2d-1800-0000-1419-8fbdb10c0000 pid=3249 /usr/bin/mv guuid=c112ee29-1800-0000-1419-8fbdaa0c0000 pid=3242->guuid=38a01a2d-1800-0000-1419-8fbdb10c0000 pid=3249 execve guuid=a940932d-1800-0000-1419-8fbdb20c0000 pid=3250 /usr/bin/bash guuid=c112ee29-1800-0000-1419-8fbdaa0c0000 pid=3242->guuid=a940932d-1800-0000-1419-8fbdb20c0000 pid=3250 clone guuid=603e9c2d-1800-0000-1419-8fbdb30c0000 pid=3251 /usr/bin/base64 write-file guuid=c112ee29-1800-0000-1419-8fbdaa0c0000 pid=3242->guuid=603e9c2d-1800-0000-1419-8fbdb30c0000 pid=3251 execve guuid=33bd442e-1800-0000-1419-8fbdb40c0000 pid=3252 /usr/bin/rm delete-file guuid=c112ee29-1800-0000-1419-8fbdaa0c0000 pid=3242->guuid=33bd442e-1800-0000-1419-8fbdb40c0000 pid=3252 execve guuid=b7d9a12e-1800-0000-1419-8fbdb50c0000 pid=3253 /usr/bin/ls guuid=c112ee29-1800-0000-1419-8fbdaa0c0000 pid=3242->guuid=b7d9a12e-1800-0000-1419-8fbdb50c0000 pid=3253 execve guuid=a9bd302f-1800-0000-1419-8fbdb60c0000 pid=3254 /usr/bin/bash guuid=c112ee29-1800-0000-1419-8fbdaa0c0000 pid=3242->guuid=a9bd302f-1800-0000-1419-8fbdb60c0000 pid=3254 clone guuid=65693a2f-1800-0000-1419-8fbdb70c0000 pid=3255 /usr/bin/base64 write-file guuid=c112ee29-1800-0000-1419-8fbdaa0c0000 pid=3242->guuid=65693a2f-1800-0000-1419-8fbdb70c0000 pid=3255 execve guuid=e738ac2f-1800-0000-1419-8fbdb80c0000 pid=3256 /usr/bin/ls guuid=c112ee29-1800-0000-1419-8fbdaa0c0000 pid=3242->guuid=e738ac2f-1800-0000-1419-8fbdb80c0000 pid=3256 execve guuid=88ae4030-1800-0000-1419-8fbdb90c0000 pid=3257 /usr/bin/cat guuid=c112ee29-1800-0000-1419-8fbdaa0c0000 pid=3242->guuid=88ae4030-1800-0000-1419-8fbdb90c0000 pid=3257 execve guuid=3fc9cc30-1800-0000-1419-8fbdba0c0000 pid=3258 /usr/bin/ls guuid=c112ee29-1800-0000-1419-8fbdaa0c0000 pid=3242->guuid=3fc9cc30-1800-0000-1419-8fbdba0c0000 pid=3258 execve
Score:
81%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/036c343cd3825c27561c09b0bdd04bcb6ef5a44394d0743a5ba5796edd2cff8b
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/036c343cd3825c27561c09b0bdd04bcb6ef5a44394d0743a5ba5796edd2cff8b/
Verdict:
Malicious
Threat:
Trojan-Downloader.Shell.Agent
Link:
https://tip.neiki.dev/file/036c343cd3825c27561c09b0bdd04bcb6ef5a44394d0743a5ba5796edd2cff8b
Threat name:
Script-Shell.Trojan.Vigorf
Create hunting rule
Status:
Malicious
First seen:
2026-03-10 21:20:25 UTC
File Type:
Text (Shell)
AV detection:
13 of 24 (54.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=anwdipgtqjocovq4bgyl3uclznxpljcdstihios3uv4w5xjm76fq._file
Result
Malware family:
n/a
Score:
  4/10
Tags:
defense_evasion discovery linux
Link:
https://tria.ge/reports/260310-z6x4nabz9l/
Behaviour
Reads runtime system information
Writes file to tmp directory
Deobfuscate/Decode Files or Information
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.64
Link:
https://yomi.yoroi.company/submissions/036c343cd3825c27561c09b0bdd04bcb6ef5a44394d0743a5ba5796edd2cff8b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SUSP_LNX_Base64_Exec_Apr24
Create hunting rule
Author:Christian Burkard
Description:Detects suspicious base64 encoded shell commands (as seen in Palo Alto CVE-2024-3400 exploitation)
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 036c343cd3825c27561c09b0bdd04bcb6ef5a44394d0743a5ba5796edd2cff8b

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3784565/
  
Delivery method
Distributed via web download

Comments