MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0d8758e97610f6e5ec6a1c23ba0c51b535d13732bc8f90d1977b98c69bb94eb2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0d8758e97610f6e5ec6a1c23ba0c51b535d13732bc8f90d1977b98c69bb94eb2
SHA3-384 hash: 09bd6b2136af9f179abe69fa672d9f7992c95e2cb9f7eb344d58ff83e3e24d989c617275e8312c4e30cbb2989618ec02
SHA1 hash: 905561f410339e02174a0abadf5109d80efbdd72
MD5 hash: b19b2291e6098392e4cd0c279e05fb4a
humanhash: foxtrot-venus-moon-juliet
File name:k.php
Download: download sample
File size:19'499 bytes
First seen:2026-03-01 20:42:27 UTC
Last seen:2026-03-02 08:29:09 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 384:RVdcuQpWx+BL0SWL0guzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:Rv8i+BL0SI0NzsP4cbddr7zsP4cbddrk
TLSH T158924CB512896C79FBD1CE39AF3C6F4DADE8C2C42124A3ACBA4F39205A1166DC705359
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh

Intelligence

File Origin
# of uploads :
2
# of downloads :
64
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.BV.Agent-BNQ.64367933.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive masquerade
Link:
https://www.filescan.io/uploads/69a4a4e29eaae84659411cc0/reports/74c6ee17-572f-4814-be79-4b914c2ed20c/overview
Verdict:
Malicious
File Type:
unix shell
Detections:
HEUR:Trojan-Downloader.Shell.Agent.bc
Link:
https://opentip.kaspersky.com/0d8758e97610f6e5ec6a1c23ba0c51b535d13732bc8f90d1977b98c69bb94eb2/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/eb5ba418-15ba-40b7-80cd-4c1bc3e2a936
Behavior Graph:
Download SVG
%3 guuid=f7da84ca-1900-0000-308f-0bef82040000 pid=1154 /usr/bin/sudo guuid=90e417cc-1900-0000-308f-0bef86040000 pid=1158 /tmp/sample.bin guuid=f7da84ca-1900-0000-308f-0bef82040000 pid=1154->guuid=90e417cc-1900-0000-308f-0bef86040000 pid=1158 execve guuid=5f8347cd-1900-0000-308f-0bef87040000 pid=1159 /usr/bin/bash guuid=90e417cc-1900-0000-308f-0bef86040000 pid=1158->guuid=5f8347cd-1900-0000-308f-0bef87040000 pid=1159 clone guuid=d5715dcd-1900-0000-308f-0bef88040000 pid=1160 /usr/bin/bash guuid=90e417cc-1900-0000-308f-0bef86040000 pid=1158->guuid=d5715dcd-1900-0000-308f-0bef88040000 pid=1160 clone guuid=b3429dcd-1900-0000-308f-0bef89040000 pid=1161 /usr/bin/mkdir guuid=90e417cc-1900-0000-308f-0bef86040000 pid=1158->guuid=b3429dcd-1900-0000-308f-0bef89040000 pid=1161 execve guuid=fcb637ce-1900-0000-308f-0bef8b040000 pid=1163 /usr/bin/mkdir guuid=90e417cc-1900-0000-308f-0bef86040000 pid=1158->guuid=fcb637ce-1900-0000-308f-0bef8b040000 pid=1163 execve guuid=a2b2aece-1900-0000-308f-0bef8c040000 pid=1164 /usr/bin/mkdir guuid=90e417cc-1900-0000-308f-0bef86040000 pid=1158->guuid=a2b2aece-1900-0000-308f-0bef8c040000 pid=1164 execve guuid=613118cf-1900-0000-308f-0bef8d040000 pid=1165 /usr/bin/mkdir guuid=90e417cc-1900-0000-308f-0bef86040000 pid=1158->guuid=613118cf-1900-0000-308f-0bef8d040000 pid=1165 execve guuid=894175cf-1900-0000-308f-0bef8f040000 pid=1167 /usr/bin/mkdir guuid=90e417cc-1900-0000-308f-0bef86040000 pid=1158->guuid=894175cf-1900-0000-308f-0bef8f040000 pid=1167 execve guuid=34fbcacf-1900-0000-308f-0bef91040000 pid=1169 /usr/bin/mkdir guuid=90e417cc-1900-0000-308f-0bef86040000 pid=1158->guuid=34fbcacf-1900-0000-308f-0bef91040000 pid=1169 execve guuid=c72a2dd0-1900-0000-308f-0bef93040000 pid=1171 /usr/bin/mkdir guuid=90e417cc-1900-0000-308f-0bef86040000 pid=1158->guuid=c72a2dd0-1900-0000-308f-0bef93040000 pid=1171 execve guuid=ec6388d0-1900-0000-308f-0bef96040000 pid=1174 /usr/bin/cp guuid=90e417cc-1900-0000-308f-0bef86040000 pid=1158->guuid=ec6388d0-1900-0000-308f-0bef96040000 pid=1174 execve guuid=dd85edd0-1900-0000-308f-0bef98040000 pid=1176 /usr/bin/cp guuid=90e417cc-1900-0000-308f-0bef86040000 pid=1158->guuid=dd85edd0-1900-0000-308f-0bef98040000 pid=1176 execve guuid=61507bd1-1900-0000-308f-0bef9b040000 pid=1179 /usr/bin/cp guuid=90e417cc-1900-0000-308f-0bef86040000 pid=1158->guuid=61507bd1-1900-0000-308f-0bef9b040000 pid=1179 execve guuid=8d43efd1-1900-0000-308f-0bef9d040000 pid=1181 /usr/bin/cp guuid=90e417cc-1900-0000-308f-0bef86040000 pid=1158->guuid=8d43efd1-1900-0000-308f-0bef9d040000 pid=1181 execve guuid=1d755ed2-1900-0000-308f-0bef9e040000 pid=1182 /usr/bin/cp guuid=90e417cc-1900-0000-308f-0bef86040000 pid=1158->guuid=1d755ed2-1900-0000-308f-0bef9e040000 pid=1182 execve guuid=0990d4d2-1900-0000-308f-0bef9f040000 pid=1183 /usr/bin/cp guuid=90e417cc-1900-0000-308f-0bef86040000 pid=1158->guuid=0990d4d2-1900-0000-308f-0bef9f040000 pid=1183 execve guuid=75fc42d3-1900-0000-308f-0befa0040000 pid=1184 /usr/bin/cp guuid=90e417cc-1900-0000-308f-0bef86040000 pid=1158->guuid=75fc42d3-1900-0000-308f-0befa0040000 pid=1184 execve guuid=3a0cadd3-1900-0000-308f-0befa2040000 pid=1186 /usr/bin/cp guuid=90e417cc-1900-0000-308f-0bef86040000 pid=1158->guuid=3a0cadd3-1900-0000-308f-0befa2040000 pid=1186 execve guuid=c12225d4-1900-0000-308f-0befa3040000 pid=1187 /usr/bin/cp guuid=90e417cc-1900-0000-308f-0bef86040000 pid=1158->guuid=c12225d4-1900-0000-308f-0befa3040000 pid=1187 execve guuid=0b869ad4-1900-0000-308f-0befa5040000 pid=1189 /usr/bin/cp guuid=90e417cc-1900-0000-308f-0bef86040000 pid=1158->guuid=0b869ad4-1900-0000-308f-0befa5040000 pid=1189 execve guuid=5f7efcd4-1900-0000-308f-0befa7040000 pid=1191 /usr/bin/cp guuid=90e417cc-1900-0000-308f-0bef86040000 pid=1158->guuid=5f7efcd4-1900-0000-308f-0befa7040000 pid=1191 execve guuid=13426ad5-1900-0000-308f-0befaa040000 pid=1194 /usr/bin/cp guuid=90e417cc-1900-0000-308f-0bef86040000 pid=1158->guuid=13426ad5-1900-0000-308f-0befaa040000 pid=1194 execve guuid=2a0fd8d5-1900-0000-308f-0befac040000 pid=1196 /usr/bin/cp guuid=90e417cc-1900-0000-308f-0bef86040000 pid=1158->guuid=2a0fd8d5-1900-0000-308f-0befac040000 pid=1196 execve guuid=fe984cd6-1900-0000-308f-0befae040000 pid=1198 /usr/bin/cp guuid=90e417cc-1900-0000-308f-0bef86040000 pid=1158->guuid=fe984cd6-1900-0000-308f-0befae040000 pid=1198 execve guuid=af63b6d6-1900-0000-308f-0befaf040000 pid=1199 /usr/bin/cp guuid=90e417cc-1900-0000-308f-0bef86040000 pid=1158->guuid=af63b6d6-1900-0000-308f-0befaf040000 pid=1199 execve guuid=294820d7-1900-0000-308f-0befb1040000 pid=1201 /usr/bin/touch guuid=90e417cc-1900-0000-308f-0bef86040000 pid=1158->guuid=294820d7-1900-0000-308f-0befb1040000 pid=1201 execve guuid=0f126cd7-1900-0000-308f-0befb3040000 pid=1203 /usr/bin/bash guuid=90e417cc-1900-0000-308f-0bef86040000 pid=1158->guuid=0f126cd7-1900-0000-308f-0befb3040000 pid=1203 clone guuid=fcb172d7-1900-0000-308f-0befb4040000 pid=1204 /usr/bin/bash guuid=90e417cc-1900-0000-308f-0bef86040000 pid=1158->guuid=fcb172d7-1900-0000-308f-0befb4040000 pid=1204 clone guuid=7d7a96d7-1900-0000-308f-0befb6040000 pid=1206 /usr/bin/bash guuid=90e417cc-1900-0000-308f-0bef86040000 pid=1158->guuid=7d7a96d7-1900-0000-308f-0befb6040000 pid=1206 clone guuid=807f9dd7-1900-0000-308f-0befb7040000 pid=1207 /usr/bin/base64 write-file guuid=90e417cc-1900-0000-308f-0bef86040000 pid=1158->guuid=807f9dd7-1900-0000-308f-0befb7040000 pid=1207 execve guuid=bad419d8-1900-0000-308f-0befb9040000 pid=1209 /usr/bin/bash guuid=90e417cc-1900-0000-308f-0bef86040000 pid=1158->guuid=bad419d8-1900-0000-308f-0befb9040000 pid=1209 execve guuid=bd0388dd-1900-0000-308f-0befd9040000 pid=1241 /usr/bin/rm delete-file guuid=90e417cc-1900-0000-308f-0bef86040000 pid=1158->guuid=bd0388dd-1900-0000-308f-0befd9040000 pid=1241 execve guuid=320601de-1900-0000-308f-0befda040000 pid=1242 /usr/bin/bash guuid=90e417cc-1900-0000-308f-0bef86040000 pid=1158->guuid=320601de-1900-0000-308f-0befda040000 pid=1242 clone guuid=550409de-1900-0000-308f-0befdb040000 pid=1243 /usr/bin/bash guuid=90e417cc-1900-0000-308f-0bef86040000 pid=1158->guuid=550409de-1900-0000-308f-0befdb040000 pid=1243 clone guuid=86b837de-1900-0000-308f-0befdc040000 pid=1244 /usr/bin/bash guuid=90e417cc-1900-0000-308f-0bef86040000 pid=1158->guuid=86b837de-1900-0000-308f-0befdc040000 pid=1244 execve guuid=f527b3de-1900-0000-308f-0befde040000 pid=1246 /usr/bin/rm guuid=90e417cc-1900-0000-308f-0bef86040000 pid=1158->guuid=f527b3de-1900-0000-308f-0befde040000 pid=1246 execve guuid=5acc6cd8-1900-0000-308f-0befbb040000 pid=1211 /usr/bin/bash guuid=bad419d8-1900-0000-308f-0befb9040000 pid=1209->guuid=5acc6cd8-1900-0000-308f-0befbb040000 pid=1211 clone guuid=6e3972d8-1900-0000-308f-0befbc040000 pid=1212 /usr/bin/bash guuid=bad419d8-1900-0000-308f-0befb9040000 pid=1209->guuid=6e3972d8-1900-0000-308f-0befbc040000 pid=1212 clone guuid=ea6793d8-1900-0000-308f-0befbe040000 pid=1214 /usr/bin/ls guuid=bad419d8-1900-0000-308f-0befb9040000 pid=1209->guuid=ea6793d8-1900-0000-308f-0befbe040000 pid=1214 execve guuid=48392dd9-1900-0000-308f-0befc1040000 pid=1217 /usr/bin/cat guuid=bad419d8-1900-0000-308f-0befb9040000 pid=1209->guuid=48392dd9-1900-0000-308f-0befc1040000 pid=1217 execve guuid=585e73d9-1900-0000-308f-0befc2040000 pid=1218 /usr/bin/ls guuid=bad419d8-1900-0000-308f-0befb9040000 pid=1209->guuid=585e73d9-1900-0000-308f-0befc2040000 pid=1218 execve guuid=0128ecd9-1900-0000-308f-0befc5040000 pid=1221 /usr/bin/mkdir guuid=bad419d8-1900-0000-308f-0befb9040000 pid=1209->guuid=0128ecd9-1900-0000-308f-0befc5040000 pid=1221 execve guuid=d9c340da-1900-0000-308f-0befc7040000 pid=1223 /usr/bin/mv guuid=bad419d8-1900-0000-308f-0befb9040000 pid=1209->guuid=d9c340da-1900-0000-308f-0befc7040000 pid=1223 execve guuid=1d26cbda-1900-0000-308f-0befca040000 pid=1226 /usr/bin/bash guuid=bad419d8-1900-0000-308f-0befb9040000 pid=1209->guuid=1d26cbda-1900-0000-308f-0befca040000 pid=1226 clone guuid=e335d2da-1900-0000-308f-0befcc040000 pid=1228 /usr/bin/base64 write-file guuid=bad419d8-1900-0000-308f-0befb9040000 pid=1209->guuid=e335d2da-1900-0000-308f-0befcc040000 pid=1228 execve guuid=395a23db-1900-0000-308f-0befce040000 pid=1230 /usr/bin/rm delete-file guuid=bad419d8-1900-0000-308f-0befb9040000 pid=1209->guuid=395a23db-1900-0000-308f-0befce040000 pid=1230 execve guuid=b0b769db-1900-0000-308f-0befd0040000 pid=1232 /usr/bin/ls guuid=bad419d8-1900-0000-308f-0befb9040000 pid=1209->guuid=b0b769db-1900-0000-308f-0befd0040000 pid=1232 execve guuid=3643d1db-1900-0000-308f-0befd3040000 pid=1235 /usr/bin/bash guuid=bad419d8-1900-0000-308f-0befb9040000 pid=1209->guuid=3643d1db-1900-0000-308f-0befd3040000 pid=1235 clone guuid=e942d7db-1900-0000-308f-0befd4040000 pid=1236 /usr/bin/base64 write-file guuid=bad419d8-1900-0000-308f-0befb9040000 pid=1209->guuid=e942d7db-1900-0000-308f-0befd4040000 pid=1236 execve guuid=f23520dc-1900-0000-308f-0befd5040000 pid=1237 /usr/bin/ls guuid=bad419d8-1900-0000-308f-0befb9040000 pid=1209->guuid=f23520dc-1900-0000-308f-0befd5040000 pid=1237 execve guuid=bf4589dc-1900-0000-308f-0befd7040000 pid=1239 /usr/bin/cat guuid=bad419d8-1900-0000-308f-0befb9040000 pid=1209->guuid=bf4589dc-1900-0000-308f-0befd7040000 pid=1239 execve guuid=fb01d9dc-1900-0000-308f-0befd8040000 pid=1240 /usr/bin/ls guuid=bad419d8-1900-0000-308f-0befb9040000 pid=1209->guuid=fb01d9dc-1900-0000-308f-0befd8040000 pid=1240 execve
Score:
81%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/0d8758e97610f6e5ec6a1c23ba0c51b535d13732bc8f90d1977b98c69bb94eb2
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0d8758e97610f6e5ec6a1c23ba0c51b535d13732bc8f90d1977b98c69bb94eb2/
Verdict:
Malicious
Threat:
Trojan-Downloader.Shell.Agent
Link:
https://tip.neiki.dev/file/0d8758e97610f6e5ec6a1c23ba0c51b535d13732bc8f90d1977b98c69bb94eb2
Threat name:
Script-Shell.Trojan.Vigorf
Create hunting rule
Status:
Malicious
First seen:
2026-03-01 20:43:37 UTC
File Type:
Text (Shell)
AV detection:
13 of 24 (54.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bwdvr2lwcd3ol3dkdqr3udcrwu25cnzsxshzbumxpommng5zj2za._file
Result
Malware family:
n/a
Score:
  4/10
Tags:
defense_evasion discovery linux
Link:
https://tria.ge/reports/260301-zhnv3scy3f/
Behaviour
Reads runtime system information
Writes file to tmp directory
Deobfuscate/Decode Files or Information
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/0d8758e97610f6e5ec6a1c23ba0c51b535d13732bc8f90d1977b98c69bb94eb2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SUSP_LNX_Base64_Exec_Apr24
Create hunting rule
Author:Christian Burkard
Description:Detects suspicious base64 encoded shell commands (as seen in Palo Alto CVE-2024-3400 exploitation)
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 0d8758e97610f6e5ec6a1c23ba0c51b535d13732bc8f90d1977b98c69bb94eb2

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3784565/
  
Delivery method
Distributed via web download

Comments