MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 273fea99829bf43a4601b716c1bdd5a8bfe4d3645cc9d265cf565377c6edcfc2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 273fea99829bf43a4601b716c1bdd5a8bfe4d3645cc9d265cf565377c6edcfc2
SHA3-384 hash: 7e91e29a4fb538b589849a6485d98de5a44d5f20370caaf40034d2d2989ed551fa842444d3bb5eb8103aa19c9ebd7bd5
SHA1 hash: a6139bdc4bf394408cb700424307a4ebf84b5b63
MD5 hash: cbff06525776d9ef660e58254d25400d
humanhash: romeo-uniform-solar-nine
File name:k.php
Download: download sample
File size:19'499 bytes
First seen:2026-03-03 08:29:39 UTC
Last seen:2026-03-03 13:16:05 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 384:1icuQpWx+BL0SWL0gOzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:1i8i+BL0SI05zsP4cbddr7zsP4cbddrk
TLSH T13F924CB512896C79FBD0CE399F3C6F4DADE8C2C42124E3ADBA0F39215A1166DC70535A
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh

Intelligence

File Origin
# of uploads :
2
# of downloads :
72
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.MulDrop.187.23946.19118.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive masquerade
Link:
https://www.filescan.io/uploads/69a69c2197feb4afd6667978/reports/985c3fce-9bfe-46b7-88b2-cf9da72cf4e3/overview
Verdict:
Malicious
File Type:
unix shell
Detections:
HEUR:Trojan-Downloader.Shell.Agent.bc
Link:
https://opentip.kaspersky.com/273fea99829bf43a4601b716c1bdd5a8bfe4d3645cc9d265cf565377c6edcfc2/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/1fd1ea21-00cc-4eab-bf85-0cd0f50fc638
Behavior Graph:
Download SVG
%3 guuid=a8bb61b6-1600-0000-a000-d8c9d00d0000 pid=3536 /usr/bin/sudo guuid=a7ce6db8-1600-0000-a000-d8c9d60d0000 pid=3542 /tmp/sample.bin guuid=a8bb61b6-1600-0000-a000-d8c9d00d0000 pid=3536->guuid=a7ce6db8-1600-0000-a000-d8c9d60d0000 pid=3542 execve guuid=e036fbb8-1600-0000-a000-d8c9d90d0000 pid=3545 /usr/bin/bash guuid=a7ce6db8-1600-0000-a000-d8c9d60d0000 pid=3542->guuid=e036fbb8-1600-0000-a000-d8c9d90d0000 pid=3545 clone guuid=69fe04b9-1600-0000-a000-d8c9da0d0000 pid=3546 /usr/bin/bash guuid=a7ce6db8-1600-0000-a000-d8c9d60d0000 pid=3542->guuid=69fe04b9-1600-0000-a000-d8c9da0d0000 pid=3546 clone guuid=fb3c39b9-1600-0000-a000-d8c9dc0d0000 pid=3548 /usr/bin/mkdir guuid=a7ce6db8-1600-0000-a000-d8c9d60d0000 pid=3542->guuid=fb3c39b9-1600-0000-a000-d8c9dc0d0000 pid=3548 execve guuid=b62b90b9-1600-0000-a000-d8c9de0d0000 pid=3550 /usr/bin/mkdir guuid=a7ce6db8-1600-0000-a000-d8c9d60d0000 pid=3542->guuid=b62b90b9-1600-0000-a000-d8c9de0d0000 pid=3550 execve guuid=c6b8e0b9-1600-0000-a000-d8c9e00d0000 pid=3552 /usr/bin/mkdir guuid=a7ce6db8-1600-0000-a000-d8c9d60d0000 pid=3542->guuid=c6b8e0b9-1600-0000-a000-d8c9e00d0000 pid=3552 execve guuid=fb5d62ba-1600-0000-a000-d8c9e30d0000 pid=3555 /usr/bin/mkdir guuid=a7ce6db8-1600-0000-a000-d8c9d60d0000 pid=3542->guuid=fb5d62ba-1600-0000-a000-d8c9e30d0000 pid=3555 execve guuid=d113b4ba-1600-0000-a000-d8c9e40d0000 pid=3556 /usr/bin/mkdir guuid=a7ce6db8-1600-0000-a000-d8c9d60d0000 pid=3542->guuid=d113b4ba-1600-0000-a000-d8c9e40d0000 pid=3556 execve guuid=d34911bb-1600-0000-a000-d8c9e60d0000 pid=3558 /usr/bin/mkdir guuid=a7ce6db8-1600-0000-a000-d8c9d60d0000 pid=3542->guuid=d34911bb-1600-0000-a000-d8c9e60d0000 pid=3558 execve guuid=a5485dbb-1600-0000-a000-d8c9e80d0000 pid=3560 /usr/bin/mkdir guuid=a7ce6db8-1600-0000-a000-d8c9d60d0000 pid=3542->guuid=a5485dbb-1600-0000-a000-d8c9e80d0000 pid=3560 execve guuid=5008b7bb-1600-0000-a000-d8c9ea0d0000 pid=3562 /usr/bin/cp guuid=a7ce6db8-1600-0000-a000-d8c9d60d0000 pid=3542->guuid=5008b7bb-1600-0000-a000-d8c9ea0d0000 pid=3562 execve guuid=335f3ebc-1600-0000-a000-d8c9f00d0000 pid=3568 /usr/bin/cp guuid=a7ce6db8-1600-0000-a000-d8c9d60d0000 pid=3542->guuid=335f3ebc-1600-0000-a000-d8c9f00d0000 pid=3568 execve guuid=d9a7ccbc-1600-0000-a000-d8c9f20d0000 pid=3570 /usr/bin/cp guuid=a7ce6db8-1600-0000-a000-d8c9d60d0000 pid=3542->guuid=d9a7ccbc-1600-0000-a000-d8c9f20d0000 pid=3570 execve guuid=31d626bd-1600-0000-a000-d8c9f30d0000 pid=3571 /usr/bin/cp guuid=a7ce6db8-1600-0000-a000-d8c9d60d0000 pid=3542->guuid=31d626bd-1600-0000-a000-d8c9f30d0000 pid=3571 execve guuid=64837ebd-1600-0000-a000-d8c9f50d0000 pid=3573 /usr/bin/cp guuid=a7ce6db8-1600-0000-a000-d8c9d60d0000 pid=3542->guuid=64837ebd-1600-0000-a000-d8c9f50d0000 pid=3573 execve guuid=7aceefbd-1600-0000-a000-d8c9f70d0000 pid=3575 /usr/bin/cp guuid=a7ce6db8-1600-0000-a000-d8c9d60d0000 pid=3542->guuid=7aceefbd-1600-0000-a000-d8c9f70d0000 pid=3575 execve guuid=dde648be-1600-0000-a000-d8c9f90d0000 pid=3577 /usr/bin/cp guuid=a7ce6db8-1600-0000-a000-d8c9d60d0000 pid=3542->guuid=dde648be-1600-0000-a000-d8c9f90d0000 pid=3577 execve guuid=50fae4be-1600-0000-a000-d8c9fc0d0000 pid=3580 /usr/bin/cp guuid=a7ce6db8-1600-0000-a000-d8c9d60d0000 pid=3542->guuid=50fae4be-1600-0000-a000-d8c9fc0d0000 pid=3580 execve guuid=a5df47bf-1600-0000-a000-d8c9fe0d0000 pid=3582 /usr/bin/cp guuid=a7ce6db8-1600-0000-a000-d8c9d60d0000 pid=3542->guuid=a5df47bf-1600-0000-a000-d8c9fe0d0000 pid=3582 execve guuid=2e63c7bf-1600-0000-a000-d8c9000e0000 pid=3584 /usr/bin/cp guuid=a7ce6db8-1600-0000-a000-d8c9d60d0000 pid=3542->guuid=2e63c7bf-1600-0000-a000-d8c9000e0000 pid=3584 execve guuid=e13d25c0-1600-0000-a000-d8c9020e0000 pid=3586 /usr/bin/cp guuid=a7ce6db8-1600-0000-a000-d8c9d60d0000 pid=3542->guuid=e13d25c0-1600-0000-a000-d8c9020e0000 pid=3586 execve guuid=dd0e8ec0-1600-0000-a000-d8c9040e0000 pid=3588 /usr/bin/cp guuid=a7ce6db8-1600-0000-a000-d8c9d60d0000 pid=3542->guuid=dd0e8ec0-1600-0000-a000-d8c9040e0000 pid=3588 execve guuid=7334ebc0-1600-0000-a000-d8c9060e0000 pid=3590 /usr/bin/cp guuid=a7ce6db8-1600-0000-a000-d8c9d60d0000 pid=3542->guuid=7334ebc0-1600-0000-a000-d8c9060e0000 pid=3590 execve guuid=0fe645c1-1600-0000-a000-d8c9080e0000 pid=3592 /usr/bin/cp guuid=a7ce6db8-1600-0000-a000-d8c9d60d0000 pid=3542->guuid=0fe645c1-1600-0000-a000-d8c9080e0000 pid=3592 execve guuid=16f4abc1-1600-0000-a000-d8c9090e0000 pid=3593 /usr/bin/cp guuid=a7ce6db8-1600-0000-a000-d8c9d60d0000 pid=3542->guuid=16f4abc1-1600-0000-a000-d8c9090e0000 pid=3593 execve guuid=818009c2-1600-0000-a000-d8c90b0e0000 pid=3595 /usr/bin/touch guuid=a7ce6db8-1600-0000-a000-d8c9d60d0000 pid=3542->guuid=818009c2-1600-0000-a000-d8c90b0e0000 pid=3595 execve guuid=817348c2-1600-0000-a000-d8c90c0e0000 pid=3596 /usr/bin/bash guuid=a7ce6db8-1600-0000-a000-d8c9d60d0000 pid=3542->guuid=817348c2-1600-0000-a000-d8c90c0e0000 pid=3596 clone guuid=c37d4ec2-1600-0000-a000-d8c90d0e0000 pid=3597 /usr/bin/bash guuid=a7ce6db8-1600-0000-a000-d8c9d60d0000 pid=3542->guuid=c37d4ec2-1600-0000-a000-d8c90d0e0000 pid=3597 clone guuid=8d5d74c2-1600-0000-a000-d8c90e0e0000 pid=3598 /usr/bin/bash guuid=a7ce6db8-1600-0000-a000-d8c9d60d0000 pid=3542->guuid=8d5d74c2-1600-0000-a000-d8c90e0e0000 pid=3598 clone guuid=5b857cc2-1600-0000-a000-d8c90f0e0000 pid=3599 /usr/bin/base64 write-file guuid=a7ce6db8-1600-0000-a000-d8c9d60d0000 pid=3542->guuid=5b857cc2-1600-0000-a000-d8c90f0e0000 pid=3599 execve guuid=66212bc3-1600-0000-a000-d8c9120e0000 pid=3602 /usr/bin/bash guuid=a7ce6db8-1600-0000-a000-d8c9d60d0000 pid=3542->guuid=66212bc3-1600-0000-a000-d8c9120e0000 pid=3602 execve guuid=55710dc9-1600-0000-a000-d8c9340e0000 pid=3636 /usr/bin/rm delete-file guuid=a7ce6db8-1600-0000-a000-d8c9d60d0000 pid=3542->guuid=55710dc9-1600-0000-a000-d8c9340e0000 pid=3636 execve guuid=641152c9-1600-0000-a000-d8c9350e0000 pid=3637 /usr/bin/bash guuid=a7ce6db8-1600-0000-a000-d8c9d60d0000 pid=3542->guuid=641152c9-1600-0000-a000-d8c9350e0000 pid=3637 clone guuid=81115ac9-1600-0000-a000-d8c9360e0000 pid=3638 /usr/bin/bash guuid=a7ce6db8-1600-0000-a000-d8c9d60d0000 pid=3542->guuid=81115ac9-1600-0000-a000-d8c9360e0000 pid=3638 clone guuid=3d7297c9-1600-0000-a000-d8c9380e0000 pid=3640 /usr/bin/bash guuid=a7ce6db8-1600-0000-a000-d8c9d60d0000 pid=3542->guuid=3d7297c9-1600-0000-a000-d8c9380e0000 pid=3640 execve guuid=3e2cfcc9-1600-0000-a000-d8c93a0e0000 pid=3642 /usr/bin/rm guuid=a7ce6db8-1600-0000-a000-d8c9d60d0000 pid=3542->guuid=3e2cfcc9-1600-0000-a000-d8c93a0e0000 pid=3642 execve guuid=5edc73c3-1600-0000-a000-d8c9140e0000 pid=3604 /usr/bin/bash guuid=66212bc3-1600-0000-a000-d8c9120e0000 pid=3602->guuid=5edc73c3-1600-0000-a000-d8c9140e0000 pid=3604 clone guuid=6e4c79c3-1600-0000-a000-d8c9150e0000 pid=3605 /usr/bin/bash guuid=66212bc3-1600-0000-a000-d8c9120e0000 pid=3602->guuid=6e4c79c3-1600-0000-a000-d8c9150e0000 pid=3605 clone guuid=7ce092c3-1600-0000-a000-d8c9160e0000 pid=3606 /usr/bin/ls guuid=66212bc3-1600-0000-a000-d8c9120e0000 pid=3602->guuid=7ce092c3-1600-0000-a000-d8c9160e0000 pid=3606 execve guuid=77db0bc4-1600-0000-a000-d8c9180e0000 pid=3608 /usr/bin/cat guuid=66212bc3-1600-0000-a000-d8c9120e0000 pid=3602->guuid=77db0bc4-1600-0000-a000-d8c9180e0000 pid=3608 execve guuid=d8e881c4-1600-0000-a000-d8c91a0e0000 pid=3610 /usr/bin/ls guuid=66212bc3-1600-0000-a000-d8c9120e0000 pid=3602->guuid=d8e881c4-1600-0000-a000-d8c91a0e0000 pid=3610 execve guuid=f15dfdc4-1600-0000-a000-d8c91c0e0000 pid=3612 /usr/bin/mkdir guuid=66212bc3-1600-0000-a000-d8c9120e0000 pid=3602->guuid=f15dfdc4-1600-0000-a000-d8c91c0e0000 pid=3612 execve guuid=676d5ac5-1600-0000-a000-d8c91e0e0000 pid=3614 /usr/bin/mv guuid=66212bc3-1600-0000-a000-d8c9120e0000 pid=3602->guuid=676d5ac5-1600-0000-a000-d8c91e0e0000 pid=3614 execve guuid=1ef7b8c5-1600-0000-a000-d8c9200e0000 pid=3616 /usr/bin/bash guuid=66212bc3-1600-0000-a000-d8c9120e0000 pid=3602->guuid=1ef7b8c5-1600-0000-a000-d8c9200e0000 pid=3616 clone guuid=28a1c1c5-1600-0000-a000-d8c9210e0000 pid=3617 /usr/bin/base64 write-file guuid=66212bc3-1600-0000-a000-d8c9120e0000 pid=3602->guuid=28a1c1c5-1600-0000-a000-d8c9210e0000 pid=3617 execve guuid=bf5086c6-1600-0000-a000-d8c9250e0000 pid=3621 /usr/bin/rm delete-file guuid=66212bc3-1600-0000-a000-d8c9120e0000 pid=3602->guuid=bf5086c6-1600-0000-a000-d8c9250e0000 pid=3621 execve guuid=42fbc7c6-1600-0000-a000-d8c9270e0000 pid=3623 /usr/bin/ls guuid=66212bc3-1600-0000-a000-d8c9120e0000 pid=3602->guuid=42fbc7c6-1600-0000-a000-d8c9270e0000 pid=3623 execve guuid=d80368c7-1600-0000-a000-d8c92a0e0000 pid=3626 /usr/bin/bash guuid=66212bc3-1600-0000-a000-d8c9120e0000 pid=3602->guuid=d80368c7-1600-0000-a000-d8c92a0e0000 pid=3626 clone guuid=3dc06dc7-1600-0000-a000-d8c92b0e0000 pid=3627 /usr/bin/base64 write-file guuid=66212bc3-1600-0000-a000-d8c9120e0000 pid=3602->guuid=3dc06dc7-1600-0000-a000-d8c92b0e0000 pid=3627 execve guuid=bdc3b7c7-1600-0000-a000-d8c92d0e0000 pid=3629 /usr/bin/ls guuid=66212bc3-1600-0000-a000-d8c9120e0000 pid=3602->guuid=bdc3b7c7-1600-0000-a000-d8c92d0e0000 pid=3629 execve guuid=f46b1ec8-1600-0000-a000-d8c92f0e0000 pid=3631 /usr/bin/cat guuid=66212bc3-1600-0000-a000-d8c9120e0000 pid=3602->guuid=f46b1ec8-1600-0000-a000-d8c92f0e0000 pid=3631 execve guuid=55a462c8-1600-0000-a000-d8c9310e0000 pid=3633 /usr/bin/ls guuid=66212bc3-1600-0000-a000-d8c9120e0000 pid=3602->guuid=55a462c8-1600-0000-a000-d8c9310e0000 pid=3633 execve
Score:
81%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/273fea99829bf43a4601b716c1bdd5a8bfe4d3645cc9d265cf565377c6edcfc2
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/273fea99829bf43a4601b716c1bdd5a8bfe4d3645cc9d265cf565377c6edcfc2/
Verdict:
Malicious
Threat:
Trojan-Downloader.Shell.Agent
Link:
https://tip.neiki.dev/file/273fea99829bf43a4601b716c1bdd5a8bfe4d3645cc9d265cf565377c6edcfc2
Threat name:
Script-Shell.Trojan.Vigorf
Create hunting rule
Status:
Malicious
First seen:
2026-03-03 08:30:43 UTC
File Type:
Text (Shell)
AV detection:
10 of 24 (41.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=e476vgmctp2durqbw4lmdpovvc76ju3elte5ezopkzjxprxnz7ba._file
Result
Malware family:
n/a
Score:
  4/10
Tags:
defense_evasion discovery linux
Link:
https://tria.ge/reports/260303-keclbahy9h/
Behaviour
Reads runtime system information
Writes file to tmp directory
Deobfuscate/Decode Files or Information
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/273fea99829bf43a4601b716c1bdd5a8bfe4d3645cc9d265cf565377c6edcfc2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SUSP_LNX_Base64_Exec_Apr24
Create hunting rule
Author:Christian Burkard
Description:Detects suspicious base64 encoded shell commands (as seen in Palo Alto CVE-2024-3400 exploitation)
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 273fea99829bf43a4601b716c1bdd5a8bfe4d3645cc9d265cf565377c6edcfc2

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3784565/
  
Delivery method
Distributed via web download

Comments