MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2bc71a7b91df434f8997e729d60448c0f405b63cd1a1e3ef84c63c30284f9653. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2bc71a7b91df434f8997e729d60448c0f405b63cd1a1e3ef84c63c30284f9653
SHA3-384 hash: a945fdb612d08724900158be244de840c7b1b800a9ad77cf9130b50dfa2206cc3ec429b05f5925bc27103ba3fbbf4879
SHA1 hash: 4d4a1920a3e11982303d0ea02149b16f0b9cc8a7
MD5 hash: 99cd1873fbb819f2b310e01da0582b8b
humanhash: south-mike-april-vermont
File name:p
Download: download sample
File size:826 bytes
First seen:2026-06-03 14:32:41 UTC
Last seen:2026-06-04 09:20:36 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 24:kXCKysE2hi0ziQvZohaFv5pnTF8llAq/KH7:e9Qp+MsFv5pTF8/Aq/KH7
TLSH T1E201EBCAC103C720E286F89D26A751803411C3CBAA420FB43E8C043EEBAA718B0A5FC5
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://188.132.232.81/Tccn/an/aelf ua-wget
http://188.132.232.81/65jn/an/aelf ua-wget
http://188.132.232.81/pokn/an/aelf ua-wget
http://188.132.232.81/7j3n/an/aelf ua-wget
http://188.132.232.81/SEoDn/an/aelf ua-wget

Intelligence

File Origin
# of uploads :
2
# of downloads :
67
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive
Link:
https://www.filescan.io/uploads/6a203b34099ef368af1acaad/reports/d1b2eeed-3089-43a1-9874-f2f5d48b2ab9/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-06-03T11:54:00Z UTC
Last seen:
2026-06-05T06:19:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan-Downloader.Shell.Agent.a
Link:
https://opentip.kaspersky.com/2bc71a7b91df434f8997e729d60448c0f405b63cd1a1e3ef84c63c30284f9653/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/6133700f-5545-4a9e-bd7a-2e2af7f1e716
Behavior Graph:
Download SVG
%3 guuid=0536dfce-1600-0000-e40a-fecd140d0000 pid=3348 /usr/bin/sudo guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351 /tmp/sample.bin write-file guuid=0536dfce-1600-0000-e40a-fecd140d0000 pid=3348->guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351 execve guuid=e84653d1-1600-0000-e40a-fecd190d0000 pid=3353 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=e84653d1-1600-0000-e40a-fecd190d0000 pid=3353 execve guuid=b8d2b2d1-1600-0000-e40a-fecd1b0d0000 pid=3355 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=b8d2b2d1-1600-0000-e40a-fecd1b0d0000 pid=3355 execve guuid=1a6215d2-1600-0000-e40a-fecd1e0d0000 pid=3358 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=1a6215d2-1600-0000-e40a-fecd1e0d0000 pid=3358 execve guuid=cca279d2-1600-0000-e40a-fecd200d0000 pid=3360 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=cca279d2-1600-0000-e40a-fecd200d0000 pid=3360 execve guuid=3c77d4d2-1600-0000-e40a-fecd230d0000 pid=3363 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=3c77d4d2-1600-0000-e40a-fecd230d0000 pid=3363 execve guuid=c17a36d3-1600-0000-e40a-fecd240d0000 pid=3364 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=c17a36d3-1600-0000-e40a-fecd240d0000 pid=3364 execve guuid=5dc28dd3-1600-0000-e40a-fecd260d0000 pid=3366 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=5dc28dd3-1600-0000-e40a-fecd260d0000 pid=3366 execve guuid=0efde8d3-1600-0000-e40a-fecd280d0000 pid=3368 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=0efde8d3-1600-0000-e40a-fecd280d0000 pid=3368 execve guuid=616e43d4-1600-0000-e40a-fecd2b0d0000 pid=3371 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=616e43d4-1600-0000-e40a-fecd2b0d0000 pid=3371 execve guuid=e5e69cd4-1600-0000-e40a-fecd2d0d0000 pid=3373 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=e5e69cd4-1600-0000-e40a-fecd2d0d0000 pid=3373 execve guuid=ca1df9d4-1600-0000-e40a-fecd300d0000 pid=3376 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=ca1df9d4-1600-0000-e40a-fecd300d0000 pid=3376 execve guuid=29807fd5-1600-0000-e40a-fecd330d0000 pid=3379 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=29807fd5-1600-0000-e40a-fecd330d0000 pid=3379 execve guuid=247a39d6-1600-0000-e40a-fecd360d0000 pid=3382 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=247a39d6-1600-0000-e40a-fecd360d0000 pid=3382 execve guuid=3e109bd6-1600-0000-e40a-fecd390d0000 pid=3385 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=3e109bd6-1600-0000-e40a-fecd390d0000 pid=3385 execve guuid=faa3f5d6-1600-0000-e40a-fecd3b0d0000 pid=3387 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=faa3f5d6-1600-0000-e40a-fecd3b0d0000 pid=3387 execve guuid=142b52d7-1600-0000-e40a-fecd3d0d0000 pid=3389 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=142b52d7-1600-0000-e40a-fecd3d0d0000 pid=3389 execve guuid=a537b0d7-1600-0000-e40a-fecd400d0000 pid=3392 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=a537b0d7-1600-0000-e40a-fecd400d0000 pid=3392 execve guuid=99d30cd8-1600-0000-e40a-fecd420d0000 pid=3394 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=99d30cd8-1600-0000-e40a-fecd420d0000 pid=3394 execve guuid=f26f83d8-1600-0000-e40a-fecd430d0000 pid=3395 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=f26f83d8-1600-0000-e40a-fecd430d0000 pid=3395 execve guuid=a24901d9-1600-0000-e40a-fecd440d0000 pid=3396 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=a24901d9-1600-0000-e40a-fecd440d0000 pid=3396 execve guuid=903472d9-1600-0000-e40a-fecd460d0000 pid=3398 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=903472d9-1600-0000-e40a-fecd460d0000 pid=3398 execve guuid=5580cad9-1600-0000-e40a-fecd480d0000 pid=3400 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=5580cad9-1600-0000-e40a-fecd480d0000 pid=3400 execve guuid=d72829da-1600-0000-e40a-fecd4b0d0000 pid=3403 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=d72829da-1600-0000-e40a-fecd4b0d0000 pid=3403 execve guuid=28f580da-1600-0000-e40a-fecd4d0d0000 pid=3405 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=28f580da-1600-0000-e40a-fecd4d0d0000 pid=3405 execve guuid=6d29ddda-1600-0000-e40a-fecd500d0000 pid=3408 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=6d29ddda-1600-0000-e40a-fecd500d0000 pid=3408 execve guuid=6e0935db-1600-0000-e40a-fecd520d0000 pid=3410 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=6e0935db-1600-0000-e40a-fecd520d0000 pid=3410 execve guuid=699691db-1600-0000-e40a-fecd550d0000 pid=3413 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=699691db-1600-0000-e40a-fecd550d0000 pid=3413 execve guuid=0ffceddb-1600-0000-e40a-fecd570d0000 pid=3415 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=0ffceddb-1600-0000-e40a-fecd570d0000 pid=3415 execve guuid=e4a44adc-1600-0000-e40a-fecd5a0d0000 pid=3418 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=e4a44adc-1600-0000-e40a-fecd5a0d0000 pid=3418 execve guuid=af02a5dc-1600-0000-e40a-fecd5c0d0000 pid=3420 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=af02a5dc-1600-0000-e40a-fecd5c0d0000 pid=3420 execve guuid=7b04ffdc-1600-0000-e40a-fecd5f0d0000 pid=3423 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=7b04ffdc-1600-0000-e40a-fecd5f0d0000 pid=3423 execve guuid=661e5add-1600-0000-e40a-fecd610d0000 pid=3425 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=661e5add-1600-0000-e40a-fecd610d0000 pid=3425 execve guuid=632ec6dd-1600-0000-e40a-fecd640d0000 pid=3428 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=632ec6dd-1600-0000-e40a-fecd640d0000 pid=3428 execve guuid=95da23de-1600-0000-e40a-fecd660d0000 pid=3430 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=95da23de-1600-0000-e40a-fecd660d0000 pid=3430 execve guuid=0bce81de-1600-0000-e40a-fecd680d0000 pid=3432 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=0bce81de-1600-0000-e40a-fecd680d0000 pid=3432 execve guuid=b2e2e5de-1600-0000-e40a-fecd6b0d0000 pid=3435 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=b2e2e5de-1600-0000-e40a-fecd6b0d0000 pid=3435 execve guuid=df1145df-1600-0000-e40a-fecd6d0d0000 pid=3437 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=df1145df-1600-0000-e40a-fecd6d0d0000 pid=3437 execve guuid=a94da2df-1600-0000-e40a-fecd700d0000 pid=3440 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=a94da2df-1600-0000-e40a-fecd700d0000 pid=3440 execve guuid=a2be03e0-1600-0000-e40a-fecd720d0000 pid=3442 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=a2be03e0-1600-0000-e40a-fecd720d0000 pid=3442 execve guuid=d1b464e0-1600-0000-e40a-fecd740d0000 pid=3444 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=d1b464e0-1600-0000-e40a-fecd740d0000 pid=3444 execve guuid=c904bfe0-1600-0000-e40a-fecd770d0000 pid=3447 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=c904bfe0-1600-0000-e40a-fecd770d0000 pid=3447 execve guuid=9e1118e1-1600-0000-e40a-fecd790d0000 pid=3449 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=9e1118e1-1600-0000-e40a-fecd790d0000 pid=3449 execve guuid=631f75e1-1600-0000-e40a-fecd7c0d0000 pid=3452 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=631f75e1-1600-0000-e40a-fecd7c0d0000 pid=3452 execve guuid=4832e9e1-1600-0000-e40a-fecd7e0d0000 pid=3454 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=4832e9e1-1600-0000-e40a-fecd7e0d0000 pid=3454 execve guuid=3df03ce2-1600-0000-e40a-fecd810d0000 pid=3457 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=3df03ce2-1600-0000-e40a-fecd810d0000 pid=3457 execve guuid=4dd791e2-1600-0000-e40a-fecd830d0000 pid=3459 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=4dd791e2-1600-0000-e40a-fecd830d0000 pid=3459 execve guuid=45eae2e2-1600-0000-e40a-fecd850d0000 pid=3461 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=45eae2e2-1600-0000-e40a-fecd850d0000 pid=3461 execve guuid=11e138e3-1600-0000-e40a-fecd880d0000 pid=3464 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=11e138e3-1600-0000-e40a-fecd880d0000 pid=3464 execve guuid=3ba68de3-1600-0000-e40a-fecd8a0d0000 pid=3466 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=3ba68de3-1600-0000-e40a-fecd8a0d0000 pid=3466 execve guuid=40f8e2e3-1600-0000-e40a-fecd8c0d0000 pid=3468 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=40f8e2e3-1600-0000-e40a-fecd8c0d0000 pid=3468 execve guuid=980f4be4-1600-0000-e40a-fecd8f0d0000 pid=3471 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=980f4be4-1600-0000-e40a-fecd8f0d0000 pid=3471 execve guuid=f8faa4e4-1600-0000-e40a-fecd910d0000 pid=3473 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=f8faa4e4-1600-0000-e40a-fecd910d0000 pid=3473 execve guuid=42e9f9e4-1600-0000-e40a-fecd940d0000 pid=3476 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=42e9f9e4-1600-0000-e40a-fecd940d0000 pid=3476 execve guuid=cc017ce5-1600-0000-e40a-fecd960d0000 pid=3478 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=cc017ce5-1600-0000-e40a-fecd960d0000 pid=3478 execve guuid=ff34dbe5-1600-0000-e40a-fecd980d0000 pid=3480 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=ff34dbe5-1600-0000-e40a-fecd980d0000 pid=3480 execve guuid=b56452e6-1600-0000-e40a-fecd9b0d0000 pid=3483 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=b56452e6-1600-0000-e40a-fecd9b0d0000 pid=3483 execve guuid=f2e3c0e6-1600-0000-e40a-fecd9e0d0000 pid=3486 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=f2e3c0e6-1600-0000-e40a-fecd9e0d0000 pid=3486 execve guuid=3da61ee7-1600-0000-e40a-fecda00d0000 pid=3488 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=3da61ee7-1600-0000-e40a-fecda00d0000 pid=3488 execve guuid=750482e7-1600-0000-e40a-fecda30d0000 pid=3491 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=750482e7-1600-0000-e40a-fecda30d0000 pid=3491 execve guuid=3ee8e3e7-1600-0000-e40a-fecda50d0000 pid=3493 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=3ee8e3e7-1600-0000-e40a-fecda50d0000 pid=3493 execve guuid=5ff945e8-1600-0000-e40a-fecda80d0000 pid=3496 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=5ff945e8-1600-0000-e40a-fecda80d0000 pid=3496 execve guuid=30f8b8e8-1600-0000-e40a-fecdaa0d0000 pid=3498 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=30f8b8e8-1600-0000-e40a-fecdaa0d0000 pid=3498 execve guuid=ec5414e9-1600-0000-e40a-fecdad0d0000 pid=3501 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=ec5414e9-1600-0000-e40a-fecdad0d0000 pid=3501 execve guuid=c06470e9-1600-0000-e40a-fecdaf0d0000 pid=3503 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=c06470e9-1600-0000-e40a-fecdaf0d0000 pid=3503 execve guuid=2826c8e9-1600-0000-e40a-fecdb10d0000 pid=3505 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=2826c8e9-1600-0000-e40a-fecdb10d0000 pid=3505 execve guuid=888025ea-1600-0000-e40a-fecdb40d0000 pid=3508 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=888025ea-1600-0000-e40a-fecdb40d0000 pid=3508 execve guuid=12f07eea-1600-0000-e40a-fecdb60d0000 pid=3510 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=12f07eea-1600-0000-e40a-fecdb60d0000 pid=3510 execve guuid=98c1d0ea-1600-0000-e40a-fecdb80d0000 pid=3512 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=98c1d0ea-1600-0000-e40a-fecdb80d0000 pid=3512 execve guuid=f80238eb-1600-0000-e40a-fecdbb0d0000 pid=3515 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=f80238eb-1600-0000-e40a-fecdbb0d0000 pid=3515 execve guuid=0ce995eb-1600-0000-e40a-fecdbe0d0000 pid=3518 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=0ce995eb-1600-0000-e40a-fecdbe0d0000 pid=3518 execve guuid=95d4f0eb-1600-0000-e40a-fecdc00d0000 pid=3520 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=95d4f0eb-1600-0000-e40a-fecdc00d0000 pid=3520 execve guuid=b9684dec-1600-0000-e40a-fecdc30d0000 pid=3523 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=b9684dec-1600-0000-e40a-fecdc30d0000 pid=3523 execve guuid=dceaa8ec-1600-0000-e40a-fecdc50d0000 pid=3525 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=dceaa8ec-1600-0000-e40a-fecdc50d0000 pid=3525 execve guuid=0aa90ded-1600-0000-e40a-fecdc70d0000 pid=3527 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=0aa90ded-1600-0000-e40a-fecdc70d0000 pid=3527 execve guuid=d21f71ed-1600-0000-e40a-fecdca0d0000 pid=3530 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=d21f71ed-1600-0000-e40a-fecdca0d0000 pid=3530 execve guuid=066ccfed-1600-0000-e40a-fecdcc0d0000 pid=3532 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=066ccfed-1600-0000-e40a-fecdcc0d0000 pid=3532 execve guuid=5a7342ee-1600-0000-e40a-fecdcf0d0000 pid=3535 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=5a7342ee-1600-0000-e40a-fecdcf0d0000 pid=3535 execve guuid=117b9cee-1600-0000-e40a-fecdd10d0000 pid=3537 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=117b9cee-1600-0000-e40a-fecdd10d0000 pid=3537 execve guuid=792508ef-1600-0000-e40a-fecdd40d0000 pid=3540 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=792508ef-1600-0000-e40a-fecdd40d0000 pid=3540 execve guuid=93f260ef-1600-0000-e40a-fecdd60d0000 pid=3542 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=93f260ef-1600-0000-e40a-fecdd60d0000 pid=3542 execve guuid=f103bdef-1600-0000-e40a-fecdd90d0000 pid=3545 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=f103bdef-1600-0000-e40a-fecdd90d0000 pid=3545 execve guuid=f4381df0-1600-0000-e40a-fecddb0d0000 pid=3547 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=f4381df0-1600-0000-e40a-fecddb0d0000 pid=3547 execve guuid=150884f0-1600-0000-e40a-fecddd0d0000 pid=3549 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=150884f0-1600-0000-e40a-fecddd0d0000 pid=3549 execve guuid=409fe4f0-1600-0000-e40a-fecde00d0000 pid=3552 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=409fe4f0-1600-0000-e40a-fecde00d0000 pid=3552 execve guuid=394c4cf1-1600-0000-e40a-fecde20d0000 pid=3554 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=394c4cf1-1600-0000-e40a-fecde20d0000 pid=3554 execve guuid=e23cc0f1-1600-0000-e40a-fecde50d0000 pid=3557 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=e23cc0f1-1600-0000-e40a-fecde50d0000 pid=3557 execve guuid=f2d71ef2-1600-0000-e40a-fecde70d0000 pid=3559 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=f2d71ef2-1600-0000-e40a-fecde70d0000 pid=3559 execve guuid=710b7af2-1600-0000-e40a-fecdec0d0000 pid=3564 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=710b7af2-1600-0000-e40a-fecdec0d0000 pid=3564 execve guuid=62e9cdf2-1600-0000-e40a-fecded0d0000 pid=3565 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=62e9cdf2-1600-0000-e40a-fecded0d0000 pid=3565 execve guuid=c51b2bf3-1600-0000-e40a-fecdee0d0000 pid=3566 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=c51b2bf3-1600-0000-e40a-fecdee0d0000 pid=3566 execve guuid=84ed86f3-1600-0000-e40a-fecdef0d0000 pid=3567 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=84ed86f3-1600-0000-e40a-fecdef0d0000 pid=3567 execve guuid=8537e5f3-1600-0000-e40a-fecdf00d0000 pid=3568 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=8537e5f3-1600-0000-e40a-fecdf00d0000 pid=3568 execve guuid=ead63df4-1600-0000-e40a-fecdf10d0000 pid=3569 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=ead63df4-1600-0000-e40a-fecdf10d0000 pid=3569 execve guuid=e58194f4-1600-0000-e40a-fecdf20d0000 pid=3570 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=e58194f4-1600-0000-e40a-fecdf20d0000 pid=3570 execve guuid=2c9eecf4-1600-0000-e40a-fecdf30d0000 pid=3571 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=2c9eecf4-1600-0000-e40a-fecdf30d0000 pid=3571 execve guuid=dcb540f5-1600-0000-e40a-fecdf40d0000 pid=3572 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=dcb540f5-1600-0000-e40a-fecdf40d0000 pid=3572 execve guuid=4863a3f5-1600-0000-e40a-fecdf50d0000 pid=3573 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=4863a3f5-1600-0000-e40a-fecdf50d0000 pid=3573 execve guuid=47da05f6-1600-0000-e40a-fecdf60d0000 pid=3574 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=47da05f6-1600-0000-e40a-fecdf60d0000 pid=3574 execve guuid=712161f6-1600-0000-e40a-fecdf70d0000 pid=3575 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=712161f6-1600-0000-e40a-fecdf70d0000 pid=3575 execve guuid=23ecc0f6-1600-0000-e40a-fecdf80d0000 pid=3576 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=23ecc0f6-1600-0000-e40a-fecdf80d0000 pid=3576 execve guuid=e2561cf7-1600-0000-e40a-fecdf90d0000 pid=3577 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=e2561cf7-1600-0000-e40a-fecdf90d0000 pid=3577 execve guuid=9c6b87f7-1600-0000-e40a-fecdfd0d0000 pid=3581 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=9c6b87f7-1600-0000-e40a-fecdfd0d0000 pid=3581 execve guuid=c37109f8-1600-0000-e40a-fecdfe0d0000 pid=3582 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=c37109f8-1600-0000-e40a-fecdfe0d0000 pid=3582 execve guuid=effe81f8-1600-0000-e40a-fecdff0d0000 pid=3583 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=effe81f8-1600-0000-e40a-fecdff0d0000 pid=3583 execve guuid=e90aecf8-1600-0000-e40a-fecd000e0000 pid=3584 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=e90aecf8-1600-0000-e40a-fecd000e0000 pid=3584 execve guuid=ce444af9-1600-0000-e40a-fecd030e0000 pid=3587 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=ce444af9-1600-0000-e40a-fecd030e0000 pid=3587 execve guuid=f269b2f9-1600-0000-e40a-fecd050e0000 pid=3589 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=f269b2f9-1600-0000-e40a-fecd050e0000 pid=3589 execve guuid=20e514fa-1600-0000-e40a-fecd080e0000 pid=3592 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=20e514fa-1600-0000-e40a-fecd080e0000 pid=3592 execve guuid=15208ffa-1600-0000-e40a-fecd0a0e0000 pid=3594 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=15208ffa-1600-0000-e40a-fecd0a0e0000 pid=3594 execve guuid=1e5bf7fa-1600-0000-e40a-fecd0c0e0000 pid=3596 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=1e5bf7fa-1600-0000-e40a-fecd0c0e0000 pid=3596 execve guuid=67cf58fb-1600-0000-e40a-fecd0e0e0000 pid=3598 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=67cf58fb-1600-0000-e40a-fecd0e0e0000 pid=3598 execve guuid=3988aefb-1600-0000-e40a-fecd100e0000 pid=3600 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=3988aefb-1600-0000-e40a-fecd100e0000 pid=3600 execve guuid=f87b0dfc-1600-0000-e40a-fecd120e0000 pid=3602 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=f87b0dfc-1600-0000-e40a-fecd120e0000 pid=3602 execve guuid=efbc77fc-1600-0000-e40a-fecd130e0000 pid=3603 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=efbc77fc-1600-0000-e40a-fecd130e0000 pid=3603 execve guuid=b258dafc-1600-0000-e40a-fecd150e0000 pid=3605 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=b258dafc-1600-0000-e40a-fecd150e0000 pid=3605 execve guuid=cb2359fd-1600-0000-e40a-fecd160e0000 pid=3606 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=cb2359fd-1600-0000-e40a-fecd160e0000 pid=3606 execve guuid=b28de5fd-1600-0000-e40a-fecd170e0000 pid=3607 /usr/bin/ls guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=b28de5fd-1600-0000-e40a-fecd170e0000 pid=3607 execve guuid=c7f65dfe-1600-0000-e40a-fecd190e0000 pid=3609 /usr/bin/rm guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=c7f65dfe-1600-0000-e40a-fecd190e0000 pid=3609 execve guuid=7be9a7fe-1600-0000-e40a-fecd1b0e0000 pid=3611 /usr/bin/wget net send-data write-file guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=7be9a7fe-1600-0000-e40a-fecd1b0e0000 pid=3611 execve guuid=f25ba20f-1800-0000-e40a-fecd74100000 pid=4212 /usr/bin/chmod guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=f25ba20f-1800-0000-e40a-fecd74100000 pid=4212 execve guuid=9a573a10-1800-0000-e40a-fecd75100000 pid=4213 /usr/bin/dash guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=9a573a10-1800-0000-e40a-fecd75100000 pid=4213 clone guuid=95553c11-1800-0000-e40a-fecd7a100000 pid=4218 /usr/bin/rm guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=95553c11-1800-0000-e40a-fecd7a100000 pid=4218 execve guuid=7f6ea111-1800-0000-e40a-fecd7b100000 pid=4219 /usr/bin/wget net send-data write-file guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=7f6ea111-1800-0000-e40a-fecd7b100000 pid=4219 execve guuid=4d329a5d-1800-0000-e40a-fecd35110000 pid=4405 /usr/bin/chmod guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=4d329a5d-1800-0000-e40a-fecd35110000 pid=4405 execve guuid=a613fa5d-1800-0000-e40a-fecd37110000 pid=4407 /usr/bin/dash guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=a613fa5d-1800-0000-e40a-fecd37110000 pid=4407 clone guuid=41313b60-1800-0000-e40a-fecd3c110000 pid=4412 /usr/bin/rm guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=41313b60-1800-0000-e40a-fecd3c110000 pid=4412 execve guuid=5ccc8b60-1800-0000-e40a-fecd3d110000 pid=4413 /usr/bin/wget net send-data write-file guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=5ccc8b60-1800-0000-e40a-fecd3d110000 pid=4413 execve guuid=1b3d5555-1900-0000-e40a-fecd4b130000 pid=4939 /usr/bin/chmod guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=1b3d5555-1900-0000-e40a-fecd4b130000 pid=4939 execve guuid=3aa59155-1900-0000-e40a-fecd4d130000 pid=4941 /usr/bin/dash guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=3aa59155-1900-0000-e40a-fecd4d130000 pid=4941 clone guuid=9c839e56-1900-0000-e40a-fecd53130000 pid=4947 /usr/bin/rm guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=9c839e56-1900-0000-e40a-fecd53130000 pid=4947 execve guuid=3acadc56-1900-0000-e40a-fecd55130000 pid=4949 /usr/bin/wget net send-data write-file guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=3acadc56-1900-0000-e40a-fecd55130000 pid=4949 execve guuid=66301256-1a00-0000-e40a-fecde3140000 pid=5347 /usr/bin/chmod guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=66301256-1a00-0000-e40a-fecde3140000 pid=5347 execve guuid=64ce6256-1a00-0000-e40a-fecde4140000 pid=5348 /usr/bin/dash guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=64ce6256-1a00-0000-e40a-fecde4140000 pid=5348 clone guuid=e7cbfb56-1a00-0000-e40a-fecde6140000 pid=5350 /usr/bin/rm guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=e7cbfb56-1a00-0000-e40a-fecde6140000 pid=5350 execve guuid=66a34157-1a00-0000-e40a-fecde7140000 pid=5351 /usr/bin/wget net send-data write-file guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=66a34157-1a00-0000-e40a-fecde7140000 pid=5351 execve guuid=62c9beed-1a00-0000-e40a-fecdef140000 pid=5359 /usr/bin/chmod guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=62c9beed-1a00-0000-e40a-fecdef140000 pid=5359 execve guuid=650e25ee-1a00-0000-e40a-fecdf0140000 pid=5360 /usr/bin/dash guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=650e25ee-1a00-0000-e40a-fecdf0140000 pid=5360 clone guuid=c8140bef-1a00-0000-e40a-fecdf2140000 pid=5362 /usr/bin/rm delete-file guuid=032319d1-1600-0000-e40a-fecd170d0000 pid=3351->guuid=c8140bef-1a00-0000-e40a-fecdf2140000 pid=5362 execve 9554d36e-3083-568e-90da-bb8e3c487b07 188.132.232.81:80 guuid=7be9a7fe-1600-0000-e40a-fecd1b0e0000 pid=3611->9554d36e-3083-568e-90da-bb8e3c487b07 send: 132B guuid=7f6ea111-1800-0000-e40a-fecd7b100000 pid=4219->9554d36e-3083-568e-90da-bb8e3c487b07 send: 132B guuid=5ccc8b60-1800-0000-e40a-fecd3d110000 pid=4413->9554d36e-3083-568e-90da-bb8e3c487b07 send: 132B guuid=3acadc56-1900-0000-e40a-fecd55130000 pid=4949->9554d36e-3083-568e-90da-bb8e3c487b07 send: 132B guuid=66a34157-1a00-0000-e40a-fecde7140000 pid=5351->9554d36e-3083-568e-90da-bb8e3c487b07 send: 133B
Score:
99%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/2bc71a7b91df434f8997e729d60448c0f405b63cd1a1e3ef84c63c30284f9653
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2bc71a7b91df434f8997e729d60448c0f405b63cd1a1e3ef84c63c30284f9653/
Verdict:
Malicious
Threat:
Trojan-Downloader.Shell.Agent
Link:
https://tip.neiki.dev/file/2bc71a7b91df434f8997e729d60448c0f405b63cd1a1e3ef84c63c30284f9653
Threat name:
Win32.Trojan.Vigorf
Create hunting rule
Status:
Malicious
First seen:
2026-06-03 14:33:27 UTC
File Type:
Text (Shell)
AV detection:
9 of 23 (39.13%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fpdru64r35bu7cmx44u5mbciyd2alnr42gq6h34eyy6dakcpszjq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
defense_evasion discovery linux
Link:
https://tria.ge/reports/260603-rw21vshv4s/
Behaviour
Reads runtime system information
Writes file to tmp directory
Enumerates running processes
File and Directory Permissions Modification
Deletes itself
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.26
Link:
https://yomi.yoroi.company/submissions/2bc71a7b91df434f8997e729d60448c0f405b63cd1a1e3ef84c63c30284f9653

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 2bc71a7b91df434f8997e729d60448c0f405b63cd1a1e3ef84c63c30284f9653

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3856423/
  
Delivery method
Distributed via web download

Comments