🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3431ed0a46d18ed6d16657d87dc481b6220634ab3724db2e7f9abae445d3ff1a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3431ed0a46d18ed6d16657d87dc481b6220634ab3724db2e7f9abae445d3ff1a
SHA3-384 hash: 31f6d14bcb6b234d5122b74173dcfb4247bf1dd10bf76aedd2aab7d3eb50965c69a749526c57fd593b3919281f9cc697
SHA1 hash: 8e408e63dde1ef747a27106fa528405c7500df44
MD5 hash: c17f01636b8c56f1d747b9ee07ebbf30
humanhash: crazy-queen-high-six
File name:p
Download: download sample
File size:830 bytes
First seen:2026-06-10 08:40:01 UTC
Last seen:2026-06-10 16:47:23 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkaBXIqNMhBOIhKFAIGDFPnIVes6EIGpNauD:kXCKysE2hi0ziQvZohaBXrJAXZfDEPN7
TLSH T16C0188DEC012DB305186D99EA3AB51C0B820C38B15868BA87FAC443D9BBD628B055E49
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://188.132.232.81/MfMNn/an/aelf ua-wget
http://188.132.232.81/qPfn/an/aelf ua-wget
http://188.132.232.81/MXln/an/aelf ua-wget
http://188.132.232.81/QVz1n/an/aelf ua-wget
http://188.132.232.81/x0zn/an/aelf ua-wget

Intelligence

File Origin
# of uploads :
2
# of downloads :
58
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive
Link:
https://www.filescan.io/uploads/6a29230a1f652d686574b2c0/reports/0b529816-9a5c-4169-9543-9b0c7d2cb294/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-06-10T06:07:00Z UTC
Last seen:
2026-06-10T07:01:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan-Downloader.Shell.Agent.a
Link:
https://opentip.kaspersky.com/3431ed0a46d18ed6d16657d87dc481b6220634ab3724db2e7f9abae445d3ff1a/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/9068eb37-8aa1-4e9b-924f-434537c49e03
Behavior Graph:
Download SVG
%3 guuid=611e6526-1700-0000-4a49-04aa5d0d0000 pid=3421 /usr/bin/sudo guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429 /tmp/sample.bin write-file guuid=611e6526-1700-0000-4a49-04aa5d0d0000 pid=3421->guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429 execve guuid=eb463728-1700-0000-4a49-04aa660d0000 pid=3430 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=eb463728-1700-0000-4a49-04aa660d0000 pid=3430 execve guuid=81ad8f28-1700-0000-4a49-04aa690d0000 pid=3433 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=81ad8f28-1700-0000-4a49-04aa690d0000 pid=3433 execve guuid=b16ced28-1700-0000-4a49-04aa6b0d0000 pid=3435 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=b16ced28-1700-0000-4a49-04aa6b0d0000 pid=3435 execve guuid=35574629-1700-0000-4a49-04aa6e0d0000 pid=3438 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=35574629-1700-0000-4a49-04aa6e0d0000 pid=3438 execve guuid=3d9ab229-1700-0000-4a49-04aa700d0000 pid=3440 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=3d9ab229-1700-0000-4a49-04aa700d0000 pid=3440 execve guuid=3c48702a-1700-0000-4a49-04aa740d0000 pid=3444 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=3c48702a-1700-0000-4a49-04aa740d0000 pid=3444 execve guuid=3222d02a-1700-0000-4a49-04aa760d0000 pid=3446 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=3222d02a-1700-0000-4a49-04aa760d0000 pid=3446 execve guuid=02d4362b-1700-0000-4a49-04aa790d0000 pid=3449 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=02d4362b-1700-0000-4a49-04aa790d0000 pid=3449 execve guuid=02a3b62b-1700-0000-4a49-04aa7b0d0000 pid=3451 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=02a3b62b-1700-0000-4a49-04aa7b0d0000 pid=3451 execve guuid=51be132c-1700-0000-4a49-04aa7e0d0000 pid=3454 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=51be132c-1700-0000-4a49-04aa7e0d0000 pid=3454 execve guuid=6ed36c2c-1700-0000-4a49-04aa800d0000 pid=3456 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=6ed36c2c-1700-0000-4a49-04aa800d0000 pid=3456 execve guuid=acb1c32c-1700-0000-4a49-04aa830d0000 pid=3459 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=acb1c32c-1700-0000-4a49-04aa830d0000 pid=3459 execve guuid=3839192d-1700-0000-4a49-04aa850d0000 pid=3461 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=3839192d-1700-0000-4a49-04aa850d0000 pid=3461 execve guuid=5ce66d2d-1700-0000-4a49-04aa870d0000 pid=3463 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=5ce66d2d-1700-0000-4a49-04aa870d0000 pid=3463 execve guuid=43e9c22d-1700-0000-4a49-04aa8a0d0000 pid=3466 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=43e9c22d-1700-0000-4a49-04aa8a0d0000 pid=3466 execve guuid=cb75132e-1700-0000-4a49-04aa8c0d0000 pid=3468 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=cb75132e-1700-0000-4a49-04aa8c0d0000 pid=3468 execve guuid=f447632e-1700-0000-4a49-04aa8f0d0000 pid=3471 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=f447632e-1700-0000-4a49-04aa8f0d0000 pid=3471 execve guuid=abaab42e-1700-0000-4a49-04aa910d0000 pid=3473 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=abaab42e-1700-0000-4a49-04aa910d0000 pid=3473 execve guuid=9ce1082f-1700-0000-4a49-04aa930d0000 pid=3475 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=9ce1082f-1700-0000-4a49-04aa930d0000 pid=3475 execve guuid=f1db5d2f-1700-0000-4a49-04aa960d0000 pid=3478 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=f1db5d2f-1700-0000-4a49-04aa960d0000 pid=3478 execve guuid=4593b12f-1700-0000-4a49-04aa980d0000 pid=3480 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=4593b12f-1700-0000-4a49-04aa980d0000 pid=3480 execve guuid=65190630-1700-0000-4a49-04aa9b0d0000 pid=3483 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=65190630-1700-0000-4a49-04aa9b0d0000 pid=3483 execve guuid=14f45d30-1700-0000-4a49-04aa9d0d0000 pid=3485 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=14f45d30-1700-0000-4a49-04aa9d0d0000 pid=3485 execve guuid=8c22b930-1700-0000-4a49-04aa9f0d0000 pid=3487 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=8c22b930-1700-0000-4a49-04aa9f0d0000 pid=3487 execve guuid=0de71531-1700-0000-4a49-04aaa20d0000 pid=3490 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=0de71531-1700-0000-4a49-04aaa20d0000 pid=3490 execve guuid=83f97831-1700-0000-4a49-04aaa40d0000 pid=3492 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=83f97831-1700-0000-4a49-04aaa40d0000 pid=3492 execve guuid=9a23db31-1700-0000-4a49-04aaa60d0000 pid=3494 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=9a23db31-1700-0000-4a49-04aaa60d0000 pid=3494 execve guuid=34743432-1700-0000-4a49-04aaa90d0000 pid=3497 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=34743432-1700-0000-4a49-04aaa90d0000 pid=3497 execve guuid=378e9232-1700-0000-4a49-04aaab0d0000 pid=3499 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=378e9232-1700-0000-4a49-04aaab0d0000 pid=3499 execve guuid=a7f4e932-1700-0000-4a49-04aaad0d0000 pid=3501 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=a7f4e932-1700-0000-4a49-04aaad0d0000 pid=3501 execve guuid=e6c04733-1700-0000-4a49-04aab00d0000 pid=3504 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=e6c04733-1700-0000-4a49-04aab00d0000 pid=3504 execve guuid=8110a233-1700-0000-4a49-04aab20d0000 pid=3506 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=8110a233-1700-0000-4a49-04aab20d0000 pid=3506 execve guuid=1d2cff33-1700-0000-4a49-04aab50d0000 pid=3509 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=1d2cff33-1700-0000-4a49-04aab50d0000 pid=3509 execve guuid=5fcc5834-1700-0000-4a49-04aab70d0000 pid=3511 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=5fcc5834-1700-0000-4a49-04aab70d0000 pid=3511 execve guuid=8747b534-1700-0000-4a49-04aab90d0000 pid=3513 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=8747b534-1700-0000-4a49-04aab90d0000 pid=3513 execve guuid=86bf1f35-1700-0000-4a49-04aabc0d0000 pid=3516 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=86bf1f35-1700-0000-4a49-04aabc0d0000 pid=3516 execve guuid=d3037e35-1700-0000-4a49-04aabe0d0000 pid=3518 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=d3037e35-1700-0000-4a49-04aabe0d0000 pid=3518 execve guuid=2b2dd935-1700-0000-4a49-04aac10d0000 pid=3521 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=2b2dd935-1700-0000-4a49-04aac10d0000 pid=3521 execve guuid=cb543336-1700-0000-4a49-04aac60d0000 pid=3526 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=cb543336-1700-0000-4a49-04aac60d0000 pid=3526 execve guuid=0dbf8536-1700-0000-4a49-04aac70d0000 pid=3527 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=0dbf8536-1700-0000-4a49-04aac70d0000 pid=3527 execve guuid=39cad636-1700-0000-4a49-04aac80d0000 pid=3528 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=39cad636-1700-0000-4a49-04aac80d0000 pid=3528 execve guuid=bea02c37-1700-0000-4a49-04aac90d0000 pid=3529 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=bea02c37-1700-0000-4a49-04aac90d0000 pid=3529 execve guuid=bd298137-1700-0000-4a49-04aaca0d0000 pid=3530 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=bd298137-1700-0000-4a49-04aaca0d0000 pid=3530 execve guuid=3e8ed737-1700-0000-4a49-04aacb0d0000 pid=3531 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=3e8ed737-1700-0000-4a49-04aacb0d0000 pid=3531 execve guuid=75832c38-1700-0000-4a49-04aacc0d0000 pid=3532 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=75832c38-1700-0000-4a49-04aacc0d0000 pid=3532 execve guuid=8aab7238-1700-0000-4a49-04aacd0d0000 pid=3533 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=8aab7238-1700-0000-4a49-04aacd0d0000 pid=3533 execve guuid=28e4ce38-1700-0000-4a49-04aace0d0000 pid=3534 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=28e4ce38-1700-0000-4a49-04aace0d0000 pid=3534 execve guuid=c0452a39-1700-0000-4a49-04aacf0d0000 pid=3535 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=c0452a39-1700-0000-4a49-04aacf0d0000 pid=3535 execve guuid=221b8b39-1700-0000-4a49-04aad00d0000 pid=3536 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=221b8b39-1700-0000-4a49-04aad00d0000 pid=3536 execve guuid=5f15e739-1700-0000-4a49-04aad10d0000 pid=3537 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=5f15e739-1700-0000-4a49-04aad10d0000 pid=3537 execve guuid=dbd8463a-1700-0000-4a49-04aad20d0000 pid=3538 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=dbd8463a-1700-0000-4a49-04aad20d0000 pid=3538 execve guuid=c7edaa3a-1700-0000-4a49-04aad30d0000 pid=3539 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=c7edaa3a-1700-0000-4a49-04aad30d0000 pid=3539 execve guuid=4dd7083b-1700-0000-4a49-04aad50d0000 pid=3541 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=4dd7083b-1700-0000-4a49-04aad50d0000 pid=3541 execve guuid=1853553b-1700-0000-4a49-04aad80d0000 pid=3544 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=1853553b-1700-0000-4a49-04aad80d0000 pid=3544 execve guuid=51c3ab3b-1700-0000-4a49-04aada0d0000 pid=3546 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=51c3ab3b-1700-0000-4a49-04aada0d0000 pid=3546 execve guuid=9121fb3b-1700-0000-4a49-04aadb0d0000 pid=3547 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=9121fb3b-1700-0000-4a49-04aadb0d0000 pid=3547 execve guuid=8a4b4e3c-1700-0000-4a49-04aadd0d0000 pid=3549 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=8a4b4e3c-1700-0000-4a49-04aadd0d0000 pid=3549 execve guuid=2f24a33c-1700-0000-4a49-04aadf0d0000 pid=3551 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=2f24a33c-1700-0000-4a49-04aadf0d0000 pid=3551 execve guuid=5b04f93c-1700-0000-4a49-04aae10d0000 pid=3553 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=5b04f93c-1700-0000-4a49-04aae10d0000 pid=3553 execve guuid=489a553d-1700-0000-4a49-04aae30d0000 pid=3555 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=489a553d-1700-0000-4a49-04aae30d0000 pid=3555 execve guuid=6cc1b23d-1700-0000-4a49-04aae60d0000 pid=3558 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=6cc1b23d-1700-0000-4a49-04aae60d0000 pid=3558 execve guuid=59f4233e-1700-0000-4a49-04aae80d0000 pid=3560 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=59f4233e-1700-0000-4a49-04aae80d0000 pid=3560 execve guuid=e1afea3e-1700-0000-4a49-04aaeb0d0000 pid=3563 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=e1afea3e-1700-0000-4a49-04aaeb0d0000 pid=3563 execve guuid=8fee503f-1700-0000-4a49-04aaed0d0000 pid=3565 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=8fee503f-1700-0000-4a49-04aaed0d0000 pid=3565 execve guuid=d6abb63f-1700-0000-4a49-04aaee0d0000 pid=3566 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=d6abb63f-1700-0000-4a49-04aaee0d0000 pid=3566 execve guuid=1ea21b40-1700-0000-4a49-04aaf10d0000 pid=3569 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=1ea21b40-1700-0000-4a49-04aaf10d0000 pid=3569 execve guuid=0bfb7740-1700-0000-4a49-04aaf30d0000 pid=3571 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=0bfb7740-1700-0000-4a49-04aaf30d0000 pid=3571 execve guuid=705fd440-1700-0000-4a49-04aaf60d0000 pid=3574 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=705fd440-1700-0000-4a49-04aaf60d0000 pid=3574 execve guuid=9f673541-1700-0000-4a49-04aaf80d0000 pid=3576 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=9f673541-1700-0000-4a49-04aaf80d0000 pid=3576 execve guuid=127c9a41-1700-0000-4a49-04aaf90d0000 pid=3577 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=127c9a41-1700-0000-4a49-04aaf90d0000 pid=3577 execve guuid=478efe41-1700-0000-4a49-04aafb0d0000 pid=3579 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=478efe41-1700-0000-4a49-04aafb0d0000 pid=3579 execve guuid=f5725e42-1700-0000-4a49-04aafc0d0000 pid=3580 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=f5725e42-1700-0000-4a49-04aafc0d0000 pid=3580 execve guuid=6ec1c142-1700-0000-4a49-04aaff0d0000 pid=3583 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=6ec1c142-1700-0000-4a49-04aaff0d0000 pid=3583 execve guuid=23b41d43-1700-0000-4a49-04aa010e0000 pid=3585 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=23b41d43-1700-0000-4a49-04aa010e0000 pid=3585 execve guuid=c498d543-1700-0000-4a49-04aa050e0000 pid=3589 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=c498d543-1700-0000-4a49-04aa050e0000 pid=3589 execve guuid=20848f44-1700-0000-4a49-04aa090e0000 pid=3593 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=20848f44-1700-0000-4a49-04aa090e0000 pid=3593 execve guuid=92f02745-1700-0000-4a49-04aa0c0e0000 pid=3596 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=92f02745-1700-0000-4a49-04aa0c0e0000 pid=3596 execve guuid=ed478f45-1700-0000-4a49-04aa0f0e0000 pid=3599 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=ed478f45-1700-0000-4a49-04aa0f0e0000 pid=3599 execve guuid=3c00eb45-1700-0000-4a49-04aa110e0000 pid=3601 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=3c00eb45-1700-0000-4a49-04aa110e0000 pid=3601 execve guuid=72bd6546-1700-0000-4a49-04aa140e0000 pid=3604 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=72bd6546-1700-0000-4a49-04aa140e0000 pid=3604 execve guuid=2b76c846-1700-0000-4a49-04aa150e0000 pid=3605 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=2b76c846-1700-0000-4a49-04aa150e0000 pid=3605 execve guuid=eb043147-1700-0000-4a49-04aa170e0000 pid=3607 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=eb043147-1700-0000-4a49-04aa170e0000 pid=3607 execve guuid=cf059747-1700-0000-4a49-04aa180e0000 pid=3608 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=cf059747-1700-0000-4a49-04aa180e0000 pid=3608 execve guuid=c36efc47-1700-0000-4a49-04aa1a0e0000 pid=3610 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=c36efc47-1700-0000-4a49-04aa1a0e0000 pid=3610 execve guuid=316c6048-1700-0000-4a49-04aa1c0e0000 pid=3612 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=316c6048-1700-0000-4a49-04aa1c0e0000 pid=3612 execve guuid=ed360249-1700-0000-4a49-04aa1f0e0000 pid=3615 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=ed360249-1700-0000-4a49-04aa1f0e0000 pid=3615 execve guuid=7d02a049-1700-0000-4a49-04aa220e0000 pid=3618 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=7d02a049-1700-0000-4a49-04aa220e0000 pid=3618 execve guuid=32b1024a-1700-0000-4a49-04aa230e0000 pid=3619 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=32b1024a-1700-0000-4a49-04aa230e0000 pid=3619 execve guuid=4d7da74a-1700-0000-4a49-04aa260e0000 pid=3622 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=4d7da74a-1700-0000-4a49-04aa260e0000 pid=3622 execve guuid=aa5a464b-1700-0000-4a49-04aa280e0000 pid=3624 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=aa5a464b-1700-0000-4a49-04aa280e0000 pid=3624 execve guuid=6a88a74b-1700-0000-4a49-04aa2b0e0000 pid=3627 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=6a88a74b-1700-0000-4a49-04aa2b0e0000 pid=3627 execve guuid=4dc1044c-1700-0000-4a49-04aa2d0e0000 pid=3629 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=4dc1044c-1700-0000-4a49-04aa2d0e0000 pid=3629 execve guuid=aadf624c-1700-0000-4a49-04aa300e0000 pid=3632 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=aadf624c-1700-0000-4a49-04aa300e0000 pid=3632 execve guuid=2e3cbf4c-1700-0000-4a49-04aa320e0000 pid=3634 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=2e3cbf4c-1700-0000-4a49-04aa320e0000 pid=3634 execve guuid=2b97214d-1700-0000-4a49-04aa350e0000 pid=3637 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=2b97214d-1700-0000-4a49-04aa350e0000 pid=3637 execve guuid=e4747e4d-1700-0000-4a49-04aa370e0000 pid=3639 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=e4747e4d-1700-0000-4a49-04aa370e0000 pid=3639 execve guuid=1ecadd4d-1700-0000-4a49-04aa3a0e0000 pid=3642 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=1ecadd4d-1700-0000-4a49-04aa3a0e0000 pid=3642 execve guuid=eade3e4e-1700-0000-4a49-04aa3c0e0000 pid=3644 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=eade3e4e-1700-0000-4a49-04aa3c0e0000 pid=3644 execve guuid=be669f4e-1700-0000-4a49-04aa3f0e0000 pid=3647 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=be669f4e-1700-0000-4a49-04aa3f0e0000 pid=3647 execve guuid=588c034f-1700-0000-4a49-04aa410e0000 pid=3649 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=588c034f-1700-0000-4a49-04aa410e0000 pid=3649 execve guuid=ac256a4f-1700-0000-4a49-04aa440e0000 pid=3652 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=ac256a4f-1700-0000-4a49-04aa440e0000 pid=3652 execve guuid=2290cb4f-1700-0000-4a49-04aa460e0000 pid=3654 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=2290cb4f-1700-0000-4a49-04aa460e0000 pid=3654 execve guuid=b8a72b50-1700-0000-4a49-04aa480e0000 pid=3656 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=b8a72b50-1700-0000-4a49-04aa480e0000 pid=3656 execve guuid=ab348a50-1700-0000-4a49-04aa4d0e0000 pid=3661 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=ab348a50-1700-0000-4a49-04aa4d0e0000 pid=3661 execve guuid=f866e850-1700-0000-4a49-04aa4f0e0000 pid=3663 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=f866e850-1700-0000-4a49-04aa4f0e0000 pid=3663 execve guuid=50765051-1700-0000-4a49-04aa510e0000 pid=3665 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=50765051-1700-0000-4a49-04aa510e0000 pid=3665 execve guuid=1ee2af51-1700-0000-4a49-04aa530e0000 pid=3667 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=1ee2af51-1700-0000-4a49-04aa530e0000 pid=3667 execve guuid=a5680f52-1700-0000-4a49-04aa550e0000 pid=3669 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=a5680f52-1700-0000-4a49-04aa550e0000 pid=3669 execve guuid=c1c06652-1700-0000-4a49-04aa580e0000 pid=3672 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=c1c06652-1700-0000-4a49-04aa580e0000 pid=3672 execve guuid=0650ca52-1700-0000-4a49-04aa5a0e0000 pid=3674 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=0650ca52-1700-0000-4a49-04aa5a0e0000 pid=3674 execve guuid=3bc02653-1700-0000-4a49-04aa5c0e0000 pid=3676 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=3bc02653-1700-0000-4a49-04aa5c0e0000 pid=3676 execve guuid=20f98153-1700-0000-4a49-04aa5e0e0000 pid=3678 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=20f98153-1700-0000-4a49-04aa5e0e0000 pid=3678 execve guuid=4fe5e353-1700-0000-4a49-04aa600e0000 pid=3680 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=4fe5e353-1700-0000-4a49-04aa600e0000 pid=3680 execve guuid=a36b3954-1700-0000-4a49-04aa620e0000 pid=3682 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=a36b3954-1700-0000-4a49-04aa620e0000 pid=3682 execve guuid=d3178c54-1700-0000-4a49-04aa640e0000 pid=3684 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=d3178c54-1700-0000-4a49-04aa640e0000 pid=3684 execve guuid=dcf8e854-1700-0000-4a49-04aa660e0000 pid=3686 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=dcf8e854-1700-0000-4a49-04aa660e0000 pid=3686 execve guuid=74ae3c55-1700-0000-4a49-04aa670e0000 pid=3687 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=74ae3c55-1700-0000-4a49-04aa670e0000 pid=3687 execve guuid=d5549055-1700-0000-4a49-04aa680e0000 pid=3688 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=d5549055-1700-0000-4a49-04aa680e0000 pid=3688 execve guuid=f4202356-1700-0000-4a49-04aa690e0000 pid=3689 /usr/bin/ls guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=f4202356-1700-0000-4a49-04aa690e0000 pid=3689 execve guuid=33e88156-1700-0000-4a49-04aa6a0e0000 pid=3690 /usr/bin/rm guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=33e88156-1700-0000-4a49-04aa6a0e0000 pid=3690 execve guuid=de94bb56-1700-0000-4a49-04aa6b0e0000 pid=3691 /usr/bin/wget net send-data write-file guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=de94bb56-1700-0000-4a49-04aa6b0e0000 pid=3691 execve guuid=3700fd9a-1700-0000-4a49-04aa260f0000 pid=3878 /usr/bin/chmod guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=3700fd9a-1700-0000-4a49-04aa260f0000 pid=3878 execve guuid=2ef5c49b-1700-0000-4a49-04aa280f0000 pid=3880 /tmp/MfMN guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=2ef5c49b-1700-0000-4a49-04aa280f0000 pid=3880 execve guuid=3bba6c9d-1700-0000-4a49-04aa2e0f0000 pid=3886 /usr/bin/rm guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=3bba6c9d-1700-0000-4a49-04aa2e0f0000 pid=3886 execve guuid=ecb4b89d-1700-0000-4a49-04aa300f0000 pid=3888 /usr/bin/wget net send-data write-file guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=ecb4b89d-1700-0000-4a49-04aa300f0000 pid=3888 execve guuid=cd2f17a4-1700-0000-4a49-04aa490f0000 pid=3913 /usr/bin/chmod guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=cd2f17a4-1700-0000-4a49-04aa490f0000 pid=3913 execve guuid=a19391a4-1700-0000-4a49-04aa4b0f0000 pid=3915 /tmp/qPf guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=a19391a4-1700-0000-4a49-04aa4b0f0000 pid=3915 execve guuid=40b5b3a5-1700-0000-4a49-04aa520f0000 pid=3922 /usr/bin/rm guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=40b5b3a5-1700-0000-4a49-04aa520f0000 pid=3922 execve guuid=faca08a6-1700-0000-4a49-04aa540f0000 pid=3924 /usr/bin/wget net send-data write-file guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=faca08a6-1700-0000-4a49-04aa540f0000 pid=3924 execve guuid=d8da31ae-1700-0000-4a49-04aa6a0f0000 pid=3946 /usr/bin/chmod guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=d8da31ae-1700-0000-4a49-04aa6a0f0000 pid=3946 execve guuid=ad0d8eae-1700-0000-4a49-04aa6b0f0000 pid=3947 /tmp/MXl guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=ad0d8eae-1700-0000-4a49-04aa6b0f0000 pid=3947 execve guuid=5f3754af-1700-0000-4a49-04aa700f0000 pid=3952 /usr/bin/rm guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=5f3754af-1700-0000-4a49-04aa700f0000 pid=3952 execve guuid=1d2c8caf-1700-0000-4a49-04aa720f0000 pid=3954 /usr/bin/wget net send-data write-file guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=1d2c8caf-1700-0000-4a49-04aa720f0000 pid=3954 execve guuid=f8d19ed3-1700-0000-4a49-04aaea0f0000 pid=4074 /usr/bin/chmod guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=f8d19ed3-1700-0000-4a49-04aaea0f0000 pid=4074 execve guuid=d032dbd3-1700-0000-4a49-04aaec0f0000 pid=4076 /tmp/QVz1 guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=d032dbd3-1700-0000-4a49-04aaec0f0000 pid=4076 execve guuid=b1c94dd5-1700-0000-4a49-04aaf20f0000 pid=4082 /usr/bin/rm guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=b1c94dd5-1700-0000-4a49-04aaf20f0000 pid=4082 execve guuid=82a686d5-1700-0000-4a49-04aaf30f0000 pid=4083 /usr/bin/wget net send-data write-file guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=82a686d5-1700-0000-4a49-04aaf30f0000 pid=4083 execve guuid=733bbcdb-1700-0000-4a49-04aa12100000 pid=4114 /usr/bin/chmod guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=733bbcdb-1700-0000-4a49-04aa12100000 pid=4114 execve guuid=8fb6f8db-1700-0000-4a49-04aa14100000 pid=4116 /tmp/x0z guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=8fb6f8db-1700-0000-4a49-04aa14100000 pid=4116 execve guuid=b91e35dd-1700-0000-4a49-04aa1a100000 pid=4122 /usr/bin/rm delete-file guuid=30740528-1700-0000-4a49-04aa650d0000 pid=3429->guuid=b91e35dd-1700-0000-4a49-04aa1a100000 pid=4122 execve 9554d36e-3083-568e-90da-bb8e3c487b07 188.132.232.81:80 guuid=de94bb56-1700-0000-4a49-04aa6b0e0000 pid=3691->9554d36e-3083-568e-90da-bb8e3c487b07 send: 133B guuid=ecb4b89d-1700-0000-4a49-04aa300f0000 pid=3888->9554d36e-3083-568e-90da-bb8e3c487b07 send: 132B guuid=faca08a6-1700-0000-4a49-04aa540f0000 pid=3924->9554d36e-3083-568e-90da-bb8e3c487b07 send: 132B guuid=1d2c8caf-1700-0000-4a49-04aa720f0000 pid=3954->9554d36e-3083-568e-90da-bb8e3c487b07 send: 133B guuid=82a686d5-1700-0000-4a49-04aaf30f0000 pid=4083->9554d36e-3083-568e-90da-bb8e3c487b07 send: 132B
Score:
96%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/3431ed0a46d18ed6d16657d87dc481b6220634ab3724db2e7f9abae445d3ff1a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3431ed0a46d18ed6d16657d87dc481b6220634ab3724db2e7f9abae445d3ff1a/
Threat name:
Win32.Trojan.Vigorf
Create hunting rule
Status:
Malicious
First seen:
2026-06-10 08:40:51 UTC
File Type:
Text (Shell)
AV detection:
10 of 23 (43.48%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gqy62csg2ghnnulgk7mh3rebwyramnflg4snwlt7tk5oirot74na._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
defense_evasion discovery linux
Link:
https://tria.ge/reports/260610-kk8wpshs4n/
Behaviour
Reads runtime system information
Writes file to tmp directory
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.26
Link:
https://yomi.yoroi.company/submissions/3431ed0a46d18ed6d16657d87dc481b6220634ab3724db2e7f9abae445d3ff1a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 3431ed0a46d18ed6d16657d87dc481b6220634ab3724db2e7f9abae445d3ff1a

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3856423/
  
Delivery method
Distributed via web download

Comments