MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3edcc282706f25748cb78b59ee6e3e460cd96d054522e7fbd573742fc397b14a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DDoSAgent


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3edcc282706f25748cb78b59ee6e3e460cd96d054522e7fbd573742fc397b14a
SHA3-384 hash: 3e1404fa84027cc2628fd4a35e151843b6100669f41b776c6caf7e349a3efc395fd053765f76516cecdf4f68e6f6b829
SHA1 hash: 38da4bc1cac0fc681ca5232a55cbf4b33ce42a72
MD5 hash: f4a67ee49b12aea781c5c87b4bd81f6e
humanhash: vermont-bakerloo-single-gee
File name:dl201
Download: download sample
Signature DDoSAgent
Create hunting rule
File size:3'683 bytes
First seen:2025-07-20 18:56:01 UTC
Last seen:Never
File type: sh
MIME type:text/plain
ssdeep 96:yqhT4LHVJhkESXf0ktMlsfdW+f2WZSMNM8wK:wTI
TLSH T186719AD902E203009102B64F3BF97B61AE7483E5AE7B0F89FC95C97A5470A54F224F5D
Magika shell
Reporter abuse_ch
Tags:DDOSAgent sh
URLMalware sample (SHA256 hash)SignatureTags
http://31.170.22.205/bins/whisper.armv555d6cc5c314be3c2c988a797eeed584c7844549513e5eb9106a3a266f5c9c527 DDoSAgentDDoSAgent elf
http://31.170.22.205/bins/whisper.armv62b4c87240aaf767982d676933e628f8bf2957c931d906a90c88ccf3a18dc55ce DDoSAgentDDoSAgent elf
http://31.170.22.205/bins/whisper.armv7e97da696893a2a090ac962789c524119aacab5583df1f2074c081295a0f582e3 DDoSAgentDDoSAgent elf
http://31.170.22.205/bins/whisper.aarch6438b7cbe9ff53cec015d67d04da59bcced70fae6c7e1d15baf95abc34035cc862 DDoSAgentDDoSAgent elf
http://31.170.22.205/bins/whisper.aarch64be5b489dfd7395de9106468d7b92374c56d30af994b4ea06be6c77e98ba540cf6a DDoSAgentDDoSAgent elf
http://31.170.22.205/bins/whisper.arcle750d6001350ab65adfd7a9e0fca7560c49fc5d8f6e96939f1bdb630599e5fb902a14 DDoSAgentDDoSAgent elf
http://31.170.22.205/bins/whisper.arclehs381a3c8f2dbd32b05b5dc1c7ebd3b5cdaaf24fb5296978e6061671edca802a41f4 DDoSAgentDDoSAgent elf
http://31.170.22.205/bins/whisper.mips3d0ff85391334a8130b92bf85bb1b760f7f060508a5bfaab3ff7eb9a2ca53b0a DDoSAgentDDoSAgent elf mirai opendir
http://31.170.22.205/bins/whisper.mips64b8c1191781c9feb322cfcacf40f4f1d207a09af4d786e26a7455e8a36afd4a1c DDoSAgentDDoSAgent elf mirai opendir
http://31.170.22.205/bins/whisper.mips64le527a822afceebc65d8926a1dd0c3c97862f3e114db26f104797c58f45a2e609c DDoSAgentDDoSAgent elf mirai opendir
http://31.170.22.205/bins/whisper.mips64len32c6a1cd7348531c4c0db50ecf21f64e444b33a3ff194ed55a467adb938ec22408 DDoSAgentDDoSAgent elf
http://31.170.22.205/bins/whisper.mips64n3290676d5a951bfb339c20472a0d3ff253767268f54be520eb6410522eeba9741e DDoSAgentDDoSAgent elf
http://31.170.22.205/bins/whisper.mipslee479f82af03dd6087f688cd398fc792a6443e362c9a36348ab53a3f6ddc591a2 DDoSAgentDDoSAgent elf mirai opendir
http://31.170.22.205/bins/whisper.riscv3245ca399bc539910e391f87bb398acac0f5c47410acb0d329ea3bf82406b3c189 DDoSAgentDDoSAgent elf
http://31.170.22.205/bins/whisper.riscv6484dbcc96a5ede7cb185d06f1116aee3bbe07e85ab020e86b5d4bfa9dcc6e60e1 DDoSAgentDDoSAgent elf
http://31.170.22.205/bins/whisper.m68kc304b1825bfe337bc1801440ca0bb1cda35aa96672d60952b852a5b2e3255f06 DDoSAgentDDoSAgent elf
http://31.170.22.205/bins/whisper.sh4n/an/aelf
http://31.170.22.205/bins/whisper.i6862ba541b4a6c62619d785852c86d67829118e70a52105ef37f32010aecb64784b DDoSAgentDDoSAgent elf
http://31.170.22.205/bins/whisper.x6411742623bba0e1ca221814a36cd8239be94898c59fcc61c1328a6230a9981219 DDoSAgentDDoSAgent elf mirai opendir
http://31.170.22.205/bins/whisper.powerpc440fp197455fb6ac704dea344ee392427a842c243f6919c6886965b9586424b65e00b DDoSAgentDDoSAgent elf
http://31.170.22.205/bins/whisper.powerpc64e55001033d5f5d215d7df4d05737606f8323406eaeb9c215e1308fe48e77aba6f00f4 DDoSAgentDDoSAgent elf
http://31.170.22.205/bins/whisper.powerpc64e6500a97c72cdfb63586cf2bbf84c6839b38eaf7af1a474d6f5f27af0b11f7140f067 DDoSAgentDDoSAgent elf
http://31.170.22.205/bins/whisper.powerpc64lepower84d5ef555aac80b752223c279e28e49de774e1a68309e426095c52690a105f313 DDoSAgentDDoSAgent elf
http://31.170.22.205/bins/whisper.powerpc64power8e3ed9343357d6cb963060d7908aa2637165f89cf21a4eb8f7538bb2ddb79e54f DDoSAgentDDoSAgent elf
http://31.170.22.205/bins/whisper.powerpce300c395d23e5693047c429dcf68baf9141ee074a578d08d434f6e1ae520374d0c7928 DDoSAgentDDoSAgent elf
http://31.170.22.205/bins/whisper.powerpce500mc189b5636d5a9a46a6ed38a7fdcd6b4f063fd7abc292363ff9ef7ac77852eae49 DDoSAgentDDoSAgent elf
http://31.170.22.205/bins/whisper.sparc25bf2d5845b6d3497bbceeeda40ba99a78e27f8ca88ec2efb690d919b4c5b8f6 DDoSAgentDDoSAgent elf
http://31.170.22.205/bins/whisper.sparc640e7338e304ae5c960e232d80d98edb0a281d03c974ab13c6de4b0596fd0557c9 DDoSAgentDDoSAgent elf
http://31.170.22.205/bins/whisper.armv4n/an/aelf

Intelligence

File Origin
# of uploads :
1
# of downloads :
25
Origin country :
DE DE
Vendor Threat Intelligence
Detection(s):
URLhaus.3462419.UNOFFICIAL
Create hunting rule

URLhaus.3462413.UNOFFICIAL
Create hunting rule

URLhaus.3462403.UNOFFICIAL
Create hunting rule

URLhaus.3462409.UNOFFICIAL
Create hunting rule

URLhaus.3462416.UNOFFICIAL
Create hunting rule

URLhaus.3462399.UNOFFICIAL
Create hunting rule

URLhaus.3462402.UNOFFICIAL
Create hunting rule

URLhaus.3447675.UNOFFICIAL
Create hunting rule

URLhaus.3447676.UNOFFICIAL
Create hunting rule

URLhaus.3447679.UNOFFICIAL
Create hunting rule

URLhaus.3462417.UNOFFICIAL
Create hunting rule

URLhaus.3462395.UNOFFICIAL
Create hunting rule

URLhaus.3447674.UNOFFICIAL
Create hunting rule

URLhaus.3462404.UNOFFICIAL
Create hunting rule

URLhaus.3462410.UNOFFICIAL
Create hunting rule

URLhaus.3462418.UNOFFICIAL
Create hunting rule

URLhaus.3462407.UNOFFICIAL
Create hunting rule

URLhaus.3462397.UNOFFICIAL
Create hunting rule

URLhaus.3447677.UNOFFICIAL
Create hunting rule

URLhaus.3462398.UNOFFICIAL
Create hunting rule

URLhaus.3462400.UNOFFICIAL
Create hunting rule

URLhaus.3462415.UNOFFICIAL
Create hunting rule

URLhaus.3462406.UNOFFICIAL
Create hunting rule

URLhaus.3462405.UNOFFICIAL
Create hunting rule

URLhaus.3462401.UNOFFICIAL
Create hunting rule

URLhaus.3462396.UNOFFICIAL
Create hunting rule

URLhaus.3462412.UNOFFICIAL
Create hunting rule

URLhaus.3462408.UNOFFICIAL
Create hunting rule

URLhaus.3462414.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/687d3be18a7d628a81b8aa1d/reports/903db9b4-7352-4117-b891-de93a4c9f3dd/overview
Verdict:
Malicious
Labled as:
Bash.MiraiA.Generic
Link:
https://www.hybrid-analysis.com/sample/3edcc282706f25748cb78b59ee6e3e460cd96d054522e7fbd573742fc397b14a
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/060ee3e1-187a-463e-a242-d0e713618314
Behavior Graph:
Download SVG
%3 guuid=79b0839e-1a00-0000-6dc7-12ac2d0c0000 pid=3117 /usr/bin/sudo guuid=a3b90ca1-1a00-0000-6dc7-12ac370c0000 pid=3127 /tmp/sample.bin guuid=79b0839e-1a00-0000-6dc7-12ac2d0c0000 pid=3117->guuid=a3b90ca1-1a00-0000-6dc7-12ac370c0000 pid=3127 execve guuid=c7876ca1-1a00-0000-6dc7-12ac390c0000 pid=3129 /usr/bin/rm guuid=a3b90ca1-1a00-0000-6dc7-12ac370c0000 pid=3127->guuid=c7876ca1-1a00-0000-6dc7-12ac390c0000 pid=3129 execve guuid=d524c3a1-1a00-0000-6dc7-12ac3a0c0000 pid=3130 /usr/bin/wget net send-data write-file guuid=a3b90ca1-1a00-0000-6dc7-12ac370c0000 pid=3127->guuid=d524c3a1-1a00-0000-6dc7-12ac3a0c0000 pid=3130 execve guuid=f09221b2-1a00-0000-6dc7-12ac5d0c0000 pid=3165 /usr/bin/chmod guuid=a3b90ca1-1a00-0000-6dc7-12ac370c0000 pid=3127->guuid=f09221b2-1a00-0000-6dc7-12ac5d0c0000 pid=3165 execve guuid=a6cd67b2-1a00-0000-6dc7-12ac5e0c0000 pid=3166 /usr/bin/dash guuid=a3b90ca1-1a00-0000-6dc7-12ac370c0000 pid=3127->guuid=a6cd67b2-1a00-0000-6dc7-12ac5e0c0000 pid=3166 clone guuid=4884c9b3-1a00-0000-6dc7-12ac610c0000 pid=3169 /usr/bin/rm delete-file guuid=a3b90ca1-1a00-0000-6dc7-12ac370c0000 pid=3127->guuid=4884c9b3-1a00-0000-6dc7-12ac610c0000 pid=3169 execve guuid=c2b164b4-1a00-0000-6dc7-12ac620c0000 pid=3170 /usr/bin/wget net send-data write-file guuid=a3b90ca1-1a00-0000-6dc7-12ac370c0000 pid=3127->guuid=c2b164b4-1a00-0000-6dc7-12ac620c0000 pid=3170 execve guuid=d3fcd6c0-1a00-0000-6dc7-12ac770c0000 pid=3191 /usr/bin/chmod guuid=a3b90ca1-1a00-0000-6dc7-12ac370c0000 pid=3127->guuid=d3fcd6c0-1a00-0000-6dc7-12ac770c0000 pid=3191 execve guuid=7f355cc1-1a00-0000-6dc7-12ac780c0000 pid=3192 /usr/bin/dash guuid=a3b90ca1-1a00-0000-6dc7-12ac370c0000 pid=3127->guuid=7f355cc1-1a00-0000-6dc7-12ac780c0000 pid=3192 clone guuid=69db46c2-1a00-0000-6dc7-12ac7a0c0000 pid=3194 /usr/bin/rm delete-file guuid=a3b90ca1-1a00-0000-6dc7-12ac370c0000 pid=3127->guuid=69db46c2-1a00-0000-6dc7-12ac7a0c0000 pid=3194 execve guuid=4ca8aac2-1a00-0000-6dc7-12ac7b0c0000 pid=3195 /usr/bin/wget net send-data write-file guuid=a3b90ca1-1a00-0000-6dc7-12ac370c0000 pid=3127->guuid=4ca8aac2-1a00-0000-6dc7-12ac7b0c0000 pid=3195 execve guuid=c8b5b7ce-1a00-0000-6dc7-12ac7c0c0000 pid=3196 /usr/bin/chmod guuid=a3b90ca1-1a00-0000-6dc7-12ac370c0000 pid=3127->guuid=c8b5b7ce-1a00-0000-6dc7-12ac7c0c0000 pid=3196 execve guuid=268a13cf-1a00-0000-6dc7-12ac7d0c0000 pid=3197 /usr/bin/dash guuid=a3b90ca1-1a00-0000-6dc7-12ac370c0000 pid=3127->guuid=268a13cf-1a00-0000-6dc7-12ac7d0c0000 pid=3197 clone guuid=1ca7eccf-1a00-0000-6dc7-12ac800c0000 pid=3200 /usr/bin/rm delete-file guuid=a3b90ca1-1a00-0000-6dc7-12ac370c0000 pid=3127->guuid=1ca7eccf-1a00-0000-6dc7-12ac800c0000 pid=3200 execve guuid=b0ea33d0-1a00-0000-6dc7-12ac810c0000 pid=3201 /usr/bin/wget net send-data write-file guuid=a3b90ca1-1a00-0000-6dc7-12ac370c0000 pid=3127->guuid=b0ea33d0-1a00-0000-6dc7-12ac810c0000 pid=3201 execve guuid=b2f844de-1a00-0000-6dc7-12ac9b0c0000 pid=3227 /usr/bin/chmod guuid=a3b90ca1-1a00-0000-6dc7-12ac370c0000 pid=3127->guuid=b2f844de-1a00-0000-6dc7-12ac9b0c0000 pid=3227 execve guuid=9996a3de-1a00-0000-6dc7-12ac9c0c0000 pid=3228 /usr/bin/dash guuid=a3b90ca1-1a00-0000-6dc7-12ac370c0000 pid=3127->guuid=9996a3de-1a00-0000-6dc7-12ac9c0c0000 pid=3228 clone guuid=a84e69df-1a00-0000-6dc7-12ac9f0c0000 pid=3231 /usr/bin/rm delete-file guuid=a3b90ca1-1a00-0000-6dc7-12ac370c0000 pid=3127->guuid=a84e69df-1a00-0000-6dc7-12ac9f0c0000 pid=3231 execve guuid=948faddf-1a00-0000-6dc7-12aca10c0000 pid=3233 /usr/bin/wget net send-data write-file guuid=a3b90ca1-1a00-0000-6dc7-12ac370c0000 pid=3127->guuid=948faddf-1a00-0000-6dc7-12aca10c0000 pid=3233 execve guuid=d0b389ee-1a00-0000-6dc7-12acaa0c0000 pid=3242 /usr/bin/chmod guuid=a3b90ca1-1a00-0000-6dc7-12ac370c0000 pid=3127->guuid=d0b389ee-1a00-0000-6dc7-12acaa0c0000 pid=3242 execve guuid=6c0ef0ee-1a00-0000-6dc7-12acab0c0000 pid=3243 /usr/bin/dash guuid=a3b90ca1-1a00-0000-6dc7-12ac370c0000 pid=3127->guuid=6c0ef0ee-1a00-0000-6dc7-12acab0c0000 pid=3243 clone guuid=e4b32ff0-1a00-0000-6dc7-12acad0c0000 pid=3245 /usr/bin/rm delete-file guuid=a3b90ca1-1a00-0000-6dc7-12ac370c0000 pid=3127->guuid=e4b32ff0-1a00-0000-6dc7-12acad0c0000 pid=3245 execve guuid=fd8d88f0-1a00-0000-6dc7-12acae0c0000 pid=3246 /usr/bin/wget net send-data write-file guuid=a3b90ca1-1a00-0000-6dc7-12ac370c0000 pid=3127->guuid=fd8d88f0-1a00-0000-6dc7-12acae0c0000 pid=3246 execve guuid=6eff62fd-1a00-0000-6dc7-12acbf0c0000 pid=3263 /usr/bin/chmod guuid=a3b90ca1-1a00-0000-6dc7-12ac370c0000 pid=3127->guuid=6eff62fd-1a00-0000-6dc7-12acbf0c0000 pid=3263 execve guuid=2d95b9fd-1a00-0000-6dc7-12acc10c0000 pid=3265 /usr/bin/dash guuid=a3b90ca1-1a00-0000-6dc7-12ac370c0000 pid=3127->guuid=2d95b9fd-1a00-0000-6dc7-12acc10c0000 pid=3265 clone guuid=b89ec7ff-1a00-0000-6dc7-12acc70c0000 pid=3271 /usr/bin/rm delete-file guuid=a3b90ca1-1a00-0000-6dc7-12ac370c0000 pid=3127->guuid=b89ec7ff-1a00-0000-6dc7-12acc70c0000 pid=3271 execve guuid=a3d34300-1b00-0000-6dc7-12acc80c0000 pid=3272 /usr/bin/wget net send-data write-file guuid=a3b90ca1-1a00-0000-6dc7-12ac370c0000 pid=3127->guuid=a3d34300-1b00-0000-6dc7-12acc80c0000 pid=3272 execve guuid=fad4dd0c-1b00-0000-6dc7-12acd80c0000 pid=3288 /usr/bin/chmod guuid=a3b90ca1-1a00-0000-6dc7-12ac370c0000 pid=3127->guuid=fad4dd0c-1b00-0000-6dc7-12acd80c0000 pid=3288 execve guuid=2482280d-1b00-0000-6dc7-12acd90c0000 pid=3289 /usr/bin/dash guuid=a3b90ca1-1a00-0000-6dc7-12ac370c0000 pid=3127->guuid=2482280d-1b00-0000-6dc7-12acd90c0000 pid=3289 clone guuid=2186c20d-1b00-0000-6dc7-12acdb0c0000 pid=3291 /usr/bin/rm delete-file guuid=a3b90ca1-1a00-0000-6dc7-12ac370c0000 pid=3127->guuid=2186c20d-1b00-0000-6dc7-12acdb0c0000 pid=3291 execve guuid=f3ea360e-1b00-0000-6dc7-12acdd0c0000 pid=3293 /usr/bin/wget net send-data write-file guuid=a3b90ca1-1a00-0000-6dc7-12ac370c0000 pid=3127->guuid=f3ea360e-1b00-0000-6dc7-12acdd0c0000 pid=3293 execve guuid=3356211f-1b00-0000-6dc7-12acfe0c0000 pid=3326 /usr/bin/chmod guuid=a3b90ca1-1a00-0000-6dc7-12ac370c0000 pid=3127->guuid=3356211f-1b00-0000-6dc7-12acfe0c0000 pid=3326 execve guuid=0271901f-1b00-0000-6dc7-12ac000d0000 pid=3328 /usr/bin/dash guuid=a3b90ca1-1a00-0000-6dc7-12ac370c0000 pid=3127->guuid=0271901f-1b00-0000-6dc7-12ac000d0000 pid=3328 clone guuid=3ef24720-1b00-0000-6dc7-12ac040d0000 pid=3332 /usr/bin/rm delete-file guuid=a3b90ca1-1a00-0000-6dc7-12ac370c0000 pid=3127->guuid=3ef24720-1b00-0000-6dc7-12ac040d0000 pid=3332 execve guuid=c4e09c20-1b00-0000-6dc7-12ac060d0000 pid=3334 /usr/bin/wget net send-data write-file guuid=a3b90ca1-1a00-0000-6dc7-12ac370c0000 pid=3127->guuid=c4e09c20-1b00-0000-6dc7-12ac060d0000 pid=3334 execve guuid=b5cc4336-1b00-0000-6dc7-12ac2f0d0000 pid=3375 /usr/bin/chmod guuid=a3b90ca1-1a00-0000-6dc7-12ac370c0000 pid=3127->guuid=b5cc4336-1b00-0000-6dc7-12ac2f0d0000 pid=3375 execve guuid=82acad36-1b00-0000-6dc7-12ac300d0000 pid=3376 /usr/bin/dash guuid=a3b90ca1-1a00-0000-6dc7-12ac370c0000 pid=3127->guuid=82acad36-1b00-0000-6dc7-12ac300d0000 pid=3376 clone guuid=11bd6338-1b00-0000-6dc7-12ac320d0000 pid=3378 /usr/bin/rm delete-file guuid=a3b90ca1-1a00-0000-6dc7-12ac370c0000 pid=3127->guuid=11bd6338-1b00-0000-6dc7-12ac320d0000 pid=3378 execve guuid=a130b638-1b00-0000-6dc7-12ac330d0000 pid=3379 /usr/bin/wget net send-data write-file guuid=a3b90ca1-1a00-0000-6dc7-12ac370c0000 pid=3127->guuid=a130b638-1b00-0000-6dc7-12ac330d0000 pid=3379 execve guuid=2651a84e-1b00-0000-6dc7-12ac550d0000 pid=3413 /usr/bin/chmod guuid=a3b90ca1-1a00-0000-6dc7-12ac370c0000 pid=3127->guuid=2651a84e-1b00-0000-6dc7-12ac550d0000 pid=3413 execve guuid=7780ef4e-1b00-0000-6dc7-12ac560d0000 pid=3414 /usr/bin/dash guuid=a3b90ca1-1a00-0000-6dc7-12ac370c0000 pid=3127->guuid=7780ef4e-1b00-0000-6dc7-12ac560d0000 pid=3414 clone guuid=54b8984f-1b00-0000-6dc7-12ac580d0000 pid=3416 /usr/bin/rm delete-file guuid=a3b90ca1-1a00-0000-6dc7-12ac370c0000 pid=3127->guuid=54b8984f-1b00-0000-6dc7-12ac580d0000 pid=3416 execve guuid=813ee44f-1b00-0000-6dc7-12ac5a0d0000 pid=3418 /usr/bin/wget net send-data write-file guuid=a3b90ca1-1a00-0000-6dc7-12ac370c0000 pid=3127->guuid=813ee44f-1b00-0000-6dc7-12ac5a0d0000 pid=3418 execve guuid=d8cdc55d-1b00-0000-6dc7-12ac740d0000 pid=3444 /usr/bin/chmod guuid=a3b90ca1-1a00-0000-6dc7-12ac370c0000 pid=3127->guuid=d8cdc55d-1b00-0000-6dc7-12ac740d0000 pid=3444 execve guuid=387e265e-1b00-0000-6dc7-12ac760d0000 pid=3446 /usr/bin/dash guuid=a3b90ca1-1a00-0000-6dc7-12ac370c0000 pid=3127->guuid=387e265e-1b00-0000-6dc7-12ac760d0000 pid=3446 clone guuid=fbd01c5f-1b00-0000-6dc7-12ac7a0d0000 pid=3450 /usr/bin/rm delete-file guuid=a3b90ca1-1a00-0000-6dc7-12ac370c0000 pid=3127->guuid=fbd01c5f-1b00-0000-6dc7-12ac7a0d0000 pid=3450 execve guuid=5990625f-1b00-0000-6dc7-12ac7b0d0000 pid=3451 /usr/bin/wget net send-data write-file guuid=a3b90ca1-1a00-0000-6dc7-12ac370c0000 pid=3127->guuid=5990625f-1b00-0000-6dc7-12ac7b0d0000 pid=3451 execve guuid=9e59006e-1b00-0000-6dc7-12aca00d0000 pid=3488 /usr/bin/chmod guuid=a3b90ca1-1a00-0000-6dc7-12ac370c0000 pid=3127->guuid=9e59006e-1b00-0000-6dc7-12aca00d0000 pid=3488 execve guuid=43c8706e-1b00-0000-6dc7-12aca20d0000 pid=3490 /usr/bin/dash guuid=a3b90ca1-1a00-0000-6dc7-12ac370c0000 pid=3127->guuid=43c8706e-1b00-0000-6dc7-12aca20d0000 pid=3490 clone guuid=cfc5556f-1b00-0000-6dc7-12aca60d0000 pid=3494 /usr/bin/rm delete-file guuid=a3b90ca1-1a00-0000-6dc7-12ac370c0000 pid=3127->guuid=cfc5556f-1b00-0000-6dc7-12aca60d0000 pid=3494 execve guuid=f36bb96f-1b00-0000-6dc7-12aca80d0000 pid=3496 /usr/bin/wget net send-data write-file guuid=a3b90ca1-1a00-0000-6dc7-12ac370c0000 pid=3127->guuid=f36bb96f-1b00-0000-6dc7-12aca80d0000 pid=3496 execve guuid=80e5787e-1b00-0000-6dc7-12accc0d0000 pid=3532 /usr/bin/chmod guuid=a3b90ca1-1a00-0000-6dc7-12ac370c0000 pid=3127->guuid=80e5787e-1b00-0000-6dc7-12accc0d0000 pid=3532 execve guuid=ec77f97e-1b00-0000-6dc7-12acce0d0000 pid=3534 /usr/bin/dash guuid=a3b90ca1-1a00-0000-6dc7-12ac370c0000 pid=3127->guuid=ec77f97e-1b00-0000-6dc7-12acce0d0000 pid=3534 clone guuid=586e3f80-1b00-0000-6dc7-12acd20d0000 pid=3538 /usr/bin/rm delete-file guuid=a3b90ca1-1a00-0000-6dc7-12ac370c0000 pid=3127->guuid=586e3f80-1b00-0000-6dc7-12acd20d0000 pid=3538 execve guuid=d22c9980-1b00-0000-6dc7-12acd40d0000 pid=3540 /usr/bin/wget net send-data write-file guuid=a3b90ca1-1a00-0000-6dc7-12ac370c0000 pid=3127->guuid=d22c9980-1b00-0000-6dc7-12acd40d0000 pid=3540 execve guuid=84bb7a8f-1b00-0000-6dc7-12aceb0d0000 pid=3563 /usr/bin/chmod guuid=a3b90ca1-1a00-0000-6dc7-12ac370c0000 pid=3127->guuid=84bb7a8f-1b00-0000-6dc7-12aceb0d0000 pid=3563 execve guuid=0297fe8f-1b00-0000-6dc7-12acec0d0000 pid=3564 /usr/bin/dash guuid=a3b90ca1-1a00-0000-6dc7-12ac370c0000 pid=3127->guuid=0297fe8f-1b00-0000-6dc7-12acec0d0000 pid=3564 clone guuid=76b5d490-1b00-0000-6dc7-12acf20d0000 pid=3570 /usr/bin/rm delete-file guuid=a3b90ca1-1a00-0000-6dc7-12ac370c0000 pid=3127->guuid=76b5d490-1b00-0000-6dc7-12acf20d0000 pid=3570 execve guuid=215b7391-1b00-0000-6dc7-12acf50d0000 pid=3573 /usr/bin/wget net send-data write-file guuid=a3b90ca1-1a00-0000-6dc7-12ac370c0000 pid=3127->guuid=215b7391-1b00-0000-6dc7-12acf50d0000 pid=3573 execve guuid=3367879f-1b00-0000-6dc7-12ac0b0e0000 pid=3595 /usr/bin/chmod guuid=a3b90ca1-1a00-0000-6dc7-12ac370c0000 pid=3127->guuid=3367879f-1b00-0000-6dc7-12ac0b0e0000 pid=3595 execve guuid=08a8d29f-1b00-0000-6dc7-12ac0d0e0000 pid=3597 /usr/bin/dash guuid=a3b90ca1-1a00-0000-6dc7-12ac370c0000 pid=3127->guuid=08a8d29f-1b00-0000-6dc7-12ac0d0e0000 pid=3597 clone guuid=f6158ca0-1b00-0000-6dc7-12ac110e0000 pid=3601 /usr/bin/rm delete-file guuid=a3b90ca1-1a00-0000-6dc7-12ac370c0000 pid=3127->guuid=f6158ca0-1b00-0000-6dc7-12ac110e0000 pid=3601 execve guuid=d970f4a0-1b00-0000-6dc7-12ac130e0000 pid=3603 /usr/bin/wget net send-data write-file guuid=a3b90ca1-1a00-0000-6dc7-12ac370c0000 pid=3127->guuid=d970f4a0-1b00-0000-6dc7-12ac130e0000 pid=3603 execve guuid=3f6cdaad-1b00-0000-6dc7-12ac2a0e0000 pid=3626 /usr/bin/chmod guuid=a3b90ca1-1a00-0000-6dc7-12ac370c0000 pid=3127->guuid=3f6cdaad-1b00-0000-6dc7-12ac2a0e0000 pid=3626 execve guuid=a2e027ae-1b00-0000-6dc7-12ac2b0e0000 pid=3627 /usr/bin/dash guuid=a3b90ca1-1a00-0000-6dc7-12ac370c0000 pid=3127->guuid=a2e027ae-1b00-0000-6dc7-12ac2b0e0000 pid=3627 clone guuid=75da1daf-1b00-0000-6dc7-12ac300e0000 pid=3632 /usr/bin/rm delete-file guuid=a3b90ca1-1a00-0000-6dc7-12ac370c0000 pid=3127->guuid=75da1daf-1b00-0000-6dc7-12ac300e0000 pid=3632 execve guuid=2d8266af-1b00-0000-6dc7-12ac320e0000 pid=3634 /usr/bin/wget net send-data write-file guuid=a3b90ca1-1a00-0000-6dc7-12ac370c0000 pid=3127->guuid=2d8266af-1b00-0000-6dc7-12ac320e0000 pid=3634 execve guuid=ff10febe-1b00-0000-6dc7-12ac5a0e0000 pid=3674 /usr/bin/chmod guuid=a3b90ca1-1a00-0000-6dc7-12ac370c0000 pid=3127->guuid=ff10febe-1b00-0000-6dc7-12ac5a0e0000 pid=3674 execve guuid=c2a450bf-1b00-0000-6dc7-12ac5b0e0000 pid=3675 /usr/bin/dash guuid=a3b90ca1-1a00-0000-6dc7-12ac370c0000 pid=3127->guuid=c2a450bf-1b00-0000-6dc7-12ac5b0e0000 pid=3675 clone guuid=fb73cabf-1b00-0000-6dc7-12ac5f0e0000 pid=3679 /usr/bin/rm delete-file guuid=a3b90ca1-1a00-0000-6dc7-12ac370c0000 pid=3127->guuid=fb73cabf-1b00-0000-6dc7-12ac5f0e0000 pid=3679 execve guuid=10870cc0-1b00-0000-6dc7-12ac610e0000 pid=3681 /usr/bin/wget net send-data write-file guuid=a3b90ca1-1a00-0000-6dc7-12ac370c0000 pid=3127->guuid=10870cc0-1b00-0000-6dc7-12ac610e0000 pid=3681 execve guuid=add71fce-1b00-0000-6dc7-12ac890e0000 pid=3721 /usr/bin/chmod guuid=a3b90ca1-1a00-0000-6dc7-12ac370c0000 pid=3127->guuid=add71fce-1b00-0000-6dc7-12ac890e0000 pid=3721 execve guuid=2f586ece-1b00-0000-6dc7-12ac8b0e0000 pid=3723 /tmp/whisper.i686 net send-data guuid=a3b90ca1-1a00-0000-6dc7-12ac370c0000 pid=3127->guuid=2f586ece-1b00-0000-6dc7-12ac8b0e0000 pid=3723 execve 4466a7ec-d357-5dbd-9f7f-c7e61f48c387 31.170.22.205:80 guuid=d524c3a1-1a00-0000-6dc7-12ac3a0c0000 pid=3130->4466a7ec-d357-5dbd-9f7f-c7e61f48c387 send: 146B guuid=c2b164b4-1a00-0000-6dc7-12ac620c0000 pid=3170->4466a7ec-d357-5dbd-9f7f-c7e61f48c387 send: 146B guuid=4ca8aac2-1a00-0000-6dc7-12ac7b0c0000 pid=3195->4466a7ec-d357-5dbd-9f7f-c7e61f48c387 send: 146B guuid=b0ea33d0-1a00-0000-6dc7-12ac810c0000 pid=3201->4466a7ec-d357-5dbd-9f7f-c7e61f48c387 send: 148B guuid=948faddf-1a00-0000-6dc7-12aca10c0000 pid=3233->4466a7ec-d357-5dbd-9f7f-c7e61f48c387 send: 150B guuid=fd8d88f0-1a00-0000-6dc7-12acae0c0000 pid=3246->4466a7ec-d357-5dbd-9f7f-c7e61f48c387 send: 150B guuid=a3d34300-1b00-0000-6dc7-12acc80c0000 pid=3272->4466a7ec-d357-5dbd-9f7f-c7e61f48c387 send: 150B guuid=f3ea360e-1b00-0000-6dc7-12acdd0c0000 pid=3293->4466a7ec-d357-5dbd-9f7f-c7e61f48c387 send: 145B guuid=c4e09c20-1b00-0000-6dc7-12ac060d0000 pid=3334->4466a7ec-d357-5dbd-9f7f-c7e61f48c387 send: 147B guuid=a130b638-1b00-0000-6dc7-12ac330d0000 pid=3379->4466a7ec-d357-5dbd-9f7f-c7e61f48c387 send: 149B guuid=813ee44f-1b00-0000-6dc7-12ac5a0d0000 pid=3418->4466a7ec-d357-5dbd-9f7f-c7e61f48c387 send: 152B guuid=5990625f-1b00-0000-6dc7-12ac7b0d0000 pid=3451->4466a7ec-d357-5dbd-9f7f-c7e61f48c387 send: 150B guuid=f36bb96f-1b00-0000-6dc7-12aca80d0000 pid=3496->4466a7ec-d357-5dbd-9f7f-c7e61f48c387 send: 147B guuid=d22c9980-1b00-0000-6dc7-12acd40d0000 pid=3540->4466a7ec-d357-5dbd-9f7f-c7e61f48c387 send: 148B guuid=215b7391-1b00-0000-6dc7-12acf50d0000 pid=3573->4466a7ec-d357-5dbd-9f7f-c7e61f48c387 send: 148B guuid=d970f4a0-1b00-0000-6dc7-12ac130e0000 pid=3603->4466a7ec-d357-5dbd-9f7f-c7e61f48c387 send: 145B guuid=2d8266af-1b00-0000-6dc7-12ac320e0000 pid=3634->4466a7ec-d357-5dbd-9f7f-c7e61f48c387 send: 144B guuid=10870cc0-1b00-0000-6dc7-12ac610e0000 pid=3681->4466a7ec-d357-5dbd-9f7f-c7e61f48c387 send: 145B guuid=2f586ece-1b00-0000-6dc7-12ac8b0e0000 pid=3723->4466a7ec-d357-5dbd-9f7f-c7e61f48c387 send: 141B
Score:
98%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/3edcc282706f25748cb78b59ee6e3e460cd96d054522e7fbd573742fc397b14a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3edcc282706f25748cb78b59ee6e3e460cd96d054522e7fbd573742fc397b14a/
Threat name:
Script-Shell.Trojan.Vigorf
Create hunting rule
Status:
Malicious
First seen:
2025-07-21 01:24:00 UTC
File Type:
Text (Shell)
AV detection:
10 of 23 (43.48%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=h3omfatqn4sxjdfxrnm643r6iygns3ifiurop66von2c7q4xwffa._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/3edcc282706f25748cb78b59ee6e3e460cd96d054522e7fbd573742fc397b14a

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

DDoSAgent

sh 3edcc282706f25748cb78b59ee6e3e460cd96d054522e7fbd573742fc397b14a

(this sample)

DDoSAgent

elf 55d6cc5c314be3c2c988a797eeed584c7844549513e5eb9106a3a266f5c9c527

  
URLhaus
https://urlhaus.abuse.ch/url/3532985/
  
Delivery method
Distributed via web download
  
Dropping
MD5 2f4c13a8e22bcca551ce49a5b20245af
  
Dropping
SHA256 55d6cc5c314be3c2c988a797eeed584c7844549513e5eb9106a3a266f5c9c527

Comments