MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4765acca1071e7348c662ae2bcb1fe8342ae3f7ebbaf2338ef802e99ea523a09. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4765acca1071e7348c662ae2bcb1fe8342ae3f7ebbaf2338ef802e99ea523a09
SHA3-384 hash: 699d185dd712d17d49db0c12a09305486ba78ff6ba1e410af85d25d4211c284844a0d632a21b8b3475cfc3f1ce0be2b3
SHA1 hash: 3fd91c7ae4b704c6873a9d5e44bd3cf0814ad39c
MD5 hash: 95fc2298cdf9dc22a4511717518ed90a
humanhash: winner-gee-ohio-georgia
File name:k.php
Download: download sample
File size:19'499 bytes
First seen:2026-03-26 09:00:59 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 384:EFcuQpWx+BL0SWL0g3zsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:EF8i+BL0SI08zsP4cbddr7zsP4cbddrk
TLSH T11D925DB512896C79FBD1CE399F3C7F4CADE882C42124A3ACBA4F39215A1166DC70535D
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh

Intelligence

File Origin
# of uploads :
1
# of downloads :
50
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.MulDrop.187.22985.28812.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive masquerade
Link:
https://www.filescan.io/uploads/69c4f5e400ad363694060e61/reports/7597ec94-2587-48ed-9dd0-51c25c9b6177/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-03-26T06:06:00Z UTC
Last seen:
2026-03-26T06:27:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan-Downloader.Shell.Agent.bc
Link:
https://opentip.kaspersky.com/4765acca1071e7348c662ae2bcb1fe8342ae3f7ebbaf2338ef802e99ea523a09/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/ad6ec65f-ca14-4f88-962b-c25815d6846b
Behavior Graph:
Download SVG
%3 guuid=18ff1dd7-1900-0000-49a5-33475a080000 pid=2138 /usr/bin/sudo guuid=eb4316da-1900-0000-49a5-334764080000 pid=2148 /tmp/sample.bin guuid=18ff1dd7-1900-0000-49a5-33475a080000 pid=2138->guuid=eb4316da-1900-0000-49a5-334764080000 pid=2148 execve guuid=cbc588da-1900-0000-49a5-334767080000 pid=2151 /usr/bin/bash guuid=eb4316da-1900-0000-49a5-334764080000 pid=2148->guuid=cbc588da-1900-0000-49a5-334767080000 pid=2151 clone guuid=6e5b90da-1900-0000-49a5-334768080000 pid=2152 /usr/bin/bash guuid=eb4316da-1900-0000-49a5-334764080000 pid=2148->guuid=6e5b90da-1900-0000-49a5-334768080000 pid=2152 clone guuid=8ee8a7da-1900-0000-49a5-334769080000 pid=2153 /usr/bin/mkdir guuid=eb4316da-1900-0000-49a5-334764080000 pid=2148->guuid=8ee8a7da-1900-0000-49a5-334769080000 pid=2153 execve guuid=63f12cdb-1900-0000-49a5-33476c080000 pid=2156 /usr/bin/mkdir guuid=eb4316da-1900-0000-49a5-334764080000 pid=2148->guuid=63f12cdb-1900-0000-49a5-33476c080000 pid=2156 execve guuid=340ab4db-1900-0000-49a5-33476f080000 pid=2159 /usr/bin/mkdir guuid=eb4316da-1900-0000-49a5-334764080000 pid=2148->guuid=340ab4db-1900-0000-49a5-33476f080000 pid=2159 execve guuid=420d17dc-1900-0000-49a5-334772080000 pid=2162 /usr/bin/mkdir guuid=eb4316da-1900-0000-49a5-334764080000 pid=2148->guuid=420d17dc-1900-0000-49a5-334772080000 pid=2162 execve guuid=2ff57edc-1900-0000-49a5-334774080000 pid=2164 /usr/bin/mkdir guuid=eb4316da-1900-0000-49a5-334764080000 pid=2148->guuid=2ff57edc-1900-0000-49a5-334774080000 pid=2164 execve guuid=d27adbdc-1900-0000-49a5-334775080000 pid=2165 /usr/bin/mkdir guuid=eb4316da-1900-0000-49a5-334764080000 pid=2148->guuid=d27adbdc-1900-0000-49a5-334775080000 pid=2165 execve guuid=c01774dd-1900-0000-49a5-334778080000 pid=2168 /usr/bin/mkdir guuid=eb4316da-1900-0000-49a5-334764080000 pid=2148->guuid=c01774dd-1900-0000-49a5-334778080000 pid=2168 execve guuid=eab6e9dd-1900-0000-49a5-33477b080000 pid=2171 /usr/bin/cp guuid=eb4316da-1900-0000-49a5-334764080000 pid=2148->guuid=eab6e9dd-1900-0000-49a5-33477b080000 pid=2171 execve guuid=e96b73de-1900-0000-49a5-33477d080000 pid=2173 /usr/bin/cp guuid=eb4316da-1900-0000-49a5-334764080000 pid=2148->guuid=e96b73de-1900-0000-49a5-33477d080000 pid=2173 execve guuid=98d8f8de-1900-0000-49a5-33477f080000 pid=2175 /usr/bin/cp guuid=eb4316da-1900-0000-49a5-334764080000 pid=2148->guuid=98d8f8de-1900-0000-49a5-33477f080000 pid=2175 execve guuid=2d0385df-1900-0000-49a5-334782080000 pid=2178 /usr/bin/cp guuid=eb4316da-1900-0000-49a5-334764080000 pid=2148->guuid=2d0385df-1900-0000-49a5-334782080000 pid=2178 execve guuid=5186eddf-1900-0000-49a5-334784080000 pid=2180 /usr/bin/cp guuid=eb4316da-1900-0000-49a5-334764080000 pid=2148->guuid=5186eddf-1900-0000-49a5-334784080000 pid=2180 execve guuid=702d5de0-1900-0000-49a5-334786080000 pid=2182 /usr/bin/cp guuid=eb4316da-1900-0000-49a5-334764080000 pid=2148->guuid=702d5de0-1900-0000-49a5-334786080000 pid=2182 execve guuid=558febe0-1900-0000-49a5-334789080000 pid=2185 /usr/bin/cp guuid=eb4316da-1900-0000-49a5-334764080000 pid=2148->guuid=558febe0-1900-0000-49a5-334789080000 pid=2185 execve guuid=33e46ce1-1900-0000-49a5-33478b080000 pid=2187 /usr/bin/cp guuid=eb4316da-1900-0000-49a5-334764080000 pid=2148->guuid=33e46ce1-1900-0000-49a5-33478b080000 pid=2187 execve guuid=54d0e8e1-1900-0000-49a5-33478e080000 pid=2190 /usr/bin/cp guuid=eb4316da-1900-0000-49a5-334764080000 pid=2148->guuid=54d0e8e1-1900-0000-49a5-33478e080000 pid=2190 execve guuid=b15465e2-1900-0000-49a5-334790080000 pid=2192 /usr/bin/cp guuid=eb4316da-1900-0000-49a5-334764080000 pid=2148->guuid=b15465e2-1900-0000-49a5-334790080000 pid=2192 execve guuid=c572c4e2-1900-0000-49a5-334792080000 pid=2194 /usr/bin/cp guuid=eb4316da-1900-0000-49a5-334764080000 pid=2148->guuid=c572c4e2-1900-0000-49a5-334792080000 pid=2194 execve guuid=1f5035e3-1900-0000-49a5-334794080000 pid=2196 /usr/bin/cp guuid=eb4316da-1900-0000-49a5-334764080000 pid=2148->guuid=1f5035e3-1900-0000-49a5-334794080000 pid=2196 execve guuid=5c75d4e3-1900-0000-49a5-334797080000 pid=2199 /usr/bin/cp guuid=eb4316da-1900-0000-49a5-334764080000 pid=2148->guuid=5c75d4e3-1900-0000-49a5-334797080000 pid=2199 execve guuid=9ae046e4-1900-0000-49a5-334799080000 pid=2201 /usr/bin/cp guuid=eb4316da-1900-0000-49a5-334764080000 pid=2148->guuid=9ae046e4-1900-0000-49a5-334799080000 pid=2201 execve guuid=ef04a1e4-1900-0000-49a5-33479b080000 pid=2203 /usr/bin/cp guuid=eb4316da-1900-0000-49a5-334764080000 pid=2148->guuid=ef04a1e4-1900-0000-49a5-33479b080000 pid=2203 execve guuid=0b1a1ce5-1900-0000-49a5-33479d080000 pid=2205 /usr/bin/touch guuid=eb4316da-1900-0000-49a5-334764080000 pid=2148->guuid=0b1a1ce5-1900-0000-49a5-33479d080000 pid=2205 execve guuid=2b4862e5-1900-0000-49a5-33479f080000 pid=2207 /usr/bin/bash guuid=eb4316da-1900-0000-49a5-334764080000 pid=2148->guuid=2b4862e5-1900-0000-49a5-33479f080000 pid=2207 clone guuid=b6b56ae5-1900-0000-49a5-3347a0080000 pid=2208 /usr/bin/bash guuid=eb4316da-1900-0000-49a5-334764080000 pid=2148->guuid=b6b56ae5-1900-0000-49a5-3347a0080000 pid=2208 clone guuid=62808ce5-1900-0000-49a5-3347a1080000 pid=2209 /usr/bin/bash guuid=eb4316da-1900-0000-49a5-334764080000 pid=2148->guuid=62808ce5-1900-0000-49a5-3347a1080000 pid=2209 clone guuid=b3ae94e5-1900-0000-49a5-3347a2080000 pid=2210 /usr/bin/base64 write-file guuid=eb4316da-1900-0000-49a5-334764080000 pid=2148->guuid=b3ae94e5-1900-0000-49a5-3347a2080000 pid=2210 execve guuid=09c31fe6-1900-0000-49a5-3347a5080000 pid=2213 /usr/bin/bash guuid=eb4316da-1900-0000-49a5-334764080000 pid=2148->guuid=09c31fe6-1900-0000-49a5-3347a5080000 pid=2213 execve guuid=e2410aed-1900-0000-49a5-3347ca080000 pid=2250 /usr/bin/rm delete-file guuid=eb4316da-1900-0000-49a5-334764080000 pid=2148->guuid=e2410aed-1900-0000-49a5-3347ca080000 pid=2250 execve guuid=721f8aed-1900-0000-49a5-3347cd080000 pid=2253 /usr/bin/bash guuid=eb4316da-1900-0000-49a5-334764080000 pid=2148->guuid=721f8aed-1900-0000-49a5-3347cd080000 pid=2253 clone guuid=a08a99ed-1900-0000-49a5-3347ce080000 pid=2254 /usr/bin/bash guuid=eb4316da-1900-0000-49a5-334764080000 pid=2148->guuid=a08a99ed-1900-0000-49a5-3347ce080000 pid=2254 clone guuid=ed9dc4ed-1900-0000-49a5-3347cf080000 pid=2255 /usr/bin/bash guuid=eb4316da-1900-0000-49a5-334764080000 pid=2148->guuid=ed9dc4ed-1900-0000-49a5-3347cf080000 pid=2255 execve guuid=4aee3fee-1900-0000-49a5-3347d2080000 pid=2258 /usr/bin/rm guuid=eb4316da-1900-0000-49a5-334764080000 pid=2148->guuid=4aee3fee-1900-0000-49a5-3347d2080000 pid=2258 execve guuid=99a97ce6-1900-0000-49a5-3347a7080000 pid=2215 /usr/bin/bash guuid=09c31fe6-1900-0000-49a5-3347a5080000 pid=2213->guuid=99a97ce6-1900-0000-49a5-3347a7080000 pid=2215 clone guuid=0c1682e6-1900-0000-49a5-3347a8080000 pid=2216 /usr/bin/bash guuid=09c31fe6-1900-0000-49a5-3347a5080000 pid=2213->guuid=0c1682e6-1900-0000-49a5-3347a8080000 pid=2216 clone guuid=7484a0e6-1900-0000-49a5-3347aa080000 pid=2218 /usr/bin/ls guuid=09c31fe6-1900-0000-49a5-3347a5080000 pid=2213->guuid=7484a0e6-1900-0000-49a5-3347aa080000 pid=2218 execve guuid=963221e7-1900-0000-49a5-3347ac080000 pid=2220 /usr/bin/cat guuid=09c31fe6-1900-0000-49a5-3347a5080000 pid=2213->guuid=963221e7-1900-0000-49a5-3347ac080000 pid=2220 execve guuid=7d8894e7-1900-0000-49a5-3347ae080000 pid=2222 /usr/bin/ls guuid=09c31fe6-1900-0000-49a5-3347a5080000 pid=2213->guuid=7d8894e7-1900-0000-49a5-3347ae080000 pid=2222 execve guuid=cadc2ee8-1900-0000-49a5-3347b0080000 pid=2224 /usr/bin/mkdir guuid=09c31fe6-1900-0000-49a5-3347a5080000 pid=2213->guuid=cadc2ee8-1900-0000-49a5-3347b0080000 pid=2224 execve guuid=67fc97e8-1900-0000-49a5-3347b2080000 pid=2226 /usr/bin/mv guuid=09c31fe6-1900-0000-49a5-3347a5080000 pid=2213->guuid=67fc97e8-1900-0000-49a5-3347b2080000 pid=2226 execve guuid=3f6d11e9-1900-0000-49a5-3347b5080000 pid=2229 /usr/bin/bash guuid=09c31fe6-1900-0000-49a5-3347a5080000 pid=2213->guuid=3f6d11e9-1900-0000-49a5-3347b5080000 pid=2229 clone guuid=ceee1ae9-1900-0000-49a5-3347b6080000 pid=2230 /usr/bin/base64 write-file guuid=09c31fe6-1900-0000-49a5-3347a5080000 pid=2213->guuid=ceee1ae9-1900-0000-49a5-3347b6080000 pid=2230 execve guuid=cbc784e9-1900-0000-49a5-3347b8080000 pid=2232 /usr/bin/rm delete-file guuid=09c31fe6-1900-0000-49a5-3347a5080000 pid=2213->guuid=cbc784e9-1900-0000-49a5-3347b8080000 pid=2232 execve guuid=8143f2e9-1900-0000-49a5-3347ba080000 pid=2234 /usr/bin/ls guuid=09c31fe6-1900-0000-49a5-3347a5080000 pid=2213->guuid=8143f2e9-1900-0000-49a5-3347ba080000 pid=2234 execve guuid=9d1fa8ea-1900-0000-49a5-3347be080000 pid=2238 /usr/bin/bash guuid=09c31fe6-1900-0000-49a5-3347a5080000 pid=2213->guuid=9d1fa8ea-1900-0000-49a5-3347be080000 pid=2238 clone guuid=a11ab2ea-1900-0000-49a5-3347bf080000 pid=2239 /usr/bin/base64 write-file guuid=09c31fe6-1900-0000-49a5-3347a5080000 pid=2213->guuid=a11ab2ea-1900-0000-49a5-3347bf080000 pid=2239 execve guuid=23f23aeb-1900-0000-49a5-3347c2080000 pid=2242 /usr/bin/ls guuid=09c31fe6-1900-0000-49a5-3347a5080000 pid=2213->guuid=23f23aeb-1900-0000-49a5-3347c2080000 pid=2242 execve guuid=1ee2d7eb-1900-0000-49a5-3347c5080000 pid=2245 /usr/bin/cat guuid=09c31fe6-1900-0000-49a5-3347a5080000 pid=2213->guuid=1ee2d7eb-1900-0000-49a5-3347c5080000 pid=2245 execve guuid=380860ec-1900-0000-49a5-3347c8080000 pid=2248 /usr/bin/ls guuid=09c31fe6-1900-0000-49a5-3347a5080000 pid=2213->guuid=380860ec-1900-0000-49a5-3347c8080000 pid=2248 execve
Score:
80%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/4765acca1071e7348c662ae2bcb1fe8342ae3f7ebbaf2338ef802e99ea523a09
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4765acca1071e7348c662ae2bcb1fe8342ae3f7ebbaf2338ef802e99ea523a09/
Verdict:
Malicious
Threat:
Trojan-Downloader.Shell.Agent
Link:
https://tip.neiki.dev/file/4765acca1071e7348c662ae2bcb1fe8342ae3f7ebbaf2338ef802e99ea523a09
Threat name:
Script-Shell.Trojan.Vigorf
Create hunting rule
Status:
Malicious
First seen:
2026-03-26 09:01:29 UTC
File Type:
Text (Shell)
AV detection:
13 of 24 (54.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=i5s2zsqqohttjddgflrlzmp6qnbk4p36xoxsgohpqaxjt2sshieq._file
Result
Malware family:
n/a
Score:
  4/10
Tags:
defense_evasion discovery linux
Link:
https://tria.ge/reports/260326-ky38daev6w/
Behaviour
Reads runtime system information
Writes file to tmp directory
Deobfuscate/Decode Files or Information
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/4765acca1071e7348c662ae2bcb1fe8342ae3f7ebbaf2338ef802e99ea523a09

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SUSP_LNX_Base64_Exec_Apr24
Create hunting rule
Author:Christian Burkard
Description:Detects suspicious base64 encoded shell commands (as seen in Palo Alto CVE-2024-3400 exploitation)
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 4765acca1071e7348c662ae2bcb1fe8342ae3f7ebbaf2338ef802e99ea523a09

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3792476/
  
Delivery method
Distributed via web download

Comments