MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4cfbd57289d0d26ce9be0a5c60d1b697e202bf7111d274740112b1edfce25a4d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4cfbd57289d0d26ce9be0a5c60d1b697e202bf7111d274740112b1edfce25a4d
SHA3-384 hash: 1237567dbb3f0877945fb7c949c5fb5e4b20f47d306c1080b2858d507a977530c0a353441e9787649ada80b0379d757a
SHA1 hash: 961acc931f927f1f197baacf7beb503731c7a9fc
MD5 hash: 11741e4adafd94a45981e4719e6705f9
humanhash: winter-monkey-victor-fish
File name:p
Download: download sample
File size:826 bytes
First seen:2026-06-05 08:42:41 UTC
Last seen:2026-06-06 03:58:52 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkauIEFSI4Una9IPFrI9HnSIabpuauD:kXCKysE2hi0ziQvZohauSpwjpbA7
TLSH T16D016FD98116E7504189E89E22D751907420C3CB65454BB87F9C443DEBB97487169FA8
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://188.132.232.81/9hFn/an/aelf ua-wget
http://188.132.232.81/Bqjn/an/aelf ua-wget
http://188.132.232.81/4qGxn/an/aelf ua-wget
http://188.132.232.81/9eBn/an/aelf ua-wget
http://188.132.232.81/dPOn/an/aelf ua-wget

Intelligence

File Origin
# of uploads :
2
# of downloads :
53
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive
Link:
https://www.filescan.io/uploads/6a228c2212da0d249c65f231/reports/56092b52-58b4-478b-9fb6-e165a034e72f/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-06-05T05:49:00Z UTC
Last seen:
2026-06-05T08:48:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan-Downloader.Shell.Agent.a
Link:
https://opentip.kaspersky.com/4cfbd57289d0d26ce9be0a5c60d1b697e202bf7111d274740112b1edfce25a4d/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/c8835a77-782f-4575-9f0f-c43752761bbe
Behavior Graph:
Download SVG
%3 guuid=137e3e21-1700-0000-1d87-657d450e0000 pid=3653 /usr/bin/sudo guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660 /tmp/sample.bin write-file guuid=137e3e21-1700-0000-1d87-657d450e0000 pid=3653->guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660 execve guuid=74aa1623-1700-0000-1d87-657d4d0e0000 pid=3661 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=74aa1623-1700-0000-1d87-657d4d0e0000 pid=3661 execve guuid=a5eb7523-1700-0000-1d87-657d510e0000 pid=3665 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=a5eb7523-1700-0000-1d87-657d510e0000 pid=3665 execve guuid=40ace323-1700-0000-1d87-657d540e0000 pid=3668 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=40ace323-1700-0000-1d87-657d540e0000 pid=3668 execve guuid=468e5124-1700-0000-1d87-657d560e0000 pid=3670 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=468e5124-1700-0000-1d87-657d560e0000 pid=3670 execve guuid=908bb024-1700-0000-1d87-657d590e0000 pid=3673 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=908bb024-1700-0000-1d87-657d590e0000 pid=3673 execve guuid=263b0c25-1700-0000-1d87-657d5b0e0000 pid=3675 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=263b0c25-1700-0000-1d87-657d5b0e0000 pid=3675 execve guuid=b1d26925-1700-0000-1d87-657d5d0e0000 pid=3677 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=b1d26925-1700-0000-1d87-657d5d0e0000 pid=3677 execve guuid=a7bebf25-1700-0000-1d87-657d600e0000 pid=3680 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=a7bebf25-1700-0000-1d87-657d600e0000 pid=3680 execve guuid=0ef21626-1700-0000-1d87-657d640e0000 pid=3684 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=0ef21626-1700-0000-1d87-657d640e0000 pid=3684 execve guuid=82b37826-1700-0000-1d87-657d670e0000 pid=3687 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=82b37826-1700-0000-1d87-657d670e0000 pid=3687 execve guuid=721dcf26-1700-0000-1d87-657d690e0000 pid=3689 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=721dcf26-1700-0000-1d87-657d690e0000 pid=3689 execve guuid=5d402527-1700-0000-1d87-657d6b0e0000 pid=3691 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=5d402527-1700-0000-1d87-657d6b0e0000 pid=3691 execve guuid=bf907d27-1700-0000-1d87-657d6e0e0000 pid=3694 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=bf907d27-1700-0000-1d87-657d6e0e0000 pid=3694 execve guuid=6463d727-1700-0000-1d87-657d700e0000 pid=3696 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=6463d727-1700-0000-1d87-657d700e0000 pid=3696 execve guuid=17d22d28-1700-0000-1d87-657d720e0000 pid=3698 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=17d22d28-1700-0000-1d87-657d720e0000 pid=3698 execve guuid=7d089428-1700-0000-1d87-657d750e0000 pid=3701 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=7d089428-1700-0000-1d87-657d750e0000 pid=3701 execve guuid=4825f328-1700-0000-1d87-657d770e0000 pid=3703 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=4825f328-1700-0000-1d87-657d770e0000 pid=3703 execve guuid=62f04e29-1700-0000-1d87-657d7a0e0000 pid=3706 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=62f04e29-1700-0000-1d87-657d7a0e0000 pid=3706 execve guuid=a37bb529-1700-0000-1d87-657d7c0e0000 pid=3708 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=a37bb529-1700-0000-1d87-657d7c0e0000 pid=3708 execve guuid=5456142a-1700-0000-1d87-657d800e0000 pid=3712 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=5456142a-1700-0000-1d87-657d800e0000 pid=3712 execve guuid=da117a2a-1700-0000-1d87-657d830e0000 pid=3715 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=da117a2a-1700-0000-1d87-657d830e0000 pid=3715 execve guuid=9d35d62a-1700-0000-1d87-657d860e0000 pid=3718 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=9d35d62a-1700-0000-1d87-657d860e0000 pid=3718 execve guuid=d819352b-1700-0000-1d87-657d890e0000 pid=3721 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=d819352b-1700-0000-1d87-657d890e0000 pid=3721 execve guuid=3ad2912b-1700-0000-1d87-657d8d0e0000 pid=3725 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=3ad2912b-1700-0000-1d87-657d8d0e0000 pid=3725 execve guuid=7b57f42b-1700-0000-1d87-657d910e0000 pid=3729 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=7b57f42b-1700-0000-1d87-657d910e0000 pid=3729 execve guuid=24ab532c-1700-0000-1d87-657d930e0000 pid=3731 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=24ab532c-1700-0000-1d87-657d930e0000 pid=3731 execve guuid=7741b72c-1700-0000-1d87-657d950e0000 pid=3733 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=7741b72c-1700-0000-1d87-657d950e0000 pid=3733 execve guuid=32d0142d-1700-0000-1d87-657d990e0000 pid=3737 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=32d0142d-1700-0000-1d87-657d990e0000 pid=3737 execve guuid=e0937a2d-1700-0000-1d87-657d9d0e0000 pid=3741 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=e0937a2d-1700-0000-1d87-657d9d0e0000 pid=3741 execve guuid=2fb6ed2d-1700-0000-1d87-657d9e0e0000 pid=3742 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=2fb6ed2d-1700-0000-1d87-657d9e0e0000 pid=3742 execve guuid=34b04b2e-1700-0000-1d87-657d9f0e0000 pid=3743 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=34b04b2e-1700-0000-1d87-657d9f0e0000 pid=3743 execve guuid=86c1ae2e-1700-0000-1d87-657da00e0000 pid=3744 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=86c1ae2e-1700-0000-1d87-657da00e0000 pid=3744 execve guuid=9f37072f-1700-0000-1d87-657da10e0000 pid=3745 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=9f37072f-1700-0000-1d87-657da10e0000 pid=3745 execve guuid=498a772f-1700-0000-1d87-657da20e0000 pid=3746 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=498a772f-1700-0000-1d87-657da20e0000 pid=3746 execve guuid=01f0e32f-1700-0000-1d87-657da30e0000 pid=3747 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=01f0e32f-1700-0000-1d87-657da30e0000 pid=3747 execve guuid=39e64d30-1700-0000-1d87-657da40e0000 pid=3748 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=39e64d30-1700-0000-1d87-657da40e0000 pid=3748 execve guuid=fa34c230-1700-0000-1d87-657da50e0000 pid=3749 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=fa34c230-1700-0000-1d87-657da50e0000 pid=3749 execve guuid=e5964331-1700-0000-1d87-657da60e0000 pid=3750 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=e5964331-1700-0000-1d87-657da60e0000 pid=3750 execve guuid=07f6c431-1700-0000-1d87-657da70e0000 pid=3751 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=07f6c431-1700-0000-1d87-657da70e0000 pid=3751 execve guuid=52694032-1700-0000-1d87-657da80e0000 pid=3752 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=52694032-1700-0000-1d87-657da80e0000 pid=3752 execve guuid=80decf32-1700-0000-1d87-657da90e0000 pid=3753 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=80decf32-1700-0000-1d87-657da90e0000 pid=3753 execve guuid=16595533-1700-0000-1d87-657daa0e0000 pid=3754 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=16595533-1700-0000-1d87-657daa0e0000 pid=3754 execve guuid=bb3aeb33-1700-0000-1d87-657dab0e0000 pid=3755 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=bb3aeb33-1700-0000-1d87-657dab0e0000 pid=3755 execve guuid=9c4b8734-1700-0000-1d87-657dac0e0000 pid=3756 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=9c4b8734-1700-0000-1d87-657dac0e0000 pid=3756 execve guuid=0abc6835-1700-0000-1d87-657db20e0000 pid=3762 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=0abc6835-1700-0000-1d87-657db20e0000 pid=3762 execve guuid=6ea2c435-1700-0000-1d87-657db30e0000 pid=3763 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=6ea2c435-1700-0000-1d87-657db30e0000 pid=3763 execve guuid=17a32936-1700-0000-1d87-657db70e0000 pid=3767 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=17a32936-1700-0000-1d87-657db70e0000 pid=3767 execve guuid=23e09236-1700-0000-1d87-657db90e0000 pid=3769 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=23e09236-1700-0000-1d87-657db90e0000 pid=3769 execve guuid=ad24ef36-1700-0000-1d87-657dbb0e0000 pid=3771 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=ad24ef36-1700-0000-1d87-657dbb0e0000 pid=3771 execve guuid=12385237-1700-0000-1d87-657dbf0e0000 pid=3775 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=12385237-1700-0000-1d87-657dbf0e0000 pid=3775 execve guuid=3100bb37-1700-0000-1d87-657dc30e0000 pid=3779 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=3100bb37-1700-0000-1d87-657dc30e0000 pid=3779 execve guuid=d1131838-1700-0000-1d87-657dc50e0000 pid=3781 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=d1131838-1700-0000-1d87-657dc50e0000 pid=3781 execve guuid=febb6d38-1700-0000-1d87-657dc70e0000 pid=3783 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=febb6d38-1700-0000-1d87-657dc70e0000 pid=3783 execve guuid=882fc938-1700-0000-1d87-657dcb0e0000 pid=3787 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=882fc938-1700-0000-1d87-657dcb0e0000 pid=3787 execve guuid=2c651639-1700-0000-1d87-657dcf0e0000 pid=3791 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=2c651639-1700-0000-1d87-657dcf0e0000 pid=3791 execve guuid=58866539-1700-0000-1d87-657dd10e0000 pid=3793 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=58866539-1700-0000-1d87-657dd10e0000 pid=3793 execve guuid=c043c339-1700-0000-1d87-657dd30e0000 pid=3795 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=c043c339-1700-0000-1d87-657dd30e0000 pid=3795 execve guuid=1345193a-1700-0000-1d87-657dd50e0000 pid=3797 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=1345193a-1700-0000-1d87-657dd50e0000 pid=3797 execve guuid=d5247b3a-1700-0000-1d87-657dd70e0000 pid=3799 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=d5247b3a-1700-0000-1d87-657dd70e0000 pid=3799 execve guuid=cbe6f13a-1700-0000-1d87-657dd90e0000 pid=3801 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=cbe6f13a-1700-0000-1d87-657dd90e0000 pid=3801 execve guuid=18ea4e3b-1700-0000-1d87-657ddb0e0000 pid=3803 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=18ea4e3b-1700-0000-1d87-657ddb0e0000 pid=3803 execve guuid=78c3ad3b-1700-0000-1d87-657ddd0e0000 pid=3805 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=78c3ad3b-1700-0000-1d87-657ddd0e0000 pid=3805 execve guuid=fb1e0e3c-1700-0000-1d87-657ddf0e0000 pid=3807 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=fb1e0e3c-1700-0000-1d87-657ddf0e0000 pid=3807 execve guuid=5f676f3c-1700-0000-1d87-657de10e0000 pid=3809 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=5f676f3c-1700-0000-1d87-657de10e0000 pid=3809 execve guuid=9c0bed3c-1700-0000-1d87-657de40e0000 pid=3812 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=9c0bed3c-1700-0000-1d87-657de40e0000 pid=3812 execve guuid=9914403d-1700-0000-1d87-657de70e0000 pid=3815 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=9914403d-1700-0000-1d87-657de70e0000 pid=3815 execve guuid=1fe6963d-1700-0000-1d87-657de90e0000 pid=3817 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=1fe6963d-1700-0000-1d87-657de90e0000 pid=3817 execve guuid=0f8aee3d-1700-0000-1d87-657deb0e0000 pid=3819 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=0f8aee3d-1700-0000-1d87-657deb0e0000 pid=3819 execve guuid=2f824c3e-1700-0000-1d87-657dee0e0000 pid=3822 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=2f824c3e-1700-0000-1d87-657dee0e0000 pid=3822 execve guuid=23fea53e-1700-0000-1d87-657df00e0000 pid=3824 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=23fea53e-1700-0000-1d87-657df00e0000 pid=3824 execve guuid=05bf023f-1700-0000-1d87-657df20e0000 pid=3826 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=05bf023f-1700-0000-1d87-657df20e0000 pid=3826 execve guuid=aafe5c3f-1700-0000-1d87-657df40e0000 pid=3828 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=aafe5c3f-1700-0000-1d87-657df40e0000 pid=3828 execve guuid=0590b83f-1700-0000-1d87-657df70e0000 pid=3831 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=0590b83f-1700-0000-1d87-657df70e0000 pid=3831 execve guuid=ce941940-1700-0000-1d87-657df90e0000 pid=3833 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=ce941940-1700-0000-1d87-657df90e0000 pid=3833 execve guuid=057f7340-1700-0000-1d87-657dfc0e0000 pid=3836 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=057f7340-1700-0000-1d87-657dfc0e0000 pid=3836 execve guuid=d1a9ca40-1700-0000-1d87-657dfe0e0000 pid=3838 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=d1a9ca40-1700-0000-1d87-657dfe0e0000 pid=3838 execve guuid=33f12b41-1700-0000-1d87-657d030f0000 pid=3843 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=33f12b41-1700-0000-1d87-657d030f0000 pid=3843 execve guuid=ab848441-1700-0000-1d87-657d050f0000 pid=3845 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=ab848441-1700-0000-1d87-657d050f0000 pid=3845 execve guuid=2d88e441-1700-0000-1d87-657d090f0000 pid=3849 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=2d88e441-1700-0000-1d87-657d090f0000 pid=3849 execve guuid=e4813942-1700-0000-1d87-657d0c0f0000 pid=3852 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=e4813942-1700-0000-1d87-657d0c0f0000 pid=3852 execve guuid=608f9b42-1700-0000-1d87-657d100f0000 pid=3856 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=608f9b42-1700-0000-1d87-657d100f0000 pid=3856 execve guuid=559e0a43-1700-0000-1d87-657d130f0000 pid=3859 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=559e0a43-1700-0000-1d87-657d130f0000 pid=3859 execve guuid=6d707043-1700-0000-1d87-657d160f0000 pid=3862 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=6d707043-1700-0000-1d87-657d160f0000 pid=3862 execve guuid=228cd243-1700-0000-1d87-657d190f0000 pid=3865 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=228cd243-1700-0000-1d87-657d190f0000 pid=3865 execve guuid=d4e13844-1700-0000-1d87-657d1c0f0000 pid=3868 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=d4e13844-1700-0000-1d87-657d1c0f0000 pid=3868 execve guuid=27809244-1700-0000-1d87-657d200f0000 pid=3872 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=27809244-1700-0000-1d87-657d200f0000 pid=3872 execve guuid=4e37f744-1700-0000-1d87-657d240f0000 pid=3876 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=4e37f744-1700-0000-1d87-657d240f0000 pid=3876 execve guuid=5daa5245-1700-0000-1d87-657d270f0000 pid=3879 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=5daa5245-1700-0000-1d87-657d270f0000 pid=3879 execve guuid=4b5db845-1700-0000-1d87-657d2c0f0000 pid=3884 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=4b5db845-1700-0000-1d87-657d2c0f0000 pid=3884 execve guuid=d34f1946-1700-0000-1d87-657d2f0f0000 pid=3887 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=d34f1946-1700-0000-1d87-657d2f0f0000 pid=3887 execve guuid=a2727246-1700-0000-1d87-657d320f0000 pid=3890 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=a2727246-1700-0000-1d87-657d320f0000 pid=3890 execve guuid=33f3c946-1700-0000-1d87-657d360f0000 pid=3894 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=33f3c946-1700-0000-1d87-657d360f0000 pid=3894 execve guuid=9bd12447-1700-0000-1d87-657d3a0f0000 pid=3898 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=9bd12447-1700-0000-1d87-657d3a0f0000 pid=3898 execve guuid=38978147-1700-0000-1d87-657d3c0f0000 pid=3900 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=38978147-1700-0000-1d87-657d3c0f0000 pid=3900 execve guuid=ad5ae547-1700-0000-1d87-657d430f0000 pid=3907 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=ad5ae547-1700-0000-1d87-657d430f0000 pid=3907 execve guuid=838d4148-1700-0000-1d87-657d450f0000 pid=3909 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=838d4148-1700-0000-1d87-657d450f0000 pid=3909 execve guuid=fb0aa148-1700-0000-1d87-657d460f0000 pid=3910 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=fb0aa148-1700-0000-1d87-657d460f0000 pid=3910 execve guuid=a8cf0e49-1700-0000-1d87-657d490f0000 pid=3913 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=a8cf0e49-1700-0000-1d87-657d490f0000 pid=3913 execve guuid=32f67649-1700-0000-1d87-657d4b0f0000 pid=3915 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=32f67649-1700-0000-1d87-657d4b0f0000 pid=3915 execve guuid=09e7df49-1700-0000-1d87-657d4e0f0000 pid=3918 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=09e7df49-1700-0000-1d87-657d4e0f0000 pid=3918 execve guuid=2adf434a-1700-0000-1d87-657d500f0000 pid=3920 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=2adf434a-1700-0000-1d87-657d500f0000 pid=3920 execve guuid=e453b04a-1700-0000-1d87-657d530f0000 pid=3923 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=e453b04a-1700-0000-1d87-657d530f0000 pid=3923 execve guuid=a8eb124b-1700-0000-1d87-657d550f0000 pid=3925 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=a8eb124b-1700-0000-1d87-657d550f0000 pid=3925 execve guuid=fea5764b-1700-0000-1d87-657d590f0000 pid=3929 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=fea5764b-1700-0000-1d87-657d590f0000 pid=3929 execve guuid=3369d84b-1700-0000-1d87-657d5a0f0000 pid=3930 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=3369d84b-1700-0000-1d87-657d5a0f0000 pid=3930 execve guuid=9fb43c4c-1700-0000-1d87-657d5e0f0000 pid=3934 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=9fb43c4c-1700-0000-1d87-657d5e0f0000 pid=3934 execve guuid=e3e1994c-1700-0000-1d87-657d620f0000 pid=3938 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=e3e1994c-1700-0000-1d87-657d620f0000 pid=3938 execve guuid=8d7afe4c-1700-0000-1d87-657d660f0000 pid=3942 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=8d7afe4c-1700-0000-1d87-657d660f0000 pid=3942 execve guuid=fadd584d-1700-0000-1d87-657d6a0f0000 pid=3946 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=fadd584d-1700-0000-1d87-657d6a0f0000 pid=3946 execve guuid=1518b14d-1700-0000-1d87-657d6b0f0000 pid=3947 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=1518b14d-1700-0000-1d87-657d6b0f0000 pid=3947 execve guuid=3f28144e-1700-0000-1d87-657d6e0f0000 pid=3950 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=3f28144e-1700-0000-1d87-657d6e0f0000 pid=3950 execve guuid=a25b764e-1700-0000-1d87-657d710f0000 pid=3953 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=a25b764e-1700-0000-1d87-657d710f0000 pid=3953 execve guuid=02b7d04e-1700-0000-1d87-657d730f0000 pid=3955 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=02b7d04e-1700-0000-1d87-657d730f0000 pid=3955 execve guuid=36282c4f-1700-0000-1d87-657d760f0000 pid=3958 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=36282c4f-1700-0000-1d87-657d760f0000 pid=3958 execve guuid=aceb914f-1700-0000-1d87-657d780f0000 pid=3960 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=aceb914f-1700-0000-1d87-657d780f0000 pid=3960 execve guuid=02d3f44f-1700-0000-1d87-657d7c0f0000 pid=3964 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=02d3f44f-1700-0000-1d87-657d7c0f0000 pid=3964 execve guuid=36995b50-1700-0000-1d87-657d800f0000 pid=3968 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=36995b50-1700-0000-1d87-657d800f0000 pid=3968 execve guuid=9132bc50-1700-0000-1d87-657d820f0000 pid=3970 /usr/bin/ls guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=9132bc50-1700-0000-1d87-657d820f0000 pid=3970 execve guuid=aedc1d51-1700-0000-1d87-657d850f0000 pid=3973 /usr/bin/rm guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=aedc1d51-1700-0000-1d87-657d850f0000 pid=3973 execve guuid=af815b51-1700-0000-1d87-657d860f0000 pid=3974 /usr/bin/wget net send-data write-file guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=af815b51-1700-0000-1d87-657d860f0000 pid=3974 execve guuid=d8039294-1700-0000-1d87-657d4a100000 pid=4170 /usr/bin/chmod guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=d8039294-1700-0000-1d87-657d4a100000 pid=4170 execve guuid=b866f394-1700-0000-1d87-657d4b100000 pid=4171 /tmp/9hF guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=b866f394-1700-0000-1d87-657d4b100000 pid=4171 execve guuid=628bec95-1700-0000-1d87-657d50100000 pid=4176 /usr/bin/rm guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=628bec95-1700-0000-1d87-657d50100000 pid=4176 execve guuid=e3246196-1700-0000-1d87-657d53100000 pid=4179 /usr/bin/wget net send-data write-file guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=e3246196-1700-0000-1d87-657d53100000 pid=4179 execve guuid=aefbfc9d-1700-0000-1d87-657d6b100000 pid=4203 /usr/bin/chmod guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=aefbfc9d-1700-0000-1d87-657d6b100000 pid=4203 execve guuid=7b9e5f9e-1700-0000-1d87-657d6c100000 pid=4204 /tmp/Bqj guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=7b9e5f9e-1700-0000-1d87-657d6c100000 pid=4204 execve guuid=ac7214a1-1700-0000-1d87-657d75100000 pid=4213 /usr/bin/rm guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=ac7214a1-1700-0000-1d87-657d75100000 pid=4213 execve guuid=63ae77a1-1700-0000-1d87-657d77100000 pid=4215 /usr/bin/wget net send-data write-file guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=63ae77a1-1700-0000-1d87-657d77100000 pid=4215 execve guuid=98c31ba9-1700-0000-1d87-657d88100000 pid=4232 /usr/bin/chmod guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=98c31ba9-1700-0000-1d87-657d88100000 pid=4232 execve guuid=5b917da9-1700-0000-1d87-657d8a100000 pid=4234 /tmp/4qGx guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=5b917da9-1700-0000-1d87-657d8a100000 pid=4234 execve guuid=e765eeab-1700-0000-1d87-657d92100000 pid=4242 /usr/bin/rm guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=e765eeab-1700-0000-1d87-657d92100000 pid=4242 execve guuid=6bd054ac-1700-0000-1d87-657d94100000 pid=4244 /usr/bin/wget net send-data write-file guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=6bd054ac-1700-0000-1d87-657d94100000 pid=4244 execve guuid=c7a4d2b3-1700-0000-1d87-657dae100000 pid=4270 /usr/bin/chmod guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=c7a4d2b3-1700-0000-1d87-657dae100000 pid=4270 execve guuid=30da43b4-1700-0000-1d87-657db0100000 pid=4272 /tmp/9eB guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=30da43b4-1700-0000-1d87-657db0100000 pid=4272 execve guuid=793457b5-1700-0000-1d87-657db4100000 pid=4276 /usr/bin/rm guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=793457b5-1700-0000-1d87-657db4100000 pid=4276 execve guuid=8b7fadb5-1700-0000-1d87-657db6100000 pid=4278 /usr/bin/wget net send-data write-file guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=8b7fadb5-1700-0000-1d87-657db6100000 pid=4278 execve guuid=90d969bc-1700-0000-1d87-657dc4100000 pid=4292 /usr/bin/chmod guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=90d969bc-1700-0000-1d87-657dc4100000 pid=4292 execve guuid=a05a35bd-1700-0000-1d87-657dc5100000 pid=4293 /tmp/dPO guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=a05a35bd-1700-0000-1d87-657dc5100000 pid=4293 execve guuid=ffd88abe-1700-0000-1d87-657dc7100000 pid=4295 /usr/bin/rm delete-file guuid=bcbedb22-1700-0000-1d87-657d4c0e0000 pid=3660->guuid=ffd88abe-1700-0000-1d87-657dc7100000 pid=4295 execve 9554d36e-3083-568e-90da-bb8e3c487b07 188.132.232.81:80 guuid=af815b51-1700-0000-1d87-657d860f0000 pid=3974->9554d36e-3083-568e-90da-bb8e3c487b07 send: 132B guuid=e3246196-1700-0000-1d87-657d53100000 pid=4179->9554d36e-3083-568e-90da-bb8e3c487b07 send: 132B guuid=63ae77a1-1700-0000-1d87-657d77100000 pid=4215->9554d36e-3083-568e-90da-bb8e3c487b07 send: 133B guuid=6bd054ac-1700-0000-1d87-657d94100000 pid=4244->9554d36e-3083-568e-90da-bb8e3c487b07 send: 132B guuid=8b7fadb5-1700-0000-1d87-657db6100000 pid=4278->9554d36e-3083-568e-90da-bb8e3c487b07 send: 132B
Score:
98%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/4cfbd57289d0d26ce9be0a5c60d1b697e202bf7111d274740112b1edfce25a4d
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4cfbd57289d0d26ce9be0a5c60d1b697e202bf7111d274740112b1edfce25a4d/
Verdict:
Malicious
Threat:
Trojan-Downloader.Shell.Agent
Link:
https://tip.neiki.dev/file/4cfbd57289d0d26ce9be0a5c60d1b697e202bf7111d274740112b1edfce25a4d
Threat name:
Win32.Trojan.Vigorf
Create hunting rule
Status:
Malicious
First seen:
2026-06-05 08:43:28 UTC
File Type:
Text (Shell)
AV detection:
9 of 23 (39.13%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jt55k4uj2djgz2n6bjogbunws7rafp3rchjhi5abcky637hcljgq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
defense_evasion discovery linux
Link:
https://tria.ge/reports/260605-kmnzbacx2w/
Behaviour
Reads runtime system information
Writes file to tmp directory
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.06
Link:
https://yomi.yoroi.company/submissions/4cfbd57289d0d26ce9be0a5c60d1b697e202bf7111d274740112b1edfce25a4d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 4cfbd57289d0d26ce9be0a5c60d1b697e202bf7111d274740112b1edfce25a4d

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3856423/
  
Delivery method
Distributed via web download

Comments