🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 525ede4f72f413dac2902b7dd5e506ca9415d12da69a832386fd98903c91e752. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 525ede4f72f413dac2902b7dd5e506ca9415d12da69a832386fd98903c91e752
SHA3-384 hash: fb913b6101b110f744d52c7ec7a8e29f0b6b317d0b80ab6b4642c3e5e2aa2d902c89262c4ea482c10979ff0150050009
SHA1 hash: a63c197f16d935b2a8f609d3f1df4c1e92ab4c8f
MD5 hash: 84fc2d48e778dc218905ac862abbc33c
humanhash: spring-wisconsin-triple-johnny
File name:ok
Download: download sample
File size:1'584 bytes
First seen:2026-06-21 03:51:57 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 12:Uv6FfhX3Uf676Uf0NUV6U/vtvjnSjmy6UJtdbDX76VtowNEI6NEI49EL46LEfXId:5E+8mvN7KVtuZEdEI368U7wCnRTk
TLSH T14F312FDF10155A3A2252DACEB3733249640C85EB28DBC390DD485EED82889DCB276FD4
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://5.182.210.61/266986n/an/aelf ua-wget
http://5.182.210.61/a84888n/an/aelf ua-wget
http://5.182.210.61/c1b976n/an/aelf ua-wget
http://5.182.210.61/ce0e3fn/an/aelf ua-wget
http://5.182.210.61/abecd0n/an/aelf ua-wget
http://5.182.210.61/49436an/an/aelf ua-wget
http://5.182.210.61/344e2bn/an/aelf ua-wget
http://5.182.210.61/523a67n/an/aelf ua-wget
http://5.182.210.61/3f5390n/an/aelf ua-wget
http://5.182.210.61/4227acn/an/aelf ua-wget
http://5.182.210.61/f0d5bcn/an/aelf ua-wget
http://5.182.210.61/21a02dn/an/aelf ua-wget

Intelligence

File Origin
# of uploads :
1
# of downloads :
58
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-06-21T01:03:00Z UTC
Last seen:
2026-06-22T23:48:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan-Downloader.Shell.Agent.a
Link:
https://opentip.kaspersky.com/525ede4f72f413dac2902b7dd5e506ca9415d12da69a832386fd98903c91e752/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/c15a77b1-9952-4c30-bb1a-dc723a2300fc
Behavior Graph:
Download SVG
%3 guuid=82ed14f8-1e00-0000-7c60-dd373d140000 pid=5181 /usr/bin/sudo guuid=61e2e3fc-1e00-0000-7c60-dd373e140000 pid=5182 /tmp/sample.bin guuid=82ed14f8-1e00-0000-7c60-dd373d140000 pid=5181->guuid=61e2e3fc-1e00-0000-7c60-dd373e140000 pid=5182 execve guuid=2e77effd-1e00-0000-7c60-dd373f140000 pid=5183 /usr/bin/wget net send-data guuid=61e2e3fc-1e00-0000-7c60-dd373e140000 pid=5182->guuid=2e77effd-1e00-0000-7c60-dd373f140000 pid=5183 execve guuid=a2dc3c01-1f00-0000-7c60-dd3740140000 pid=5184 /usr/bin/curl net send-data write-file guuid=61e2e3fc-1e00-0000-7c60-dd373e140000 pid=5182->guuid=a2dc3c01-1f00-0000-7c60-dd3740140000 pid=5184 execve guuid=e2dca505-1f00-0000-7c60-dd3742140000 pid=5186 /usr/bin/chmod guuid=61e2e3fc-1e00-0000-7c60-dd373e140000 pid=5182->guuid=e2dca505-1f00-0000-7c60-dd3742140000 pid=5186 execve guuid=d343ee05-1f00-0000-7c60-dd3743140000 pid=5187 /usr/bin/bash guuid=61e2e3fc-1e00-0000-7c60-dd373e140000 pid=5182->guuid=d343ee05-1f00-0000-7c60-dd3743140000 pid=5187 clone guuid=87503206-1f00-0000-7c60-dd3745140000 pid=5189 /usr/bin/rm delete-file guuid=61e2e3fc-1e00-0000-7c60-dd373e140000 pid=5182->guuid=87503206-1f00-0000-7c60-dd3745140000 pid=5189 execve guuid=e0b08b06-1f00-0000-7c60-dd3746140000 pid=5190 /usr/bin/rm guuid=61e2e3fc-1e00-0000-7c60-dd373e140000 pid=5182->guuid=e0b08b06-1f00-0000-7c60-dd3746140000 pid=5190 execve guuid=fa80e206-1f00-0000-7c60-dd3747140000 pid=5191 /usr/bin/wget net send-data guuid=61e2e3fc-1e00-0000-7c60-dd373e140000 pid=5182->guuid=fa80e206-1f00-0000-7c60-dd3747140000 pid=5191 execve guuid=acf75809-1f00-0000-7c60-dd3748140000 pid=5192 /usr/bin/curl net send-data write-file guuid=61e2e3fc-1e00-0000-7c60-dd373e140000 pid=5182->guuid=acf75809-1f00-0000-7c60-dd3748140000 pid=5192 execve guuid=f21b810c-1f00-0000-7c60-dd374b140000 pid=5195 /usr/bin/chmod guuid=61e2e3fc-1e00-0000-7c60-dd373e140000 pid=5182->guuid=f21b810c-1f00-0000-7c60-dd374b140000 pid=5195 execve guuid=cff1ba0c-1f00-0000-7c60-dd374c140000 pid=5196 /usr/bin/bash guuid=61e2e3fc-1e00-0000-7c60-dd373e140000 pid=5182->guuid=cff1ba0c-1f00-0000-7c60-dd374c140000 pid=5196 clone guuid=e99cf40c-1f00-0000-7c60-dd374e140000 pid=5198 /usr/bin/rm delete-file guuid=61e2e3fc-1e00-0000-7c60-dd373e140000 pid=5182->guuid=e99cf40c-1f00-0000-7c60-dd374e140000 pid=5198 execve guuid=2909360d-1f00-0000-7c60-dd3750140000 pid=5200 /usr/bin/rm guuid=61e2e3fc-1e00-0000-7c60-dd373e140000 pid=5182->guuid=2909360d-1f00-0000-7c60-dd3750140000 pid=5200 execve guuid=e566740d-1f00-0000-7c60-dd3752140000 pid=5202 /usr/bin/wget net send-data guuid=61e2e3fc-1e00-0000-7c60-dd373e140000 pid=5182->guuid=e566740d-1f00-0000-7c60-dd3752140000 pid=5202 execve guuid=fadfe00f-1f00-0000-7c60-dd3754140000 pid=5204 /usr/bin/curl net send-data write-file guuid=61e2e3fc-1e00-0000-7c60-dd373e140000 pid=5182->guuid=fadfe00f-1f00-0000-7c60-dd3754140000 pid=5204 execve guuid=5795611f-1f00-0000-7c60-dd3755140000 pid=5205 /usr/bin/chmod guuid=61e2e3fc-1e00-0000-7c60-dd373e140000 pid=5182->guuid=5795611f-1f00-0000-7c60-dd3755140000 pid=5205 execve guuid=d501d11f-1f00-0000-7c60-dd3756140000 pid=5206 /usr/bin/bash guuid=61e2e3fc-1e00-0000-7c60-dd373e140000 pid=5182->guuid=d501d11f-1f00-0000-7c60-dd3756140000 pid=5206 clone guuid=a8132d20-1f00-0000-7c60-dd3758140000 pid=5208 /usr/bin/rm delete-file guuid=61e2e3fc-1e00-0000-7c60-dd373e140000 pid=5182->guuid=a8132d20-1f00-0000-7c60-dd3758140000 pid=5208 execve guuid=6bd28e20-1f00-0000-7c60-dd3759140000 pid=5209 /usr/bin/rm guuid=61e2e3fc-1e00-0000-7c60-dd373e140000 pid=5182->guuid=6bd28e20-1f00-0000-7c60-dd3759140000 pid=5209 execve guuid=892ce320-1f00-0000-7c60-dd375a140000 pid=5210 /usr/bin/wget net send-data guuid=61e2e3fc-1e00-0000-7c60-dd373e140000 pid=5182->guuid=892ce320-1f00-0000-7c60-dd375a140000 pid=5210 execve guuid=ae9c8b23-1f00-0000-7c60-dd375b140000 pid=5211 /usr/bin/curl net send-data write-file guuid=61e2e3fc-1e00-0000-7c60-dd373e140000 pid=5182->guuid=ae9c8b23-1f00-0000-7c60-dd375b140000 pid=5211 execve guuid=87d0db27-1f00-0000-7c60-dd375c140000 pid=5212 /usr/bin/chmod guuid=61e2e3fc-1e00-0000-7c60-dd373e140000 pid=5182->guuid=87d0db27-1f00-0000-7c60-dd375c140000 pid=5212 execve guuid=c50c8528-1f00-0000-7c60-dd375e140000 pid=5214 /usr/bin/bash guuid=61e2e3fc-1e00-0000-7c60-dd373e140000 pid=5182->guuid=c50c8528-1f00-0000-7c60-dd375e140000 pid=5214 clone guuid=ae3dfa28-1f00-0000-7c60-dd3761140000 pid=5217 /usr/bin/rm delete-file guuid=61e2e3fc-1e00-0000-7c60-dd373e140000 pid=5182->guuid=ae3dfa28-1f00-0000-7c60-dd3761140000 pid=5217 execve guuid=faf89829-1f00-0000-7c60-dd3763140000 pid=5219 /usr/bin/rm guuid=61e2e3fc-1e00-0000-7c60-dd373e140000 pid=5182->guuid=faf89829-1f00-0000-7c60-dd3763140000 pid=5219 execve guuid=6ece2a2a-1f00-0000-7c60-dd3765140000 pid=5221 /usr/bin/wget net send-data guuid=61e2e3fc-1e00-0000-7c60-dd373e140000 pid=5182->guuid=6ece2a2a-1f00-0000-7c60-dd3765140000 pid=5221 execve guuid=2ebd5f2d-1f00-0000-7c60-dd3769140000 pid=5225 /usr/bin/curl net send-data write-file guuid=61e2e3fc-1e00-0000-7c60-dd373e140000 pid=5182->guuid=2ebd5f2d-1f00-0000-7c60-dd3769140000 pid=5225 execve guuid=80742041-1f00-0000-7c60-dd376a140000 pid=5226 /usr/bin/chmod guuid=61e2e3fc-1e00-0000-7c60-dd373e140000 pid=5182->guuid=80742041-1f00-0000-7c60-dd376a140000 pid=5226 execve guuid=a94d6541-1f00-0000-7c60-dd376b140000 pid=5227 /usr/bin/bash guuid=61e2e3fc-1e00-0000-7c60-dd373e140000 pid=5182->guuid=a94d6541-1f00-0000-7c60-dd376b140000 pid=5227 clone guuid=21e0aa41-1f00-0000-7c60-dd376d140000 pid=5229 /usr/bin/rm delete-file guuid=61e2e3fc-1e00-0000-7c60-dd373e140000 pid=5182->guuid=21e0aa41-1f00-0000-7c60-dd376d140000 pid=5229 execve guuid=524cef41-1f00-0000-7c60-dd376e140000 pid=5230 /usr/bin/rm guuid=61e2e3fc-1e00-0000-7c60-dd373e140000 pid=5182->guuid=524cef41-1f00-0000-7c60-dd376e140000 pid=5230 execve guuid=db615242-1f00-0000-7c60-dd376f140000 pid=5231 /usr/bin/wget net send-data guuid=61e2e3fc-1e00-0000-7c60-dd373e140000 pid=5182->guuid=db615242-1f00-0000-7c60-dd376f140000 pid=5231 execve guuid=6ad02f45-1f00-0000-7c60-dd3770140000 pid=5232 /usr/bin/curl net send-data write-file guuid=61e2e3fc-1e00-0000-7c60-dd373e140000 pid=5182->guuid=6ad02f45-1f00-0000-7c60-dd3770140000 pid=5232 execve guuid=bb0c2e49-1f00-0000-7c60-dd3771140000 pid=5233 /usr/bin/chmod guuid=61e2e3fc-1e00-0000-7c60-dd373e140000 pid=5182->guuid=bb0c2e49-1f00-0000-7c60-dd3771140000 pid=5233 execve guuid=1f467749-1f00-0000-7c60-dd3772140000 pid=5234 /usr/bin/bash guuid=61e2e3fc-1e00-0000-7c60-dd373e140000 pid=5182->guuid=1f467749-1f00-0000-7c60-dd3772140000 pid=5234 clone guuid=869fb249-1f00-0000-7c60-dd3774140000 pid=5236 /usr/bin/rm delete-file guuid=61e2e3fc-1e00-0000-7c60-dd373e140000 pid=5182->guuid=869fb249-1f00-0000-7c60-dd3774140000 pid=5236 execve guuid=461b574a-1f00-0000-7c60-dd3775140000 pid=5237 /usr/bin/rm guuid=61e2e3fc-1e00-0000-7c60-dd373e140000 pid=5182->guuid=461b574a-1f00-0000-7c60-dd3775140000 pid=5237 execve guuid=486ea84a-1f00-0000-7c60-dd3776140000 pid=5238 /usr/bin/wget net send-data guuid=61e2e3fc-1e00-0000-7c60-dd373e140000 pid=5182->guuid=486ea84a-1f00-0000-7c60-dd3776140000 pid=5238 execve guuid=9ef9954d-1f00-0000-7c60-dd3777140000 pid=5239 /usr/bin/curl net send-data write-file guuid=61e2e3fc-1e00-0000-7c60-dd373e140000 pid=5182->guuid=9ef9954d-1f00-0000-7c60-dd3777140000 pid=5239 execve guuid=6a1f1051-1f00-0000-7c60-dd3778140000 pid=5240 /usr/bin/chmod guuid=61e2e3fc-1e00-0000-7c60-dd373e140000 pid=5182->guuid=6a1f1051-1f00-0000-7c60-dd3778140000 pid=5240 execve guuid=a3a55e51-1f00-0000-7c60-dd3779140000 pid=5241 /usr/bin/bash guuid=61e2e3fc-1e00-0000-7c60-dd373e140000 pid=5182->guuid=a3a55e51-1f00-0000-7c60-dd3779140000 pid=5241 clone guuid=ade0b251-1f00-0000-7c60-dd377b140000 pid=5243 /usr/bin/rm delete-file guuid=61e2e3fc-1e00-0000-7c60-dd373e140000 pid=5182->guuid=ade0b251-1f00-0000-7c60-dd377b140000 pid=5243 execve guuid=fadaa352-1f00-0000-7c60-dd377c140000 pid=5244 /usr/bin/rm guuid=61e2e3fc-1e00-0000-7c60-dd373e140000 pid=5182->guuid=fadaa352-1f00-0000-7c60-dd377c140000 pid=5244 execve guuid=1118f552-1f00-0000-7c60-dd377d140000 pid=5245 /usr/bin/wget net send-data guuid=61e2e3fc-1e00-0000-7c60-dd373e140000 pid=5182->guuid=1118f552-1f00-0000-7c60-dd377d140000 pid=5245 execve guuid=f5531656-1f00-0000-7c60-dd377e140000 pid=5246 /usr/bin/curl net send-data write-file guuid=61e2e3fc-1e00-0000-7c60-dd373e140000 pid=5182->guuid=f5531656-1f00-0000-7c60-dd377e140000 pid=5246 execve guuid=27fa6759-1f00-0000-7c60-dd3780140000 pid=5248 /usr/bin/chmod guuid=61e2e3fc-1e00-0000-7c60-dd373e140000 pid=5182->guuid=27fa6759-1f00-0000-7c60-dd3780140000 pid=5248 execve guuid=1b3bc259-1f00-0000-7c60-dd3781140000 pid=5249 /usr/bin/bash guuid=61e2e3fc-1e00-0000-7c60-dd373e140000 pid=5182->guuid=1b3bc259-1f00-0000-7c60-dd3781140000 pid=5249 clone guuid=34da1e5a-1f00-0000-7c60-dd3783140000 pid=5251 /usr/bin/rm delete-file guuid=61e2e3fc-1e00-0000-7c60-dd373e140000 pid=5182->guuid=34da1e5a-1f00-0000-7c60-dd3783140000 pid=5251 execve guuid=0b49775a-1f00-0000-7c60-dd3784140000 pid=5252 /usr/bin/rm guuid=61e2e3fc-1e00-0000-7c60-dd373e140000 pid=5182->guuid=0b49775a-1f00-0000-7c60-dd3784140000 pid=5252 execve guuid=d184cc5a-1f00-0000-7c60-dd3785140000 pid=5253 /usr/bin/wget net send-data guuid=61e2e3fc-1e00-0000-7c60-dd373e140000 pid=5182->guuid=d184cc5a-1f00-0000-7c60-dd3785140000 pid=5253 execve guuid=d500895d-1f00-0000-7c60-dd3786140000 pid=5254 /usr/bin/curl net send-data write-file guuid=61e2e3fc-1e00-0000-7c60-dd373e140000 pid=5182->guuid=d500895d-1f00-0000-7c60-dd3786140000 pid=5254 execve guuid=a88ac861-1f00-0000-7c60-dd3788140000 pid=5256 /usr/bin/chmod guuid=61e2e3fc-1e00-0000-7c60-dd373e140000 pid=5182->guuid=a88ac861-1f00-0000-7c60-dd3788140000 pid=5256 execve guuid=f61c1462-1f00-0000-7c60-dd3789140000 pid=5257 /usr/bin/bash guuid=61e2e3fc-1e00-0000-7c60-dd373e140000 pid=5182->guuid=f61c1462-1f00-0000-7c60-dd3789140000 pid=5257 clone guuid=aaa15e62-1f00-0000-7c60-dd378b140000 pid=5259 /usr/bin/rm delete-file guuid=61e2e3fc-1e00-0000-7c60-dd373e140000 pid=5182->guuid=aaa15e62-1f00-0000-7c60-dd378b140000 pid=5259 execve guuid=99efaf62-1f00-0000-7c60-dd378c140000 pid=5260 /usr/bin/rm guuid=61e2e3fc-1e00-0000-7c60-dd373e140000 pid=5182->guuid=99efaf62-1f00-0000-7c60-dd378c140000 pid=5260 execve guuid=51c2fd62-1f00-0000-7c60-dd378d140000 pid=5261 /usr/bin/wget net send-data guuid=61e2e3fc-1e00-0000-7c60-dd373e140000 pid=5182->guuid=51c2fd62-1f00-0000-7c60-dd378d140000 pid=5261 execve guuid=9a9d9965-1f00-0000-7c60-dd378e140000 pid=5262 /usr/bin/curl net send-data write-file guuid=61e2e3fc-1e00-0000-7c60-dd373e140000 pid=5182->guuid=9a9d9965-1f00-0000-7c60-dd378e140000 pid=5262 execve guuid=c36e4b6a-1f00-0000-7c60-dd3790140000 pid=5264 /usr/bin/chmod guuid=61e2e3fc-1e00-0000-7c60-dd373e140000 pid=5182->guuid=c36e4b6a-1f00-0000-7c60-dd3790140000 pid=5264 execve guuid=6a98926a-1f00-0000-7c60-dd3791140000 pid=5265 /usr/bin/bash guuid=61e2e3fc-1e00-0000-7c60-dd373e140000 pid=5182->guuid=6a98926a-1f00-0000-7c60-dd3791140000 pid=5265 clone guuid=7addd46a-1f00-0000-7c60-dd3793140000 pid=5267 /usr/bin/rm delete-file guuid=61e2e3fc-1e00-0000-7c60-dd373e140000 pid=5182->guuid=7addd46a-1f00-0000-7c60-dd3793140000 pid=5267 execve guuid=0355196b-1f00-0000-7c60-dd3794140000 pid=5268 /usr/bin/rm guuid=61e2e3fc-1e00-0000-7c60-dd373e140000 pid=5182->guuid=0355196b-1f00-0000-7c60-dd3794140000 pid=5268 execve guuid=92ad5c6b-1f00-0000-7c60-dd3795140000 pid=5269 /usr/bin/wget net send-data guuid=61e2e3fc-1e00-0000-7c60-dd373e140000 pid=5182->guuid=92ad5c6b-1f00-0000-7c60-dd3795140000 pid=5269 execve guuid=e1c0bb74-1f00-0000-7c60-dd37a0140000 pid=5280 /usr/bin/curl net send-data write-file guuid=61e2e3fc-1e00-0000-7c60-dd373e140000 pid=5182->guuid=e1c0bb74-1f00-0000-7c60-dd37a0140000 pid=5280 execve guuid=af5c1f78-1f00-0000-7c60-dd37a7140000 pid=5287 /usr/bin/chmod guuid=61e2e3fc-1e00-0000-7c60-dd373e140000 pid=5182->guuid=af5c1f78-1f00-0000-7c60-dd37a7140000 pid=5287 execve guuid=abd9118e-1f00-0000-7c60-dd37a8140000 pid=5288 /usr/bin/bash guuid=61e2e3fc-1e00-0000-7c60-dd373e140000 pid=5182->guuid=abd9118e-1f00-0000-7c60-dd37a8140000 pid=5288 clone guuid=d331918e-1f00-0000-7c60-dd37aa140000 pid=5290 /usr/bin/rm delete-file guuid=61e2e3fc-1e00-0000-7c60-dd373e140000 pid=5182->guuid=d331918e-1f00-0000-7c60-dd37aa140000 pid=5290 execve guuid=8a15268f-1f00-0000-7c60-dd37ab140000 pid=5291 /usr/bin/rm guuid=61e2e3fc-1e00-0000-7c60-dd373e140000 pid=5182->guuid=8a15268f-1f00-0000-7c60-dd37ab140000 pid=5291 execve guuid=2d469d8f-1f00-0000-7c60-dd37ac140000 pid=5292 /usr/bin/wget net send-data guuid=61e2e3fc-1e00-0000-7c60-dd373e140000 pid=5182->guuid=2d469d8f-1f00-0000-7c60-dd37ac140000 pid=5292 execve guuid=e2b30f93-1f00-0000-7c60-dd37ad140000 pid=5293 /usr/bin/curl net send-data write-file guuid=61e2e3fc-1e00-0000-7c60-dd373e140000 pid=5182->guuid=e2b30f93-1f00-0000-7c60-dd37ad140000 pid=5293 execve guuid=6dd49497-1f00-0000-7c60-dd37ae140000 pid=5294 /usr/bin/chmod guuid=61e2e3fc-1e00-0000-7c60-dd373e140000 pid=5182->guuid=6dd49497-1f00-0000-7c60-dd37ae140000 pid=5294 execve guuid=85371198-1f00-0000-7c60-dd37af140000 pid=5295 /usr/bin/bash guuid=61e2e3fc-1e00-0000-7c60-dd373e140000 pid=5182->guuid=85371198-1f00-0000-7c60-dd37af140000 pid=5295 clone guuid=eab95198-1f00-0000-7c60-dd37b1140000 pid=5297 /usr/bin/rm delete-file guuid=61e2e3fc-1e00-0000-7c60-dd373e140000 pid=5182->guuid=eab95198-1f00-0000-7c60-dd37b1140000 pid=5297 execve guuid=1866ea98-1f00-0000-7c60-dd37b2140000 pid=5298 /usr/bin/rm guuid=61e2e3fc-1e00-0000-7c60-dd373e140000 pid=5182->guuid=1866ea98-1f00-0000-7c60-dd37b2140000 pid=5298 execve 9e33e6d7-6ac7-5a65-88f4-941337e56821 5.182.210.61:80 guuid=2e77effd-1e00-0000-7c60-dd373f140000 pid=5183->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=a2dc3c01-1f00-0000-7c60-dd3740140000 pid=5184->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=5bc40906-1f00-0000-7c60-dd3744140000 pid=5188 /usr/bin/bash guuid=d343ee05-1f00-0000-7c60-dd3743140000 pid=5187->guuid=5bc40906-1f00-0000-7c60-dd3744140000 pid=5188 clone guuid=fa80e206-1f00-0000-7c60-dd3747140000 pid=5191->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=acf75809-1f00-0000-7c60-dd3748140000 pid=5192->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=1117cf0c-1f00-0000-7c60-dd374d140000 pid=5197 /usr/bin/bash guuid=cff1ba0c-1f00-0000-7c60-dd374c140000 pid=5196->guuid=1117cf0c-1f00-0000-7c60-dd374d140000 pid=5197 clone guuid=e566740d-1f00-0000-7c60-dd3752140000 pid=5202->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=fadfe00f-1f00-0000-7c60-dd3754140000 pid=5204->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=723af31f-1f00-0000-7c60-dd3757140000 pid=5207 /usr/bin/bash guuid=d501d11f-1f00-0000-7c60-dd3756140000 pid=5206->guuid=723af31f-1f00-0000-7c60-dd3757140000 pid=5207 clone guuid=892ce320-1f00-0000-7c60-dd375a140000 pid=5210->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=ae9c8b23-1f00-0000-7c60-dd375b140000 pid=5211->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=1223bc28-1f00-0000-7c60-dd375f140000 pid=5215 /usr/bin/bash guuid=c50c8528-1f00-0000-7c60-dd375e140000 pid=5214->guuid=1223bc28-1f00-0000-7c60-dd375f140000 pid=5215 clone guuid=6ece2a2a-1f00-0000-7c60-dd3765140000 pid=5221->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=2ebd5f2d-1f00-0000-7c60-dd3769140000 pid=5225->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=c37f8341-1f00-0000-7c60-dd376c140000 pid=5228 /usr/bin/bash guuid=a94d6541-1f00-0000-7c60-dd376b140000 pid=5227->guuid=c37f8341-1f00-0000-7c60-dd376c140000 pid=5228 clone guuid=db615242-1f00-0000-7c60-dd376f140000 pid=5231->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=6ad02f45-1f00-0000-7c60-dd3770140000 pid=5232->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=4bec8f49-1f00-0000-7c60-dd3773140000 pid=5235 /usr/bin/bash guuid=1f467749-1f00-0000-7c60-dd3772140000 pid=5234->guuid=4bec8f49-1f00-0000-7c60-dd3773140000 pid=5235 clone guuid=486ea84a-1f00-0000-7c60-dd3776140000 pid=5238->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=9ef9954d-1f00-0000-7c60-dd3777140000 pid=5239->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=62808751-1f00-0000-7c60-dd377a140000 pid=5242 /usr/bin/bash guuid=a3a55e51-1f00-0000-7c60-dd3779140000 pid=5241->guuid=62808751-1f00-0000-7c60-dd377a140000 pid=5242 clone guuid=1118f552-1f00-0000-7c60-dd377d140000 pid=5245->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=f5531656-1f00-0000-7c60-dd377e140000 pid=5246->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=3c36ec59-1f00-0000-7c60-dd3782140000 pid=5250 /usr/bin/bash guuid=1b3bc259-1f00-0000-7c60-dd3781140000 pid=5249->guuid=3c36ec59-1f00-0000-7c60-dd3782140000 pid=5250 clone guuid=d184cc5a-1f00-0000-7c60-dd3785140000 pid=5253->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=d500895d-1f00-0000-7c60-dd3786140000 pid=5254->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=f0602f62-1f00-0000-7c60-dd378a140000 pid=5258 /usr/bin/bash guuid=f61c1462-1f00-0000-7c60-dd3789140000 pid=5257->guuid=f0602f62-1f00-0000-7c60-dd378a140000 pid=5258 clone guuid=51c2fd62-1f00-0000-7c60-dd378d140000 pid=5261->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=9a9d9965-1f00-0000-7c60-dd378e140000 pid=5262->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=38bfac6a-1f00-0000-7c60-dd3792140000 pid=5266 /usr/bin/bash guuid=6a98926a-1f00-0000-7c60-dd3791140000 pid=5265->guuid=38bfac6a-1f00-0000-7c60-dd3792140000 pid=5266 clone guuid=92ad5c6b-1f00-0000-7c60-dd3795140000 pid=5269->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=e1c0bb74-1f00-0000-7c60-dd37a0140000 pid=5280->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=1887598e-1f00-0000-7c60-dd37a9140000 pid=5289 /usr/bin/bash guuid=abd9118e-1f00-0000-7c60-dd37a8140000 pid=5288->guuid=1887598e-1f00-0000-7c60-dd37a9140000 pid=5289 clone guuid=2d469d8f-1f00-0000-7c60-dd37ac140000 pid=5292->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=e2b30f93-1f00-0000-7c60-dd37ad140000 pid=5293->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=0e242f98-1f00-0000-7c60-dd37b0140000 pid=5296 /usr/bin/bash guuid=85371198-1f00-0000-7c60-dd37af140000 pid=5295->guuid=0e242f98-1f00-0000-7c60-dd37b0140000 pid=5296 clone
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/525ede4f72f413dac2902b7dd5e506ca9415d12da69a832386fd98903c91e752
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/525ede4f72f413dac2902b7dd5e506ca9415d12da69a832386fd98903c91e752/
Verdict:
Malicious
Threat:
Trojan-Downloader.Shell.Agent
Link:
https://tip.neiki.dev/file/525ede4f72f413dac2902b7dd5e506ca9415d12da69a832386fd98903c91e752
Threat name:
Linux.Trojan.Vigorf
Create hunting rule
Status:
Malicious
First seen:
2026-06-21 03:52:34 UTC
File Type:
Text (Shell)
AV detection:
13 of 24 (54.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=kjpn4t3s6qj5vquqfn65lzigzkkblujnu2nigi4g7wmjaper45ja._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260621-efakfsct51/
Behaviour
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.11
Link:
https://yomi.yoroi.company/submissions/525ede4f72f413dac2902b7dd5e506ca9415d12da69a832386fd98903c91e752

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 525ede4f72f413dac2902b7dd5e506ca9415d12da69a832386fd98903c91e752

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3864548/
  
Delivery method
Distributed via web download

Comments