MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 5b7014ba948dee21bee9c264c6e3e4457d8f3cd224200541ae64f953b4e99f0e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 5b7014ba948dee21bee9c264c6e3e4457d8f3cd224200541ae64f953b4e99f0e
SHA3-384 hash: 0a7e6928b9188d81f75115e5ca243aab51cb1690fb83aa164961b55a5302a56a2f12989a3ae1f19a773161aac4110d18
SHA1 hash: c7fb8d2296414705256d6d2936c88452de8fe8bb
MD5 hash: bd360798e91b501cf6575afdb4bb4b7a
humanhash: georgia-lake-helium-paris
File name:k.php
Download: download sample
File size:19'499 bytes
First seen:2026-03-13 05:39:08 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 384:4FcuQpWx+BL0SWL0gOzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:4F8i+BL0SI05zsP4cbddr7zsP4cbddrk
TLSH T177924DB512896C79FBD0CE399F3C6F4DADE4C2C42124A3ACBA4F39215A1166DC605359
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh

Intelligence

File Origin
# of uploads :
1
# of downloads :
74
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.MulDrop.187.7287.20582.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive masquerade
Link:
https://www.filescan.io/uploads/69b3a302677ac46843a4b069/reports/97be2f3d-977a-44e5-9e1f-6af7ae260957/overview
Verdict:
Malicious
File Type:
unix shell
Detections:
HEUR:Trojan-Downloader.Shell.Agent.bc
Link:
https://opentip.kaspersky.com/5b7014ba948dee21bee9c264c6e3e4457d8f3cd224200541ae64f953b4e99f0e/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/20159e43-6c3a-4587-8864-1cbdc7a65f6a
Behavior Graph:
Download SVG
%3 guuid=705b4a95-1600-0000-4e32-0477bd0c0000 pid=3261 /usr/bin/sudo guuid=8a835897-1600-0000-4e32-0477c00c0000 pid=3264 /tmp/sample.bin guuid=705b4a95-1600-0000-4e32-0477bd0c0000 pid=3261->guuid=8a835897-1600-0000-4e32-0477c00c0000 pid=3264 execve guuid=8b466b98-1600-0000-4e32-0477c40c0000 pid=3268 /usr/bin/bash guuid=8a835897-1600-0000-4e32-0477c00c0000 pid=3264->guuid=8b466b98-1600-0000-4e32-0477c40c0000 pid=3268 clone guuid=ad687d98-1600-0000-4e32-0477c50c0000 pid=3269 /usr/bin/bash guuid=8a835897-1600-0000-4e32-0477c00c0000 pid=3264->guuid=ad687d98-1600-0000-4e32-0477c50c0000 pid=3269 clone guuid=7de6a798-1600-0000-4e32-0477c70c0000 pid=3271 /usr/bin/mkdir guuid=8a835897-1600-0000-4e32-0477c00c0000 pid=3264->guuid=7de6a798-1600-0000-4e32-0477c70c0000 pid=3271 execve guuid=b7bc1699-1600-0000-4e32-0477c80c0000 pid=3272 /usr/bin/mkdir guuid=8a835897-1600-0000-4e32-0477c00c0000 pid=3264->guuid=b7bc1699-1600-0000-4e32-0477c80c0000 pid=3272 execve guuid=dd3f6e99-1600-0000-4e32-0477ca0c0000 pid=3274 /usr/bin/mkdir guuid=8a835897-1600-0000-4e32-0477c00c0000 pid=3264->guuid=dd3f6e99-1600-0000-4e32-0477ca0c0000 pid=3274 execve guuid=2633d599-1600-0000-4e32-0477cc0c0000 pid=3276 /usr/bin/mkdir guuid=8a835897-1600-0000-4e32-0477c00c0000 pid=3264->guuid=2633d599-1600-0000-4e32-0477cc0c0000 pid=3276 execve guuid=5aea319a-1600-0000-4e32-0477ce0c0000 pid=3278 /usr/bin/mkdir guuid=8a835897-1600-0000-4e32-0477c00c0000 pid=3264->guuid=5aea319a-1600-0000-4e32-0477ce0c0000 pid=3278 execve guuid=c4308d9a-1600-0000-4e32-0477d00c0000 pid=3280 /usr/bin/mkdir guuid=8a835897-1600-0000-4e32-0477c00c0000 pid=3264->guuid=c4308d9a-1600-0000-4e32-0477d00c0000 pid=3280 execve guuid=e440dd9a-1600-0000-4e32-0477d20c0000 pid=3282 /usr/bin/mkdir guuid=8a835897-1600-0000-4e32-0477c00c0000 pid=3264->guuid=e440dd9a-1600-0000-4e32-0477d20c0000 pid=3282 execve guuid=5b65859b-1600-0000-4e32-0477d40c0000 pid=3284 /usr/bin/cp guuid=8a835897-1600-0000-4e32-0477c00c0000 pid=3264->guuid=5b65859b-1600-0000-4e32-0477d40c0000 pid=3284 execve guuid=b710ed9b-1600-0000-4e32-0477d70c0000 pid=3287 /usr/bin/cp guuid=8a835897-1600-0000-4e32-0477c00c0000 pid=3264->guuid=b710ed9b-1600-0000-4e32-0477d70c0000 pid=3287 execve guuid=4c96779c-1600-0000-4e32-0477d90c0000 pid=3289 /usr/bin/cp guuid=8a835897-1600-0000-4e32-0477c00c0000 pid=3264->guuid=4c96779c-1600-0000-4e32-0477d90c0000 pid=3289 execve guuid=3069dd9c-1600-0000-4e32-0477dc0c0000 pid=3292 /usr/bin/cp guuid=8a835897-1600-0000-4e32-0477c00c0000 pid=3264->guuid=3069dd9c-1600-0000-4e32-0477dc0c0000 pid=3292 execve guuid=c0a23e9d-1600-0000-4e32-0477de0c0000 pid=3294 /usr/bin/cp guuid=8a835897-1600-0000-4e32-0477c00c0000 pid=3264->guuid=c0a23e9d-1600-0000-4e32-0477de0c0000 pid=3294 execve guuid=b1b1a19d-1600-0000-4e32-0477e00c0000 pid=3296 /usr/bin/cp guuid=8a835897-1600-0000-4e32-0477c00c0000 pid=3264->guuid=b1b1a19d-1600-0000-4e32-0477e00c0000 pid=3296 execve guuid=9e6e1b9e-1600-0000-4e32-0477e20c0000 pid=3298 /usr/bin/cp guuid=8a835897-1600-0000-4e32-0477c00c0000 pid=3264->guuid=9e6e1b9e-1600-0000-4e32-0477e20c0000 pid=3298 execve guuid=caac809e-1600-0000-4e32-0477e30c0000 pid=3299 /usr/bin/cp guuid=8a835897-1600-0000-4e32-0477c00c0000 pid=3264->guuid=caac809e-1600-0000-4e32-0477e30c0000 pid=3299 execve guuid=6686049f-1600-0000-4e32-0477e40c0000 pid=3300 /usr/bin/cp guuid=8a835897-1600-0000-4e32-0477c00c0000 pid=3264->guuid=6686049f-1600-0000-4e32-0477e40c0000 pid=3300 execve guuid=344d649f-1600-0000-4e32-0477e60c0000 pid=3302 /usr/bin/cp guuid=8a835897-1600-0000-4e32-0477c00c0000 pid=3264->guuid=344d649f-1600-0000-4e32-0477e60c0000 pid=3302 execve guuid=9816cd9f-1600-0000-4e32-0477e90c0000 pid=3305 /usr/bin/cp guuid=8a835897-1600-0000-4e32-0477c00c0000 pid=3264->guuid=9816cd9f-1600-0000-4e32-0477e90c0000 pid=3305 execve guuid=167e34a0-1600-0000-4e32-0477eb0c0000 pid=3307 /usr/bin/cp guuid=8a835897-1600-0000-4e32-0477c00c0000 pid=3264->guuid=167e34a0-1600-0000-4e32-0477eb0c0000 pid=3307 execve guuid=85c197a0-1600-0000-4e32-0477ed0c0000 pid=3309 /usr/bin/cp guuid=8a835897-1600-0000-4e32-0477c00c0000 pid=3264->guuid=85c197a0-1600-0000-4e32-0477ed0c0000 pid=3309 execve guuid=f13f36a1-1600-0000-4e32-0477ef0c0000 pid=3311 /usr/bin/cp guuid=8a835897-1600-0000-4e32-0477c00c0000 pid=3264->guuid=f13f36a1-1600-0000-4e32-0477ef0c0000 pid=3311 execve guuid=144da4a1-1600-0000-4e32-0477f10c0000 pid=3313 /usr/bin/cp guuid=8a835897-1600-0000-4e32-0477c00c0000 pid=3264->guuid=144da4a1-1600-0000-4e32-0477f10c0000 pid=3313 execve guuid=222c3da2-1600-0000-4e32-0477f20c0000 pid=3314 /usr/bin/touch guuid=8a835897-1600-0000-4e32-0477c00c0000 pid=3264->guuid=222c3da2-1600-0000-4e32-0477f20c0000 pid=3314 execve guuid=510d95a2-1600-0000-4e32-0477f30c0000 pid=3315 /usr/bin/bash guuid=8a835897-1600-0000-4e32-0477c00c0000 pid=3264->guuid=510d95a2-1600-0000-4e32-0477f30c0000 pid=3315 clone guuid=cc8e9da2-1600-0000-4e32-0477f40c0000 pid=3316 /usr/bin/bash guuid=8a835897-1600-0000-4e32-0477c00c0000 pid=3264->guuid=cc8e9da2-1600-0000-4e32-0477f40c0000 pid=3316 clone guuid=2a9dc3a2-1600-0000-4e32-0477f50c0000 pid=3317 /usr/bin/bash guuid=8a835897-1600-0000-4e32-0477c00c0000 pid=3264->guuid=2a9dc3a2-1600-0000-4e32-0477f50c0000 pid=3317 clone guuid=599fcca2-1600-0000-4e32-0477f60c0000 pid=3318 /usr/bin/base64 write-file guuid=8a835897-1600-0000-4e32-0477c00c0000 pid=3264->guuid=599fcca2-1600-0000-4e32-0477f60c0000 pid=3318 execve guuid=8fc95aa3-1600-0000-4e32-0477f90c0000 pid=3321 /usr/bin/bash guuid=8a835897-1600-0000-4e32-0477c00c0000 pid=3264->guuid=8fc95aa3-1600-0000-4e32-0477f90c0000 pid=3321 execve guuid=d20614a8-1600-0000-4e32-04771b0d0000 pid=3355 /usr/bin/rm delete-file guuid=8a835897-1600-0000-4e32-0477c00c0000 pid=3264->guuid=d20614a8-1600-0000-4e32-04771b0d0000 pid=3355 execve guuid=06b95aa8-1600-0000-4e32-04771d0d0000 pid=3357 /usr/bin/bash guuid=8a835897-1600-0000-4e32-0477c00c0000 pid=3264->guuid=06b95aa8-1600-0000-4e32-04771d0d0000 pid=3357 clone guuid=c2a75fa8-1600-0000-4e32-04771e0d0000 pid=3358 /usr/bin/bash guuid=8a835897-1600-0000-4e32-0477c00c0000 pid=3264->guuid=c2a75fa8-1600-0000-4e32-04771e0d0000 pid=3358 clone guuid=55537aa8-1600-0000-4e32-04771f0d0000 pid=3359 /usr/bin/bash guuid=8a835897-1600-0000-4e32-0477c00c0000 pid=3264->guuid=55537aa8-1600-0000-4e32-04771f0d0000 pid=3359 execve guuid=eb80d7a8-1600-0000-4e32-0477220d0000 pid=3362 /usr/bin/rm guuid=8a835897-1600-0000-4e32-0477c00c0000 pid=3264->guuid=eb80d7a8-1600-0000-4e32-0477220d0000 pid=3362 execve guuid=69dcafa3-1600-0000-4e32-0477fb0c0000 pid=3323 /usr/bin/bash guuid=8fc95aa3-1600-0000-4e32-0477f90c0000 pid=3321->guuid=69dcafa3-1600-0000-4e32-0477fb0c0000 pid=3323 clone guuid=039bb7a3-1600-0000-4e32-0477fd0c0000 pid=3325 /usr/bin/bash guuid=8fc95aa3-1600-0000-4e32-0477f90c0000 pid=3321->guuid=039bb7a3-1600-0000-4e32-0477fd0c0000 pid=3325 clone guuid=ac30d8a3-1600-0000-4e32-0477fe0c0000 pid=3326 /usr/bin/ls guuid=8fc95aa3-1600-0000-4e32-0477f90c0000 pid=3321->guuid=ac30d8a3-1600-0000-4e32-0477fe0c0000 pid=3326 execve guuid=48553fa4-1600-0000-4e32-0477010d0000 pid=3329 /usr/bin/cat guuid=8fc95aa3-1600-0000-4e32-0477f90c0000 pid=3321->guuid=48553fa4-1600-0000-4e32-0477010d0000 pid=3329 execve guuid=8a8982a4-1600-0000-4e32-0477030d0000 pid=3331 /usr/bin/ls guuid=8fc95aa3-1600-0000-4e32-0477f90c0000 pid=3321->guuid=8a8982a4-1600-0000-4e32-0477030d0000 pid=3331 execve guuid=81952da5-1600-0000-4e32-0477060d0000 pid=3334 /usr/bin/mkdir guuid=8fc95aa3-1600-0000-4e32-0477f90c0000 pid=3321->guuid=81952da5-1600-0000-4e32-0477060d0000 pid=3334 execve guuid=5cb17da5-1600-0000-4e32-0477080d0000 pid=3336 /usr/bin/mv guuid=8fc95aa3-1600-0000-4e32-0477f90c0000 pid=3321->guuid=5cb17da5-1600-0000-4e32-0477080d0000 pid=3336 execve guuid=936cd2a5-1600-0000-4e32-04770b0d0000 pid=3339 /usr/bin/bash guuid=8fc95aa3-1600-0000-4e32-0477f90c0000 pid=3321->guuid=936cd2a5-1600-0000-4e32-04770b0d0000 pid=3339 clone guuid=9e85d7a5-1600-0000-4e32-04770c0d0000 pid=3340 /usr/bin/base64 write-file guuid=8fc95aa3-1600-0000-4e32-0477f90c0000 pid=3321->guuid=9e85d7a5-1600-0000-4e32-04770c0d0000 pid=3340 execve guuid=d04f21a6-1600-0000-4e32-04770e0d0000 pid=3342 /usr/bin/rm delete-file guuid=8fc95aa3-1600-0000-4e32-0477f90c0000 pid=3321->guuid=d04f21a6-1600-0000-4e32-04770e0d0000 pid=3342 execve guuid=a5bd64a6-1600-0000-4e32-0477100d0000 pid=3344 /usr/bin/ls guuid=8fc95aa3-1600-0000-4e32-0477f90c0000 pid=3321->guuid=a5bd64a6-1600-0000-4e32-0477100d0000 pid=3344 execve guuid=0784bba6-1600-0000-4e32-0477120d0000 pid=3346 /usr/bin/bash guuid=8fc95aa3-1600-0000-4e32-0477f90c0000 pid=3321->guuid=0784bba6-1600-0000-4e32-0477120d0000 pid=3346 clone guuid=2f61c1a6-1600-0000-4e32-0477130d0000 pid=3347 /usr/bin/base64 write-file guuid=8fc95aa3-1600-0000-4e32-0477f90c0000 pid=3321->guuid=2f61c1a6-1600-0000-4e32-0477130d0000 pid=3347 execve guuid=209805a7-1600-0000-4e32-0477150d0000 pid=3349 /usr/bin/ls guuid=8fc95aa3-1600-0000-4e32-0477f90c0000 pid=3321->guuid=209805a7-1600-0000-4e32-0477150d0000 pid=3349 execve guuid=e41663a7-1600-0000-4e32-0477180d0000 pid=3352 /usr/bin/cat guuid=8fc95aa3-1600-0000-4e32-0477f90c0000 pid=3321->guuid=e41663a7-1600-0000-4e32-0477180d0000 pid=3352 execve guuid=271aa0a7-1600-0000-4e32-0477190d0000 pid=3353 /usr/bin/ls guuid=8fc95aa3-1600-0000-4e32-0477f90c0000 pid=3321->guuid=271aa0a7-1600-0000-4e32-0477190d0000 pid=3353 execve
Score:
81%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/5b7014ba948dee21bee9c264c6e3e4457d8f3cd224200541ae64f953b4e99f0e
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/5b7014ba948dee21bee9c264c6e3e4457d8f3cd224200541ae64f953b4e99f0e/
Verdict:
Malicious
Link:
https://tip.neiki.dev/file/5b7014ba948dee21bee9c264c6e3e4457d8f3cd224200541ae64f953b4e99f0e
Threat name:
Script-Shell.Trojan.Vigorf
Create hunting rule
Status:
Malicious
First seen:
2026-03-13 05:39:22 UTC
File Type:
Text (Shell)
AV detection:
9 of 23 (39.13%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lnybjouurxxcdpxjyjsmny7eiv6y6pgseqqakqnomt4vhnhjt4ha._file
Result
Malware family:
n/a
Score:
  4/10
Tags:
defense_evasion discovery linux
Link:
https://tria.ge/reports/260313-gcefcact2k/
Behaviour
Reads runtime system information
Writes file to tmp directory
Deobfuscate/Decode Files or Information
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/5b7014ba948dee21bee9c264c6e3e4457d8f3cd224200541ae64f953b4e99f0e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SUSP_LNX_Base64_Exec_Apr24
Create hunting rule
Author:Christian Burkard
Description:Detects suspicious base64 encoded shell commands (as seen in Palo Alto CVE-2024-3400 exploitation)
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 5b7014ba948dee21bee9c264c6e3e4457d8f3cd224200541ae64f953b4e99f0e

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3792476/
  
Delivery method
Distributed via web download

Comments