🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 60089b8b41676b36533a66b5cd648ace8a1e704a09764c6fcdbb04f9588c8b29. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 60089b8b41676b36533a66b5cd648ace8a1e704a09764c6fcdbb04f9588c8b29
SHA3-384 hash: 088a325f7295251cddc2dfaf5d4b8456aa0e73e103b641c7737aabb05de404b86130ac8889a8b3db4ae5f25ffe90b4ae
SHA1 hash: f9e1a4549404df87eb853e899873da1cc0b93b18
MD5 hash: 82e88a7c84f36516a2637e6e90421f28
humanhash: alaska-grey-west-yellow
File name:ok
Download: download sample
File size:1'584 bytes
First seen:2026-06-18 09:17:01 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 12:UI6qb6RD5NwL6NwgxTGni6naZ0czGIu6+HRZL6ZDLVXxbE76bEvp1b612l5Nql1p:+Dt4B0qysHvtNdj2W7Fch
TLSH T137311EDF40152A7A0213DA8DB3E23548B04C99EB1C9BD7959A480FFD828C6CCB266BD1
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://5.182.210.61/e94217n/an/aua-wget
http://5.182.210.61/a7b9a5n/an/aua-wget
http://5.182.210.61/dba395n/an/aua-wget
http://5.182.210.61/e14bbdn/an/aua-wget
http://5.182.210.61/3479c6n/an/aua-wget
http://5.182.210.61/77f8d7n/an/aua-wget
http://5.182.210.61/7aa159n/an/aua-wget
http://5.182.210.61/45cc57n/an/aua-wget
http://5.182.210.61/ca66b5n/an/aua-wget
http://5.182.210.61/0ec9f4n/an/aua-wget
http://5.182.210.61/314e0cn/an/aua-wget
http://5.182.210.61/c39530n/an/aua-wget

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive
Link:
https://www.filescan.io/uploads/6a33b7bb1d76d9ec9613ace4/reports/f26e9e4a-eff5-4aba-a46b-f1f55d950c00/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-06-18T06:23:00Z UTC
Last seen:
2026-06-19T21:46:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan-Downloader.Shell.Agent.a
Link:
https://opentip.kaspersky.com/60089b8b41676b36533a66b5cd648ace8a1e704a09764c6fcdbb04f9588c8b29/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/e3c7be1b-70fc-4490-bf6f-b3b5acc4028c
Behavior Graph:
Download SVG
%3 guuid=9e2e67ae-1e00-0000-a124-129258110000 pid=4440 /usr/bin/sudo guuid=b060fdb0-1e00-0000-a124-129259110000 pid=4441 /tmp/sample.bin guuid=9e2e67ae-1e00-0000-a124-129258110000 pid=4440->guuid=b060fdb0-1e00-0000-a124-129259110000 pid=4441 execve guuid=4d2970b1-1e00-0000-a124-12925a110000 pid=4442 /usr/bin/wget net send-data guuid=b060fdb0-1e00-0000-a124-129259110000 pid=4441->guuid=4d2970b1-1e00-0000-a124-12925a110000 pid=4442 execve guuid=da7390c6-1e00-0000-a124-12926a110000 pid=4458 /usr/bin/curl net send-data write-file guuid=b060fdb0-1e00-0000-a124-129259110000 pid=4441->guuid=da7390c6-1e00-0000-a124-12926a110000 pid=4458 execve guuid=f716b5cb-1e00-0000-a124-12927d110000 pid=4477 /usr/bin/chmod guuid=b060fdb0-1e00-0000-a124-129259110000 pid=4441->guuid=f716b5cb-1e00-0000-a124-12927d110000 pid=4477 execve guuid=58f620cc-1e00-0000-a124-129281110000 pid=4481 /usr/bin/bash guuid=b060fdb0-1e00-0000-a124-129259110000 pid=4441->guuid=58f620cc-1e00-0000-a124-129281110000 pid=4481 clone guuid=c5f494cc-1e00-0000-a124-129283110000 pid=4483 /usr/bin/rm delete-file guuid=b060fdb0-1e00-0000-a124-129259110000 pid=4441->guuid=c5f494cc-1e00-0000-a124-129283110000 pid=4483 execve guuid=8160f5cc-1e00-0000-a124-129287110000 pid=4487 /usr/bin/rm guuid=b060fdb0-1e00-0000-a124-129259110000 pid=4441->guuid=8160f5cc-1e00-0000-a124-129287110000 pid=4487 execve guuid=172447cd-1e00-0000-a124-129288110000 pid=4488 /usr/bin/wget net send-data guuid=b060fdb0-1e00-0000-a124-129259110000 pid=4441->guuid=172447cd-1e00-0000-a124-129288110000 pid=4488 execve guuid=878fc4cf-1e00-0000-a124-129293110000 pid=4499 /usr/bin/curl net send-data write-file guuid=b060fdb0-1e00-0000-a124-129259110000 pid=4441->guuid=878fc4cf-1e00-0000-a124-129293110000 pid=4499 execve guuid=e41027d3-1e00-0000-a124-1292a4110000 pid=4516 /usr/bin/chmod guuid=b060fdb0-1e00-0000-a124-129259110000 pid=4441->guuid=e41027d3-1e00-0000-a124-1292a4110000 pid=4516 execve guuid=9e8a7ad3-1e00-0000-a124-1292a6110000 pid=4518 /usr/bin/bash guuid=b060fdb0-1e00-0000-a124-129259110000 pid=4441->guuid=9e8a7ad3-1e00-0000-a124-1292a6110000 pid=4518 clone guuid=3983c1d3-1e00-0000-a124-1292aa110000 pid=4522 /usr/bin/rm delete-file guuid=b060fdb0-1e00-0000-a124-129259110000 pid=4441->guuid=3983c1d3-1e00-0000-a124-1292aa110000 pid=4522 execve guuid=011422d4-1e00-0000-a124-1292ac110000 pid=4524 /usr/bin/rm guuid=b060fdb0-1e00-0000-a124-129259110000 pid=4441->guuid=011422d4-1e00-0000-a124-1292ac110000 pid=4524 execve guuid=5e1077d4-1e00-0000-a124-1292af110000 pid=4527 /usr/bin/wget net send-data guuid=b060fdb0-1e00-0000-a124-129259110000 pid=4441->guuid=5e1077d4-1e00-0000-a124-1292af110000 pid=4527 execve guuid=9279ecd7-1e00-0000-a124-1292ba110000 pid=4538 /usr/bin/curl net send-data write-file guuid=b060fdb0-1e00-0000-a124-129259110000 pid=4441->guuid=9279ecd7-1e00-0000-a124-1292ba110000 pid=4538 execve guuid=25557ddb-1e00-0000-a124-1292c9110000 pid=4553 /usr/bin/chmod guuid=b060fdb0-1e00-0000-a124-129259110000 pid=4441->guuid=25557ddb-1e00-0000-a124-1292c9110000 pid=4553 execve guuid=6ab9cbdb-1e00-0000-a124-1292cb110000 pid=4555 /usr/bin/bash guuid=b060fdb0-1e00-0000-a124-129259110000 pid=4441->guuid=6ab9cbdb-1e00-0000-a124-1292cb110000 pid=4555 clone guuid=f50c13dc-1e00-0000-a124-1292cd110000 pid=4557 /usr/bin/rm delete-file guuid=b060fdb0-1e00-0000-a124-129259110000 pid=4441->guuid=f50c13dc-1e00-0000-a124-1292cd110000 pid=4557 execve guuid=31c559dc-1e00-0000-a124-1292cf110000 pid=4559 /usr/bin/rm guuid=b060fdb0-1e00-0000-a124-129259110000 pid=4441->guuid=31c559dc-1e00-0000-a124-1292cf110000 pid=4559 execve guuid=b4eacddc-1e00-0000-a124-1292d3110000 pid=4563 /usr/bin/wget net send-data guuid=b060fdb0-1e00-0000-a124-129259110000 pid=4441->guuid=b4eacddc-1e00-0000-a124-1292d3110000 pid=4563 execve guuid=1d8c0de0-1e00-0000-a124-1292dc110000 pid=4572 /usr/bin/curl net send-data write-file guuid=b060fdb0-1e00-0000-a124-129259110000 pid=4441->guuid=1d8c0de0-1e00-0000-a124-1292dc110000 pid=4572 execve guuid=c4d2a1e5-1e00-0000-a124-1292eb110000 pid=4587 /usr/bin/chmod guuid=b060fdb0-1e00-0000-a124-129259110000 pid=4441->guuid=c4d2a1e5-1e00-0000-a124-1292eb110000 pid=4587 execve guuid=476dffe5-1e00-0000-a124-1292ec110000 pid=4588 /usr/bin/bash guuid=b060fdb0-1e00-0000-a124-129259110000 pid=4441->guuid=476dffe5-1e00-0000-a124-1292ec110000 pid=4588 clone guuid=ec9a4de6-1e00-0000-a124-1292ef110000 pid=4591 /usr/bin/rm delete-file guuid=b060fdb0-1e00-0000-a124-129259110000 pid=4441->guuid=ec9a4de6-1e00-0000-a124-1292ef110000 pid=4591 execve guuid=6415d5e6-1e00-0000-a124-1292f1110000 pid=4593 /usr/bin/rm guuid=b060fdb0-1e00-0000-a124-129259110000 pid=4441->guuid=6415d5e6-1e00-0000-a124-1292f1110000 pid=4593 execve guuid=a8f23fe7-1e00-0000-a124-1292f3110000 pid=4595 /usr/bin/wget net send-data guuid=b060fdb0-1e00-0000-a124-129259110000 pid=4441->guuid=a8f23fe7-1e00-0000-a124-1292f3110000 pid=4595 execve guuid=25b0f7e9-1e00-0000-a124-1292f9110000 pid=4601 /usr/bin/curl net send-data write-file guuid=b060fdb0-1e00-0000-a124-129259110000 pid=4441->guuid=25b0f7e9-1e00-0000-a124-1292f9110000 pid=4601 execve guuid=9f6ddbee-1e00-0000-a124-129206120000 pid=4614 /usr/bin/chmod guuid=b060fdb0-1e00-0000-a124-129259110000 pid=4441->guuid=9f6ddbee-1e00-0000-a124-129206120000 pid=4614 execve guuid=b64128ef-1e00-0000-a124-129208120000 pid=4616 /usr/bin/bash guuid=b060fdb0-1e00-0000-a124-129259110000 pid=4441->guuid=b64128ef-1e00-0000-a124-129208120000 pid=4616 clone guuid=34285fef-1e00-0000-a124-12920b120000 pid=4619 /usr/bin/rm delete-file guuid=b060fdb0-1e00-0000-a124-129259110000 pid=4441->guuid=34285fef-1e00-0000-a124-12920b120000 pid=4619 execve guuid=2788e2ef-1e00-0000-a124-12920e120000 pid=4622 /usr/bin/rm guuid=b060fdb0-1e00-0000-a124-129259110000 pid=4441->guuid=2788e2ef-1e00-0000-a124-12920e120000 pid=4622 execve guuid=29b151f0-1e00-0000-a124-129212120000 pid=4626 /usr/bin/wget net send-data guuid=b060fdb0-1e00-0000-a124-129259110000 pid=4441->guuid=29b151f0-1e00-0000-a124-129212120000 pid=4626 execve guuid=9de91af3-1e00-0000-a124-12921b120000 pid=4635 /usr/bin/curl net send-data write-file guuid=b060fdb0-1e00-0000-a124-129259110000 pid=4441->guuid=9de91af3-1e00-0000-a124-12921b120000 pid=4635 execve guuid=493f0ef7-1e00-0000-a124-129227120000 pid=4647 /usr/bin/chmod guuid=b060fdb0-1e00-0000-a124-129259110000 pid=4441->guuid=493f0ef7-1e00-0000-a124-129227120000 pid=4647 execve guuid=641c65f7-1e00-0000-a124-129228120000 pid=4648 /usr/bin/bash guuid=b060fdb0-1e00-0000-a124-129259110000 pid=4441->guuid=641c65f7-1e00-0000-a124-129228120000 pid=4648 clone guuid=f93dbdf7-1e00-0000-a124-12922d120000 pid=4653 /usr/bin/rm delete-file guuid=b060fdb0-1e00-0000-a124-129259110000 pid=4441->guuid=f93dbdf7-1e00-0000-a124-12922d120000 pid=4653 execve guuid=aaaf36f8-1e00-0000-a124-12922e120000 pid=4654 /usr/bin/rm guuid=b060fdb0-1e00-0000-a124-129259110000 pid=4441->guuid=aaaf36f8-1e00-0000-a124-12922e120000 pid=4654 execve guuid=bb5da2f8-1e00-0000-a124-129231120000 pid=4657 /usr/bin/wget net send-data guuid=b060fdb0-1e00-0000-a124-129259110000 pid=4441->guuid=bb5da2f8-1e00-0000-a124-129231120000 pid=4657 execve guuid=a6e8abfb-1e00-0000-a124-12923e120000 pid=4670 /usr/bin/curl net send-data write-file guuid=b060fdb0-1e00-0000-a124-129259110000 pid=4441->guuid=a6e8abfb-1e00-0000-a124-12923e120000 pid=4670 execve guuid=c20bbdff-1e00-0000-a124-12924c120000 pid=4684 /usr/bin/chmod guuid=b060fdb0-1e00-0000-a124-129259110000 pid=4441->guuid=c20bbdff-1e00-0000-a124-12924c120000 pid=4684 execve guuid=98c70f00-1f00-0000-a124-12924e120000 pid=4686 /usr/bin/bash guuid=b060fdb0-1e00-0000-a124-129259110000 pid=4441->guuid=98c70f00-1f00-0000-a124-12924e120000 pid=4686 clone guuid=61247800-1f00-0000-a124-129250120000 pid=4688 /usr/bin/rm delete-file guuid=b060fdb0-1e00-0000-a124-129259110000 pid=4441->guuid=61247800-1f00-0000-a124-129250120000 pid=4688 execve guuid=b9a1e900-1f00-0000-a124-129254120000 pid=4692 /usr/bin/rm guuid=b060fdb0-1e00-0000-a124-129259110000 pid=4441->guuid=b9a1e900-1f00-0000-a124-129254120000 pid=4692 execve guuid=f2c45401-1f00-0000-a124-129257120000 pid=4695 /usr/bin/wget net send-data guuid=b060fdb0-1e00-0000-a124-129259110000 pid=4441->guuid=f2c45401-1f00-0000-a124-129257120000 pid=4695 execve guuid=ef681806-1f00-0000-a124-12926b120000 pid=4715 /usr/bin/curl net send-data write-file guuid=b060fdb0-1e00-0000-a124-129259110000 pid=4441->guuid=ef681806-1f00-0000-a124-12926b120000 pid=4715 execve guuid=9195e60a-1f00-0000-a124-12927d120000 pid=4733 /usr/bin/chmod guuid=b060fdb0-1e00-0000-a124-129259110000 pid=4441->guuid=9195e60a-1f00-0000-a124-12927d120000 pid=4733 execve guuid=5eb72b0b-1f00-0000-a124-12927e120000 pid=4734 /usr/bin/bash guuid=b060fdb0-1e00-0000-a124-129259110000 pid=4441->guuid=5eb72b0b-1f00-0000-a124-12927e120000 pid=4734 clone guuid=c1c16e0b-1f00-0000-a124-129280120000 pid=4736 /usr/bin/rm delete-file guuid=b060fdb0-1e00-0000-a124-129259110000 pid=4441->guuid=c1c16e0b-1f00-0000-a124-129280120000 pid=4736 execve guuid=ed77bd0b-1f00-0000-a124-129281120000 pid=4737 /usr/bin/rm guuid=b060fdb0-1e00-0000-a124-129259110000 pid=4441->guuid=ed77bd0b-1f00-0000-a124-129281120000 pid=4737 execve guuid=926a170c-1f00-0000-a124-129282120000 pid=4738 /usr/bin/wget net send-data guuid=b060fdb0-1e00-0000-a124-129259110000 pid=4441->guuid=926a170c-1f00-0000-a124-129282120000 pid=4738 execve guuid=8bb4a90f-1f00-0000-a124-12928b120000 pid=4747 /usr/bin/curl net send-data write-file guuid=b060fdb0-1e00-0000-a124-129259110000 pid=4441->guuid=8bb4a90f-1f00-0000-a124-12928b120000 pid=4747 execve guuid=8bf6ba13-1f00-0000-a124-129298120000 pid=4760 /usr/bin/chmod guuid=b060fdb0-1e00-0000-a124-129259110000 pid=4441->guuid=8bf6ba13-1f00-0000-a124-129298120000 pid=4760 execve guuid=9c211a14-1f00-0000-a124-12929a120000 pid=4762 /usr/bin/bash guuid=b060fdb0-1e00-0000-a124-129259110000 pid=4441->guuid=9c211a14-1f00-0000-a124-12929a120000 pid=4762 clone guuid=cbba5b14-1f00-0000-a124-12929d120000 pid=4765 /usr/bin/rm delete-file guuid=b060fdb0-1e00-0000-a124-129259110000 pid=4441->guuid=cbba5b14-1f00-0000-a124-12929d120000 pid=4765 execve guuid=7601ab14-1f00-0000-a124-12929f120000 pid=4767 /usr/bin/rm guuid=b060fdb0-1e00-0000-a124-129259110000 pid=4441->guuid=7601ab14-1f00-0000-a124-12929f120000 pid=4767 execve guuid=dd514015-1f00-0000-a124-1292a2120000 pid=4770 /usr/bin/wget net send-data guuid=b060fdb0-1e00-0000-a124-129259110000 pid=4441->guuid=dd514015-1f00-0000-a124-1292a2120000 pid=4770 execve guuid=248c4718-1f00-0000-a124-1292ac120000 pid=4780 /usr/bin/curl net send-data write-file guuid=b060fdb0-1e00-0000-a124-129259110000 pid=4441->guuid=248c4718-1f00-0000-a124-1292ac120000 pid=4780 execve guuid=058e431c-1f00-0000-a124-1292ba120000 pid=4794 /usr/bin/chmod guuid=b060fdb0-1e00-0000-a124-129259110000 pid=4441->guuid=058e431c-1f00-0000-a124-1292ba120000 pid=4794 execve guuid=621db01c-1f00-0000-a124-1292bd120000 pid=4797 /usr/bin/bash guuid=b060fdb0-1e00-0000-a124-129259110000 pid=4441->guuid=621db01c-1f00-0000-a124-1292bd120000 pid=4797 clone guuid=07660a1d-1f00-0000-a124-1292c0120000 pid=4800 /usr/bin/rm delete-file guuid=b060fdb0-1e00-0000-a124-129259110000 pid=4441->guuid=07660a1d-1f00-0000-a124-1292c0120000 pid=4800 execve guuid=b1d36b1d-1f00-0000-a124-1292c2120000 pid=4802 /usr/bin/rm guuid=b060fdb0-1e00-0000-a124-129259110000 pid=4441->guuid=b1d36b1d-1f00-0000-a124-1292c2120000 pid=4802 execve guuid=ea72cd1d-1f00-0000-a124-1292c4120000 pid=4804 /usr/bin/wget net send-data guuid=b060fdb0-1e00-0000-a124-129259110000 pid=4441->guuid=ea72cd1d-1f00-0000-a124-1292c4120000 pid=4804 execve guuid=666fff20-1f00-0000-a124-1292d0120000 pid=4816 /usr/bin/curl net send-data write-file guuid=b060fdb0-1e00-0000-a124-129259110000 pid=4441->guuid=666fff20-1f00-0000-a124-1292d0120000 pid=4816 execve guuid=fb888f24-1f00-0000-a124-1292dd120000 pid=4829 /usr/bin/chmod guuid=b060fdb0-1e00-0000-a124-129259110000 pid=4441->guuid=fb888f24-1f00-0000-a124-1292dd120000 pid=4829 execve guuid=2a061225-1f00-0000-a124-1292e0120000 pid=4832 /usr/bin/bash guuid=b060fdb0-1e00-0000-a124-129259110000 pid=4441->guuid=2a061225-1f00-0000-a124-1292e0120000 pid=4832 clone guuid=27946c25-1f00-0000-a124-1292e3120000 pid=4835 /usr/bin/rm delete-file guuid=b060fdb0-1e00-0000-a124-129259110000 pid=4441->guuid=27946c25-1f00-0000-a124-1292e3120000 pid=4835 execve guuid=ff1bb425-1f00-0000-a124-1292e5120000 pid=4837 /usr/bin/rm guuid=b060fdb0-1e00-0000-a124-129259110000 pid=4441->guuid=ff1bb425-1f00-0000-a124-1292e5120000 pid=4837 execve guuid=5f7bfb25-1f00-0000-a124-1292e7120000 pid=4839 /usr/bin/wget net send-data guuid=b060fdb0-1e00-0000-a124-129259110000 pid=4441->guuid=5f7bfb25-1f00-0000-a124-1292e7120000 pid=4839 execve guuid=60610b29-1f00-0000-a124-1292f0120000 pid=4848 /usr/bin/curl net send-data write-file guuid=b060fdb0-1e00-0000-a124-129259110000 pid=4441->guuid=60610b29-1f00-0000-a124-1292f0120000 pid=4848 execve guuid=7705c72c-1f00-0000-a124-1292fc120000 pid=4860 /usr/bin/chmod guuid=b060fdb0-1e00-0000-a124-129259110000 pid=4441->guuid=7705c72c-1f00-0000-a124-1292fc120000 pid=4860 execve guuid=e296162d-1f00-0000-a124-1292fe120000 pid=4862 /usr/bin/bash guuid=b060fdb0-1e00-0000-a124-129259110000 pid=4441->guuid=e296162d-1f00-0000-a124-1292fe120000 pid=4862 clone guuid=dff6512d-1f00-0000-a124-129201130000 pid=4865 /usr/bin/rm delete-file guuid=b060fdb0-1e00-0000-a124-129259110000 pid=4441->guuid=dff6512d-1f00-0000-a124-129201130000 pid=4865 execve guuid=29d5a42d-1f00-0000-a124-129203130000 pid=4867 /usr/bin/rm guuid=b060fdb0-1e00-0000-a124-129259110000 pid=4441->guuid=29d5a42d-1f00-0000-a124-129203130000 pid=4867 execve 9e33e6d7-6ac7-5a65-88f4-941337e56821 5.182.210.61:80 guuid=4d2970b1-1e00-0000-a124-12925a110000 pid=4442->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=da7390c6-1e00-0000-a124-12926a110000 pid=4458->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=696858cc-1e00-0000-a124-129282110000 pid=4482 /usr/bin/bash guuid=58f620cc-1e00-0000-a124-129281110000 pid=4481->guuid=696858cc-1e00-0000-a124-129282110000 pid=4482 clone guuid=172447cd-1e00-0000-a124-129288110000 pid=4488->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=878fc4cf-1e00-0000-a124-129293110000 pid=4499->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=2f8295d3-1e00-0000-a124-1292a9110000 pid=4521 /usr/bin/bash guuid=9e8a7ad3-1e00-0000-a124-1292a6110000 pid=4518->guuid=2f8295d3-1e00-0000-a124-1292a9110000 pid=4521 clone guuid=5e1077d4-1e00-0000-a124-1292af110000 pid=4527->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=9279ecd7-1e00-0000-a124-1292ba110000 pid=4538->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=6993e1db-1e00-0000-a124-1292cc110000 pid=4556 /usr/bin/bash guuid=6ab9cbdb-1e00-0000-a124-1292cb110000 pid=4555->guuid=6993e1db-1e00-0000-a124-1292cc110000 pid=4556 clone guuid=b4eacddc-1e00-0000-a124-1292d3110000 pid=4563->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=1d8c0de0-1e00-0000-a124-1292dc110000 pid=4572->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=79cb1fe6-1e00-0000-a124-1292ed110000 pid=4589 /usr/bin/bash guuid=476dffe5-1e00-0000-a124-1292ec110000 pid=4588->guuid=79cb1fe6-1e00-0000-a124-1292ed110000 pid=4589 clone guuid=a8f23fe7-1e00-0000-a124-1292f3110000 pid=4595->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=25b0f7e9-1e00-0000-a124-1292f9110000 pid=4601->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=c4ac3fef-1e00-0000-a124-129209120000 pid=4617 /usr/bin/bash guuid=b64128ef-1e00-0000-a124-129208120000 pid=4616->guuid=c4ac3fef-1e00-0000-a124-129209120000 pid=4617 clone guuid=29b151f0-1e00-0000-a124-129212120000 pid=4626->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=9de91af3-1e00-0000-a124-12921b120000 pid=4635->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=52b684f7-1e00-0000-a124-129229120000 pid=4649 /usr/bin/bash guuid=641c65f7-1e00-0000-a124-129228120000 pid=4648->guuid=52b684f7-1e00-0000-a124-129229120000 pid=4649 clone guuid=bb5da2f8-1e00-0000-a124-129231120000 pid=4657->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=a6e8abfb-1e00-0000-a124-12923e120000 pid=4670->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=69a53300-1f00-0000-a124-12924f120000 pid=4687 /usr/bin/bash guuid=98c70f00-1f00-0000-a124-12924e120000 pid=4686->guuid=69a53300-1f00-0000-a124-12924f120000 pid=4687 clone guuid=f2c45401-1f00-0000-a124-129257120000 pid=4695->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=ef681806-1f00-0000-a124-12926b120000 pid=4715->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=0537440b-1f00-0000-a124-12927f120000 pid=4735 /usr/bin/bash guuid=5eb72b0b-1f00-0000-a124-12927e120000 pid=4734->guuid=0537440b-1f00-0000-a124-12927f120000 pid=4735 clone guuid=926a170c-1f00-0000-a124-129282120000 pid=4738->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=8bb4a90f-1f00-0000-a124-12928b120000 pid=4747->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=16e73314-1f00-0000-a124-12929b120000 pid=4763 /usr/bin/bash guuid=9c211a14-1f00-0000-a124-12929a120000 pid=4762->guuid=16e73314-1f00-0000-a124-12929b120000 pid=4763 clone guuid=dd514015-1f00-0000-a124-1292a2120000 pid=4770->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=248c4718-1f00-0000-a124-1292ac120000 pid=4780->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=a339d21c-1f00-0000-a124-1292be120000 pid=4798 /usr/bin/bash guuid=621db01c-1f00-0000-a124-1292bd120000 pid=4797->guuid=a339d21c-1f00-0000-a124-1292be120000 pid=4798 clone guuid=ea72cd1d-1f00-0000-a124-1292c4120000 pid=4804->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=666fff20-1f00-0000-a124-1292d0120000 pid=4816->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=d2b04c25-1f00-0000-a124-1292e2120000 pid=4834 /usr/bin/bash guuid=2a061225-1f00-0000-a124-1292e0120000 pid=4832->guuid=d2b04c25-1f00-0000-a124-1292e2120000 pid=4834 clone guuid=5f7bfb25-1f00-0000-a124-1292e7120000 pid=4839->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=60610b29-1f00-0000-a124-1292f0120000 pid=4848->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=5cb62c2d-1f00-0000-a124-129200130000 pid=4864 /usr/bin/bash guuid=e296162d-1f00-0000-a124-1292fe120000 pid=4862->guuid=5cb62c2d-1f00-0000-a124-129200130000 pid=4864 clone
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/60089b8b41676b36533a66b5cd648ace8a1e704a09764c6fcdbb04f9588c8b29
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/60089b8b41676b36533a66b5cd648ace8a1e704a09764c6fcdbb04f9588c8b29/
Verdict:
Malicious
Threat:
Trojan-Downloader.Shell.Agent
Link:
https://tip.neiki.dev/file/60089b8b41676b36533a66b5cd648ace8a1e704a09764c6fcdbb04f9588c8b29
Threat name:
Win32.Trojan.Vigorf
Create hunting rule
Status:
Malicious
First seen:
2026-06-18 09:18:08 UTC
File Type:
Text (Shell)
AV detection:
13 of 24 (54.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=maejxc2bm5vtmuz2m2242zekz2fb44ckbf3ey36nxmcpswemrmuq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260618-k85h7ah16x/
Behaviour
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.11
Link:
https://yomi.yoroi.company/submissions/60089b8b41676b36533a66b5cd648ace8a1e704a09764c6fcdbb04f9588c8b29

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 60089b8b41676b36533a66b5cd648ace8a1e704a09764c6fcdbb04f9588c8b29

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3864548/
  
Delivery method
Distributed via web download

Comments