MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6cc800f0b3d0738f996454a5a587f63db0f979e6b923cc697b7e50ef6eb2d83e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6cc800f0b3d0738f996454a5a587f63db0f979e6b923cc697b7e50ef6eb2d83e
SHA3-384 hash: 98a3fa191cdce52e4ff3b19f3d914e735aa650fc0cde1cff496d3278cea8a345bdca225af684556ade5df5b5bb67e2f4
SHA1 hash: 136b362d3ee42cd3d1f18a1a26b5c8d85f8cc02f
MD5 hash: aefaf428995a1e0481f4b550203a2622
humanhash: snake-uncle-utah-magnesium
File name:k.php
Download: download sample
File size:19'499 bytes
First seen:2026-03-22 09:12:20 UTC
Last seen:2026-03-23 08:58:05 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 384:qFcuQpWx+BL0SWL0g6zsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:qF8i+BL0SI0FzsP4cbddr7zsP4cbddrk
TLSH T1BE925DB512496C79FBD1CE39AF3C6F4DADE8C2C42124A3ACBA4F39215A1166DC705349
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh

Intelligence

File Origin
# of uploads :
3
# of downloads :
69
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive masquerade
Link:
https://www.filescan.io/uploads/69bfb2aa2000fc76c3f5ea62/reports/a785b47b-2c7c-4119-aa07-84e5f3349ced/overview
Verdict:
Malicious
File Type:
unix shell
Detections:
HEUR:Trojan-Downloader.Shell.Agent.bc
Link:
https://opentip.kaspersky.com/6cc800f0b3d0738f996454a5a587f63db0f979e6b923cc697b7e50ef6eb2d83e/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/4de029cb-5d03-4957-b8b0-761f28ea7d56
Behavior Graph:
Download SVG
%3 guuid=a8b932ba-1600-0000-a4c2-24f83c0c0000 pid=3132 /usr/bin/sudo guuid=8afcb6bc-1600-0000-a4c2-24f8400c0000 pid=3136 /tmp/sample.bin guuid=a8b932ba-1600-0000-a4c2-24f83c0c0000 pid=3132->guuid=8afcb6bc-1600-0000-a4c2-24f8400c0000 pid=3136 execve guuid=fad91fbd-1600-0000-a4c2-24f8430c0000 pid=3139 /usr/bin/bash guuid=8afcb6bc-1600-0000-a4c2-24f8400c0000 pid=3136->guuid=fad91fbd-1600-0000-a4c2-24f8430c0000 pid=3139 clone guuid=952627bd-1600-0000-a4c2-24f8440c0000 pid=3140 /usr/bin/bash guuid=8afcb6bc-1600-0000-a4c2-24f8400c0000 pid=3136->guuid=952627bd-1600-0000-a4c2-24f8440c0000 pid=3140 clone guuid=6f064fbd-1600-0000-a4c2-24f8460c0000 pid=3142 /usr/bin/mkdir guuid=8afcb6bc-1600-0000-a4c2-24f8400c0000 pid=3136->guuid=6f064fbd-1600-0000-a4c2-24f8460c0000 pid=3142 execve guuid=6ff4aabd-1600-0000-a4c2-24f8480c0000 pid=3144 /usr/bin/mkdir guuid=8afcb6bc-1600-0000-a4c2-24f8400c0000 pid=3136->guuid=6ff4aabd-1600-0000-a4c2-24f8480c0000 pid=3144 execve guuid=e52005be-1600-0000-a4c2-24f84a0c0000 pid=3146 /usr/bin/mkdir guuid=8afcb6bc-1600-0000-a4c2-24f8400c0000 pid=3136->guuid=e52005be-1600-0000-a4c2-24f84a0c0000 pid=3146 execve guuid=d69c67be-1600-0000-a4c2-24f84d0c0000 pid=3149 /usr/bin/mkdir guuid=8afcb6bc-1600-0000-a4c2-24f8400c0000 pid=3136->guuid=d69c67be-1600-0000-a4c2-24f84d0c0000 pid=3149 execve guuid=97d3c9be-1600-0000-a4c2-24f84e0c0000 pid=3150 /usr/bin/mkdir guuid=8afcb6bc-1600-0000-a4c2-24f8400c0000 pid=3136->guuid=97d3c9be-1600-0000-a4c2-24f84e0c0000 pid=3150 execve guuid=4c7a35bf-1600-0000-a4c2-24f84f0c0000 pid=3151 /usr/bin/mkdir guuid=8afcb6bc-1600-0000-a4c2-24f8400c0000 pid=3136->guuid=4c7a35bf-1600-0000-a4c2-24f84f0c0000 pid=3151 execve guuid=e1f3adbf-1600-0000-a4c2-24f8500c0000 pid=3152 /usr/bin/mkdir guuid=8afcb6bc-1600-0000-a4c2-24f8400c0000 pid=3136->guuid=e1f3adbf-1600-0000-a4c2-24f8500c0000 pid=3152 execve guuid=53e322c0-1600-0000-a4c2-24f8510c0000 pid=3153 /usr/bin/cp guuid=8afcb6bc-1600-0000-a4c2-24f8400c0000 pid=3136->guuid=53e322c0-1600-0000-a4c2-24f8510c0000 pid=3153 execve guuid=2a11b7c0-1600-0000-a4c2-24f8530c0000 pid=3155 /usr/bin/cp guuid=8afcb6bc-1600-0000-a4c2-24f8400c0000 pid=3136->guuid=2a11b7c0-1600-0000-a4c2-24f8530c0000 pid=3155 execve guuid=c7a203c1-1600-0000-a4c2-24f8540c0000 pid=3156 /usr/bin/cp guuid=8afcb6bc-1600-0000-a4c2-24f8400c0000 pid=3136->guuid=c7a203c1-1600-0000-a4c2-24f8540c0000 pid=3156 execve guuid=f3ee62c1-1600-0000-a4c2-24f8550c0000 pid=3157 /usr/bin/cp guuid=8afcb6bc-1600-0000-a4c2-24f8400c0000 pid=3136->guuid=f3ee62c1-1600-0000-a4c2-24f8550c0000 pid=3157 execve guuid=1bbebec1-1600-0000-a4c2-24f8570c0000 pid=3159 /usr/bin/cp guuid=8afcb6bc-1600-0000-a4c2-24f8400c0000 pid=3136->guuid=1bbebec1-1600-0000-a4c2-24f8570c0000 pid=3159 execve guuid=2bb51dc2-1600-0000-a4c2-24f8590c0000 pid=3161 /usr/bin/cp guuid=8afcb6bc-1600-0000-a4c2-24f8400c0000 pid=3136->guuid=2bb51dc2-1600-0000-a4c2-24f8590c0000 pid=3161 execve guuid=44d27fc2-1600-0000-a4c2-24f85b0c0000 pid=3163 /usr/bin/cp guuid=8afcb6bc-1600-0000-a4c2-24f8400c0000 pid=3136->guuid=44d27fc2-1600-0000-a4c2-24f85b0c0000 pid=3163 execve guuid=df55e0c2-1600-0000-a4c2-24f85d0c0000 pid=3165 /usr/bin/cp guuid=8afcb6bc-1600-0000-a4c2-24f8400c0000 pid=3136->guuid=df55e0c2-1600-0000-a4c2-24f85d0c0000 pid=3165 execve guuid=705e40c3-1600-0000-a4c2-24f85f0c0000 pid=3167 /usr/bin/cp guuid=8afcb6bc-1600-0000-a4c2-24f8400c0000 pid=3136->guuid=705e40c3-1600-0000-a4c2-24f85f0c0000 pid=3167 execve guuid=03deb9c3-1600-0000-a4c2-24f8610c0000 pid=3169 /usr/bin/cp guuid=8afcb6bc-1600-0000-a4c2-24f8400c0000 pid=3136->guuid=03deb9c3-1600-0000-a4c2-24f8610c0000 pid=3169 execve guuid=cedc34c4-1600-0000-a4c2-24f8620c0000 pid=3170 /usr/bin/cp guuid=8afcb6bc-1600-0000-a4c2-24f8400c0000 pid=3136->guuid=cedc34c4-1600-0000-a4c2-24f8620c0000 pid=3170 execve guuid=35c3a3c4-1600-0000-a4c2-24f8640c0000 pid=3172 /usr/bin/cp guuid=8afcb6bc-1600-0000-a4c2-24f8400c0000 pid=3136->guuid=35c3a3c4-1600-0000-a4c2-24f8640c0000 pid=3172 execve guuid=1be40fc5-1600-0000-a4c2-24f8660c0000 pid=3174 /usr/bin/cp guuid=8afcb6bc-1600-0000-a4c2-24f8400c0000 pid=3136->guuid=1be40fc5-1600-0000-a4c2-24f8660c0000 pid=3174 execve guuid=76cd75c5-1600-0000-a4c2-24f8680c0000 pid=3176 /usr/bin/cp guuid=8afcb6bc-1600-0000-a4c2-24f8400c0000 pid=3136->guuid=76cd75c5-1600-0000-a4c2-24f8680c0000 pid=3176 execve guuid=0c41e4c5-1600-0000-a4c2-24f86b0c0000 pid=3179 /usr/bin/cp guuid=8afcb6bc-1600-0000-a4c2-24f8400c0000 pid=3136->guuid=0c41e4c5-1600-0000-a4c2-24f86b0c0000 pid=3179 execve guuid=a58651c6-1600-0000-a4c2-24f86d0c0000 pid=3181 /usr/bin/touch guuid=8afcb6bc-1600-0000-a4c2-24f8400c0000 pid=3136->guuid=a58651c6-1600-0000-a4c2-24f86d0c0000 pid=3181 execve guuid=57409bc6-1600-0000-a4c2-24f86f0c0000 pid=3183 /usr/bin/bash guuid=8afcb6bc-1600-0000-a4c2-24f8400c0000 pid=3136->guuid=57409bc6-1600-0000-a4c2-24f86f0c0000 pid=3183 clone guuid=8cb5a1c6-1600-0000-a4c2-24f8700c0000 pid=3184 /usr/bin/bash guuid=8afcb6bc-1600-0000-a4c2-24f8400c0000 pid=3136->guuid=8cb5a1c6-1600-0000-a4c2-24f8700c0000 pid=3184 clone guuid=6a13c0c6-1600-0000-a4c2-24f8710c0000 pid=3185 /usr/bin/bash guuid=8afcb6bc-1600-0000-a4c2-24f8400c0000 pid=3136->guuid=6a13c0c6-1600-0000-a4c2-24f8710c0000 pid=3185 clone guuid=e788cbc6-1600-0000-a4c2-24f8720c0000 pid=3186 /usr/bin/base64 write-file guuid=8afcb6bc-1600-0000-a4c2-24f8400c0000 pid=3136->guuid=e788cbc6-1600-0000-a4c2-24f8720c0000 pid=3186 execve guuid=07f366c7-1600-0000-a4c2-24f8740c0000 pid=3188 /usr/bin/bash guuid=8afcb6bc-1600-0000-a4c2-24f8400c0000 pid=3136->guuid=07f366c7-1600-0000-a4c2-24f8740c0000 pid=3188 execve guuid=ee757ecd-1600-0000-a4c2-24f88b0c0000 pid=3211 /usr/bin/rm delete-file guuid=8afcb6bc-1600-0000-a4c2-24f8400c0000 pid=3136->guuid=ee757ecd-1600-0000-a4c2-24f88b0c0000 pid=3211 execve guuid=b4a0dbcd-1600-0000-a4c2-24f88c0c0000 pid=3212 /usr/bin/bash guuid=8afcb6bc-1600-0000-a4c2-24f8400c0000 pid=3136->guuid=b4a0dbcd-1600-0000-a4c2-24f88c0c0000 pid=3212 clone guuid=ae10e6cd-1600-0000-a4c2-24f88d0c0000 pid=3213 /usr/bin/bash guuid=8afcb6bc-1600-0000-a4c2-24f8400c0000 pid=3136->guuid=ae10e6cd-1600-0000-a4c2-24f88d0c0000 pid=3213 clone guuid=6a6914ce-1600-0000-a4c2-24f88e0c0000 pid=3214 /usr/bin/bash guuid=8afcb6bc-1600-0000-a4c2-24f8400c0000 pid=3136->guuid=6a6914ce-1600-0000-a4c2-24f88e0c0000 pid=3214 execve guuid=c6e78cce-1600-0000-a4c2-24f88f0c0000 pid=3215 /usr/bin/rm guuid=8afcb6bc-1600-0000-a4c2-24f8400c0000 pid=3136->guuid=c6e78cce-1600-0000-a4c2-24f88f0c0000 pid=3215 execve guuid=ce1ddbc7-1600-0000-a4c2-24f8750c0000 pid=3189 /usr/bin/bash guuid=07f366c7-1600-0000-a4c2-24f8740c0000 pid=3188->guuid=ce1ddbc7-1600-0000-a4c2-24f8750c0000 pid=3189 clone guuid=ef43e9c7-1600-0000-a4c2-24f8760c0000 pid=3190 /usr/bin/bash guuid=07f366c7-1600-0000-a4c2-24f8740c0000 pid=3188->guuid=ef43e9c7-1600-0000-a4c2-24f8760c0000 pid=3190 clone guuid=cd5c0cc8-1600-0000-a4c2-24f8770c0000 pid=3191 /usr/bin/ls guuid=07f366c7-1600-0000-a4c2-24f8740c0000 pid=3188->guuid=cd5c0cc8-1600-0000-a4c2-24f8770c0000 pid=3191 execve guuid=dd1ad0c8-1600-0000-a4c2-24f87a0c0000 pid=3194 /usr/bin/cat guuid=07f366c7-1600-0000-a4c2-24f8740c0000 pid=3188->guuid=dd1ad0c8-1600-0000-a4c2-24f87a0c0000 pid=3194 execve guuid=cc010fc9-1600-0000-a4c2-24f87c0c0000 pid=3196 /usr/bin/ls guuid=07f366c7-1600-0000-a4c2-24f8740c0000 pid=3188->guuid=cc010fc9-1600-0000-a4c2-24f87c0c0000 pid=3196 execve guuid=a68566c9-1600-0000-a4c2-24f87e0c0000 pid=3198 /usr/bin/mkdir guuid=07f366c7-1600-0000-a4c2-24f8740c0000 pid=3188->guuid=a68566c9-1600-0000-a4c2-24f87e0c0000 pid=3198 execve guuid=ec2ab2c9-1600-0000-a4c2-24f8800c0000 pid=3200 /usr/bin/mv guuid=07f366c7-1600-0000-a4c2-24f8740c0000 pid=3188->guuid=ec2ab2c9-1600-0000-a4c2-24f8800c0000 pid=3200 execve guuid=b30e05ca-1600-0000-a4c2-24f8820c0000 pid=3202 /usr/bin/bash guuid=07f366c7-1600-0000-a4c2-24f8740c0000 pid=3188->guuid=b30e05ca-1600-0000-a4c2-24f8820c0000 pid=3202 clone guuid=53790cca-1600-0000-a4c2-24f8830c0000 pid=3203 /usr/bin/base64 write-file guuid=07f366c7-1600-0000-a4c2-24f8740c0000 pid=3188->guuid=53790cca-1600-0000-a4c2-24f8830c0000 pid=3203 execve guuid=9d6f70ca-1600-0000-a4c2-24f8840c0000 pid=3204 /usr/bin/rm delete-file guuid=07f366c7-1600-0000-a4c2-24f8740c0000 pid=3188->guuid=9d6f70ca-1600-0000-a4c2-24f8840c0000 pid=3204 execve guuid=ed3dcdca-1600-0000-a4c2-24f8850c0000 pid=3205 /usr/bin/ls guuid=07f366c7-1600-0000-a4c2-24f8740c0000 pid=3188->guuid=ed3dcdca-1600-0000-a4c2-24f8850c0000 pid=3205 execve guuid=740358cb-1600-0000-a4c2-24f8860c0000 pid=3206 /usr/bin/bash guuid=07f366c7-1600-0000-a4c2-24f8740c0000 pid=3188->guuid=740358cb-1600-0000-a4c2-24f8860c0000 pid=3206 clone guuid=26b85ecb-1600-0000-a4c2-24f8870c0000 pid=3207 /usr/bin/base64 write-file guuid=07f366c7-1600-0000-a4c2-24f8740c0000 pid=3188->guuid=26b85ecb-1600-0000-a4c2-24f8870c0000 pid=3207 execve guuid=0485d6cb-1600-0000-a4c2-24f8880c0000 pid=3208 /usr/bin/ls guuid=07f366c7-1600-0000-a4c2-24f8740c0000 pid=3188->guuid=0485d6cb-1600-0000-a4c2-24f8880c0000 pid=3208 execve guuid=d09774cc-1600-0000-a4c2-24f8890c0000 pid=3209 /usr/bin/cat guuid=07f366c7-1600-0000-a4c2-24f8740c0000 pid=3188->guuid=d09774cc-1600-0000-a4c2-24f8890c0000 pid=3209 execve guuid=1556d8cc-1600-0000-a4c2-24f88a0c0000 pid=3210 /usr/bin/ls guuid=07f366c7-1600-0000-a4c2-24f8740c0000 pid=3188->guuid=1556d8cc-1600-0000-a4c2-24f88a0c0000 pid=3210 execve
Score:
81%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/6cc800f0b3d0738f996454a5a587f63db0f979e6b923cc697b7e50ef6eb2d83e
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6cc800f0b3d0738f996454a5a587f63db0f979e6b923cc697b7e50ef6eb2d83e/
Verdict:
Malicious
Threat:
Trojan-Downloader.Shell.Agent
Link:
https://tip.neiki.dev/file/6cc800f0b3d0738f996454a5a587f63db0f979e6b923cc697b7e50ef6eb2d83e
Threat name:
Script-Shell.Trojan.Vigorf
Create hunting rule
Status:
Malicious
First seen:
2026-03-22 09:13:24 UTC
File Type:
Text (Shell)
AV detection:
13 of 24 (54.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nteab4ft2bzy7glekss2lb7whwyps6pgxer4y2l3pzio63vs3a7a._file
Result
Malware family:
n/a
Score:
  4/10
Tags:
defense_evasion discovery linux
Link:
https://tria.ge/reports/260322-k6vk7sds2q/
Behaviour
Reads runtime system information
Writes file to tmp directory
Deobfuscate/Decode Files or Information
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/6cc800f0b3d0738f996454a5a587f63db0f979e6b923cc697b7e50ef6eb2d83e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SUSP_LNX_Base64_Exec_Apr24
Create hunting rule
Author:Christian Burkard
Description:Detects suspicious base64 encoded shell commands (as seen in Palo Alto CVE-2024-3400 exploitation)
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 6cc800f0b3d0738f996454a5a587f63db0f979e6b923cc697b7e50ef6eb2d83e

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3792476/
  
Delivery method
Distributed via web download

Comments