MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 833887196f6379a8a9bfb7d93dce0a7ac1eba6d63fb7338089b3f0704f5b35d2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 833887196f6379a8a9bfb7d93dce0a7ac1eba6d63fb7338089b3f0704f5b35d2
SHA3-384 hash: 5eb99e77fe3f7783cb5ddecb8a684ceaa77e6ee31cf978a2269db496a65934f2d73189b05f87dcbbcffaaf6d7dcd4719
SHA1 hash: 3da10ee196ac0d0938cf319ec99bc84ef6c90690
MD5 hash: b674ba469dcfcc3a624849068ec2cb6f
humanhash: wisconsin-xray-idaho-floor
File name:p
Download: download sample
File size:839 bytes
First seen:2026-06-19 14:25:32 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 24:kXCKysE2hi0ziQvZohaJUHAjraEERvOEo2s7:e9Qp+MsJUcraES02s7
TLSH T121018CCA86106910402A961E629731A0B410C3CE554A0F747F8C5E3DFBEC914B03AE94
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://129.121.114.124/c1Vn/an/aelf ua-wget
http://129.121.114.124/jDIn/an/aelf ua-wget
http://129.121.114.124/keajn/an/aelf ua-wget
http://129.121.114.124/vaW6n/an/aelf ua-wget
http://129.121.114.124/3j8Rn/an/aelf ua-wget

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive
Link:
https://www.filescan.io/uploads/6a35516690632a45f72d64b8/reports/06750282-99db-4998-9d97-6c06d2bf9ae2/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-06-19T11:35:00Z UTC
Last seen:
2026-06-20T23:22:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan-Downloader.Shell.Agent.a
Link:
https://opentip.kaspersky.com/833887196f6379a8a9bfb7d93dce0a7ac1eba6d63fb7338089b3f0704f5b35d2/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/4d78c245-f01f-4e8a-b52f-17ca3ae889b0
Behavior Graph:
Download SVG
%3 guuid=b0dd7b3a-1900-0000-c275-d7bc2c140000 pid=5164 /usr/bin/sudo guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165 /tmp/sample.bin write-file guuid=b0dd7b3a-1900-0000-c275-d7bc2c140000 pid=5164->guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165 execve guuid=7e31323e-1900-0000-c275-d7bc2e140000 pid=5166 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=7e31323e-1900-0000-c275-d7bc2e140000 pid=5166 execve guuid=a5542f3f-1900-0000-c275-d7bc2f140000 pid=5167 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=a5542f3f-1900-0000-c275-d7bc2f140000 pid=5167 execve guuid=64490840-1900-0000-c275-d7bc30140000 pid=5168 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=64490840-1900-0000-c275-d7bc30140000 pid=5168 execve guuid=6f797840-1900-0000-c275-d7bc31140000 pid=5169 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=6f797840-1900-0000-c275-d7bc31140000 pid=5169 execve guuid=3432e440-1900-0000-c275-d7bc32140000 pid=5170 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=3432e440-1900-0000-c275-d7bc32140000 pid=5170 execve guuid=6eabd341-1900-0000-c275-d7bc33140000 pid=5171 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=6eabd341-1900-0000-c275-d7bc33140000 pid=5171 execve guuid=93335942-1900-0000-c275-d7bc34140000 pid=5172 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=93335942-1900-0000-c275-d7bc34140000 pid=5172 execve guuid=3db8d442-1900-0000-c275-d7bc35140000 pid=5173 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=3db8d442-1900-0000-c275-d7bc35140000 pid=5173 execve guuid=52e44f43-1900-0000-c275-d7bc36140000 pid=5174 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=52e44f43-1900-0000-c275-d7bc36140000 pid=5174 execve guuid=bc9dc843-1900-0000-c275-d7bc37140000 pid=5175 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=bc9dc843-1900-0000-c275-d7bc37140000 pid=5175 execve guuid=06653244-1900-0000-c275-d7bc38140000 pid=5176 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=06653244-1900-0000-c275-d7bc38140000 pid=5176 execve guuid=ede79944-1900-0000-c275-d7bc39140000 pid=5177 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=ede79944-1900-0000-c275-d7bc39140000 pid=5177 execve guuid=77fd0845-1900-0000-c275-d7bc3a140000 pid=5178 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=77fd0845-1900-0000-c275-d7bc3a140000 pid=5178 execve guuid=15eeed45-1900-0000-c275-d7bc3b140000 pid=5179 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=15eeed45-1900-0000-c275-d7bc3b140000 pid=5179 execve guuid=6ddf6646-1900-0000-c275-d7bc3c140000 pid=5180 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=6ddf6646-1900-0000-c275-d7bc3c140000 pid=5180 execve guuid=ecd5dc46-1900-0000-c275-d7bc3d140000 pid=5181 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=ecd5dc46-1900-0000-c275-d7bc3d140000 pid=5181 execve guuid=079a7947-1900-0000-c275-d7bc3e140000 pid=5182 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=079a7947-1900-0000-c275-d7bc3e140000 pid=5182 execve guuid=68aef047-1900-0000-c275-d7bc3f140000 pid=5183 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=68aef047-1900-0000-c275-d7bc3f140000 pid=5183 execve guuid=d220b548-1900-0000-c275-d7bc40140000 pid=5184 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=d220b548-1900-0000-c275-d7bc40140000 pid=5184 execve guuid=a3e32249-1900-0000-c275-d7bc41140000 pid=5185 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=a3e32249-1900-0000-c275-d7bc41140000 pid=5185 execve guuid=64689949-1900-0000-c275-d7bc42140000 pid=5186 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=64689949-1900-0000-c275-d7bc42140000 pid=5186 execve guuid=1910084a-1900-0000-c275-d7bc43140000 pid=5187 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=1910084a-1900-0000-c275-d7bc43140000 pid=5187 execve guuid=65b3724a-1900-0000-c275-d7bc44140000 pid=5188 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=65b3724a-1900-0000-c275-d7bc44140000 pid=5188 execve guuid=73c3d84a-1900-0000-c275-d7bc45140000 pid=5189 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=73c3d84a-1900-0000-c275-d7bc45140000 pid=5189 execve guuid=18bb434b-1900-0000-c275-d7bc46140000 pid=5190 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=18bb434b-1900-0000-c275-d7bc46140000 pid=5190 execve guuid=ecdda54b-1900-0000-c275-d7bc47140000 pid=5191 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=ecdda54b-1900-0000-c275-d7bc47140000 pid=5191 execve guuid=adbf0b4c-1900-0000-c275-d7bc48140000 pid=5192 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=adbf0b4c-1900-0000-c275-d7bc48140000 pid=5192 execve guuid=20f56e4c-1900-0000-c275-d7bc49140000 pid=5193 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=20f56e4c-1900-0000-c275-d7bc49140000 pid=5193 execve guuid=6ac4d74c-1900-0000-c275-d7bc4a140000 pid=5194 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=6ac4d74c-1900-0000-c275-d7bc4a140000 pid=5194 execve guuid=edfb464d-1900-0000-c275-d7bc4b140000 pid=5195 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=edfb464d-1900-0000-c275-d7bc4b140000 pid=5195 execve guuid=db2ab54d-1900-0000-c275-d7bc4c140000 pid=5196 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=db2ab54d-1900-0000-c275-d7bc4c140000 pid=5196 execve guuid=5324274e-1900-0000-c275-d7bc4d140000 pid=5197 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=5324274e-1900-0000-c275-d7bc4d140000 pid=5197 execve guuid=163c9b4e-1900-0000-c275-d7bc4e140000 pid=5198 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=163c9b4e-1900-0000-c275-d7bc4e140000 pid=5198 execve guuid=7ca9054f-1900-0000-c275-d7bc4f140000 pid=5199 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=7ca9054f-1900-0000-c275-d7bc4f140000 pid=5199 execve guuid=d718d64f-1900-0000-c275-d7bc50140000 pid=5200 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=d718d64f-1900-0000-c275-d7bc50140000 pid=5200 execve guuid=2c156350-1900-0000-c275-d7bc51140000 pid=5201 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=2c156350-1900-0000-c275-d7bc51140000 pid=5201 execve guuid=032ced50-1900-0000-c275-d7bc52140000 pid=5202 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=032ced50-1900-0000-c275-d7bc52140000 pid=5202 execve guuid=885f6651-1900-0000-c275-d7bc53140000 pid=5203 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=885f6651-1900-0000-c275-d7bc53140000 pid=5203 execve guuid=617cdc51-1900-0000-c275-d7bc54140000 pid=5204 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=617cdc51-1900-0000-c275-d7bc54140000 pid=5204 execve guuid=ba7b4452-1900-0000-c275-d7bc55140000 pid=5205 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=ba7b4452-1900-0000-c275-d7bc55140000 pid=5205 execve guuid=b7edb252-1900-0000-c275-d7bc56140000 pid=5206 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=b7edb252-1900-0000-c275-d7bc56140000 pid=5206 execve guuid=3d0d2053-1900-0000-c275-d7bc57140000 pid=5207 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=3d0d2053-1900-0000-c275-d7bc57140000 pid=5207 execve guuid=af7c9253-1900-0000-c275-d7bc58140000 pid=5208 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=af7c9253-1900-0000-c275-d7bc58140000 pid=5208 execve guuid=90fdfa53-1900-0000-c275-d7bc59140000 pid=5209 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=90fdfa53-1900-0000-c275-d7bc59140000 pid=5209 execve guuid=60636454-1900-0000-c275-d7bc5a140000 pid=5210 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=60636454-1900-0000-c275-d7bc5a140000 pid=5210 execve guuid=c62bdd54-1900-0000-c275-d7bc5b140000 pid=5211 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=c62bdd54-1900-0000-c275-d7bc5b140000 pid=5211 execve guuid=ce255255-1900-0000-c275-d7bc5c140000 pid=5212 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=ce255255-1900-0000-c275-d7bc5c140000 pid=5212 execve guuid=21e7ca55-1900-0000-c275-d7bc5d140000 pid=5213 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=21e7ca55-1900-0000-c275-d7bc5d140000 pid=5213 execve guuid=cca64056-1900-0000-c275-d7bc5e140000 pid=5214 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=cca64056-1900-0000-c275-d7bc5e140000 pid=5214 execve guuid=9ccfba56-1900-0000-c275-d7bc5f140000 pid=5215 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=9ccfba56-1900-0000-c275-d7bc5f140000 pid=5215 execve guuid=c18e2d57-1900-0000-c275-d7bc60140000 pid=5216 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=c18e2d57-1900-0000-c275-d7bc60140000 pid=5216 execve guuid=58c9a257-1900-0000-c275-d7bc61140000 pid=5217 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=58c9a257-1900-0000-c275-d7bc61140000 pid=5217 execve guuid=b24f1158-1900-0000-c275-d7bc62140000 pid=5218 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=b24f1158-1900-0000-c275-d7bc62140000 pid=5218 execve guuid=db878658-1900-0000-c275-d7bc63140000 pid=5219 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=db878658-1900-0000-c275-d7bc63140000 pid=5219 execve guuid=cdf1fa58-1900-0000-c275-d7bc64140000 pid=5220 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=cdf1fa58-1900-0000-c275-d7bc64140000 pid=5220 execve guuid=b7097059-1900-0000-c275-d7bc65140000 pid=5221 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=b7097059-1900-0000-c275-d7bc65140000 pid=5221 execve guuid=c3efdf59-1900-0000-c275-d7bc66140000 pid=5222 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=c3efdf59-1900-0000-c275-d7bc66140000 pid=5222 execve guuid=f6404d5a-1900-0000-c275-d7bc67140000 pid=5223 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=f6404d5a-1900-0000-c275-d7bc67140000 pid=5223 execve guuid=8257c15a-1900-0000-c275-d7bc68140000 pid=5224 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=8257c15a-1900-0000-c275-d7bc68140000 pid=5224 execve guuid=7f35735b-1900-0000-c275-d7bc69140000 pid=5225 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=7f35735b-1900-0000-c275-d7bc69140000 pid=5225 execve guuid=ddb7dc5b-1900-0000-c275-d7bc6a140000 pid=5226 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=ddb7dc5b-1900-0000-c275-d7bc6a140000 pid=5226 execve guuid=b8ea685c-1900-0000-c275-d7bc6b140000 pid=5227 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=b8ea685c-1900-0000-c275-d7bc6b140000 pid=5227 execve guuid=030ddd5c-1900-0000-c275-d7bc6c140000 pid=5228 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=030ddd5c-1900-0000-c275-d7bc6c140000 pid=5228 execve guuid=b3334d5d-1900-0000-c275-d7bc6d140000 pid=5229 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=b3334d5d-1900-0000-c275-d7bc6d140000 pid=5229 execve guuid=0b39c25d-1900-0000-c275-d7bc6e140000 pid=5230 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=0b39c25d-1900-0000-c275-d7bc6e140000 pid=5230 execve guuid=67ae315e-1900-0000-c275-d7bc6f140000 pid=5231 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=67ae315e-1900-0000-c275-d7bc6f140000 pid=5231 execve guuid=4c46a45e-1900-0000-c275-d7bc70140000 pid=5232 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=4c46a45e-1900-0000-c275-d7bc70140000 pid=5232 execve guuid=18700f5f-1900-0000-c275-d7bc71140000 pid=5233 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=18700f5f-1900-0000-c275-d7bc71140000 pid=5233 execve guuid=f00e875f-1900-0000-c275-d7bc72140000 pid=5234 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=f00e875f-1900-0000-c275-d7bc72140000 pid=5234 execve guuid=0e352760-1900-0000-c275-d7bc73140000 pid=5235 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=0e352760-1900-0000-c275-d7bc73140000 pid=5235 execve guuid=10aa9660-1900-0000-c275-d7bc74140000 pid=5236 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=10aa9660-1900-0000-c275-d7bc74140000 pid=5236 execve guuid=a03b0561-1900-0000-c275-d7bc75140000 pid=5237 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=a03b0561-1900-0000-c275-d7bc75140000 pid=5237 execve guuid=f7617461-1900-0000-c275-d7bc76140000 pid=5238 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=f7617461-1900-0000-c275-d7bc76140000 pid=5238 execve guuid=38e4da61-1900-0000-c275-d7bc77140000 pid=5239 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=38e4da61-1900-0000-c275-d7bc77140000 pid=5239 execve guuid=0f4d4562-1900-0000-c275-d7bc78140000 pid=5240 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=0f4d4562-1900-0000-c275-d7bc78140000 pid=5240 execve guuid=4241b762-1900-0000-c275-d7bc79140000 pid=5241 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=4241b762-1900-0000-c275-d7bc79140000 pid=5241 execve guuid=eaa03163-1900-0000-c275-d7bc7a140000 pid=5242 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=eaa03163-1900-0000-c275-d7bc7a140000 pid=5242 execve guuid=0f73a563-1900-0000-c275-d7bc7b140000 pid=5243 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=0f73a563-1900-0000-c275-d7bc7b140000 pid=5243 execve guuid=d9042264-1900-0000-c275-d7bc7c140000 pid=5244 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=d9042264-1900-0000-c275-d7bc7c140000 pid=5244 execve guuid=4caf9b64-1900-0000-c275-d7bc7d140000 pid=5245 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=4caf9b64-1900-0000-c275-d7bc7d140000 pid=5245 execve guuid=e5e71865-1900-0000-c275-d7bc7e140000 pid=5246 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=e5e71865-1900-0000-c275-d7bc7e140000 pid=5246 execve guuid=54ad8c65-1900-0000-c275-d7bc7f140000 pid=5247 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=54ad8c65-1900-0000-c275-d7bc7f140000 pid=5247 execve guuid=df49fe65-1900-0000-c275-d7bc80140000 pid=5248 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=df49fe65-1900-0000-c275-d7bc80140000 pid=5248 execve guuid=7e3b7066-1900-0000-c275-d7bc81140000 pid=5249 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=7e3b7066-1900-0000-c275-d7bc81140000 pid=5249 execve guuid=2313de66-1900-0000-c275-d7bc82140000 pid=5250 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=2313de66-1900-0000-c275-d7bc82140000 pid=5250 execve guuid=017a4e67-1900-0000-c275-d7bc83140000 pid=5251 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=017a4e67-1900-0000-c275-d7bc83140000 pid=5251 execve guuid=1d0cc067-1900-0000-c275-d7bc84140000 pid=5252 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=1d0cc067-1900-0000-c275-d7bc84140000 pid=5252 execve guuid=69b72a68-1900-0000-c275-d7bc85140000 pid=5253 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=69b72a68-1900-0000-c275-d7bc85140000 pid=5253 execve guuid=5cab9368-1900-0000-c275-d7bc86140000 pid=5254 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=5cab9368-1900-0000-c275-d7bc86140000 pid=5254 execve guuid=16e6fc68-1900-0000-c275-d7bc87140000 pid=5255 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=16e6fc68-1900-0000-c275-d7bc87140000 pid=5255 execve guuid=8e906469-1900-0000-c275-d7bc88140000 pid=5256 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=8e906469-1900-0000-c275-d7bc88140000 pid=5256 execve guuid=95b6d169-1900-0000-c275-d7bc89140000 pid=5257 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=95b6d169-1900-0000-c275-d7bc89140000 pid=5257 execve guuid=d09c3b6a-1900-0000-c275-d7bc8a140000 pid=5258 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=d09c3b6a-1900-0000-c275-d7bc8a140000 pid=5258 execve guuid=b54dad6a-1900-0000-c275-d7bc8b140000 pid=5259 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=b54dad6a-1900-0000-c275-d7bc8b140000 pid=5259 execve guuid=1e97736c-1900-0000-c275-d7bc8c140000 pid=5260 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=1e97736c-1900-0000-c275-d7bc8c140000 pid=5260 execve guuid=9893556d-1900-0000-c275-d7bc8d140000 pid=5261 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=9893556d-1900-0000-c275-d7bc8d140000 pid=5261 execve guuid=28bf356e-1900-0000-c275-d7bc8e140000 pid=5262 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=28bf356e-1900-0000-c275-d7bc8e140000 pid=5262 execve guuid=38c0006f-1900-0000-c275-d7bc8f140000 pid=5263 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=38c0006f-1900-0000-c275-d7bc8f140000 pid=5263 execve guuid=a78b7b70-1900-0000-c275-d7bc90140000 pid=5264 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=a78b7b70-1900-0000-c275-d7bc90140000 pid=5264 execve guuid=cf432771-1900-0000-c275-d7bc91140000 pid=5265 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=cf432771-1900-0000-c275-d7bc91140000 pid=5265 execve guuid=026dd371-1900-0000-c275-d7bc92140000 pid=5266 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=026dd371-1900-0000-c275-d7bc92140000 pid=5266 execve guuid=6ddf5c72-1900-0000-c275-d7bc93140000 pid=5267 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=6ddf5c72-1900-0000-c275-d7bc93140000 pid=5267 execve guuid=2a6dcf72-1900-0000-c275-d7bc94140000 pid=5268 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=2a6dcf72-1900-0000-c275-d7bc94140000 pid=5268 execve guuid=877c4073-1900-0000-c275-d7bc95140000 pid=5269 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=877c4073-1900-0000-c275-d7bc95140000 pid=5269 execve guuid=a0efac73-1900-0000-c275-d7bc96140000 pid=5270 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=a0efac73-1900-0000-c275-d7bc96140000 pid=5270 execve guuid=6fec2374-1900-0000-c275-d7bc97140000 pid=5271 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=6fec2374-1900-0000-c275-d7bc97140000 pid=5271 execve guuid=c1c58e74-1900-0000-c275-d7bc98140000 pid=5272 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=c1c58e74-1900-0000-c275-d7bc98140000 pid=5272 execve guuid=79e9f974-1900-0000-c275-d7bc99140000 pid=5273 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=79e9f974-1900-0000-c275-d7bc99140000 pid=5273 execve guuid=88cc6075-1900-0000-c275-d7bc9a140000 pid=5274 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=88cc6075-1900-0000-c275-d7bc9a140000 pid=5274 execve guuid=cc8fcc75-1900-0000-c275-d7bc9b140000 pid=5275 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=cc8fcc75-1900-0000-c275-d7bc9b140000 pid=5275 execve guuid=32e63376-1900-0000-c275-d7bc9c140000 pid=5276 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=32e63376-1900-0000-c275-d7bc9c140000 pid=5276 execve guuid=c1a09576-1900-0000-c275-d7bc9d140000 pid=5277 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=c1a09576-1900-0000-c275-d7bc9d140000 pid=5277 execve guuid=df14fa76-1900-0000-c275-d7bc9e140000 pid=5278 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=df14fa76-1900-0000-c275-d7bc9e140000 pid=5278 execve guuid=fb185e77-1900-0000-c275-d7bc9f140000 pid=5279 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=fb185e77-1900-0000-c275-d7bc9f140000 pid=5279 execve guuid=db9dc077-1900-0000-c275-d7bca0140000 pid=5280 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=db9dc077-1900-0000-c275-d7bca0140000 pid=5280 execve guuid=e96b3278-1900-0000-c275-d7bca1140000 pid=5281 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=e96b3278-1900-0000-c275-d7bca1140000 pid=5281 execve guuid=99300779-1900-0000-c275-d7bca2140000 pid=5282 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=99300779-1900-0000-c275-d7bca2140000 pid=5282 execve guuid=cdd87979-1900-0000-c275-d7bca3140000 pid=5283 /usr/bin/ls guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=cdd87979-1900-0000-c275-d7bca3140000 pid=5283 execve guuid=0d60ea79-1900-0000-c275-d7bca4140000 pid=5284 /usr/bin/rm guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=0d60ea79-1900-0000-c275-d7bca4140000 pid=5284 execve guuid=785e2d7a-1900-0000-c275-d7bca5140000 pid=5285 /usr/bin/wget net send-data write-file guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=785e2d7a-1900-0000-c275-d7bca5140000 pid=5285 execve guuid=d38e3db6-1900-0000-c275-d7bca6140000 pid=5286 /usr/bin/chmod guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=d38e3db6-1900-0000-c275-d7bca6140000 pid=5286 execve guuid=b6f28ab6-1900-0000-c275-d7bca7140000 pid=5287 /tmp/c1V guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=b6f28ab6-1900-0000-c275-d7bca7140000 pid=5287 execve guuid=dd2c59b7-1900-0000-c275-d7bca9140000 pid=5289 /usr/bin/rm guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=dd2c59b7-1900-0000-c275-d7bca9140000 pid=5289 execve guuid=9f1e99b7-1900-0000-c275-d7bcaa140000 pid=5290 /usr/bin/wget net send-data write-file guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=9f1e99b7-1900-0000-c275-d7bcaa140000 pid=5290 execve guuid=8326acc4-1900-0000-c275-d7bcab140000 pid=5291 /usr/bin/chmod guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=8326acc4-1900-0000-c275-d7bcab140000 pid=5291 execve guuid=2beeefc4-1900-0000-c275-d7bcac140000 pid=5292 /tmp/jDI guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=2beeefc4-1900-0000-c275-d7bcac140000 pid=5292 execve guuid=6ce3aac5-1900-0000-c275-d7bcae140000 pid=5294 /usr/bin/rm guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=6ce3aac5-1900-0000-c275-d7bcae140000 pid=5294 execve guuid=a7ebeec5-1900-0000-c275-d7bcaf140000 pid=5295 /usr/bin/wget net send-data write-file guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=a7ebeec5-1900-0000-c275-d7bcaf140000 pid=5295 execve guuid=5ae3bfd2-1900-0000-c275-d7bcb0140000 pid=5296 /usr/bin/chmod guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=5ae3bfd2-1900-0000-c275-d7bcb0140000 pid=5296 execve guuid=b035f5d3-1900-0000-c275-d7bcb1140000 pid=5297 /tmp/keaj guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=b035f5d3-1900-0000-c275-d7bcb1140000 pid=5297 execve guuid=e3fc12d5-1900-0000-c275-d7bcb3140000 pid=5299 /usr/bin/rm guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=e3fc12d5-1900-0000-c275-d7bcb3140000 pid=5299 execve guuid=1fea53d5-1900-0000-c275-d7bcb4140000 pid=5300 /usr/bin/wget net send-data write-file guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=1fea53d5-1900-0000-c275-d7bcb4140000 pid=5300 execve guuid=7d919be2-1900-0000-c275-d7bcb5140000 pid=5301 /usr/bin/chmod guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=7d919be2-1900-0000-c275-d7bcb5140000 pid=5301 execve guuid=0df9f0e2-1900-0000-c275-d7bcb6140000 pid=5302 /tmp/vaW6 guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=0df9f0e2-1900-0000-c275-d7bcb6140000 pid=5302 execve guuid=a8c4b6e3-1900-0000-c275-d7bcb8140000 pid=5304 /usr/bin/rm guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=a8c4b6e3-1900-0000-c275-d7bcb8140000 pid=5304 execve guuid=975e00e4-1900-0000-c275-d7bcb9140000 pid=5305 /usr/bin/wget net send-data write-file guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=975e00e4-1900-0000-c275-d7bcb9140000 pid=5305 execve guuid=f6da80f1-1900-0000-c275-d7bcba140000 pid=5306 /usr/bin/chmod guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=f6da80f1-1900-0000-c275-d7bcba140000 pid=5306 execve guuid=6af5fdf2-1900-0000-c275-d7bcbb140000 pid=5307 /tmp/3j8R guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=6af5fdf2-1900-0000-c275-d7bcbb140000 pid=5307 execve guuid=f3e443f6-1900-0000-c275-d7bcbd140000 pid=5309 /usr/bin/rm delete-file guuid=338d6b3c-1900-0000-c275-d7bc2d140000 pid=5165->guuid=f3e443f6-1900-0000-c275-d7bcbd140000 pid=5309 execve 801186e6-5fe8-5959-a7b4-832d8d66e7aa 129.121.114.124:80 guuid=785e2d7a-1900-0000-c275-d7bca5140000 pid=5285->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 133B guuid=9f1e99b7-1900-0000-c275-d7bcaa140000 pid=5290->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 133B guuid=a7ebeec5-1900-0000-c275-d7bcaf140000 pid=5295->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 134B guuid=1fea53d5-1900-0000-c275-d7bcb4140000 pid=5300->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 134B guuid=975e00e4-1900-0000-c275-d7bcb9140000 pid=5305->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 134B
Score:
97%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/833887196f6379a8a9bfb7d93dce0a7ac1eba6d63fb7338089b3f0704f5b35d2
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/833887196f6379a8a9bfb7d93dce0a7ac1eba6d63fb7338089b3f0704f5b35d2/
Verdict:
Malicious
Threat:
Family.MIRAI
Link:
https://tip.neiki.dev/file/833887196f6379a8a9bfb7d93dce0a7ac1eba6d63fb7338089b3f0704f5b35d2
Threat name:
Win32.Trojan.Vigorf
Create hunting rule
Status:
Malicious
First seen:
2026-06-19 14:26:41 UTC
File Type:
Text (Shell)
AV detection:
9 of 23 (39.13%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=qm4ioglpmn42rkn7w7mt3tqkpla6xjwwh63thaejwpyhat23gxja._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
discovery linux
Link:
https://tria.ge/reports/260619-rrm15sgx7n/
Behaviour
Reads runtime system information
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.26
Link:
https://yomi.yoroi.company/submissions/833887196f6379a8a9bfb7d93dce0a7ac1eba6d63fb7338089b3f0704f5b35d2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 833887196f6379a8a9bfb7d93dce0a7ac1eba6d63fb7338089b3f0704f5b35d2

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3866369/
  
Delivery method
Distributed via web download

Comments