🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8b1e618bd25e706963289818a580abc81cf15be89696c5f519e2a2e8ca348161. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8b1e618bd25e706963289818a580abc81cf15be89696c5f519e2a2e8ca348161
SHA3-384 hash: ab08d79e70fd95f3276c8ab56ece2d93f2d29d1ac11b2aaf13eab16addff1d4fb886a37a96cd83877d8995f74be71bf0
SHA1 hash: 08cbe9fd54818081513f3a640eda3b3e95d55b0e
MD5 hash: 6821cd8f80c0cb9f4c38a8d4b14fb11d
humanhash: vegan-mississippi-jupiter-pip
File name:ok
Download: download sample
File size:1'584 bytes
First seen:2026-06-18 07:40:23 UTC
Last seen:2026-06-18 12:53:34 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 24:PUNs8Q388QII8KClep3a30Xh5BmwsEGd2:d8y8rRtCe3a30Xhjmw5
TLSH T11B3190CB14292F391212CFDE73A3354DB00C96EB2D9BC795DC480EAA85884CCB162BD6
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://5.182.210.61/b847e9n/an/aua-wget
http://5.182.210.61/19aaf8n/an/aua-wget
http://5.182.210.61/6f60bfn/an/aua-wget
http://5.182.210.61/0d59d7n/an/aua-wget
http://5.182.210.61/00ba7an/an/aua-wget
http://5.182.210.61/ad252an/an/aua-wget
http://5.182.210.61/7c1260n/an/aua-wget
http://5.182.210.61/dae017n/an/aua-wget
http://5.182.210.61/bedaden/an/aua-wget
http://5.182.210.61/568fcan/an/aua-wget
http://5.182.210.61/bee8c3n/an/aua-wget
http://5.182.210.61/033c83n/an/aua-wget

Intelligence

File Origin
# of uploads :
2
# of downloads :
64
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive
Link:
https://www.filescan.io/uploads/6a33a117a419cb85d28c886e/reports/89ed3ecc-f074-4b0e-8112-e8ad8bb678da/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-06-18T04:52:00Z UTC
Last seen:
2026-06-19T21:46:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan-Downloader.Shell.Agent.a
Link:
https://opentip.kaspersky.com/8b1e618bd25e706963289818a580abc81cf15be89696c5f519e2a2e8ca348161/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/0ca02ec5-88f9-4f2e-b421-fc94386466d5
Behavior Graph:
Download SVG
%3 guuid=f4383e3c-1900-0000-5ce7-b4fd2d140000 pid=5165 /usr/bin/sudo guuid=9a30ec3e-1900-0000-5ce7-b4fd2e140000 pid=5166 /tmp/sample.bin guuid=f4383e3c-1900-0000-5ce7-b4fd2d140000 pid=5165->guuid=9a30ec3e-1900-0000-5ce7-b4fd2e140000 pid=5166 execve guuid=2d71e53f-1900-0000-5ce7-b4fd2f140000 pid=5167 /usr/bin/wget net send-data guuid=9a30ec3e-1900-0000-5ce7-b4fd2e140000 pid=5166->guuid=2d71e53f-1900-0000-5ce7-b4fd2f140000 pid=5167 execve guuid=889d094e-1900-0000-5ce7-b4fd35140000 pid=5173 /usr/bin/curl net send-data write-file guuid=9a30ec3e-1900-0000-5ce7-b4fd2e140000 pid=5166->guuid=889d094e-1900-0000-5ce7-b4fd35140000 pid=5173 execve guuid=aa3b4459-1900-0000-5ce7-b4fd37140000 pid=5175 /usr/bin/chmod guuid=9a30ec3e-1900-0000-5ce7-b4fd2e140000 pid=5166->guuid=aa3b4459-1900-0000-5ce7-b4fd37140000 pid=5175 execve guuid=62e9ba59-1900-0000-5ce7-b4fd38140000 pid=5176 /usr/bin/bash guuid=9a30ec3e-1900-0000-5ce7-b4fd2e140000 pid=5166->guuid=62e9ba59-1900-0000-5ce7-b4fd38140000 pid=5176 clone guuid=642a525a-1900-0000-5ce7-b4fd3a140000 pid=5178 /usr/bin/rm delete-file guuid=9a30ec3e-1900-0000-5ce7-b4fd2e140000 pid=5166->guuid=642a525a-1900-0000-5ce7-b4fd3a140000 pid=5178 execve guuid=27d4c05a-1900-0000-5ce7-b4fd3b140000 pid=5179 /usr/bin/rm guuid=9a30ec3e-1900-0000-5ce7-b4fd2e140000 pid=5166->guuid=27d4c05a-1900-0000-5ce7-b4fd3b140000 pid=5179 execve guuid=ff6f2b5b-1900-0000-5ce7-b4fd3c140000 pid=5180 /usr/bin/wget net send-data guuid=9a30ec3e-1900-0000-5ce7-b4fd2e140000 pid=5166->guuid=ff6f2b5b-1900-0000-5ce7-b4fd3c140000 pid=5180 execve guuid=126ce55f-1900-0000-5ce7-b4fd3d140000 pid=5181 /usr/bin/curl net send-data write-file guuid=9a30ec3e-1900-0000-5ce7-b4fd2e140000 pid=5166->guuid=126ce55f-1900-0000-5ce7-b4fd3d140000 pid=5181 execve guuid=aff0b966-1900-0000-5ce7-b4fd3e140000 pid=5182 /usr/bin/chmod guuid=9a30ec3e-1900-0000-5ce7-b4fd2e140000 pid=5166->guuid=aff0b966-1900-0000-5ce7-b4fd3e140000 pid=5182 execve guuid=f9936067-1900-0000-5ce7-b4fd3f140000 pid=5183 /usr/bin/bash guuid=9a30ec3e-1900-0000-5ce7-b4fd2e140000 pid=5166->guuid=f9936067-1900-0000-5ce7-b4fd3f140000 pid=5183 clone guuid=d772fa67-1900-0000-5ce7-b4fd41140000 pid=5185 /usr/bin/rm delete-file guuid=9a30ec3e-1900-0000-5ce7-b4fd2e140000 pid=5166->guuid=d772fa67-1900-0000-5ce7-b4fd41140000 pid=5185 execve guuid=8a3b9768-1900-0000-5ce7-b4fd42140000 pid=5186 /usr/bin/rm guuid=9a30ec3e-1900-0000-5ce7-b4fd2e140000 pid=5166->guuid=8a3b9768-1900-0000-5ce7-b4fd42140000 pid=5186 execve guuid=f5021a69-1900-0000-5ce7-b4fd43140000 pid=5187 /usr/bin/wget net send-data guuid=9a30ec3e-1900-0000-5ce7-b4fd2e140000 pid=5166->guuid=f5021a69-1900-0000-5ce7-b4fd43140000 pid=5187 execve guuid=c1cbfc6b-1900-0000-5ce7-b4fd44140000 pid=5188 /usr/bin/curl net send-data write-file guuid=9a30ec3e-1900-0000-5ce7-b4fd2e140000 pid=5166->guuid=c1cbfc6b-1900-0000-5ce7-b4fd44140000 pid=5188 execve guuid=b4e9397a-1900-0000-5ce7-b4fd45140000 pid=5189 /usr/bin/chmod guuid=9a30ec3e-1900-0000-5ce7-b4fd2e140000 pid=5166->guuid=b4e9397a-1900-0000-5ce7-b4fd45140000 pid=5189 execve guuid=53f2c57a-1900-0000-5ce7-b4fd46140000 pid=5190 /usr/bin/bash guuid=9a30ec3e-1900-0000-5ce7-b4fd2e140000 pid=5166->guuid=53f2c57a-1900-0000-5ce7-b4fd46140000 pid=5190 clone guuid=3505367b-1900-0000-5ce7-b4fd48140000 pid=5192 /usr/bin/rm delete-file guuid=9a30ec3e-1900-0000-5ce7-b4fd2e140000 pid=5166->guuid=3505367b-1900-0000-5ce7-b4fd48140000 pid=5192 execve guuid=cf01a77b-1900-0000-5ce7-b4fd49140000 pid=5193 /usr/bin/rm guuid=9a30ec3e-1900-0000-5ce7-b4fd2e140000 pid=5166->guuid=cf01a77b-1900-0000-5ce7-b4fd49140000 pid=5193 execve guuid=f855107c-1900-0000-5ce7-b4fd4a140000 pid=5194 /usr/bin/wget net send-data guuid=9a30ec3e-1900-0000-5ce7-b4fd2e140000 pid=5166->guuid=f855107c-1900-0000-5ce7-b4fd4a140000 pid=5194 execve guuid=6aff2f84-1900-0000-5ce7-b4fd4b140000 pid=5195 /usr/bin/curl net send-data write-file guuid=9a30ec3e-1900-0000-5ce7-b4fd2e140000 pid=5166->guuid=6aff2f84-1900-0000-5ce7-b4fd4b140000 pid=5195 execve guuid=b9cf8a8b-1900-0000-5ce7-b4fd4c140000 pid=5196 /usr/bin/chmod guuid=9a30ec3e-1900-0000-5ce7-b4fd2e140000 pid=5166->guuid=b9cf8a8b-1900-0000-5ce7-b4fd4c140000 pid=5196 execve guuid=c203828c-1900-0000-5ce7-b4fd4d140000 pid=5197 /usr/bin/bash guuid=9a30ec3e-1900-0000-5ce7-b4fd2e140000 pid=5166->guuid=c203828c-1900-0000-5ce7-b4fd4d140000 pid=5197 clone guuid=3184608d-1900-0000-5ce7-b4fd4f140000 pid=5199 /usr/bin/rm delete-file guuid=9a30ec3e-1900-0000-5ce7-b4fd2e140000 pid=5166->guuid=3184608d-1900-0000-5ce7-b4fd4f140000 pid=5199 execve guuid=9fa3e58d-1900-0000-5ce7-b4fd50140000 pid=5200 /usr/bin/rm guuid=9a30ec3e-1900-0000-5ce7-b4fd2e140000 pid=5166->guuid=9fa3e58d-1900-0000-5ce7-b4fd50140000 pid=5200 execve guuid=9680518e-1900-0000-5ce7-b4fd51140000 pid=5201 /usr/bin/wget net send-data guuid=9a30ec3e-1900-0000-5ce7-b4fd2e140000 pid=5166->guuid=9680518e-1900-0000-5ce7-b4fd51140000 pid=5201 execve guuid=a33c5892-1900-0000-5ce7-b4fd52140000 pid=5202 /usr/bin/curl net send-data write-file guuid=9a30ec3e-1900-0000-5ce7-b4fd2e140000 pid=5166->guuid=a33c5892-1900-0000-5ce7-b4fd52140000 pid=5202 execve guuid=9793b29c-1900-0000-5ce7-b4fd53140000 pid=5203 /usr/bin/chmod guuid=9a30ec3e-1900-0000-5ce7-b4fd2e140000 pid=5166->guuid=9793b29c-1900-0000-5ce7-b4fd53140000 pid=5203 execve guuid=180f209d-1900-0000-5ce7-b4fd54140000 pid=5204 /usr/bin/bash guuid=9a30ec3e-1900-0000-5ce7-b4fd2e140000 pid=5166->guuid=180f209d-1900-0000-5ce7-b4fd54140000 pid=5204 clone guuid=a88d8b9d-1900-0000-5ce7-b4fd56140000 pid=5206 /usr/bin/rm delete-file guuid=9a30ec3e-1900-0000-5ce7-b4fd2e140000 pid=5166->guuid=a88d8b9d-1900-0000-5ce7-b4fd56140000 pid=5206 execve guuid=45a4ff9d-1900-0000-5ce7-b4fd57140000 pid=5207 /usr/bin/rm guuid=9a30ec3e-1900-0000-5ce7-b4fd2e140000 pid=5166->guuid=45a4ff9d-1900-0000-5ce7-b4fd57140000 pid=5207 execve guuid=7f86659e-1900-0000-5ce7-b4fd58140000 pid=5208 /usr/bin/wget net send-data guuid=9a30ec3e-1900-0000-5ce7-b4fd2e140000 pid=5166->guuid=7f86659e-1900-0000-5ce7-b4fd58140000 pid=5208 execve guuid=0fcb62a1-1900-0000-5ce7-b4fd59140000 pid=5209 /usr/bin/curl net send-data write-file guuid=9a30ec3e-1900-0000-5ce7-b4fd2e140000 pid=5166->guuid=0fcb62a1-1900-0000-5ce7-b4fd59140000 pid=5209 execve guuid=509af7a5-1900-0000-5ce7-b4fd5a140000 pid=5210 /usr/bin/chmod guuid=9a30ec3e-1900-0000-5ce7-b4fd2e140000 pid=5166->guuid=509af7a5-1900-0000-5ce7-b4fd5a140000 pid=5210 execve guuid=42f65da6-1900-0000-5ce7-b4fd5b140000 pid=5211 /usr/bin/bash guuid=9a30ec3e-1900-0000-5ce7-b4fd2e140000 pid=5166->guuid=42f65da6-1900-0000-5ce7-b4fd5b140000 pid=5211 clone guuid=4770bfa6-1900-0000-5ce7-b4fd5d140000 pid=5213 /usr/bin/rm delete-file guuid=9a30ec3e-1900-0000-5ce7-b4fd2e140000 pid=5166->guuid=4770bfa6-1900-0000-5ce7-b4fd5d140000 pid=5213 execve guuid=d7691ca7-1900-0000-5ce7-b4fd5e140000 pid=5214 /usr/bin/rm guuid=9a30ec3e-1900-0000-5ce7-b4fd2e140000 pid=5166->guuid=d7691ca7-1900-0000-5ce7-b4fd5e140000 pid=5214 execve guuid=561378a7-1900-0000-5ce7-b4fd5f140000 pid=5215 /usr/bin/wget net send-data guuid=9a30ec3e-1900-0000-5ce7-b4fd2e140000 pid=5166->guuid=561378a7-1900-0000-5ce7-b4fd5f140000 pid=5215 execve guuid=77a812ab-1900-0000-5ce7-b4fd60140000 pid=5216 /usr/bin/curl net send-data write-file guuid=9a30ec3e-1900-0000-5ce7-b4fd2e140000 pid=5166->guuid=77a812ab-1900-0000-5ce7-b4fd60140000 pid=5216 execve guuid=38bb6ab2-1900-0000-5ce7-b4fd61140000 pid=5217 /usr/bin/chmod guuid=9a30ec3e-1900-0000-5ce7-b4fd2e140000 pid=5166->guuid=38bb6ab2-1900-0000-5ce7-b4fd61140000 pid=5217 execve guuid=7ecfd3b2-1900-0000-5ce7-b4fd62140000 pid=5218 /usr/bin/bash guuid=9a30ec3e-1900-0000-5ce7-b4fd2e140000 pid=5166->guuid=7ecfd3b2-1900-0000-5ce7-b4fd62140000 pid=5218 clone guuid=f36b81b3-1900-0000-5ce7-b4fd64140000 pid=5220 /usr/bin/rm delete-file guuid=9a30ec3e-1900-0000-5ce7-b4fd2e140000 pid=5166->guuid=f36b81b3-1900-0000-5ce7-b4fd64140000 pid=5220 execve guuid=a5a5f7b3-1900-0000-5ce7-b4fd65140000 pid=5221 /usr/bin/rm guuid=9a30ec3e-1900-0000-5ce7-b4fd2e140000 pid=5166->guuid=a5a5f7b3-1900-0000-5ce7-b4fd65140000 pid=5221 execve guuid=d544a1b4-1900-0000-5ce7-b4fd66140000 pid=5222 /usr/bin/wget net send-data guuid=9a30ec3e-1900-0000-5ce7-b4fd2e140000 pid=5166->guuid=d544a1b4-1900-0000-5ce7-b4fd66140000 pid=5222 execve guuid=5856b2b8-1900-0000-5ce7-b4fd67140000 pid=5223 /usr/bin/curl net send-data write-file guuid=9a30ec3e-1900-0000-5ce7-b4fd2e140000 pid=5166->guuid=5856b2b8-1900-0000-5ce7-b4fd67140000 pid=5223 execve guuid=20c187bf-1900-0000-5ce7-b4fd68140000 pid=5224 /usr/bin/chmod guuid=9a30ec3e-1900-0000-5ce7-b4fd2e140000 pid=5166->guuid=20c187bf-1900-0000-5ce7-b4fd68140000 pid=5224 execve guuid=eb4805c0-1900-0000-5ce7-b4fd69140000 pid=5225 /usr/bin/bash guuid=9a30ec3e-1900-0000-5ce7-b4fd2e140000 pid=5166->guuid=eb4805c0-1900-0000-5ce7-b4fd69140000 pid=5225 clone guuid=a11ebcc0-1900-0000-5ce7-b4fd6b140000 pid=5227 /usr/bin/rm delete-file guuid=9a30ec3e-1900-0000-5ce7-b4fd2e140000 pid=5166->guuid=a11ebcc0-1900-0000-5ce7-b4fd6b140000 pid=5227 execve guuid=bfff23c2-1900-0000-5ce7-b4fd6c140000 pid=5228 /usr/bin/rm guuid=9a30ec3e-1900-0000-5ce7-b4fd2e140000 pid=5166->guuid=bfff23c2-1900-0000-5ce7-b4fd6c140000 pid=5228 execve guuid=72b9a8c2-1900-0000-5ce7-b4fd6d140000 pid=5229 /usr/bin/wget net send-data guuid=9a30ec3e-1900-0000-5ce7-b4fd2e140000 pid=5166->guuid=72b9a8c2-1900-0000-5ce7-b4fd6d140000 pid=5229 execve guuid=42901dc8-1900-0000-5ce7-b4fd6e140000 pid=5230 /usr/bin/curl net send-data write-file guuid=9a30ec3e-1900-0000-5ce7-b4fd2e140000 pid=5166->guuid=42901dc8-1900-0000-5ce7-b4fd6e140000 pid=5230 execve guuid=0eb629d3-1900-0000-5ce7-b4fd6f140000 pid=5231 /usr/bin/chmod guuid=9a30ec3e-1900-0000-5ce7-b4fd2e140000 pid=5166->guuid=0eb629d3-1900-0000-5ce7-b4fd6f140000 pid=5231 execve guuid=2a2bbcd3-1900-0000-5ce7-b4fd70140000 pid=5232 /usr/bin/bash guuid=9a30ec3e-1900-0000-5ce7-b4fd2e140000 pid=5166->guuid=2a2bbcd3-1900-0000-5ce7-b4fd70140000 pid=5232 clone guuid=0d1d6bd4-1900-0000-5ce7-b4fd72140000 pid=5234 /usr/bin/rm delete-file guuid=9a30ec3e-1900-0000-5ce7-b4fd2e140000 pid=5166->guuid=0d1d6bd4-1900-0000-5ce7-b4fd72140000 pid=5234 execve guuid=0e5c70d7-1900-0000-5ce7-b4fd73140000 pid=5235 /usr/bin/rm guuid=9a30ec3e-1900-0000-5ce7-b4fd2e140000 pid=5166->guuid=0e5c70d7-1900-0000-5ce7-b4fd73140000 pid=5235 execve guuid=be4c05d8-1900-0000-5ce7-b4fd74140000 pid=5236 /usr/bin/wget net send-data guuid=9a30ec3e-1900-0000-5ce7-b4fd2e140000 pid=5166->guuid=be4c05d8-1900-0000-5ce7-b4fd74140000 pid=5236 execve guuid=25198cdb-1900-0000-5ce7-b4fd75140000 pid=5237 /usr/bin/curl net send-data write-file guuid=9a30ec3e-1900-0000-5ce7-b4fd2e140000 pid=5166->guuid=25198cdb-1900-0000-5ce7-b4fd75140000 pid=5237 execve guuid=56b93fe1-1900-0000-5ce7-b4fd76140000 pid=5238 /usr/bin/chmod guuid=9a30ec3e-1900-0000-5ce7-b4fd2e140000 pid=5166->guuid=56b93fe1-1900-0000-5ce7-b4fd76140000 pid=5238 execve guuid=07348fe1-1900-0000-5ce7-b4fd77140000 pid=5239 /usr/bin/bash guuid=9a30ec3e-1900-0000-5ce7-b4fd2e140000 pid=5166->guuid=07348fe1-1900-0000-5ce7-b4fd77140000 pid=5239 clone guuid=a6f6dde1-1900-0000-5ce7-b4fd79140000 pid=5241 /usr/bin/rm delete-file guuid=9a30ec3e-1900-0000-5ce7-b4fd2e140000 pid=5166->guuid=a6f6dde1-1900-0000-5ce7-b4fd79140000 pid=5241 execve guuid=685e41e2-1900-0000-5ce7-b4fd7a140000 pid=5242 /usr/bin/rm guuid=9a30ec3e-1900-0000-5ce7-b4fd2e140000 pid=5166->guuid=685e41e2-1900-0000-5ce7-b4fd7a140000 pid=5242 execve guuid=6ba3a6e2-1900-0000-5ce7-b4fd7b140000 pid=5243 /usr/bin/wget net send-data guuid=9a30ec3e-1900-0000-5ce7-b4fd2e140000 pid=5166->guuid=6ba3a6e2-1900-0000-5ce7-b4fd7b140000 pid=5243 execve guuid=2cef1ee9-1900-0000-5ce7-b4fd7c140000 pid=5244 /usr/bin/curl net send-data write-file guuid=9a30ec3e-1900-0000-5ce7-b4fd2e140000 pid=5166->guuid=2cef1ee9-1900-0000-5ce7-b4fd7c140000 pid=5244 execve guuid=24e00df1-1900-0000-5ce7-b4fd7d140000 pid=5245 /usr/bin/chmod guuid=9a30ec3e-1900-0000-5ce7-b4fd2e140000 pid=5166->guuid=24e00df1-1900-0000-5ce7-b4fd7d140000 pid=5245 execve guuid=6f77d6f1-1900-0000-5ce7-b4fd7e140000 pid=5246 /usr/bin/bash guuid=9a30ec3e-1900-0000-5ce7-b4fd2e140000 pid=5166->guuid=6f77d6f1-1900-0000-5ce7-b4fd7e140000 pid=5246 clone guuid=fe442ff2-1900-0000-5ce7-b4fd80140000 pid=5248 /usr/bin/rm delete-file guuid=9a30ec3e-1900-0000-5ce7-b4fd2e140000 pid=5166->guuid=fe442ff2-1900-0000-5ce7-b4fd80140000 pid=5248 execve guuid=bc59c5f2-1900-0000-5ce7-b4fd81140000 pid=5249 /usr/bin/rm guuid=9a30ec3e-1900-0000-5ce7-b4fd2e140000 pid=5166->guuid=bc59c5f2-1900-0000-5ce7-b4fd81140000 pid=5249 execve guuid=571e6df3-1900-0000-5ce7-b4fd82140000 pid=5250 /usr/bin/wget net send-data guuid=9a30ec3e-1900-0000-5ce7-b4fd2e140000 pid=5166->guuid=571e6df3-1900-0000-5ce7-b4fd82140000 pid=5250 execve guuid=16316cf8-1900-0000-5ce7-b4fd83140000 pid=5251 /usr/bin/curl net send-data write-file guuid=9a30ec3e-1900-0000-5ce7-b4fd2e140000 pid=5166->guuid=16316cf8-1900-0000-5ce7-b4fd83140000 pid=5251 execve guuid=8e4e94fd-1900-0000-5ce7-b4fd84140000 pid=5252 /usr/bin/chmod guuid=9a30ec3e-1900-0000-5ce7-b4fd2e140000 pid=5166->guuid=8e4e94fd-1900-0000-5ce7-b4fd84140000 pid=5252 execve guuid=45e211fe-1900-0000-5ce7-b4fd85140000 pid=5253 /usr/bin/bash guuid=9a30ec3e-1900-0000-5ce7-b4fd2e140000 pid=5166->guuid=45e211fe-1900-0000-5ce7-b4fd85140000 pid=5253 clone guuid=d4ccf7ff-1900-0000-5ce7-b4fd87140000 pid=5255 /usr/bin/rm delete-file guuid=9a30ec3e-1900-0000-5ce7-b4fd2e140000 pid=5166->guuid=d4ccf7ff-1900-0000-5ce7-b4fd87140000 pid=5255 execve guuid=f9377200-1a00-0000-5ce7-b4fd88140000 pid=5256 /usr/bin/rm guuid=9a30ec3e-1900-0000-5ce7-b4fd2e140000 pid=5166->guuid=f9377200-1a00-0000-5ce7-b4fd88140000 pid=5256 execve 9e33e6d7-6ac7-5a65-88f4-941337e56821 5.182.210.61:80 guuid=2d71e53f-1900-0000-5ce7-b4fd2f140000 pid=5167->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=889d094e-1900-0000-5ce7-b4fd35140000 pid=5173->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=a1ffe659-1900-0000-5ce7-b4fd39140000 pid=5177 /usr/bin/bash guuid=62e9ba59-1900-0000-5ce7-b4fd38140000 pid=5176->guuid=a1ffe659-1900-0000-5ce7-b4fd39140000 pid=5177 clone guuid=ff6f2b5b-1900-0000-5ce7-b4fd3c140000 pid=5180->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=126ce55f-1900-0000-5ce7-b4fd3d140000 pid=5181->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=f6fd9f67-1900-0000-5ce7-b4fd40140000 pid=5184 /usr/bin/bash guuid=f9936067-1900-0000-5ce7-b4fd3f140000 pid=5183->guuid=f6fd9f67-1900-0000-5ce7-b4fd40140000 pid=5184 clone guuid=f5021a69-1900-0000-5ce7-b4fd43140000 pid=5187->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=c1cbfc6b-1900-0000-5ce7-b4fd44140000 pid=5188->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=102ef27a-1900-0000-5ce7-b4fd47140000 pid=5191 /usr/bin/bash guuid=53f2c57a-1900-0000-5ce7-b4fd46140000 pid=5190->guuid=102ef27a-1900-0000-5ce7-b4fd47140000 pid=5191 clone guuid=f855107c-1900-0000-5ce7-b4fd4a140000 pid=5194->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=6aff2f84-1900-0000-5ce7-b4fd4b140000 pid=5195->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=d2fcb58c-1900-0000-5ce7-b4fd4e140000 pid=5198 /usr/bin/bash guuid=c203828c-1900-0000-5ce7-b4fd4d140000 pid=5197->guuid=d2fcb58c-1900-0000-5ce7-b4fd4e140000 pid=5198 clone guuid=9680518e-1900-0000-5ce7-b4fd51140000 pid=5201->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=a33c5892-1900-0000-5ce7-b4fd52140000 pid=5202->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=2aa2459d-1900-0000-5ce7-b4fd55140000 pid=5205 /usr/bin/bash guuid=180f209d-1900-0000-5ce7-b4fd54140000 pid=5204->guuid=2aa2459d-1900-0000-5ce7-b4fd55140000 pid=5205 clone guuid=7f86659e-1900-0000-5ce7-b4fd58140000 pid=5208->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=0fcb62a1-1900-0000-5ce7-b4fd59140000 pid=5209->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=159e81a6-1900-0000-5ce7-b4fd5c140000 pid=5212 /usr/bin/bash guuid=42f65da6-1900-0000-5ce7-b4fd5b140000 pid=5211->guuid=159e81a6-1900-0000-5ce7-b4fd5c140000 pid=5212 clone guuid=561378a7-1900-0000-5ce7-b4fd5f140000 pid=5215->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=77a812ab-1900-0000-5ce7-b4fd60140000 pid=5216->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=e47112b3-1900-0000-5ce7-b4fd63140000 pid=5219 /usr/bin/bash guuid=7ecfd3b2-1900-0000-5ce7-b4fd62140000 pid=5218->guuid=e47112b3-1900-0000-5ce7-b4fd63140000 pid=5219 clone guuid=d544a1b4-1900-0000-5ce7-b4fd66140000 pid=5222->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=5856b2b8-1900-0000-5ce7-b4fd67140000 pid=5223->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=d73f3fc0-1900-0000-5ce7-b4fd6a140000 pid=5226 /usr/bin/bash guuid=eb4805c0-1900-0000-5ce7-b4fd69140000 pid=5225->guuid=d73f3fc0-1900-0000-5ce7-b4fd6a140000 pid=5226 clone guuid=72b9a8c2-1900-0000-5ce7-b4fd6d140000 pid=5229->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=42901dc8-1900-0000-5ce7-b4fd6e140000 pid=5230->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=7c53e0d3-1900-0000-5ce7-b4fd71140000 pid=5233 /usr/bin/bash guuid=2a2bbcd3-1900-0000-5ce7-b4fd70140000 pid=5232->guuid=7c53e0d3-1900-0000-5ce7-b4fd71140000 pid=5233 clone guuid=be4c05d8-1900-0000-5ce7-b4fd74140000 pid=5236->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=25198cdb-1900-0000-5ce7-b4fd75140000 pid=5237->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=2399aee1-1900-0000-5ce7-b4fd78140000 pid=5240 /usr/bin/bash guuid=07348fe1-1900-0000-5ce7-b4fd77140000 pid=5239->guuid=2399aee1-1900-0000-5ce7-b4fd78140000 pid=5240 clone guuid=6ba3a6e2-1900-0000-5ce7-b4fd7b140000 pid=5243->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=2cef1ee9-1900-0000-5ce7-b4fd7c140000 pid=5244->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=91e602f2-1900-0000-5ce7-b4fd7f140000 pid=5247 /usr/bin/bash guuid=6f77d6f1-1900-0000-5ce7-b4fd7e140000 pid=5246->guuid=91e602f2-1900-0000-5ce7-b4fd7f140000 pid=5247 clone guuid=571e6df3-1900-0000-5ce7-b4fd82140000 pid=5250->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=16316cf8-1900-0000-5ce7-b4fd83140000 pid=5251->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=b3a15cfe-1900-0000-5ce7-b4fd86140000 pid=5254 /usr/bin/bash guuid=45e211fe-1900-0000-5ce7-b4fd85140000 pid=5253->guuid=b3a15cfe-1900-0000-5ce7-b4fd86140000 pid=5254 clone
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/8b1e618bd25e706963289818a580abc81cf15be89696c5f519e2a2e8ca348161
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8b1e618bd25e706963289818a580abc81cf15be89696c5f519e2a2e8ca348161/
Verdict:
Malicious
Threat:
Trojan-Downloader.Shell.Agent
Link:
https://tip.neiki.dev/file/8b1e618bd25e706963289818a580abc81cf15be89696c5f519e2a2e8ca348161
Threat name:
Win32.Trojan.Vigorf
Create hunting rule
Status:
Malicious
First seen:
2026-06-18 07:45:17 UTC
File Type:
Text (Shell)
AV detection:
11 of 24 (45.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rmpgdc6slzygsyzitamklaflzaopcw7is2lml5iz4krorsruqfqq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260618-jjfcbsfz6n/
Behaviour
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.11
Link:
https://yomi.yoroi.company/submissions/8b1e618bd25e706963289818a580abc81cf15be89696c5f519e2a2e8ca348161

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 8b1e618bd25e706963289818a580abc81cf15be89696c5f519e2a2e8ca348161

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3864548/
  
Delivery method
Distributed via web download

Comments