🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 93b3d9b30c6463e043fd1d6a3fc9348827b5b86a67bc5520803e23ea8352044e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 93b3d9b30c6463e043fd1d6a3fc9348827b5b86a67bc5520803e23ea8352044e
SHA3-384 hash: 64d51603b47590d423f2c5ff0b3d92c1803d49476a9e5af51d5701dfa25912792483013d9e7aef6e63fa58277281834a
SHA1 hash: db0af497aa5e7b27f02eae4da72ff7dc7857c1fc
MD5 hash: 93eea51429b0c73740bacda98d8a74a8
humanhash: october-march-video-vermont
File name:p
Download: download sample
File size:835 bytes
First seen:2026-06-20 16:06:32 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 24:kXCKysE2hi0ziQvZoha5wWNI9SW9qvJ/gG7:e9Qp+Ms5Pu9SW90gG7
TLSH T1CA018CCA8600AD004029A66F26A75290B810C3CF568A0FB87F9C5D2DF7D9914B066E98
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://129.121.114.124/0UKXn/an/aelf ua-wget
http://129.121.114.124/tB3n/an/aelf ua-wget
http://129.121.114.124/g0Gn/an/aelf ua-wget
http://129.121.114.124/vl0n/an/aelf ua-wget
http://129.121.114.124/Qkbbn/an/aelf ua-wget

Intelligence

File Origin
# of uploads :
1
# of downloads :
45
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
File Type:
unix shell
First seen:
2026-06-20T13:14:00Z UTC
Last seen:
2026-06-21T01:39:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan-Downloader.Shell.Agent.a
Link:
https://opentip.kaspersky.com/93b3d9b30c6463e043fd1d6a3fc9348827b5b86a67bc5520803e23ea8352044e/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/e2639823-1d22-4bac-aaa9-48457afef5a0
Behavior Graph:
Download SVG
%3 guuid=d85e584c-1a00-0000-bc7f-41ef280c0000 pid=3112 /usr/bin/sudo guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118 /tmp/sample.bin write-file guuid=d85e584c-1a00-0000-bc7f-41ef280c0000 pid=3112->guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118 execve guuid=15185450-1a00-0000-bc7f-41ef300c0000 pid=3120 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=15185450-1a00-0000-bc7f-41ef300c0000 pid=3120 execve guuid=76fdab51-1a00-0000-bc7f-41ef320c0000 pid=3122 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=76fdab51-1a00-0000-bc7f-41ef320c0000 pid=3122 execve guuid=c3166852-1a00-0000-bc7f-41ef340c0000 pid=3124 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=c3166852-1a00-0000-bc7f-41ef340c0000 pid=3124 execve guuid=ab0a4953-1a00-0000-bc7f-41ef350c0000 pid=3125 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=ab0a4953-1a00-0000-bc7f-41ef350c0000 pid=3125 execve guuid=1b472654-1a00-0000-bc7f-41ef360c0000 pid=3126 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=1b472654-1a00-0000-bc7f-41ef360c0000 pid=3126 execve guuid=dc4ce654-1a00-0000-bc7f-41ef390c0000 pid=3129 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=dc4ce654-1a00-0000-bc7f-41ef390c0000 pid=3129 execve guuid=729e9855-1a00-0000-bc7f-41ef3c0c0000 pid=3132 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=729e9855-1a00-0000-bc7f-41ef3c0c0000 pid=3132 execve guuid=c9353b56-1a00-0000-bc7f-41ef3f0c0000 pid=3135 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=c9353b56-1a00-0000-bc7f-41ef3f0c0000 pid=3135 execve guuid=1222d856-1a00-0000-bc7f-41ef400c0000 pid=3136 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=1222d856-1a00-0000-bc7f-41ef400c0000 pid=3136 execve guuid=6a8e8c57-1a00-0000-bc7f-41ef410c0000 pid=3137 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=6a8e8c57-1a00-0000-bc7f-41ef410c0000 pid=3137 execve guuid=c0e15558-1a00-0000-bc7f-41ef420c0000 pid=3138 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=c0e15558-1a00-0000-bc7f-41ef420c0000 pid=3138 execve guuid=73073c59-1a00-0000-bc7f-41ef430c0000 pid=3139 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=73073c59-1a00-0000-bc7f-41ef430c0000 pid=3139 execve guuid=34d5045a-1a00-0000-bc7f-41ef440c0000 pid=3140 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=34d5045a-1a00-0000-bc7f-41ef440c0000 pid=3140 execve guuid=1b03155b-1a00-0000-bc7f-41ef450c0000 pid=3141 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=1b03155b-1a00-0000-bc7f-41ef450c0000 pid=3141 execve guuid=b3ba025c-1a00-0000-bc7f-41ef460c0000 pid=3142 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=b3ba025c-1a00-0000-bc7f-41ef460c0000 pid=3142 execve guuid=08b5f55c-1a00-0000-bc7f-41ef470c0000 pid=3143 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=08b5f55c-1a00-0000-bc7f-41ef470c0000 pid=3143 execve guuid=82cbd85d-1a00-0000-bc7f-41ef480c0000 pid=3144 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=82cbd85d-1a00-0000-bc7f-41ef480c0000 pid=3144 execve guuid=a642815e-1a00-0000-bc7f-41ef490c0000 pid=3145 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=a642815e-1a00-0000-bc7f-41ef490c0000 pid=3145 execve guuid=ac0d0d5f-1a00-0000-bc7f-41ef4a0c0000 pid=3146 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=ac0d0d5f-1a00-0000-bc7f-41ef4a0c0000 pid=3146 execve guuid=6dc6b45f-1a00-0000-bc7f-41ef4b0c0000 pid=3147 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=6dc6b45f-1a00-0000-bc7f-41ef4b0c0000 pid=3147 execve guuid=f34c6760-1a00-0000-bc7f-41ef4c0c0000 pid=3148 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=f34c6760-1a00-0000-bc7f-41ef4c0c0000 pid=3148 execve guuid=ed776e61-1a00-0000-bc7f-41ef4d0c0000 pid=3149 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=ed776e61-1a00-0000-bc7f-41ef4d0c0000 pid=3149 execve guuid=16858862-1a00-0000-bc7f-41ef4e0c0000 pid=3150 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=16858862-1a00-0000-bc7f-41ef4e0c0000 pid=3150 execve guuid=242b8363-1a00-0000-bc7f-41ef4f0c0000 pid=3151 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=242b8363-1a00-0000-bc7f-41ef4f0c0000 pid=3151 execve guuid=11bc5b64-1a00-0000-bc7f-41ef500c0000 pid=3152 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=11bc5b64-1a00-0000-bc7f-41ef500c0000 pid=3152 execve guuid=6c966b65-1a00-0000-bc7f-41ef510c0000 pid=3153 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=6c966b65-1a00-0000-bc7f-41ef510c0000 pid=3153 execve guuid=214d0b66-1a00-0000-bc7f-41ef520c0000 pid=3154 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=214d0b66-1a00-0000-bc7f-41ef520c0000 pid=3154 execve guuid=3086a766-1a00-0000-bc7f-41ef530c0000 pid=3155 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=3086a766-1a00-0000-bc7f-41ef530c0000 pid=3155 execve guuid=7fd44c67-1a00-0000-bc7f-41ef540c0000 pid=3156 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=7fd44c67-1a00-0000-bc7f-41ef540c0000 pid=3156 execve guuid=cfb2e567-1a00-0000-bc7f-41ef550c0000 pid=3157 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=cfb2e567-1a00-0000-bc7f-41ef550c0000 pid=3157 execve guuid=78b8bd68-1a00-0000-bc7f-41ef560c0000 pid=3158 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=78b8bd68-1a00-0000-bc7f-41ef560c0000 pid=3158 execve guuid=91a45f69-1a00-0000-bc7f-41ef570c0000 pid=3159 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=91a45f69-1a00-0000-bc7f-41ef570c0000 pid=3159 execve guuid=317a496a-1a00-0000-bc7f-41ef580c0000 pid=3160 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=317a496a-1a00-0000-bc7f-41ef580c0000 pid=3160 execve guuid=ea7fdf6a-1a00-0000-bc7f-41ef590c0000 pid=3161 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=ea7fdf6a-1a00-0000-bc7f-41ef590c0000 pid=3161 execve guuid=9095866b-1a00-0000-bc7f-41ef5a0c0000 pid=3162 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=9095866b-1a00-0000-bc7f-41ef5a0c0000 pid=3162 execve guuid=a650436c-1a00-0000-bc7f-41ef5b0c0000 pid=3163 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=a650436c-1a00-0000-bc7f-41ef5b0c0000 pid=3163 execve guuid=1ac3fa6c-1a00-0000-bc7f-41ef5c0c0000 pid=3164 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=1ac3fa6c-1a00-0000-bc7f-41ef5c0c0000 pid=3164 execve guuid=a352f46d-1a00-0000-bc7f-41ef5e0c0000 pid=3166 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=a352f46d-1a00-0000-bc7f-41ef5e0c0000 pid=3166 execve guuid=9487c06e-1a00-0000-bc7f-41ef5f0c0000 pid=3167 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=9487c06e-1a00-0000-bc7f-41ef5f0c0000 pid=3167 execve guuid=2fb9a06f-1a00-0000-bc7f-41ef600c0000 pid=3168 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=2fb9a06f-1a00-0000-bc7f-41ef600c0000 pid=3168 execve guuid=7c2f5770-1a00-0000-bc7f-41ef620c0000 pid=3170 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=7c2f5770-1a00-0000-bc7f-41ef620c0000 pid=3170 execve guuid=444ad470-1a00-0000-bc7f-41ef640c0000 pid=3172 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=444ad470-1a00-0000-bc7f-41ef640c0000 pid=3172 execve guuid=07bd7571-1a00-0000-bc7f-41ef670c0000 pid=3175 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=07bd7571-1a00-0000-bc7f-41ef670c0000 pid=3175 execve guuid=65eaf471-1a00-0000-bc7f-41ef690c0000 pid=3177 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=65eaf471-1a00-0000-bc7f-41ef690c0000 pid=3177 execve guuid=b9706372-1a00-0000-bc7f-41ef6b0c0000 pid=3179 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=b9706372-1a00-0000-bc7f-41ef6b0c0000 pid=3179 execve guuid=7e6d0473-1a00-0000-bc7f-41ef6d0c0000 pid=3181 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=7e6d0473-1a00-0000-bc7f-41ef6d0c0000 pid=3181 execve guuid=15039c73-1a00-0000-bc7f-41ef6f0c0000 pid=3183 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=15039c73-1a00-0000-bc7f-41ef6f0c0000 pid=3183 execve guuid=54894474-1a00-0000-bc7f-41ef710c0000 pid=3185 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=54894474-1a00-0000-bc7f-41ef710c0000 pid=3185 execve guuid=06404075-1a00-0000-bc7f-41ef720c0000 pid=3186 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=06404075-1a00-0000-bc7f-41ef720c0000 pid=3186 execve guuid=a604c375-1a00-0000-bc7f-41ef730c0000 pid=3187 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=a604c375-1a00-0000-bc7f-41ef730c0000 pid=3187 execve guuid=58432f76-1a00-0000-bc7f-41ef750c0000 pid=3189 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=58432f76-1a00-0000-bc7f-41ef750c0000 pid=3189 execve guuid=10edc276-1a00-0000-bc7f-41ef780c0000 pid=3192 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=10edc276-1a00-0000-bc7f-41ef780c0000 pid=3192 execve guuid=18a65c77-1a00-0000-bc7f-41ef7b0c0000 pid=3195 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=18a65c77-1a00-0000-bc7f-41ef7b0c0000 pid=3195 execve guuid=455dca77-1a00-0000-bc7f-41ef7d0c0000 pid=3197 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=455dca77-1a00-0000-bc7f-41ef7d0c0000 pid=3197 execve guuid=b93c3978-1a00-0000-bc7f-41ef7f0c0000 pid=3199 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=b93c3978-1a00-0000-bc7f-41ef7f0c0000 pid=3199 execve guuid=ac46e278-1a00-0000-bc7f-41ef810c0000 pid=3201 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=ac46e278-1a00-0000-bc7f-41ef810c0000 pid=3201 execve guuid=86b78879-1a00-0000-bc7f-41ef830c0000 pid=3203 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=86b78879-1a00-0000-bc7f-41ef830c0000 pid=3203 execve guuid=583f137a-1a00-0000-bc7f-41ef850c0000 pid=3205 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=583f137a-1a00-0000-bc7f-41ef850c0000 pid=3205 execve guuid=b4c69d7a-1a00-0000-bc7f-41ef880c0000 pid=3208 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=b4c69d7a-1a00-0000-bc7f-41ef880c0000 pid=3208 execve guuid=9de45c7b-1a00-0000-bc7f-41ef8a0c0000 pid=3210 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=9de45c7b-1a00-0000-bc7f-41ef8a0c0000 pid=3210 execve guuid=ce2ede7b-1a00-0000-bc7f-41ef8d0c0000 pid=3213 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=ce2ede7b-1a00-0000-bc7f-41ef8d0c0000 pid=3213 execve guuid=9fb3567c-1a00-0000-bc7f-41ef8e0c0000 pid=3214 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=9fb3567c-1a00-0000-bc7f-41ef8e0c0000 pid=3214 execve guuid=03d52f7d-1a00-0000-bc7f-41ef8f0c0000 pid=3215 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=03d52f7d-1a00-0000-bc7f-41ef8f0c0000 pid=3215 execve guuid=2a1ecc7d-1a00-0000-bc7f-41ef910c0000 pid=3217 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=2a1ecc7d-1a00-0000-bc7f-41ef910c0000 pid=3217 execve guuid=4481687e-1a00-0000-bc7f-41ef920c0000 pid=3218 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=4481687e-1a00-0000-bc7f-41ef920c0000 pid=3218 execve guuid=5f97f57e-1a00-0000-bc7f-41ef930c0000 pid=3219 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=5f97f57e-1a00-0000-bc7f-41ef930c0000 pid=3219 execve guuid=8eca647f-1a00-0000-bc7f-41ef960c0000 pid=3222 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=8eca647f-1a00-0000-bc7f-41ef960c0000 pid=3222 execve guuid=40e40380-1a00-0000-bc7f-41ef990c0000 pid=3225 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=40e40380-1a00-0000-bc7f-41ef990c0000 pid=3225 execve guuid=6bf89c80-1a00-0000-bc7f-41ef9b0c0000 pid=3227 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=6bf89c80-1a00-0000-bc7f-41ef9b0c0000 pid=3227 execve guuid=d1621581-1a00-0000-bc7f-41ef9d0c0000 pid=3229 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=d1621581-1a00-0000-bc7f-41ef9d0c0000 pid=3229 execve guuid=79f68d81-1a00-0000-bc7f-41ef9f0c0000 pid=3231 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=79f68d81-1a00-0000-bc7f-41ef9f0c0000 pid=3231 execve guuid=a5a40a82-1a00-0000-bc7f-41efa10c0000 pid=3233 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=a5a40a82-1a00-0000-bc7f-41efa10c0000 pid=3233 execve guuid=e7018382-1a00-0000-bc7f-41efa30c0000 pid=3235 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=e7018382-1a00-0000-bc7f-41efa30c0000 pid=3235 execve guuid=cc592383-1a00-0000-bc7f-41efa50c0000 pid=3237 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=cc592383-1a00-0000-bc7f-41efa50c0000 pid=3237 execve guuid=3e6ec583-1a00-0000-bc7f-41efa60c0000 pid=3238 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=3e6ec583-1a00-0000-bc7f-41efa60c0000 pid=3238 execve guuid=51f77c84-1a00-0000-bc7f-41efa70c0000 pid=3239 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=51f77c84-1a00-0000-bc7f-41efa70c0000 pid=3239 execve guuid=285a4485-1a00-0000-bc7f-41efa80c0000 pid=3240 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=285a4485-1a00-0000-bc7f-41efa80c0000 pid=3240 execve guuid=f19f2186-1a00-0000-bc7f-41efa90c0000 pid=3241 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=f19f2186-1a00-0000-bc7f-41efa90c0000 pid=3241 execve guuid=78befe86-1a00-0000-bc7f-41efaa0c0000 pid=3242 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=78befe86-1a00-0000-bc7f-41efaa0c0000 pid=3242 execve guuid=2187c287-1a00-0000-bc7f-41efab0c0000 pid=3243 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=2187c287-1a00-0000-bc7f-41efab0c0000 pid=3243 execve guuid=9e217988-1a00-0000-bc7f-41efac0c0000 pid=3244 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=9e217988-1a00-0000-bc7f-41efac0c0000 pid=3244 execve guuid=62c73789-1a00-0000-bc7f-41efad0c0000 pid=3245 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=62c73789-1a00-0000-bc7f-41efad0c0000 pid=3245 execve guuid=3ebee689-1a00-0000-bc7f-41efae0c0000 pid=3246 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=3ebee689-1a00-0000-bc7f-41efae0c0000 pid=3246 execve guuid=0dc8d58a-1a00-0000-bc7f-41efaf0c0000 pid=3247 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=0dc8d58a-1a00-0000-bc7f-41efaf0c0000 pid=3247 execve guuid=04f5a48b-1a00-0000-bc7f-41efb00c0000 pid=3248 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=04f5a48b-1a00-0000-bc7f-41efb00c0000 pid=3248 execve guuid=57968b8c-1a00-0000-bc7f-41efb10c0000 pid=3249 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=57968b8c-1a00-0000-bc7f-41efb10c0000 pid=3249 execve guuid=2e69b08d-1a00-0000-bc7f-41efb20c0000 pid=3250 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=2e69b08d-1a00-0000-bc7f-41efb20c0000 pid=3250 execve guuid=6db6778e-1a00-0000-bc7f-41efb30c0000 pid=3251 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=6db6778e-1a00-0000-bc7f-41efb30c0000 pid=3251 execve guuid=1f247a8f-1a00-0000-bc7f-41efb40c0000 pid=3252 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=1f247a8f-1a00-0000-bc7f-41efb40c0000 pid=3252 execve guuid=f1995490-1a00-0000-bc7f-41efb50c0000 pid=3253 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=f1995490-1a00-0000-bc7f-41efb50c0000 pid=3253 execve guuid=82f53991-1a00-0000-bc7f-41efb60c0000 pid=3254 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=82f53991-1a00-0000-bc7f-41efb60c0000 pid=3254 execve guuid=edd2d191-1a00-0000-bc7f-41efb70c0000 pid=3255 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=edd2d191-1a00-0000-bc7f-41efb70c0000 pid=3255 execve guuid=dddf8192-1a00-0000-bc7f-41efb80c0000 pid=3256 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=dddf8192-1a00-0000-bc7f-41efb80c0000 pid=3256 execve guuid=0c147293-1a00-0000-bc7f-41efb90c0000 pid=3257 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=0c147293-1a00-0000-bc7f-41efb90c0000 pid=3257 execve guuid=0ff65494-1a00-0000-bc7f-41efba0c0000 pid=3258 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=0ff65494-1a00-0000-bc7f-41efba0c0000 pid=3258 execve guuid=fcba5895-1a00-0000-bc7f-41efbb0c0000 pid=3259 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=fcba5895-1a00-0000-bc7f-41efbb0c0000 pid=3259 execve guuid=d88e3b96-1a00-0000-bc7f-41efbc0c0000 pid=3260 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=d88e3b96-1a00-0000-bc7f-41efbc0c0000 pid=3260 execve guuid=cb1f1697-1a00-0000-bc7f-41efbd0c0000 pid=3261 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=cb1f1697-1a00-0000-bc7f-41efbd0c0000 pid=3261 execve guuid=3ae23a98-1a00-0000-bc7f-41efbe0c0000 pid=3262 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=3ae23a98-1a00-0000-bc7f-41efbe0c0000 pid=3262 execve guuid=f77aee98-1a00-0000-bc7f-41efbf0c0000 pid=3263 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=f77aee98-1a00-0000-bc7f-41efbf0c0000 pid=3263 execve guuid=56f0d599-1a00-0000-bc7f-41efc00c0000 pid=3264 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=56f0d599-1a00-0000-bc7f-41efc00c0000 pid=3264 execve guuid=6762a89a-1a00-0000-bc7f-41efc10c0000 pid=3265 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=6762a89a-1a00-0000-bc7f-41efc10c0000 pid=3265 execve guuid=1b571a9b-1a00-0000-bc7f-41efc30c0000 pid=3267 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=1b571a9b-1a00-0000-bc7f-41efc30c0000 pid=3267 execve guuid=50329e9b-1a00-0000-bc7f-41efc40c0000 pid=3268 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=50329e9b-1a00-0000-bc7f-41efc40c0000 pid=3268 execve guuid=db5c769c-1a00-0000-bc7f-41efc50c0000 pid=3269 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=db5c769c-1a00-0000-bc7f-41efc50c0000 pid=3269 execve guuid=c301789d-1a00-0000-bc7f-41efc70c0000 pid=3271 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=c301789d-1a00-0000-bc7f-41efc70c0000 pid=3271 execve guuid=52f9ed9d-1a00-0000-bc7f-41efc90c0000 pid=3273 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=52f9ed9d-1a00-0000-bc7f-41efc90c0000 pid=3273 execve guuid=6085579e-1a00-0000-bc7f-41efcb0c0000 pid=3275 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=6085579e-1a00-0000-bc7f-41efcb0c0000 pid=3275 execve guuid=ef9bcb9e-1a00-0000-bc7f-41efcd0c0000 pid=3277 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=ef9bcb9e-1a00-0000-bc7f-41efcd0c0000 pid=3277 execve guuid=005d369f-1a00-0000-bc7f-41efd00c0000 pid=3280 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=005d369f-1a00-0000-bc7f-41efd00c0000 pid=3280 execve guuid=4abba69f-1a00-0000-bc7f-41efd10c0000 pid=3281 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=4abba69f-1a00-0000-bc7f-41efd10c0000 pid=3281 execve guuid=cfa93fa0-1a00-0000-bc7f-41efd30c0000 pid=3283 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=cfa93fa0-1a00-0000-bc7f-41efd30c0000 pid=3283 execve guuid=388eb0a0-1a00-0000-bc7f-41efd40c0000 pid=3284 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=388eb0a0-1a00-0000-bc7f-41efd40c0000 pid=3284 execve guuid=522a40a1-1a00-0000-bc7f-41efd60c0000 pid=3286 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=522a40a1-1a00-0000-bc7f-41efd60c0000 pid=3286 execve guuid=77a1d6a1-1a00-0000-bc7f-41efd90c0000 pid=3289 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=77a1d6a1-1a00-0000-bc7f-41efd90c0000 pid=3289 execve guuid=eda157a2-1a00-0000-bc7f-41efdb0c0000 pid=3291 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=eda157a2-1a00-0000-bc7f-41efdb0c0000 pid=3291 execve guuid=e156d1a2-1a00-0000-bc7f-41efde0c0000 pid=3294 /usr/bin/ls guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=e156d1a2-1a00-0000-bc7f-41efde0c0000 pid=3294 execve guuid=758b71a3-1a00-0000-bc7f-41efdf0c0000 pid=3295 /usr/bin/rm guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=758b71a3-1a00-0000-bc7f-41efdf0c0000 pid=3295 execve guuid=094dd5a3-1a00-0000-bc7f-41efe00c0000 pid=3296 /usr/bin/wget net send-data write-file guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=094dd5a3-1a00-0000-bc7f-41efe00c0000 pid=3296 execve guuid=91ea0cb2-1a00-0000-bc7f-41efec0c0000 pid=3308 /usr/bin/chmod guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=91ea0cb2-1a00-0000-bc7f-41efec0c0000 pid=3308 execve guuid=10114fb2-1a00-0000-bc7f-41efed0c0000 pid=3309 /tmp/0UKX guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=10114fb2-1a00-0000-bc7f-41efed0c0000 pid=3309 execve guuid=553d4eb4-1a00-0000-bc7f-41eff20c0000 pid=3314 /usr/bin/rm guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=553d4eb4-1a00-0000-bc7f-41eff20c0000 pid=3314 execve guuid=bd5d93b4-1a00-0000-bc7f-41eff30c0000 pid=3315 /usr/bin/wget net send-data write-file guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=bd5d93b4-1a00-0000-bc7f-41eff30c0000 pid=3315 execve guuid=46c67bc1-1a00-0000-bc7f-41effe0c0000 pid=3326 /usr/bin/chmod guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=46c67bc1-1a00-0000-bc7f-41effe0c0000 pid=3326 execve guuid=ccf6cfc1-1a00-0000-bc7f-41ef000d0000 pid=3328 /usr/bin/dash guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=ccf6cfc1-1a00-0000-bc7f-41ef000d0000 pid=3328 clone guuid=d7cfbcc3-1a00-0000-bc7f-41ef050d0000 pid=3333 /usr/bin/rm guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=d7cfbcc3-1a00-0000-bc7f-41ef050d0000 pid=3333 execve guuid=b13a0dc4-1a00-0000-bc7f-41ef060d0000 pid=3334 /usr/bin/wget net send-data write-file guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=b13a0dc4-1a00-0000-bc7f-41ef060d0000 pid=3334 execve guuid=ba8b39d1-1a00-0000-bc7f-41ef1b0d0000 pid=3355 /usr/bin/chmod guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=ba8b39d1-1a00-0000-bc7f-41ef1b0d0000 pid=3355 execve guuid=e0f189d1-1a00-0000-bc7f-41ef1c0d0000 pid=3356 /tmp/g0G guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=e0f189d1-1a00-0000-bc7f-41ef1c0d0000 pid=3356 execve guuid=1d3768d2-1a00-0000-bc7f-41ef220d0000 pid=3362 /usr/bin/rm guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=1d3768d2-1a00-0000-bc7f-41ef220d0000 pid=3362 execve guuid=09f99fd2-1a00-0000-bc7f-41ef230d0000 pid=3363 /usr/bin/wget net send-data write-file guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=09f99fd2-1a00-0000-bc7f-41ef230d0000 pid=3363 execve guuid=ae75acdf-1a00-0000-bc7f-41ef390d0000 pid=3385 /usr/bin/chmod guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=ae75acdf-1a00-0000-bc7f-41ef390d0000 pid=3385 execve guuid=c25ff8df-1a00-0000-bc7f-41ef3a0d0000 pid=3386 /tmp/vl0 guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=c25ff8df-1a00-0000-bc7f-41ef3a0d0000 pid=3386 execve guuid=2401e6e0-1a00-0000-bc7f-41ef3c0d0000 pid=3388 /usr/bin/rm guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=2401e6e0-1a00-0000-bc7f-41ef3c0d0000 pid=3388 execve guuid=73cc37e1-1a00-0000-bc7f-41ef3d0d0000 pid=3389 /usr/bin/wget net send-data write-file guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=73cc37e1-1a00-0000-bc7f-41ef3d0d0000 pid=3389 execve guuid=ee6dc2ed-1a00-0000-bc7f-41ef3e0d0000 pid=3390 /usr/bin/chmod guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=ee6dc2ed-1a00-0000-bc7f-41ef3e0d0000 pid=3390 execve guuid=d15926ee-1a00-0000-bc7f-41ef3f0d0000 pid=3391 /tmp/Qkbb guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=d15926ee-1a00-0000-bc7f-41ef3f0d0000 pid=3391 execve guuid=ec7affee-1a00-0000-bc7f-41ef410d0000 pid=3393 /usr/bin/rm delete-file guuid=036ad84f-1a00-0000-bc7f-41ef2e0c0000 pid=3118->guuid=ec7affee-1a00-0000-bc7f-41ef410d0000 pid=3393 execve 801186e6-5fe8-5959-a7b4-832d8d66e7aa 129.121.114.124:80 guuid=094dd5a3-1a00-0000-bc7f-41efe00c0000 pid=3296->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 134B guuid=bd5d93b4-1a00-0000-bc7f-41eff30c0000 pid=3315->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 133B guuid=b13a0dc4-1a00-0000-bc7f-41ef060d0000 pid=3334->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 133B guuid=09f99fd2-1a00-0000-bc7f-41ef230d0000 pid=3363->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 133B guuid=73cc37e1-1a00-0000-bc7f-41ef3d0d0000 pid=3389->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 134B
Score:
97%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/93b3d9b30c6463e043fd1d6a3fc9348827b5b86a67bc5520803e23ea8352044e
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/93b3d9b30c6463e043fd1d6a3fc9348827b5b86a67bc5520803e23ea8352044e/
Verdict:
Malicious
Threat:
Family.MIRAI
Link:
https://tip.neiki.dev/file/93b3d9b30c6463e043fd1d6a3fc9348827b5b86a67bc5520803e23ea8352044e
Threat name:
Win32.Trojan.Vigorf
Create hunting rule
Status:
Malicious
First seen:
2026-06-20 16:07:29 UTC
File Type:
Text (Shell)
AV detection:
11 of 24 (45.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=soz5tmymmrr6aq75dvvd7sjurat3lodkm66fkieahyr6va2sarha._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
discovery linux
Link:
https://tria.ge/reports/260620-tkdv1afy5r/
Behaviour
Reads runtime system information
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.26
Link:
https://yomi.yoroi.company/submissions/93b3d9b30c6463e043fd1d6a3fc9348827b5b86a67bc5520803e23ea8352044e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 93b3d9b30c6463e043fd1d6a3fc9348827b5b86a67bc5520803e23ea8352044e

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3866369/
  
Delivery method
Distributed via web download

Comments