🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 94b5cfdf5039324b106687db0982d5cb373f743ef988dbca032c18c65b6c4f55. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 94b5cfdf5039324b106687db0982d5cb373f743ef988dbca032c18c65b6c4f55
SHA3-384 hash: fcaac7023f00f0f310ae9261d90ece5087fad7af576c40506a3cce237eba8ee24d07652329b62003a9b0c09cb1bd5bf3
SHA1 hash: de1a32dbc1175f3b7576a3181d96bebf3f6d4061
MD5 hash: e7e0cc0f91eff7a9e5c8bfa6174e690b
humanhash: carolina-salami-carpet-tennis
File name:ok
Download: download sample
File size:1'584 bytes
First seen:2026-06-19 09:46:22 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 24:HoXo9So+5w2a4aoWBmHXmEoRtnKtVpmSVp9EiuF0:HEwJmERtnmDVK0
TLSH T10E3172DB81151A395602CACE7B773918B11C86FB2C4BC7A0DC0C4E9AC6C86DC7152FD9
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://5.182.210.61/08102dn/an/aua-wget
http://5.182.210.61/a60eb0n/an/aua-wget
http://5.182.210.61/c2b44bn/an/aua-wget
http://5.182.210.61/6299a7n/an/aua-wget
http://5.182.210.61/6a025dn/an/aua-wget
http://5.182.210.61/4be2efn/an/aua-wget
http://5.182.210.61/d11ba5n/an/aua-wget
http://5.182.210.61/1c4ad8n/an/aua-wget
http://5.182.210.61/706900n/an/aua-wget
http://5.182.210.61/ed0aa8n/an/aua-wget
http://5.182.210.61/f6965dn/an/aua-wget
http://5.182.210.61/379653n/an/aua-wget

Intelligence

File Origin
# of uploads :
1
# of downloads :
72
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive
Link:
https://www.filescan.io/uploads/6a35101c62d0679105f8ab0a/reports/886c421c-335e-4954-872b-594ed6e35745/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-06-19T06:55:00Z UTC
Last seen:
2026-06-20T23:22:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan-Downloader.Shell.Agent.a
Link:
https://opentip.kaspersky.com/94b5cfdf5039324b106687db0982d5cb373f743ef988dbca032c18c65b6c4f55/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/b7211df3-0a1e-4397-91d0-9ca7609c8799
Behavior Graph:
Download SVG
%3 guuid=b337d176-1900-0000-4710-8f082e140000 pid=5166 /usr/bin/sudo guuid=e580c079-1900-0000-4710-8f082f140000 pid=5167 /tmp/sample.bin guuid=b337d176-1900-0000-4710-8f082e140000 pid=5166->guuid=e580c079-1900-0000-4710-8f082f140000 pid=5167 execve guuid=2b71dc7a-1900-0000-4710-8f0830140000 pid=5168 /usr/bin/wget net send-data guuid=e580c079-1900-0000-4710-8f082f140000 pid=5167->guuid=2b71dc7a-1900-0000-4710-8f0830140000 pid=5168 execve guuid=0f07fc7e-1900-0000-4710-8f0831140000 pid=5169 /usr/bin/curl net send-data write-file guuid=e580c079-1900-0000-4710-8f082f140000 pid=5167->guuid=0f07fc7e-1900-0000-4710-8f0831140000 pid=5169 execve guuid=89088988-1900-0000-4710-8f0832140000 pid=5170 /usr/bin/chmod guuid=e580c079-1900-0000-4710-8f082f140000 pid=5167->guuid=89088988-1900-0000-4710-8f0832140000 pid=5170 execve guuid=35e51b89-1900-0000-4710-8f0833140000 pid=5171 /usr/bin/bash guuid=e580c079-1900-0000-4710-8f082f140000 pid=5167->guuid=35e51b89-1900-0000-4710-8f0833140000 pid=5171 clone guuid=b7767289-1900-0000-4710-8f0835140000 pid=5173 /usr/bin/rm delete-file guuid=e580c079-1900-0000-4710-8f082f140000 pid=5167->guuid=b7767289-1900-0000-4710-8f0835140000 pid=5173 execve guuid=e1f3ed89-1900-0000-4710-8f0836140000 pid=5174 /usr/bin/rm guuid=e580c079-1900-0000-4710-8f082f140000 pid=5167->guuid=e1f3ed89-1900-0000-4710-8f0836140000 pid=5174 execve guuid=38f5448a-1900-0000-4710-8f0837140000 pid=5175 /usr/bin/wget net send-data guuid=e580c079-1900-0000-4710-8f082f140000 pid=5167->guuid=38f5448a-1900-0000-4710-8f0837140000 pid=5175 execve guuid=85230b8d-1900-0000-4710-8f0838140000 pid=5176 /usr/bin/curl net send-data write-file guuid=e580c079-1900-0000-4710-8f082f140000 pid=5167->guuid=85230b8d-1900-0000-4710-8f0838140000 pid=5176 execve guuid=ab22d390-1900-0000-4710-8f0839140000 pid=5177 /usr/bin/chmod guuid=e580c079-1900-0000-4710-8f082f140000 pid=5167->guuid=ab22d390-1900-0000-4710-8f0839140000 pid=5177 execve guuid=600b1e91-1900-0000-4710-8f083a140000 pid=5178 /usr/bin/bash guuid=e580c079-1900-0000-4710-8f082f140000 pid=5167->guuid=600b1e91-1900-0000-4710-8f083a140000 pid=5178 clone guuid=de485191-1900-0000-4710-8f083c140000 pid=5180 /usr/bin/rm delete-file guuid=e580c079-1900-0000-4710-8f082f140000 pid=5167->guuid=de485191-1900-0000-4710-8f083c140000 pid=5180 execve guuid=56c39891-1900-0000-4710-8f083d140000 pid=5181 /usr/bin/rm guuid=e580c079-1900-0000-4710-8f082f140000 pid=5167->guuid=56c39891-1900-0000-4710-8f083d140000 pid=5181 execve guuid=ade1e191-1900-0000-4710-8f083e140000 pid=5182 /usr/bin/wget net send-data guuid=e580c079-1900-0000-4710-8f082f140000 pid=5167->guuid=ade1e191-1900-0000-4710-8f083e140000 pid=5182 execve guuid=866f6294-1900-0000-4710-8f083f140000 pid=5183 /usr/bin/curl net send-data write-file guuid=e580c079-1900-0000-4710-8f082f140000 pid=5167->guuid=866f6294-1900-0000-4710-8f083f140000 pid=5183 execve guuid=0ee0bd97-1900-0000-4710-8f0840140000 pid=5184 /usr/bin/chmod guuid=e580c079-1900-0000-4710-8f082f140000 pid=5167->guuid=0ee0bd97-1900-0000-4710-8f0840140000 pid=5184 execve guuid=1dfc0398-1900-0000-4710-8f0841140000 pid=5185 /usr/bin/bash guuid=e580c079-1900-0000-4710-8f082f140000 pid=5167->guuid=1dfc0398-1900-0000-4710-8f0841140000 pid=5185 clone guuid=c7843d98-1900-0000-4710-8f0843140000 pid=5187 /usr/bin/rm delete-file guuid=e580c079-1900-0000-4710-8f082f140000 pid=5167->guuid=c7843d98-1900-0000-4710-8f0843140000 pid=5187 execve guuid=90a08a98-1900-0000-4710-8f0844140000 pid=5188 /usr/bin/rm guuid=e580c079-1900-0000-4710-8f082f140000 pid=5167->guuid=90a08a98-1900-0000-4710-8f0844140000 pid=5188 execve guuid=e4e0d598-1900-0000-4710-8f0845140000 pid=5189 /usr/bin/wget net send-data guuid=e580c079-1900-0000-4710-8f082f140000 pid=5167->guuid=e4e0d598-1900-0000-4710-8f0845140000 pid=5189 execve guuid=0834649b-1900-0000-4710-8f0846140000 pid=5190 /usr/bin/curl net send-data write-file guuid=e580c079-1900-0000-4710-8f082f140000 pid=5167->guuid=0834649b-1900-0000-4710-8f0846140000 pid=5190 execve guuid=942c8b9f-1900-0000-4710-8f0847140000 pid=5191 /usr/bin/chmod guuid=e580c079-1900-0000-4710-8f082f140000 pid=5167->guuid=942c8b9f-1900-0000-4710-8f0847140000 pid=5191 execve guuid=87f2ee9f-1900-0000-4710-8f0848140000 pid=5192 /usr/bin/bash guuid=e580c079-1900-0000-4710-8f082f140000 pid=5167->guuid=87f2ee9f-1900-0000-4710-8f0848140000 pid=5192 clone guuid=da2f46a0-1900-0000-4710-8f084a140000 pid=5194 /usr/bin/rm delete-file guuid=e580c079-1900-0000-4710-8f082f140000 pid=5167->guuid=da2f46a0-1900-0000-4710-8f084a140000 pid=5194 execve guuid=e43a99a0-1900-0000-4710-8f084c140000 pid=5196 /usr/bin/rm guuid=e580c079-1900-0000-4710-8f082f140000 pid=5167->guuid=e43a99a0-1900-0000-4710-8f084c140000 pid=5196 execve guuid=9989dea0-1900-0000-4710-8f084d140000 pid=5197 /usr/bin/wget net send-data guuid=e580c079-1900-0000-4710-8f082f140000 pid=5167->guuid=9989dea0-1900-0000-4710-8f084d140000 pid=5197 execve guuid=22f6a1a7-1900-0000-4710-8f0854140000 pid=5204 /usr/bin/curl net send-data write-file guuid=e580c079-1900-0000-4710-8f082f140000 pid=5167->guuid=22f6a1a7-1900-0000-4710-8f0854140000 pid=5204 execve guuid=2acbf3ad-1900-0000-4710-8f0855140000 pid=5205 /usr/bin/chmod guuid=e580c079-1900-0000-4710-8f082f140000 pid=5167->guuid=2acbf3ad-1900-0000-4710-8f0855140000 pid=5205 execve guuid=1a4367ae-1900-0000-4710-8f0856140000 pid=5206 /usr/bin/bash guuid=e580c079-1900-0000-4710-8f082f140000 pid=5167->guuid=1a4367ae-1900-0000-4710-8f0856140000 pid=5206 clone guuid=c06c19af-1900-0000-4710-8f0858140000 pid=5208 /usr/bin/rm delete-file guuid=e580c079-1900-0000-4710-8f082f140000 pid=5167->guuid=c06c19af-1900-0000-4710-8f0858140000 pid=5208 execve guuid=ebeff3af-1900-0000-4710-8f0859140000 pid=5209 /usr/bin/rm guuid=e580c079-1900-0000-4710-8f082f140000 pid=5167->guuid=ebeff3af-1900-0000-4710-8f0859140000 pid=5209 execve guuid=1c7db6b0-1900-0000-4710-8f085a140000 pid=5210 /usr/bin/wget net send-data guuid=e580c079-1900-0000-4710-8f082f140000 pid=5167->guuid=1c7db6b0-1900-0000-4710-8f085a140000 pid=5210 execve guuid=25aa7ab3-1900-0000-4710-8f085b140000 pid=5211 /usr/bin/curl net send-data write-file guuid=e580c079-1900-0000-4710-8f082f140000 pid=5167->guuid=25aa7ab3-1900-0000-4710-8f085b140000 pid=5211 execve guuid=123f53b8-1900-0000-4710-8f085c140000 pid=5212 /usr/bin/chmod guuid=e580c079-1900-0000-4710-8f082f140000 pid=5167->guuid=123f53b8-1900-0000-4710-8f085c140000 pid=5212 execve guuid=2e2cf5b8-1900-0000-4710-8f085d140000 pid=5213 /usr/bin/bash guuid=e580c079-1900-0000-4710-8f082f140000 pid=5167->guuid=2e2cf5b8-1900-0000-4710-8f085d140000 pid=5213 clone guuid=8f8f5eb9-1900-0000-4710-8f085f140000 pid=5215 /usr/bin/rm delete-file guuid=e580c079-1900-0000-4710-8f082f140000 pid=5167->guuid=8f8f5eb9-1900-0000-4710-8f085f140000 pid=5215 execve guuid=fea1c1b9-1900-0000-4710-8f0860140000 pid=5216 /usr/bin/rm guuid=e580c079-1900-0000-4710-8f082f140000 pid=5167->guuid=fea1c1b9-1900-0000-4710-8f0860140000 pid=5216 execve guuid=a65e24ba-1900-0000-4710-8f0861140000 pid=5217 /usr/bin/wget net send-data guuid=e580c079-1900-0000-4710-8f082f140000 pid=5167->guuid=a65e24ba-1900-0000-4710-8f0861140000 pid=5217 execve guuid=fa8215bd-1900-0000-4710-8f0862140000 pid=5218 /usr/bin/curl net send-data write-file guuid=e580c079-1900-0000-4710-8f082f140000 pid=5167->guuid=fa8215bd-1900-0000-4710-8f0862140000 pid=5218 execve guuid=83072ac3-1900-0000-4710-8f0863140000 pid=5219 /usr/bin/chmod guuid=e580c079-1900-0000-4710-8f082f140000 pid=5167->guuid=83072ac3-1900-0000-4710-8f0863140000 pid=5219 execve guuid=666c95c3-1900-0000-4710-8f0864140000 pid=5220 /usr/bin/bash guuid=e580c079-1900-0000-4710-8f082f140000 pid=5167->guuid=666c95c3-1900-0000-4710-8f0864140000 pid=5220 clone guuid=503bfcc3-1900-0000-4710-8f0866140000 pid=5222 /usr/bin/rm delete-file guuid=e580c079-1900-0000-4710-8f082f140000 pid=5167->guuid=503bfcc3-1900-0000-4710-8f0866140000 pid=5222 execve guuid=8b516bc4-1900-0000-4710-8f0867140000 pid=5223 /usr/bin/rm guuid=e580c079-1900-0000-4710-8f082f140000 pid=5167->guuid=8b516bc4-1900-0000-4710-8f0867140000 pid=5223 execve guuid=05cfcac4-1900-0000-4710-8f0868140000 pid=5224 /usr/bin/wget net send-data guuid=e580c079-1900-0000-4710-8f082f140000 pid=5167->guuid=05cfcac4-1900-0000-4710-8f0868140000 pid=5224 execve guuid=490529c8-1900-0000-4710-8f0869140000 pid=5225 /usr/bin/curl net send-data write-file guuid=e580c079-1900-0000-4710-8f082f140000 pid=5167->guuid=490529c8-1900-0000-4710-8f0869140000 pid=5225 execve guuid=581c1ece-1900-0000-4710-8f086a140000 pid=5226 /usr/bin/chmod guuid=e580c079-1900-0000-4710-8f082f140000 pid=5167->guuid=581c1ece-1900-0000-4710-8f086a140000 pid=5226 execve guuid=987696ce-1900-0000-4710-8f086b140000 pid=5227 /usr/bin/bash guuid=e580c079-1900-0000-4710-8f082f140000 pid=5167->guuid=987696ce-1900-0000-4710-8f086b140000 pid=5227 clone guuid=f42fe1ce-1900-0000-4710-8f086d140000 pid=5229 /usr/bin/rm delete-file guuid=e580c079-1900-0000-4710-8f082f140000 pid=5167->guuid=f42fe1ce-1900-0000-4710-8f086d140000 pid=5229 execve guuid=551557cf-1900-0000-4710-8f086e140000 pid=5230 /usr/bin/rm guuid=e580c079-1900-0000-4710-8f082f140000 pid=5167->guuid=551557cf-1900-0000-4710-8f086e140000 pid=5230 execve guuid=3c72b0cf-1900-0000-4710-8f086f140000 pid=5231 /usr/bin/wget net send-data guuid=e580c079-1900-0000-4710-8f082f140000 pid=5167->guuid=3c72b0cf-1900-0000-4710-8f086f140000 pid=5231 execve guuid=8752aed2-1900-0000-4710-8f0870140000 pid=5232 /usr/bin/curl net send-data write-file guuid=e580c079-1900-0000-4710-8f082f140000 pid=5167->guuid=8752aed2-1900-0000-4710-8f0870140000 pid=5232 execve guuid=f263d3d7-1900-0000-4710-8f0871140000 pid=5233 /usr/bin/chmod guuid=e580c079-1900-0000-4710-8f082f140000 pid=5167->guuid=f263d3d7-1900-0000-4710-8f0871140000 pid=5233 execve guuid=c84a33d8-1900-0000-4710-8f0872140000 pid=5234 /usr/bin/bash guuid=e580c079-1900-0000-4710-8f082f140000 pid=5167->guuid=c84a33d8-1900-0000-4710-8f0872140000 pid=5234 clone guuid=556585d8-1900-0000-4710-8f0874140000 pid=5236 /usr/bin/rm delete-file guuid=e580c079-1900-0000-4710-8f082f140000 pid=5167->guuid=556585d8-1900-0000-4710-8f0874140000 pid=5236 execve guuid=5225edd8-1900-0000-4710-8f0875140000 pid=5237 /usr/bin/rm guuid=e580c079-1900-0000-4710-8f082f140000 pid=5167->guuid=5225edd8-1900-0000-4710-8f0875140000 pid=5237 execve guuid=5dcf4ad9-1900-0000-4710-8f0876140000 pid=5238 /usr/bin/wget net send-data guuid=e580c079-1900-0000-4710-8f082f140000 pid=5167->guuid=5dcf4ad9-1900-0000-4710-8f0876140000 pid=5238 execve guuid=98e69edc-1900-0000-4710-8f0877140000 pid=5239 /usr/bin/curl net send-data write-file guuid=e580c079-1900-0000-4710-8f082f140000 pid=5167->guuid=98e69edc-1900-0000-4710-8f0877140000 pid=5239 execve guuid=683d12fe-1900-0000-4710-8f0878140000 pid=5240 /usr/bin/chmod guuid=e580c079-1900-0000-4710-8f082f140000 pid=5167->guuid=683d12fe-1900-0000-4710-8f0878140000 pid=5240 execve guuid=98238004-1a00-0000-4710-8f0879140000 pid=5241 /usr/bin/bash guuid=e580c079-1900-0000-4710-8f082f140000 pid=5167->guuid=98238004-1a00-0000-4710-8f0879140000 pid=5241 clone guuid=a601a305-1a00-0000-4710-8f087b140000 pid=5243 /usr/bin/rm delete-file guuid=e580c079-1900-0000-4710-8f082f140000 pid=5167->guuid=a601a305-1a00-0000-4710-8f087b140000 pid=5243 execve guuid=d0df5406-1a00-0000-4710-8f087c140000 pid=5244 /usr/bin/rm guuid=e580c079-1900-0000-4710-8f082f140000 pid=5167->guuid=d0df5406-1a00-0000-4710-8f087c140000 pid=5244 execve guuid=fefa1808-1a00-0000-4710-8f087d140000 pid=5245 /usr/bin/wget net send-data guuid=e580c079-1900-0000-4710-8f082f140000 pid=5167->guuid=fefa1808-1a00-0000-4710-8f087d140000 pid=5245 execve guuid=440daa0d-1a00-0000-4710-8f087e140000 pid=5246 /usr/bin/curl net send-data write-file guuid=e580c079-1900-0000-4710-8f082f140000 pid=5167->guuid=440daa0d-1a00-0000-4710-8f087e140000 pid=5246 execve guuid=a03a3e16-1a00-0000-4710-8f087f140000 pid=5247 /usr/bin/chmod guuid=e580c079-1900-0000-4710-8f082f140000 pid=5167->guuid=a03a3e16-1a00-0000-4710-8f087f140000 pid=5247 execve guuid=2e64a616-1a00-0000-4710-8f0880140000 pid=5248 /usr/bin/bash guuid=e580c079-1900-0000-4710-8f082f140000 pid=5167->guuid=2e64a616-1a00-0000-4710-8f0880140000 pid=5248 clone guuid=c2e01817-1a00-0000-4710-8f0882140000 pid=5250 /usr/bin/rm delete-file guuid=e580c079-1900-0000-4710-8f082f140000 pid=5167->guuid=c2e01817-1a00-0000-4710-8f0882140000 pid=5250 execve guuid=e1859117-1a00-0000-4710-8f0883140000 pid=5251 /usr/bin/rm guuid=e580c079-1900-0000-4710-8f082f140000 pid=5167->guuid=e1859117-1a00-0000-4710-8f0883140000 pid=5251 execve guuid=c6190b18-1a00-0000-4710-8f0884140000 pid=5252 /usr/bin/wget net send-data guuid=e580c079-1900-0000-4710-8f082f140000 pid=5167->guuid=c6190b18-1a00-0000-4710-8f0884140000 pid=5252 execve guuid=32ea9d24-1a00-0000-4710-8f0885140000 pid=5253 /usr/bin/curl net send-data write-file guuid=e580c079-1900-0000-4710-8f082f140000 pid=5167->guuid=32ea9d24-1a00-0000-4710-8f0885140000 pid=5253 execve guuid=eab8ca30-1a00-0000-4710-8f0886140000 pid=5254 /usr/bin/chmod guuid=e580c079-1900-0000-4710-8f082f140000 pid=5167->guuid=eab8ca30-1a00-0000-4710-8f0886140000 pid=5254 execve guuid=259e4631-1a00-0000-4710-8f0887140000 pid=5255 /usr/bin/bash guuid=e580c079-1900-0000-4710-8f082f140000 pid=5167->guuid=259e4631-1a00-0000-4710-8f0887140000 pid=5255 clone guuid=74a4f631-1a00-0000-4710-8f0889140000 pid=5257 /usr/bin/rm delete-file guuid=e580c079-1900-0000-4710-8f082f140000 pid=5167->guuid=74a4f631-1a00-0000-4710-8f0889140000 pid=5257 execve guuid=393d7132-1a00-0000-4710-8f088a140000 pid=5258 /usr/bin/rm guuid=e580c079-1900-0000-4710-8f082f140000 pid=5167->guuid=393d7132-1a00-0000-4710-8f088a140000 pid=5258 execve 9e33e6d7-6ac7-5a65-88f4-941337e56821 5.182.210.61:80 guuid=2b71dc7a-1900-0000-4710-8f0830140000 pid=5168->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=0f07fc7e-1900-0000-4710-8f0831140000 pid=5169->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=05a44589-1900-0000-4710-8f0834140000 pid=5172 /usr/bin/bash guuid=35e51b89-1900-0000-4710-8f0833140000 pid=5171->guuid=05a44589-1900-0000-4710-8f0834140000 pid=5172 clone guuid=38f5448a-1900-0000-4710-8f0837140000 pid=5175->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=85230b8d-1900-0000-4710-8f0838140000 pid=5176->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=ffde3491-1900-0000-4710-8f083b140000 pid=5179 /usr/bin/bash guuid=600b1e91-1900-0000-4710-8f083a140000 pid=5178->guuid=ffde3491-1900-0000-4710-8f083b140000 pid=5179 clone guuid=ade1e191-1900-0000-4710-8f083e140000 pid=5182->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=866f6294-1900-0000-4710-8f083f140000 pid=5183->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=65ef1b98-1900-0000-4710-8f0842140000 pid=5186 /usr/bin/bash guuid=1dfc0398-1900-0000-4710-8f0841140000 pid=5185->guuid=65ef1b98-1900-0000-4710-8f0842140000 pid=5186 clone guuid=e4e0d598-1900-0000-4710-8f0845140000 pid=5189->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=0834649b-1900-0000-4710-8f0846140000 pid=5190->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=88b31ba0-1900-0000-4710-8f0849140000 pid=5193 /usr/bin/bash guuid=87f2ee9f-1900-0000-4710-8f0848140000 pid=5192->guuid=88b31ba0-1900-0000-4710-8f0849140000 pid=5193 clone guuid=9989dea0-1900-0000-4710-8f084d140000 pid=5197->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=22f6a1a7-1900-0000-4710-8f0854140000 pid=5204->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=dd8ac8ae-1900-0000-4710-8f0857140000 pid=5207 /usr/bin/bash guuid=1a4367ae-1900-0000-4710-8f0856140000 pid=5206->guuid=dd8ac8ae-1900-0000-4710-8f0857140000 pid=5207 clone guuid=1c7db6b0-1900-0000-4710-8f085a140000 pid=5210->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=25aa7ab3-1900-0000-4710-8f085b140000 pid=5211->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=c5332fb9-1900-0000-4710-8f085e140000 pid=5214 /usr/bin/bash guuid=2e2cf5b8-1900-0000-4710-8f085d140000 pid=5213->guuid=c5332fb9-1900-0000-4710-8f085e140000 pid=5214 clone guuid=a65e24ba-1900-0000-4710-8f0861140000 pid=5217->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=fa8215bd-1900-0000-4710-8f0862140000 pid=5218->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=e104bdc3-1900-0000-4710-8f0865140000 pid=5221 /usr/bin/bash guuid=666c95c3-1900-0000-4710-8f0864140000 pid=5220->guuid=e104bdc3-1900-0000-4710-8f0865140000 pid=5221 clone guuid=05cfcac4-1900-0000-4710-8f0868140000 pid=5224->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=490529c8-1900-0000-4710-8f0869140000 pid=5225->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=5e1eb8ce-1900-0000-4710-8f086c140000 pid=5228 /usr/bin/bash guuid=987696ce-1900-0000-4710-8f086b140000 pid=5227->guuid=5e1eb8ce-1900-0000-4710-8f086c140000 pid=5228 clone guuid=3c72b0cf-1900-0000-4710-8f086f140000 pid=5231->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=8752aed2-1900-0000-4710-8f0870140000 pid=5232->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=966e53d8-1900-0000-4710-8f0873140000 pid=5235 /usr/bin/bash guuid=c84a33d8-1900-0000-4710-8f0872140000 pid=5234->guuid=966e53d8-1900-0000-4710-8f0873140000 pid=5235 clone guuid=5dcf4ad9-1900-0000-4710-8f0876140000 pid=5238->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=98e69edc-1900-0000-4710-8f0877140000 pid=5239->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=61312205-1a00-0000-4710-8f087a140000 pid=5242 /usr/bin/bash guuid=98238004-1a00-0000-4710-8f0879140000 pid=5241->guuid=61312205-1a00-0000-4710-8f087a140000 pid=5242 clone guuid=fefa1808-1a00-0000-4710-8f087d140000 pid=5245->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=440daa0d-1a00-0000-4710-8f087e140000 pid=5246->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=9989cd16-1a00-0000-4710-8f0881140000 pid=5249 /usr/bin/bash guuid=2e64a616-1a00-0000-4710-8f0880140000 pid=5248->guuid=9989cd16-1a00-0000-4710-8f0881140000 pid=5249 clone guuid=c6190b18-1a00-0000-4710-8f0884140000 pid=5252->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=32ea9d24-1a00-0000-4710-8f0885140000 pid=5253->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=36e78f31-1a00-0000-4710-8f0888140000 pid=5256 /usr/bin/bash guuid=259e4631-1a00-0000-4710-8f0887140000 pid=5255->guuid=36e78f31-1a00-0000-4710-8f0888140000 pid=5256 clone
Score:
99%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/94b5cfdf5039324b106687db0982d5cb373f743ef988dbca032c18c65b6c4f55
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/94b5cfdf5039324b106687db0982d5cb373f743ef988dbca032c18c65b6c4f55/
Verdict:
Malicious
Threat:
Trojan-Downloader.Shell.Agent
Link:
https://tip.neiki.dev/file/94b5cfdf5039324b106687db0982d5cb373f743ef988dbca032c18c65b6c4f55
Threat name:
Win32.Trojan.Vigorf
Create hunting rule
Status:
Malicious
First seen:
2026-06-19 09:47:30 UTC
File Type:
Text (Shell)
AV detection:
12 of 24 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ss247x2qhezewedgq7nqtawvzm3t65b67genxsqdfqmmmw3mj5kq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260619-lsdk7se12n/
Behaviour
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.11
Link:
https://yomi.yoroi.company/submissions/94b5cfdf5039324b106687db0982d5cb373f743ef988dbca032c18c65b6c4f55

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 94b5cfdf5039324b106687db0982d5cb373f743ef988dbca032c18c65b6c4f55

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3864548/
  
Delivery method
Distributed via web download

Comments