MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a035e0bfd2cce492ff9b54ee668934775d53dd9f15b6f10d25bee1c88966cd1d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a035e0bfd2cce492ff9b54ee668934775d53dd9f15b6f10d25bee1c88966cd1d
SHA3-384 hash: f788a1a01d5dd208929be96702e349b85db9f20d00318dd8899df756a3da10f883118e14760822b2e8ef4d94e7db287c
SHA1 hash: cc11e49a8eeb6de7e4a987be948768ac2cdd415f
MD5 hash: f5c5a2cd3ebe75d6234b34c1b9cdee62
humanhash: ohio-king-beer-mississippi
File name:p
Download: download sample
File size:822 bytes
First seen:2026-06-10 05:22:45 UTC
Last seen:2026-06-11 04:53:15 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 24:kXCKysE2hi0ziQvZohaXmswXtJSiShMu7:e9Qp+MsX7MKNP7
TLSH T13801ABCAC002DB5001CAE49E729B51C0FC20C3CB65490BB87F9C483D9BF9748B056F98
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://188.132.232.81/hYOn/an/aelf ua-wget
http://188.132.232.81/bfOn/an/aelf ua-wget
http://188.132.232.81/DiNn/an/aelf ua-wget
http://188.132.232.81/9VBn/an/aelf ua-wget
http://188.132.232.81/lr6n/an/aelf ua-wget

Intelligence

File Origin
# of uploads :
2
# of downloads :
45
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive
Link:
https://www.filescan.io/uploads/6a28f4d01f652d6865744841/reports/89832eff-ea9c-4095-a5fd-42ef1fb589b0/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-06-10T02:29:00Z UTC
Last seen:
2026-06-11T22:21:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan-Downloader.Shell.Agent.a
Link:
https://opentip.kaspersky.com/a035e0bfd2cce492ff9b54ee668934775d53dd9f15b6f10d25bee1c88966cd1d/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/8ff99003-dfb9-4d50-b939-ad91e3b597f4
Behavior Graph:
Download SVG
%3 guuid=ae3383a7-1600-0000-a37d-7405590d0000 pid=3417 /usr/bin/sudo guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424 /tmp/sample.bin write-file guuid=ae3383a7-1600-0000-a37d-7405590d0000 pid=3417->guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424 execve guuid=3a5066a9-1600-0000-a37d-7405620d0000 pid=3426 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=3a5066a9-1600-0000-a37d-7405620d0000 pid=3426 execve guuid=ce1ccaa9-1600-0000-a37d-7405640d0000 pid=3428 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=ce1ccaa9-1600-0000-a37d-7405640d0000 pid=3428 execve guuid=88e52eaa-1600-0000-a37d-7405670d0000 pid=3431 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=88e52eaa-1600-0000-a37d-7405670d0000 pid=3431 execve guuid=861d89aa-1600-0000-a37d-7405690d0000 pid=3433 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=861d89aa-1600-0000-a37d-7405690d0000 pid=3433 execve guuid=ce0ce7aa-1600-0000-a37d-74056c0d0000 pid=3436 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=ce0ce7aa-1600-0000-a37d-74056c0d0000 pid=3436 execve guuid=5bce68ab-1600-0000-a37d-74056e0d0000 pid=3438 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=5bce68ab-1600-0000-a37d-74056e0d0000 pid=3438 execve guuid=e555ceab-1600-0000-a37d-7405710d0000 pid=3441 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=e555ceab-1600-0000-a37d-7405710d0000 pid=3441 execve guuid=a29a27ac-1600-0000-a37d-7405730d0000 pid=3443 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=a29a27ac-1600-0000-a37d-7405730d0000 pid=3443 execve guuid=520887ac-1600-0000-a37d-7405760d0000 pid=3446 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=520887ac-1600-0000-a37d-7405760d0000 pid=3446 execve guuid=a68de6ac-1600-0000-a37d-7405780d0000 pid=3448 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=a68de6ac-1600-0000-a37d-7405780d0000 pid=3448 execve guuid=2f6645ad-1600-0000-a37d-74057a0d0000 pid=3450 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=2f6645ad-1600-0000-a37d-74057a0d0000 pid=3450 execve guuid=3d63a2ad-1600-0000-a37d-74057d0d0000 pid=3453 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=3d63a2ad-1600-0000-a37d-74057d0d0000 pid=3453 execve guuid=92030bae-1600-0000-a37d-7405800d0000 pid=3456 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=92030bae-1600-0000-a37d-7405800d0000 pid=3456 execve guuid=e91e69ae-1600-0000-a37d-7405820d0000 pid=3458 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=e91e69ae-1600-0000-a37d-7405820d0000 pid=3458 execve guuid=5965c5ae-1600-0000-a37d-7405840d0000 pid=3460 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=5965c5ae-1600-0000-a37d-7405840d0000 pid=3460 execve guuid=12ac27af-1600-0000-a37d-7405860d0000 pid=3462 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=12ac27af-1600-0000-a37d-7405860d0000 pid=3462 execve guuid=f60f8baf-1600-0000-a37d-7405890d0000 pid=3465 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=f60f8baf-1600-0000-a37d-7405890d0000 pid=3465 execve guuid=a73aeaaf-1600-0000-a37d-74058b0d0000 pid=3467 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=a73aeaaf-1600-0000-a37d-74058b0d0000 pid=3467 execve guuid=2e2248b0-1600-0000-a37d-74058e0d0000 pid=3470 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=2e2248b0-1600-0000-a37d-74058e0d0000 pid=3470 execve guuid=bc46a3b0-1600-0000-a37d-7405900d0000 pid=3472 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=bc46a3b0-1600-0000-a37d-7405900d0000 pid=3472 execve guuid=d649feb0-1600-0000-a37d-7405920d0000 pid=3474 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=d649feb0-1600-0000-a37d-7405920d0000 pid=3474 execve guuid=c5b45bb1-1600-0000-a37d-7405940d0000 pid=3476 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=c5b45bb1-1600-0000-a37d-7405940d0000 pid=3476 execve guuid=a8b6b5b1-1600-0000-a37d-7405970d0000 pid=3479 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=a8b6b5b1-1600-0000-a37d-7405970d0000 pid=3479 execve guuid=d2ad16b2-1600-0000-a37d-7405990d0000 pid=3481 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=d2ad16b2-1600-0000-a37d-7405990d0000 pid=3481 execve guuid=e33c84b2-1600-0000-a37d-74059b0d0000 pid=3483 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=e33c84b2-1600-0000-a37d-74059b0d0000 pid=3483 execve guuid=8485e2b2-1600-0000-a37d-74059e0d0000 pid=3486 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=8485e2b2-1600-0000-a37d-74059e0d0000 pid=3486 execve guuid=142a42b3-1600-0000-a37d-7405a00d0000 pid=3488 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=142a42b3-1600-0000-a37d-7405a00d0000 pid=3488 execve guuid=94a3a1b3-1600-0000-a37d-7405a30d0000 pid=3491 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=94a3a1b3-1600-0000-a37d-7405a30d0000 pid=3491 execve guuid=bda740b4-1600-0000-a37d-7405a60d0000 pid=3494 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=bda740b4-1600-0000-a37d-7405a60d0000 pid=3494 execve guuid=d1be9eb4-1600-0000-a37d-7405a80d0000 pid=3496 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=d1be9eb4-1600-0000-a37d-7405a80d0000 pid=3496 execve guuid=f036f9b4-1600-0000-a37d-7405ab0d0000 pid=3499 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=f036f9b4-1600-0000-a37d-7405ab0d0000 pid=3499 execve guuid=8a1f5ab5-1600-0000-a37d-7405ad0d0000 pid=3501 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=8a1f5ab5-1600-0000-a37d-7405ad0d0000 pid=3501 execve guuid=216fc0b5-1600-0000-a37d-7405b00d0000 pid=3504 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=216fc0b5-1600-0000-a37d-7405b00d0000 pid=3504 execve guuid=e79710b6-1600-0000-a37d-7405b50d0000 pid=3509 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=e79710b6-1600-0000-a37d-7405b50d0000 pid=3509 execve guuid=e03e6cb6-1600-0000-a37d-7405b60d0000 pid=3510 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=e03e6cb6-1600-0000-a37d-7405b60d0000 pid=3510 execve guuid=17f8bbb6-1600-0000-a37d-7405b70d0000 pid=3511 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=17f8bbb6-1600-0000-a37d-7405b70d0000 pid=3511 execve guuid=189b1bb7-1600-0000-a37d-7405b80d0000 pid=3512 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=189b1bb7-1600-0000-a37d-7405b80d0000 pid=3512 execve guuid=eeb777b7-1600-0000-a37d-7405b90d0000 pid=3513 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=eeb777b7-1600-0000-a37d-7405b90d0000 pid=3513 execve guuid=65f4d2b7-1600-0000-a37d-7405ba0d0000 pid=3514 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=65f4d2b7-1600-0000-a37d-7405ba0d0000 pid=3514 execve guuid=d68e2fb8-1600-0000-a37d-7405bb0d0000 pid=3515 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=d68e2fb8-1600-0000-a37d-7405bb0d0000 pid=3515 execve guuid=29c38ab8-1600-0000-a37d-7405bc0d0000 pid=3516 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=29c38ab8-1600-0000-a37d-7405bc0d0000 pid=3516 execve guuid=e264ebb8-1600-0000-a37d-7405bd0d0000 pid=3517 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=e264ebb8-1600-0000-a37d-7405bd0d0000 pid=3517 execve guuid=26cb50b9-1600-0000-a37d-7405be0d0000 pid=3518 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=26cb50b9-1600-0000-a37d-7405be0d0000 pid=3518 execve guuid=489db1b9-1600-0000-a37d-7405bf0d0000 pid=3519 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=489db1b9-1600-0000-a37d-7405bf0d0000 pid=3519 execve guuid=c36704ba-1600-0000-a37d-7405c00d0000 pid=3520 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=c36704ba-1600-0000-a37d-7405c00d0000 pid=3520 execve guuid=3be16bba-1600-0000-a37d-7405c10d0000 pid=3521 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=3be16bba-1600-0000-a37d-7405c10d0000 pid=3521 execve guuid=b3abd0ba-1600-0000-a37d-7405c20d0000 pid=3522 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=b3abd0ba-1600-0000-a37d-7405c20d0000 pid=3522 execve guuid=95702dbb-1600-0000-a37d-7405c60d0000 pid=3526 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=95702dbb-1600-0000-a37d-7405c60d0000 pid=3526 execve guuid=ff72a4bb-1600-0000-a37d-7405c70d0000 pid=3527 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=ff72a4bb-1600-0000-a37d-7405c70d0000 pid=3527 execve guuid=7f7f19bc-1600-0000-a37d-7405c80d0000 pid=3528 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=7f7f19bc-1600-0000-a37d-7405c80d0000 pid=3528 execve guuid=41e88ebc-1600-0000-a37d-7405c90d0000 pid=3529 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=41e88ebc-1600-0000-a37d-7405c90d0000 pid=3529 execve guuid=25aef5bc-1600-0000-a37d-7405cb0d0000 pid=3531 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=25aef5bc-1600-0000-a37d-7405cb0d0000 pid=3531 execve guuid=dac54ebd-1600-0000-a37d-7405cd0d0000 pid=3533 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=dac54ebd-1600-0000-a37d-7405cd0d0000 pid=3533 execve guuid=1fa29fbd-1600-0000-a37d-7405cf0d0000 pid=3535 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=1fa29fbd-1600-0000-a37d-7405cf0d0000 pid=3535 execve guuid=cf21e8bd-1600-0000-a37d-7405d10d0000 pid=3537 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=cf21e8bd-1600-0000-a37d-7405d10d0000 pid=3537 execve guuid=090e3cbe-1600-0000-a37d-7405d40d0000 pid=3540 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=090e3cbe-1600-0000-a37d-7405d40d0000 pid=3540 execve guuid=a3f48fbe-1600-0000-a37d-7405d60d0000 pid=3542 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=a3f48fbe-1600-0000-a37d-7405d60d0000 pid=3542 execve guuid=b8f5e2be-1600-0000-a37d-7405d90d0000 pid=3545 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=b8f5e2be-1600-0000-a37d-7405d90d0000 pid=3545 execve guuid=2bfe36bf-1600-0000-a37d-7405db0d0000 pid=3547 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=2bfe36bf-1600-0000-a37d-7405db0d0000 pid=3547 execve guuid=12829abf-1600-0000-a37d-7405dc0d0000 pid=3548 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=12829abf-1600-0000-a37d-7405dc0d0000 pid=3548 execve guuid=576f10c0-1600-0000-a37d-7405dd0d0000 pid=3549 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=576f10c0-1600-0000-a37d-7405dd0d0000 pid=3549 execve guuid=a6f76dc0-1600-0000-a37d-7405df0d0000 pid=3551 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=a6f76dc0-1600-0000-a37d-7405df0d0000 pid=3551 execve guuid=a86cdbc0-1600-0000-a37d-7405e00d0000 pid=3552 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=a86cdbc0-1600-0000-a37d-7405e00d0000 pid=3552 execve guuid=81875bc1-1600-0000-a37d-7405e10d0000 pid=3553 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=81875bc1-1600-0000-a37d-7405e10d0000 pid=3553 execve guuid=b538bec1-1600-0000-a37d-7405e30d0000 pid=3555 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=b538bec1-1600-0000-a37d-7405e30d0000 pid=3555 execve guuid=fa841fc2-1600-0000-a37d-7405e50d0000 pid=3557 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=fa841fc2-1600-0000-a37d-7405e50d0000 pid=3557 execve guuid=32ac8ac2-1600-0000-a37d-7405e80d0000 pid=3560 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=32ac8ac2-1600-0000-a37d-7405e80d0000 pid=3560 execve guuid=9a2beec2-1600-0000-a37d-7405ea0d0000 pid=3562 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=9a2beec2-1600-0000-a37d-7405ea0d0000 pid=3562 execve guuid=813050c3-1600-0000-a37d-7405ec0d0000 pid=3564 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=813050c3-1600-0000-a37d-7405ec0d0000 pid=3564 execve guuid=07bae9c4-1600-0000-a37d-7405ed0d0000 pid=3565 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=07bae9c4-1600-0000-a37d-7405ed0d0000 pid=3565 execve guuid=e25b1bc6-1600-0000-a37d-7405ef0d0000 pid=3567 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=e25b1bc6-1600-0000-a37d-7405ef0d0000 pid=3567 execve guuid=749ca2c6-1600-0000-a37d-7405f00d0000 pid=3568 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=749ca2c6-1600-0000-a37d-7405f00d0000 pid=3568 execve guuid=996a1cc7-1600-0000-a37d-7405f10d0000 pid=3569 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=996a1cc7-1600-0000-a37d-7405f10d0000 pid=3569 execve guuid=7ec47fc7-1600-0000-a37d-7405f40d0000 pid=3572 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=7ec47fc7-1600-0000-a37d-7405f40d0000 pid=3572 execve guuid=4abf0bc8-1600-0000-a37d-7405f70d0000 pid=3575 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=4abf0bc8-1600-0000-a37d-7405f70d0000 pid=3575 execve guuid=c7ff97c8-1600-0000-a37d-7405fa0d0000 pid=3578 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=c7ff97c8-1600-0000-a37d-7405fa0d0000 pid=3578 execve guuid=7bc822c9-1600-0000-a37d-7405fd0d0000 pid=3581 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=7bc822c9-1600-0000-a37d-7405fd0d0000 pid=3581 execve guuid=7ffca3c9-1600-0000-a37d-7405000e0000 pid=3584 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=7ffca3c9-1600-0000-a37d-7405000e0000 pid=3584 execve guuid=80a700ca-1600-0000-a37d-7405020e0000 pid=3586 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=80a700ca-1600-0000-a37d-7405020e0000 pid=3586 execve guuid=3e0c5cca-1600-0000-a37d-7405050e0000 pid=3589 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=3e0c5cca-1600-0000-a37d-7405050e0000 pid=3589 execve guuid=e49ab4ca-1600-0000-a37d-7405070e0000 pid=3591 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=e49ab4ca-1600-0000-a37d-7405070e0000 pid=3591 execve guuid=b0a40ecb-1600-0000-a37d-7405090e0000 pid=3593 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=b0a40ecb-1600-0000-a37d-7405090e0000 pid=3593 execve guuid=0bea70cb-1600-0000-a37d-74050b0e0000 pid=3595 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=0bea70cb-1600-0000-a37d-74050b0e0000 pid=3595 execve guuid=4c7363cc-1600-0000-a37d-74050c0e0000 pid=3596 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=4c7363cc-1600-0000-a37d-74050c0e0000 pid=3596 execve guuid=6a6eefcc-1600-0000-a37d-74050d0e0000 pid=3597 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=6a6eefcc-1600-0000-a37d-74050d0e0000 pid=3597 execve guuid=84bb70cd-1600-0000-a37d-74050e0e0000 pid=3598 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=84bb70cd-1600-0000-a37d-74050e0e0000 pid=3598 execve guuid=d3a5f1cd-1600-0000-a37d-74050f0e0000 pid=3599 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=d3a5f1cd-1600-0000-a37d-74050f0e0000 pid=3599 execve guuid=62215ece-1600-0000-a37d-7405110e0000 pid=3601 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=62215ece-1600-0000-a37d-7405110e0000 pid=3601 execve guuid=3f78e5ce-1600-0000-a37d-7405120e0000 pid=3602 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=3f78e5ce-1600-0000-a37d-7405120e0000 pid=3602 execve guuid=707058cf-1600-0000-a37d-7405130e0000 pid=3603 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=707058cf-1600-0000-a37d-7405130e0000 pid=3603 execve guuid=c61bbccf-1600-0000-a37d-7405150e0000 pid=3605 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=c61bbccf-1600-0000-a37d-7405150e0000 pid=3605 execve guuid=f57d10d0-1600-0000-a37d-7405170e0000 pid=3607 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=f57d10d0-1600-0000-a37d-7405170e0000 pid=3607 execve guuid=e84e66d0-1600-0000-a37d-74051a0e0000 pid=3610 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=e84e66d0-1600-0000-a37d-74051a0e0000 pid=3610 execve guuid=7a2812d1-1600-0000-a37d-74051d0e0000 pid=3613 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=7a2812d1-1600-0000-a37d-74051d0e0000 pid=3613 execve guuid=9ab16ad1-1600-0000-a37d-7405200e0000 pid=3616 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=9ab16ad1-1600-0000-a37d-7405200e0000 pid=3616 execve guuid=d951d2d1-1600-0000-a37d-7405220e0000 pid=3618 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=d951d2d1-1600-0000-a37d-7405220e0000 pid=3618 execve guuid=a2aa26d2-1600-0000-a37d-7405250e0000 pid=3621 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=a2aa26d2-1600-0000-a37d-7405250e0000 pid=3621 execve guuid=fdbd82d2-1600-0000-a37d-7405270e0000 pid=3623 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=fdbd82d2-1600-0000-a37d-7405270e0000 pid=3623 execve guuid=0b8ce1d2-1600-0000-a37d-7405290e0000 pid=3625 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=0b8ce1d2-1600-0000-a37d-7405290e0000 pid=3625 execve guuid=4d3244d3-1600-0000-a37d-74052b0e0000 pid=3627 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=4d3244d3-1600-0000-a37d-74052b0e0000 pid=3627 execve guuid=da63b1d3-1600-0000-a37d-74052e0e0000 pid=3630 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=da63b1d3-1600-0000-a37d-74052e0e0000 pid=3630 execve guuid=21ec14d4-1600-0000-a37d-7405300e0000 pid=3632 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=21ec14d4-1600-0000-a37d-7405300e0000 pid=3632 execve guuid=d00876d4-1600-0000-a37d-7405330e0000 pid=3635 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=d00876d4-1600-0000-a37d-7405330e0000 pid=3635 execve guuid=285ad8d4-1600-0000-a37d-7405350e0000 pid=3637 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=285ad8d4-1600-0000-a37d-7405350e0000 pid=3637 execve guuid=3e7436d5-1600-0000-a37d-7405370e0000 pid=3639 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=3e7436d5-1600-0000-a37d-7405370e0000 pid=3639 execve guuid=0bbe98d5-1600-0000-a37d-74053a0e0000 pid=3642 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=0bbe98d5-1600-0000-a37d-74053a0e0000 pid=3642 execve guuid=1b12fbd5-1600-0000-a37d-74053c0e0000 pid=3644 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=1b12fbd5-1600-0000-a37d-74053c0e0000 pid=3644 execve guuid=a01957d6-1600-0000-a37d-74053f0e0000 pid=3647 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=a01957d6-1600-0000-a37d-74053f0e0000 pid=3647 execve guuid=0636c1d6-1600-0000-a37d-7405410e0000 pid=3649 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=0636c1d6-1600-0000-a37d-7405410e0000 pid=3649 execve guuid=322128d7-1600-0000-a37d-7405440e0000 pid=3652 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=322128d7-1600-0000-a37d-7405440e0000 pid=3652 execve guuid=9b577fd7-1600-0000-a37d-7405480e0000 pid=3656 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=9b577fd7-1600-0000-a37d-7405480e0000 pid=3656 execve guuid=ab63dad7-1600-0000-a37d-74054a0e0000 pid=3658 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=ab63dad7-1600-0000-a37d-74054a0e0000 pid=3658 execve guuid=88433ad8-1600-0000-a37d-74054c0e0000 pid=3660 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=88433ad8-1600-0000-a37d-74054c0e0000 pid=3660 execve guuid=f20095d8-1600-0000-a37d-74054e0e0000 pid=3662 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=f20095d8-1600-0000-a37d-74054e0e0000 pid=3662 execve guuid=6e2eebd8-1600-0000-a37d-7405500e0000 pid=3664 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=6e2eebd8-1600-0000-a37d-7405500e0000 pid=3664 execve guuid=e8b740d9-1600-0000-a37d-7405520e0000 pid=3666 /usr/bin/ls guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=e8b740d9-1600-0000-a37d-7405520e0000 pid=3666 execve guuid=199f97d9-1600-0000-a37d-7405550e0000 pid=3669 /usr/bin/rm guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=199f97d9-1600-0000-a37d-7405550e0000 pid=3669 execve guuid=0166d0d9-1600-0000-a37d-7405560e0000 pid=3670 /usr/bin/wget net send-data write-file guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=0166d0d9-1600-0000-a37d-7405560e0000 pid=3670 execve guuid=e2f0fbe1-1600-0000-a37d-74056b0e0000 pid=3691 /usr/bin/chmod guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=e2f0fbe1-1600-0000-a37d-74056b0e0000 pid=3691 execve guuid=aaee7ae2-1600-0000-a37d-74056d0e0000 pid=3693 /tmp/hYO guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=aaee7ae2-1600-0000-a37d-74056d0e0000 pid=3693 execve guuid=fbfd6ee4-1600-0000-a37d-7405740e0000 pid=3700 /usr/bin/rm guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=fbfd6ee4-1600-0000-a37d-7405740e0000 pid=3700 execve guuid=0f7cd4e4-1600-0000-a37d-7405760e0000 pid=3702 /usr/bin/wget net send-data write-file guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=0f7cd4e4-1600-0000-a37d-7405760e0000 pid=3702 execve guuid=463187eb-1600-0000-a37d-7405870e0000 pid=3719 /usr/bin/chmod guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=463187eb-1600-0000-a37d-7405870e0000 pid=3719 execve guuid=169edceb-1600-0000-a37d-7405890e0000 pid=3721 /tmp/bfO guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=169edceb-1600-0000-a37d-7405890e0000 pid=3721 execve guuid=0a3702ed-1600-0000-a37d-74058e0e0000 pid=3726 /usr/bin/rm guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=0a3702ed-1600-0000-a37d-74058e0e0000 pid=3726 execve guuid=f81818ee-1600-0000-a37d-7405900e0000 pid=3728 /usr/bin/wget net send-data write-file guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=f81818ee-1600-0000-a37d-7405900e0000 pid=3728 execve guuid=720f8430-1700-0000-a37d-74051d0f0000 pid=3869 /usr/bin/chmod guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=720f8430-1700-0000-a37d-74051d0f0000 pid=3869 execve guuid=2774bf30-1700-0000-a37d-74051f0f0000 pid=3871 /tmp/DiN guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=2774bf30-1700-0000-a37d-74051f0f0000 pid=3871 execve guuid=61906431-1700-0000-a37d-7405230f0000 pid=3875 /usr/bin/rm guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=61906431-1700-0000-a37d-7405230f0000 pid=3875 execve guuid=ab42a131-1700-0000-a37d-7405250f0000 pid=3877 /usr/bin/wget net send-data write-file guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=ab42a131-1700-0000-a37d-7405250f0000 pid=3877 execve guuid=50237b37-1700-0000-a37d-7405460f0000 pid=3910 /usr/bin/chmod guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=50237b37-1700-0000-a37d-7405460f0000 pid=3910 execve guuid=9288b337-1700-0000-a37d-7405490f0000 pid=3913 /tmp/9VB guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=9288b337-1700-0000-a37d-7405490f0000 pid=3913 execve guuid=ea945b38-1700-0000-a37d-7405500f0000 pid=3920 /usr/bin/rm guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=ea945b38-1700-0000-a37d-7405500f0000 pid=3920 execve guuid=1fc89a38-1700-0000-a37d-7405520f0000 pid=3922 /usr/bin/wget net send-data write-file guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=1fc89a38-1700-0000-a37d-7405520f0000 pid=3922 execve guuid=8db8eb3e-1700-0000-a37d-7405710f0000 pid=3953 /usr/bin/chmod guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=8db8eb3e-1700-0000-a37d-7405710f0000 pid=3953 execve guuid=f9f9283f-1700-0000-a37d-7405740f0000 pid=3956 /tmp/lr6 guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=f9f9283f-1700-0000-a37d-7405740f0000 pid=3956 execve guuid=7f0e9640-1700-0000-a37d-7405800f0000 pid=3968 /usr/bin/rm delete-file guuid=987027a9-1600-0000-a37d-7405600d0000 pid=3424->guuid=7f0e9640-1700-0000-a37d-7405800f0000 pid=3968 execve 9554d36e-3083-568e-90da-bb8e3c487b07 188.132.232.81:80 guuid=0166d0d9-1600-0000-a37d-7405560e0000 pid=3670->9554d36e-3083-568e-90da-bb8e3c487b07 send: 132B guuid=0f7cd4e4-1600-0000-a37d-7405760e0000 pid=3702->9554d36e-3083-568e-90da-bb8e3c487b07 send: 132B guuid=f81818ee-1600-0000-a37d-7405900e0000 pid=3728->9554d36e-3083-568e-90da-bb8e3c487b07 send: 132B guuid=ab42a131-1700-0000-a37d-7405250f0000 pid=3877->9554d36e-3083-568e-90da-bb8e3c487b07 send: 132B guuid=1fc89a38-1700-0000-a37d-7405520f0000 pid=3922->9554d36e-3083-568e-90da-bb8e3c487b07 send: 132B
Score:
99%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/a035e0bfd2cce492ff9b54ee668934775d53dd9f15b6f10d25bee1c88966cd1d
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a035e0bfd2cce492ff9b54ee668934775d53dd9f15b6f10d25bee1c88966cd1d/
Threat name:
Win32.Trojan.Vigorf
Create hunting rule
Status:
Malicious
First seen:
2026-06-10 05:23:34 UTC
File Type:
Text (Shell)
AV detection:
12 of 23 (52.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ua26bp6sztsjf743ktxgncjuo5ovhxm7cw3pcdjfx3q4rclgzuoq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
defense_evasion discovery linux
Link:
https://tria.ge/reports/260610-f3ctrses3v/
Behaviour
Reads runtime system information
Writes file to tmp directory
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.26
Link:
https://yomi.yoroi.company/submissions/a035e0bfd2cce492ff9b54ee668934775d53dd9f15b6f10d25bee1c88966cd1d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh a035e0bfd2cce492ff9b54ee668934775d53dd9f15b6f10d25bee1c88966cd1d

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3856423/
  
Delivery method
Distributed via web download

Comments