🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a093015413d6d543e3d5d863be6e44b853a2055849df37f8070175aae44d42e0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a093015413d6d543e3d5d863be6e44b853a2055849df37f8070175aae44d42e0
SHA3-384 hash: 6943b20f151559e914d91b197ff93d140ebd3d493c3509eb9c9a93da0474c5247fe509f56e3d0645812d52412ff0a3c4
SHA1 hash: 257bf22146cc9c22d1ae6eb3431bea96a28ca1e0
MD5 hash: 9222bdff9810874530022442e242baf8
humanhash: double-october-william-spring
File name:ok
Download: download sample
File size:1'584 bytes
First seen:2026-06-21 09:19:39 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 24:gcxiHz3H5MLhmGrkEaxhCXECJhGXKn7oqs:gcxir5+hm2kEajCXECJhGa7e
TLSH T1A3316CDB44190E390603DADE73633548B10C9AEB286BDB94CC584EEDC68C2CCB266FC5
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://5.182.210.61/1b97a5n/an/aelf ua-wget
http://5.182.210.61/e0be9an/an/aelf ua-wget
http://5.182.210.61/a4eb82n/an/aelf ua-wget
http://5.182.210.61/13a883n/an/aelf ua-wget
http://5.182.210.61/a35c4en/an/aelf ua-wget
http://5.182.210.61/bb35den/an/aelf ua-wget
http://5.182.210.61/4bbcc0n/an/aelf ua-wget
http://5.182.210.61/05e7f4n/an/aelf ua-wget
http://5.182.210.61/2752f0n/an/aelf ua-wget
http://5.182.210.61/eed7e2n/an/aelf ua-wget
http://5.182.210.61/05d0cbn/an/aelf ua-wget
http://5.182.210.61/e58f36n/an/aelf ua-wget

Intelligence

File Origin
# of uploads :
1
# of downloads :
102
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive
Link:
https://www.filescan.io/uploads/6a37aced9799578a6c438127/reports/19285d71-899a-496b-9555-160dbcb611a0/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-06-21T06:28:00Z UTC
Last seen:
2026-06-21T09:08:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan-Downloader.Shell.Agent.a
Link:
https://opentip.kaspersky.com/a093015413d6d543e3d5d863be6e44b853a2055849df37f8070175aae44d42e0/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/4fbf0381-9959-4a93-9f6e-955b73058261
Behavior Graph:
Download SVG
%3 guuid=2b3e5b5a-1900-0000-6dd2-cac82b140000 pid=5163 /usr/bin/sudo guuid=c48e5d5c-1900-0000-6dd2-cac82c140000 pid=5164 /tmp/sample.bin guuid=2b3e5b5a-1900-0000-6dd2-cac82b140000 pid=5163->guuid=c48e5d5c-1900-0000-6dd2-cac82c140000 pid=5164 execve guuid=c095c35c-1900-0000-6dd2-cac82d140000 pid=5165 /usr/bin/wget net send-data guuid=c48e5d5c-1900-0000-6dd2-cac82c140000 pid=5164->guuid=c095c35c-1900-0000-6dd2-cac82d140000 pid=5165 execve guuid=06f04c62-1900-0000-6dd2-cac82e140000 pid=5166 /usr/bin/curl net send-data write-file guuid=c48e5d5c-1900-0000-6dd2-cac82c140000 pid=5164->guuid=06f04c62-1900-0000-6dd2-cac82e140000 pid=5166 execve guuid=4c9edb6b-1900-0000-6dd2-cac82f140000 pid=5167 /usr/bin/chmod guuid=c48e5d5c-1900-0000-6dd2-cac82c140000 pid=5164->guuid=4c9edb6b-1900-0000-6dd2-cac82f140000 pid=5167 execve guuid=3b474c6c-1900-0000-6dd2-cac830140000 pid=5168 /usr/bin/bash guuid=c48e5d5c-1900-0000-6dd2-cac82c140000 pid=5164->guuid=3b474c6c-1900-0000-6dd2-cac830140000 pid=5168 clone guuid=faa7a76c-1900-0000-6dd2-cac832140000 pid=5170 /usr/bin/rm delete-file guuid=c48e5d5c-1900-0000-6dd2-cac82c140000 pid=5164->guuid=faa7a76c-1900-0000-6dd2-cac832140000 pid=5170 execve guuid=a252ef6c-1900-0000-6dd2-cac833140000 pid=5171 /usr/bin/rm guuid=c48e5d5c-1900-0000-6dd2-cac82c140000 pid=5164->guuid=a252ef6c-1900-0000-6dd2-cac833140000 pid=5171 execve guuid=77bb326d-1900-0000-6dd2-cac834140000 pid=5172 /usr/bin/wget net send-data guuid=c48e5d5c-1900-0000-6dd2-cac82c140000 pid=5164->guuid=77bb326d-1900-0000-6dd2-cac834140000 pid=5172 execve guuid=7a7c6a70-1900-0000-6dd2-cac835140000 pid=5173 /usr/bin/curl net send-data write-file guuid=c48e5d5c-1900-0000-6dd2-cac82c140000 pid=5164->guuid=7a7c6a70-1900-0000-6dd2-cac835140000 pid=5173 execve guuid=d972eb75-1900-0000-6dd2-cac836140000 pid=5174 /usr/bin/chmod guuid=c48e5d5c-1900-0000-6dd2-cac82c140000 pid=5164->guuid=d972eb75-1900-0000-6dd2-cac836140000 pid=5174 execve guuid=590a4876-1900-0000-6dd2-cac837140000 pid=5175 /usr/bin/bash guuid=c48e5d5c-1900-0000-6dd2-cac82c140000 pid=5164->guuid=590a4876-1900-0000-6dd2-cac837140000 pid=5175 clone guuid=0fa59676-1900-0000-6dd2-cac839140000 pid=5177 /usr/bin/rm delete-file guuid=c48e5d5c-1900-0000-6dd2-cac82c140000 pid=5164->guuid=0fa59676-1900-0000-6dd2-cac839140000 pid=5177 execve guuid=c2422277-1900-0000-6dd2-cac83a140000 pid=5178 /usr/bin/rm guuid=c48e5d5c-1900-0000-6dd2-cac82c140000 pid=5164->guuid=c2422277-1900-0000-6dd2-cac83a140000 pid=5178 execve guuid=12938877-1900-0000-6dd2-cac83b140000 pid=5179 /usr/bin/wget net send-data guuid=c48e5d5c-1900-0000-6dd2-cac82c140000 pid=5164->guuid=12938877-1900-0000-6dd2-cac83b140000 pid=5179 execve guuid=3e9e387a-1900-0000-6dd2-cac83c140000 pid=5180 /usr/bin/curl net send-data write-file guuid=c48e5d5c-1900-0000-6dd2-cac82c140000 pid=5164->guuid=3e9e387a-1900-0000-6dd2-cac83c140000 pid=5180 execve guuid=31cb2c7e-1900-0000-6dd2-cac83d140000 pid=5181 /usr/bin/chmod guuid=c48e5d5c-1900-0000-6dd2-cac82c140000 pid=5164->guuid=31cb2c7e-1900-0000-6dd2-cac83d140000 pid=5181 execve guuid=db7a977e-1900-0000-6dd2-cac83e140000 pid=5182 /usr/bin/bash guuid=c48e5d5c-1900-0000-6dd2-cac82c140000 pid=5164->guuid=db7a977e-1900-0000-6dd2-cac83e140000 pid=5182 clone guuid=2b7ff17e-1900-0000-6dd2-cac840140000 pid=5184 /usr/bin/rm delete-file guuid=c48e5d5c-1900-0000-6dd2-cac82c140000 pid=5164->guuid=2b7ff17e-1900-0000-6dd2-cac840140000 pid=5184 execve guuid=44763f7f-1900-0000-6dd2-cac841140000 pid=5185 /usr/bin/rm guuid=c48e5d5c-1900-0000-6dd2-cac82c140000 pid=5164->guuid=44763f7f-1900-0000-6dd2-cac841140000 pid=5185 execve guuid=8f33887f-1900-0000-6dd2-cac842140000 pid=5186 /usr/bin/wget net send-data guuid=c48e5d5c-1900-0000-6dd2-cac82c140000 pid=5164->guuid=8f33887f-1900-0000-6dd2-cac842140000 pid=5186 execve guuid=991bef81-1900-0000-6dd2-cac843140000 pid=5187 /usr/bin/curl net send-data write-file guuid=c48e5d5c-1900-0000-6dd2-cac82c140000 pid=5164->guuid=991bef81-1900-0000-6dd2-cac843140000 pid=5187 execve guuid=ee727385-1900-0000-6dd2-cac844140000 pid=5188 /usr/bin/chmod guuid=c48e5d5c-1900-0000-6dd2-cac82c140000 pid=5164->guuid=ee727385-1900-0000-6dd2-cac844140000 pid=5188 execve guuid=caadd085-1900-0000-6dd2-cac845140000 pid=5189 /usr/bin/bash guuid=c48e5d5c-1900-0000-6dd2-cac82c140000 pid=5164->guuid=caadd085-1900-0000-6dd2-cac845140000 pid=5189 clone guuid=981a7386-1900-0000-6dd2-cac847140000 pid=5191 /usr/bin/rm delete-file guuid=c48e5d5c-1900-0000-6dd2-cac82c140000 pid=5164->guuid=981a7386-1900-0000-6dd2-cac847140000 pid=5191 execve guuid=936cc486-1900-0000-6dd2-cac848140000 pid=5192 /usr/bin/rm guuid=c48e5d5c-1900-0000-6dd2-cac82c140000 pid=5164->guuid=936cc486-1900-0000-6dd2-cac848140000 pid=5192 execve guuid=b6241287-1900-0000-6dd2-cac849140000 pid=5193 /usr/bin/wget net send-data guuid=c48e5d5c-1900-0000-6dd2-cac82c140000 pid=5164->guuid=b6241287-1900-0000-6dd2-cac849140000 pid=5193 execve guuid=c33c198b-1900-0000-6dd2-cac84a140000 pid=5194 /usr/bin/curl net send-data write-file guuid=c48e5d5c-1900-0000-6dd2-cac82c140000 pid=5164->guuid=c33c198b-1900-0000-6dd2-cac84a140000 pid=5194 execve guuid=62274790-1900-0000-6dd2-cac84b140000 pid=5195 /usr/bin/chmod guuid=c48e5d5c-1900-0000-6dd2-cac82c140000 pid=5164->guuid=62274790-1900-0000-6dd2-cac84b140000 pid=5195 execve guuid=db81a490-1900-0000-6dd2-cac84c140000 pid=5196 /usr/bin/bash guuid=c48e5d5c-1900-0000-6dd2-cac82c140000 pid=5164->guuid=db81a490-1900-0000-6dd2-cac84c140000 pid=5196 clone guuid=84c32d91-1900-0000-6dd2-cac84e140000 pid=5198 /usr/bin/rm delete-file guuid=c48e5d5c-1900-0000-6dd2-cac82c140000 pid=5164->guuid=84c32d91-1900-0000-6dd2-cac84e140000 pid=5198 execve guuid=08cab491-1900-0000-6dd2-cac84f140000 pid=5199 /usr/bin/rm guuid=c48e5d5c-1900-0000-6dd2-cac82c140000 pid=5164->guuid=08cab491-1900-0000-6dd2-cac84f140000 pid=5199 execve guuid=a5c93192-1900-0000-6dd2-cac850140000 pid=5200 /usr/bin/wget net send-data guuid=c48e5d5c-1900-0000-6dd2-cac82c140000 pid=5164->guuid=a5c93192-1900-0000-6dd2-cac850140000 pid=5200 execve guuid=b5226e96-1900-0000-6dd2-cac852140000 pid=5202 /usr/bin/curl net send-data write-file guuid=c48e5d5c-1900-0000-6dd2-cac82c140000 pid=5164->guuid=b5226e96-1900-0000-6dd2-cac852140000 pid=5202 execve guuid=d8cdec9b-1900-0000-6dd2-cac853140000 pid=5203 /usr/bin/chmod guuid=c48e5d5c-1900-0000-6dd2-cac82c140000 pid=5164->guuid=d8cdec9b-1900-0000-6dd2-cac853140000 pid=5203 execve guuid=5781399c-1900-0000-6dd2-cac854140000 pid=5204 /usr/bin/bash guuid=c48e5d5c-1900-0000-6dd2-cac82c140000 pid=5164->guuid=5781399c-1900-0000-6dd2-cac854140000 pid=5204 clone guuid=e971769c-1900-0000-6dd2-cac856140000 pid=5206 /usr/bin/rm delete-file guuid=c48e5d5c-1900-0000-6dd2-cac82c140000 pid=5164->guuid=e971769c-1900-0000-6dd2-cac856140000 pid=5206 execve guuid=154fe39c-1900-0000-6dd2-cac857140000 pid=5207 /usr/bin/rm guuid=c48e5d5c-1900-0000-6dd2-cac82c140000 pid=5164->guuid=154fe39c-1900-0000-6dd2-cac857140000 pid=5207 execve guuid=76544c9d-1900-0000-6dd2-cac858140000 pid=5208 /usr/bin/wget net send-data guuid=c48e5d5c-1900-0000-6dd2-cac82c140000 pid=5164->guuid=76544c9d-1900-0000-6dd2-cac858140000 pid=5208 execve guuid=b04679a0-1900-0000-6dd2-cac859140000 pid=5209 /usr/bin/curl net send-data write-file guuid=c48e5d5c-1900-0000-6dd2-cac82c140000 pid=5164->guuid=b04679a0-1900-0000-6dd2-cac859140000 pid=5209 execve guuid=85e1d9a4-1900-0000-6dd2-cac85a140000 pid=5210 /usr/bin/chmod guuid=c48e5d5c-1900-0000-6dd2-cac82c140000 pid=5164->guuid=85e1d9a4-1900-0000-6dd2-cac85a140000 pid=5210 execve guuid=ce9a5da5-1900-0000-6dd2-cac85b140000 pid=5211 /usr/bin/bash guuid=c48e5d5c-1900-0000-6dd2-cac82c140000 pid=5164->guuid=ce9a5da5-1900-0000-6dd2-cac85b140000 pid=5211 clone guuid=fdc4bda5-1900-0000-6dd2-cac85d140000 pid=5213 /usr/bin/rm delete-file guuid=c48e5d5c-1900-0000-6dd2-cac82c140000 pid=5164->guuid=fdc4bda5-1900-0000-6dd2-cac85d140000 pid=5213 execve guuid=57998ea6-1900-0000-6dd2-cac85e140000 pid=5214 /usr/bin/rm guuid=c48e5d5c-1900-0000-6dd2-cac82c140000 pid=5164->guuid=57998ea6-1900-0000-6dd2-cac85e140000 pid=5214 execve guuid=f88538a7-1900-0000-6dd2-cac85f140000 pid=5215 /usr/bin/wget net send-data guuid=c48e5d5c-1900-0000-6dd2-cac82c140000 pid=5164->guuid=f88538a7-1900-0000-6dd2-cac85f140000 pid=5215 execve guuid=170fbaad-1900-0000-6dd2-cac866140000 pid=5222 /usr/bin/curl net send-data write-file guuid=c48e5d5c-1900-0000-6dd2-cac82c140000 pid=5164->guuid=170fbaad-1900-0000-6dd2-cac866140000 pid=5222 execve guuid=55e969b2-1900-0000-6dd2-cac867140000 pid=5223 /usr/bin/chmod guuid=c48e5d5c-1900-0000-6dd2-cac82c140000 pid=5164->guuid=55e969b2-1900-0000-6dd2-cac867140000 pid=5223 execve guuid=92bf3bb3-1900-0000-6dd2-cac868140000 pid=5224 /usr/bin/bash guuid=c48e5d5c-1900-0000-6dd2-cac82c140000 pid=5164->guuid=92bf3bb3-1900-0000-6dd2-cac868140000 pid=5224 clone guuid=be6bb3b3-1900-0000-6dd2-cac86a140000 pid=5226 /usr/bin/rm delete-file guuid=c48e5d5c-1900-0000-6dd2-cac82c140000 pid=5164->guuid=be6bb3b3-1900-0000-6dd2-cac86a140000 pid=5226 execve guuid=6be818b4-1900-0000-6dd2-cac86b140000 pid=5227 /usr/bin/rm guuid=c48e5d5c-1900-0000-6dd2-cac82c140000 pid=5164->guuid=6be818b4-1900-0000-6dd2-cac86b140000 pid=5227 execve guuid=81a4beb4-1900-0000-6dd2-cac86c140000 pid=5228 /usr/bin/wget net send-data guuid=c48e5d5c-1900-0000-6dd2-cac82c140000 pid=5164->guuid=81a4beb4-1900-0000-6dd2-cac86c140000 pid=5228 execve guuid=43cdbcb7-1900-0000-6dd2-cac86d140000 pid=5229 /usr/bin/curl net send-data write-file guuid=c48e5d5c-1900-0000-6dd2-cac82c140000 pid=5164->guuid=43cdbcb7-1900-0000-6dd2-cac86d140000 pid=5229 execve guuid=76108dbc-1900-0000-6dd2-cac86e140000 pid=5230 /usr/bin/chmod guuid=c48e5d5c-1900-0000-6dd2-cac82c140000 pid=5164->guuid=76108dbc-1900-0000-6dd2-cac86e140000 pid=5230 execve guuid=fa232fbd-1900-0000-6dd2-cac86f140000 pid=5231 /usr/bin/bash guuid=c48e5d5c-1900-0000-6dd2-cac82c140000 pid=5164->guuid=fa232fbd-1900-0000-6dd2-cac86f140000 pid=5231 clone guuid=f2d2afbd-1900-0000-6dd2-cac871140000 pid=5233 /usr/bin/rm delete-file guuid=c48e5d5c-1900-0000-6dd2-cac82c140000 pid=5164->guuid=f2d2afbd-1900-0000-6dd2-cac871140000 pid=5233 execve guuid=863643be-1900-0000-6dd2-cac872140000 pid=5234 /usr/bin/rm guuid=c48e5d5c-1900-0000-6dd2-cac82c140000 pid=5164->guuid=863643be-1900-0000-6dd2-cac872140000 pid=5234 execve guuid=d317cbbe-1900-0000-6dd2-cac873140000 pid=5235 /usr/bin/wget net send-data guuid=c48e5d5c-1900-0000-6dd2-cac82c140000 pid=5164->guuid=d317cbbe-1900-0000-6dd2-cac873140000 pid=5235 execve guuid=8b5f1cc2-1900-0000-6dd2-cac874140000 pid=5236 /usr/bin/curl net send-data write-file guuid=c48e5d5c-1900-0000-6dd2-cac82c140000 pid=5164->guuid=8b5f1cc2-1900-0000-6dd2-cac874140000 pid=5236 execve guuid=d9ed22c8-1900-0000-6dd2-cac875140000 pid=5237 /usr/bin/chmod guuid=c48e5d5c-1900-0000-6dd2-cac82c140000 pid=5164->guuid=d9ed22c8-1900-0000-6dd2-cac875140000 pid=5237 execve guuid=4a1187c8-1900-0000-6dd2-cac876140000 pid=5238 /usr/bin/bash guuid=c48e5d5c-1900-0000-6dd2-cac82c140000 pid=5164->guuid=4a1187c8-1900-0000-6dd2-cac876140000 pid=5238 clone guuid=b278d7c8-1900-0000-6dd2-cac878140000 pid=5240 /usr/bin/rm delete-file guuid=c48e5d5c-1900-0000-6dd2-cac82c140000 pid=5164->guuid=b278d7c8-1900-0000-6dd2-cac878140000 pid=5240 execve guuid=a9976acb-1900-0000-6dd2-cac879140000 pid=5241 /usr/bin/rm guuid=c48e5d5c-1900-0000-6dd2-cac82c140000 pid=5164->guuid=a9976acb-1900-0000-6dd2-cac879140000 pid=5241 execve guuid=f8d8d5cb-1900-0000-6dd2-cac87a140000 pid=5242 /usr/bin/wget net send-data guuid=c48e5d5c-1900-0000-6dd2-cac82c140000 pid=5164->guuid=f8d8d5cb-1900-0000-6dd2-cac87a140000 pid=5242 execve guuid=b05cbbce-1900-0000-6dd2-cac87b140000 pid=5243 /usr/bin/curl net send-data write-file guuid=c48e5d5c-1900-0000-6dd2-cac82c140000 pid=5164->guuid=b05cbbce-1900-0000-6dd2-cac87b140000 pid=5243 execve guuid=f1758ad3-1900-0000-6dd2-cac87c140000 pid=5244 /usr/bin/chmod guuid=c48e5d5c-1900-0000-6dd2-cac82c140000 pid=5164->guuid=f1758ad3-1900-0000-6dd2-cac87c140000 pid=5244 execve guuid=aa4b1dd4-1900-0000-6dd2-cac87d140000 pid=5245 /usr/bin/bash guuid=c48e5d5c-1900-0000-6dd2-cac82c140000 pid=5164->guuid=aa4b1dd4-1900-0000-6dd2-cac87d140000 pid=5245 clone guuid=d7f676d4-1900-0000-6dd2-cac87f140000 pid=5247 /usr/bin/rm delete-file guuid=c48e5d5c-1900-0000-6dd2-cac82c140000 pid=5164->guuid=d7f676d4-1900-0000-6dd2-cac87f140000 pid=5247 execve guuid=2387e9d4-1900-0000-6dd2-cac880140000 pid=5248 /usr/bin/rm guuid=c48e5d5c-1900-0000-6dd2-cac82c140000 pid=5164->guuid=2387e9d4-1900-0000-6dd2-cac880140000 pid=5248 execve guuid=a63d57d5-1900-0000-6dd2-cac881140000 pid=5249 /usr/bin/wget net send-data guuid=c48e5d5c-1900-0000-6dd2-cac82c140000 pid=5164->guuid=a63d57d5-1900-0000-6dd2-cac881140000 pid=5249 execve guuid=8da240d9-1900-0000-6dd2-cac882140000 pid=5250 /usr/bin/curl net send-data write-file guuid=c48e5d5c-1900-0000-6dd2-cac82c140000 pid=5164->guuid=8da240d9-1900-0000-6dd2-cac882140000 pid=5250 execve guuid=94e8fadf-1900-0000-6dd2-cac883140000 pid=5251 /usr/bin/chmod guuid=c48e5d5c-1900-0000-6dd2-cac82c140000 pid=5164->guuid=94e8fadf-1900-0000-6dd2-cac883140000 pid=5251 execve guuid=fa8e67e0-1900-0000-6dd2-cac884140000 pid=5252 /usr/bin/bash guuid=c48e5d5c-1900-0000-6dd2-cac82c140000 pid=5164->guuid=fa8e67e0-1900-0000-6dd2-cac884140000 pid=5252 clone guuid=8f7ec5e0-1900-0000-6dd2-cac886140000 pid=5254 /usr/bin/rm delete-file guuid=c48e5d5c-1900-0000-6dd2-cac82c140000 pid=5164->guuid=8f7ec5e0-1900-0000-6dd2-cac886140000 pid=5254 execve guuid=2e3335e1-1900-0000-6dd2-cac887140000 pid=5255 /usr/bin/rm guuid=c48e5d5c-1900-0000-6dd2-cac82c140000 pid=5164->guuid=2e3335e1-1900-0000-6dd2-cac887140000 pid=5255 execve 9e33e6d7-6ac7-5a65-88f4-941337e56821 5.182.210.61:80 guuid=c095c35c-1900-0000-6dd2-cac82d140000 pid=5165->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=06f04c62-1900-0000-6dd2-cac82e140000 pid=5166->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=e1a9696c-1900-0000-6dd2-cac831140000 pid=5169 /usr/bin/bash guuid=3b474c6c-1900-0000-6dd2-cac830140000 pid=5168->guuid=e1a9696c-1900-0000-6dd2-cac831140000 pid=5169 clone guuid=77bb326d-1900-0000-6dd2-cac834140000 pid=5172->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=7a7c6a70-1900-0000-6dd2-cac835140000 pid=5173->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=5b176e76-1900-0000-6dd2-cac838140000 pid=5176 /usr/bin/bash guuid=590a4876-1900-0000-6dd2-cac837140000 pid=5175->guuid=5b176e76-1900-0000-6dd2-cac838140000 pid=5176 clone guuid=12938877-1900-0000-6dd2-cac83b140000 pid=5179->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=3e9e387a-1900-0000-6dd2-cac83c140000 pid=5180->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=94f3c07e-1900-0000-6dd2-cac83f140000 pid=5183 /usr/bin/bash guuid=db7a977e-1900-0000-6dd2-cac83e140000 pid=5182->guuid=94f3c07e-1900-0000-6dd2-cac83f140000 pid=5183 clone guuid=8f33887f-1900-0000-6dd2-cac842140000 pid=5186->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=991bef81-1900-0000-6dd2-cac843140000 pid=5187->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=81e9f485-1900-0000-6dd2-cac846140000 pid=5190 /usr/bin/bash guuid=caadd085-1900-0000-6dd2-cac845140000 pid=5189->guuid=81e9f485-1900-0000-6dd2-cac846140000 pid=5190 clone guuid=b6241287-1900-0000-6dd2-cac849140000 pid=5193->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=c33c198b-1900-0000-6dd2-cac84a140000 pid=5194->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=91ccc290-1900-0000-6dd2-cac84d140000 pid=5197 /usr/bin/bash guuid=db81a490-1900-0000-6dd2-cac84c140000 pid=5196->guuid=91ccc290-1900-0000-6dd2-cac84d140000 pid=5197 clone guuid=a5c93192-1900-0000-6dd2-cac850140000 pid=5200->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=b5226e96-1900-0000-6dd2-cac852140000 pid=5202->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=fecf529c-1900-0000-6dd2-cac855140000 pid=5205 /usr/bin/bash guuid=5781399c-1900-0000-6dd2-cac854140000 pid=5204->guuid=fecf529c-1900-0000-6dd2-cac855140000 pid=5205 clone guuid=76544c9d-1900-0000-6dd2-cac858140000 pid=5208->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=b04679a0-1900-0000-6dd2-cac859140000 pid=5209->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=b74485a5-1900-0000-6dd2-cac85c140000 pid=5212 /usr/bin/bash guuid=ce9a5da5-1900-0000-6dd2-cac85b140000 pid=5211->guuid=b74485a5-1900-0000-6dd2-cac85c140000 pid=5212 clone guuid=f88538a7-1900-0000-6dd2-cac85f140000 pid=5215->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=170fbaad-1900-0000-6dd2-cac866140000 pid=5222->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=59e965b3-1900-0000-6dd2-cac869140000 pid=5225 /usr/bin/bash guuid=92bf3bb3-1900-0000-6dd2-cac868140000 pid=5224->guuid=59e965b3-1900-0000-6dd2-cac869140000 pid=5225 clone guuid=81a4beb4-1900-0000-6dd2-cac86c140000 pid=5228->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=43cdbcb7-1900-0000-6dd2-cac86d140000 pid=5229->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=304a63bd-1900-0000-6dd2-cac870140000 pid=5232 /usr/bin/bash guuid=fa232fbd-1900-0000-6dd2-cac86f140000 pid=5231->guuid=304a63bd-1900-0000-6dd2-cac870140000 pid=5232 clone guuid=d317cbbe-1900-0000-6dd2-cac873140000 pid=5235->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=8b5f1cc2-1900-0000-6dd2-cac874140000 pid=5236->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=11d4aac8-1900-0000-6dd2-cac877140000 pid=5239 /usr/bin/bash guuid=4a1187c8-1900-0000-6dd2-cac876140000 pid=5238->guuid=11d4aac8-1900-0000-6dd2-cac877140000 pid=5239 clone guuid=f8d8d5cb-1900-0000-6dd2-cac87a140000 pid=5242->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=b05cbbce-1900-0000-6dd2-cac87b140000 pid=5243->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=cb2042d4-1900-0000-6dd2-cac87e140000 pid=5246 /usr/bin/bash guuid=aa4b1dd4-1900-0000-6dd2-cac87d140000 pid=5245->guuid=cb2042d4-1900-0000-6dd2-cac87e140000 pid=5246 clone guuid=a63d57d5-1900-0000-6dd2-cac881140000 pid=5249->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=8da240d9-1900-0000-6dd2-cac882140000 pid=5250->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=42b194e0-1900-0000-6dd2-cac885140000 pid=5253 /usr/bin/bash guuid=fa8e67e0-1900-0000-6dd2-cac884140000 pid=5252->guuid=42b194e0-1900-0000-6dd2-cac885140000 pid=5253 clone
Score:
99%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/a093015413d6d543e3d5d863be6e44b853a2055849df37f8070175aae44d42e0
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a093015413d6d543e3d5d863be6e44b853a2055849df37f8070175aae44d42e0/
Verdict:
Malicious
Threat:
Trojan-Downloader.Shell.Agent
Link:
https://tip.neiki.dev/file/a093015413d6d543e3d5d863be6e44b853a2055849df37f8070175aae44d42e0
Threat name:
Win32.Trojan.Vigorf
Create hunting rule
Status:
Malicious
First seen:
2026-06-21 09:20:52 UTC
File Type:
Text (Shell)
AV detection:
14 of 24 (58.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ucjqcvat23kuhy6v3br343sexbj2ebkyjhptp6ahaf22vzcnilqa._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260621-la6t2acv5q/
Behaviour
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.11
Link:
https://yomi.yoroi.company/submissions/a093015413d6d543e3d5d863be6e44b853a2055849df37f8070175aae44d42e0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh a093015413d6d543e3d5d863be6e44b853a2055849df37f8070175aae44d42e0

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3864548/
  
Delivery method
Distributed via web download

Comments