MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a643f6e4c319e5dfc5d67da0d4304cc8def9ae687404fafef0462aa270857393. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a643f6e4c319e5dfc5d67da0d4304cc8def9ae687404fafef0462aa270857393
SHA3-384 hash: 64c4badaaa05f9ebbee35ad8e828894cd2f7559cf468cf9172709a2482582e4f03ffc49bb8b678614d1bd45e6d615733
SHA1 hash: 07820244bcb98af633b95b45ac2fa09f81182f79
MD5 hash: 82b0a4cb5b8e2a2ab76fabdea13266f0
humanhash: blossom-pennsylvania-muppet-comet
File name:p
Download: download sample
File size:834 bytes
First seen:2026-06-05 01:35:36 UTC
Last seen:2026-06-05 10:32:10 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 24:kXCKysE2hi0ziQvZohasjGjhqYuTzMgy7:e9Qp+MssjGjhqYuTz9y7
TLSH T1D901AFC9C1019B70418AE8AE26AB61C07811C3CF55458BB47FDC543D97ADB58706DF94
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://188.132.232.81/elln/an/aelf ua-wget
http://188.132.232.81/Zjf5n/an/aelf ua-wget
http://188.132.232.81/O2dn/an/aelf ua-wget
http://188.132.232.81/ED5Hn/an/aelf ua-wget
http://188.132.232.81/Mn0rn/an/aelf ua-wget

Intelligence

File Origin
# of uploads :
2
# of downloads :
51
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive
Link:
https://www.filescan.io/uploads/6a222815099ef368af2040ab/reports/2f4ac0d6-d25a-4fc9-aa56-fcdaf5a63a3f/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-06-04T22:41:00Z UTC
Last seen:
2026-06-06T21:47:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan-Downloader.Shell.Agent.a
Link:
https://opentip.kaspersky.com/a643f6e4c319e5dfc5d67da0d4304cc8def9ae687404fafef0462aa270857393/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/1c5e8983-d5cc-4a85-b6de-1fb59d0ef884
Behavior Graph:
Download SVG
%3 guuid=8a461696-1800-0000-8c15-faa4820c0000 pid=3202 /usr/bin/sudo guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209 /tmp/sample.bin write-file guuid=8a461696-1800-0000-8c15-faa4820c0000 pid=3202->guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209 execve guuid=e0bb8e98-1800-0000-8c15-faa48b0c0000 pid=3211 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=e0bb8e98-1800-0000-8c15-faa48b0c0000 pid=3211 execve guuid=1ed00e99-1800-0000-8c15-faa48c0c0000 pid=3212 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=1ed00e99-1800-0000-8c15-faa48c0c0000 pid=3212 execve guuid=b32da699-1800-0000-8c15-faa48d0c0000 pid=3213 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=b32da699-1800-0000-8c15-faa48d0c0000 pid=3213 execve guuid=824f2b9a-1800-0000-8c15-faa48e0c0000 pid=3214 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=824f2b9a-1800-0000-8c15-faa48e0c0000 pid=3214 execve guuid=9026f69a-1800-0000-8c15-faa48f0c0000 pid=3215 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=9026f69a-1800-0000-8c15-faa48f0c0000 pid=3215 execve guuid=c3a4859b-1800-0000-8c15-faa4900c0000 pid=3216 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=c3a4859b-1800-0000-8c15-faa4900c0000 pid=3216 execve guuid=f9891e9c-1800-0000-8c15-faa4910c0000 pid=3217 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=f9891e9c-1800-0000-8c15-faa4910c0000 pid=3217 execve guuid=fac5a59c-1800-0000-8c15-faa4920c0000 pid=3218 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=fac5a59c-1800-0000-8c15-faa4920c0000 pid=3218 execve guuid=6481229d-1800-0000-8c15-faa4930c0000 pid=3219 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=6481229d-1800-0000-8c15-faa4930c0000 pid=3219 execve guuid=7433999d-1800-0000-8c15-faa4940c0000 pid=3220 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=7433999d-1800-0000-8c15-faa4940c0000 pid=3220 execve guuid=2708249e-1800-0000-8c15-faa4950c0000 pid=3221 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=2708249e-1800-0000-8c15-faa4950c0000 pid=3221 execve guuid=b8ddb09e-1800-0000-8c15-faa4960c0000 pid=3222 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=b8ddb09e-1800-0000-8c15-faa4960c0000 pid=3222 execve guuid=8f8a319f-1800-0000-8c15-faa4970c0000 pid=3223 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=8f8a319f-1800-0000-8c15-faa4970c0000 pid=3223 execve guuid=985eb09f-1800-0000-8c15-faa4980c0000 pid=3224 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=985eb09f-1800-0000-8c15-faa4980c0000 pid=3224 execve guuid=84be2da0-1800-0000-8c15-faa4990c0000 pid=3225 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=84be2da0-1800-0000-8c15-faa4990c0000 pid=3225 execve guuid=caaf9fa0-1800-0000-8c15-faa49a0c0000 pid=3226 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=caaf9fa0-1800-0000-8c15-faa49a0c0000 pid=3226 execve guuid=11b329a1-1800-0000-8c15-faa49b0c0000 pid=3227 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=11b329a1-1800-0000-8c15-faa49b0c0000 pid=3227 execve guuid=c19cbaa1-1800-0000-8c15-faa49c0c0000 pid=3228 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=c19cbaa1-1800-0000-8c15-faa49c0c0000 pid=3228 execve guuid=d03f62a2-1800-0000-8c15-faa49d0c0000 pid=3229 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=d03f62a2-1800-0000-8c15-faa49d0c0000 pid=3229 execve guuid=6e20f7a2-1800-0000-8c15-faa49e0c0000 pid=3230 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=6e20f7a2-1800-0000-8c15-faa49e0c0000 pid=3230 execve guuid=9ac892a3-1800-0000-8c15-faa49f0c0000 pid=3231 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=9ac892a3-1800-0000-8c15-faa49f0c0000 pid=3231 execve guuid=7a8329a4-1800-0000-8c15-faa4a00c0000 pid=3232 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=7a8329a4-1800-0000-8c15-faa4a00c0000 pid=3232 execve guuid=fabfdba4-1800-0000-8c15-faa4a10c0000 pid=3233 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=fabfdba4-1800-0000-8c15-faa4a10c0000 pid=3233 execve guuid=28e472a5-1800-0000-8c15-faa4a20c0000 pid=3234 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=28e472a5-1800-0000-8c15-faa4a20c0000 pid=3234 execve guuid=270a04a7-1800-0000-8c15-faa4a30c0000 pid=3235 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=270a04a7-1800-0000-8c15-faa4a30c0000 pid=3235 execve guuid=44e093a7-1800-0000-8c15-faa4a40c0000 pid=3236 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=44e093a7-1800-0000-8c15-faa4a40c0000 pid=3236 execve guuid=acbb21a8-1800-0000-8c15-faa4a50c0000 pid=3237 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=acbb21a8-1800-0000-8c15-faa4a50c0000 pid=3237 execve guuid=d1b43ba9-1800-0000-8c15-faa4a60c0000 pid=3238 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=d1b43ba9-1800-0000-8c15-faa4a60c0000 pid=3238 execve guuid=a0e2e5a9-1800-0000-8c15-faa4a70c0000 pid=3239 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=a0e2e5a9-1800-0000-8c15-faa4a70c0000 pid=3239 execve guuid=ec1aceaa-1800-0000-8c15-faa4a80c0000 pid=3240 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=ec1aceaa-1800-0000-8c15-faa4a80c0000 pid=3240 execve guuid=1fe997ab-1800-0000-8c15-faa4a90c0000 pid=3241 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=1fe997ab-1800-0000-8c15-faa4a90c0000 pid=3241 execve guuid=b4c861ac-1800-0000-8c15-faa4aa0c0000 pid=3242 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=b4c861ac-1800-0000-8c15-faa4aa0c0000 pid=3242 execve guuid=852e2aad-1800-0000-8c15-faa4ab0c0000 pid=3243 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=852e2aad-1800-0000-8c15-faa4ab0c0000 pid=3243 execve guuid=f7aee0ad-1800-0000-8c15-faa4ac0c0000 pid=3244 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=f7aee0ad-1800-0000-8c15-faa4ac0c0000 pid=3244 execve guuid=fa3673ae-1800-0000-8c15-faa4ae0c0000 pid=3246 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=fa3673ae-1800-0000-8c15-faa4ae0c0000 pid=3246 execve guuid=64703aaf-1800-0000-8c15-faa4af0c0000 pid=3247 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=64703aaf-1800-0000-8c15-faa4af0c0000 pid=3247 execve guuid=5a68daaf-1800-0000-8c15-faa4b00c0000 pid=3248 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=5a68daaf-1800-0000-8c15-faa4b00c0000 pid=3248 execve guuid=1ee63cb0-1800-0000-8c15-faa4b20c0000 pid=3250 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=1ee63cb0-1800-0000-8c15-faa4b20c0000 pid=3250 execve guuid=d77696b0-1800-0000-8c15-faa4b50c0000 pid=3253 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=d77696b0-1800-0000-8c15-faa4b50c0000 pid=3253 execve guuid=0e105ab1-1800-0000-8c15-faa4b60c0000 pid=3254 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=0e105ab1-1800-0000-8c15-faa4b60c0000 pid=3254 execve guuid=1187cfb1-1800-0000-8c15-faa4b90c0000 pid=3257 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=1187cfb1-1800-0000-8c15-faa4b90c0000 pid=3257 execve guuid=b33069b2-1800-0000-8c15-faa4bb0c0000 pid=3259 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=b33069b2-1800-0000-8c15-faa4bb0c0000 pid=3259 execve guuid=1497cdb2-1800-0000-8c15-faa4bd0c0000 pid=3261 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=1497cdb2-1800-0000-8c15-faa4bd0c0000 pid=3261 execve guuid=80534cb3-1800-0000-8c15-faa4be0c0000 pid=3262 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=80534cb3-1800-0000-8c15-faa4be0c0000 pid=3262 execve guuid=0fddb2b3-1800-0000-8c15-faa4c00c0000 pid=3264 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=0fddb2b3-1800-0000-8c15-faa4c00c0000 pid=3264 execve guuid=914a0bb4-1800-0000-8c15-faa4c20c0000 pid=3266 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=914a0bb4-1800-0000-8c15-faa4c20c0000 pid=3266 execve guuid=fa8e72b4-1800-0000-8c15-faa4c50c0000 pid=3269 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=fa8e72b4-1800-0000-8c15-faa4c50c0000 pid=3269 execve guuid=4774d1b4-1800-0000-8c15-faa4c80c0000 pid=3272 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=4774d1b4-1800-0000-8c15-faa4c80c0000 pid=3272 execve guuid=7f452bb5-1800-0000-8c15-faa4c90c0000 pid=3273 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=7f452bb5-1800-0000-8c15-faa4c90c0000 pid=3273 execve guuid=6133c2b5-1800-0000-8c15-faa4ca0c0000 pid=3274 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=6133c2b5-1800-0000-8c15-faa4ca0c0000 pid=3274 execve guuid=26df48b6-1800-0000-8c15-faa4cc0c0000 pid=3276 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=26df48b6-1800-0000-8c15-faa4cc0c0000 pid=3276 execve guuid=d591b2b6-1800-0000-8c15-faa4cd0c0000 pid=3277 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=d591b2b6-1800-0000-8c15-faa4cd0c0000 pid=3277 execve guuid=448125b7-1800-0000-8c15-faa4d00c0000 pid=3280 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=448125b7-1800-0000-8c15-faa4d00c0000 pid=3280 execve guuid=686ffdb7-1800-0000-8c15-faa4d30c0000 pid=3283 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=686ffdb7-1800-0000-8c15-faa4d30c0000 pid=3283 execve guuid=6d6a77b8-1800-0000-8c15-faa4d60c0000 pid=3286 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=6d6a77b8-1800-0000-8c15-faa4d60c0000 pid=3286 execve guuid=326c1eb9-1800-0000-8c15-faa4d70c0000 pid=3287 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=326c1eb9-1800-0000-8c15-faa4d70c0000 pid=3287 execve guuid=bb77abb9-1800-0000-8c15-faa4d80c0000 pid=3288 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=bb77abb9-1800-0000-8c15-faa4d80c0000 pid=3288 execve guuid=107834ba-1800-0000-8c15-faa4d90c0000 pid=3289 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=107834ba-1800-0000-8c15-faa4d90c0000 pid=3289 execve guuid=1d95b8ba-1800-0000-8c15-faa4da0c0000 pid=3290 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=1d95b8ba-1800-0000-8c15-faa4da0c0000 pid=3290 execve guuid=ec182fbb-1800-0000-8c15-faa4db0c0000 pid=3291 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=ec182fbb-1800-0000-8c15-faa4db0c0000 pid=3291 execve guuid=54cfabbb-1800-0000-8c15-faa4dc0c0000 pid=3292 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=54cfabbb-1800-0000-8c15-faa4dc0c0000 pid=3292 execve guuid=969e22bc-1800-0000-8c15-faa4dd0c0000 pid=3293 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=969e22bc-1800-0000-8c15-faa4dd0c0000 pid=3293 execve guuid=2fdf9bbc-1800-0000-8c15-faa4de0c0000 pid=3294 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=2fdf9bbc-1800-0000-8c15-faa4de0c0000 pid=3294 execve guuid=ea8c14bd-1800-0000-8c15-faa4df0c0000 pid=3295 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=ea8c14bd-1800-0000-8c15-faa4df0c0000 pid=3295 execve guuid=130391bd-1800-0000-8c15-faa4e00c0000 pid=3296 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=130391bd-1800-0000-8c15-faa4e00c0000 pid=3296 execve guuid=c33311be-1800-0000-8c15-faa4e10c0000 pid=3297 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=c33311be-1800-0000-8c15-faa4e10c0000 pid=3297 execve guuid=2a43e1be-1800-0000-8c15-faa4e20c0000 pid=3298 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=2a43e1be-1800-0000-8c15-faa4e20c0000 pid=3298 execve guuid=a267a1bf-1800-0000-8c15-faa4e30c0000 pid=3299 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=a267a1bf-1800-0000-8c15-faa4e30c0000 pid=3299 execve guuid=632f25c0-1800-0000-8c15-faa4e50c0000 pid=3301 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=632f25c0-1800-0000-8c15-faa4e50c0000 pid=3301 execve guuid=ff2fb0c0-1800-0000-8c15-faa4e60c0000 pid=3302 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=ff2fb0c0-1800-0000-8c15-faa4e60c0000 pid=3302 execve guuid=2db139c1-1800-0000-8c15-faa4e70c0000 pid=3303 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=2db139c1-1800-0000-8c15-faa4e70c0000 pid=3303 execve guuid=4a5aaec1-1800-0000-8c15-faa4e90c0000 pid=3305 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=4a5aaec1-1800-0000-8c15-faa4e90c0000 pid=3305 execve guuid=a4d60fc2-1800-0000-8c15-faa4eb0c0000 pid=3307 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=a4d60fc2-1800-0000-8c15-faa4eb0c0000 pid=3307 execve guuid=b47d74c2-1800-0000-8c15-faa4ed0c0000 pid=3309 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=b47d74c2-1800-0000-8c15-faa4ed0c0000 pid=3309 execve guuid=367cd1c2-1800-0000-8c15-faa4f00c0000 pid=3312 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=367cd1c2-1800-0000-8c15-faa4f00c0000 pid=3312 execve guuid=e7a730c3-1800-0000-8c15-faa4f20c0000 pid=3314 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=e7a730c3-1800-0000-8c15-faa4f20c0000 pid=3314 execve guuid=bf2f91c3-1800-0000-8c15-faa4f40c0000 pid=3316 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=bf2f91c3-1800-0000-8c15-faa4f40c0000 pid=3316 execve guuid=bc5910c4-1800-0000-8c15-faa4f50c0000 pid=3317 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=bc5910c4-1800-0000-8c15-faa4f50c0000 pid=3317 execve guuid=dc9c83c4-1800-0000-8c15-faa4f60c0000 pid=3318 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=dc9c83c4-1800-0000-8c15-faa4f60c0000 pid=3318 execve guuid=fbe32dc5-1800-0000-8c15-faa4f80c0000 pid=3320 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=fbe32dc5-1800-0000-8c15-faa4f80c0000 pid=3320 execve guuid=dec9abc5-1800-0000-8c15-faa4fb0c0000 pid=3323 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=dec9abc5-1800-0000-8c15-faa4fb0c0000 pid=3323 execve guuid=f6b948c6-1800-0000-8c15-faa4ff0c0000 pid=3327 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=f6b948c6-1800-0000-8c15-faa4ff0c0000 pid=3327 execve guuid=040da1c6-1800-0000-8c15-faa4000d0000 pid=3328 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=040da1c6-1800-0000-8c15-faa4000d0000 pid=3328 execve guuid=654615c7-1800-0000-8c15-faa4010d0000 pid=3329 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=654615c7-1800-0000-8c15-faa4010d0000 pid=3329 execve guuid=df8ba1c7-1800-0000-8c15-faa4020d0000 pid=3330 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=df8ba1c7-1800-0000-8c15-faa4020d0000 pid=3330 execve guuid=63930ec8-1800-0000-8c15-faa4040d0000 pid=3332 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=63930ec8-1800-0000-8c15-faa4040d0000 pid=3332 execve guuid=4b558ac8-1800-0000-8c15-faa4050d0000 pid=3333 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=4b558ac8-1800-0000-8c15-faa4050d0000 pid=3333 execve guuid=b31416c9-1800-0000-8c15-faa4060d0000 pid=3334 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=b31416c9-1800-0000-8c15-faa4060d0000 pid=3334 execve guuid=0bd197c9-1800-0000-8c15-faa4080d0000 pid=3336 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=0bd197c9-1800-0000-8c15-faa4080d0000 pid=3336 execve guuid=9da9f8c9-1800-0000-8c15-faa40a0d0000 pid=3338 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=9da9f8c9-1800-0000-8c15-faa40a0d0000 pid=3338 execve guuid=9e4c5cca-1800-0000-8c15-faa40c0d0000 pid=3340 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=9e4c5cca-1800-0000-8c15-faa40c0d0000 pid=3340 execve guuid=0cdfc0ca-1800-0000-8c15-faa40f0d0000 pid=3343 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=0cdfc0ca-1800-0000-8c15-faa40f0d0000 pid=3343 execve guuid=0edc6dcb-1800-0000-8c15-faa4110d0000 pid=3345 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=0edc6dcb-1800-0000-8c15-faa4110d0000 pid=3345 execve guuid=723609cc-1800-0000-8c15-faa4120d0000 pid=3346 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=723609cc-1800-0000-8c15-faa4120d0000 pid=3346 execve guuid=654f8ecc-1800-0000-8c15-faa4130d0000 pid=3347 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=654f8ecc-1800-0000-8c15-faa4130d0000 pid=3347 execve guuid=94e80ecd-1800-0000-8c15-faa4140d0000 pid=3348 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=94e80ecd-1800-0000-8c15-faa4140d0000 pid=3348 execve guuid=01bbb8cd-1800-0000-8c15-faa4150d0000 pid=3349 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=01bbb8cd-1800-0000-8c15-faa4150d0000 pid=3349 execve guuid=a7293cce-1800-0000-8c15-faa4160d0000 pid=3350 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=a7293cce-1800-0000-8c15-faa4160d0000 pid=3350 execve guuid=3425dece-1800-0000-8c15-faa4170d0000 pid=3351 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=3425dece-1800-0000-8c15-faa4170d0000 pid=3351 execve guuid=6edabecf-1800-0000-8c15-faa4180d0000 pid=3352 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=6edabecf-1800-0000-8c15-faa4180d0000 pid=3352 execve guuid=f42e63d0-1800-0000-8c15-faa4190d0000 pid=3353 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=f42e63d0-1800-0000-8c15-faa4190d0000 pid=3353 execve guuid=fc73ded0-1800-0000-8c15-faa41a0d0000 pid=3354 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=fc73ded0-1800-0000-8c15-faa41a0d0000 pid=3354 execve guuid=a5095cd1-1800-0000-8c15-faa41c0d0000 pid=3356 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=a5095cd1-1800-0000-8c15-faa41c0d0000 pid=3356 execve guuid=dde9ddd1-1800-0000-8c15-faa41d0d0000 pid=3357 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=dde9ddd1-1800-0000-8c15-faa41d0d0000 pid=3357 execve guuid=937f4ed2-1800-0000-8c15-faa41f0d0000 pid=3359 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=937f4ed2-1800-0000-8c15-faa41f0d0000 pid=3359 execve guuid=6b0daed2-1800-0000-8c15-faa4210d0000 pid=3361 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=6b0daed2-1800-0000-8c15-faa4210d0000 pid=3361 execve guuid=5e610fd3-1800-0000-8c15-faa4230d0000 pid=3363 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=5e610fd3-1800-0000-8c15-faa4230d0000 pid=3363 execve guuid=aa4070d3-1800-0000-8c15-faa4260d0000 pid=3366 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=aa4070d3-1800-0000-8c15-faa4260d0000 pid=3366 execve guuid=47fcdbd3-1800-0000-8c15-faa4280d0000 pid=3368 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=47fcdbd3-1800-0000-8c15-faa4280d0000 pid=3368 execve guuid=d80a43d4-1800-0000-8c15-faa42b0d0000 pid=3371 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=d80a43d4-1800-0000-8c15-faa42b0d0000 pid=3371 execve guuid=a9f2a6d4-1800-0000-8c15-faa42d0d0000 pid=3373 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=a9f2a6d4-1800-0000-8c15-faa42d0d0000 pid=3373 execve guuid=eb640cd5-1800-0000-8c15-faa42f0d0000 pid=3375 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=eb640cd5-1800-0000-8c15-faa42f0d0000 pid=3375 execve guuid=9dd07cd5-1800-0000-8c15-faa4320d0000 pid=3378 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=9dd07cd5-1800-0000-8c15-faa4320d0000 pid=3378 execve guuid=9f12e2d5-1800-0000-8c15-faa4340d0000 pid=3380 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=9f12e2d5-1800-0000-8c15-faa4340d0000 pid=3380 execve guuid=b6c13ed6-1800-0000-8c15-faa4360d0000 pid=3382 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=b6c13ed6-1800-0000-8c15-faa4360d0000 pid=3382 execve guuid=65d99dd6-1800-0000-8c15-faa4380d0000 pid=3384 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=65d99dd6-1800-0000-8c15-faa4380d0000 pid=3384 execve guuid=5fd503d7-1800-0000-8c15-faa43a0d0000 pid=3386 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=5fd503d7-1800-0000-8c15-faa43a0d0000 pid=3386 execve guuid=614b66d7-1800-0000-8c15-faa43d0d0000 pid=3389 /usr/bin/ls guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=614b66d7-1800-0000-8c15-faa43d0d0000 pid=3389 execve guuid=4a45c5d7-1800-0000-8c15-faa43e0d0000 pid=3390 /usr/bin/rm guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=4a45c5d7-1800-0000-8c15-faa43e0d0000 pid=3390 execve guuid=d76903d8-1800-0000-8c15-faa4400d0000 pid=3392 /usr/bin/wget net send-data write-file guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=d76903d8-1800-0000-8c15-faa4400d0000 pid=3392 execve guuid=a5241be1-1800-0000-8c15-faa4580d0000 pid=3416 /usr/bin/chmod guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=a5241be1-1800-0000-8c15-faa4580d0000 pid=3416 execve guuid=c2f16de1-1800-0000-8c15-faa4590d0000 pid=3417 /tmp/ell guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=c2f16de1-1800-0000-8c15-faa4590d0000 pid=3417 execve guuid=e1d538e2-1800-0000-8c15-faa45d0d0000 pid=3421 /usr/bin/rm guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=e1d538e2-1800-0000-8c15-faa45d0d0000 pid=3421 execve guuid=9fda93e2-1800-0000-8c15-faa45f0d0000 pid=3423 /usr/bin/wget net send-data write-file guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=9fda93e2-1800-0000-8c15-faa45f0d0000 pid=3423 execve guuid=f34b3eea-1800-0000-8c15-faa4730d0000 pid=3443 /usr/bin/chmod guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=f34b3eea-1800-0000-8c15-faa4730d0000 pid=3443 execve guuid=9e2b8fea-1800-0000-8c15-faa4740d0000 pid=3444 /tmp/Zjf5 guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=9e2b8fea-1800-0000-8c15-faa4740d0000 pid=3444 execve guuid=c2264ceb-1800-0000-8c15-faa4780d0000 pid=3448 /usr/bin/rm guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=c2264ceb-1800-0000-8c15-faa4780d0000 pid=3448 execve guuid=863989eb-1800-0000-8c15-faa47a0d0000 pid=3450 /usr/bin/wget net send-data write-file guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=863989eb-1800-0000-8c15-faa47a0d0000 pid=3450 execve guuid=1c154df2-1800-0000-8c15-faa47e0d0000 pid=3454 /usr/bin/chmod guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=1c154df2-1800-0000-8c15-faa47e0d0000 pid=3454 execve guuid=f76dd2f2-1800-0000-8c15-faa47f0d0000 pid=3455 /tmp/O2d guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=f76dd2f2-1800-0000-8c15-faa47f0d0000 pid=3455 execve guuid=0ca04df4-1800-0000-8c15-faa4810d0000 pid=3457 /usr/bin/rm guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=0ca04df4-1800-0000-8c15-faa4810d0000 pid=3457 execve guuid=b62bc2f4-1800-0000-8c15-faa4820d0000 pid=3458 /usr/bin/wget net send-data write-file guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=b62bc2f4-1800-0000-8c15-faa4820d0000 pid=3458 execve guuid=957a6a1c-1900-0000-8c15-faa4bf0d0000 pid=3519 /usr/bin/chmod guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=957a6a1c-1900-0000-8c15-faa4bf0d0000 pid=3519 execve guuid=f007e51c-1900-0000-8c15-faa4c10d0000 pid=3521 /tmp/ED5H guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=f007e51c-1900-0000-8c15-faa4c10d0000 pid=3521 execve guuid=57d0361e-1900-0000-8c15-faa4c50d0000 pid=3525 /usr/bin/rm guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=57d0361e-1900-0000-8c15-faa4c50d0000 pid=3525 execve guuid=ab0b391f-1900-0000-8c15-faa4c60d0000 pid=3526 /usr/bin/wget net send-data write-file guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=ab0b391f-1900-0000-8c15-faa4c60d0000 pid=3526 execve guuid=c84c6726-1900-0000-8c15-faa4d70d0000 pid=3543 /usr/bin/chmod guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=c84c6726-1900-0000-8c15-faa4d70d0000 pid=3543 execve guuid=22cfc526-1900-0000-8c15-faa4d90d0000 pid=3545 /tmp/Mn0r guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=22cfc526-1900-0000-8c15-faa4d90d0000 pid=3545 execve guuid=d1d53b28-1900-0000-8c15-faa4de0d0000 pid=3550 /usr/bin/rm delete-file guuid=cc1d2b98-1800-0000-8c15-faa4890c0000 pid=3209->guuid=d1d53b28-1900-0000-8c15-faa4de0d0000 pid=3550 execve 9554d36e-3083-568e-90da-bb8e3c487b07 188.132.232.81:80 guuid=d76903d8-1800-0000-8c15-faa4400d0000 pid=3392->9554d36e-3083-568e-90da-bb8e3c487b07 send: 132B guuid=9fda93e2-1800-0000-8c15-faa45f0d0000 pid=3423->9554d36e-3083-568e-90da-bb8e3c487b07 send: 133B guuid=863989eb-1800-0000-8c15-faa47a0d0000 pid=3450->9554d36e-3083-568e-90da-bb8e3c487b07 send: 132B guuid=b62bc2f4-1800-0000-8c15-faa4820d0000 pid=3458->9554d36e-3083-568e-90da-bb8e3c487b07 send: 133B guuid=ab0b391f-1900-0000-8c15-faa4c60d0000 pid=3526->9554d36e-3083-568e-90da-bb8e3c487b07 send: 133B
Score:
99%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/a643f6e4c319e5dfc5d67da0d4304cc8def9ae687404fafef0462aa270857393
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a643f6e4c319e5dfc5d67da0d4304cc8def9ae687404fafef0462aa270857393/
Verdict:
Malicious
Threat:
Trojan-Downloader.Shell.Agent
Link:
https://tip.neiki.dev/file/a643f6e4c319e5dfc5d67da0d4304cc8def9ae687404fafef0462aa270857393
Threat name:
Win32.Trojan.Vigorf
Create hunting rule
Status:
Malicious
First seen:
2026-06-05 01:36:26 UTC
File Type:
Text (Shell)
AV detection:
12 of 24 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=uzb7nzgddhs57rowpwqnimcmzdpptltioqcpv7xqiyvke4efoojq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
defense_evasion discovery linux
Link:
https://tria.ge/reports/260605-b1es5aas7x/
Behaviour
Reads runtime system information
Writes file to tmp directory
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.26
Link:
https://yomi.yoroi.company/submissions/a643f6e4c319e5dfc5d67da0d4304cc8def9ae687404fafef0462aa270857393

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh a643f6e4c319e5dfc5d67da0d4304cc8def9ae687404fafef0462aa270857393

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3856423/
  
Delivery method
Distributed via web download

Comments