MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a8d54c6df6011e62f5897f3c47bd30560ca42dc14887d80fd4a9575a9c3a2c4a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a8d54c6df6011e62f5897f3c47bd30560ca42dc14887d80fd4a9575a9c3a2c4a
SHA3-384 hash: b76333ecd09cdd78771f86f7747659185380fd8de4b72265cd012963b4fbc6fac27f469339796c6046fe4c4722d9606e
SHA1 hash: 9b593f949f3474cd0db01f685b3e9e40588b725b
MD5 hash: 319010a3169b3e2d4644d9bc96d3057c
humanhash: sweet-oklahoma-helium-pizza
File name:k.php
Download: download sample
File size:19'491 bytes
First seen:2026-03-17 17:12:18 UTC
Last seen:2026-03-17 21:36:20 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 384:qmk/xNd9xaBTfJs5P/UzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:qmC/aBTfGszsP4cbddr7zsP4cbddrk
TLSH T162923BB906497C34F7C1DE799E3C2F0DAEE881C42124E39CFA0F39215E516ADD60935A
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh

Intelligence

File Origin
# of uploads :
2
# of downloads :
91
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive masquerade
Link:
https://www.filescan.io/uploads/69b98baa4ec2f522cc4cbe05/reports/2adfaccc-05bc-432d-9491-67632994f12e/overview
Verdict:
Malicious
File Type:
unix shell
Detections:
HEUR:Trojan-Downloader.Shell.Agent.bc
Link:
https://opentip.kaspersky.com/a8d54c6df6011e62f5897f3c47bd30560ca42dc14887d80fd4a9575a9c3a2c4a/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/f38ed197-778b-4aea-a2e5-3815ee6a3896
Behavior Graph:
Download SVG
%3 guuid=c5af3dad-1600-0000-6e02-f1cec50c0000 pid=3269 /usr/bin/sudo guuid=f91a01af-1600-0000-6e02-f1cecd0c0000 pid=3277 /tmp/sample.bin guuid=c5af3dad-1600-0000-6e02-f1cec50c0000 pid=3269->guuid=f91a01af-1600-0000-6e02-f1cecd0c0000 pid=3277 execve guuid=91bcd6af-1600-0000-6e02-f1ced10c0000 pid=3281 /usr/bin/bash guuid=f91a01af-1600-0000-6e02-f1cecd0c0000 pid=3277->guuid=91bcd6af-1600-0000-6e02-f1ced10c0000 pid=3281 clone guuid=085bfcaf-1600-0000-6e02-f1ced20c0000 pid=3282 /usr/bin/bash guuid=f91a01af-1600-0000-6e02-f1cecd0c0000 pid=3277->guuid=085bfcaf-1600-0000-6e02-f1ced20c0000 pid=3282 clone guuid=5bef64b0-1600-0000-6e02-f1ced40c0000 pid=3284 /usr/bin/mkdir guuid=f91a01af-1600-0000-6e02-f1cecd0c0000 pid=3277->guuid=5bef64b0-1600-0000-6e02-f1ced40c0000 pid=3284 execve guuid=71d9b8b0-1600-0000-6e02-f1ced60c0000 pid=3286 /usr/bin/mkdir guuid=f91a01af-1600-0000-6e02-f1cecd0c0000 pid=3277->guuid=71d9b8b0-1600-0000-6e02-f1ced60c0000 pid=3286 execve guuid=7e9517b1-1600-0000-6e02-f1ced80c0000 pid=3288 /usr/bin/mkdir guuid=f91a01af-1600-0000-6e02-f1cecd0c0000 pid=3277->guuid=7e9517b1-1600-0000-6e02-f1ced80c0000 pid=3288 execve guuid=f66a67b1-1600-0000-6e02-f1ced90c0000 pid=3289 /usr/bin/mkdir guuid=f91a01af-1600-0000-6e02-f1cecd0c0000 pid=3277->guuid=f66a67b1-1600-0000-6e02-f1ced90c0000 pid=3289 execve guuid=19e5cfb1-1600-0000-6e02-f1ceda0c0000 pid=3290 /usr/bin/mkdir guuid=f91a01af-1600-0000-6e02-f1cecd0c0000 pid=3277->guuid=19e5cfb1-1600-0000-6e02-f1ceda0c0000 pid=3290 execve guuid=d6a938b2-1600-0000-6e02-f1cedb0c0000 pid=3291 /usr/bin/mkdir guuid=f91a01af-1600-0000-6e02-f1cecd0c0000 pid=3277->guuid=d6a938b2-1600-0000-6e02-f1cedb0c0000 pid=3291 execve guuid=fdf6a4b2-1600-0000-6e02-f1cedc0c0000 pid=3292 /usr/bin/mkdir guuid=f91a01af-1600-0000-6e02-f1cecd0c0000 pid=3277->guuid=fdf6a4b2-1600-0000-6e02-f1cedc0c0000 pid=3292 execve guuid=f67109b3-1600-0000-6e02-f1cedd0c0000 pid=3293 /usr/bin/cp guuid=f91a01af-1600-0000-6e02-f1cecd0c0000 pid=3277->guuid=f67109b3-1600-0000-6e02-f1cedd0c0000 pid=3293 execve guuid=3aad6db3-1600-0000-6e02-f1cedf0c0000 pid=3295 /usr/bin/cp guuid=f91a01af-1600-0000-6e02-f1cecd0c0000 pid=3277->guuid=3aad6db3-1600-0000-6e02-f1cedf0c0000 pid=3295 execve guuid=082d64b4-1600-0000-6e02-f1cee20c0000 pid=3298 /usr/bin/cp guuid=f91a01af-1600-0000-6e02-f1cecd0c0000 pid=3277->guuid=082d64b4-1600-0000-6e02-f1cee20c0000 pid=3298 execve guuid=70b102b5-1600-0000-6e02-f1cee50c0000 pid=3301 /usr/bin/cp guuid=f91a01af-1600-0000-6e02-f1cecd0c0000 pid=3277->guuid=70b102b5-1600-0000-6e02-f1cee50c0000 pid=3301 execve guuid=aaeda3b5-1600-0000-6e02-f1cee70c0000 pid=3303 /usr/bin/cp guuid=f91a01af-1600-0000-6e02-f1cecd0c0000 pid=3277->guuid=aaeda3b5-1600-0000-6e02-f1cee70c0000 pid=3303 execve guuid=7edb31b6-1600-0000-6e02-f1cee90c0000 pid=3305 /usr/bin/cp guuid=f91a01af-1600-0000-6e02-f1cecd0c0000 pid=3277->guuid=7edb31b6-1600-0000-6e02-f1cee90c0000 pid=3305 execve guuid=7343a6b6-1600-0000-6e02-f1ceea0c0000 pid=3306 /usr/bin/cp guuid=f91a01af-1600-0000-6e02-f1cecd0c0000 pid=3277->guuid=7343a6b6-1600-0000-6e02-f1ceea0c0000 pid=3306 execve guuid=e0225db7-1600-0000-6e02-f1ceeb0c0000 pid=3307 /usr/bin/cp guuid=f91a01af-1600-0000-6e02-f1cecd0c0000 pid=3277->guuid=e0225db7-1600-0000-6e02-f1ceeb0c0000 pid=3307 execve guuid=4d8ef2b7-1600-0000-6e02-f1ceee0c0000 pid=3310 /usr/bin/cp guuid=f91a01af-1600-0000-6e02-f1cecd0c0000 pid=3277->guuid=4d8ef2b7-1600-0000-6e02-f1ceee0c0000 pid=3310 execve guuid=a81b61b8-1600-0000-6e02-f1cef00c0000 pid=3312 /usr/bin/cp guuid=f91a01af-1600-0000-6e02-f1cecd0c0000 pid=3277->guuid=a81b61b8-1600-0000-6e02-f1cef00c0000 pid=3312 execve guuid=1c22c3b8-1600-0000-6e02-f1cef20c0000 pid=3314 /usr/bin/cp guuid=f91a01af-1600-0000-6e02-f1cecd0c0000 pid=3277->guuid=1c22c3b8-1600-0000-6e02-f1cef20c0000 pid=3314 execve guuid=61be2bb9-1600-0000-6e02-f1cef50c0000 pid=3317 /usr/bin/cp guuid=f91a01af-1600-0000-6e02-f1cecd0c0000 pid=3277->guuid=61be2bb9-1600-0000-6e02-f1cef50c0000 pid=3317 execve guuid=36cbc8b9-1600-0000-6e02-f1cef80c0000 pid=3320 /usr/bin/cp guuid=f91a01af-1600-0000-6e02-f1cecd0c0000 pid=3277->guuid=36cbc8b9-1600-0000-6e02-f1cef80c0000 pid=3320 execve guuid=4fa62cba-1600-0000-6e02-f1cefa0c0000 pid=3322 /usr/bin/cp guuid=f91a01af-1600-0000-6e02-f1cecd0c0000 pid=3277->guuid=4fa62cba-1600-0000-6e02-f1cefa0c0000 pid=3322 execve guuid=f37f91ba-1600-0000-6e02-f1cefd0c0000 pid=3325 /usr/bin/cp guuid=f91a01af-1600-0000-6e02-f1cecd0c0000 pid=3277->guuid=f37f91ba-1600-0000-6e02-f1cefd0c0000 pid=3325 execve guuid=47b9f2ba-1600-0000-6e02-f1ceff0c0000 pid=3327 /usr/bin/touch guuid=f91a01af-1600-0000-6e02-f1cecd0c0000 pid=3277->guuid=47b9f2ba-1600-0000-6e02-f1ceff0c0000 pid=3327 execve guuid=cd3e39bb-1600-0000-6e02-f1ce010d0000 pid=3329 /usr/bin/bash guuid=f91a01af-1600-0000-6e02-f1cecd0c0000 pid=3277->guuid=cd3e39bb-1600-0000-6e02-f1ce010d0000 pid=3329 clone guuid=0c4540bb-1600-0000-6e02-f1ce020d0000 pid=3330 /usr/bin/bash guuid=f91a01af-1600-0000-6e02-f1cecd0c0000 pid=3277->guuid=0c4540bb-1600-0000-6e02-f1ce020d0000 pid=3330 clone guuid=5a7365bb-1600-0000-6e02-f1ce040d0000 pid=3332 /usr/bin/bash guuid=f91a01af-1600-0000-6e02-f1cecd0c0000 pid=3277->guuid=5a7365bb-1600-0000-6e02-f1ce040d0000 pid=3332 clone guuid=af906cbb-1600-0000-6e02-f1ce050d0000 pid=3333 /usr/bin/base64 write-file guuid=f91a01af-1600-0000-6e02-f1cecd0c0000 pid=3277->guuid=af906cbb-1600-0000-6e02-f1ce050d0000 pid=3333 execve guuid=6625e9bb-1600-0000-6e02-f1ce070d0000 pid=3335 /usr/bin/bash guuid=f91a01af-1600-0000-6e02-f1cecd0c0000 pid=3277->guuid=6625e9bb-1600-0000-6e02-f1ce070d0000 pid=3335 execve guuid=7bf799c1-1600-0000-6e02-f1ce220d0000 pid=3362 /usr/bin/rm delete-file guuid=f91a01af-1600-0000-6e02-f1cecd0c0000 pid=3277->guuid=7bf799c1-1600-0000-6e02-f1ce220d0000 pid=3362 execve guuid=989f16c2-1600-0000-6e02-f1ce230d0000 pid=3363 /usr/bin/bash guuid=f91a01af-1600-0000-6e02-f1cecd0c0000 pid=3277->guuid=989f16c2-1600-0000-6e02-f1ce230d0000 pid=3363 clone guuid=d3d81fc2-1600-0000-6e02-f1ce240d0000 pid=3364 /usr/bin/bash guuid=f91a01af-1600-0000-6e02-f1cecd0c0000 pid=3277->guuid=d3d81fc2-1600-0000-6e02-f1ce240d0000 pid=3364 clone guuid=dc4c5bc2-1600-0000-6e02-f1ce250d0000 pid=3365 /usr/bin/bash guuid=f91a01af-1600-0000-6e02-f1cecd0c0000 pid=3277->guuid=dc4c5bc2-1600-0000-6e02-f1ce250d0000 pid=3365 execve guuid=9b82cec2-1600-0000-6e02-f1ce260d0000 pid=3366 /usr/bin/rm guuid=f91a01af-1600-0000-6e02-f1cecd0c0000 pid=3277->guuid=9b82cec2-1600-0000-6e02-f1ce260d0000 pid=3366 execve guuid=70d43cbc-1600-0000-6e02-f1ce0a0d0000 pid=3338 /usr/bin/bash guuid=6625e9bb-1600-0000-6e02-f1ce070d0000 pid=3335->guuid=70d43cbc-1600-0000-6e02-f1ce0a0d0000 pid=3338 clone guuid=088142bc-1600-0000-6e02-f1ce0b0d0000 pid=3339 /usr/bin/bash guuid=6625e9bb-1600-0000-6e02-f1ce070d0000 pid=3335->guuid=088142bc-1600-0000-6e02-f1ce0b0d0000 pid=3339 clone guuid=eb105ebc-1600-0000-6e02-f1ce0c0d0000 pid=3340 /usr/bin/ls guuid=6625e9bb-1600-0000-6e02-f1ce070d0000 pid=3335->guuid=eb105ebc-1600-0000-6e02-f1ce0c0d0000 pid=3340 execve guuid=7b9ce6bc-1600-0000-6e02-f1ce0e0d0000 pid=3342 /usr/bin/cat guuid=6625e9bb-1600-0000-6e02-f1ce070d0000 pid=3335->guuid=7b9ce6bc-1600-0000-6e02-f1ce0e0d0000 pid=3342 execve guuid=4aea31bd-1600-0000-6e02-f1ce100d0000 pid=3344 /usr/bin/ls guuid=6625e9bb-1600-0000-6e02-f1ce070d0000 pid=3335->guuid=4aea31bd-1600-0000-6e02-f1ce100d0000 pid=3344 execve guuid=d786cebd-1600-0000-6e02-f1ce110d0000 pid=3345 /usr/bin/mkdir guuid=6625e9bb-1600-0000-6e02-f1ce070d0000 pid=3335->guuid=d786cebd-1600-0000-6e02-f1ce110d0000 pid=3345 execve guuid=9c7943be-1600-0000-6e02-f1ce120d0000 pid=3346 /usr/bin/mv guuid=6625e9bb-1600-0000-6e02-f1ce070d0000 pid=3335->guuid=9c7943be-1600-0000-6e02-f1ce120d0000 pid=3346 execve guuid=8683aebe-1600-0000-6e02-f1ce130d0000 pid=3347 /usr/bin/bash guuid=6625e9bb-1600-0000-6e02-f1ce070d0000 pid=3335->guuid=8683aebe-1600-0000-6e02-f1ce130d0000 pid=3347 clone guuid=5149b4be-1600-0000-6e02-f1ce150d0000 pid=3349 /usr/bin/base64 write-file guuid=6625e9bb-1600-0000-6e02-f1ce070d0000 pid=3335->guuid=5149b4be-1600-0000-6e02-f1ce150d0000 pid=3349 execve guuid=5ce606bf-1600-0000-6e02-f1ce170d0000 pid=3351 /usr/bin/rm delete-file guuid=6625e9bb-1600-0000-6e02-f1ce070d0000 pid=3335->guuid=5ce606bf-1600-0000-6e02-f1ce170d0000 pid=3351 execve guuid=ddd24fbf-1600-0000-6e02-f1ce190d0000 pid=3353 /usr/bin/ls guuid=6625e9bb-1600-0000-6e02-f1ce070d0000 pid=3335->guuid=ddd24fbf-1600-0000-6e02-f1ce190d0000 pid=3353 execve guuid=cc01aebf-1600-0000-6e02-f1ce1b0d0000 pid=3355 /usr/bin/bash guuid=6625e9bb-1600-0000-6e02-f1ce070d0000 pid=3335->guuid=cc01aebf-1600-0000-6e02-f1ce1b0d0000 pid=3355 clone guuid=91f8b3bf-1600-0000-6e02-f1ce1c0d0000 pid=3356 /usr/bin/base64 write-file guuid=6625e9bb-1600-0000-6e02-f1ce070d0000 pid=3335->guuid=91f8b3bf-1600-0000-6e02-f1ce1c0d0000 pid=3356 execve guuid=c8d9f7bf-1600-0000-6e02-f1ce1f0d0000 pid=3359 /usr/bin/ls guuid=6625e9bb-1600-0000-6e02-f1ce070d0000 pid=3335->guuid=c8d9f7bf-1600-0000-6e02-f1ce1f0d0000 pid=3359 execve guuid=de1877c0-1600-0000-6e02-f1ce200d0000 pid=3360 /usr/bin/cat guuid=6625e9bb-1600-0000-6e02-f1ce070d0000 pid=3335->guuid=de1877c0-1600-0000-6e02-f1ce200d0000 pid=3360 execve guuid=d397cdc0-1600-0000-6e02-f1ce210d0000 pid=3361 /usr/bin/ls guuid=6625e9bb-1600-0000-6e02-f1ce070d0000 pid=3335->guuid=d397cdc0-1600-0000-6e02-f1ce210d0000 pid=3361 execve
Score:
82%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/a8d54c6df6011e62f5897f3c47bd30560ca42dc14887d80fd4a9575a9c3a2c4a
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a8d54c6df6011e62f5897f3c47bd30560ca42dc14887d80fd4a9575a9c3a2c4a/
Verdict:
Malicious
Threat:
Trojan-Downloader.Shell.Agent
Link:
https://tip.neiki.dev/file/a8d54c6df6011e62f5897f3c47bd30560ca42dc14887d80fd4a9575a9c3a2c4a
Threat name:
Script-Shell.Trojan.Vigorf
Create hunting rule
Status:
Malicious
First seen:
2026-03-17 17:13:16 UTC
File Type:
Text (Shell)
AV detection:
10 of 22 (45.45%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vdkuy3pwaepgf5mjp46eppjqkygkilobjcd5qd6uvflvvhb2frfa._file
Result
Malware family:
n/a
Score:
  4/10
Tags:
defense_evasion discovery linux
Link:
https://tria.ge/reports/260317-vq1sdsaw9p/
Behaviour
Reads runtime system information
Writes file to tmp directory
Deobfuscate/Decode Files or Information
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/a8d54c6df6011e62f5897f3c47bd30560ca42dc14887d80fd4a9575a9c3a2c4a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SUSP_LNX_Base64_Exec_Apr24
Create hunting rule
Author:Christian Burkard
Description:Detects suspicious base64 encoded shell commands (as seen in Palo Alto CVE-2024-3400 exploitation)
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh a8d54c6df6011e62f5897f3c47bd30560ca42dc14887d80fd4a9575a9c3a2c4a

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3784565/
  
Delivery method
Distributed via web download

Comments