🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a9d41a6aec4a745cdd729a094d042958f7a682b90b06dddafa9e24c8cdf1f3a6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a9d41a6aec4a745cdd729a094d042958f7a682b90b06dddafa9e24c8cdf1f3a6
SHA3-384 hash: 4e16dd9c641ec6564e39f31d0afbe3f362662bfb7243e16ae8e4d639bb9ec536d0b75c5165558cf5f2433ea33e854ddb
SHA1 hash: 5aed51fba229f872bef18fd43632cee9e48ab7a0
MD5 hash: cdceda0eb64da7dd2ad76125d9db8fac
humanhash: march-alpha-hydrogen-triple
File name:lil
Download: download sample
File size:843 bytes
First seen:2026-06-05 05:12:22 UTC
Last seen:2026-06-05 18:05:34 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 24:kXCKysE2hi0ziQvZohalfMmahne+1H0dX:e9Qp+MslfMmaJHH0dX
TLSH T1B301C2DFC005D62040D6F4AD26D75544F830C3CB2646CFBABE6C983E9BB964870A5FA4
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://188.132.232.81/305bn/an/aelf ua-wget
http://188.132.232.81/bcM5n/an/aelf ua-wget
http://188.132.232.81/Ok4n/an/aelf ua-wget
http://188.132.232.81/l5V7n/an/aelf ua-wget
http://188.132.232.81/nQdn/an/aelf ua-wget

Intelligence

File Origin
# of uploads :
2
# of downloads :
51
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive
Link:
https://www.filescan.io/uploads/6a225af4099ef368af20c260/reports/c5688ceb-aedc-4cc8-b7c3-ede119247fec/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-06-05T02:23:00Z UTC
Last seen:
2026-06-06T22:07:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan-Downloader.Shell.Agent.a
Link:
https://opentip.kaspersky.com/a9d41a6aec4a745cdd729a094d042958f7a682b90b06dddafa9e24c8cdf1f3a6/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/fcdb7591-807c-4448-a5cc-034b2a32a927
Behavior Graph:
Download SVG
%3 guuid=0fc62374-1700-0000-2b5b-bf94760d0000 pid=3446 /usr/bin/sudo guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454 /tmp/sample.bin write-file guuid=0fc62374-1700-0000-2b5b-bf94760d0000 pid=3446->guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454 execve guuid=1f105476-1700-0000-2b5b-bf94800d0000 pid=3456 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=1f105476-1700-0000-2b5b-bf94800d0000 pid=3456 execve guuid=5132c376-1700-0000-2b5b-bf94830d0000 pid=3459 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=5132c376-1700-0000-2b5b-bf94830d0000 pid=3459 execve guuid=96e02477-1700-0000-2b5b-bf94850d0000 pid=3461 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=96e02477-1700-0000-2b5b-bf94850d0000 pid=3461 execve guuid=16b18977-1700-0000-2b5b-bf94880d0000 pid=3464 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=16b18977-1700-0000-2b5b-bf94880d0000 pid=3464 execve guuid=fb20f477-1700-0000-2b5b-bf948a0d0000 pid=3466 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=fb20f477-1700-0000-2b5b-bf948a0d0000 pid=3466 execve guuid=6cf15478-1700-0000-2b5b-bf948c0d0000 pid=3468 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=6cf15478-1700-0000-2b5b-bf948c0d0000 pid=3468 execve guuid=591cb278-1700-0000-2b5b-bf948f0d0000 pid=3471 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=591cb278-1700-0000-2b5b-bf948f0d0000 pid=3471 execve guuid=06a10a79-1700-0000-2b5b-bf94910d0000 pid=3473 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=06a10a79-1700-0000-2b5b-bf94910d0000 pid=3473 execve guuid=aa206679-1700-0000-2b5b-bf94940d0000 pid=3476 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=aa206679-1700-0000-2b5b-bf94940d0000 pid=3476 execve guuid=7371bd79-1700-0000-2b5b-bf94960d0000 pid=3478 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=7371bd79-1700-0000-2b5b-bf94960d0000 pid=3478 execve guuid=5673157a-1700-0000-2b5b-bf94980d0000 pid=3480 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=5673157a-1700-0000-2b5b-bf94980d0000 pid=3480 execve guuid=cdb8717a-1700-0000-2b5b-bf949b0d0000 pid=3483 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=cdb8717a-1700-0000-2b5b-bf949b0d0000 pid=3483 execve guuid=5d3ecb7a-1700-0000-2b5b-bf949d0d0000 pid=3485 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=5d3ecb7a-1700-0000-2b5b-bf949d0d0000 pid=3485 execve guuid=86e0237b-1700-0000-2b5b-bf94a00d0000 pid=3488 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=86e0237b-1700-0000-2b5b-bf94a00d0000 pid=3488 execve guuid=286a7c7b-1700-0000-2b5b-bf94a20d0000 pid=3490 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=286a7c7b-1700-0000-2b5b-bf94a20d0000 pid=3490 execve guuid=258ddf7b-1700-0000-2b5b-bf94a50d0000 pid=3493 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=258ddf7b-1700-0000-2b5b-bf94a50d0000 pid=3493 execve guuid=f951447c-1700-0000-2b5b-bf94a70d0000 pid=3495 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=f951447c-1700-0000-2b5b-bf94a70d0000 pid=3495 execve guuid=9486a97c-1700-0000-2b5b-bf94aa0d0000 pid=3498 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=9486a97c-1700-0000-2b5b-bf94aa0d0000 pid=3498 execve guuid=f48e0b7d-1700-0000-2b5b-bf94ac0d0000 pid=3500 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=f48e0b7d-1700-0000-2b5b-bf94ac0d0000 pid=3500 execve guuid=52ae6b7d-1700-0000-2b5b-bf94af0d0000 pid=3503 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=52ae6b7d-1700-0000-2b5b-bf94af0d0000 pid=3503 execve guuid=6f3bcf7d-1700-0000-2b5b-bf94b40d0000 pid=3508 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=6f3bcf7d-1700-0000-2b5b-bf94b40d0000 pid=3508 execve guuid=97492c7e-1700-0000-2b5b-bf94b50d0000 pid=3509 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=97492c7e-1700-0000-2b5b-bf94b50d0000 pid=3509 execve guuid=2941877e-1700-0000-2b5b-bf94b60d0000 pid=3510 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=2941877e-1700-0000-2b5b-bf94b60d0000 pid=3510 execve guuid=147ce87e-1700-0000-2b5b-bf94b70d0000 pid=3511 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=147ce87e-1700-0000-2b5b-bf94b70d0000 pid=3511 execve guuid=d65f497f-1700-0000-2b5b-bf94b80d0000 pid=3512 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=d65f497f-1700-0000-2b5b-bf94b80d0000 pid=3512 execve guuid=1cddaa7f-1700-0000-2b5b-bf94b90d0000 pid=3513 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=1cddaa7f-1700-0000-2b5b-bf94b90d0000 pid=3513 execve guuid=1ebd1580-1700-0000-2b5b-bf94ba0d0000 pid=3514 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=1ebd1580-1700-0000-2b5b-bf94ba0d0000 pid=3514 execve guuid=61a47580-1700-0000-2b5b-bf94bb0d0000 pid=3515 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=61a47580-1700-0000-2b5b-bf94bb0d0000 pid=3515 execve guuid=a11bdb80-1700-0000-2b5b-bf94bc0d0000 pid=3516 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=a11bdb80-1700-0000-2b5b-bf94bc0d0000 pid=3516 execve guuid=b6e53481-1700-0000-2b5b-bf94bd0d0000 pid=3517 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=b6e53481-1700-0000-2b5b-bf94bd0d0000 pid=3517 execve guuid=870b8c81-1700-0000-2b5b-bf94be0d0000 pid=3518 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=870b8c81-1700-0000-2b5b-bf94be0d0000 pid=3518 execve guuid=03f5e181-1700-0000-2b5b-bf94bf0d0000 pid=3519 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=03f5e181-1700-0000-2b5b-bf94bf0d0000 pid=3519 execve guuid=71cb3c82-1700-0000-2b5b-bf94c00d0000 pid=3520 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=71cb3c82-1700-0000-2b5b-bf94c00d0000 pid=3520 execve guuid=4cb89682-1700-0000-2b5b-bf94c40d0000 pid=3524 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=4cb89682-1700-0000-2b5b-bf94c40d0000 pid=3524 execve guuid=d8b3ef82-1700-0000-2b5b-bf94c60d0000 pid=3526 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=d8b3ef82-1700-0000-2b5b-bf94c60d0000 pid=3526 execve guuid=a1c54383-1700-0000-2b5b-bf94c80d0000 pid=3528 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=a1c54383-1700-0000-2b5b-bf94c80d0000 pid=3528 execve guuid=41769783-1700-0000-2b5b-bf94cb0d0000 pid=3531 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=41769783-1700-0000-2b5b-bf94cb0d0000 pid=3531 execve guuid=e0a6ec83-1700-0000-2b5b-bf94cd0d0000 pid=3533 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=e0a6ec83-1700-0000-2b5b-bf94cd0d0000 pid=3533 execve guuid=614c4284-1700-0000-2b5b-bf94d00d0000 pid=3536 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=614c4284-1700-0000-2b5b-bf94d00d0000 pid=3536 execve guuid=cc829c84-1700-0000-2b5b-bf94d20d0000 pid=3538 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=cc829c84-1700-0000-2b5b-bf94d20d0000 pid=3538 execve guuid=0186f484-1700-0000-2b5b-bf94d40d0000 pid=3540 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=0186f484-1700-0000-2b5b-bf94d40d0000 pid=3540 execve guuid=f5c25685-1700-0000-2b5b-bf94d60d0000 pid=3542 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=f5c25685-1700-0000-2b5b-bf94d60d0000 pid=3542 execve guuid=fb11b785-1700-0000-2b5b-bf94d80d0000 pid=3544 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=fb11b785-1700-0000-2b5b-bf94d80d0000 pid=3544 execve guuid=b6213086-1700-0000-2b5b-bf94d90d0000 pid=3545 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=b6213086-1700-0000-2b5b-bf94d90d0000 pid=3545 execve guuid=5cc68386-1700-0000-2b5b-bf94da0d0000 pid=3546 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=5cc68386-1700-0000-2b5b-bf94da0d0000 pid=3546 execve guuid=0a25e086-1700-0000-2b5b-bf94dc0d0000 pid=3548 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=0a25e086-1700-0000-2b5b-bf94dc0d0000 pid=3548 execve guuid=5a623f87-1700-0000-2b5b-bf94df0d0000 pid=3551 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=5a623f87-1700-0000-2b5b-bf94df0d0000 pid=3551 execve guuid=d9b29d87-1700-0000-2b5b-bf94e10d0000 pid=3553 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=d9b29d87-1700-0000-2b5b-bf94e10d0000 pid=3553 execve guuid=c3d00088-1700-0000-2b5b-bf94e40d0000 pid=3556 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=c3d00088-1700-0000-2b5b-bf94e40d0000 pid=3556 execve guuid=76c66b88-1700-0000-2b5b-bf94e50d0000 pid=3557 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=76c66b88-1700-0000-2b5b-bf94e50d0000 pid=3557 execve guuid=b6f9c988-1700-0000-2b5b-bf94e70d0000 pid=3559 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=b6f9c988-1700-0000-2b5b-bf94e70d0000 pid=3559 execve guuid=ea512d89-1700-0000-2b5b-bf94e90d0000 pid=3561 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=ea512d89-1700-0000-2b5b-bf94e90d0000 pid=3561 execve guuid=5d99a489-1700-0000-2b5b-bf94ec0d0000 pid=3564 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=5d99a489-1700-0000-2b5b-bf94ec0d0000 pid=3564 execve guuid=962d138a-1700-0000-2b5b-bf94ee0d0000 pid=3566 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=962d138a-1700-0000-2b5b-bf94ee0d0000 pid=3566 execve guuid=260a5e8a-1700-0000-2b5b-bf94f10d0000 pid=3569 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=260a5e8a-1700-0000-2b5b-bf94f10d0000 pid=3569 execve guuid=0aedb48a-1700-0000-2b5b-bf94f30d0000 pid=3571 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=0aedb48a-1700-0000-2b5b-bf94f30d0000 pid=3571 execve guuid=4e6e178b-1700-0000-2b5b-bf94f60d0000 pid=3574 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=4e6e178b-1700-0000-2b5b-bf94f60d0000 pid=3574 execve guuid=97fe6d8b-1700-0000-2b5b-bf94f80d0000 pid=3576 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=97fe6d8b-1700-0000-2b5b-bf94f80d0000 pid=3576 execve guuid=edafd28b-1700-0000-2b5b-bf94fa0d0000 pid=3578 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=edafd28b-1700-0000-2b5b-bf94fa0d0000 pid=3578 execve guuid=3bbd278c-1700-0000-2b5b-bf94fd0d0000 pid=3581 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=3bbd278c-1700-0000-2b5b-bf94fd0d0000 pid=3581 execve guuid=cd86928c-1700-0000-2b5b-bf94ff0d0000 pid=3583 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=cd86928c-1700-0000-2b5b-bf94ff0d0000 pid=3583 execve guuid=0a8bfa8c-1700-0000-2b5b-bf94020e0000 pid=3586 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=0a8bfa8c-1700-0000-2b5b-bf94020e0000 pid=3586 execve guuid=512e628d-1700-0000-2b5b-bf94030e0000 pid=3587 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=512e628d-1700-0000-2b5b-bf94030e0000 pid=3587 execve guuid=0a6ec18d-1700-0000-2b5b-bf94050e0000 pid=3589 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=0a6ec18d-1700-0000-2b5b-bf94050e0000 pid=3589 execve guuid=6d821e8e-1700-0000-2b5b-bf94060e0000 pid=3590 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=6d821e8e-1700-0000-2b5b-bf94060e0000 pid=3590 execve guuid=215b7c8e-1700-0000-2b5b-bf94090e0000 pid=3593 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=215b7c8e-1700-0000-2b5b-bf94090e0000 pid=3593 execve guuid=a850df8e-1700-0000-2b5b-bf940b0e0000 pid=3595 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=a850df8e-1700-0000-2b5b-bf940b0e0000 pid=3595 execve guuid=60413f8f-1700-0000-2b5b-bf940e0e0000 pid=3598 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=60413f8f-1700-0000-2b5b-bf940e0e0000 pid=3598 execve guuid=223fa88f-1700-0000-2b5b-bf94100e0000 pid=3600 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=223fa88f-1700-0000-2b5b-bf94100e0000 pid=3600 execve guuid=99b50790-1700-0000-2b5b-bf94130e0000 pid=3603 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=99b50790-1700-0000-2b5b-bf94130e0000 pid=3603 execve guuid=bd1b6090-1700-0000-2b5b-bf94150e0000 pid=3605 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=bd1b6090-1700-0000-2b5b-bf94150e0000 pid=3605 execve guuid=585ab490-1700-0000-2b5b-bf94180e0000 pid=3608 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=585ab490-1700-0000-2b5b-bf94180e0000 pid=3608 execve guuid=4e690791-1700-0000-2b5b-bf941a0e0000 pid=3610 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=4e690791-1700-0000-2b5b-bf941a0e0000 pid=3610 execve guuid=e8e95e91-1700-0000-2b5b-bf941c0e0000 pid=3612 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=e8e95e91-1700-0000-2b5b-bf941c0e0000 pid=3612 execve guuid=42b0b191-1700-0000-2b5b-bf941f0e0000 pid=3615 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=42b0b191-1700-0000-2b5b-bf941f0e0000 pid=3615 execve guuid=7ef10f92-1700-0000-2b5b-bf94210e0000 pid=3617 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=7ef10f92-1700-0000-2b5b-bf94210e0000 pid=3617 execve guuid=3d806692-1700-0000-2b5b-bf94240e0000 pid=3620 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=3d806692-1700-0000-2b5b-bf94240e0000 pid=3620 execve guuid=6220c192-1700-0000-2b5b-bf94260e0000 pid=3622 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=6220c192-1700-0000-2b5b-bf94260e0000 pid=3622 execve guuid=d1832093-1700-0000-2b5b-bf94290e0000 pid=3625 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=d1832093-1700-0000-2b5b-bf94290e0000 pid=3625 execve guuid=bfec7e93-1700-0000-2b5b-bf942b0e0000 pid=3627 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=bfec7e93-1700-0000-2b5b-bf942b0e0000 pid=3627 execve guuid=5fcce293-1700-0000-2b5b-bf942d0e0000 pid=3629 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=5fcce293-1700-0000-2b5b-bf942d0e0000 pid=3629 execve guuid=405d3e94-1700-0000-2b5b-bf94300e0000 pid=3632 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=405d3e94-1700-0000-2b5b-bf94300e0000 pid=3632 execve guuid=18eeb694-1700-0000-2b5b-bf94330e0000 pid=3635 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=18eeb694-1700-0000-2b5b-bf94330e0000 pid=3635 execve guuid=98048295-1700-0000-2b5b-bf94390e0000 pid=3641 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=98048295-1700-0000-2b5b-bf94390e0000 pid=3641 execve guuid=5fb9e095-1700-0000-2b5b-bf943b0e0000 pid=3643 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=5fb9e095-1700-0000-2b5b-bf943b0e0000 pid=3643 execve guuid=8f1d4296-1700-0000-2b5b-bf943c0e0000 pid=3644 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=8f1d4296-1700-0000-2b5b-bf943c0e0000 pid=3644 execve guuid=b055a296-1700-0000-2b5b-bf943e0e0000 pid=3646 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=b055a296-1700-0000-2b5b-bf943e0e0000 pid=3646 execve guuid=cace3597-1700-0000-2b5b-bf94410e0000 pid=3649 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=cace3597-1700-0000-2b5b-bf94410e0000 pid=3649 execve guuid=87669d97-1700-0000-2b5b-bf94430e0000 pid=3651 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=87669d97-1700-0000-2b5b-bf94430e0000 pid=3651 execve guuid=40c50e98-1700-0000-2b5b-bf94460e0000 pid=3654 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=40c50e98-1700-0000-2b5b-bf94460e0000 pid=3654 execve guuid=a9f36f98-1700-0000-2b5b-bf94480e0000 pid=3656 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=a9f36f98-1700-0000-2b5b-bf94480e0000 pid=3656 execve guuid=d335d498-1700-0000-2b5b-bf944a0e0000 pid=3658 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=d335d498-1700-0000-2b5b-bf944a0e0000 pid=3658 execve guuid=f5e23999-1700-0000-2b5b-bf944c0e0000 pid=3660 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=f5e23999-1700-0000-2b5b-bf944c0e0000 pid=3660 execve guuid=29bc9e99-1700-0000-2b5b-bf944f0e0000 pid=3663 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=29bc9e99-1700-0000-2b5b-bf944f0e0000 pid=3663 execve guuid=e22c289a-1700-0000-2b5b-bf94510e0000 pid=3665 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=e22c289a-1700-0000-2b5b-bf94510e0000 pid=3665 execve guuid=69edae9a-1700-0000-2b5b-bf94530e0000 pid=3667 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=69edae9a-1700-0000-2b5b-bf94530e0000 pid=3667 execve guuid=02d53d9b-1700-0000-2b5b-bf94550e0000 pid=3669 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=02d53d9b-1700-0000-2b5b-bf94550e0000 pid=3669 execve guuid=bc1cc89b-1700-0000-2b5b-bf94570e0000 pid=3671 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=bc1cc89b-1700-0000-2b5b-bf94570e0000 pid=3671 execve guuid=faac5a9c-1700-0000-2b5b-bf945a0e0000 pid=3674 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=faac5a9c-1700-0000-2b5b-bf945a0e0000 pid=3674 execve guuid=2a89f59c-1700-0000-2b5b-bf945c0e0000 pid=3676 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=2a89f59c-1700-0000-2b5b-bf945c0e0000 pid=3676 execve guuid=f887609d-1700-0000-2b5b-bf945f0e0000 pid=3679 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=f887609d-1700-0000-2b5b-bf945f0e0000 pid=3679 execve guuid=f676c89d-1700-0000-2b5b-bf94600e0000 pid=3680 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=f676c89d-1700-0000-2b5b-bf94600e0000 pid=3680 execve guuid=9c0c289e-1700-0000-2b5b-bf94620e0000 pid=3682 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=9c0c289e-1700-0000-2b5b-bf94620e0000 pid=3682 execve guuid=7a2da19e-1700-0000-2b5b-bf94650e0000 pid=3685 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=7a2da19e-1700-0000-2b5b-bf94650e0000 pid=3685 execve guuid=40a11a9f-1700-0000-2b5b-bf94680e0000 pid=3688 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=40a11a9f-1700-0000-2b5b-bf94680e0000 pid=3688 execve guuid=e052889f-1700-0000-2b5b-bf946a0e0000 pid=3690 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=e052889f-1700-0000-2b5b-bf946a0e0000 pid=3690 execve guuid=4fb002a0-1700-0000-2b5b-bf946c0e0000 pid=3692 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=4fb002a0-1700-0000-2b5b-bf946c0e0000 pid=3692 execve guuid=0ee25ca0-1700-0000-2b5b-bf946f0e0000 pid=3695 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=0ee25ca0-1700-0000-2b5b-bf946f0e0000 pid=3695 execve guuid=9e3ac2a0-1700-0000-2b5b-bf94710e0000 pid=3697 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=9e3ac2a0-1700-0000-2b5b-bf94710e0000 pid=3697 execve guuid=224e20a1-1700-0000-2b5b-bf94730e0000 pid=3699 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=224e20a1-1700-0000-2b5b-bf94730e0000 pid=3699 execve guuid=3a097da1-1700-0000-2b5b-bf94760e0000 pid=3702 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=3a097da1-1700-0000-2b5b-bf94760e0000 pid=3702 execve guuid=fe90e3a1-1700-0000-2b5b-bf94770e0000 pid=3703 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=fe90e3a1-1700-0000-2b5b-bf94770e0000 pid=3703 execve guuid=aa5b49a2-1700-0000-2b5b-bf947a0e0000 pid=3706 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=aa5b49a2-1700-0000-2b5b-bf947a0e0000 pid=3706 execve guuid=77d2aea2-1700-0000-2b5b-bf947c0e0000 pid=3708 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=77d2aea2-1700-0000-2b5b-bf947c0e0000 pid=3708 execve guuid=2f0209a3-1700-0000-2b5b-bf947d0e0000 pid=3709 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=2f0209a3-1700-0000-2b5b-bf947d0e0000 pid=3709 execve guuid=ce726ba3-1700-0000-2b5b-bf947f0e0000 pid=3711 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=ce726ba3-1700-0000-2b5b-bf947f0e0000 pid=3711 execve guuid=a348cea3-1700-0000-2b5b-bf94810e0000 pid=3713 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=a348cea3-1700-0000-2b5b-bf94810e0000 pid=3713 execve guuid=dda929a4-1700-0000-2b5b-bf94830e0000 pid=3715 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=dda929a4-1700-0000-2b5b-bf94830e0000 pid=3715 execve guuid=dc698ca4-1700-0000-2b5b-bf94840e0000 pid=3716 /usr/bin/ls guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=dc698ca4-1700-0000-2b5b-bf94840e0000 pid=3716 execve guuid=0e66eca4-1700-0000-2b5b-bf94860e0000 pid=3718 /usr/bin/rm guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=0e66eca4-1700-0000-2b5b-bf94860e0000 pid=3718 execve guuid=5cb727a5-1700-0000-2b5b-bf94870e0000 pid=3719 /usr/bin/wget net send-data write-file guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=5cb727a5-1700-0000-2b5b-bf94870e0000 pid=3719 execve guuid=7dae89ad-1700-0000-2b5b-bf94940e0000 pid=3732 /usr/bin/chmod guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=7dae89ad-1700-0000-2b5b-bf94940e0000 pid=3732 execve guuid=5af7eaad-1700-0000-2b5b-bf94970e0000 pid=3735 /tmp/305b guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=5af7eaad-1700-0000-2b5b-bf94970e0000 pid=3735 execve guuid=eff4c4ae-1700-0000-2b5b-bf94990e0000 pid=3737 /usr/bin/rm guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=eff4c4ae-1700-0000-2b5b-bf94990e0000 pid=3737 execve guuid=bde700af-1700-0000-2b5b-bf949c0e0000 pid=3740 /usr/bin/wget net send-data write-file guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=bde700af-1700-0000-2b5b-bf949c0e0000 pid=3740 execve guuid=1aed7cb5-1700-0000-2b5b-bf94af0e0000 pid=3759 /usr/bin/chmod guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=1aed7cb5-1700-0000-2b5b-bf94af0e0000 pid=3759 execve guuid=02ccf8b5-1700-0000-2b5b-bf94b30e0000 pid=3763 /tmp/bcM5 guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=02ccf8b5-1700-0000-2b5b-bf94b30e0000 pid=3763 execve guuid=fe19e1b7-1700-0000-2b5b-bf94bb0e0000 pid=3771 /usr/bin/rm guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=fe19e1b7-1700-0000-2b5b-bf94bb0e0000 pid=3771 execve guuid=d39c23b8-1700-0000-2b5b-bf94bd0e0000 pid=3773 /usr/bin/wget net send-data write-file guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=d39c23b8-1700-0000-2b5b-bf94bd0e0000 pid=3773 execve guuid=6ff9a6fb-1700-0000-2b5b-bf94880f0000 pid=3976 /usr/bin/chmod guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=6ff9a6fb-1700-0000-2b5b-bf94880f0000 pid=3976 execve guuid=b9a92efc-1700-0000-2b5b-bf948a0f0000 pid=3978 /tmp/Ok4 guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=b9a92efc-1700-0000-2b5b-bf948a0f0000 pid=3978 execve guuid=b3574bfe-1700-0000-2b5b-bf94930f0000 pid=3987 /usr/bin/rm guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=b3574bfe-1700-0000-2b5b-bf94930f0000 pid=3987 execve guuid=9ea39dfe-1700-0000-2b5b-bf94950f0000 pid=3989 /usr/bin/wget net send-data write-file guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=9ea39dfe-1700-0000-2b5b-bf94950f0000 pid=3989 execve guuid=83011205-1800-0000-2b5b-bf94ae0f0000 pid=4014 /usr/bin/chmod guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=83011205-1800-0000-2b5b-bf94ae0f0000 pid=4014 execve guuid=5a305b05-1800-0000-2b5b-bf94b00f0000 pid=4016 /tmp/l5V7 guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=5a305b05-1800-0000-2b5b-bf94b00f0000 pid=4016 execve guuid=30d22c06-1800-0000-2b5b-bf94b40f0000 pid=4020 /usr/bin/rm guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=30d22c06-1800-0000-2b5b-bf94b40f0000 pid=4020 execve guuid=96767f06-1800-0000-2b5b-bf94b50f0000 pid=4021 /usr/bin/wget net send-data write-file guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=96767f06-1800-0000-2b5b-bf94b50f0000 pid=4021 execve guuid=3fb2300d-1800-0000-2b5b-bf94cc0f0000 pid=4044 /usr/bin/chmod guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=3fb2300d-1800-0000-2b5b-bf94cc0f0000 pid=4044 execve guuid=f148eb0d-1800-0000-2b5b-bf94cd0f0000 pid=4045 /tmp/nQd guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=f148eb0d-1800-0000-2b5b-bf94cd0f0000 pid=4045 execve guuid=b92dda0f-1800-0000-2b5b-bf94d50f0000 pid=4053 /usr/bin/rm delete-file guuid=2e831576-1700-0000-2b5b-bf947e0d0000 pid=3454->guuid=b92dda0f-1800-0000-2b5b-bf94d50f0000 pid=4053 execve 9554d36e-3083-568e-90da-bb8e3c487b07 188.132.232.81:80 guuid=5cb727a5-1700-0000-2b5b-bf94870e0000 pid=3719->9554d36e-3083-568e-90da-bb8e3c487b07 send: 133B guuid=bde700af-1700-0000-2b5b-bf949c0e0000 pid=3740->9554d36e-3083-568e-90da-bb8e3c487b07 send: 133B guuid=d39c23b8-1700-0000-2b5b-bf94bd0e0000 pid=3773->9554d36e-3083-568e-90da-bb8e3c487b07 send: 132B guuid=9ea39dfe-1700-0000-2b5b-bf94950f0000 pid=3989->9554d36e-3083-568e-90da-bb8e3c487b07 send: 133B guuid=96767f06-1800-0000-2b5b-bf94b50f0000 pid=4021->9554d36e-3083-568e-90da-bb8e3c487b07 send: 132B
Score:
97%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/a9d41a6aec4a745cdd729a094d042958f7a682b90b06dddafa9e24c8cdf1f3a6
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a9d41a6aec4a745cdd729a094d042958f7a682b90b06dddafa9e24c8cdf1f3a6/
Verdict:
Malicious
Threat:
Trojan-Downloader.Shell.Agent
Link:
https://tip.neiki.dev/file/a9d41a6aec4a745cdd729a094d042958f7a682b90b06dddafa9e24c8cdf1f3a6
Threat name:
Win32.Trojan.Vigorf
Create hunting rule
Status:
Malicious
First seen:
2026-06-05 05:13:35 UTC
File Type:
Text (Shell)
AV detection:
10 of 22 (45.45%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vhkbu2xmjj2fzxlstieu2bbjld32navzbmdn3wx2tysmrtpr6ota._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
defense_evasion discovery linux
Link:
https://tria.ge/reports/260605-fwl4vsct6j/
Behaviour
Reads runtime system information
Writes file to tmp directory
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.26
Link:
https://yomi.yoroi.company/submissions/a9d41a6aec4a745cdd729a094d042958f7a682b90b06dddafa9e24c8cdf1f3a6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh a9d41a6aec4a745cdd729a094d042958f7a682b90b06dddafa9e24c8cdf1f3a6

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3856431/
  
Delivery method
Distributed via web download

Comments