MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b2aa441df3f7bc83c5e15a9f713a364a222930e90adcb7f43e4577c1fec92c64. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b2aa441df3f7bc83c5e15a9f713a364a222930e90adcb7f43e4577c1fec92c64
SHA3-384 hash: 18e9dfbe6874b5c69351d1f651f4321e3d74bc774fd1ba854fa0a46de8297860962b047544e9a676c8913265f8807aca
SHA1 hash: 1e8393e4a8a812568fcb51351e24ec66409e98f6
MD5 hash: 468ddf2b34c05123e99931d199950923
humanhash: lion-summer-five-potato
File name:k.php
Download: download sample
File size:19'499 bytes
First seen:2026-03-25 15:59:33 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 384:+FcuQpWx+BL0SWL0gUzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:+F8i+BL0SI0jzsP4cbddr7zsP4cbddrk
TLSH T1A6925DB512496C79FBD1CE399F3C6F4CADE8C2C42124A3ACBA4F39205A1166DC70534A
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh

Intelligence

File Origin
# of uploads :
1
# of downloads :
73
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive masquerade
Link:
https://www.filescan.io/uploads/69c406a6e2df9aa488b777ea/reports/5bf6095e-e62b-424f-8df1-30d1313feed5/overview
Verdict:
Malicious
File Type:
unix shell
Detections:
HEUR:Trojan-Downloader.Shell.Agent.bc
Link:
https://opentip.kaspersky.com/b2aa441df3f7bc83c5e15a9f713a364a222930e90adcb7f43e4577c1fec92c64/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/eda501f6-658d-4661-83ec-d67f2f4270e4
Behavior Graph:
Download SVG
%3 guuid=8f614199-1a00-0000-8f63-b6c7520a0000 pid=2642 /usr/bin/sudo guuid=19939e9b-1a00-0000-8f63-b6c75b0a0000 pid=2651 /tmp/sample.bin guuid=8f614199-1a00-0000-8f63-b6c7520a0000 pid=2642->guuid=19939e9b-1a00-0000-8f63-b6c75b0a0000 pid=2651 execve guuid=e2488a9c-1a00-0000-8f63-b6c75e0a0000 pid=2654 /usr/bin/bash guuid=19939e9b-1a00-0000-8f63-b6c75b0a0000 pid=2651->guuid=e2488a9c-1a00-0000-8f63-b6c75e0a0000 pid=2654 clone guuid=81919b9c-1a00-0000-8f63-b6c7600a0000 pid=2656 /usr/bin/bash guuid=19939e9b-1a00-0000-8f63-b6c75b0a0000 pid=2651->guuid=81919b9c-1a00-0000-8f63-b6c7600a0000 pid=2656 clone guuid=518efd9c-1a00-0000-8f63-b6c7620a0000 pid=2658 /usr/bin/mkdir guuid=19939e9b-1a00-0000-8f63-b6c75b0a0000 pid=2651->guuid=518efd9c-1a00-0000-8f63-b6c7620a0000 pid=2658 execve guuid=fb98629d-1a00-0000-8f63-b6c7640a0000 pid=2660 /usr/bin/mkdir guuid=19939e9b-1a00-0000-8f63-b6c75b0a0000 pid=2651->guuid=fb98629d-1a00-0000-8f63-b6c7640a0000 pid=2660 execve guuid=083cb99d-1a00-0000-8f63-b6c7660a0000 pid=2662 /usr/bin/mkdir guuid=19939e9b-1a00-0000-8f63-b6c75b0a0000 pid=2651->guuid=083cb99d-1a00-0000-8f63-b6c7660a0000 pid=2662 execve guuid=b8de0d9e-1a00-0000-8f63-b6c7680a0000 pid=2664 /usr/bin/mkdir guuid=19939e9b-1a00-0000-8f63-b6c75b0a0000 pid=2651->guuid=b8de0d9e-1a00-0000-8f63-b6c7680a0000 pid=2664 execve guuid=35bd649e-1a00-0000-8f63-b6c76a0a0000 pid=2666 /usr/bin/mkdir guuid=19939e9b-1a00-0000-8f63-b6c75b0a0000 pid=2651->guuid=35bd649e-1a00-0000-8f63-b6c76a0a0000 pid=2666 execve guuid=0190dd9e-1a00-0000-8f63-b6c76c0a0000 pid=2668 /usr/bin/mkdir guuid=19939e9b-1a00-0000-8f63-b6c75b0a0000 pid=2651->guuid=0190dd9e-1a00-0000-8f63-b6c76c0a0000 pid=2668 execve guuid=4e553d9f-1a00-0000-8f63-b6c76e0a0000 pid=2670 /usr/bin/mkdir guuid=19939e9b-1a00-0000-8f63-b6c75b0a0000 pid=2651->guuid=4e553d9f-1a00-0000-8f63-b6c76e0a0000 pid=2670 execve guuid=c2d2999f-1a00-0000-8f63-b6c7700a0000 pid=2672 /usr/bin/cp guuid=19939e9b-1a00-0000-8f63-b6c75b0a0000 pid=2651->guuid=c2d2999f-1a00-0000-8f63-b6c7700a0000 pid=2672 execve guuid=f62900a0-1a00-0000-8f63-b6c7730a0000 pid=2675 /usr/bin/cp guuid=19939e9b-1a00-0000-8f63-b6c75b0a0000 pid=2651->guuid=f62900a0-1a00-0000-8f63-b6c7730a0000 pid=2675 execve guuid=769790a0-1a00-0000-8f63-b6c7760a0000 pid=2678 /usr/bin/cp guuid=19939e9b-1a00-0000-8f63-b6c75b0a0000 pid=2651->guuid=769790a0-1a00-0000-8f63-b6c7760a0000 pid=2678 execve guuid=7c4414a1-1a00-0000-8f63-b6c7780a0000 pid=2680 /usr/bin/cp guuid=19939e9b-1a00-0000-8f63-b6c75b0a0000 pid=2651->guuid=7c4414a1-1a00-0000-8f63-b6c7780a0000 pid=2680 execve guuid=b1638fa1-1a00-0000-8f63-b6c77a0a0000 pid=2682 /usr/bin/cp guuid=19939e9b-1a00-0000-8f63-b6c75b0a0000 pid=2651->guuid=b1638fa1-1a00-0000-8f63-b6c77a0a0000 pid=2682 execve guuid=6e7fe9a1-1a00-0000-8f63-b6c77c0a0000 pid=2684 /usr/bin/cp guuid=19939e9b-1a00-0000-8f63-b6c75b0a0000 pid=2651->guuid=6e7fe9a1-1a00-0000-8f63-b6c77c0a0000 pid=2684 execve guuid=627548a2-1a00-0000-8f63-b6c77f0a0000 pid=2687 /usr/bin/cp guuid=19939e9b-1a00-0000-8f63-b6c75b0a0000 pid=2651->guuid=627548a2-1a00-0000-8f63-b6c77f0a0000 pid=2687 execve guuid=b2d0bda2-1a00-0000-8f63-b6c7820a0000 pid=2690 /usr/bin/cp guuid=19939e9b-1a00-0000-8f63-b6c75b0a0000 pid=2651->guuid=b2d0bda2-1a00-0000-8f63-b6c7820a0000 pid=2690 execve guuid=541e1da3-1a00-0000-8f63-b6c7840a0000 pid=2692 /usr/bin/cp guuid=19939e9b-1a00-0000-8f63-b6c75b0a0000 pid=2651->guuid=541e1da3-1a00-0000-8f63-b6c7840a0000 pid=2692 execve guuid=594b8ba3-1a00-0000-8f63-b6c7860a0000 pid=2694 /usr/bin/cp guuid=19939e9b-1a00-0000-8f63-b6c75b0a0000 pid=2651->guuid=594b8ba3-1a00-0000-8f63-b6c7860a0000 pid=2694 execve guuid=9002e8a3-1a00-0000-8f63-b6c7890a0000 pid=2697 /usr/bin/cp guuid=19939e9b-1a00-0000-8f63-b6c75b0a0000 pid=2651->guuid=9002e8a3-1a00-0000-8f63-b6c7890a0000 pid=2697 execve guuid=302784a4-1a00-0000-8f63-b6c78b0a0000 pid=2699 /usr/bin/cp guuid=19939e9b-1a00-0000-8f63-b6c75b0a0000 pid=2651->guuid=302784a4-1a00-0000-8f63-b6c78b0a0000 pid=2699 execve guuid=318b0ea5-1a00-0000-8f63-b6c78d0a0000 pid=2701 /usr/bin/cp guuid=19939e9b-1a00-0000-8f63-b6c75b0a0000 pid=2651->guuid=318b0ea5-1a00-0000-8f63-b6c78d0a0000 pid=2701 execve guuid=6035a2a5-1a00-0000-8f63-b6c7900a0000 pid=2704 /usr/bin/cp guuid=19939e9b-1a00-0000-8f63-b6c75b0a0000 pid=2651->guuid=6035a2a5-1a00-0000-8f63-b6c7900a0000 pid=2704 execve guuid=f4cb48a6-1a00-0000-8f63-b6c7930a0000 pid=2707 /usr/bin/cp guuid=19939e9b-1a00-0000-8f63-b6c75b0a0000 pid=2651->guuid=f4cb48a6-1a00-0000-8f63-b6c7930a0000 pid=2707 execve guuid=340db3a6-1a00-0000-8f63-b6c7950a0000 pid=2709 /usr/bin/touch guuid=19939e9b-1a00-0000-8f63-b6c75b0a0000 pid=2651->guuid=340db3a6-1a00-0000-8f63-b6c7950a0000 pid=2709 execve guuid=52b505a7-1a00-0000-8f63-b6c7970a0000 pid=2711 /usr/bin/bash guuid=19939e9b-1a00-0000-8f63-b6c75b0a0000 pid=2651->guuid=52b505a7-1a00-0000-8f63-b6c7970a0000 pid=2711 clone guuid=b41b0da7-1a00-0000-8f63-b6c7980a0000 pid=2712 /usr/bin/bash guuid=19939e9b-1a00-0000-8f63-b6c75b0a0000 pid=2651->guuid=b41b0da7-1a00-0000-8f63-b6c7980a0000 pid=2712 clone guuid=eee236a7-1a00-0000-8f63-b6c79a0a0000 pid=2714 /usr/bin/bash guuid=19939e9b-1a00-0000-8f63-b6c75b0a0000 pid=2651->guuid=eee236a7-1a00-0000-8f63-b6c79a0a0000 pid=2714 clone guuid=25ce3ea7-1a00-0000-8f63-b6c79b0a0000 pid=2715 /usr/bin/base64 write-file guuid=19939e9b-1a00-0000-8f63-b6c75b0a0000 pid=2651->guuid=25ce3ea7-1a00-0000-8f63-b6c79b0a0000 pid=2715 execve guuid=efdbeaa7-1a00-0000-8f63-b6c79d0a0000 pid=2717 /usr/bin/bash guuid=19939e9b-1a00-0000-8f63-b6c75b0a0000 pid=2651->guuid=efdbeaa7-1a00-0000-8f63-b6c79d0a0000 pid=2717 execve guuid=ec7f27ad-1a00-0000-8f63-b6c7bf0a0000 pid=2751 /usr/bin/rm delete-file guuid=19939e9b-1a00-0000-8f63-b6c75b0a0000 pid=2651->guuid=ec7f27ad-1a00-0000-8f63-b6c7bf0a0000 pid=2751 execve guuid=f58275ad-1a00-0000-8f63-b6c7c10a0000 pid=2753 /usr/bin/bash guuid=19939e9b-1a00-0000-8f63-b6c75b0a0000 pid=2651->guuid=f58275ad-1a00-0000-8f63-b6c7c10a0000 pid=2753 clone guuid=15a97bad-1a00-0000-8f63-b6c7c20a0000 pid=2754 /usr/bin/bash guuid=19939e9b-1a00-0000-8f63-b6c75b0a0000 pid=2651->guuid=15a97bad-1a00-0000-8f63-b6c7c20a0000 pid=2754 clone guuid=d4bad7ad-1a00-0000-8f63-b6c7c50a0000 pid=2757 /usr/bin/bash guuid=19939e9b-1a00-0000-8f63-b6c75b0a0000 pid=2651->guuid=d4bad7ad-1a00-0000-8f63-b6c7c50a0000 pid=2757 execve guuid=b3b731ae-1a00-0000-8f63-b6c7c70a0000 pid=2759 /usr/bin/rm guuid=19939e9b-1a00-0000-8f63-b6c75b0a0000 pid=2651->guuid=b3b731ae-1a00-0000-8f63-b6c7c70a0000 pid=2759 execve guuid=b92d54a8-1a00-0000-8f63-b6c79f0a0000 pid=2719 /usr/bin/bash guuid=efdbeaa7-1a00-0000-8f63-b6c79d0a0000 pid=2717->guuid=b92d54a8-1a00-0000-8f63-b6c79f0a0000 pid=2719 clone guuid=20b65ba8-1a00-0000-8f63-b6c7a00a0000 pid=2720 /usr/bin/bash guuid=efdbeaa7-1a00-0000-8f63-b6c79d0a0000 pid=2717->guuid=20b65ba8-1a00-0000-8f63-b6c7a00a0000 pid=2720 clone guuid=7f0c84a8-1a00-0000-8f63-b6c7a20a0000 pid=2722 /usr/bin/ls guuid=efdbeaa7-1a00-0000-8f63-b6c79d0a0000 pid=2717->guuid=7f0c84a8-1a00-0000-8f63-b6c7a20a0000 pid=2722 execve guuid=12faf6a8-1a00-0000-8f63-b6c7a50a0000 pid=2725 /usr/bin/cat guuid=efdbeaa7-1a00-0000-8f63-b6c79d0a0000 pid=2717->guuid=12faf6a8-1a00-0000-8f63-b6c7a50a0000 pid=2725 execve guuid=ad8270a9-1a00-0000-8f63-b6c7a80a0000 pid=2728 /usr/bin/ls guuid=efdbeaa7-1a00-0000-8f63-b6c79d0a0000 pid=2717->guuid=ad8270a9-1a00-0000-8f63-b6c7a80a0000 pid=2728 execve guuid=b41edea9-1a00-0000-8f63-b6c7aa0a0000 pid=2730 /usr/bin/mkdir guuid=efdbeaa7-1a00-0000-8f63-b6c79d0a0000 pid=2717->guuid=b41edea9-1a00-0000-8f63-b6c7aa0a0000 pid=2730 execve guuid=b20039aa-1a00-0000-8f63-b6c7ad0a0000 pid=2733 /usr/bin/mv guuid=efdbeaa7-1a00-0000-8f63-b6c79d0a0000 pid=2717->guuid=b20039aa-1a00-0000-8f63-b6c7ad0a0000 pid=2733 execve guuid=d32b99aa-1a00-0000-8f63-b6c7af0a0000 pid=2735 /usr/bin/bash guuid=efdbeaa7-1a00-0000-8f63-b6c79d0a0000 pid=2717->guuid=d32b99aa-1a00-0000-8f63-b6c7af0a0000 pid=2735 clone guuid=769fa1aa-1a00-0000-8f63-b6c7b00a0000 pid=2736 /usr/bin/base64 write-file guuid=efdbeaa7-1a00-0000-8f63-b6c79d0a0000 pid=2717->guuid=769fa1aa-1a00-0000-8f63-b6c7b00a0000 pid=2736 execve guuid=e5aaf5aa-1a00-0000-8f63-b6c7b20a0000 pid=2738 /usr/bin/rm delete-file guuid=efdbeaa7-1a00-0000-8f63-b6c79d0a0000 pid=2717->guuid=e5aaf5aa-1a00-0000-8f63-b6c7b20a0000 pid=2738 execve guuid=7ec041ab-1a00-0000-8f63-b6c7b40a0000 pid=2740 /usr/bin/ls guuid=efdbeaa7-1a00-0000-8f63-b6c79d0a0000 pid=2717->guuid=7ec041ab-1a00-0000-8f63-b6c7b40a0000 pid=2740 execve guuid=92f7a7ab-1a00-0000-8f63-b6c7b60a0000 pid=2742 /usr/bin/bash guuid=efdbeaa7-1a00-0000-8f63-b6c79d0a0000 pid=2717->guuid=92f7a7ab-1a00-0000-8f63-b6c7b60a0000 pid=2742 clone guuid=6187b1ab-1a00-0000-8f63-b6c7b70a0000 pid=2743 /usr/bin/base64 write-file guuid=efdbeaa7-1a00-0000-8f63-b6c79d0a0000 pid=2717->guuid=6187b1ab-1a00-0000-8f63-b6c7b70a0000 pid=2743 execve guuid=5f7401ac-1a00-0000-8f63-b6c7b90a0000 pid=2745 /usr/bin/ls guuid=efdbeaa7-1a00-0000-8f63-b6c79d0a0000 pid=2717->guuid=5f7401ac-1a00-0000-8f63-b6c7b90a0000 pid=2745 execve guuid=cb406dac-1a00-0000-8f63-b6c7bb0a0000 pid=2747 /usr/bin/cat guuid=efdbeaa7-1a00-0000-8f63-b6c79d0a0000 pid=2717->guuid=cb406dac-1a00-0000-8f63-b6c7bb0a0000 pid=2747 execve guuid=ab93b5ac-1a00-0000-8f63-b6c7bc0a0000 pid=2748 /usr/bin/ls guuid=efdbeaa7-1a00-0000-8f63-b6c79d0a0000 pid=2717->guuid=ab93b5ac-1a00-0000-8f63-b6c7bc0a0000 pid=2748 execve
Score:
81%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/b2aa441df3f7bc83c5e15a9f713a364a222930e90adcb7f43e4577c1fec92c64
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b2aa441df3f7bc83c5e15a9f713a364a222930e90adcb7f43e4577c1fec92c64/
Verdict:
Malicious
Threat:
Trojan-Downloader.Shell.Agent
Link:
https://tip.neiki.dev/file/b2aa441df3f7bc83c5e15a9f713a364a222930e90adcb7f43e4577c1fec92c64
Threat name:
Script-Shell.Trojan.Vigorf
Create hunting rule
Status:
Malicious
First seen:
2026-03-25 16:00:47 UTC
File Type:
Text (Shell)
AV detection:
13 of 24 (54.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wkveihpt666ihrpblkpxcorwjircsmhjblolp5b6iv34d7wjfrsa._file
Result
Malware family:
n/a
Score:
  4/10
Tags:
defense_evasion discovery linux
Link:
https://tria.ge/reports/260325-tfxsbaez3w/
Behaviour
Reads runtime system information
Writes file to tmp directory
Deobfuscate/Decode Files or Information
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/b2aa441df3f7bc83c5e15a9f713a364a222930e90adcb7f43e4577c1fec92c64

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SUSP_LNX_Base64_Exec_Apr24
Create hunting rule
Author:Christian Burkard
Description:Detects suspicious base64 encoded shell commands (as seen in Palo Alto CVE-2024-3400 exploitation)
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh b2aa441df3f7bc83c5e15a9f713a364a222930e90adcb7f43e4577c1fec92c64

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3792476/
  
Delivery method
Distributed via web download

Comments