🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 be112a1b5c18eac836e6d5555587ca2e47025a9e586268e728c01208c2a60263. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: be112a1b5c18eac836e6d5555587ca2e47025a9e586268e728c01208c2a60263
SHA3-384 hash: fa6ad870d81b7744a9b3b9f9cda68741cc8198273cbc2d49eba066bb400e8dbbcb12c2961c4321f952452d26d755c3e9
SHA1 hash: 47325d40c9706e4c8e4209d273c521648f8cc6a0
MD5 hash: 8917695df7bd21e569c5937b9631dc49
humanhash: wisconsin-iowa-don-winter
File name:ok
Download: download sample
File size:1'584 bytes
First seen:2026-06-22 08:52:10 UTC
Last seen:2026-06-23 01:10:16 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 12:Us6ppSpGH6GORyhFD/6Kgw2c6qTLI6Lgp9ZJ1I6J1IXvti6taqersx6s048kD16i:spSoLEyzXH7QpvSVbiOK3XGYAd1
TLSH T19C318E9F05205D3A5242CECE73B73118644C95EB2D6BC795AC889EAE818898CB2A5FC4
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://5.182.210.61/9bbae5n/an/aelf ua-wget
http://5.182.210.61/1cf3cdn/an/aelf ua-wget
http://5.182.210.61/77f9a3n/an/aelf ua-wget
http://5.182.210.61/f816f5n/an/aelf ua-wget
http://5.182.210.61/3483f4n/an/aelf ua-wget
http://5.182.210.61/479f95n/an/aelf ua-wget
http://5.182.210.61/c5a65bn/an/aelf ua-wget
http://5.182.210.61/9de4d6n/an/aelf ua-wget
http://5.182.210.61/a8ea28n/an/aelf ua-wget
http://5.182.210.61/e929e0n/an/aelf ua-wget
http://5.182.210.61/3f885an/an/aelf ua-wget
http://5.182.210.61/4fea0cn/an/aelf ua-wget

Intelligence

File Origin
# of uploads :
4
# of downloads :
68
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive
Link:
https://www.filescan.io/uploads/6a38f7d490632a45f731ba5e/reports/c9d45f3d-512b-4f6f-b649-ae47f25f59c9/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-06-22T06:02:00Z UTC
Last seen:
2026-06-23T23:27:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan-Downloader.Shell.Agent.a
Link:
https://opentip.kaspersky.com/be112a1b5c18eac836e6d5555587ca2e47025a9e586268e728c01208c2a60263/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/fdcc8708-3dd7-4323-b042-a627b831da35
Behavior Graph:
Download SVG
%3 guuid=d738e463-1900-0000-bdef-6a8c2e140000 pid=5166 /usr/bin/sudo guuid=94b6db66-1900-0000-bdef-6a8c2f140000 pid=5167 /tmp/sample.bin guuid=d738e463-1900-0000-bdef-6a8c2e140000 pid=5166->guuid=94b6db66-1900-0000-bdef-6a8c2f140000 pid=5167 execve guuid=3ceb6b67-1900-0000-bdef-6a8c30140000 pid=5168 /usr/bin/wget net send-data guuid=94b6db66-1900-0000-bdef-6a8c2f140000 pid=5167->guuid=3ceb6b67-1900-0000-bdef-6a8c30140000 pid=5168 execve guuid=c1c5388e-1900-0000-bdef-6a8c31140000 pid=5169 /usr/bin/curl net send-data write-file guuid=94b6db66-1900-0000-bdef-6a8c2f140000 pid=5167->guuid=c1c5388e-1900-0000-bdef-6a8c31140000 pid=5169 execve guuid=9f02d1be-1900-0000-bdef-6a8c32140000 pid=5170 /usr/bin/chmod guuid=94b6db66-1900-0000-bdef-6a8c2f140000 pid=5167->guuid=9f02d1be-1900-0000-bdef-6a8c32140000 pid=5170 execve guuid=11f559bf-1900-0000-bdef-6a8c34140000 pid=5172 /usr/bin/bash guuid=94b6db66-1900-0000-bdef-6a8c2f140000 pid=5167->guuid=11f559bf-1900-0000-bdef-6a8c34140000 pid=5172 clone guuid=2736c4bf-1900-0000-bdef-6a8c36140000 pid=5174 /usr/bin/rm delete-file guuid=94b6db66-1900-0000-bdef-6a8c2f140000 pid=5167->guuid=2736c4bf-1900-0000-bdef-6a8c36140000 pid=5174 execve guuid=3e6209c0-1900-0000-bdef-6a8c39140000 pid=5177 /usr/bin/rm guuid=94b6db66-1900-0000-bdef-6a8c2f140000 pid=5167->guuid=3e6209c0-1900-0000-bdef-6a8c39140000 pid=5177 execve guuid=7e7053c0-1900-0000-bdef-6a8c3c140000 pid=5180 /usr/bin/wget net send-data guuid=94b6db66-1900-0000-bdef-6a8c2f140000 pid=5167->guuid=7e7053c0-1900-0000-bdef-6a8c3c140000 pid=5180 execve guuid=d974c0c3-1900-0000-bdef-6a8c3d140000 pid=5181 /usr/bin/curl net send-data write-file guuid=94b6db66-1900-0000-bdef-6a8c2f140000 pid=5167->guuid=d974c0c3-1900-0000-bdef-6a8c3d140000 pid=5181 execve guuid=ca3555c9-1900-0000-bdef-6a8c40140000 pid=5184 /usr/bin/chmod guuid=94b6db66-1900-0000-bdef-6a8c2f140000 pid=5167->guuid=ca3555c9-1900-0000-bdef-6a8c40140000 pid=5184 execve guuid=044bb9c9-1900-0000-bdef-6a8c41140000 pid=5185 /usr/bin/bash guuid=94b6db66-1900-0000-bdef-6a8c2f140000 pid=5167->guuid=044bb9c9-1900-0000-bdef-6a8c41140000 pid=5185 clone guuid=fcbb60ca-1900-0000-bdef-6a8c43140000 pid=5187 /usr/bin/rm delete-file guuid=94b6db66-1900-0000-bdef-6a8c2f140000 pid=5167->guuid=fcbb60ca-1900-0000-bdef-6a8c43140000 pid=5187 execve guuid=33cec0ca-1900-0000-bdef-6a8c44140000 pid=5188 /usr/bin/rm guuid=94b6db66-1900-0000-bdef-6a8c2f140000 pid=5167->guuid=33cec0ca-1900-0000-bdef-6a8c44140000 pid=5188 execve guuid=bf531fcb-1900-0000-bdef-6a8c45140000 pid=5189 /usr/bin/wget net send-data guuid=94b6db66-1900-0000-bdef-6a8c2f140000 pid=5167->guuid=bf531fcb-1900-0000-bdef-6a8c45140000 pid=5189 execve guuid=2f3de5cd-1900-0000-bdef-6a8c46140000 pid=5190 /usr/bin/curl net send-data write-file guuid=94b6db66-1900-0000-bdef-6a8c2f140000 pid=5167->guuid=2f3de5cd-1900-0000-bdef-6a8c46140000 pid=5190 execve guuid=7cdb01d2-1900-0000-bdef-6a8c47140000 pid=5191 /usr/bin/chmod guuid=94b6db66-1900-0000-bdef-6a8c2f140000 pid=5167->guuid=7cdb01d2-1900-0000-bdef-6a8c47140000 pid=5191 execve guuid=7e0464d2-1900-0000-bdef-6a8c48140000 pid=5192 /usr/bin/bash guuid=94b6db66-1900-0000-bdef-6a8c2f140000 pid=5167->guuid=7e0464d2-1900-0000-bdef-6a8c48140000 pid=5192 clone guuid=2d3adad2-1900-0000-bdef-6a8c4a140000 pid=5194 /usr/bin/rm delete-file guuid=94b6db66-1900-0000-bdef-6a8c2f140000 pid=5167->guuid=2d3adad2-1900-0000-bdef-6a8c4a140000 pid=5194 execve guuid=49e940d3-1900-0000-bdef-6a8c4b140000 pid=5195 /usr/bin/rm guuid=94b6db66-1900-0000-bdef-6a8c2f140000 pid=5167->guuid=49e940d3-1900-0000-bdef-6a8c4b140000 pid=5195 execve guuid=789cacd3-1900-0000-bdef-6a8c4c140000 pid=5196 /usr/bin/wget net send-data guuid=94b6db66-1900-0000-bdef-6a8c2f140000 pid=5167->guuid=789cacd3-1900-0000-bdef-6a8c4c140000 pid=5196 execve guuid=4824a0d6-1900-0000-bdef-6a8c4d140000 pid=5197 /usr/bin/curl net send-data write-file guuid=94b6db66-1900-0000-bdef-6a8c2f140000 pid=5167->guuid=4824a0d6-1900-0000-bdef-6a8c4d140000 pid=5197 execve guuid=5bf5feda-1900-0000-bdef-6a8c4e140000 pid=5198 /usr/bin/chmod guuid=94b6db66-1900-0000-bdef-6a8c2f140000 pid=5167->guuid=5bf5feda-1900-0000-bdef-6a8c4e140000 pid=5198 execve guuid=067365db-1900-0000-bdef-6a8c4f140000 pid=5199 /usr/bin/bash guuid=94b6db66-1900-0000-bdef-6a8c2f140000 pid=5167->guuid=067365db-1900-0000-bdef-6a8c4f140000 pid=5199 clone guuid=c4e5fcdb-1900-0000-bdef-6a8c51140000 pid=5201 /usr/bin/rm delete-file guuid=94b6db66-1900-0000-bdef-6a8c2f140000 pid=5167->guuid=c4e5fcdb-1900-0000-bdef-6a8c51140000 pid=5201 execve guuid=82a164dc-1900-0000-bdef-6a8c52140000 pid=5202 /usr/bin/rm guuid=94b6db66-1900-0000-bdef-6a8c2f140000 pid=5167->guuid=82a164dc-1900-0000-bdef-6a8c52140000 pid=5202 execve guuid=b7c6cedc-1900-0000-bdef-6a8c53140000 pid=5203 /usr/bin/wget net send-data guuid=94b6db66-1900-0000-bdef-6a8c2f140000 pid=5167->guuid=b7c6cedc-1900-0000-bdef-6a8c53140000 pid=5203 execve guuid=67d8a6df-1900-0000-bdef-6a8c54140000 pid=5204 /usr/bin/curl net send-data write-file guuid=94b6db66-1900-0000-bdef-6a8c2f140000 pid=5167->guuid=67d8a6df-1900-0000-bdef-6a8c54140000 pid=5204 execve guuid=cb9218f4-1900-0000-bdef-6a8c55140000 pid=5205 /usr/bin/chmod guuid=94b6db66-1900-0000-bdef-6a8c2f140000 pid=5167->guuid=cb9218f4-1900-0000-bdef-6a8c55140000 pid=5205 execve guuid=c54405f5-1900-0000-bdef-6a8c56140000 pid=5206 /usr/bin/bash guuid=94b6db66-1900-0000-bdef-6a8c2f140000 pid=5167->guuid=c54405f5-1900-0000-bdef-6a8c56140000 pid=5206 clone guuid=141968f5-1900-0000-bdef-6a8c58140000 pid=5208 /usr/bin/rm delete-file guuid=94b6db66-1900-0000-bdef-6a8c2f140000 pid=5167->guuid=141968f5-1900-0000-bdef-6a8c58140000 pid=5208 execve guuid=4396d1f5-1900-0000-bdef-6a8c59140000 pid=5209 /usr/bin/rm guuid=94b6db66-1900-0000-bdef-6a8c2f140000 pid=5167->guuid=4396d1f5-1900-0000-bdef-6a8c59140000 pid=5209 execve guuid=cc4d31f6-1900-0000-bdef-6a8c5a140000 pid=5210 /usr/bin/wget net send-data guuid=94b6db66-1900-0000-bdef-6a8c2f140000 pid=5167->guuid=cc4d31f6-1900-0000-bdef-6a8c5a140000 pid=5210 execve guuid=ce1167f9-1900-0000-bdef-6a8c5b140000 pid=5211 /usr/bin/curl net send-data write-file guuid=94b6db66-1900-0000-bdef-6a8c2f140000 pid=5167->guuid=ce1167f9-1900-0000-bdef-6a8c5b140000 pid=5211 execve guuid=92d22e01-1a00-0000-bdef-6a8c5c140000 pid=5212 /usr/bin/chmod guuid=94b6db66-1900-0000-bdef-6a8c2f140000 pid=5167->guuid=92d22e01-1a00-0000-bdef-6a8c5c140000 pid=5212 execve guuid=1e5b9c01-1a00-0000-bdef-6a8c5d140000 pid=5213 /usr/bin/bash guuid=94b6db66-1900-0000-bdef-6a8c2f140000 pid=5167->guuid=1e5b9c01-1a00-0000-bdef-6a8c5d140000 pid=5213 clone guuid=066bf501-1a00-0000-bdef-6a8c5f140000 pid=5215 /usr/bin/rm delete-file guuid=94b6db66-1900-0000-bdef-6a8c2f140000 pid=5167->guuid=066bf501-1a00-0000-bdef-6a8c5f140000 pid=5215 execve guuid=bc347c02-1a00-0000-bdef-6a8c60140000 pid=5216 /usr/bin/rm guuid=94b6db66-1900-0000-bdef-6a8c2f140000 pid=5167->guuid=bc347c02-1a00-0000-bdef-6a8c60140000 pid=5216 execve guuid=760ade02-1a00-0000-bdef-6a8c61140000 pid=5217 /usr/bin/wget net send-data guuid=94b6db66-1900-0000-bdef-6a8c2f140000 pid=5167->guuid=760ade02-1a00-0000-bdef-6a8c61140000 pid=5217 execve guuid=0ad3f705-1a00-0000-bdef-6a8c62140000 pid=5218 /usr/bin/curl net send-data write-file guuid=94b6db66-1900-0000-bdef-6a8c2f140000 pid=5167->guuid=0ad3f705-1a00-0000-bdef-6a8c62140000 pid=5218 execve guuid=f486b50a-1a00-0000-bdef-6a8c63140000 pid=5219 /usr/bin/chmod guuid=94b6db66-1900-0000-bdef-6a8c2f140000 pid=5167->guuid=f486b50a-1a00-0000-bdef-6a8c63140000 pid=5219 execve guuid=f5db310b-1a00-0000-bdef-6a8c64140000 pid=5220 /usr/bin/bash guuid=94b6db66-1900-0000-bdef-6a8c2f140000 pid=5167->guuid=f5db310b-1a00-0000-bdef-6a8c64140000 pid=5220 clone guuid=0812920b-1a00-0000-bdef-6a8c66140000 pid=5222 /usr/bin/rm delete-file guuid=94b6db66-1900-0000-bdef-6a8c2f140000 pid=5167->guuid=0812920b-1a00-0000-bdef-6a8c66140000 pid=5222 execve guuid=004e0f0c-1a00-0000-bdef-6a8c67140000 pid=5223 /usr/bin/rm guuid=94b6db66-1900-0000-bdef-6a8c2f140000 pid=5167->guuid=004e0f0c-1a00-0000-bdef-6a8c67140000 pid=5223 execve guuid=7b59820c-1a00-0000-bdef-6a8c68140000 pid=5224 /usr/bin/wget net send-data guuid=94b6db66-1900-0000-bdef-6a8c2f140000 pid=5167->guuid=7b59820c-1a00-0000-bdef-6a8c68140000 pid=5224 execve guuid=daab1f12-1a00-0000-bdef-6a8c69140000 pid=5225 /usr/bin/curl net send-data write-file guuid=94b6db66-1900-0000-bdef-6a8c2f140000 pid=5167->guuid=daab1f12-1a00-0000-bdef-6a8c69140000 pid=5225 execve guuid=313cd61a-1a00-0000-bdef-6a8c6a140000 pid=5226 /usr/bin/chmod guuid=94b6db66-1900-0000-bdef-6a8c2f140000 pid=5167->guuid=313cd61a-1a00-0000-bdef-6a8c6a140000 pid=5226 execve guuid=0e972d1b-1a00-0000-bdef-6a8c6b140000 pid=5227 /usr/bin/bash guuid=94b6db66-1900-0000-bdef-6a8c2f140000 pid=5167->guuid=0e972d1b-1a00-0000-bdef-6a8c6b140000 pid=5227 clone guuid=a3e8851b-1a00-0000-bdef-6a8c6d140000 pid=5229 /usr/bin/rm delete-file guuid=94b6db66-1900-0000-bdef-6a8c2f140000 pid=5167->guuid=a3e8851b-1a00-0000-bdef-6a8c6d140000 pid=5229 execve guuid=493eef1b-1a00-0000-bdef-6a8c6e140000 pid=5230 /usr/bin/rm guuid=94b6db66-1900-0000-bdef-6a8c2f140000 pid=5167->guuid=493eef1b-1a00-0000-bdef-6a8c6e140000 pid=5230 execve guuid=15a7481c-1a00-0000-bdef-6a8c6f140000 pid=5231 /usr/bin/wget net send-data guuid=94b6db66-1900-0000-bdef-6a8c2f140000 pid=5167->guuid=15a7481c-1a00-0000-bdef-6a8c6f140000 pid=5231 execve guuid=35d8a220-1a00-0000-bdef-6a8c70140000 pid=5232 /usr/bin/curl net send-data write-file guuid=94b6db66-1900-0000-bdef-6a8c2f140000 pid=5167->guuid=35d8a220-1a00-0000-bdef-6a8c70140000 pid=5232 execve guuid=175c4c28-1a00-0000-bdef-6a8c71140000 pid=5233 /usr/bin/chmod guuid=94b6db66-1900-0000-bdef-6a8c2f140000 pid=5167->guuid=175c4c28-1a00-0000-bdef-6a8c71140000 pid=5233 execve guuid=69ebdd28-1a00-0000-bdef-6a8c72140000 pid=5234 /usr/bin/bash guuid=94b6db66-1900-0000-bdef-6a8c2f140000 pid=5167->guuid=69ebdd28-1a00-0000-bdef-6a8c72140000 pid=5234 clone guuid=1c3e5629-1a00-0000-bdef-6a8c74140000 pid=5236 /usr/bin/rm delete-file guuid=94b6db66-1900-0000-bdef-6a8c2f140000 pid=5167->guuid=1c3e5629-1a00-0000-bdef-6a8c74140000 pid=5236 execve guuid=f533a62a-1a00-0000-bdef-6a8c75140000 pid=5237 /usr/bin/rm guuid=94b6db66-1900-0000-bdef-6a8c2f140000 pid=5167->guuid=f533a62a-1a00-0000-bdef-6a8c75140000 pid=5237 execve guuid=7946282b-1a00-0000-bdef-6a8c76140000 pid=5238 /usr/bin/wget net send-data guuid=94b6db66-1900-0000-bdef-6a8c2f140000 pid=5167->guuid=7946282b-1a00-0000-bdef-6a8c76140000 pid=5238 execve guuid=8666142f-1a00-0000-bdef-6a8c77140000 pid=5239 /usr/bin/curl net send-data write-file guuid=94b6db66-1900-0000-bdef-6a8c2f140000 pid=5167->guuid=8666142f-1a00-0000-bdef-6a8c77140000 pid=5239 execve guuid=082ab935-1a00-0000-bdef-6a8c78140000 pid=5240 /usr/bin/chmod guuid=94b6db66-1900-0000-bdef-6a8c2f140000 pid=5167->guuid=082ab935-1a00-0000-bdef-6a8c78140000 pid=5240 execve guuid=9a4c2537-1a00-0000-bdef-6a8c79140000 pid=5241 /usr/bin/bash guuid=94b6db66-1900-0000-bdef-6a8c2f140000 pid=5167->guuid=9a4c2537-1a00-0000-bdef-6a8c79140000 pid=5241 clone guuid=aeb00439-1a00-0000-bdef-6a8c7b140000 pid=5243 /usr/bin/rm delete-file guuid=94b6db66-1900-0000-bdef-6a8c2f140000 pid=5167->guuid=aeb00439-1a00-0000-bdef-6a8c7b140000 pid=5243 execve guuid=7b94a13c-1a00-0000-bdef-6a8c7c140000 pid=5244 /usr/bin/rm guuid=94b6db66-1900-0000-bdef-6a8c2f140000 pid=5167->guuid=7b94a13c-1a00-0000-bdef-6a8c7c140000 pid=5244 execve guuid=875e1b41-1a00-0000-bdef-6a8c7d140000 pid=5245 /usr/bin/wget net send-data guuid=94b6db66-1900-0000-bdef-6a8c2f140000 pid=5167->guuid=875e1b41-1a00-0000-bdef-6a8c7d140000 pid=5245 execve guuid=71fa6749-1a00-0000-bdef-6a8c7e140000 pid=5246 /usr/bin/curl net send-data write-file guuid=94b6db66-1900-0000-bdef-6a8c2f140000 pid=5167->guuid=71fa6749-1a00-0000-bdef-6a8c7e140000 pid=5246 execve guuid=ebee564f-1a00-0000-bdef-6a8c7f140000 pid=5247 /usr/bin/chmod guuid=94b6db66-1900-0000-bdef-6a8c2f140000 pid=5167->guuid=ebee564f-1a00-0000-bdef-6a8c7f140000 pid=5247 execve guuid=4a591150-1a00-0000-bdef-6a8c80140000 pid=5248 /usr/bin/bash guuid=94b6db66-1900-0000-bdef-6a8c2f140000 pid=5167->guuid=4a591150-1a00-0000-bdef-6a8c80140000 pid=5248 clone guuid=db6a7850-1a00-0000-bdef-6a8c82140000 pid=5250 /usr/bin/rm delete-file guuid=94b6db66-1900-0000-bdef-6a8c2f140000 pid=5167->guuid=db6a7850-1a00-0000-bdef-6a8c82140000 pid=5250 execve guuid=ed9bd950-1a00-0000-bdef-6a8c83140000 pid=5251 /usr/bin/rm guuid=94b6db66-1900-0000-bdef-6a8c2f140000 pid=5167->guuid=ed9bd950-1a00-0000-bdef-6a8c83140000 pid=5251 execve guuid=9cad5151-1a00-0000-bdef-6a8c84140000 pid=5252 /usr/bin/wget net send-data guuid=94b6db66-1900-0000-bdef-6a8c2f140000 pid=5167->guuid=9cad5151-1a00-0000-bdef-6a8c84140000 pid=5252 execve guuid=66de0555-1a00-0000-bdef-6a8c85140000 pid=5253 /usr/bin/curl net send-data write-file guuid=94b6db66-1900-0000-bdef-6a8c2f140000 pid=5167->guuid=66de0555-1a00-0000-bdef-6a8c85140000 pid=5253 execve guuid=0e53545a-1a00-0000-bdef-6a8c86140000 pid=5254 /usr/bin/chmod guuid=94b6db66-1900-0000-bdef-6a8c2f140000 pid=5167->guuid=0e53545a-1a00-0000-bdef-6a8c86140000 pid=5254 execve guuid=7020105b-1a00-0000-bdef-6a8c87140000 pid=5255 /usr/bin/bash guuid=94b6db66-1900-0000-bdef-6a8c2f140000 pid=5167->guuid=7020105b-1a00-0000-bdef-6a8c87140000 pid=5255 clone guuid=90a6905b-1a00-0000-bdef-6a8c89140000 pid=5257 /usr/bin/rm delete-file guuid=94b6db66-1900-0000-bdef-6a8c2f140000 pid=5167->guuid=90a6905b-1a00-0000-bdef-6a8c89140000 pid=5257 execve guuid=1a22055c-1a00-0000-bdef-6a8c8a140000 pid=5258 /usr/bin/rm guuid=94b6db66-1900-0000-bdef-6a8c2f140000 pid=5167->guuid=1a22055c-1a00-0000-bdef-6a8c8a140000 pid=5258 execve 9e33e6d7-6ac7-5a65-88f4-941337e56821 5.182.210.61:80 guuid=3ceb6b67-1900-0000-bdef-6a8c30140000 pid=5168->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=c1c5388e-1900-0000-bdef-6a8c31140000 pid=5169->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=9d2c76bf-1900-0000-bdef-6a8c35140000 pid=5173 /usr/bin/bash guuid=11f559bf-1900-0000-bdef-6a8c34140000 pid=5172->guuid=9d2c76bf-1900-0000-bdef-6a8c35140000 pid=5173 clone guuid=7e7053c0-1900-0000-bdef-6a8c3c140000 pid=5180->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=d974c0c3-1900-0000-bdef-6a8c3d140000 pid=5181->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=675ee4c9-1900-0000-bdef-6a8c42140000 pid=5186 /usr/bin/bash guuid=044bb9c9-1900-0000-bdef-6a8c41140000 pid=5185->guuid=675ee4c9-1900-0000-bdef-6a8c42140000 pid=5186 clone guuid=bf531fcb-1900-0000-bdef-6a8c45140000 pid=5189->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=2f3de5cd-1900-0000-bdef-6a8c46140000 pid=5190->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=af9388d2-1900-0000-bdef-6a8c49140000 pid=5193 /usr/bin/bash guuid=7e0464d2-1900-0000-bdef-6a8c48140000 pid=5192->guuid=af9388d2-1900-0000-bdef-6a8c49140000 pid=5193 clone guuid=789cacd3-1900-0000-bdef-6a8c4c140000 pid=5196->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=4824a0d6-1900-0000-bdef-6a8c4d140000 pid=5197->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=dd168cdb-1900-0000-bdef-6a8c50140000 pid=5200 /usr/bin/bash guuid=067365db-1900-0000-bdef-6a8c4f140000 pid=5199->guuid=dd168cdb-1900-0000-bdef-6a8c50140000 pid=5200 clone guuid=b7c6cedc-1900-0000-bdef-6a8c53140000 pid=5203->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=67d8a6df-1900-0000-bdef-6a8c54140000 pid=5204->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=a5792df5-1900-0000-bdef-6a8c57140000 pid=5207 /usr/bin/bash guuid=c54405f5-1900-0000-bdef-6a8c56140000 pid=5206->guuid=a5792df5-1900-0000-bdef-6a8c57140000 pid=5207 clone guuid=cc4d31f6-1900-0000-bdef-6a8c5a140000 pid=5210->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=ce1167f9-1900-0000-bdef-6a8c5b140000 pid=5211->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=b8f2c301-1a00-0000-bdef-6a8c5e140000 pid=5214 /usr/bin/bash guuid=1e5b9c01-1a00-0000-bdef-6a8c5d140000 pid=5213->guuid=b8f2c301-1a00-0000-bdef-6a8c5e140000 pid=5214 clone guuid=760ade02-1a00-0000-bdef-6a8c61140000 pid=5217->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=0ad3f705-1a00-0000-bdef-6a8c62140000 pid=5218->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=9f8b5a0b-1a00-0000-bdef-6a8c65140000 pid=5221 /usr/bin/bash guuid=f5db310b-1a00-0000-bdef-6a8c64140000 pid=5220->guuid=9f8b5a0b-1a00-0000-bdef-6a8c65140000 pid=5221 clone guuid=7b59820c-1a00-0000-bdef-6a8c68140000 pid=5224->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=daab1f12-1a00-0000-bdef-6a8c69140000 pid=5225->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=0b7c4c1b-1a00-0000-bdef-6a8c6c140000 pid=5228 /usr/bin/bash guuid=0e972d1b-1a00-0000-bdef-6a8c6b140000 pid=5227->guuid=0b7c4c1b-1a00-0000-bdef-6a8c6c140000 pid=5228 clone guuid=15a7481c-1a00-0000-bdef-6a8c6f140000 pid=5231->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=35d8a220-1a00-0000-bdef-6a8c70140000 pid=5232->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=9c8c1a29-1a00-0000-bdef-6a8c73140000 pid=5235 /usr/bin/bash guuid=69ebdd28-1a00-0000-bdef-6a8c72140000 pid=5234->guuid=9c8c1a29-1a00-0000-bdef-6a8c73140000 pid=5235 clone guuid=7946282b-1a00-0000-bdef-6a8c76140000 pid=5238->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=8666142f-1a00-0000-bdef-6a8c77140000 pid=5239->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=3b298a37-1a00-0000-bdef-6a8c7a140000 pid=5242 /usr/bin/bash guuid=9a4c2537-1a00-0000-bdef-6a8c79140000 pid=5241->guuid=3b298a37-1a00-0000-bdef-6a8c7a140000 pid=5242 clone guuid=875e1b41-1a00-0000-bdef-6a8c7d140000 pid=5245->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=71fa6749-1a00-0000-bdef-6a8c7e140000 pid=5246->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=c6163750-1a00-0000-bdef-6a8c81140000 pid=5249 /usr/bin/bash guuid=4a591150-1a00-0000-bdef-6a8c80140000 pid=5248->guuid=c6163750-1a00-0000-bdef-6a8c81140000 pid=5249 clone guuid=9cad5151-1a00-0000-bdef-6a8c84140000 pid=5252->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=66de0555-1a00-0000-bdef-6a8c85140000 pid=5253->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=7e6a625b-1a00-0000-bdef-6a8c88140000 pid=5256 /usr/bin/bash guuid=7020105b-1a00-0000-bdef-6a8c87140000 pid=5255->guuid=7e6a625b-1a00-0000-bdef-6a8c88140000 pid=5256 clone
Score:
99%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/be112a1b5c18eac836e6d5555587ca2e47025a9e586268e728c01208c2a60263
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/be112a1b5c18eac836e6d5555587ca2e47025a9e586268e728c01208c2a60263/
Verdict:
Malicious
Threat:
Trojan-Downloader.Shell.Agent
Link:
https://tip.neiki.dev/file/be112a1b5c18eac836e6d5555587ca2e47025a9e586268e728c01208c2a60263
Threat name:
Linux.Trojan.Vigorf
Create hunting rule
Status:
Malicious
First seen:
2026-06-22 08:57:35 UTC
File Type:
Text (Shell)
AV detection:
18 of 38 (47.37%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=xyisug24ddvmqnxg2vkvlb6kfzdqewu6lbrgrzziyajarqvgajrq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260622-ks16tsaw3j/
Behaviour
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.11
Link:
https://yomi.yoroi.company/submissions/be112a1b5c18eac836e6d5555587ca2e47025a9e586268e728c01208c2a60263

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh be112a1b5c18eac836e6d5555587ca2e47025a9e586268e728c01208c2a60263

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3864548/
  
Delivery method
Distributed via web download

Comments