MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d10d99165795d12d8cc58f794453a61e938e8a42aeca1e2cbae74014a6148a01. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d10d99165795d12d8cc58f794453a61e938e8a42aeca1e2cbae74014a6148a01
SHA3-384 hash: b20745c79b571342c94d437dc5ecc43c47ae4198549d5eec8987145d2e123b8b0b0ee368f45e14762c15851068be999f
SHA1 hash: 2b27b9a1d0e0a1bef02b215b160c480c90cf21d0
MD5 hash: 41e3c0d47e727a1bb4e582194bff91e0
humanhash: july-bacon-march-december
File name:ok
Download: download sample
File size:1'644 bytes
First seen:2026-06-17 15:50:48 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 12:U3Ni63NalRd5pEv6P9p9Ww67O0+76hQHpb4aHCr6aHHsnT1wgx6g5Gs1GMGi6MGl:knQpOnQ5qs/xGuG1+e4/56TvKd96x
TLSH T14D31839FD4001A761702DACE73763548B20C82EB285FE7E0DD494E7D92589C9B106FC6
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://5.182.210.61/a38664n/an/aelf ua-wget
http://5.182.210.61/b6dc28n/an/aelf ua-wget
http://5.182.210.61/792899n/an/aelf ua-wget
http://5.182.210.61/81d124n/an/aelf ua-wget
http://5.182.210.61/a06bbbn/an/aelf ua-wget
http://5.182.210.61/3355b8n/an/aelf ua-wget
http://5.182.210.61/9c64fbn/an/aelf ua-wget
http://5.182.210.61/ca36acn/an/aelf ua-wget
http://5.182.210.61/571a19n/an/aelf ua-wget
http://5.182.210.61/0fea12n/an/aelf ua-wget
http://5.182.210.61/4df5fen/an/aelf ua-wget
http://5.182.210.61/873a79n/an/aelf ua-wget

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive
Link:
https://www.filescan.io/uploads/6a32c26490632a45f7262af3/reports/ab5a5d33-db93-43e4-9b6b-1bd909e542bd/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-06-17T12:58:00Z UTC
Last seen:
2026-06-18T18:08:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan-Downloader.Shell.Agent.a
Link:
https://opentip.kaspersky.com/d10d99165795d12d8cc58f794453a61e938e8a42aeca1e2cbae74014a6148a01/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/43ca9cca-c860-465f-b725-c2dd54fd5a87
Behavior Graph:
Download SVG
%3 guuid=f0b79548-1900-0000-f7b6-c7ef2d140000 pid=5165 /usr/bin/sudo guuid=da97214b-1900-0000-f7b6-c7ef2e140000 pid=5166 /tmp/sample.bin guuid=f0b79548-1900-0000-f7b6-c7ef2d140000 pid=5165->guuid=da97214b-1900-0000-f7b6-c7ef2e140000 pid=5166 execve guuid=27e1d64b-1900-0000-f7b6-c7ef2f140000 pid=5167 /usr/bin/wget net send-data guuid=da97214b-1900-0000-f7b6-c7ef2e140000 pid=5166->guuid=27e1d64b-1900-0000-f7b6-c7ef2f140000 pid=5167 execve guuid=eaf32751-1900-0000-f7b6-c7ef30140000 pid=5168 /usr/bin/curl net send-data write-file guuid=da97214b-1900-0000-f7b6-c7ef2e140000 pid=5166->guuid=eaf32751-1900-0000-f7b6-c7ef30140000 pid=5168 execve guuid=5bb2265a-1900-0000-f7b6-c7ef31140000 pid=5169 /usr/bin/chmod guuid=da97214b-1900-0000-f7b6-c7ef2e140000 pid=5166->guuid=5bb2265a-1900-0000-f7b6-c7ef31140000 pid=5169 execve guuid=08d3715a-1900-0000-f7b6-c7ef32140000 pid=5170 /usr/bin/bash guuid=da97214b-1900-0000-f7b6-c7ef2e140000 pid=5166->guuid=08d3715a-1900-0000-f7b6-c7ef32140000 pid=5170 clone guuid=6cf2d85a-1900-0000-f7b6-c7ef34140000 pid=5172 /usr/bin/rm delete-file guuid=da97214b-1900-0000-f7b6-c7ef2e140000 pid=5166->guuid=6cf2d85a-1900-0000-f7b6-c7ef34140000 pid=5172 execve guuid=8dec255b-1900-0000-f7b6-c7ef35140000 pid=5173 /usr/bin/rm guuid=da97214b-1900-0000-f7b6-c7ef2e140000 pid=5166->guuid=8dec255b-1900-0000-f7b6-c7ef35140000 pid=5173 execve guuid=03736b5b-1900-0000-f7b6-c7ef36140000 pid=5174 /usr/bin/wget net send-data guuid=da97214b-1900-0000-f7b6-c7ef2e140000 pid=5166->guuid=03736b5b-1900-0000-f7b6-c7ef36140000 pid=5174 execve guuid=152bfc5d-1900-0000-f7b6-c7ef37140000 pid=5175 /usr/bin/curl net send-data write-file guuid=da97214b-1900-0000-f7b6-c7ef2e140000 pid=5166->guuid=152bfc5d-1900-0000-f7b6-c7ef37140000 pid=5175 execve guuid=6f3df261-1900-0000-f7b6-c7ef38140000 pid=5176 /usr/bin/chmod guuid=da97214b-1900-0000-f7b6-c7ef2e140000 pid=5166->guuid=6f3df261-1900-0000-f7b6-c7ef38140000 pid=5176 execve guuid=44d29662-1900-0000-f7b6-c7ef39140000 pid=5177 /usr/bin/bash guuid=da97214b-1900-0000-f7b6-c7ef2e140000 pid=5166->guuid=44d29662-1900-0000-f7b6-c7ef39140000 pid=5177 clone guuid=d553f962-1900-0000-f7b6-c7ef3b140000 pid=5179 /usr/bin/rm delete-file guuid=da97214b-1900-0000-f7b6-c7ef2e140000 pid=5166->guuid=d553f962-1900-0000-f7b6-c7ef3b140000 pid=5179 execve guuid=1e9c7263-1900-0000-f7b6-c7ef3c140000 pid=5180 /usr/bin/rm guuid=da97214b-1900-0000-f7b6-c7ef2e140000 pid=5166->guuid=1e9c7263-1900-0000-f7b6-c7ef3c140000 pid=5180 execve guuid=22cfe663-1900-0000-f7b6-c7ef3d140000 pid=5181 /usr/bin/wget net send-data guuid=da97214b-1900-0000-f7b6-c7ef2e140000 pid=5166->guuid=22cfe663-1900-0000-f7b6-c7ef3d140000 pid=5181 execve guuid=c8eedb66-1900-0000-f7b6-c7ef3e140000 pid=5182 /usr/bin/curl net send-data write-file guuid=da97214b-1900-0000-f7b6-c7ef2e140000 pid=5166->guuid=c8eedb66-1900-0000-f7b6-c7ef3e140000 pid=5182 execve guuid=111fa86d-1900-0000-f7b6-c7ef3f140000 pid=5183 /usr/bin/chmod guuid=da97214b-1900-0000-f7b6-c7ef2e140000 pid=5166->guuid=111fa86d-1900-0000-f7b6-c7ef3f140000 pid=5183 execve guuid=70f3596e-1900-0000-f7b6-c7ef40140000 pid=5184 /usr/bin/bash guuid=da97214b-1900-0000-f7b6-c7ef2e140000 pid=5166->guuid=70f3596e-1900-0000-f7b6-c7ef40140000 pid=5184 clone guuid=2b11c66e-1900-0000-f7b6-c7ef42140000 pid=5186 /usr/bin/rm delete-file guuid=da97214b-1900-0000-f7b6-c7ef2e140000 pid=5166->guuid=2b11c66e-1900-0000-f7b6-c7ef42140000 pid=5186 execve guuid=427d596f-1900-0000-f7b6-c7ef43140000 pid=5187 /usr/bin/rm guuid=da97214b-1900-0000-f7b6-c7ef2e140000 pid=5166->guuid=427d596f-1900-0000-f7b6-c7ef43140000 pid=5187 execve guuid=1dc4c06f-1900-0000-f7b6-c7ef44140000 pid=5188 /usr/bin/wget net send-data guuid=da97214b-1900-0000-f7b6-c7ef2e140000 pid=5166->guuid=1dc4c06f-1900-0000-f7b6-c7ef44140000 pid=5188 execve guuid=941c2873-1900-0000-f7b6-c7ef45140000 pid=5189 /usr/bin/curl net send-data write-file guuid=da97214b-1900-0000-f7b6-c7ef2e140000 pid=5166->guuid=941c2873-1900-0000-f7b6-c7ef45140000 pid=5189 execve guuid=4cbbcf78-1900-0000-f7b6-c7ef46140000 pid=5190 /usr/bin/chmod guuid=da97214b-1900-0000-f7b6-c7ef2e140000 pid=5166->guuid=4cbbcf78-1900-0000-f7b6-c7ef46140000 pid=5190 execve guuid=0ffc3379-1900-0000-f7b6-c7ef47140000 pid=5191 /usr/bin/bash guuid=da97214b-1900-0000-f7b6-c7ef2e140000 pid=5166->guuid=0ffc3379-1900-0000-f7b6-c7ef47140000 pid=5191 clone guuid=a98aac79-1900-0000-f7b6-c7ef49140000 pid=5193 /usr/bin/rm delete-file guuid=da97214b-1900-0000-f7b6-c7ef2e140000 pid=5166->guuid=a98aac79-1900-0000-f7b6-c7ef49140000 pid=5193 execve guuid=47fe1c7a-1900-0000-f7b6-c7ef4a140000 pid=5194 /usr/bin/rm guuid=da97214b-1900-0000-f7b6-c7ef2e140000 pid=5166->guuid=47fe1c7a-1900-0000-f7b6-c7ef4a140000 pid=5194 execve guuid=5bf2827a-1900-0000-f7b6-c7ef4b140000 pid=5195 /usr/bin/wget net send-data guuid=da97214b-1900-0000-f7b6-c7ef2e140000 pid=5166->guuid=5bf2827a-1900-0000-f7b6-c7ef4b140000 pid=5195 execve guuid=21a1b17d-1900-0000-f7b6-c7ef4c140000 pid=5196 /usr/bin/curl net send-data write-file guuid=da97214b-1900-0000-f7b6-c7ef2e140000 pid=5166->guuid=21a1b17d-1900-0000-f7b6-c7ef4c140000 pid=5196 execve guuid=0c332d84-1900-0000-f7b6-c7ef4d140000 pid=5197 /usr/bin/chmod guuid=da97214b-1900-0000-f7b6-c7ef2e140000 pid=5166->guuid=0c332d84-1900-0000-f7b6-c7ef4d140000 pid=5197 execve guuid=96298b84-1900-0000-f7b6-c7ef4e140000 pid=5198 /usr/bin/bash guuid=da97214b-1900-0000-f7b6-c7ef2e140000 pid=5166->guuid=96298b84-1900-0000-f7b6-c7ef4e140000 pid=5198 clone guuid=030de084-1900-0000-f7b6-c7ef50140000 pid=5200 /usr/bin/rm delete-file guuid=da97214b-1900-0000-f7b6-c7ef2e140000 pid=5166->guuid=030de084-1900-0000-f7b6-c7ef50140000 pid=5200 execve guuid=34684b85-1900-0000-f7b6-c7ef51140000 pid=5201 /usr/bin/rm guuid=da97214b-1900-0000-f7b6-c7ef2e140000 pid=5166->guuid=34684b85-1900-0000-f7b6-c7ef51140000 pid=5201 execve guuid=3b71aa85-1900-0000-f7b6-c7ef52140000 pid=5202 /usr/bin/wget net send-data guuid=da97214b-1900-0000-f7b6-c7ef2e140000 pid=5166->guuid=3b71aa85-1900-0000-f7b6-c7ef52140000 pid=5202 execve guuid=610d4089-1900-0000-f7b6-c7ef53140000 pid=5203 /usr/bin/curl net send-data write-file guuid=da97214b-1900-0000-f7b6-c7ef2e140000 pid=5166->guuid=610d4089-1900-0000-f7b6-c7ef53140000 pid=5203 execve guuid=0d7aa08f-1900-0000-f7b6-c7ef54140000 pid=5204 /usr/bin/chmod guuid=da97214b-1900-0000-f7b6-c7ef2e140000 pid=5166->guuid=0d7aa08f-1900-0000-f7b6-c7ef54140000 pid=5204 execve guuid=92610990-1900-0000-f7b6-c7ef55140000 pid=5205 /usr/bin/bash guuid=da97214b-1900-0000-f7b6-c7ef2e140000 pid=5166->guuid=92610990-1900-0000-f7b6-c7ef55140000 pid=5205 clone guuid=2ba66090-1900-0000-f7b6-c7ef57140000 pid=5207 /usr/bin/rm delete-file guuid=da97214b-1900-0000-f7b6-c7ef2e140000 pid=5166->guuid=2ba66090-1900-0000-f7b6-c7ef57140000 pid=5207 execve guuid=0dc9b990-1900-0000-f7b6-c7ef58140000 pid=5208 /usr/bin/rm guuid=da97214b-1900-0000-f7b6-c7ef2e140000 pid=5166->guuid=0dc9b990-1900-0000-f7b6-c7ef58140000 pid=5208 execve guuid=099c0f91-1900-0000-f7b6-c7ef59140000 pid=5209 /usr/bin/wget net send-data guuid=da97214b-1900-0000-f7b6-c7ef2e140000 pid=5166->guuid=099c0f91-1900-0000-f7b6-c7ef59140000 pid=5209 execve guuid=641d0a94-1900-0000-f7b6-c7ef5a140000 pid=5210 /usr/bin/curl net send-data write-file guuid=da97214b-1900-0000-f7b6-c7ef2e140000 pid=5166->guuid=641d0a94-1900-0000-f7b6-c7ef5a140000 pid=5210 execve guuid=ba9fb497-1900-0000-f7b6-c7ef5b140000 pid=5211 /usr/bin/chmod guuid=da97214b-1900-0000-f7b6-c7ef2e140000 pid=5166->guuid=ba9fb497-1900-0000-f7b6-c7ef5b140000 pid=5211 execve guuid=add2f997-1900-0000-f7b6-c7ef5c140000 pid=5212 /usr/bin/bash guuid=da97214b-1900-0000-f7b6-c7ef2e140000 pid=5166->guuid=add2f997-1900-0000-f7b6-c7ef5c140000 pid=5212 clone guuid=a7963498-1900-0000-f7b6-c7ef5e140000 pid=5214 /usr/bin/rm delete-file guuid=da97214b-1900-0000-f7b6-c7ef2e140000 pid=5166->guuid=a7963498-1900-0000-f7b6-c7ef5e140000 pid=5214 execve guuid=b5688e98-1900-0000-f7b6-c7ef5f140000 pid=5215 /usr/bin/rm guuid=da97214b-1900-0000-f7b6-c7ef2e140000 pid=5166->guuid=b5688e98-1900-0000-f7b6-c7ef5f140000 pid=5215 execve guuid=8c49e498-1900-0000-f7b6-c7ef60140000 pid=5216 /usr/bin/wget net send-data guuid=da97214b-1900-0000-f7b6-c7ef2e140000 pid=5166->guuid=8c49e498-1900-0000-f7b6-c7ef60140000 pid=5216 execve guuid=d129d49b-1900-0000-f7b6-c7ef61140000 pid=5217 /usr/bin/curl net send-data write-file guuid=da97214b-1900-0000-f7b6-c7ef2e140000 pid=5166->guuid=d129d49b-1900-0000-f7b6-c7ef61140000 pid=5217 execve guuid=679243a0-1900-0000-f7b6-c7ef62140000 pid=5218 /usr/bin/chmod guuid=da97214b-1900-0000-f7b6-c7ef2e140000 pid=5166->guuid=679243a0-1900-0000-f7b6-c7ef62140000 pid=5218 execve guuid=1e8ac6a0-1900-0000-f7b6-c7ef63140000 pid=5219 /usr/bin/bash guuid=da97214b-1900-0000-f7b6-c7ef2e140000 pid=5166->guuid=1e8ac6a0-1900-0000-f7b6-c7ef63140000 pid=5219 clone guuid=27cc3da1-1900-0000-f7b6-c7ef65140000 pid=5221 /usr/bin/rm delete-file guuid=da97214b-1900-0000-f7b6-c7ef2e140000 pid=5166->guuid=27cc3da1-1900-0000-f7b6-c7ef65140000 pid=5221 execve guuid=5bbdbda1-1900-0000-f7b6-c7ef66140000 pid=5222 /usr/bin/rm guuid=da97214b-1900-0000-f7b6-c7ef2e140000 pid=5166->guuid=5bbdbda1-1900-0000-f7b6-c7ef66140000 pid=5222 execve guuid=d5d01aa2-1900-0000-f7b6-c7ef67140000 pid=5223 /usr/bin/wget net send-data guuid=da97214b-1900-0000-f7b6-c7ef2e140000 pid=5166->guuid=d5d01aa2-1900-0000-f7b6-c7ef67140000 pid=5223 execve guuid=f2e285a5-1900-0000-f7b6-c7ef68140000 pid=5224 /usr/bin/curl net send-data write-file guuid=da97214b-1900-0000-f7b6-c7ef2e140000 pid=5166->guuid=f2e285a5-1900-0000-f7b6-c7ef68140000 pid=5224 execve guuid=20ae4aa9-1900-0000-f7b6-c7ef69140000 pid=5225 /usr/bin/chmod guuid=da97214b-1900-0000-f7b6-c7ef2e140000 pid=5166->guuid=20ae4aa9-1900-0000-f7b6-c7ef69140000 pid=5225 execve guuid=d30c9fa9-1900-0000-f7b6-c7ef6a140000 pid=5226 /usr/bin/bash guuid=da97214b-1900-0000-f7b6-c7ef2e140000 pid=5166->guuid=d30c9fa9-1900-0000-f7b6-c7ef6a140000 pid=5226 clone guuid=df2e06aa-1900-0000-f7b6-c7ef6c140000 pid=5228 /usr/bin/rm delete-file guuid=da97214b-1900-0000-f7b6-c7ef2e140000 pid=5166->guuid=df2e06aa-1900-0000-f7b6-c7ef6c140000 pid=5228 execve guuid=9d8c5baa-1900-0000-f7b6-c7ef6d140000 pid=5229 /usr/bin/rm guuid=da97214b-1900-0000-f7b6-c7ef2e140000 pid=5166->guuid=9d8c5baa-1900-0000-f7b6-c7ef6d140000 pid=5229 execve guuid=db6daeaa-1900-0000-f7b6-c7ef6e140000 pid=5230 /usr/bin/wget net send-data guuid=da97214b-1900-0000-f7b6-c7ef2e140000 pid=5166->guuid=db6daeaa-1900-0000-f7b6-c7ef6e140000 pid=5230 execve guuid=ed6b61ad-1900-0000-f7b6-c7ef6f140000 pid=5231 /usr/bin/curl net send-data write-file guuid=da97214b-1900-0000-f7b6-c7ef2e140000 pid=5166->guuid=ed6b61ad-1900-0000-f7b6-c7ef6f140000 pid=5231 execve guuid=5f36ffb0-1900-0000-f7b6-c7ef70140000 pid=5232 /usr/bin/chmod guuid=da97214b-1900-0000-f7b6-c7ef2e140000 pid=5166->guuid=5f36ffb0-1900-0000-f7b6-c7ef70140000 pid=5232 execve guuid=3bd155b1-1900-0000-f7b6-c7ef71140000 pid=5233 /usr/bin/bash guuid=da97214b-1900-0000-f7b6-c7ef2e140000 pid=5166->guuid=3bd155b1-1900-0000-f7b6-c7ef71140000 pid=5233 clone guuid=9913acb1-1900-0000-f7b6-c7ef73140000 pid=5235 /usr/bin/rm delete-file guuid=da97214b-1900-0000-f7b6-c7ef2e140000 pid=5166->guuid=9913acb1-1900-0000-f7b6-c7ef73140000 pid=5235 execve guuid=22ccfdb1-1900-0000-f7b6-c7ef74140000 pid=5236 /usr/bin/rm guuid=da97214b-1900-0000-f7b6-c7ef2e140000 pid=5166->guuid=22ccfdb1-1900-0000-f7b6-c7ef74140000 pid=5236 execve guuid=103269b2-1900-0000-f7b6-c7ef76140000 pid=5238 /usr/bin/wget net send-data guuid=da97214b-1900-0000-f7b6-c7ef2e140000 pid=5166->guuid=103269b2-1900-0000-f7b6-c7ef76140000 pid=5238 execve guuid=4ee6a4b6-1900-0000-f7b6-c7ef79140000 pid=5241 /usr/bin/curl net send-data write-file guuid=da97214b-1900-0000-f7b6-c7ef2e140000 pid=5166->guuid=4ee6a4b6-1900-0000-f7b6-c7ef79140000 pid=5241 execve guuid=7641dbbc-1900-0000-f7b6-c7ef7e140000 pid=5246 /usr/bin/chmod guuid=da97214b-1900-0000-f7b6-c7ef2e140000 pid=5166->guuid=7641dbbc-1900-0000-f7b6-c7ef7e140000 pid=5246 execve guuid=cc283ebd-1900-0000-f7b6-c7ef7f140000 pid=5247 /usr/bin/bash guuid=da97214b-1900-0000-f7b6-c7ef2e140000 pid=5166->guuid=cc283ebd-1900-0000-f7b6-c7ef7f140000 pid=5247 clone guuid=5521d1bd-1900-0000-f7b6-c7ef81140000 pid=5249 /usr/bin/rm delete-file guuid=da97214b-1900-0000-f7b6-c7ef2e140000 pid=5166->guuid=5521d1bd-1900-0000-f7b6-c7ef81140000 pid=5249 execve guuid=44742dbe-1900-0000-f7b6-c7ef82140000 pid=5250 /usr/bin/rm guuid=da97214b-1900-0000-f7b6-c7ef2e140000 pid=5166->guuid=44742dbe-1900-0000-f7b6-c7ef82140000 pid=5250 execve guuid=47eab4be-1900-0000-f7b6-c7ef83140000 pid=5251 /usr/bin/wget net send-data guuid=da97214b-1900-0000-f7b6-c7ef2e140000 pid=5166->guuid=47eab4be-1900-0000-f7b6-c7ef83140000 pid=5251 execve guuid=23e6d5c2-1900-0000-f7b6-c7ef84140000 pid=5252 /usr/bin/curl net send-data write-file guuid=da97214b-1900-0000-f7b6-c7ef2e140000 pid=5166->guuid=23e6d5c2-1900-0000-f7b6-c7ef84140000 pid=5252 execve guuid=c98dc3c8-1900-0000-f7b6-c7ef85140000 pid=5253 /usr/bin/chmod guuid=da97214b-1900-0000-f7b6-c7ef2e140000 pid=5166->guuid=c98dc3c8-1900-0000-f7b6-c7ef85140000 pid=5253 execve guuid=6b7832c9-1900-0000-f7b6-c7ef86140000 pid=5254 /usr/bin/bash guuid=da97214b-1900-0000-f7b6-c7ef2e140000 pid=5166->guuid=6b7832c9-1900-0000-f7b6-c7ef86140000 pid=5254 clone guuid=96a6dcc9-1900-0000-f7b6-c7ef88140000 pid=5256 /usr/bin/rm delete-file guuid=da97214b-1900-0000-f7b6-c7ef2e140000 pid=5166->guuid=96a6dcc9-1900-0000-f7b6-c7ef88140000 pid=5256 execve guuid=201051ca-1900-0000-f7b6-c7ef89140000 pid=5257 /usr/bin/rm guuid=da97214b-1900-0000-f7b6-c7ef2e140000 pid=5166->guuid=201051ca-1900-0000-f7b6-c7ef89140000 pid=5257 execve 9e33e6d7-6ac7-5a65-88f4-941337e56821 5.182.210.61:80 guuid=27e1d64b-1900-0000-f7b6-c7ef2f140000 pid=5167->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=eaf32751-1900-0000-f7b6-c7ef30140000 pid=5168->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=d18f8f5a-1900-0000-f7b6-c7ef33140000 pid=5171 /usr/bin/bash guuid=08d3715a-1900-0000-f7b6-c7ef32140000 pid=5170->guuid=d18f8f5a-1900-0000-f7b6-c7ef33140000 pid=5171 clone guuid=03736b5b-1900-0000-f7b6-c7ef36140000 pid=5174->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=152bfc5d-1900-0000-f7b6-c7ef37140000 pid=5175->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=4f72c062-1900-0000-f7b6-c7ef3a140000 pid=5178 /usr/bin/bash guuid=44d29662-1900-0000-f7b6-c7ef39140000 pid=5177->guuid=4f72c062-1900-0000-f7b6-c7ef3a140000 pid=5178 clone guuid=22cfe663-1900-0000-f7b6-c7ef3d140000 pid=5181->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=c8eedb66-1900-0000-f7b6-c7ef3e140000 pid=5182->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=0f01786e-1900-0000-f7b6-c7ef41140000 pid=5185 /usr/bin/bash guuid=70f3596e-1900-0000-f7b6-c7ef40140000 pid=5184->guuid=0f01786e-1900-0000-f7b6-c7ef41140000 pid=5185 clone guuid=1dc4c06f-1900-0000-f7b6-c7ef44140000 pid=5188->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=941c2873-1900-0000-f7b6-c7ef45140000 pid=5189->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=39e95879-1900-0000-f7b6-c7ef48140000 pid=5192 /usr/bin/bash guuid=0ffc3379-1900-0000-f7b6-c7ef47140000 pid=5191->guuid=39e95879-1900-0000-f7b6-c7ef48140000 pid=5192 clone guuid=5bf2827a-1900-0000-f7b6-c7ef4b140000 pid=5195->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=21a1b17d-1900-0000-f7b6-c7ef4c140000 pid=5196->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=1420a884-1900-0000-f7b6-c7ef4f140000 pid=5199 /usr/bin/bash guuid=96298b84-1900-0000-f7b6-c7ef4e140000 pid=5198->guuid=1420a884-1900-0000-f7b6-c7ef4f140000 pid=5199 clone guuid=3b71aa85-1900-0000-f7b6-c7ef52140000 pid=5202->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=610d4089-1900-0000-f7b6-c7ef53140000 pid=5203->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=e7983090-1900-0000-f7b6-c7ef56140000 pid=5206 /usr/bin/bash guuid=92610990-1900-0000-f7b6-c7ef55140000 pid=5205->guuid=e7983090-1900-0000-f7b6-c7ef56140000 pid=5206 clone guuid=099c0f91-1900-0000-f7b6-c7ef59140000 pid=5209->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=641d0a94-1900-0000-f7b6-c7ef5a140000 pid=5210->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=84481198-1900-0000-f7b6-c7ef5d140000 pid=5213 /usr/bin/bash guuid=add2f997-1900-0000-f7b6-c7ef5c140000 pid=5212->guuid=84481198-1900-0000-f7b6-c7ef5d140000 pid=5213 clone guuid=8c49e498-1900-0000-f7b6-c7ef60140000 pid=5216->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=d129d49b-1900-0000-f7b6-c7ef61140000 pid=5217->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=eb2906a1-1900-0000-f7b6-c7ef64140000 pid=5220 /usr/bin/bash guuid=1e8ac6a0-1900-0000-f7b6-c7ef63140000 pid=5219->guuid=eb2906a1-1900-0000-f7b6-c7ef64140000 pid=5220 clone guuid=d5d01aa2-1900-0000-f7b6-c7ef67140000 pid=5223->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=f2e285a5-1900-0000-f7b6-c7ef68140000 pid=5224->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=c80fbea9-1900-0000-f7b6-c7ef6b140000 pid=5227 /usr/bin/bash guuid=d30c9fa9-1900-0000-f7b6-c7ef6a140000 pid=5226->guuid=c80fbea9-1900-0000-f7b6-c7ef6b140000 pid=5227 clone guuid=db6daeaa-1900-0000-f7b6-c7ef6e140000 pid=5230->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=ed6b61ad-1900-0000-f7b6-c7ef6f140000 pid=5231->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=308271b1-1900-0000-f7b6-c7ef72140000 pid=5234 /usr/bin/bash guuid=3bd155b1-1900-0000-f7b6-c7ef71140000 pid=5233->guuid=308271b1-1900-0000-f7b6-c7ef72140000 pid=5234 clone guuid=103269b2-1900-0000-f7b6-c7ef76140000 pid=5238->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=4ee6a4b6-1900-0000-f7b6-c7ef79140000 pid=5241->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=d2625fbd-1900-0000-f7b6-c7ef80140000 pid=5248 /usr/bin/bash guuid=cc283ebd-1900-0000-f7b6-c7ef7f140000 pid=5247->guuid=d2625fbd-1900-0000-f7b6-c7ef80140000 pid=5248 clone guuid=47eab4be-1900-0000-f7b6-c7ef83140000 pid=5251->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 133B guuid=23e6d5c2-1900-0000-f7b6-c7ef84140000 pid=5252->9e33e6d7-6ac7-5a65-88f4-941337e56821 send: 82B guuid=44075cc9-1900-0000-f7b6-c7ef87140000 pid=5255 /usr/bin/bash guuid=6b7832c9-1900-0000-f7b6-c7ef86140000 pid=5254->guuid=44075cc9-1900-0000-f7b6-c7ef87140000 pid=5255 clone
Score:
100%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/d10d99165795d12d8cc58f794453a61e938e8a42aeca1e2cbae74014a6148a01
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d10d99165795d12d8cc58f794453a61e938e8a42aeca1e2cbae74014a6148a01/
Verdict:
Malicious
Threat:
Trojan-Downloader.Shell.Agent
Link:
https://tip.neiki.dev/file/d10d99165795d12d8cc58f794453a61e938e8a42aeca1e2cbae74014a6148a01
Threat name:
Linux.Trojan.Vigorf
Create hunting rule
Status:
Malicious
First seen:
2026-06-17 15:51:51 UTC
File Type:
Text (Shell)
AV detection:
14 of 24 (58.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2egzsfsxsxis3dgfr54uiu5gd2jy5cscv3fb4lf245abjjquriaq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260617-tag5nsdt9x/
Behaviour
Reads runtime system information
Writes file to tmp directory
Checks CPU configuration
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.11
Link:
https://yomi.yoroi.company/submissions/d10d99165795d12d8cc58f794453a61e938e8a42aeca1e2cbae74014a6148a01

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh d10d99165795d12d8cc58f794453a61e938e8a42aeca1e2cbae74014a6148a01

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3864548/
  
Delivery method
Distributed via web download

Comments