MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 da4dab73dc3dcbf801fa468bd741319ddf7879c642570dbe9aff7ef08131c6d6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: da4dab73dc3dcbf801fa468bd741319ddf7879c642570dbe9aff7ef08131c6d6
SHA3-384 hash: 0bc3183141e7e35cb2230ac18fd089fde9eeabb3d6c6a231b134e7f4d3df5e4b0daac6dd2bb687134908478ceb5d6f4c
SHA1 hash: 81e32edf11460216e9986c431df972493e8e1426
MD5 hash: b84a6cd97bb2d947c9777e434b7cc2df
humanhash: nitrogen-aspen-sad-football
File name:p
Download: download sample
File size:834 bytes
First seen:2026-06-04 02:08:44 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 24:kXCKysE2hi0ziQvZohas8Lh8vMJmFdWN7:e9Qp+Mss8LKv3FdWN7
TLSH T1DF01AFDA8002DB6041D6E86D72DB92A07820C3CB59418FE87FDC043D9BA97097056F95
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://188.132.232.81/OKFHn/an/aelf ua-wget
http://188.132.232.81/qcUn/an/aelf ua-wget
http://188.132.232.81/eWan/an/aelf ua-wget
http://188.132.232.81/pxEun/an/aelf ua-wget
http://188.132.232.81/8g7Kn/an/aelf ua-wget

Intelligence

File Origin
# of uploads :
1
# of downloads :
81
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive
Link:
https://www.filescan.io/uploads/6a20de574bb6e36d180ab359/reports/bf330660-8484-436f-a2b9-760c35f73447/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-06-03T23:36:00Z UTC
Last seen:
2026-06-05T22:53:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan-Downloader.Shell.Agent.a
Link:
https://opentip.kaspersky.com/da4dab73dc3dcbf801fa468bd741319ddf7879c642570dbe9aff7ef08131c6d6/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/0404fd6e-8aec-4b6e-9b37-0ee1d92d5293
Behavior Graph:
Download SVG
%3 guuid=d5da3be7-1600-0000-80cb-91cba40d0000 pid=3492 /usr/bin/sudo guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499 /tmp/sample.bin write-file guuid=d5da3be7-1600-0000-80cb-91cba40d0000 pid=3492->guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499 execve guuid=90de3be9-1600-0000-80cb-91cbac0d0000 pid=3500 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=90de3be9-1600-0000-80cb-91cbac0d0000 pid=3500 execve guuid=659d28ea-1600-0000-80cb-91cbae0d0000 pid=3502 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=659d28ea-1600-0000-80cb-91cbae0d0000 pid=3502 execve guuid=21919dea-1600-0000-80cb-91cbaf0d0000 pid=3503 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=21919dea-1600-0000-80cb-91cbaf0d0000 pid=3503 execve guuid=ed9507eb-1600-0000-80cb-91cbb10d0000 pid=3505 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=ed9507eb-1600-0000-80cb-91cbb10d0000 pid=3505 execve guuid=93466feb-1600-0000-80cb-91cbb30d0000 pid=3507 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=93466feb-1600-0000-80cb-91cbb30d0000 pid=3507 execve guuid=6ef705ec-1600-0000-80cb-91cbb60d0000 pid=3510 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=6ef705ec-1600-0000-80cb-91cbb60d0000 pid=3510 execve guuid=f0e262ec-1600-0000-80cb-91cbb90d0000 pid=3513 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=f0e262ec-1600-0000-80cb-91cbb90d0000 pid=3513 execve guuid=ac9dc9ec-1600-0000-80cb-91cbba0d0000 pid=3514 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=ac9dc9ec-1600-0000-80cb-91cbba0d0000 pid=3514 execve guuid=2e9745ed-1600-0000-80cb-91cbbb0d0000 pid=3515 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=2e9745ed-1600-0000-80cb-91cbbb0d0000 pid=3515 execve guuid=565120ee-1600-0000-80cb-91cbbc0d0000 pid=3516 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=565120ee-1600-0000-80cb-91cbbc0d0000 pid=3516 execve guuid=7eb7b7ee-1600-0000-80cb-91cbbd0d0000 pid=3517 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=7eb7b7ee-1600-0000-80cb-91cbbd0d0000 pid=3517 execve guuid=a72833ef-1600-0000-80cb-91cbbe0d0000 pid=3518 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=a72833ef-1600-0000-80cb-91cbbe0d0000 pid=3518 execve guuid=4d0da7ef-1600-0000-80cb-91cbc00d0000 pid=3520 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=4d0da7ef-1600-0000-80cb-91cbc00d0000 pid=3520 execve guuid=a3c707f0-1600-0000-80cb-91cbc10d0000 pid=3521 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=a3c707f0-1600-0000-80cb-91cbc10d0000 pid=3521 execve guuid=169271f0-1600-0000-80cb-91cbc20d0000 pid=3522 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=169271f0-1600-0000-80cb-91cbc20d0000 pid=3522 execve guuid=b263ddf0-1600-0000-80cb-91cbc30d0000 pid=3523 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=b263ddf0-1600-0000-80cb-91cbc30d0000 pid=3523 execve guuid=493848f1-1600-0000-80cb-91cbc40d0000 pid=3524 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=493848f1-1600-0000-80cb-91cbc40d0000 pid=3524 execve guuid=c1f1bdf1-1600-0000-80cb-91cbc50d0000 pid=3525 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=c1f1bdf1-1600-0000-80cb-91cbc50d0000 pid=3525 execve guuid=84e21ef2-1600-0000-80cb-91cbc80d0000 pid=3528 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=84e21ef2-1600-0000-80cb-91cbc80d0000 pid=3528 execve guuid=239483f2-1600-0000-80cb-91cbca0d0000 pid=3530 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=239483f2-1600-0000-80cb-91cbca0d0000 pid=3530 execve guuid=1847e2f2-1600-0000-80cb-91cbcd0d0000 pid=3533 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=1847e2f2-1600-0000-80cb-91cbcd0d0000 pid=3533 execve guuid=52a37cf3-1600-0000-80cb-91cbd00d0000 pid=3536 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=52a37cf3-1600-0000-80cb-91cbd00d0000 pid=3536 execve guuid=8980e9f3-1600-0000-80cb-91cbd20d0000 pid=3538 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=8980e9f3-1600-0000-80cb-91cbd20d0000 pid=3538 execve guuid=202a4af4-1600-0000-80cb-91cbd50d0000 pid=3541 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=202a4af4-1600-0000-80cb-91cbd50d0000 pid=3541 execve guuid=703aa7f4-1600-0000-80cb-91cbd70d0000 pid=3543 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=703aa7f4-1600-0000-80cb-91cbd70d0000 pid=3543 execve guuid=5fb800f5-1600-0000-80cb-91cbda0d0000 pid=3546 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=5fb800f5-1600-0000-80cb-91cbda0d0000 pid=3546 execve guuid=dc4d57f5-1600-0000-80cb-91cbdc0d0000 pid=3548 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=dc4d57f5-1600-0000-80cb-91cbdc0d0000 pid=3548 execve guuid=afd9b5f5-1600-0000-80cb-91cbde0d0000 pid=3550 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=afd9b5f5-1600-0000-80cb-91cbde0d0000 pid=3550 execve guuid=050f14f6-1600-0000-80cb-91cbe00d0000 pid=3552 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=050f14f6-1600-0000-80cb-91cbe00d0000 pid=3552 execve guuid=719086f6-1600-0000-80cb-91cbe10d0000 pid=3553 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=719086f6-1600-0000-80cb-91cbe10d0000 pid=3553 execve guuid=20a710f7-1600-0000-80cb-91cbe20d0000 pid=3554 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=20a710f7-1600-0000-80cb-91cbe20d0000 pid=3554 execve guuid=6c168ff7-1600-0000-80cb-91cbe30d0000 pid=3555 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=6c168ff7-1600-0000-80cb-91cbe30d0000 pid=3555 execve guuid=01a40ff8-1600-0000-80cb-91cbe40d0000 pid=3556 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=01a40ff8-1600-0000-80cb-91cbe40d0000 pid=3556 execve guuid=bebc86f8-1600-0000-80cb-91cbe50d0000 pid=3557 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=bebc86f8-1600-0000-80cb-91cbe50d0000 pid=3557 execve guuid=f5fb07f9-1600-0000-80cb-91cbe60d0000 pid=3558 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=f5fb07f9-1600-0000-80cb-91cbe60d0000 pid=3558 execve guuid=24d085f9-1600-0000-80cb-91cbe70d0000 pid=3559 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=24d085f9-1600-0000-80cb-91cbe70d0000 pid=3559 execve guuid=5f6de5f9-1600-0000-80cb-91cbe90d0000 pid=3561 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=5f6de5f9-1600-0000-80cb-91cbe90d0000 pid=3561 execve guuid=4ad569fa-1600-0000-80cb-91cbea0d0000 pid=3562 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=4ad569fa-1600-0000-80cb-91cbea0d0000 pid=3562 execve guuid=18b0dffa-1600-0000-80cb-91cbeb0d0000 pid=3563 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=18b0dffa-1600-0000-80cb-91cbeb0d0000 pid=3563 execve guuid=b00b4dfb-1600-0000-80cb-91cbed0d0000 pid=3565 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=b00b4dfb-1600-0000-80cb-91cbed0d0000 pid=3565 execve guuid=182ea6fb-1600-0000-80cb-91cbef0d0000 pid=3567 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=182ea6fb-1600-0000-80cb-91cbef0d0000 pid=3567 execve guuid=58a668fc-1600-0000-80cb-91cbf30d0000 pid=3571 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=58a668fc-1600-0000-80cb-91cbf30d0000 pid=3571 execve guuid=dd80d0fc-1600-0000-80cb-91cbf40d0000 pid=3572 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=dd80d0fc-1600-0000-80cb-91cbf40d0000 pid=3572 execve guuid=1b4f4afd-1600-0000-80cb-91cbf70d0000 pid=3575 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=1b4f4afd-1600-0000-80cb-91cbf70d0000 pid=3575 execve guuid=f99ae8fd-1600-0000-80cb-91cbfa0d0000 pid=3578 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=f99ae8fd-1600-0000-80cb-91cbfa0d0000 pid=3578 execve guuid=948266fe-1600-0000-80cb-91cbfc0d0000 pid=3580 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=948266fe-1600-0000-80cb-91cbfc0d0000 pid=3580 execve guuid=1d27e8fe-1600-0000-80cb-91cbff0d0000 pid=3583 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=1d27e8fe-1600-0000-80cb-91cbff0d0000 pid=3583 execve guuid=0c2467ff-1600-0000-80cb-91cb010e0000 pid=3585 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=0c2467ff-1600-0000-80cb-91cb010e0000 pid=3585 execve guuid=6dace2ff-1600-0000-80cb-91cb040e0000 pid=3588 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=6dace2ff-1600-0000-80cb-91cb040e0000 pid=3588 execve guuid=f4695b00-1700-0000-80cb-91cb060e0000 pid=3590 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=f4695b00-1700-0000-80cb-91cb060e0000 pid=3590 execve guuid=a75cdb00-1700-0000-80cb-91cb080e0000 pid=3592 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=a75cdb00-1700-0000-80cb-91cb080e0000 pid=3592 execve guuid=04a65c01-1700-0000-80cb-91cb0b0e0000 pid=3595 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=04a65c01-1700-0000-80cb-91cb0b0e0000 pid=3595 execve guuid=4b0eee01-1700-0000-80cb-91cb0d0e0000 pid=3597 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=4b0eee01-1700-0000-80cb-91cb0d0e0000 pid=3597 execve guuid=64587202-1700-0000-80cb-91cb100e0000 pid=3600 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=64587202-1700-0000-80cb-91cb100e0000 pid=3600 execve guuid=54fd0703-1700-0000-80cb-91cb120e0000 pid=3602 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=54fd0703-1700-0000-80cb-91cb120e0000 pid=3602 execve guuid=c84edf03-1700-0000-80cb-91cb160e0000 pid=3606 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=c84edf03-1700-0000-80cb-91cb160e0000 pid=3606 execve guuid=3c617c04-1700-0000-80cb-91cb180e0000 pid=3608 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=3c617c04-1700-0000-80cb-91cb180e0000 pid=3608 execve guuid=62cc0105-1700-0000-80cb-91cb1e0e0000 pid=3614 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=62cc0105-1700-0000-80cb-91cb1e0e0000 pid=3614 execve guuid=f2c39905-1700-0000-80cb-91cb1f0e0000 pid=3615 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=f2c39905-1700-0000-80cb-91cb1f0e0000 pid=3615 execve guuid=5d1e0606-1700-0000-80cb-91cb210e0000 pid=3617 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=5d1e0606-1700-0000-80cb-91cb210e0000 pid=3617 execve guuid=35038506-1700-0000-80cb-91cb230e0000 pid=3619 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=35038506-1700-0000-80cb-91cb230e0000 pid=3619 execve guuid=caa8ff06-1700-0000-80cb-91cb240e0000 pid=3620 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=caa8ff06-1700-0000-80cb-91cb240e0000 pid=3620 execve guuid=e7cf7a07-1700-0000-80cb-91cb260e0000 pid=3622 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=e7cf7a07-1700-0000-80cb-91cb260e0000 pid=3622 execve guuid=99c2ef07-1700-0000-80cb-91cb290e0000 pid=3625 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=99c2ef07-1700-0000-80cb-91cb290e0000 pid=3625 execve guuid=a2fc6e08-1700-0000-80cb-91cb2b0e0000 pid=3627 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=a2fc6e08-1700-0000-80cb-91cb2b0e0000 pid=3627 execve guuid=dfe8e808-1700-0000-80cb-91cb2d0e0000 pid=3629 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=dfe8e808-1700-0000-80cb-91cb2d0e0000 pid=3629 execve guuid=b1e46609-1700-0000-80cb-91cb300e0000 pid=3632 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=b1e46609-1700-0000-80cb-91cb300e0000 pid=3632 execve guuid=c3a8db09-1700-0000-80cb-91cb320e0000 pid=3634 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=c3a8db09-1700-0000-80cb-91cb320e0000 pid=3634 execve guuid=c245570a-1700-0000-80cb-91cb340e0000 pid=3636 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=c245570a-1700-0000-80cb-91cb340e0000 pid=3636 execve guuid=d247d30a-1700-0000-80cb-91cb370e0000 pid=3639 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=d247d30a-1700-0000-80cb-91cb370e0000 pid=3639 execve guuid=04c95e0b-1700-0000-80cb-91cb390e0000 pid=3641 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=04c95e0b-1700-0000-80cb-91cb390e0000 pid=3641 execve guuid=c474530c-1700-0000-80cb-91cb3c0e0000 pid=3644 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=c474530c-1700-0000-80cb-91cb3c0e0000 pid=3644 execve guuid=ec46210d-1700-0000-80cb-91cb400e0000 pid=3648 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=ec46210d-1700-0000-80cb-91cb400e0000 pid=3648 execve guuid=ca63ac0d-1700-0000-80cb-91cb420e0000 pid=3650 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=ca63ac0d-1700-0000-80cb-91cb420e0000 pid=3650 execve guuid=5a5e2d0e-1700-0000-80cb-91cb440e0000 pid=3652 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=5a5e2d0e-1700-0000-80cb-91cb440e0000 pid=3652 execve guuid=e992ad0e-1700-0000-80cb-91cb460e0000 pid=3654 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=e992ad0e-1700-0000-80cb-91cb460e0000 pid=3654 execve guuid=3454380f-1700-0000-80cb-91cb490e0000 pid=3657 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=3454380f-1700-0000-80cb-91cb490e0000 pid=3657 execve guuid=b4c0b30f-1700-0000-80cb-91cb4c0e0000 pid=3660 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=b4c0b30f-1700-0000-80cb-91cb4c0e0000 pid=3660 execve guuid=05e43f10-1700-0000-80cb-91cb4e0e0000 pid=3662 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=05e43f10-1700-0000-80cb-91cb4e0e0000 pid=3662 execve guuid=c1acc910-1700-0000-80cb-91cb500e0000 pid=3664 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=c1acc910-1700-0000-80cb-91cb500e0000 pid=3664 execve guuid=21f64011-1700-0000-80cb-91cb530e0000 pid=3667 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=21f64011-1700-0000-80cb-91cb530e0000 pid=3667 execve guuid=ad11ba11-1700-0000-80cb-91cb550e0000 pid=3669 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=ad11ba11-1700-0000-80cb-91cb550e0000 pid=3669 execve guuid=90ea2e12-1700-0000-80cb-91cb570e0000 pid=3671 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=90ea2e12-1700-0000-80cb-91cb570e0000 pid=3671 execve guuid=2b0ca612-1700-0000-80cb-91cb5a0e0000 pid=3674 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=2b0ca612-1700-0000-80cb-91cb5a0e0000 pid=3674 execve guuid=d4e02113-1700-0000-80cb-91cb5c0e0000 pid=3676 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=d4e02113-1700-0000-80cb-91cb5c0e0000 pid=3676 execve guuid=91c39513-1700-0000-80cb-91cb5e0e0000 pid=3678 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=91c39513-1700-0000-80cb-91cb5e0e0000 pid=3678 execve guuid=db770a14-1700-0000-80cb-91cb600e0000 pid=3680 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=db770a14-1700-0000-80cb-91cb600e0000 pid=3680 execve guuid=0e8e8414-1700-0000-80cb-91cb620e0000 pid=3682 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=0e8e8414-1700-0000-80cb-91cb620e0000 pid=3682 execve guuid=4f85fd14-1700-0000-80cb-91cb650e0000 pid=3685 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=4f85fd14-1700-0000-80cb-91cb650e0000 pid=3685 execve guuid=40a27a15-1700-0000-80cb-91cb670e0000 pid=3687 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=40a27a15-1700-0000-80cb-91cb670e0000 pid=3687 execve guuid=7e20f815-1700-0000-80cb-91cb680e0000 pid=3688 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=7e20f815-1700-0000-80cb-91cb680e0000 pid=3688 execve guuid=80398816-1700-0000-80cb-91cb6a0e0000 pid=3690 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=80398816-1700-0000-80cb-91cb6a0e0000 pid=3690 execve guuid=6dd40a17-1700-0000-80cb-91cb6c0e0000 pid=3692 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=6dd40a17-1700-0000-80cb-91cb6c0e0000 pid=3692 execve guuid=e7d98817-1700-0000-80cb-91cb6e0e0000 pid=3694 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=e7d98817-1700-0000-80cb-91cb6e0e0000 pid=3694 execve guuid=fc180818-1700-0000-80cb-91cb710e0000 pid=3697 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=fc180818-1700-0000-80cb-91cb710e0000 pid=3697 execve guuid=fc7d8e18-1700-0000-80cb-91cb730e0000 pid=3699 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=fc7d8e18-1700-0000-80cb-91cb730e0000 pid=3699 execve guuid=60221319-1700-0000-80cb-91cb760e0000 pid=3702 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=60221319-1700-0000-80cb-91cb760e0000 pid=3702 execve guuid=4f888d19-1700-0000-80cb-91cb790e0000 pid=3705 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=4f888d19-1700-0000-80cb-91cb790e0000 pid=3705 execve guuid=ece4f019-1700-0000-80cb-91cb7b0e0000 pid=3707 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=ece4f019-1700-0000-80cb-91cb7b0e0000 pid=3707 execve guuid=4bcf5d1a-1700-0000-80cb-91cb7d0e0000 pid=3709 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=4bcf5d1a-1700-0000-80cb-91cb7d0e0000 pid=3709 execve guuid=a108c01a-1700-0000-80cb-91cb800e0000 pid=3712 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=a108c01a-1700-0000-80cb-91cb800e0000 pid=3712 execve guuid=91521f1b-1700-0000-80cb-91cb810e0000 pid=3713 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=91521f1b-1700-0000-80cb-91cb810e0000 pid=3713 execve guuid=0a138a1b-1700-0000-80cb-91cb840e0000 pid=3716 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=0a138a1b-1700-0000-80cb-91cb840e0000 pid=3716 execve guuid=fe89ec1b-1700-0000-80cb-91cb860e0000 pid=3718 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=fe89ec1b-1700-0000-80cb-91cb860e0000 pid=3718 execve guuid=e69b531c-1700-0000-80cb-91cb8a0e0000 pid=3722 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=e69b531c-1700-0000-80cb-91cb8a0e0000 pid=3722 execve guuid=34a1d81c-1700-0000-80cb-91cb8e0e0000 pid=3726 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=34a1d81c-1700-0000-80cb-91cb8e0e0000 pid=3726 execve guuid=23765c1d-1700-0000-80cb-91cb900e0000 pid=3728 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=23765c1d-1700-0000-80cb-91cb900e0000 pid=3728 execve guuid=5523b81d-1700-0000-80cb-91cb930e0000 pid=3731 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=5523b81d-1700-0000-80cb-91cb930e0000 pid=3731 execve guuid=a7cc391e-1700-0000-80cb-91cb960e0000 pid=3734 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=a7cc391e-1700-0000-80cb-91cb960e0000 pid=3734 execve guuid=9018b61e-1700-0000-80cb-91cb990e0000 pid=3737 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=9018b61e-1700-0000-80cb-91cb990e0000 pid=3737 execve guuid=c24b2f1f-1700-0000-80cb-91cb9c0e0000 pid=3740 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=c24b2f1f-1700-0000-80cb-91cb9c0e0000 pid=3740 execve guuid=b342c11f-1700-0000-80cb-91cb9f0e0000 pid=3743 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=b342c11f-1700-0000-80cb-91cb9f0e0000 pid=3743 execve guuid=d2654620-1700-0000-80cb-91cba30e0000 pid=3747 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=d2654620-1700-0000-80cb-91cba30e0000 pid=3747 execve guuid=6652cc20-1700-0000-80cb-91cba80e0000 pid=3752 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=6652cc20-1700-0000-80cb-91cba80e0000 pid=3752 execve guuid=4c1c5521-1700-0000-80cb-91cbab0e0000 pid=3755 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=4c1c5521-1700-0000-80cb-91cbab0e0000 pid=3755 execve guuid=597ce221-1700-0000-80cb-91cbae0e0000 pid=3758 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=597ce221-1700-0000-80cb-91cbae0e0000 pid=3758 execve guuid=323e3122-1700-0000-80cb-91cbb10e0000 pid=3761 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=323e3122-1700-0000-80cb-91cbb10e0000 pid=3761 execve guuid=13abb722-1700-0000-80cb-91cbb30e0000 pid=3763 /usr/bin/ls guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=13abb722-1700-0000-80cb-91cbb30e0000 pid=3763 execve guuid=2a8d1323-1700-0000-80cb-91cbb70e0000 pid=3767 /usr/bin/rm guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=2a8d1323-1700-0000-80cb-91cbb70e0000 pid=3767 execve guuid=7f954f23-1700-0000-80cb-91cbbb0e0000 pid=3771 /usr/bin/wget net send-data write-file guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=7f954f23-1700-0000-80cb-91cbbb0e0000 pid=3771 execve guuid=340f112a-1700-0000-80cb-91cbd80e0000 pid=3800 /usr/bin/chmod guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=340f112a-1700-0000-80cb-91cbd80e0000 pid=3800 execve guuid=9a6d4b2a-1700-0000-80cb-91cbd90e0000 pid=3801 /tmp/OKFH guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=9a6d4b2a-1700-0000-80cb-91cbd90e0000 pid=3801 execve guuid=6bfef52a-1700-0000-80cb-91cbde0e0000 pid=3806 /usr/bin/rm guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=6bfef52a-1700-0000-80cb-91cbde0e0000 pid=3806 execve guuid=70752b2b-1700-0000-80cb-91cbdf0e0000 pid=3807 /usr/bin/wget net send-data write-file guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=70752b2b-1700-0000-80cb-91cbdf0e0000 pid=3807 execve guuid=89d0906e-1700-0000-80cb-91cbfd0f0000 pid=4093 /usr/bin/chmod guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=89d0906e-1700-0000-80cb-91cbfd0f0000 pid=4093 execve guuid=d29ae96e-1700-0000-80cb-91cb01100000 pid=4097 /tmp/qcU guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=d29ae96e-1700-0000-80cb-91cb01100000 pid=4097 execve guuid=89f2c770-1700-0000-80cb-91cb07100000 pid=4103 /usr/bin/rm guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=89f2c770-1700-0000-80cb-91cb07100000 pid=4103 execve guuid=77390f71-1700-0000-80cb-91cb09100000 pid=4105 /usr/bin/wget net send-data write-file guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=77390f71-1700-0000-80cb-91cb09100000 pid=4105 execve guuid=07f1b878-1700-0000-80cb-91cb2b100000 pid=4139 /usr/bin/chmod guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=07f1b878-1700-0000-80cb-91cb2b100000 pid=4139 execve guuid=fea9f578-1700-0000-80cb-91cb2d100000 pid=4141 /tmp/eWa guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=fea9f578-1700-0000-80cb-91cb2d100000 pid=4141 execve guuid=0052767a-1700-0000-80cb-91cb34100000 pid=4148 /usr/bin/rm guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=0052767a-1700-0000-80cb-91cb34100000 pid=4148 execve guuid=3bc3b07a-1700-0000-80cb-91cb35100000 pid=4149 /usr/bin/wget net send-data write-file guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=3bc3b07a-1700-0000-80cb-91cb35100000 pid=4149 execve guuid=0daade81-1700-0000-80cb-91cb56100000 pid=4182 /usr/bin/chmod guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=0daade81-1700-0000-80cb-91cb56100000 pid=4182 execve guuid=447d1982-1700-0000-80cb-91cb5a100000 pid=4186 /tmp/pxEu guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=447d1982-1700-0000-80cb-91cb5a100000 pid=4186 execve guuid=df07bc82-1700-0000-80cb-91cb5f100000 pid=4191 /usr/bin/rm guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=df07bc82-1700-0000-80cb-91cb5f100000 pid=4191 execve guuid=bb9ff282-1700-0000-80cb-91cb61100000 pid=4193 /usr/bin/wget net send-data write-file guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=bb9ff282-1700-0000-80cb-91cb61100000 pid=4193 execve guuid=b718ddc5-1700-0000-80cb-91cb65110000 pid=4453 /usr/bin/chmod guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=b718ddc5-1700-0000-80cb-91cb65110000 pid=4453 execve guuid=792c7cc6-1700-0000-80cb-91cb68110000 pid=4456 /tmp/8g7K guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=792c7cc6-1700-0000-80cb-91cb68110000 pid=4456 execve guuid=e3946fc7-1700-0000-80cb-91cb6e110000 pid=4462 /usr/bin/rm delete-file guuid=0b0ff1e8-1600-0000-80cb-91cbab0d0000 pid=3499->guuid=e3946fc7-1700-0000-80cb-91cb6e110000 pid=4462 execve 9554d36e-3083-568e-90da-bb8e3c487b07 188.132.232.81:80 guuid=7f954f23-1700-0000-80cb-91cbbb0e0000 pid=3771->9554d36e-3083-568e-90da-bb8e3c487b07 send: 133B guuid=70752b2b-1700-0000-80cb-91cbdf0e0000 pid=3807->9554d36e-3083-568e-90da-bb8e3c487b07 send: 132B guuid=77390f71-1700-0000-80cb-91cb09100000 pid=4105->9554d36e-3083-568e-90da-bb8e3c487b07 send: 132B guuid=3bc3b07a-1700-0000-80cb-91cb35100000 pid=4149->9554d36e-3083-568e-90da-bb8e3c487b07 send: 133B guuid=bb9ff282-1700-0000-80cb-91cb61100000 pid=4193->9554d36e-3083-568e-90da-bb8e3c487b07 send: 133B
Score:
98%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/da4dab73dc3dcbf801fa468bd741319ddf7879c642570dbe9aff7ef08131c6d6
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/da4dab73dc3dcbf801fa468bd741319ddf7879c642570dbe9aff7ef08131c6d6/
Verdict:
Malicious
Link:
https://tip.neiki.dev/file/da4dab73dc3dcbf801fa468bd741319ddf7879c642570dbe9aff7ef08131c6d6
Threat name:
Win32.Trojan.Vigorf
Create hunting rule
Status:
Malicious
First seen:
2026-06-04 02:11:29 UTC
File Type:
Text (Shell)
AV detection:
11 of 23 (47.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3jg2w464hxf7qap2i2f5oqjrtxpxq6ogijlq3pu2757pbajry3la._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
defense_evasion discovery linux
Link:
https://tria.ge/reports/260604-clckwsgx8x/
Behaviour
Reads runtime system information
Writes file to tmp directory
File and Directory Permissions Modification
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.26
Link:
https://yomi.yoroi.company/submissions/da4dab73dc3dcbf801fa468bd741319ddf7879c642570dbe9aff7ef08131c6d6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh da4dab73dc3dcbf801fa468bd741319ddf7879c642570dbe9aff7ef08131c6d6

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3856423/
  
Delivery method
Distributed via web download

Comments