MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dd09d1fc879642e9b72ac07680a36a9f0b18cf31f8283295e7bc9c2456ff54bb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dd09d1fc879642e9b72ac07680a36a9f0b18cf31f8283295e7bc9c2456ff54bb
SHA3-384 hash: 9d1fce586daafa1d70431ef1eaced9ad0a6adb6d7e40635fbc28fa2333d2321aae27a103fed07dec00fd23a0ff7aa254
SHA1 hash: c383a1ea51da82570e2ec6490fccdadafc0f7d05
MD5 hash: 451aa4d4fdcd847b5232513beff91855
humanhash: fifteen-yellow-nevada-orange
File name:p
Download: download sample
File size:835 bytes
First seen:2026-06-21 15:45:35 UTC
Last seen:2026-06-22 10:59:18 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 24:kXCKysE2hi0ziQvZoha0ka8wNDD2Xw0Ft7:e9Qp+Ms0SwNGbFt7
TLSH T1090182D685106D105019965E2AD75294F420C3CF0A5B0FB8BF9C5D3EFF98915F067F98
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://129.121.114.124/8OjVn/an/aelf ua-wget
http://129.121.114.124/Uhjn/an/aelf ua-wget
http://129.121.114.124/6k2n/an/aelf ua-wget
http://129.121.114.124/lEG7n/an/aelf ua-wget
http://129.121.114.124/yNun/an/aelf ua-wget

Intelligence

File Origin
# of uploads :
3
# of downloads :
60
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive
Link:
https://www.filescan.io/uploads/6a38072962d0679105fa9afe/reports/c327da92-e387-4851-bddf-8c5455a48a34/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-06-21T12:48:00Z UTC
Last seen:
2026-06-22T23:48:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan-Downloader.Shell.Agent.a
Link:
https://opentip.kaspersky.com/dd09d1fc879642e9b72ac07680a36a9f0b18cf31f8283295e7bc9c2456ff54bb/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/2bd94b8a-d2ff-4329-885a-99f7c38ca961
Behavior Graph:
Download SVG
%3 guuid=9c1bb153-1900-0000-e5df-2e9e2d140000 pid=5165 /usr/bin/sudo guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166 /tmp/sample.bin write-file guuid=9c1bb153-1900-0000-e5df-2e9e2d140000 pid=5165->guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166 execve guuid=3714c955-1900-0000-e5df-2e9e2f140000 pid=5167 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=3714c955-1900-0000-e5df-2e9e2f140000 pid=5167 execve guuid=96b07556-1900-0000-e5df-2e9e30140000 pid=5168 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=96b07556-1900-0000-e5df-2e9e30140000 pid=5168 execve guuid=93cf1f57-1900-0000-e5df-2e9e31140000 pid=5169 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=93cf1f57-1900-0000-e5df-2e9e31140000 pid=5169 execve guuid=2426d357-1900-0000-e5df-2e9e32140000 pid=5170 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=2426d357-1900-0000-e5df-2e9e32140000 pid=5170 execve guuid=74048058-1900-0000-e5df-2e9e33140000 pid=5171 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=74048058-1900-0000-e5df-2e9e33140000 pid=5171 execve guuid=03d21e59-1900-0000-e5df-2e9e34140000 pid=5172 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=03d21e59-1900-0000-e5df-2e9e34140000 pid=5172 execve guuid=0a19ba59-1900-0000-e5df-2e9e35140000 pid=5173 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=0a19ba59-1900-0000-e5df-2e9e35140000 pid=5173 execve guuid=81424a5a-1900-0000-e5df-2e9e36140000 pid=5174 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=81424a5a-1900-0000-e5df-2e9e36140000 pid=5174 execve guuid=9408d55a-1900-0000-e5df-2e9e37140000 pid=5175 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=9408d55a-1900-0000-e5df-2e9e37140000 pid=5175 execve guuid=aede555b-1900-0000-e5df-2e9e38140000 pid=5176 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=aede555b-1900-0000-e5df-2e9e38140000 pid=5176 execve guuid=9299d05b-1900-0000-e5df-2e9e39140000 pid=5177 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=9299d05b-1900-0000-e5df-2e9e39140000 pid=5177 execve guuid=c612425c-1900-0000-e5df-2e9e3a140000 pid=5178 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=c612425c-1900-0000-e5df-2e9e3a140000 pid=5178 execve guuid=a843b05c-1900-0000-e5df-2e9e3b140000 pid=5179 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=a843b05c-1900-0000-e5df-2e9e3b140000 pid=5179 execve guuid=bb32145d-1900-0000-e5df-2e9e3c140000 pid=5180 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=bb32145d-1900-0000-e5df-2e9e3c140000 pid=5180 execve guuid=550a865d-1900-0000-e5df-2e9e3d140000 pid=5181 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=550a865d-1900-0000-e5df-2e9e3d140000 pid=5181 execve guuid=ba31fb5d-1900-0000-e5df-2e9e3e140000 pid=5182 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=ba31fb5d-1900-0000-e5df-2e9e3e140000 pid=5182 execve guuid=c9d6715e-1900-0000-e5df-2e9e3f140000 pid=5183 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=c9d6715e-1900-0000-e5df-2e9e3f140000 pid=5183 execve guuid=62f0e45e-1900-0000-e5df-2e9e40140000 pid=5184 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=62f0e45e-1900-0000-e5df-2e9e40140000 pid=5184 execve guuid=a20b575f-1900-0000-e5df-2e9e41140000 pid=5185 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=a20b575f-1900-0000-e5df-2e9e41140000 pid=5185 execve guuid=c23ed15f-1900-0000-e5df-2e9e42140000 pid=5186 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=c23ed15f-1900-0000-e5df-2e9e42140000 pid=5186 execve guuid=9ea23f60-1900-0000-e5df-2e9e43140000 pid=5187 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=9ea23f60-1900-0000-e5df-2e9e43140000 pid=5187 execve guuid=b60db160-1900-0000-e5df-2e9e44140000 pid=5188 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=b60db160-1900-0000-e5df-2e9e44140000 pid=5188 execve guuid=98771f61-1900-0000-e5df-2e9e45140000 pid=5189 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=98771f61-1900-0000-e5df-2e9e45140000 pid=5189 execve guuid=d2168f61-1900-0000-e5df-2e9e46140000 pid=5190 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=d2168f61-1900-0000-e5df-2e9e46140000 pid=5190 execve guuid=d6967262-1900-0000-e5df-2e9e47140000 pid=5191 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=d6967262-1900-0000-e5df-2e9e47140000 pid=5191 execve guuid=8e4ae762-1900-0000-e5df-2e9e48140000 pid=5192 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=8e4ae762-1900-0000-e5df-2e9e48140000 pid=5192 execve guuid=782f4863-1900-0000-e5df-2e9e49140000 pid=5193 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=782f4863-1900-0000-e5df-2e9e49140000 pid=5193 execve guuid=7f8eab63-1900-0000-e5df-2e9e4a140000 pid=5194 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=7f8eab63-1900-0000-e5df-2e9e4a140000 pid=5194 execve guuid=b9e51264-1900-0000-e5df-2e9e4b140000 pid=5195 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=b9e51264-1900-0000-e5df-2e9e4b140000 pid=5195 execve guuid=f5d17964-1900-0000-e5df-2e9e4c140000 pid=5196 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=f5d17964-1900-0000-e5df-2e9e4c140000 pid=5196 execve guuid=84ce4f65-1900-0000-e5df-2e9e4d140000 pid=5197 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=84ce4f65-1900-0000-e5df-2e9e4d140000 pid=5197 execve guuid=a02bbf65-1900-0000-e5df-2e9e4e140000 pid=5198 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=a02bbf65-1900-0000-e5df-2e9e4e140000 pid=5198 execve guuid=5eaa2666-1900-0000-e5df-2e9e4f140000 pid=5199 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=5eaa2666-1900-0000-e5df-2e9e4f140000 pid=5199 execve guuid=dddb9266-1900-0000-e5df-2e9e50140000 pid=5200 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=dddb9266-1900-0000-e5df-2e9e50140000 pid=5200 execve guuid=a6d8fd66-1900-0000-e5df-2e9e51140000 pid=5201 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=a6d8fd66-1900-0000-e5df-2e9e51140000 pid=5201 execve guuid=edaa6967-1900-0000-e5df-2e9e52140000 pid=5202 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=edaa6967-1900-0000-e5df-2e9e52140000 pid=5202 execve guuid=7945d267-1900-0000-e5df-2e9e53140000 pid=5203 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=7945d267-1900-0000-e5df-2e9e53140000 pid=5203 execve guuid=093a3c68-1900-0000-e5df-2e9e54140000 pid=5204 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=093a3c68-1900-0000-e5df-2e9e54140000 pid=5204 execve guuid=9e44d168-1900-0000-e5df-2e9e55140000 pid=5205 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=9e44d168-1900-0000-e5df-2e9e55140000 pid=5205 execve guuid=6b016269-1900-0000-e5df-2e9e56140000 pid=5206 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=6b016269-1900-0000-e5df-2e9e56140000 pid=5206 execve guuid=53dff669-1900-0000-e5df-2e9e57140000 pid=5207 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=53dff669-1900-0000-e5df-2e9e57140000 pid=5207 execve guuid=dfe6916a-1900-0000-e5df-2e9e58140000 pid=5208 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=dfe6916a-1900-0000-e5df-2e9e58140000 pid=5208 execve guuid=0940fe6a-1900-0000-e5df-2e9e59140000 pid=5209 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=0940fe6a-1900-0000-e5df-2e9e59140000 pid=5209 execve guuid=d5226e6b-1900-0000-e5df-2e9e5a140000 pid=5210 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=d5226e6b-1900-0000-e5df-2e9e5a140000 pid=5210 execve guuid=af0fd46b-1900-0000-e5df-2e9e5b140000 pid=5211 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=af0fd46b-1900-0000-e5df-2e9e5b140000 pid=5211 execve guuid=b5073d6c-1900-0000-e5df-2e9e5c140000 pid=5212 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=b5073d6c-1900-0000-e5df-2e9e5c140000 pid=5212 execve guuid=46cab56c-1900-0000-e5df-2e9e5d140000 pid=5213 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=46cab56c-1900-0000-e5df-2e9e5d140000 pid=5213 execve guuid=478d296d-1900-0000-e5df-2e9e5e140000 pid=5214 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=478d296d-1900-0000-e5df-2e9e5e140000 pid=5214 execve guuid=df2aa96d-1900-0000-e5df-2e9e5f140000 pid=5215 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=df2aa96d-1900-0000-e5df-2e9e5f140000 pid=5215 execve guuid=9c3e246e-1900-0000-e5df-2e9e60140000 pid=5216 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=9c3e246e-1900-0000-e5df-2e9e60140000 pid=5216 execve guuid=0e75a16e-1900-0000-e5df-2e9e61140000 pid=5217 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=0e75a16e-1900-0000-e5df-2e9e61140000 pid=5217 execve guuid=b6d5136f-1900-0000-e5df-2e9e62140000 pid=5218 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=b6d5136f-1900-0000-e5df-2e9e62140000 pid=5218 execve guuid=cd198e6f-1900-0000-e5df-2e9e63140000 pid=5219 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=cd198e6f-1900-0000-e5df-2e9e63140000 pid=5219 execve guuid=5e9b0070-1900-0000-e5df-2e9e64140000 pid=5220 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=5e9b0070-1900-0000-e5df-2e9e64140000 pid=5220 execve guuid=2aad7670-1900-0000-e5df-2e9e65140000 pid=5221 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=2aad7670-1900-0000-e5df-2e9e65140000 pid=5221 execve guuid=3e35ed70-1900-0000-e5df-2e9e66140000 pid=5222 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=3e35ed70-1900-0000-e5df-2e9e66140000 pid=5222 execve guuid=62e36071-1900-0000-e5df-2e9e67140000 pid=5223 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=62e36071-1900-0000-e5df-2e9e67140000 pid=5223 execve guuid=7217dc71-1900-0000-e5df-2e9e68140000 pid=5224 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=7217dc71-1900-0000-e5df-2e9e68140000 pid=5224 execve guuid=ce694d72-1900-0000-e5df-2e9e69140000 pid=5225 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=ce694d72-1900-0000-e5df-2e9e69140000 pid=5225 execve guuid=db10b772-1900-0000-e5df-2e9e6a140000 pid=5226 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=db10b772-1900-0000-e5df-2e9e6a140000 pid=5226 execve guuid=84692673-1900-0000-e5df-2e9e6b140000 pid=5227 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=84692673-1900-0000-e5df-2e9e6b140000 pid=5227 execve guuid=58738f73-1900-0000-e5df-2e9e6c140000 pid=5228 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=58738f73-1900-0000-e5df-2e9e6c140000 pid=5228 execve guuid=18d4f373-1900-0000-e5df-2e9e6d140000 pid=5229 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=18d4f373-1900-0000-e5df-2e9e6d140000 pid=5229 execve guuid=875a6474-1900-0000-e5df-2e9e6e140000 pid=5230 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=875a6474-1900-0000-e5df-2e9e6e140000 pid=5230 execve guuid=5aa8ca74-1900-0000-e5df-2e9e6f140000 pid=5231 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=5aa8ca74-1900-0000-e5df-2e9e6f140000 pid=5231 execve guuid=5dab3775-1900-0000-e5df-2e9e70140000 pid=5232 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=5dab3775-1900-0000-e5df-2e9e70140000 pid=5232 execve guuid=dbbba375-1900-0000-e5df-2e9e71140000 pid=5233 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=dbbba375-1900-0000-e5df-2e9e71140000 pid=5233 execve guuid=fe441876-1900-0000-e5df-2e9e72140000 pid=5234 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=fe441876-1900-0000-e5df-2e9e72140000 pid=5234 execve guuid=cd3d8b76-1900-0000-e5df-2e9e73140000 pid=5235 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=cd3d8b76-1900-0000-e5df-2e9e73140000 pid=5235 execve guuid=6ea30477-1900-0000-e5df-2e9e74140000 pid=5236 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=6ea30477-1900-0000-e5df-2e9e74140000 pid=5236 execve guuid=ceea7c77-1900-0000-e5df-2e9e75140000 pid=5237 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=ceea7c77-1900-0000-e5df-2e9e75140000 pid=5237 execve guuid=19cbf677-1900-0000-e5df-2e9e76140000 pid=5238 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=19cbf677-1900-0000-e5df-2e9e76140000 pid=5238 execve guuid=95606d78-1900-0000-e5df-2e9e77140000 pid=5239 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=95606d78-1900-0000-e5df-2e9e77140000 pid=5239 execve guuid=00d4ed78-1900-0000-e5df-2e9e78140000 pid=5240 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=00d4ed78-1900-0000-e5df-2e9e78140000 pid=5240 execve guuid=cd166179-1900-0000-e5df-2e9e79140000 pid=5241 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=cd166179-1900-0000-e5df-2e9e79140000 pid=5241 execve guuid=2f14db79-1900-0000-e5df-2e9e7a140000 pid=5242 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=2f14db79-1900-0000-e5df-2e9e7a140000 pid=5242 execve guuid=23ff537a-1900-0000-e5df-2e9e7b140000 pid=5243 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=23ff537a-1900-0000-e5df-2e9e7b140000 pid=5243 execve guuid=2236c87a-1900-0000-e5df-2e9e7c140000 pid=5244 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=2236c87a-1900-0000-e5df-2e9e7c140000 pid=5244 execve guuid=648f3e7b-1900-0000-e5df-2e9e7d140000 pid=5245 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=648f3e7b-1900-0000-e5df-2e9e7d140000 pid=5245 execve guuid=ec78ab7b-1900-0000-e5df-2e9e7e140000 pid=5246 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=ec78ab7b-1900-0000-e5df-2e9e7e140000 pid=5246 execve guuid=4e59287c-1900-0000-e5df-2e9e7f140000 pid=5247 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=4e59287c-1900-0000-e5df-2e9e7f140000 pid=5247 execve guuid=204d937c-1900-0000-e5df-2e9e80140000 pid=5248 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=204d937c-1900-0000-e5df-2e9e80140000 pid=5248 execve guuid=f38df27c-1900-0000-e5df-2e9e81140000 pid=5249 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=f38df27c-1900-0000-e5df-2e9e81140000 pid=5249 execve guuid=e16b4f7d-1900-0000-e5df-2e9e82140000 pid=5250 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=e16b4f7d-1900-0000-e5df-2e9e82140000 pid=5250 execve guuid=b5ceb87d-1900-0000-e5df-2e9e83140000 pid=5251 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=b5ceb87d-1900-0000-e5df-2e9e83140000 pid=5251 execve guuid=8998227e-1900-0000-e5df-2e9e84140000 pid=5252 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=8998227e-1900-0000-e5df-2e9e84140000 pid=5252 execve guuid=cfb48c7e-1900-0000-e5df-2e9e85140000 pid=5253 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=cfb48c7e-1900-0000-e5df-2e9e85140000 pid=5253 execve guuid=9efaf97e-1900-0000-e5df-2e9e86140000 pid=5254 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=9efaf97e-1900-0000-e5df-2e9e86140000 pid=5254 execve guuid=063e6a7f-1900-0000-e5df-2e9e87140000 pid=5255 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=063e6a7f-1900-0000-e5df-2e9e87140000 pid=5255 execve guuid=4104dc7f-1900-0000-e5df-2e9e88140000 pid=5256 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=4104dc7f-1900-0000-e5df-2e9e88140000 pid=5256 execve guuid=f4925680-1900-0000-e5df-2e9e89140000 pid=5257 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=f4925680-1900-0000-e5df-2e9e89140000 pid=5257 execve guuid=cb2cd380-1900-0000-e5df-2e9e8a140000 pid=5258 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=cb2cd380-1900-0000-e5df-2e9e8a140000 pid=5258 execve guuid=45ef4981-1900-0000-e5df-2e9e8b140000 pid=5259 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=45ef4981-1900-0000-e5df-2e9e8b140000 pid=5259 execve guuid=14efc481-1900-0000-e5df-2e9e8c140000 pid=5260 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=14efc481-1900-0000-e5df-2e9e8c140000 pid=5260 execve guuid=f09b3a82-1900-0000-e5df-2e9e8d140000 pid=5261 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=f09b3a82-1900-0000-e5df-2e9e8d140000 pid=5261 execve guuid=4826ac82-1900-0000-e5df-2e9e8e140000 pid=5262 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=4826ac82-1900-0000-e5df-2e9e8e140000 pid=5262 execve guuid=c9aa1f83-1900-0000-e5df-2e9e8f140000 pid=5263 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=c9aa1f83-1900-0000-e5df-2e9e8f140000 pid=5263 execve guuid=09159983-1900-0000-e5df-2e9e90140000 pid=5264 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=09159983-1900-0000-e5df-2e9e90140000 pid=5264 execve guuid=20151184-1900-0000-e5df-2e9e91140000 pid=5265 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=20151184-1900-0000-e5df-2e9e91140000 pid=5265 execve guuid=d73b8484-1900-0000-e5df-2e9e92140000 pid=5266 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=d73b8484-1900-0000-e5df-2e9e92140000 pid=5266 execve guuid=738eed84-1900-0000-e5df-2e9e93140000 pid=5267 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=738eed84-1900-0000-e5df-2e9e93140000 pid=5267 execve guuid=e02f5a85-1900-0000-e5df-2e9e94140000 pid=5268 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=e02f5a85-1900-0000-e5df-2e9e94140000 pid=5268 execve guuid=c20ec785-1900-0000-e5df-2e9e95140000 pid=5269 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=c20ec785-1900-0000-e5df-2e9e95140000 pid=5269 execve guuid=bb273786-1900-0000-e5df-2e9e96140000 pid=5270 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=bb273786-1900-0000-e5df-2e9e96140000 pid=5270 execve guuid=42f1a786-1900-0000-e5df-2e9e97140000 pid=5271 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=42f1a786-1900-0000-e5df-2e9e97140000 pid=5271 execve guuid=904a1387-1900-0000-e5df-2e9e98140000 pid=5272 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=904a1387-1900-0000-e5df-2e9e98140000 pid=5272 execve guuid=31807a87-1900-0000-e5df-2e9e99140000 pid=5273 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=31807a87-1900-0000-e5df-2e9e99140000 pid=5273 execve guuid=73a0e287-1900-0000-e5df-2e9e9a140000 pid=5274 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=73a0e287-1900-0000-e5df-2e9e9a140000 pid=5274 execve guuid=ebe45088-1900-0000-e5df-2e9e9b140000 pid=5275 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=ebe45088-1900-0000-e5df-2e9e9b140000 pid=5275 execve guuid=ae0db489-1900-0000-e5df-2e9e9c140000 pid=5276 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=ae0db489-1900-0000-e5df-2e9e9c140000 pid=5276 execve guuid=ad6a738a-1900-0000-e5df-2e9e9d140000 pid=5277 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=ad6a738a-1900-0000-e5df-2e9e9d140000 pid=5277 execve guuid=5199298b-1900-0000-e5df-2e9e9e140000 pid=5278 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=5199298b-1900-0000-e5df-2e9e9e140000 pid=5278 execve guuid=8a50db8b-1900-0000-e5df-2e9e9f140000 pid=5279 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=8a50db8b-1900-0000-e5df-2e9e9f140000 pid=5279 execve guuid=fafc7f8c-1900-0000-e5df-2e9ea0140000 pid=5280 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=fafc7f8c-1900-0000-e5df-2e9ea0140000 pid=5280 execve guuid=9ac3188d-1900-0000-e5df-2e9ea1140000 pid=5281 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=9ac3188d-1900-0000-e5df-2e9ea1140000 pid=5281 execve guuid=d38bad8d-1900-0000-e5df-2e9ea2140000 pid=5282 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=d38bad8d-1900-0000-e5df-2e9ea2140000 pid=5282 execve guuid=e4c8338e-1900-0000-e5df-2e9ea3140000 pid=5283 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=e4c8338e-1900-0000-e5df-2e9ea3140000 pid=5283 execve guuid=3553b48e-1900-0000-e5df-2e9ea4140000 pid=5284 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=3553b48e-1900-0000-e5df-2e9ea4140000 pid=5284 execve guuid=410c398f-1900-0000-e5df-2e9ea5140000 pid=5285 /usr/bin/ls guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=410c398f-1900-0000-e5df-2e9ea5140000 pid=5285 execve guuid=c878b18f-1900-0000-e5df-2e9ea6140000 pid=5286 /usr/bin/rm guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=c878b18f-1900-0000-e5df-2e9ea6140000 pid=5286 execve guuid=466e0090-1900-0000-e5df-2e9ea7140000 pid=5287 /usr/bin/wget net send-data write-file guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=466e0090-1900-0000-e5df-2e9ea7140000 pid=5287 execve guuid=f1d909aa-1900-0000-e5df-2e9ea8140000 pid=5288 /usr/bin/chmod guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=f1d909aa-1900-0000-e5df-2e9ea8140000 pid=5288 execve guuid=19535aaa-1900-0000-e5df-2e9ea9140000 pid=5289 /usr/bin/dash guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=19535aaa-1900-0000-e5df-2e9ea9140000 pid=5289 clone guuid=343601ab-1900-0000-e5df-2e9eab140000 pid=5291 /usr/bin/rm guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=343601ab-1900-0000-e5df-2e9eab140000 pid=5291 execve guuid=080f4aab-1900-0000-e5df-2e9eac140000 pid=5292 /usr/bin/wget net send-data write-file guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=080f4aab-1900-0000-e5df-2e9eac140000 pid=5292 execve guuid=334ed2c3-1900-0000-e5df-2e9ead140000 pid=5293 /usr/bin/chmod guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=334ed2c3-1900-0000-e5df-2e9ead140000 pid=5293 execve guuid=d6de84c4-1900-0000-e5df-2e9eae140000 pid=5294 /usr/bin/dash guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=d6de84c4-1900-0000-e5df-2e9eae140000 pid=5294 clone guuid=267d67c6-1900-0000-e5df-2e9eb0140000 pid=5296 /usr/bin/rm guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=267d67c6-1900-0000-e5df-2e9eb0140000 pid=5296 execve guuid=5377a7c6-1900-0000-e5df-2e9eb1140000 pid=5297 /usr/bin/wget net send-data write-file guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=5377a7c6-1900-0000-e5df-2e9eb1140000 pid=5297 execve guuid=c89d91df-1900-0000-e5df-2e9eb2140000 pid=5298 /usr/bin/chmod guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=c89d91df-1900-0000-e5df-2e9eb2140000 pid=5298 execve guuid=31cde2df-1900-0000-e5df-2e9eb3140000 pid=5299 /usr/bin/dash guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=31cde2df-1900-0000-e5df-2e9eb3140000 pid=5299 clone guuid=98fb7fe0-1900-0000-e5df-2e9eb5140000 pid=5301 /usr/bin/rm guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=98fb7fe0-1900-0000-e5df-2e9eb5140000 pid=5301 execve guuid=57ecbde0-1900-0000-e5df-2e9eb6140000 pid=5302 /usr/bin/wget net send-data write-file guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=57ecbde0-1900-0000-e5df-2e9eb6140000 pid=5302 execve guuid=275bf9fd-1900-0000-e5df-2e9eb7140000 pid=5303 /usr/bin/chmod guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=275bf9fd-1900-0000-e5df-2e9eb7140000 pid=5303 execve guuid=d0f1a1fe-1900-0000-e5df-2e9eb8140000 pid=5304 /usr/bin/dash guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=d0f1a1fe-1900-0000-e5df-2e9eb8140000 pid=5304 clone guuid=cb7b3fff-1900-0000-e5df-2e9eba140000 pid=5306 /usr/bin/rm guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=cb7b3fff-1900-0000-e5df-2e9eba140000 pid=5306 execve guuid=42ce83ff-1900-0000-e5df-2e9ebb140000 pid=5307 /usr/bin/wget net send-data write-file guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=42ce83ff-1900-0000-e5df-2e9ebb140000 pid=5307 execve guuid=747f491e-1a00-0000-e5df-2e9ec3140000 pid=5315 /usr/bin/chmod guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=747f491e-1a00-0000-e5df-2e9ec3140000 pid=5315 execve guuid=cf1b1b1f-1a00-0000-e5df-2e9ec4140000 pid=5316 /usr/bin/dash guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=cf1b1b1f-1a00-0000-e5df-2e9ec4140000 pid=5316 clone guuid=0980de20-1a00-0000-e5df-2e9ec6140000 pid=5318 /usr/bin/rm delete-file guuid=fe2e9655-1900-0000-e5df-2e9e2e140000 pid=5166->guuid=0980de20-1a00-0000-e5df-2e9ec6140000 pid=5318 execve 801186e6-5fe8-5959-a7b4-832d8d66e7aa 129.121.114.124:80 guuid=466e0090-1900-0000-e5df-2e9ea7140000 pid=5287->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 134B guuid=080f4aab-1900-0000-e5df-2e9eac140000 pid=5292->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 133B guuid=5377a7c6-1900-0000-e5df-2e9eb1140000 pid=5297->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 133B guuid=57ecbde0-1900-0000-e5df-2e9eb6140000 pid=5302->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 134B guuid=42ce83ff-1900-0000-e5df-2e9ebb140000 pid=5307->801186e6-5fe8-5959-a7b4-832d8d66e7aa send: 133B
Score:
98%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/dd09d1fc879642e9b72ac07680a36a9f0b18cf31f8283295e7bc9c2456ff54bb
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/dd09d1fc879642e9b72ac07680a36a9f0b18cf31f8283295e7bc9c2456ff54bb/
Verdict:
Malicious
Threat:
Family.MIRAI
Link:
https://tip.neiki.dev/file/dd09d1fc879642e9b72ac07680a36a9f0b18cf31f8283295e7bc9c2456ff54bb
Threat name:
Win32.Trojan.Vigorf
Create hunting rule
Status:
Malicious
First seen:
2026-06-21 15:46:37 UTC
File Type:
Text (Shell)
AV detection:
13 of 24 (54.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3ue5d7ehszbotnzkyb3ibi3kt4frrtzr7audffphxsocivx7ks5q._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
discovery linux
Link:
https://tria.ge/reports/260621-s7ekdaey5t/
Behaviour
Reads runtime system information
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.26
Link:
https://yomi.yoroi.company/submissions/dd09d1fc879642e9b72ac07680a36a9f0b18cf31f8283295e7bc9c2456ff54bb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh dd09d1fc879642e9b72ac07680a36a9f0b18cf31f8283295e7bc9c2456ff54bb

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3866369/
  
Delivery method
Distributed via web download

Comments