MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dd1176aca0295fe09a65f99db97b9c58e83c75b31d4635c07229aaf18ce278c6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


DDoSAgent


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dd1176aca0295fe09a65f99db97b9c58e83c75b31d4635c07229aaf18ce278c6
SHA3-384 hash: 98a2225359d03c08ad685ea4b49b1f82fb994d9d7d824101bf1edd7a9dc5f18a71f5d617824b166ba7ab5a9d103382ab
SHA1 hash: d2143967325c67d159e8de0d6c5a04229f9d6cc7
MD5 hash: b19347685af6cd79fe65b512c32399f0
humanhash: cardinal-nitrogen-romeo-spaghetti
File name:dl19
Download: download sample
Signature DDoSAgent
Create hunting rule
File size:3'654 bytes
First seen:2025-07-20 18:59:56 UTC
Last seen:Never
File type: sh
MIME type:text/plain
ssdeep 96:yhO4fMEiU5VSXfv9tLi1skhzi7tO5XGM17l:8b
TLSH T16C71B5D902E203005101B60F3BF57B61AEB483E9AE7B8F89FC99C97644B0A54F129F5D
Magika shell
Reporter abuse_ch
Tags:DDOSAgent sh
URLMalware sample (SHA256 hash)SignatureTags
http://31.170.22.205/bins/whisper.armv555d6cc5c314be3c2c988a797eeed584c7844549513e5eb9106a3a266f5c9c527 DDoSAgentDDoSAgent elf
http://31.170.22.205/bins/whisper.armv62b4c87240aaf767982d676933e628f8bf2957c931d906a90c88ccf3a18dc55ce DDoSAgentDDoSAgent elf
http://31.170.22.205/bins/whisper.armv7e97da696893a2a090ac962789c524119aacab5583df1f2074c081295a0f582e3 DDoSAgentDDoSAgent elf
http://31.170.22.205/bins/whisper.aarch6438b7cbe9ff53cec015d67d04da59bcced70fae6c7e1d15baf95abc34035cc862 DDoSAgentDDoSAgent elf
http://31.170.22.205/bins/whisper.aarch64be5b489dfd7395de9106468d7b92374c56d30af994b4ea06be6c77e98ba540cf6a DDoSAgentDDoSAgent elf
http://31.170.22.205/bins/whisper.arcle750d6001350ab65adfd7a9e0fca7560c49fc5d8f6e96939f1bdb630599e5fb902a14 DDoSAgentDDoSAgent elf
http://31.170.22.205/bins/whisper.arclehs381a3c8f2dbd32b05b5dc1c7ebd3b5cdaaf24fb5296978e6061671edca802a41f4 DDoSAgentDDoSAgent elf
http://31.170.22.205/bins/whisper.mips3d0ff85391334a8130b92bf85bb1b760f7f060508a5bfaab3ff7eb9a2ca53b0a DDoSAgentDDoSAgent elf mirai opendir
http://31.170.22.205/bins/whisper.mips64b8c1191781c9feb322cfcacf40f4f1d207a09af4d786e26a7455e8a36afd4a1c DDoSAgentDDoSAgent elf mirai opendir
http://31.170.22.205/bins/whisper.mips64le527a822afceebc65d8926a1dd0c3c97862f3e114db26f104797c58f45a2e609c DDoSAgentDDoSAgent elf mirai opendir
http://31.170.22.205/bins/whisper.mips64len32c6a1cd7348531c4c0db50ecf21f64e444b33a3ff194ed55a467adb938ec22408 DDoSAgentDDoSAgent elf
http://31.170.22.205/bins/whisper.mips64n3290676d5a951bfb339c20472a0d3ff253767268f54be520eb6410522eeba9741e DDoSAgentDDoSAgent elf
http://31.170.22.205/bins/whisper.mipslee479f82af03dd6087f688cd398fc792a6443e362c9a36348ab53a3f6ddc591a2 DDoSAgentDDoSAgent elf mirai opendir
http://31.170.22.205/bins/whisper.riscv3245ca399bc539910e391f87bb398acac0f5c47410acb0d329ea3bf82406b3c189 DDoSAgentDDoSAgent elf
http://31.170.22.205/bins/whisper.riscv6484dbcc96a5ede7cb185d06f1116aee3bbe07e85ab020e86b5d4bfa9dcc6e60e1 DDoSAgentDDoSAgent elf
http://31.170.22.205/bins/whisper.m68kc304b1825bfe337bc1801440ca0bb1cda35aa96672d60952b852a5b2e3255f06 DDoSAgentDDoSAgent elf
http://31.170.22.205/bins/whisper.sh4n/an/aelf
http://31.170.22.205/bins/whisper.i6862ba541b4a6c62619d785852c86d67829118e70a52105ef37f32010aecb64784b DDoSAgentDDoSAgent elf
http://31.170.22.205/bins/whisper.x6411742623bba0e1ca221814a36cd8239be94898c59fcc61c1328a6230a9981219 DDoSAgentDDoSAgent elf mirai opendir
http://31.170.22.205/bins/whisper.powerpc440fp197455fb6ac704dea344ee392427a842c243f6919c6886965b9586424b65e00b DDoSAgentDDoSAgent elf
http://31.170.22.205/bins/whisper.powerpc64e55001033d5f5d215d7df4d05737606f8323406eaeb9c215e1308fe48e77aba6f00f4 DDoSAgentDDoSAgent elf
http://31.170.22.205/bins/whisper.powerpc64e6500a97c72cdfb63586cf2bbf84c6839b38eaf7af1a474d6f5f27af0b11f7140f067 DDoSAgentDDoSAgent elf
http://31.170.22.205/bins/whisper.powerpc64lepower84d5ef555aac80b752223c279e28e49de774e1a68309e426095c52690a105f313 DDoSAgentDDoSAgent elf
http://31.170.22.205/bins/whisper.powerpc64power8e3ed9343357d6cb963060d7908aa2637165f89cf21a4eb8f7538bb2ddb79e54f DDoSAgentDDoSAgent elf
http://31.170.22.205/bins/whisper.powerpce300c395d23e5693047c429dcf68baf9141ee074a578d08d434f6e1ae520374d0c7928 DDoSAgentDDoSAgent elf
http://31.170.22.205/bins/whisper.powerpce500mc189b5636d5a9a46a6ed38a7fdcd6b4f063fd7abc292363ff9ef7ac77852eae49 DDoSAgentDDoSAgent elf
http://31.170.22.205/bins/whisper.sparc25bf2d5845b6d3497bbceeeda40ba99a78e27f8ca88ec2efb690d919b4c5b8f6 DDoSAgentDDoSAgent elf
http://31.170.22.205/bins/whisper.sparc640e7338e304ae5c960e232d80d98edb0a281d03c974ab13c6de4b0596fd0557c9 DDoSAgentDDoSAgent elf
http://31.170.22.205/bins/whisper.armv4n/an/aelf

Intelligence

File Origin
# of uploads :
1
# of downloads :
24
Origin country :
DE DE
Vendor Threat Intelligence
Detection(s):
URLhaus.3462419.UNOFFICIAL
Create hunting rule

URLhaus.3462413.UNOFFICIAL
Create hunting rule

URLhaus.3462403.UNOFFICIAL
Create hunting rule

URLhaus.3462409.UNOFFICIAL
Create hunting rule

URLhaus.3462416.UNOFFICIAL
Create hunting rule

URLhaus.3462399.UNOFFICIAL
Create hunting rule

URLhaus.3462402.UNOFFICIAL
Create hunting rule

URLhaus.3447675.UNOFFICIAL
Create hunting rule

URLhaus.3447676.UNOFFICIAL
Create hunting rule

URLhaus.3447679.UNOFFICIAL
Create hunting rule

URLhaus.3462417.UNOFFICIAL
Create hunting rule

URLhaus.3462395.UNOFFICIAL
Create hunting rule

URLhaus.3447674.UNOFFICIAL
Create hunting rule

URLhaus.3462404.UNOFFICIAL
Create hunting rule

URLhaus.3462410.UNOFFICIAL
Create hunting rule

URLhaus.3462418.UNOFFICIAL
Create hunting rule

URLhaus.3462407.UNOFFICIAL
Create hunting rule

URLhaus.3462397.UNOFFICIAL
Create hunting rule

URLhaus.3447677.UNOFFICIAL
Create hunting rule

URLhaus.3462398.UNOFFICIAL
Create hunting rule

URLhaus.3462400.UNOFFICIAL
Create hunting rule

URLhaus.3462415.UNOFFICIAL
Create hunting rule

URLhaus.3462406.UNOFFICIAL
Create hunting rule

URLhaus.3462405.UNOFFICIAL
Create hunting rule

URLhaus.3462401.UNOFFICIAL
Create hunting rule

URLhaus.3462396.UNOFFICIAL
Create hunting rule

URLhaus.3462412.UNOFFICIAL
Create hunting rule

URLhaus.3462408.UNOFFICIAL
Create hunting rule

URLhaus.3462414.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/687d3cd219132d98488388e7/reports/089a47c1-0533-4f6c-b554-2cfbf4b52ea9/overview
Verdict:
Malicious
Labled as:
Bash.MiraiA.Generic
Link:
https://www.hybrid-analysis.com/sample/dd1176aca0295fe09a65f99db97b9c58e83c75b31d4635c07229aaf18ce278c6
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/6b3574b8-e1db-414f-893f-0564cefaa172
Behavior Graph:
Download SVG
%3 guuid=d7ff1b99-1a00-0000-1a2d-397a950b0000 pid=2965 /usr/bin/sudo guuid=1e48f39a-1a00-0000-1a2d-397a9a0b0000 pid=2970 /tmp/sample.bin guuid=d7ff1b99-1a00-0000-1a2d-397a950b0000 pid=2965->guuid=1e48f39a-1a00-0000-1a2d-397a9a0b0000 pid=2970 execve guuid=616b2c9b-1a00-0000-1a2d-397a9c0b0000 pid=2972 /usr/bin/rm guuid=1e48f39a-1a00-0000-1a2d-397a9a0b0000 pid=2970->guuid=616b2c9b-1a00-0000-1a2d-397a9c0b0000 pid=2972 execve guuid=7d907e9b-1a00-0000-1a2d-397a9d0b0000 pid=2973 /usr/bin/wget net send-data write-file guuid=1e48f39a-1a00-0000-1a2d-397a9a0b0000 pid=2970->guuid=7d907e9b-1a00-0000-1a2d-397a9d0b0000 pid=2973 execve guuid=1bfa0ea9-1a00-0000-1a2d-397ab70b0000 pid=2999 /usr/bin/chmod guuid=1e48f39a-1a00-0000-1a2d-397a9a0b0000 pid=2970->guuid=1bfa0ea9-1a00-0000-1a2d-397ab70b0000 pid=2999 execve guuid=b89a60a9-1a00-0000-1a2d-397ab80b0000 pid=3000 /usr/bin/dash guuid=1e48f39a-1a00-0000-1a2d-397a9a0b0000 pid=2970->guuid=b89a60a9-1a00-0000-1a2d-397ab80b0000 pid=3000 clone guuid=5e9064aa-1a00-0000-1a2d-397abb0b0000 pid=3003 /usr/bin/rm delete-file guuid=1e48f39a-1a00-0000-1a2d-397a9a0b0000 pid=2970->guuid=5e9064aa-1a00-0000-1a2d-397abb0b0000 pid=3003 execve guuid=8a92afaa-1a00-0000-1a2d-397abd0b0000 pid=3005 /usr/bin/wget net send-data write-file guuid=1e48f39a-1a00-0000-1a2d-397a9a0b0000 pid=2970->guuid=8a92afaa-1a00-0000-1a2d-397abd0b0000 pid=3005 execve guuid=f3acb8b6-1a00-0000-1a2d-397add0b0000 pid=3037 /usr/bin/chmod guuid=1e48f39a-1a00-0000-1a2d-397a9a0b0000 pid=2970->guuid=f3acb8b6-1a00-0000-1a2d-397add0b0000 pid=3037 execve guuid=d24d18b7-1a00-0000-1a2d-397adf0b0000 pid=3039 /usr/bin/dash guuid=1e48f39a-1a00-0000-1a2d-397a9a0b0000 pid=2970->guuid=d24d18b7-1a00-0000-1a2d-397adf0b0000 pid=3039 clone guuid=45b3d2b7-1a00-0000-1a2d-397ae30b0000 pid=3043 /usr/bin/rm delete-file guuid=1e48f39a-1a00-0000-1a2d-397a9a0b0000 pid=2970->guuid=45b3d2b7-1a00-0000-1a2d-397ae30b0000 pid=3043 execve guuid=612d27b8-1a00-0000-1a2d-397ae50b0000 pid=3045 /usr/bin/wget net send-data write-file guuid=1e48f39a-1a00-0000-1a2d-397a9a0b0000 pid=2970->guuid=612d27b8-1a00-0000-1a2d-397ae50b0000 pid=3045 execve guuid=45ac6bc4-1a00-0000-1a2d-397a080c0000 pid=3080 /usr/bin/chmod guuid=1e48f39a-1a00-0000-1a2d-397a9a0b0000 pid=2970->guuid=45ac6bc4-1a00-0000-1a2d-397a080c0000 pid=3080 execve guuid=b11dacc4-1a00-0000-1a2d-397a0a0c0000 pid=3082 /usr/bin/dash guuid=1e48f39a-1a00-0000-1a2d-397a9a0b0000 pid=2970->guuid=b11dacc4-1a00-0000-1a2d-397a0a0c0000 pid=3082 clone guuid=39c763c5-1a00-0000-1a2d-397a0d0c0000 pid=3085 /usr/bin/rm delete-file guuid=1e48f39a-1a00-0000-1a2d-397a9a0b0000 pid=2970->guuid=39c763c5-1a00-0000-1a2d-397a0d0c0000 pid=3085 execve guuid=7e9aa0c5-1a00-0000-1a2d-397a0f0c0000 pid=3087 /usr/bin/wget net send-data write-file guuid=1e48f39a-1a00-0000-1a2d-397a9a0b0000 pid=2970->guuid=7e9aa0c5-1a00-0000-1a2d-397a0f0c0000 pid=3087 execve guuid=22f355d4-1a00-0000-1a2d-397a300c0000 pid=3120 /usr/bin/chmod guuid=1e48f39a-1a00-0000-1a2d-397a9a0b0000 pid=2970->guuid=22f355d4-1a00-0000-1a2d-397a300c0000 pid=3120 execve guuid=b7d5b1d4-1a00-0000-1a2d-397a320c0000 pid=3122 /usr/bin/dash guuid=1e48f39a-1a00-0000-1a2d-397a9a0b0000 pid=2970->guuid=b7d5b1d4-1a00-0000-1a2d-397a320c0000 pid=3122 clone guuid=5cea5ad5-1a00-0000-1a2d-397a350c0000 pid=3125 /usr/bin/rm delete-file guuid=1e48f39a-1a00-0000-1a2d-397a9a0b0000 pid=2970->guuid=5cea5ad5-1a00-0000-1a2d-397a350c0000 pid=3125 execve guuid=a861d2d5-1a00-0000-1a2d-397a360c0000 pid=3126 /usr/bin/wget net send-data write-file guuid=1e48f39a-1a00-0000-1a2d-397a9a0b0000 pid=2970->guuid=a861d2d5-1a00-0000-1a2d-397a360c0000 pid=3126 execve guuid=fd9a32e4-1a00-0000-1a2d-397a610c0000 pid=3169 /usr/bin/chmod guuid=1e48f39a-1a00-0000-1a2d-397a9a0b0000 pid=2970->guuid=fd9a32e4-1a00-0000-1a2d-397a610c0000 pid=3169 execve guuid=e17b73e4-1a00-0000-1a2d-397a630c0000 pid=3171 /usr/bin/dash guuid=1e48f39a-1a00-0000-1a2d-397a9a0b0000 pid=2970->guuid=e17b73e4-1a00-0000-1a2d-397a630c0000 pid=3171 clone guuid=7c5f0ce5-1a00-0000-1a2d-397a660c0000 pid=3174 /usr/bin/rm delete-file guuid=1e48f39a-1a00-0000-1a2d-397a9a0b0000 pid=2970->guuid=7c5f0ce5-1a00-0000-1a2d-397a660c0000 pid=3174 execve guuid=5d7485e5-1a00-0000-1a2d-397a680c0000 pid=3176 /usr/bin/wget net send-data write-file guuid=1e48f39a-1a00-0000-1a2d-397a9a0b0000 pid=2970->guuid=5d7485e5-1a00-0000-1a2d-397a680c0000 pid=3176 execve guuid=b625e3f1-1a00-0000-1a2d-397a7c0c0000 pid=3196 /usr/bin/chmod guuid=1e48f39a-1a00-0000-1a2d-397a9a0b0000 pid=2970->guuid=b625e3f1-1a00-0000-1a2d-397a7c0c0000 pid=3196 execve guuid=f78d4cf2-1a00-0000-1a2d-397a7d0c0000 pid=3197 /usr/bin/dash guuid=1e48f39a-1a00-0000-1a2d-397a9a0b0000 pid=2970->guuid=f78d4cf2-1a00-0000-1a2d-397a7d0c0000 pid=3197 clone guuid=4222f7f3-1a00-0000-1a2d-397a7f0c0000 pid=3199 /usr/bin/rm delete-file guuid=1e48f39a-1a00-0000-1a2d-397a9a0b0000 pid=2970->guuid=4222f7f3-1a00-0000-1a2d-397a7f0c0000 pid=3199 execve guuid=9c814af4-1a00-0000-1a2d-397a810c0000 pid=3201 /usr/bin/wget net send-data write-file guuid=1e48f39a-1a00-0000-1a2d-397a9a0b0000 pid=2970->guuid=9c814af4-1a00-0000-1a2d-397a810c0000 pid=3201 execve guuid=370ce600-1b00-0000-1a2d-397a870c0000 pid=3207 /usr/bin/chmod guuid=1e48f39a-1a00-0000-1a2d-397a9a0b0000 pid=2970->guuid=370ce600-1b00-0000-1a2d-397a870c0000 pid=3207 execve guuid=d1495101-1b00-0000-1a2d-397a880c0000 pid=3208 /usr/bin/dash guuid=1e48f39a-1a00-0000-1a2d-397a9a0b0000 pid=2970->guuid=d1495101-1b00-0000-1a2d-397a880c0000 pid=3208 clone guuid=82892802-1b00-0000-1a2d-397a8a0c0000 pid=3210 /usr/bin/rm delete-file guuid=1e48f39a-1a00-0000-1a2d-397a9a0b0000 pid=2970->guuid=82892802-1b00-0000-1a2d-397a8a0c0000 pid=3210 execve guuid=eb889902-1b00-0000-1a2d-397a8b0c0000 pid=3211 /usr/bin/wget net send-data write-file guuid=1e48f39a-1a00-0000-1a2d-397a9a0b0000 pid=2970->guuid=eb889902-1b00-0000-1a2d-397a8b0c0000 pid=3211 execve guuid=a6767911-1b00-0000-1a2d-397aa30c0000 pid=3235 /usr/bin/chmod guuid=1e48f39a-1a00-0000-1a2d-397a9a0b0000 pid=2970->guuid=a6767911-1b00-0000-1a2d-397aa30c0000 pid=3235 execve guuid=9a7cc011-1b00-0000-1a2d-397aa50c0000 pid=3237 /usr/bin/dash guuid=1e48f39a-1a00-0000-1a2d-397a9a0b0000 pid=2970->guuid=9a7cc011-1b00-0000-1a2d-397aa50c0000 pid=3237 clone guuid=8df46812-1b00-0000-1a2d-397aa80c0000 pid=3240 /usr/bin/rm delete-file guuid=1e48f39a-1a00-0000-1a2d-397a9a0b0000 pid=2970->guuid=8df46812-1b00-0000-1a2d-397aa80c0000 pid=3240 execve guuid=8108b012-1b00-0000-1a2d-397aaa0c0000 pid=3242 /usr/bin/wget net send-data write-file guuid=1e48f39a-1a00-0000-1a2d-397a9a0b0000 pid=2970->guuid=8108b012-1b00-0000-1a2d-397aaa0c0000 pid=3242 execve guuid=dfd03b28-1b00-0000-1a2d-397ab50c0000 pid=3253 /usr/bin/chmod guuid=1e48f39a-1a00-0000-1a2d-397a9a0b0000 pid=2970->guuid=dfd03b28-1b00-0000-1a2d-397ab50c0000 pid=3253 execve guuid=efe98c28-1b00-0000-1a2d-397ab70c0000 pid=3255 /usr/bin/dash guuid=1e48f39a-1a00-0000-1a2d-397a9a0b0000 pid=2970->guuid=efe98c28-1b00-0000-1a2d-397ab70c0000 pid=3255 clone guuid=e6bb3929-1b00-0000-1a2d-397ab90c0000 pid=3257 /usr/bin/rm delete-file guuid=1e48f39a-1a00-0000-1a2d-397a9a0b0000 pid=2970->guuid=e6bb3929-1b00-0000-1a2d-397ab90c0000 pid=3257 execve guuid=26638d29-1b00-0000-1a2d-397aba0c0000 pid=3258 /usr/bin/wget net send-data write-file guuid=1e48f39a-1a00-0000-1a2d-397a9a0b0000 pid=2970->guuid=26638d29-1b00-0000-1a2d-397aba0c0000 pid=3258 execve guuid=bd445e3d-1b00-0000-1a2d-397ad10c0000 pid=3281 /usr/bin/chmod guuid=1e48f39a-1a00-0000-1a2d-397a9a0b0000 pid=2970->guuid=bd445e3d-1b00-0000-1a2d-397ad10c0000 pid=3281 execve guuid=9bada63d-1b00-0000-1a2d-397ad30c0000 pid=3283 /usr/bin/dash guuid=1e48f39a-1a00-0000-1a2d-397a9a0b0000 pid=2970->guuid=9bada63d-1b00-0000-1a2d-397ad30c0000 pid=3283 clone guuid=53831a3f-1b00-0000-1a2d-397ad90c0000 pid=3289 /usr/bin/rm delete-file guuid=1e48f39a-1a00-0000-1a2d-397a9a0b0000 pid=2970->guuid=53831a3f-1b00-0000-1a2d-397ad90c0000 pid=3289 execve guuid=1b7a5b3f-1b00-0000-1a2d-397ada0c0000 pid=3290 /usr/bin/wget net send-data write-file guuid=1e48f39a-1a00-0000-1a2d-397a9a0b0000 pid=2970->guuid=1b7a5b3f-1b00-0000-1a2d-397ada0c0000 pid=3290 execve guuid=91f4e24d-1b00-0000-1a2d-397aed0c0000 pid=3309 /usr/bin/chmod guuid=1e48f39a-1a00-0000-1a2d-397a9a0b0000 pid=2970->guuid=91f4e24d-1b00-0000-1a2d-397aed0c0000 pid=3309 execve guuid=c9cd274e-1b00-0000-1a2d-397aee0c0000 pid=3310 /usr/bin/dash guuid=1e48f39a-1a00-0000-1a2d-397a9a0b0000 pid=2970->guuid=c9cd274e-1b00-0000-1a2d-397aee0c0000 pid=3310 clone guuid=c5f5c84e-1b00-0000-1a2d-397af20c0000 pid=3314 /usr/bin/rm delete-file guuid=1e48f39a-1a00-0000-1a2d-397a9a0b0000 pid=2970->guuid=c5f5c84e-1b00-0000-1a2d-397af20c0000 pid=3314 execve guuid=8ce30e4f-1b00-0000-1a2d-397af40c0000 pid=3316 /usr/bin/wget net send-data write-file guuid=1e48f39a-1a00-0000-1a2d-397a9a0b0000 pid=2970->guuid=8ce30e4f-1b00-0000-1a2d-397af40c0000 pid=3316 execve guuid=fa0d485e-1b00-0000-1a2d-397a150d0000 pid=3349 /usr/bin/chmod guuid=1e48f39a-1a00-0000-1a2d-397a9a0b0000 pid=2970->guuid=fa0d485e-1b00-0000-1a2d-397a150d0000 pid=3349 execve guuid=4f9f905e-1b00-0000-1a2d-397a160d0000 pid=3350 /usr/bin/dash guuid=1e48f39a-1a00-0000-1a2d-397a9a0b0000 pid=2970->guuid=4f9f905e-1b00-0000-1a2d-397a160d0000 pid=3350 clone guuid=61654160-1b00-0000-1a2d-397a1d0d0000 pid=3357 /usr/bin/rm delete-file guuid=1e48f39a-1a00-0000-1a2d-397a9a0b0000 pid=2970->guuid=61654160-1b00-0000-1a2d-397a1d0d0000 pid=3357 execve guuid=a9507d60-1b00-0000-1a2d-397a1e0d0000 pid=3358 /usr/bin/wget net send-data write-file guuid=1e48f39a-1a00-0000-1a2d-397a9a0b0000 pid=2970->guuid=a9507d60-1b00-0000-1a2d-397a1e0d0000 pid=3358 execve guuid=2e202a71-1b00-0000-1a2d-397a3a0d0000 pid=3386 /usr/bin/chmod guuid=1e48f39a-1a00-0000-1a2d-397a9a0b0000 pid=2970->guuid=2e202a71-1b00-0000-1a2d-397a3a0d0000 pid=3386 execve guuid=80cadc71-1b00-0000-1a2d-397a3b0d0000 pid=3387 /usr/bin/dash guuid=1e48f39a-1a00-0000-1a2d-397a9a0b0000 pid=2970->guuid=80cadc71-1b00-0000-1a2d-397a3b0d0000 pid=3387 clone guuid=825a2373-1b00-0000-1a2d-397a3d0d0000 pid=3389 /usr/bin/rm delete-file guuid=1e48f39a-1a00-0000-1a2d-397a9a0b0000 pid=2970->guuid=825a2373-1b00-0000-1a2d-397a3d0d0000 pid=3389 execve guuid=15f6c573-1b00-0000-1a2d-397a3e0d0000 pid=3390 /usr/bin/wget net send-data write-file guuid=1e48f39a-1a00-0000-1a2d-397a9a0b0000 pid=2970->guuid=15f6c573-1b00-0000-1a2d-397a3e0d0000 pid=3390 execve guuid=e8ca9c82-1b00-0000-1a2d-397a5b0d0000 pid=3419 /usr/bin/chmod guuid=1e48f39a-1a00-0000-1a2d-397a9a0b0000 pid=2970->guuid=e8ca9c82-1b00-0000-1a2d-397a5b0d0000 pid=3419 execve guuid=f1ef2383-1b00-0000-1a2d-397a5d0d0000 pid=3421 /usr/bin/dash guuid=1e48f39a-1a00-0000-1a2d-397a9a0b0000 pid=2970->guuid=f1ef2383-1b00-0000-1a2d-397a5d0d0000 pid=3421 clone guuid=485dc783-1b00-0000-1a2d-397a600d0000 pid=3424 /usr/bin/rm delete-file guuid=1e48f39a-1a00-0000-1a2d-397a9a0b0000 pid=2970->guuid=485dc783-1b00-0000-1a2d-397a600d0000 pid=3424 execve guuid=3c7b0384-1b00-0000-1a2d-397a620d0000 pid=3426 /usr/bin/wget net send-data write-file guuid=1e48f39a-1a00-0000-1a2d-397a9a0b0000 pid=2970->guuid=3c7b0384-1b00-0000-1a2d-397a620d0000 pid=3426 execve guuid=38ca8192-1b00-0000-1a2d-397a830d0000 pid=3459 /usr/bin/chmod guuid=1e48f39a-1a00-0000-1a2d-397a9a0b0000 pid=2970->guuid=38ca8192-1b00-0000-1a2d-397a830d0000 pid=3459 execve guuid=8e7a3993-1b00-0000-1a2d-397a860d0000 pid=3462 /usr/bin/dash guuid=1e48f39a-1a00-0000-1a2d-397a9a0b0000 pid=2970->guuid=8e7a3993-1b00-0000-1a2d-397a860d0000 pid=3462 clone guuid=28f81f95-1b00-0000-1a2d-397a8e0d0000 pid=3470 /usr/bin/rm delete-file guuid=1e48f39a-1a00-0000-1a2d-397a9a0b0000 pid=2970->guuid=28f81f95-1b00-0000-1a2d-397a8e0d0000 pid=3470 execve guuid=590b8195-1b00-0000-1a2d-397a900d0000 pid=3472 /usr/bin/wget net send-data write-file guuid=1e48f39a-1a00-0000-1a2d-397a9a0b0000 pid=2970->guuid=590b8195-1b00-0000-1a2d-397a900d0000 pid=3472 execve guuid=dcdbf4a0-1b00-0000-1a2d-397ab00d0000 pid=3504 /usr/bin/chmod guuid=1e48f39a-1a00-0000-1a2d-397a9a0b0000 pid=2970->guuid=dcdbf4a0-1b00-0000-1a2d-397ab00d0000 pid=3504 execve guuid=e1cd51a1-1b00-0000-1a2d-397ab20d0000 pid=3506 /usr/bin/dash guuid=1e48f39a-1a00-0000-1a2d-397a9a0b0000 pid=2970->guuid=e1cd51a1-1b00-0000-1a2d-397ab20d0000 pid=3506 clone guuid=6dc5fea1-1b00-0000-1a2d-397ab50d0000 pid=3509 /usr/bin/rm delete-file guuid=1e48f39a-1a00-0000-1a2d-397a9a0b0000 pid=2970->guuid=6dc5fea1-1b00-0000-1a2d-397ab50d0000 pid=3509 execve guuid=baf25aa2-1b00-0000-1a2d-397ab70d0000 pid=3511 /usr/bin/wget net send-data write-file guuid=1e48f39a-1a00-0000-1a2d-397a9a0b0000 pid=2970->guuid=baf25aa2-1b00-0000-1a2d-397ab70d0000 pid=3511 execve guuid=a40edeb1-1b00-0000-1a2d-397ae30d0000 pid=3555 /usr/bin/chmod guuid=1e48f39a-1a00-0000-1a2d-397a9a0b0000 pid=2970->guuid=a40edeb1-1b00-0000-1a2d-397ae30d0000 pid=3555 execve guuid=f0a825b2-1b00-0000-1a2d-397ae50d0000 pid=3557 /usr/bin/dash guuid=1e48f39a-1a00-0000-1a2d-397a9a0b0000 pid=2970->guuid=f0a825b2-1b00-0000-1a2d-397ae50d0000 pid=3557 clone guuid=e92834b3-1b00-0000-1a2d-397aea0d0000 pid=3562 /usr/bin/rm delete-file guuid=1e48f39a-1a00-0000-1a2d-397a9a0b0000 pid=2970->guuid=e92834b3-1b00-0000-1a2d-397aea0d0000 pid=3562 execve guuid=b7429cb3-1b00-0000-1a2d-397aed0d0000 pid=3565 /usr/bin/wget net send-data write-file guuid=1e48f39a-1a00-0000-1a2d-397a9a0b0000 pid=2970->guuid=b7429cb3-1b00-0000-1a2d-397aed0d0000 pid=3565 execve guuid=31cf47bf-1b00-0000-1a2d-397aff0d0000 pid=3583 /usr/bin/chmod guuid=1e48f39a-1a00-0000-1a2d-397a9a0b0000 pid=2970->guuid=31cf47bf-1b00-0000-1a2d-397aff0d0000 pid=3583 execve guuid=55fda7bf-1b00-0000-1a2d-397a010e0000 pid=3585 /tmp/whisper.i686 net send-data guuid=1e48f39a-1a00-0000-1a2d-397a9a0b0000 pid=2970->guuid=55fda7bf-1b00-0000-1a2d-397a010e0000 pid=3585 execve 4466a7ec-d357-5dbd-9f7f-c7e61f48c387 31.170.22.205:80 guuid=7d907e9b-1a00-0000-1a2d-397a9d0b0000 pid=2973->4466a7ec-d357-5dbd-9f7f-c7e61f48c387 send: 146B guuid=8a92afaa-1a00-0000-1a2d-397abd0b0000 pid=3005->4466a7ec-d357-5dbd-9f7f-c7e61f48c387 send: 146B guuid=612d27b8-1a00-0000-1a2d-397ae50b0000 pid=3045->4466a7ec-d357-5dbd-9f7f-c7e61f48c387 send: 146B guuid=7e9aa0c5-1a00-0000-1a2d-397a0f0c0000 pid=3087->4466a7ec-d357-5dbd-9f7f-c7e61f48c387 send: 148B guuid=a861d2d5-1a00-0000-1a2d-397a360c0000 pid=3126->4466a7ec-d357-5dbd-9f7f-c7e61f48c387 send: 150B guuid=5d7485e5-1a00-0000-1a2d-397a680c0000 pid=3176->4466a7ec-d357-5dbd-9f7f-c7e61f48c387 send: 150B guuid=9c814af4-1a00-0000-1a2d-397a810c0000 pid=3201->4466a7ec-d357-5dbd-9f7f-c7e61f48c387 send: 150B guuid=eb889902-1b00-0000-1a2d-397a8b0c0000 pid=3211->4466a7ec-d357-5dbd-9f7f-c7e61f48c387 send: 145B guuid=8108b012-1b00-0000-1a2d-397aaa0c0000 pid=3242->4466a7ec-d357-5dbd-9f7f-c7e61f48c387 send: 147B guuid=26638d29-1b00-0000-1a2d-397aba0c0000 pid=3258->4466a7ec-d357-5dbd-9f7f-c7e61f48c387 send: 149B guuid=1b7a5b3f-1b00-0000-1a2d-397ada0c0000 pid=3290->4466a7ec-d357-5dbd-9f7f-c7e61f48c387 send: 152B guuid=8ce30e4f-1b00-0000-1a2d-397af40c0000 pid=3316->4466a7ec-d357-5dbd-9f7f-c7e61f48c387 send: 150B guuid=a9507d60-1b00-0000-1a2d-397a1e0d0000 pid=3358->4466a7ec-d357-5dbd-9f7f-c7e61f48c387 send: 147B guuid=15f6c573-1b00-0000-1a2d-397a3e0d0000 pid=3390->4466a7ec-d357-5dbd-9f7f-c7e61f48c387 send: 148B guuid=3c7b0384-1b00-0000-1a2d-397a620d0000 pid=3426->4466a7ec-d357-5dbd-9f7f-c7e61f48c387 send: 148B guuid=590b8195-1b00-0000-1a2d-397a900d0000 pid=3472->4466a7ec-d357-5dbd-9f7f-c7e61f48c387 send: 145B guuid=baf25aa2-1b00-0000-1a2d-397ab70d0000 pid=3511->4466a7ec-d357-5dbd-9f7f-c7e61f48c387 send: 144B guuid=b7429cb3-1b00-0000-1a2d-397aed0d0000 pid=3565->4466a7ec-d357-5dbd-9f7f-c7e61f48c387 send: 145B guuid=55fda7bf-1b00-0000-1a2d-397a010e0000 pid=3585->4466a7ec-d357-5dbd-9f7f-c7e61f48c387 send: 139B
Score:
98%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/dd1176aca0295fe09a65f99db97b9c58e83c75b31d4635c07229aaf18ce278c6
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/dd1176aca0295fe09a65f99db97b9c58e83c75b31d4635c07229aaf18ce278c6/
Threat name:
Script-Shell.Trojan.Vigorf
Create hunting rule
Status:
Malicious
First seen:
2025-07-21 01:24:00 UTC
File Type:
Text (Shell)
AV detection:
10 of 23 (43.48%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3uixnlfaffp6bgtf7go3s644ldudy5ntdvddlqdsfgvpddhcpdda._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/dd1176aca0295fe09a65f99db97b9c58e83c75b31d4635c07229aaf18ce278c6

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

DDoSAgent

sh dd1176aca0295fe09a65f99db97b9c58e83c75b31d4635c07229aaf18ce278c6

(this sample)

DDoSAgent

elf 55d6cc5c314be3c2c988a797eeed584c7844549513e5eb9106a3a266f5c9c527

  
URLhaus
https://urlhaus.abuse.ch/url/3487069/
  
Delivery method
Distributed via web download
  
Dropping
MD5 2f4c13a8e22bcca551ce49a5b20245af
  
Dropping
SHA256 55d6cc5c314be3c2c988a797eeed584c7844549513e5eb9106a3a266f5c9c527

Comments