MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ee16bf0a52b4be0bee63c35acf4c0a3db226c0f171074e2b11572d4aa9b9f8bb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ee16bf0a52b4be0bee63c35acf4c0a3db226c0f171074e2b11572d4aa9b9f8bb
SHA3-384 hash: 052f421fd7de9abc09eda30a9ce8eb98cbe42f92cab0f7b8055c93305778ba97e24b5d6dfb22652bce6a0f343e47d305
SHA1 hash: 45f2a9678d069a52694af2bdca4134106eeab0a7
MD5 hash: 7f30b5594a90cf0762b1c88c8c6f1202
humanhash: california-nuts-queen-king
File name:p
Download: download sample
File size:826 bytes
First seen:2026-06-07 13:38:26 UTC
Last seen:2026-06-08 07:13:28 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 12:dOXOsYxcysE+vhCFN0zvy/RQvZowHkarIO4BxIxhsjIckDs/XITV/DI7kauD:kXCKysE2hi0ziQvZoharcuCEkXitAk7
TLSH T1CB01C2DEC111DBA040C5E89E26A75290B810C3CB16564FBC7F8C443E9B79748B156F94
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://188.132.232.81/pkMn/an/aelf ua-wget
http://188.132.232.81/9QPn/an/aelf ua-wget
http://188.132.232.81/bA5on/an/aelf ua-wget
http://188.132.232.81/Jj0n/an/aelf ua-wget
http://188.132.232.81/gGBn/an/aelf ua-wget

Intelligence

File Origin
# of uploads :
4
# of downloads :
47
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.Downloader-35.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive
Link:
https://www.filescan.io/uploads/6a25748e099ef368af25cac1/reports/0fd99c43-3e83-4528-a175-c954dbda4747/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-06-07T10:45:00Z UTC
Last seen:
2026-06-07T10:59:00Z UTC
Hits:
~10
Detections:
HEUR:Trojan-Downloader.Shell.Agent.a
Link:
https://opentip.kaspersky.com/ee16bf0a52b4be0bee63c35acf4c0a3db226c0f171074e2b11572d4aa9b9f8bb/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/14bfeb42-ed63-4721-a28f-aecc1a281587
Behavior Graph:
Download SVG
%3 guuid=d47ab72c-1600-0000-98e4-fc08070e0000 pid=3591 /usr/bin/sudo guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595 /tmp/sample.bin write-file guuid=d47ab72c-1600-0000-98e4-fc08070e0000 pid=3591->guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595 execve guuid=2ab1c92e-1600-0000-98e4-fc080c0e0000 pid=3596 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=2ab1c92e-1600-0000-98e4-fc080c0e0000 pid=3596 execve guuid=fede462f-1600-0000-98e4-fc080e0e0000 pid=3598 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=fede462f-1600-0000-98e4-fc080e0e0000 pid=3598 execve guuid=c696b22f-1600-0000-98e4-fc08100e0000 pid=3600 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=c696b22f-1600-0000-98e4-fc08100e0000 pid=3600 execve guuid=89b31e30-1600-0000-98e4-fc08130e0000 pid=3603 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=89b31e30-1600-0000-98e4-fc08130e0000 pid=3603 execve guuid=41cf8930-1600-0000-98e4-fc08150e0000 pid=3605 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=41cf8930-1600-0000-98e4-fc08150e0000 pid=3605 execve guuid=2386eb30-1600-0000-98e4-fc08170e0000 pid=3607 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=2386eb30-1600-0000-98e4-fc08170e0000 pid=3607 execve guuid=50569631-1600-0000-98e4-fc081b0e0000 pid=3611 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=50569631-1600-0000-98e4-fc081b0e0000 pid=3611 execve guuid=5eb5f231-1600-0000-98e4-fc081d0e0000 pid=3613 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=5eb5f231-1600-0000-98e4-fc081d0e0000 pid=3613 execve guuid=d9d74f32-1600-0000-98e4-fc08210e0000 pid=3617 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=d9d74f32-1600-0000-98e4-fc08210e0000 pid=3617 execve guuid=471fb932-1600-0000-98e4-fc08220e0000 pid=3618 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=471fb932-1600-0000-98e4-fc08220e0000 pid=3618 execve guuid=33fa2633-1600-0000-98e4-fc08230e0000 pid=3619 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=33fa2633-1600-0000-98e4-fc08230e0000 pid=3619 execve guuid=be69ab33-1600-0000-98e4-fc08260e0000 pid=3622 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=be69ab33-1600-0000-98e4-fc08260e0000 pid=3622 execve guuid=90351234-1600-0000-98e4-fc08290e0000 pid=3625 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=90351234-1600-0000-98e4-fc08290e0000 pid=3625 execve guuid=4f1f7a34-1600-0000-98e4-fc082c0e0000 pid=3628 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=4f1f7a34-1600-0000-98e4-fc082c0e0000 pid=3628 execve guuid=6b81f934-1600-0000-98e4-fc08300e0000 pid=3632 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=6b81f934-1600-0000-98e4-fc08300e0000 pid=3632 execve guuid=134e5235-1600-0000-98e4-fc08320e0000 pid=3634 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=134e5235-1600-0000-98e4-fc08320e0000 pid=3634 execve guuid=578e1036-1600-0000-98e4-fc08360e0000 pid=3638 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=578e1036-1600-0000-98e4-fc08360e0000 pid=3638 execve guuid=bf926e36-1600-0000-98e4-fc08390e0000 pid=3641 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=bf926e36-1600-0000-98e4-fc08390e0000 pid=3641 execve guuid=a659d136-1600-0000-98e4-fc083b0e0000 pid=3643 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=a659d136-1600-0000-98e4-fc083b0e0000 pid=3643 execve guuid=46603137-1600-0000-98e4-fc083e0e0000 pid=3646 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=46603137-1600-0000-98e4-fc083e0e0000 pid=3646 execve guuid=36539837-1600-0000-98e4-fc08400e0000 pid=3648 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=36539837-1600-0000-98e4-fc08400e0000 pid=3648 execve guuid=f614f737-1600-0000-98e4-fc08420e0000 pid=3650 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=f614f737-1600-0000-98e4-fc08420e0000 pid=3650 execve guuid=09e67038-1600-0000-98e4-fc08430e0000 pid=3651 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=09e67038-1600-0000-98e4-fc08430e0000 pid=3651 execve guuid=76abeb38-1600-0000-98e4-fc08440e0000 pid=3652 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=76abeb38-1600-0000-98e4-fc08440e0000 pid=3652 execve guuid=c67e4a39-1600-0000-98e4-fc08480e0000 pid=3656 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=c67e4a39-1600-0000-98e4-fc08480e0000 pid=3656 execve guuid=2c0db939-1600-0000-98e4-fc084c0e0000 pid=3660 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=2c0db939-1600-0000-98e4-fc084c0e0000 pid=3660 execve guuid=d0890b3a-1600-0000-98e4-fc084d0e0000 pid=3661 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=d0890b3a-1600-0000-98e4-fc084d0e0000 pid=3661 execve guuid=86cc643a-1600-0000-98e4-fc08500e0000 pid=3664 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=86cc643a-1600-0000-98e4-fc08500e0000 pid=3664 execve guuid=512bbb3a-1600-0000-98e4-fc08520e0000 pid=3666 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=512bbb3a-1600-0000-98e4-fc08520e0000 pid=3666 execve guuid=100f1d3b-1600-0000-98e4-fc08550e0000 pid=3669 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=100f1d3b-1600-0000-98e4-fc08550e0000 pid=3669 execve guuid=1b6b7d3b-1600-0000-98e4-fc08570e0000 pid=3671 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=1b6b7d3b-1600-0000-98e4-fc08570e0000 pid=3671 execve guuid=1794db3b-1600-0000-98e4-fc085a0e0000 pid=3674 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=1794db3b-1600-0000-98e4-fc085a0e0000 pid=3674 execve guuid=b6803c3c-1600-0000-98e4-fc085d0e0000 pid=3677 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=b6803c3c-1600-0000-98e4-fc085d0e0000 pid=3677 execve guuid=a98eaa3c-1600-0000-98e4-fc085f0e0000 pid=3679 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=a98eaa3c-1600-0000-98e4-fc085f0e0000 pid=3679 execve guuid=2d9c0e3d-1600-0000-98e4-fc08630e0000 pid=3683 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=2d9c0e3d-1600-0000-98e4-fc08630e0000 pid=3683 execve guuid=5386813d-1600-0000-98e4-fc08650e0000 pid=3685 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=5386813d-1600-0000-98e4-fc08650e0000 pid=3685 execve guuid=4cf8e63d-1600-0000-98e4-fc08680e0000 pid=3688 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=4cf8e63d-1600-0000-98e4-fc08680e0000 pid=3688 execve guuid=0b764c3e-1600-0000-98e4-fc086a0e0000 pid=3690 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=0b764c3e-1600-0000-98e4-fc086a0e0000 pid=3690 execve guuid=1c70b43e-1600-0000-98e4-fc086c0e0000 pid=3692 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=1c70b43e-1600-0000-98e4-fc086c0e0000 pid=3692 execve guuid=fee11e3f-1600-0000-98e4-fc086e0e0000 pid=3694 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=fee11e3f-1600-0000-98e4-fc086e0e0000 pid=3694 execve guuid=be73983f-1600-0000-98e4-fc086f0e0000 pid=3695 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=be73983f-1600-0000-98e4-fc086f0e0000 pid=3695 execve guuid=7f302740-1600-0000-98e4-fc08700e0000 pid=3696 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=7f302740-1600-0000-98e4-fc08700e0000 pid=3696 execve guuid=387dae40-1600-0000-98e4-fc08710e0000 pid=3697 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=387dae40-1600-0000-98e4-fc08710e0000 pid=3697 execve guuid=5cd82d41-1600-0000-98e4-fc08720e0000 pid=3698 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=5cd82d41-1600-0000-98e4-fc08720e0000 pid=3698 execve guuid=117bb041-1600-0000-98e4-fc08730e0000 pid=3699 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=117bb041-1600-0000-98e4-fc08730e0000 pid=3699 execve guuid=6d702c42-1600-0000-98e4-fc08740e0000 pid=3700 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=6d702c42-1600-0000-98e4-fc08740e0000 pid=3700 execve guuid=fe3fa742-1600-0000-98e4-fc08750e0000 pid=3701 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=fe3fa742-1600-0000-98e4-fc08750e0000 pid=3701 execve guuid=b6441d43-1600-0000-98e4-fc08760e0000 pid=3702 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=b6441d43-1600-0000-98e4-fc08760e0000 pid=3702 execve guuid=64609a43-1600-0000-98e4-fc08770e0000 pid=3703 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=64609a43-1600-0000-98e4-fc08770e0000 pid=3703 execve guuid=e44f1a44-1600-0000-98e4-fc08780e0000 pid=3704 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=e44f1a44-1600-0000-98e4-fc08780e0000 pid=3704 execve guuid=c69c9644-1600-0000-98e4-fc08790e0000 pid=3705 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=c69c9644-1600-0000-98e4-fc08790e0000 pid=3705 execve guuid=d2101845-1600-0000-98e4-fc087a0e0000 pid=3706 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=d2101845-1600-0000-98e4-fc087a0e0000 pid=3706 execve guuid=ab2a9345-1600-0000-98e4-fc087b0e0000 pid=3707 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=ab2a9345-1600-0000-98e4-fc087b0e0000 pid=3707 execve guuid=ff630746-1600-0000-98e4-fc087c0e0000 pid=3708 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=ff630746-1600-0000-98e4-fc087c0e0000 pid=3708 execve guuid=39858b46-1600-0000-98e4-fc087d0e0000 pid=3709 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=39858b46-1600-0000-98e4-fc087d0e0000 pid=3709 execve guuid=90011147-1600-0000-98e4-fc087e0e0000 pid=3710 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=90011147-1600-0000-98e4-fc087e0e0000 pid=3710 execve guuid=fe5c9b47-1600-0000-98e4-fc087f0e0000 pid=3711 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=fe5c9b47-1600-0000-98e4-fc087f0e0000 pid=3711 execve guuid=c1f71c48-1600-0000-98e4-fc08800e0000 pid=3712 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=c1f71c48-1600-0000-98e4-fc08800e0000 pid=3712 execve guuid=e8599e48-1600-0000-98e4-fc08810e0000 pid=3713 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=e8599e48-1600-0000-98e4-fc08810e0000 pid=3713 execve guuid=f2a32049-1600-0000-98e4-fc08820e0000 pid=3714 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=f2a32049-1600-0000-98e4-fc08820e0000 pid=3714 execve guuid=9217a049-1600-0000-98e4-fc08830e0000 pid=3715 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=9217a049-1600-0000-98e4-fc08830e0000 pid=3715 execve guuid=f792254a-1600-0000-98e4-fc08840e0000 pid=3716 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=f792254a-1600-0000-98e4-fc08840e0000 pid=3716 execve guuid=cf51bb4a-1600-0000-98e4-fc08860e0000 pid=3718 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=cf51bb4a-1600-0000-98e4-fc08860e0000 pid=3718 execve guuid=d023244b-1600-0000-98e4-fc08890e0000 pid=3721 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=d023244b-1600-0000-98e4-fc08890e0000 pid=3721 execve guuid=f80e884b-1600-0000-98e4-fc088d0e0000 pid=3725 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=f80e884b-1600-0000-98e4-fc088d0e0000 pid=3725 execve guuid=d68f004c-1600-0000-98e4-fc088e0e0000 pid=3726 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=d68f004c-1600-0000-98e4-fc088e0e0000 pid=3726 execve guuid=37605d4c-1600-0000-98e4-fc08910e0000 pid=3729 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=37605d4c-1600-0000-98e4-fc08910e0000 pid=3729 execve guuid=c788b74c-1600-0000-98e4-fc08930e0000 pid=3731 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=c788b74c-1600-0000-98e4-fc08930e0000 pid=3731 execve guuid=943c0e4d-1600-0000-98e4-fc08950e0000 pid=3733 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=943c0e4d-1600-0000-98e4-fc08950e0000 pid=3733 execve guuid=0eac644d-1600-0000-98e4-fc08980e0000 pid=3736 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=0eac644d-1600-0000-98e4-fc08980e0000 pid=3736 execve guuid=0388c44d-1600-0000-98e4-fc08990e0000 pid=3737 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=0388c44d-1600-0000-98e4-fc08990e0000 pid=3737 execve guuid=96b53e4e-1600-0000-98e4-fc089a0e0000 pid=3738 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=96b53e4e-1600-0000-98e4-fc089a0e0000 pid=3738 execve guuid=8b5eba4e-1600-0000-98e4-fc089b0e0000 pid=3739 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=8b5eba4e-1600-0000-98e4-fc089b0e0000 pid=3739 execve guuid=a5b4394f-1600-0000-98e4-fc089c0e0000 pid=3740 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=a5b4394f-1600-0000-98e4-fc089c0e0000 pid=3740 execve guuid=443eb64f-1600-0000-98e4-fc089d0e0000 pid=3741 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=443eb64f-1600-0000-98e4-fc089d0e0000 pid=3741 execve guuid=d29c3750-1600-0000-98e4-fc089e0e0000 pid=3742 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=d29c3750-1600-0000-98e4-fc089e0e0000 pid=3742 execve guuid=ba58b450-1600-0000-98e4-fc089f0e0000 pid=3743 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=ba58b450-1600-0000-98e4-fc089f0e0000 pid=3743 execve guuid=7bae3251-1600-0000-98e4-fc08a00e0000 pid=3744 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=7bae3251-1600-0000-98e4-fc08a00e0000 pid=3744 execve guuid=03769951-1600-0000-98e4-fc08a40e0000 pid=3748 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=03769951-1600-0000-98e4-fc08a40e0000 pid=3748 execve guuid=940b0e52-1600-0000-98e4-fc08a50e0000 pid=3749 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=940b0e52-1600-0000-98e4-fc08a50e0000 pid=3749 execve guuid=5ac97952-1600-0000-98e4-fc08a90e0000 pid=3753 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=5ac97952-1600-0000-98e4-fc08a90e0000 pid=3753 execve guuid=c7dde252-1600-0000-98e4-fc08aa0e0000 pid=3754 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=c7dde252-1600-0000-98e4-fc08aa0e0000 pid=3754 execve guuid=20b94a53-1600-0000-98e4-fc08ac0e0000 pid=3756 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=20b94a53-1600-0000-98e4-fc08ac0e0000 pid=3756 execve guuid=3275aa53-1600-0000-98e4-fc08ae0e0000 pid=3758 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=3275aa53-1600-0000-98e4-fc08ae0e0000 pid=3758 execve guuid=a08f0654-1600-0000-98e4-fc08b10e0000 pid=3761 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=a08f0654-1600-0000-98e4-fc08b10e0000 pid=3761 execve guuid=908a6754-1600-0000-98e4-fc08b30e0000 pid=3763 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=908a6754-1600-0000-98e4-fc08b30e0000 pid=3763 execve guuid=b7f5bd54-1600-0000-98e4-fc08b60e0000 pid=3766 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=b7f5bd54-1600-0000-98e4-fc08b60e0000 pid=3766 execve guuid=162a1855-1600-0000-98e4-fc08b80e0000 pid=3768 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=162a1855-1600-0000-98e4-fc08b80e0000 pid=3768 execve guuid=d3988355-1600-0000-98e4-fc08b90e0000 pid=3769 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=d3988355-1600-0000-98e4-fc08b90e0000 pid=3769 execve guuid=1f25df55-1600-0000-98e4-fc08bb0e0000 pid=3771 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=1f25df55-1600-0000-98e4-fc08bb0e0000 pid=3771 execve guuid=f1104356-1600-0000-98e4-fc08be0e0000 pid=3774 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=f1104356-1600-0000-98e4-fc08be0e0000 pid=3774 execve guuid=aee19f56-1600-0000-98e4-fc08c00e0000 pid=3776 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=aee19f56-1600-0000-98e4-fc08c00e0000 pid=3776 execve guuid=271af856-1600-0000-98e4-fc08c20e0000 pid=3778 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=271af856-1600-0000-98e4-fc08c20e0000 pid=3778 execve guuid=f2c99c57-1600-0000-98e4-fc08c70e0000 pid=3783 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=f2c99c57-1600-0000-98e4-fc08c70e0000 pid=3783 execve guuid=cd4a0a58-1600-0000-98e4-fc08ca0e0000 pid=3786 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=cd4a0a58-1600-0000-98e4-fc08ca0e0000 pid=3786 execve guuid=cad7dd58-1600-0000-98e4-fc08cf0e0000 pid=3791 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=cad7dd58-1600-0000-98e4-fc08cf0e0000 pid=3791 execve guuid=8d3b5859-1600-0000-98e4-fc08d00e0000 pid=3792 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=8d3b5859-1600-0000-98e4-fc08d00e0000 pid=3792 execve guuid=24e1c659-1600-0000-98e4-fc08d40e0000 pid=3796 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=24e1c659-1600-0000-98e4-fc08d40e0000 pid=3796 execve guuid=c71d2e5a-1600-0000-98e4-fc08d80e0000 pid=3800 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=c71d2e5a-1600-0000-98e4-fc08d80e0000 pid=3800 execve guuid=1ae58f5a-1600-0000-98e4-fc08da0e0000 pid=3802 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=1ae58f5a-1600-0000-98e4-fc08da0e0000 pid=3802 execve guuid=ef59ec5a-1600-0000-98e4-fc08df0e0000 pid=3807 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=ef59ec5a-1600-0000-98e4-fc08df0e0000 pid=3807 execve guuid=c6654d5b-1600-0000-98e4-fc08e00e0000 pid=3808 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=c6654d5b-1600-0000-98e4-fc08e00e0000 pid=3808 execve guuid=cb66af5b-1600-0000-98e4-fc08e40e0000 pid=3812 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=cb66af5b-1600-0000-98e4-fc08e40e0000 pid=3812 execve guuid=d2430b5c-1600-0000-98e4-fc08e70e0000 pid=3815 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=d2430b5c-1600-0000-98e4-fc08e70e0000 pid=3815 execve guuid=d3a7665c-1600-0000-98e4-fc08eb0e0000 pid=3819 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=d3a7665c-1600-0000-98e4-fc08eb0e0000 pid=3819 execve guuid=cac6c15c-1600-0000-98e4-fc08ef0e0000 pid=3823 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=cac6c15c-1600-0000-98e4-fc08ef0e0000 pid=3823 execve guuid=880f195d-1600-0000-98e4-fc08f10e0000 pid=3825 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=880f195d-1600-0000-98e4-fc08f10e0000 pid=3825 execve guuid=7296755d-1600-0000-98e4-fc08f30e0000 pid=3827 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=7296755d-1600-0000-98e4-fc08f30e0000 pid=3827 execve guuid=6eb2cc5d-1600-0000-98e4-fc08f70e0000 pid=3831 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=6eb2cc5d-1600-0000-98e4-fc08f70e0000 pid=3831 execve guuid=1cd5365e-1600-0000-98e4-fc08fb0e0000 pid=3835 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=1cd5365e-1600-0000-98e4-fc08fb0e0000 pid=3835 execve guuid=df4e975e-1600-0000-98e4-fc08fd0e0000 pid=3837 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=df4e975e-1600-0000-98e4-fc08fd0e0000 pid=3837 execve guuid=1f58f15e-1600-0000-98e4-fc08ff0e0000 pid=3839 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=1f58f15e-1600-0000-98e4-fc08ff0e0000 pid=3839 execve guuid=0c634e5f-1600-0000-98e4-fc08030f0000 pid=3843 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=0c634e5f-1600-0000-98e4-fc08030f0000 pid=3843 execve guuid=3ea2ab5f-1600-0000-98e4-fc08070f0000 pid=3847 /usr/bin/ls guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=3ea2ab5f-1600-0000-98e4-fc08070f0000 pid=3847 execve guuid=9c410760-1600-0000-98e4-fc08090f0000 pid=3849 /usr/bin/rm guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=9c410760-1600-0000-98e4-fc08090f0000 pid=3849 execve guuid=39573e60-1600-0000-98e4-fc080b0f0000 pid=3851 /usr/bin/wget net send-data write-file guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=39573e60-1600-0000-98e4-fc080b0f0000 pid=3851 execve guuid=6fad94aa-1600-0000-98e4-fc08d70f0000 pid=4055 /usr/bin/chmod guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=6fad94aa-1600-0000-98e4-fc08d70f0000 pid=4055 execve guuid=a42a17ab-1600-0000-98e4-fc08d80f0000 pid=4056 /usr/bin/dash guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=a42a17ab-1600-0000-98e4-fc08d80f0000 pid=4056 clone guuid=e647deab-1600-0000-98e4-fc08dd0f0000 pid=4061 /usr/bin/rm guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=e647deab-1600-0000-98e4-fc08dd0f0000 pid=4061 execve guuid=bda971ac-1600-0000-98e4-fc08df0f0000 pid=4063 /usr/bin/wget net send-data write-file guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=bda971ac-1600-0000-98e4-fc08df0f0000 pid=4063 execve guuid=63a41bfa-1800-0000-98e4-fc08dd140000 pid=5341 /usr/bin/chmod guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=63a41bfa-1800-0000-98e4-fc08dd140000 pid=5341 execve guuid=438885fa-1800-0000-98e4-fc08de140000 pid=5342 /usr/bin/dash guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=438885fa-1800-0000-98e4-fc08de140000 pid=5342 clone guuid=14790afc-1800-0000-98e4-fc08e0140000 pid=5344 /usr/bin/rm guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=14790afc-1800-0000-98e4-fc08e0140000 pid=5344 execve guuid=bd836dfc-1800-0000-98e4-fc08e1140000 pid=5345 /usr/bin/wget net send-data write-file guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=bd836dfc-1800-0000-98e4-fc08e1140000 pid=5345 execve guuid=fd70dd49-1a00-0000-98e4-fc08e9140000 pid=5353 /usr/bin/chmod guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=fd70dd49-1a00-0000-98e4-fc08e9140000 pid=5353 execve guuid=002f124a-1a00-0000-98e4-fc08ea140000 pid=5354 /usr/bin/dash guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=002f124a-1a00-0000-98e4-fc08ea140000 pid=5354 clone guuid=78598a4a-1a00-0000-98e4-fc08ec140000 pid=5356 /usr/bin/rm guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=78598a4a-1a00-0000-98e4-fc08ec140000 pid=5356 execve guuid=5bd5bc4a-1a00-0000-98e4-fc08ed140000 pid=5357 /usr/bin/wget net send-data write-file guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=5bd5bc4a-1a00-0000-98e4-fc08ed140000 pid=5357 execve guuid=b75a736a-1b00-0000-98e4-fc080e150000 pid=5390 /usr/bin/chmod guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=b75a736a-1b00-0000-98e4-fc080e150000 pid=5390 execve guuid=ee98096b-1b00-0000-98e4-fc080f150000 pid=5391 /usr/bin/dash guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=ee98096b-1b00-0000-98e4-fc080f150000 pid=5391 clone guuid=02ba1e6c-1b00-0000-98e4-fc0811150000 pid=5393 /usr/bin/rm guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=02ba1e6c-1b00-0000-98e4-fc0811150000 pid=5393 execve guuid=8bf8a86c-1b00-0000-98e4-fc0812150000 pid=5394 /usr/bin/wget net send-data write-file guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=8bf8a86c-1b00-0000-98e4-fc0812150000 pid=5394 execve guuid=963290a0-1c00-0000-98e4-fc0813150000 pid=5395 /usr/bin/chmod guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=963290a0-1c00-0000-98e4-fc0813150000 pid=5395 execve guuid=044716a1-1c00-0000-98e4-fc0814150000 pid=5396 /usr/bin/dash guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=044716a1-1c00-0000-98e4-fc0814150000 pid=5396 clone guuid=0d3c4aa2-1c00-0000-98e4-fc0816150000 pid=5398 /usr/bin/rm delete-file guuid=b4c27c2e-1600-0000-98e4-fc080b0e0000 pid=3595->guuid=0d3c4aa2-1c00-0000-98e4-fc0816150000 pid=5398 execve 9554d36e-3083-568e-90da-bb8e3c487b07 188.132.232.81:80 guuid=39573e60-1600-0000-98e4-fc080b0f0000 pid=3851->9554d36e-3083-568e-90da-bb8e3c487b07 send: 132B guuid=bda971ac-1600-0000-98e4-fc08df0f0000 pid=4063->9554d36e-3083-568e-90da-bb8e3c487b07 send: 132B guuid=bd836dfc-1800-0000-98e4-fc08e1140000 pid=5345->9554d36e-3083-568e-90da-bb8e3c487b07 send: 133B guuid=5bd5bc4a-1a00-0000-98e4-fc08ed140000 pid=5357->9554d36e-3083-568e-90da-bb8e3c487b07 send: 132B guuid=8bf8a86c-1b00-0000-98e4-fc0812150000 pid=5394->9554d36e-3083-568e-90da-bb8e3c487b07 send: 132B
Score:
99%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/ee16bf0a52b4be0bee63c35acf4c0a3db226c0f171074e2b11572d4aa9b9f8bb
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ee16bf0a52b4be0bee63c35acf4c0a3db226c0f171074e2b11572d4aa9b9f8bb/
Verdict:
Malicious
Threat:
Trojan-Downloader.Shell.Agent
Link:
https://tip.neiki.dev/file/ee16bf0a52b4be0bee63c35acf4c0a3db226c0f171074e2b11572d4aa9b9f8bb
Threat name:
Win32.Trojan.Vigorf
Create hunting rule
Status:
Malicious
First seen:
2026-06-07 13:39:33 UTC
File Type:
Text (Shell)
AV detection:
12 of 24 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5yll6cssws7ax3tdynnm6takhwzcnqhroedu4kyrk4wuvknz7c5q._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
defense_evasion discovery linux
Link:
https://tria.ge/reports/260607-qx6j1afw5z/
Behaviour
Reads runtime system information
Writes file to tmp directory
Enumerates running processes
File and Directory Permissions Modification
Deletes itself
Executes dropped EXE
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.29
Link:
https://yomi.yoroi.company/submissions/ee16bf0a52b4be0bee63c35acf4c0a3db226c0f171074e2b11572d4aa9b9f8bb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:ach_202412_suspect_bash_script
Create hunting rule
Author:abuse.ch
Description:Detects suspicious Linux bash scripts

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh ee16bf0a52b4be0bee63c35acf4c0a3db226c0f171074e2b11572d4aa9b9f8bb

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3856423/
  
Delivery method
Distributed via web download

Comments