MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f0a9dbf239d869284ff202ba61c925b9e048489130919071b0841edcddff62ba. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f0a9dbf239d869284ff202ba61c925b9e048489130919071b0841edcddff62ba
SHA3-384 hash: 37c2b6c52bc1666c1b3c2f95f63f4b237e262e8302e55e681e8fa372b93f23202ea8722a01b6f6e8092bfabcbba8c029
SHA1 hash: 85e3b0be8f6de89b0745e53c5b30eea8f11f9e20
MD5 hash: 1982a0a7d49b6b5afcd5eb022462e602
humanhash: spaghetti-delaware-delaware-aspen
File name:k.php
Download: download sample
File size:19'491 bytes
First seen:2026-03-08 20:07:45 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 384:qkncuxOLnVYMScJzsO9a4cbddrME8jyfzsO9a4cbddrME8jy4:qvuQL+cJzsP4cbddr7zsP4cbddrk
TLSH T1A5924CB906497C79BBC0CE799F3C7F0CAEE582C42129E39DBA1F39705A2065DC609359
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh

Intelligence

File Origin
# of uploads :
1
# of downloads :
56
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.MulDrop.187.23683.26676.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive masquerade
Link:
https://www.filescan.io/uploads/69add72b97feb4afd6757c48/reports/b4d2180f-8444-41c9-8465-e7cf9c4e3728/overview
Verdict:
Malicious
File Type:
unix shell
Detections:
HEUR:Trojan-Downloader.Shell.Agent.bc
Link:
https://opentip.kaspersky.com/f0a9dbf239d869284ff202ba61c925b9e048489130919071b0841edcddff62ba/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/a90a1687-e839-4b5a-8045-3ffa984c8ae8
Behavior Graph:
Download SVG
%3 guuid=161aa589-1a00-0000-ffd9-d2bde6080000 pid=2278 /usr/bin/sudo guuid=a4990f8d-1a00-0000-ffd9-d2bde8080000 pid=2280 /tmp/sample.bin guuid=161aa589-1a00-0000-ffd9-d2bde6080000 pid=2278->guuid=a4990f8d-1a00-0000-ffd9-d2bde8080000 pid=2280 execve guuid=1740008e-1a00-0000-ffd9-d2bde9080000 pid=2281 /usr/bin/bash guuid=a4990f8d-1a00-0000-ffd9-d2bde8080000 pid=2280->guuid=1740008e-1a00-0000-ffd9-d2bde9080000 pid=2281 clone guuid=49260a8e-1a00-0000-ffd9-d2bdea080000 pid=2282 /usr/bin/bash guuid=a4990f8d-1a00-0000-ffd9-d2bde8080000 pid=2280->guuid=49260a8e-1a00-0000-ffd9-d2bdea080000 pid=2282 clone guuid=31d66a8e-1a00-0000-ffd9-d2bdeb080000 pid=2283 /usr/bin/mkdir guuid=a4990f8d-1a00-0000-ffd9-d2bde8080000 pid=2280->guuid=31d66a8e-1a00-0000-ffd9-d2bdeb080000 pid=2283 execve guuid=1e8d0c8f-1a00-0000-ffd9-d2bdee080000 pid=2286 /usr/bin/mkdir guuid=a4990f8d-1a00-0000-ffd9-d2bde8080000 pid=2280->guuid=1e8d0c8f-1a00-0000-ffd9-d2bdee080000 pid=2286 execve guuid=3547858f-1a00-0000-ffd9-d2bdef080000 pid=2287 /usr/bin/mkdir guuid=a4990f8d-1a00-0000-ffd9-d2bde8080000 pid=2280->guuid=3547858f-1a00-0000-ffd9-d2bdef080000 pid=2287 execve guuid=edf8db8f-1a00-0000-ffd9-d2bdf2080000 pid=2290 /usr/bin/mkdir guuid=a4990f8d-1a00-0000-ffd9-d2bde8080000 pid=2280->guuid=edf8db8f-1a00-0000-ffd9-d2bdf2080000 pid=2290 execve guuid=e9df6d90-1a00-0000-ffd9-d2bdf5080000 pid=2293 /usr/bin/mkdir guuid=a4990f8d-1a00-0000-ffd9-d2bde8080000 pid=2280->guuid=e9df6d90-1a00-0000-ffd9-d2bdf5080000 pid=2293 execve guuid=1250d590-1a00-0000-ffd9-d2bdf7080000 pid=2295 /usr/bin/mkdir guuid=a4990f8d-1a00-0000-ffd9-d2bde8080000 pid=2280->guuid=1250d590-1a00-0000-ffd9-d2bdf7080000 pid=2295 execve guuid=7b573291-1a00-0000-ffd9-d2bdf9080000 pid=2297 /usr/bin/mkdir guuid=a4990f8d-1a00-0000-ffd9-d2bde8080000 pid=2280->guuid=7b573291-1a00-0000-ffd9-d2bdf9080000 pid=2297 execve guuid=69e0ea91-1a00-0000-ffd9-d2bdfb080000 pid=2299 /usr/bin/cp guuid=a4990f8d-1a00-0000-ffd9-d2bde8080000 pid=2280->guuid=69e0ea91-1a00-0000-ffd9-d2bdfb080000 pid=2299 execve guuid=88d97192-1a00-0000-ffd9-d2bdfd080000 pid=2301 /usr/bin/cp guuid=a4990f8d-1a00-0000-ffd9-d2bde8080000 pid=2280->guuid=88d97192-1a00-0000-ffd9-d2bdfd080000 pid=2301 execve guuid=abb3de92-1a00-0000-ffd9-d2bdff080000 pid=2303 /usr/bin/cp guuid=a4990f8d-1a00-0000-ffd9-d2bde8080000 pid=2280->guuid=abb3de92-1a00-0000-ffd9-d2bdff080000 pid=2303 execve guuid=2a006293-1a00-0000-ffd9-d2bd00090000 pid=2304 /usr/bin/cp guuid=a4990f8d-1a00-0000-ffd9-d2bde8080000 pid=2280->guuid=2a006293-1a00-0000-ffd9-d2bd00090000 pid=2304 execve guuid=d57de293-1a00-0000-ffd9-d2bd03090000 pid=2307 /usr/bin/cp guuid=a4990f8d-1a00-0000-ffd9-d2bde8080000 pid=2280->guuid=d57de293-1a00-0000-ffd9-d2bd03090000 pid=2307 execve guuid=64a46f94-1a00-0000-ffd9-d2bd05090000 pid=2309 /usr/bin/cp guuid=a4990f8d-1a00-0000-ffd9-d2bde8080000 pid=2280->guuid=64a46f94-1a00-0000-ffd9-d2bd05090000 pid=2309 execve guuid=76220995-1a00-0000-ffd9-d2bd08090000 pid=2312 /usr/bin/cp guuid=a4990f8d-1a00-0000-ffd9-d2bde8080000 pid=2280->guuid=76220995-1a00-0000-ffd9-d2bd08090000 pid=2312 execve guuid=c8438995-1a00-0000-ffd9-d2bd0a090000 pid=2314 /usr/bin/cp guuid=a4990f8d-1a00-0000-ffd9-d2bde8080000 pid=2280->guuid=c8438995-1a00-0000-ffd9-d2bd0a090000 pid=2314 execve guuid=c76d1296-1a00-0000-ffd9-d2bd0d090000 pid=2317 /usr/bin/cp guuid=a4990f8d-1a00-0000-ffd9-d2bde8080000 pid=2280->guuid=c76d1296-1a00-0000-ffd9-d2bd0d090000 pid=2317 execve guuid=34caa596-1a00-0000-ffd9-d2bd0f090000 pid=2319 /usr/bin/cp guuid=a4990f8d-1a00-0000-ffd9-d2bde8080000 pid=2280->guuid=34caa596-1a00-0000-ffd9-d2bd0f090000 pid=2319 execve guuid=86784897-1a00-0000-ffd9-d2bd11090000 pid=2321 /usr/bin/cp guuid=a4990f8d-1a00-0000-ffd9-d2bde8080000 pid=2280->guuid=86784897-1a00-0000-ffd9-d2bd11090000 pid=2321 execve guuid=06763898-1a00-0000-ffd9-d2bd13090000 pid=2323 /usr/bin/cp guuid=a4990f8d-1a00-0000-ffd9-d2bde8080000 pid=2280->guuid=06763898-1a00-0000-ffd9-d2bd13090000 pid=2323 execve guuid=709cd198-1a00-0000-ffd9-d2bd15090000 pid=2325 /usr/bin/cp guuid=a4990f8d-1a00-0000-ffd9-d2bde8080000 pid=2280->guuid=709cd198-1a00-0000-ffd9-d2bd15090000 pid=2325 execve guuid=817c9099-1a00-0000-ffd9-d2bd18090000 pid=2328 /usr/bin/cp guuid=a4990f8d-1a00-0000-ffd9-d2bde8080000 pid=2280->guuid=817c9099-1a00-0000-ffd9-d2bd18090000 pid=2328 execve guuid=0324259a-1a00-0000-ffd9-d2bd1b090000 pid=2331 /usr/bin/cp guuid=a4990f8d-1a00-0000-ffd9-d2bde8080000 pid=2280->guuid=0324259a-1a00-0000-ffd9-d2bd1b090000 pid=2331 execve guuid=a278de9a-1a00-0000-ffd9-d2bd1d090000 pid=2333 /usr/bin/touch guuid=a4990f8d-1a00-0000-ffd9-d2bde8080000 pid=2280->guuid=a278de9a-1a00-0000-ffd9-d2bd1d090000 pid=2333 execve guuid=2fb53d9b-1a00-0000-ffd9-d2bd1f090000 pid=2335 /usr/bin/bash guuid=a4990f8d-1a00-0000-ffd9-d2bde8080000 pid=2280->guuid=2fb53d9b-1a00-0000-ffd9-d2bd1f090000 pid=2335 clone guuid=976e469b-1a00-0000-ffd9-d2bd20090000 pid=2336 /usr/bin/bash guuid=a4990f8d-1a00-0000-ffd9-d2bde8080000 pid=2280->guuid=976e469b-1a00-0000-ffd9-d2bd20090000 pid=2336 clone guuid=852b6f9b-1a00-0000-ffd9-d2bd21090000 pid=2337 /usr/bin/bash guuid=a4990f8d-1a00-0000-ffd9-d2bde8080000 pid=2280->guuid=852b6f9b-1a00-0000-ffd9-d2bd21090000 pid=2337 clone guuid=6b1f7b9b-1a00-0000-ffd9-d2bd22090000 pid=2338 /usr/bin/base64 write-file guuid=a4990f8d-1a00-0000-ffd9-d2bde8080000 pid=2280->guuid=6b1f7b9b-1a00-0000-ffd9-d2bd22090000 pid=2338 execve guuid=48a62e9c-1a00-0000-ffd9-d2bd23090000 pid=2339 /usr/bin/bash guuid=a4990f8d-1a00-0000-ffd9-d2bde8080000 pid=2280->guuid=48a62e9c-1a00-0000-ffd9-d2bd23090000 pid=2339 execve guuid=ded1c6a4-1a00-0000-ffd9-d2bd40090000 pid=2368 /usr/bin/rm delete-file guuid=a4990f8d-1a00-0000-ffd9-d2bde8080000 pid=2280->guuid=ded1c6a4-1a00-0000-ffd9-d2bd40090000 pid=2368 execve guuid=9af731a5-1a00-0000-ffd9-d2bd43090000 pid=2371 /usr/bin/bash guuid=a4990f8d-1a00-0000-ffd9-d2bde8080000 pid=2280->guuid=9af731a5-1a00-0000-ffd9-d2bd43090000 pid=2371 clone guuid=fb783ca5-1a00-0000-ffd9-d2bd44090000 pid=2372 /usr/bin/bash guuid=a4990f8d-1a00-0000-ffd9-d2bde8080000 pid=2280->guuid=fb783ca5-1a00-0000-ffd9-d2bd44090000 pid=2372 clone guuid=890b6fa5-1a00-0000-ffd9-d2bd45090000 pid=2373 /usr/bin/bash guuid=a4990f8d-1a00-0000-ffd9-d2bde8080000 pid=2280->guuid=890b6fa5-1a00-0000-ffd9-d2bd45090000 pid=2373 execve guuid=6f83e9a5-1a00-0000-ffd9-d2bd47090000 pid=2375 /usr/bin/rm guuid=a4990f8d-1a00-0000-ffd9-d2bde8080000 pid=2280->guuid=6f83e9a5-1a00-0000-ffd9-d2bd47090000 pid=2375 execve guuid=3072a89c-1a00-0000-ffd9-d2bd24090000 pid=2340 /usr/bin/bash guuid=48a62e9c-1a00-0000-ffd9-d2bd23090000 pid=2339->guuid=3072a89c-1a00-0000-ffd9-d2bd24090000 pid=2340 clone guuid=05c4c99c-1a00-0000-ffd9-d2bd25090000 pid=2341 /usr/bin/bash guuid=48a62e9c-1a00-0000-ffd9-d2bd23090000 pid=2339->guuid=05c4c99c-1a00-0000-ffd9-d2bd25090000 pid=2341 clone guuid=3995139d-1a00-0000-ffd9-d2bd26090000 pid=2342 /usr/bin/ls guuid=48a62e9c-1a00-0000-ffd9-d2bd23090000 pid=2339->guuid=3995139d-1a00-0000-ffd9-d2bd26090000 pid=2342 execve guuid=8c31ff9d-1a00-0000-ffd9-d2bd29090000 pid=2345 /usr/bin/cat guuid=48a62e9c-1a00-0000-ffd9-d2bd23090000 pid=2339->guuid=8c31ff9d-1a00-0000-ffd9-d2bd29090000 pid=2345 execve guuid=b5f25d9e-1a00-0000-ffd9-d2bd2a090000 pid=2346 /usr/bin/ls guuid=48a62e9c-1a00-0000-ffd9-d2bd23090000 pid=2339->guuid=b5f25d9e-1a00-0000-ffd9-d2bd2a090000 pid=2346 execve guuid=801e399f-1a00-0000-ffd9-d2bd2d090000 pid=2349 /usr/bin/mkdir guuid=48a62e9c-1a00-0000-ffd9-d2bd23090000 pid=2339->guuid=801e399f-1a00-0000-ffd9-d2bd2d090000 pid=2349 execve guuid=28cbcf9f-1a00-0000-ffd9-d2bd30090000 pid=2352 /usr/bin/mv guuid=48a62e9c-1a00-0000-ffd9-d2bd23090000 pid=2339->guuid=28cbcf9f-1a00-0000-ffd9-d2bd30090000 pid=2352 execve guuid=3faec8a0-1a00-0000-ffd9-d2bd31090000 pid=2353 /usr/bin/bash guuid=48a62e9c-1a00-0000-ffd9-d2bd23090000 pid=2339->guuid=3faec8a0-1a00-0000-ffd9-d2bd31090000 pid=2353 clone guuid=dbb8e8a0-1a00-0000-ffd9-d2bd33090000 pid=2355 /usr/bin/base64 write-file guuid=48a62e9c-1a00-0000-ffd9-d2bd23090000 pid=2339->guuid=dbb8e8a0-1a00-0000-ffd9-d2bd33090000 pid=2355 execve guuid=6d97b0a1-1a00-0000-ffd9-d2bd34090000 pid=2356 /usr/bin/rm delete-file guuid=48a62e9c-1a00-0000-ffd9-d2bd23090000 pid=2339->guuid=6d97b0a1-1a00-0000-ffd9-d2bd34090000 pid=2356 execve guuid=a0511ba2-1a00-0000-ffd9-d2bd35090000 pid=2357 /usr/bin/ls guuid=48a62e9c-1a00-0000-ffd9-d2bd23090000 pid=2339->guuid=a0511ba2-1a00-0000-ffd9-d2bd35090000 pid=2357 execve guuid=1fdc98a2-1a00-0000-ffd9-d2bd36090000 pid=2358 /usr/bin/bash guuid=48a62e9c-1a00-0000-ffd9-d2bd23090000 pid=2339->guuid=1fdc98a2-1a00-0000-ffd9-d2bd36090000 pid=2358 clone guuid=08c2a8a2-1a00-0000-ffd9-d2bd37090000 pid=2359 /usr/bin/base64 write-file guuid=48a62e9c-1a00-0000-ffd9-d2bd23090000 pid=2339->guuid=08c2a8a2-1a00-0000-ffd9-d2bd37090000 pid=2359 execve guuid=9b730ca3-1a00-0000-ffd9-d2bd39090000 pid=2361 /usr/bin/ls guuid=48a62e9c-1a00-0000-ffd9-d2bd23090000 pid=2339->guuid=9b730ca3-1a00-0000-ffd9-d2bd39090000 pid=2361 execve guuid=b1e089a3-1a00-0000-ffd9-d2bd3b090000 pid=2363 /usr/bin/cat guuid=48a62e9c-1a00-0000-ffd9-d2bd23090000 pid=2339->guuid=b1e089a3-1a00-0000-ffd9-d2bd3b090000 pid=2363 execve guuid=7e3200a4-1a00-0000-ffd9-d2bd3e090000 pid=2366 /usr/bin/ls guuid=48a62e9c-1a00-0000-ffd9-d2bd23090000 pid=2339->guuid=7e3200a4-1a00-0000-ffd9-d2bd3e090000 pid=2366 execve
Score:
81%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/f0a9dbf239d869284ff202ba61c925b9e048489130919071b0841edcddff62ba
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f0a9dbf239d869284ff202ba61c925b9e048489130919071b0841edcddff62ba/
Verdict:
Malicious
Threat:
Trojan-Downloader.Shell.Agent
Link:
https://tip.neiki.dev/file/f0a9dbf239d869284ff202ba61c925b9e048489130919071b0841edcddff62ba
Threat name:
Script-Shell.Trojan.Vigorf
Create hunting rule
Status:
Malicious
First seen:
2026-03-08 20:08:16 UTC
File Type:
Text (Shell)
AV detection:
13 of 24 (54.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6cu5x4rz3busqt7sak5gdsjfxhqeqsergciza4nqqqpnzxp7mk5a._file
Result
Malware family:
n/a
Score:
  4/10
Tags:
defense_evasion discovery linux
Link:
https://tria.ge/reports/260308-ywmz9saz7m/
Behaviour
Reads runtime system information
Writes file to tmp directory
Deobfuscate/Decode Files or Information
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SUSP_LNX_Base64_Exec_Apr24
Create hunting rule
Author:Christian Burkard
Description:Detects suspicious base64 encoded shell commands (as seen in Palo Alto CVE-2024-3400 exploitation)
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh f0a9dbf239d869284ff202ba61c925b9e048489130919071b0841edcddff62ba

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3784565/
  
Delivery method
Distributed via web download

Comments