i.sh
Classification: Malicious
i.sh is a trojan. Detected by 37 antivirus engines. Linked to Kinsing malware. 10 sightings from MalwareBazaar Abuse.ch and Triage, last seen 2026-10-14.
Detection summary
- 37 antivirus detections
- 0 IDS alerts
- 0 processes observed
- 0 contacted hosts
- 0 DNS requests
MITRE ATT&CK associations
Malware families: KINSING (S0599)
Blacklist sightings
| Description | Source | First seen | Last seen | Labels | MITRE ATT&CK |
|---|---|---|---|---|---|
| Kinsing | Triage | 2026-03-27 13:50:16 | 2026-10-14 06:28:00 | malicious-activity | S0599 Kinsing |
| Xmrig | Triage | 2026-04-04 00:17:22 | 2026-04-04 00:17:22 | malicious-activity | |
| Kinsing | MalwareBazaar Abuse.ch | 2026-03-27 13:50:00 | 2026-03-27 13:50:00 | malicious-activity | S0599 Kinsing |
Tags
kinsing kinsing_rootkit antivm defense_evasion discovery exection execution linux loader persistence privilege_escalation rootkit xmrig miner upxSample information
- Filenames
- i.sh
- MD5
a47148c1bbdae60bd90794090403244a- SHA-1
8a36248db97292a825557a077ed75380ae4f3e33- SHA-256
a1e95e92d1b72c00837751bc45ce452dd9c034231def59d7da010a706a9c23f5- First indexed
- 2026-03-27 13:50:00
- Last updated
- 2026-10-14 06:57:44
Antivirus detections
| Engine | Detection |
|---|---|
| ALYac | Generic.Linux.Zojfor.C.D87E3A6F |
| AVG | BV:Agent-BPH [Trj] |
| AhnLab-V3 | Downloader/Shell.Kinsing.S1443 |
| Antiy-AVL | Trojan[Miner]/Shell.CoinMiner |
| Arcabit | Generic.Linux.Zojfor.C.D87E3A6F |
| Avast | BV:Agent-BPH [Trj] |
| Avira | TR/BAT.Agent.BPH |
| BitDefender | Generic.Linux.Zojfor.C.D87E3A6F |
| CTX | shell.trojan.shell |
| ClamAV | Txt.Malware.Sustes-6779550-1 |
| Cynet | Malicious (score: 99) |
| DrWeb | Linux.DownLoader.2306 |
| ESET-NOD32 | Linux/CoinMiner.OO trojan |
| Emsisoft | Generic.Linux.Zojfor.C.D87E3A6F (B) |
| F-Secure | Trojan.TR/BAT.Agent.BPH |
| GData | Generic.Linux.Zojfor.C.D87E3A6F |
| Detected | |
| Kaspersky | HEUR:Trojan-Downloader.Shell.Miner.gen |
| Lionic | Trojan.Script.Zojfor.a!c |
| McAfeeD | ti!A1E95E92D1B7 |
| MicroWorld-eScan | Generic.Linux.Zojfor.C.D87E3A6F |
| Microsoft | Trojan:Linux/CoinMiner.AF!MTB |
| NANO-Antivirus | Trojan.Script.Downloader.ktfuvz |
| Rising | Downloader.Kinsing/BASH!9.66821 (XSE:WFNFX0JBVDq+P7oiLDq1Hdpjqc74heww) |
| Sangfor | Malware.Generic-Script.Save.ba227 |
| Skyhigh | LINUX/Agent.ed |
| Sophos | Troj/Dloadr-EFZ |
| Symantec | JS.Malscript!g1 |
| Tencent | Win32.Trojan.Bash.Dflw |
| TrellixENS | LINUX/Agent.ed |
| TrendMicro | Trojan.SH.CVE20207961.SM |
| TrendMicro-HouseCall | Trojan.SH.CVE20207961.SM |
| VIPRE | Generic.Linux.Zojfor.C.D87E3A6F |
| Varist | ABMiner.VCHM-4 |
| ZoneAlarm | Troj/Dloadr-EFZ |
| alibabacloud | Miner:Linux/CoinMiner.OP |
| huorong | TrojanDownloader/JS.Kdev.a |