MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 08a91019ff7ba6f77de3b774dc201cca18edfd264f9a46e34f243f6d76e37077. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry



Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments

SHA256 hash: 08a91019ff7ba6f77de3b774dc201cca18edfd264f9a46e34f243f6d76e37077
SHA3-384 hash: 456c8ab579d26ad5ef7f9b597a81eaf82d783e0698a3a0a8d5336b316af7a6637ffffabdd839aa20e566d33bb18ad9e8
SHA1 hash: 59669e051d7915e5af98a69aca8716f4fcd95ec2
MD5 hash: 89ccf0e628a266b5764c9602279451a3
humanhash: louisiana-lemon-hot-papa
File name:wr.php
Download: download sample
File size:27'042 bytes
First seen:2026-08-03 00:49:06 UTC
Last seen:2026-08-03 11:30:04 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 768:FQV8vCB+25j6es8R1X9FYpMSUpi+20qUpi+20YQX:W8l25J1xd2QX
TLSH T13FC27D966A867C44BEC98A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11F9CD618B1A
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://160.119.69.4/z/post/noroot.phpn/an/aelf ua-wget

Intelligence


File Origin
# of uploads :
3
# of downloads :
56
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive masquerade
Status:
terminated
Behavior Graph:
%3 guuid=ce4c1069-1c00-0000-cd0a-b27517070000 pid=1815 /usr/bin/sudo guuid=84acf26c-1c00-0000-cd0a-b2751c070000 pid=1820 /tmp/sample.bin guuid=ce4c1069-1c00-0000-cd0a-b27517070000 pid=1815->guuid=84acf26c-1c00-0000-cd0a-b2751c070000 pid=1820 execve guuid=eeecb86d-1c00-0000-cd0a-b2751e070000 pid=1822 /usr/bin/bash guuid=84acf26c-1c00-0000-cd0a-b2751c070000 pid=1820->guuid=eeecb86d-1c00-0000-cd0a-b2751e070000 pid=1822 clone guuid=c52ac86d-1c00-0000-cd0a-b27520070000 pid=1824 /usr/bin/base64 guuid=84acf26c-1c00-0000-cd0a-b2751c070000 pid=1820->guuid=c52ac86d-1c00-0000-cd0a-b27520070000 pid=1824 execve guuid=20e5da6d-1c00-0000-cd0a-b27521070000 pid=1825 /usr/bin/bash guuid=84acf26c-1c00-0000-cd0a-b2751c070000 pid=1820->guuid=20e5da6d-1c00-0000-cd0a-b27521070000 pid=1825 clone guuid=cc6f2e6f-1c00-0000-cd0a-b27523070000 pid=1827 /usr/bin/cp guuid=84acf26c-1c00-0000-cd0a-b2751c070000 pid=1820->guuid=cc6f2e6f-1c00-0000-cd0a-b27523070000 pid=1827 execve guuid=60353c70-1c00-0000-cd0a-b27524070000 pid=1828 /usr/bin/mkdir guuid=84acf26c-1c00-0000-cd0a-b2751c070000 pid=1820->guuid=60353c70-1c00-0000-cd0a-b27524070000 pid=1828 execve guuid=66d42071-1c00-0000-cd0a-b27526070000 pid=1830 /usr/bin/mkdir guuid=84acf26c-1c00-0000-cd0a-b2751c070000 pid=1820->guuid=66d42071-1c00-0000-cd0a-b27526070000 pid=1830 execve guuid=5e5a9c71-1c00-0000-cd0a-b27527070000 pid=1831 /usr/bin/mkdir guuid=84acf26c-1c00-0000-cd0a-b2751c070000 pid=1820->guuid=5e5a9c71-1c00-0000-cd0a-b27527070000 pid=1831 execve guuid=eee93272-1c00-0000-cd0a-b27528070000 pid=1832 /usr/bin/mkdir guuid=84acf26c-1c00-0000-cd0a-b2751c070000 pid=1820->guuid=eee93272-1c00-0000-cd0a-b27528070000 pid=1832 execve guuid=4b911873-1c00-0000-cd0a-b2752a070000 pid=1834 /usr/bin/mkdir guuid=84acf26c-1c00-0000-cd0a-b2751c070000 pid=1820->guuid=4b911873-1c00-0000-cd0a-b2752a070000 pid=1834 execve guuid=a1bea873-1c00-0000-cd0a-b2752b070000 pid=1835 /usr/bin/mkdir guuid=84acf26c-1c00-0000-cd0a-b2751c070000 pid=1820->guuid=a1bea873-1c00-0000-cd0a-b2752b070000 pid=1835 execve guuid=1b3b8074-1c00-0000-cd0a-b2752e070000 pid=1838 /usr/bin/mkdir guuid=84acf26c-1c00-0000-cd0a-b2751c070000 pid=1820->guuid=1b3b8074-1c00-0000-cd0a-b2752e070000 pid=1838 execve guuid=118a4f75-1c00-0000-cd0a-b27530070000 pid=1840 /usr/bin/mkdir guuid=84acf26c-1c00-0000-cd0a-b2751c070000 pid=1820->guuid=118a4f75-1c00-0000-cd0a-b27530070000 pid=1840 execve guuid=268bdb75-1c00-0000-cd0a-b27531070000 pid=1841 /usr/bin/mkdir guuid=84acf26c-1c00-0000-cd0a-b2751c070000 pid=1820->guuid=268bdb75-1c00-0000-cd0a-b27531070000 pid=1841 execve guuid=6de66376-1c00-0000-cd0a-b27533070000 pid=1843 /usr/bin/cp guuid=84acf26c-1c00-0000-cd0a-b2751c070000 pid=1820->guuid=6de66376-1c00-0000-cd0a-b27533070000 pid=1843 execve guuid=f0b44977-1c00-0000-cd0a-b27535070000 pid=1845 /usr/bin/cp guuid=84acf26c-1c00-0000-cd0a-b2751c070000 pid=1820->guuid=f0b44977-1c00-0000-cd0a-b27535070000 pid=1845 execve guuid=5b808678-1c00-0000-cd0a-b27538070000 pid=1848 /usr/bin/cp guuid=84acf26c-1c00-0000-cd0a-b2751c070000 pid=1820->guuid=5b808678-1c00-0000-cd0a-b27538070000 pid=1848 execve guuid=f8236e79-1c00-0000-cd0a-b2753b070000 pid=1851 /usr/bin/cp guuid=84acf26c-1c00-0000-cd0a-b2751c070000 pid=1820->guuid=f8236e79-1c00-0000-cd0a-b2753b070000 pid=1851 execve guuid=28d0207b-1c00-0000-cd0a-b2753d070000 pid=1853 /usr/bin/cp guuid=84acf26c-1c00-0000-cd0a-b2751c070000 pid=1820->guuid=28d0207b-1c00-0000-cd0a-b2753d070000 pid=1853 execve guuid=4690c47c-1c00-0000-cd0a-b2753f070000 pid=1855 /usr/bin/cp guuid=84acf26c-1c00-0000-cd0a-b2751c070000 pid=1820->guuid=4690c47c-1c00-0000-cd0a-b2753f070000 pid=1855 execve guuid=6ce1597e-1c00-0000-cd0a-b27542070000 pid=1858 /usr/bin/cp guuid=84acf26c-1c00-0000-cd0a-b2751c070000 pid=1820->guuid=6ce1597e-1c00-0000-cd0a-b27542070000 pid=1858 execve guuid=9de57e7f-1c00-0000-cd0a-b27543070000 pid=1859 /usr/bin/cp guuid=84acf26c-1c00-0000-cd0a-b2751c070000 pid=1820->guuid=9de57e7f-1c00-0000-cd0a-b27543070000 pid=1859 execve guuid=c4112380-1c00-0000-cd0a-b27546070000 pid=1862 /usr/bin/cp guuid=84acf26c-1c00-0000-cd0a-b2751c070000 pid=1820->guuid=c4112380-1c00-0000-cd0a-b27546070000 pid=1862 execve guuid=6bc2bb81-1c00-0000-cd0a-b2754a070000 pid=1866 /usr/bin/cp guuid=84acf26c-1c00-0000-cd0a-b2751c070000 pid=1820->guuid=6bc2bb81-1c00-0000-cd0a-b2754a070000 pid=1866 execve guuid=9983b582-1c00-0000-cd0a-b2754b070000 pid=1867 /usr/bin/cp guuid=84acf26c-1c00-0000-cd0a-b2751c070000 pid=1820->guuid=9983b582-1c00-0000-cd0a-b2754b070000 pid=1867 execve guuid=61227383-1c00-0000-cd0a-b2754c070000 pid=1868 /usr/bin/cp guuid=84acf26c-1c00-0000-cd0a-b2751c070000 pid=1820->guuid=61227383-1c00-0000-cd0a-b2754c070000 pid=1868 execve guuid=fea20985-1c00-0000-cd0a-b2754e070000 pid=1870 /usr/bin/cp guuid=84acf26c-1c00-0000-cd0a-b2751c070000 pid=1820->guuid=fea20985-1c00-0000-cd0a-b2754e070000 pid=1870 execve guuid=0211de85-1c00-0000-cd0a-b2754f070000 pid=1871 /usr/bin/cp guuid=84acf26c-1c00-0000-cd0a-b2751c070000 pid=1820->guuid=0211de85-1c00-0000-cd0a-b2754f070000 pid=1871 execve guuid=56d9c286-1c00-0000-cd0a-b27551070000 pid=1873 /usr/bin/touch guuid=84acf26c-1c00-0000-cd0a-b2751c070000 pid=1820->guuid=56d9c286-1c00-0000-cd0a-b27551070000 pid=1873 execve guuid=5f0ce987-1c00-0000-cd0a-b27553070000 pid=1875 /usr/bin/chmod guuid=84acf26c-1c00-0000-cd0a-b2751c070000 pid=1820->guuid=5f0ce987-1c00-0000-cd0a-b27553070000 pid=1875 execve guuid=4f93c788-1c00-0000-cd0a-b27555070000 pid=1877 /usr/bin/chmod guuid=84acf26c-1c00-0000-cd0a-b2751c070000 pid=1820->guuid=4f93c788-1c00-0000-cd0a-b27555070000 pid=1877 execve guuid=b5b87589-1c00-0000-cd0a-b27557070000 pid=1879 /usr/bin/chattr guuid=84acf26c-1c00-0000-cd0a-b2751c070000 pid=1820->guuid=b5b87589-1c00-0000-cd0a-b27557070000 pid=1879 execve guuid=dc17b68a-1c00-0000-cd0a-b27559070000 pid=1881 /usr/bin/chattr guuid=84acf26c-1c00-0000-cd0a-b2751c070000 pid=1820->guuid=dc17b68a-1c00-0000-cd0a-b27559070000 pid=1881 execve guuid=8be9d08b-1c00-0000-cd0a-b2755b070000 pid=1883 /usr/bin/chattr guuid=84acf26c-1c00-0000-cd0a-b2751c070000 pid=1820->guuid=8be9d08b-1c00-0000-cd0a-b2755b070000 pid=1883 execve guuid=6c887a8c-1c00-0000-cd0a-b2755e070000 pid=1886 /usr/bin/chattr guuid=84acf26c-1c00-0000-cd0a-b2751c070000 pid=1820->guuid=6c887a8c-1c00-0000-cd0a-b2755e070000 pid=1886 execve guuid=8c0e5d8d-1c00-0000-cd0a-b2755f070000 pid=1887 /usr/bin/chattr guuid=84acf26c-1c00-0000-cd0a-b2751c070000 pid=1820->guuid=8c0e5d8d-1c00-0000-cd0a-b2755f070000 pid=1887 execve guuid=472cfd8d-1c00-0000-cd0a-b27560070000 pid=1888 /usr/bin/chattr guuid=84acf26c-1c00-0000-cd0a-b2751c070000 pid=1820->guuid=472cfd8d-1c00-0000-cd0a-b27560070000 pid=1888 execve guuid=4a8bd28e-1c00-0000-cd0a-b27561070000 pid=1889 /usr/bin/chattr guuid=84acf26c-1c00-0000-cd0a-b2751c070000 pid=1820->guuid=4a8bd28e-1c00-0000-cd0a-b27561070000 pid=1889 execve guuid=a503898f-1c00-0000-cd0a-b27562070000 pid=1890 /usr/bin/chattr guuid=84acf26c-1c00-0000-cd0a-b2751c070000 pid=1820->guuid=a503898f-1c00-0000-cd0a-b27562070000 pid=1890 execve guuid=f3905d90-1c00-0000-cd0a-b27563070000 pid=1891 /usr/bin/bash guuid=84acf26c-1c00-0000-cd0a-b2751c070000 pid=1820->guuid=f3905d90-1c00-0000-cd0a-b27563070000 pid=1891 clone guuid=28a99990-1c00-0000-cd0a-b27564070000 pid=1892 /usr/bin/bash guuid=84acf26c-1c00-0000-cd0a-b2751c070000 pid=1820->guuid=28a99990-1c00-0000-cd0a-b27564070000 pid=1892 clone guuid=5a78d990-1c00-0000-cd0a-b27565070000 pid=1893 /usr/bin/curl net send-data guuid=84acf26c-1c00-0000-cd0a-b2751c070000 pid=1820->guuid=5a78d990-1c00-0000-cd0a-b27565070000 pid=1893 execve guuid=d293e490-1c00-0000-cd0a-b27566070000 pid=1894 /usr/bin/dash guuid=84acf26c-1c00-0000-cd0a-b2751c070000 pid=1820->guuid=d293e490-1c00-0000-cd0a-b27566070000 pid=1894 execve guuid=6c9da6a1-1c00-0000-cd0a-b27576070000 pid=1910 /usr/bin/bash guuid=84acf26c-1c00-0000-cd0a-b2751c070000 pid=1820->guuid=6c9da6a1-1c00-0000-cd0a-b27576070000 pid=1910 clone guuid=7d5db0a1-1c00-0000-cd0a-b27577070000 pid=1911 /usr/bin/base64 guuid=84acf26c-1c00-0000-cd0a-b2751c070000 pid=1820->guuid=7d5db0a1-1c00-0000-cd0a-b27577070000 pid=1911 execve guuid=a0c6cea1-1c00-0000-cd0a-b27578070000 pid=1912 /usr/bin/tee write-file guuid=84acf26c-1c00-0000-cd0a-b2751c070000 pid=1820->guuid=a0c6cea1-1c00-0000-cd0a-b27578070000 pid=1912 execve guuid=081221a3-1c00-0000-cd0a-b2757b070000 pid=1915 /usr/bin/bash guuid=84acf26c-1c00-0000-cd0a-b2751c070000 pid=1820->guuid=081221a3-1c00-0000-cd0a-b2757b070000 pid=1915 execve guuid=649e9fb0-1c00-0000-cd0a-b2758f070000 pid=1935 /usr/bin/bash guuid=84acf26c-1c00-0000-cd0a-b2751c070000 pid=1820->guuid=649e9fb0-1c00-0000-cd0a-b2758f070000 pid=1935 execve guuid=b1144fb1-1c00-0000-cd0a-b27591070000 pid=1937 /usr/bin/rm delete-file guuid=84acf26c-1c00-0000-cd0a-b2751c070000 pid=1820->guuid=b1144fb1-1c00-0000-cd0a-b27591070000 pid=1937 execve guuid=a6efc3b1-1c00-0000-cd0a-b27593070000 pid=1939 /usr/bin/rm guuid=84acf26c-1c00-0000-cd0a-b2751c070000 pid=1820->guuid=a6efc3b1-1c00-0000-cd0a-b27593070000 pid=1939 execve guuid=565c81b2-1c00-0000-cd0a-b27596070000 pid=1942 /usr/bin/curl net send-data guuid=84acf26c-1c00-0000-cd0a-b2751c070000 pid=1820->guuid=565c81b2-1c00-0000-cd0a-b27596070000 pid=1942 execve guuid=90208eb2-1c00-0000-cd0a-b27597070000 pid=1943 /usr/bin/dash guuid=84acf26c-1c00-0000-cd0a-b2751c070000 pid=1820->guuid=90208eb2-1c00-0000-cd0a-b27597070000 pid=1943 execve 124ee36c-bdbd-5d46-bbb1-b2cd81367f04 160.119.69.4:80 guuid=5a78d990-1c00-0000-cd0a-b27565070000 pid=1893->124ee36c-bdbd-5d46-bbb1-b2cd81367f04 send: 93B guuid=e60dd3a3-1c00-0000-cd0a-b2757d070000 pid=1917 /usr/bin/bash guuid=081221a3-1c00-0000-cd0a-b2757b070000 pid=1915->guuid=e60dd3a3-1c00-0000-cd0a-b2757d070000 pid=1917 clone guuid=54dbe4a3-1c00-0000-cd0a-b2757e070000 pid=1918 /usr/bin/bash guuid=081221a3-1c00-0000-cd0a-b2757b070000 pid=1915->guuid=54dbe4a3-1c00-0000-cd0a-b2757e070000 pid=1918 clone guuid=44c91ca4-1c00-0000-cd0a-b2757f070000 pid=1919 /usr/bin/ls guuid=081221a3-1c00-0000-cd0a-b2757b070000 pid=1915->guuid=44c91ca4-1c00-0000-cd0a-b2757f070000 pid=1919 execve guuid=27711ba5-1c00-0000-cd0a-b27580070000 pid=1920 /usr/bin/cat guuid=081221a3-1c00-0000-cd0a-b2757b070000 pid=1915->guuid=27711ba5-1c00-0000-cd0a-b27580070000 pid=1920 execve guuid=2c92aaa5-1c00-0000-cd0a-b27581070000 pid=1921 /usr/bin/ls guuid=081221a3-1c00-0000-cd0a-b2757b070000 pid=1915->guuid=2c92aaa5-1c00-0000-cd0a-b27581070000 pid=1921 execve guuid=d00477a6-1c00-0000-cd0a-b27582070000 pid=1922 /usr/bin/mkdir guuid=081221a3-1c00-0000-cd0a-b2757b070000 pid=1915->guuid=d00477a6-1c00-0000-cd0a-b27582070000 pid=1922 execve guuid=fc2742a7-1c00-0000-cd0a-b27583070000 pid=1923 /usr/bin/mv guuid=081221a3-1c00-0000-cd0a-b2757b070000 pid=1915->guuid=fc2742a7-1c00-0000-cd0a-b27583070000 pid=1923 execve guuid=8ead27a8-1c00-0000-cd0a-b27584070000 pid=1924 /usr/bin/bash guuid=081221a3-1c00-0000-cd0a-b2757b070000 pid=1915->guuid=8ead27a8-1c00-0000-cd0a-b27584070000 pid=1924 clone guuid=b94333a8-1c00-0000-cd0a-b27585070000 pid=1925 /usr/bin/base64 write-file guuid=081221a3-1c00-0000-cd0a-b2757b070000 pid=1915->guuid=b94333a8-1c00-0000-cd0a-b27585070000 pid=1925 execve guuid=aaf5daa8-1c00-0000-cd0a-b27586070000 pid=1926 /usr/bin/rm delete-file guuid=081221a3-1c00-0000-cd0a-b2757b070000 pid=1915->guuid=aaf5daa8-1c00-0000-cd0a-b27586070000 pid=1926 execve guuid=879c80a9-1c00-0000-cd0a-b27587070000 pid=1927 /usr/bin/mv guuid=081221a3-1c00-0000-cd0a-b2757b070000 pid=1915->guuid=879c80a9-1c00-0000-cd0a-b27587070000 pid=1927 execve guuid=8c6580aa-1c00-0000-cd0a-b27588070000 pid=1928 /usr/bin/ls guuid=081221a3-1c00-0000-cd0a-b2757b070000 pid=1915->guuid=8c6580aa-1c00-0000-cd0a-b27588070000 pid=1928 execve guuid=c5643bac-1c00-0000-cd0a-b27589070000 pid=1929 /usr/bin/bash guuid=081221a3-1c00-0000-cd0a-b2757b070000 pid=1915->guuid=c5643bac-1c00-0000-cd0a-b27589070000 pid=1929 clone guuid=24344dac-1c00-0000-cd0a-b2758a070000 pid=1930 /usr/bin/base64 write-file guuid=081221a3-1c00-0000-cd0a-b2757b070000 pid=1915->guuid=24344dac-1c00-0000-cd0a-b2758a070000 pid=1930 execve guuid=9f8e49ad-1c00-0000-cd0a-b2758b070000 pid=1931 /usr/bin/ls guuid=081221a3-1c00-0000-cd0a-b2757b070000 pid=1915->guuid=9f8e49ad-1c00-0000-cd0a-b2758b070000 pid=1931 execve guuid=656aa8ae-1c00-0000-cd0a-b2758c070000 pid=1932 /usr/bin/cat guuid=081221a3-1c00-0000-cd0a-b2757b070000 pid=1915->guuid=656aa8ae-1c00-0000-cd0a-b2758c070000 pid=1932 execve guuid=c4c03eaf-1c00-0000-cd0a-b2758d070000 pid=1933 /usr/bin/ls guuid=081221a3-1c00-0000-cd0a-b2757b070000 pid=1915->guuid=c4c03eaf-1c00-0000-cd0a-b2758d070000 pid=1933 execve guuid=565c81b2-1c00-0000-cd0a-b27596070000 pid=1942->124ee36c-bdbd-5d46-bbb1-b2cd81367f04 send: 93B
Threat name:
Linux.Backdoor.WebShell
Status:
Malicious
First seen:
2026-08-03 00:49:40 UTC
File Type:
Text (Shell)
AV detection:
16 of 36 (44.44%)
Threat level:
  5/5
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Behaviour
Reads runtime system information
Writes file to tmp directory
Deobfuscate/Decode Files or Information
Checks CPU configuration
File and Directory Permissions Modification
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures


MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SUSP_LNX_Base64_Exec_Apr24
Author:Christian Burkard
Description:Detects suspicious base64 encoded shell commands (as seen in Palo Alto CVE-2024-3400 exploitation)
Reference:Internal Research

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 08a91019ff7ba6f77de3b774dc201cca18edfd264f9a46e34f243f6d76e37077

(this sample)

  
Delivery method
Distributed via web download

Comments