🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0b1d8b33e227cfe6f2684a582309a1ae46d83269548a9216d57bc0d797002021. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0b1d8b33e227cfe6f2684a582309a1ae46d83269548a9216d57bc0d797002021
SHA3-384 hash: e09af2d7beba3d7381e359ca785db511acc629263df29a64fbfd6bd9b8cbe6924c3e2e33cd2ec55137f665395829439d
SHA1 hash: 912c703a115920c8e9241d367f2a6c5b8d99370e
MD5 hash: 4a37563682fe2051d58ecf9c7f742721
humanhash: fanta-pasta-november-dakota
File name:wr.php
Download: download sample
File size:27'042 bytes
First seen:2026-08-05 14:42:41 UTC
Last seen:2026-08-05 18:34:34 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 768:f8vCB+25j6es8RT9FYpMSUpi+20qUpi+20YQX:f8l25JVd2QX
TLSH T130C27D966A867C44BEC94A3E4CBD2B1D6DF5C3D1224D42AC3D8A3C71DC11FACD618B1A
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://160.119.69.4/z/post/noroot.phpn/an/aelf ua-wget

Intelligence

File Origin
# of uploads :
2
# of downloads :
68
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.DownLoader.2862.17899.9697.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive masquerade
Link:
https://www.filescan.io/uploads/6a734c0cc9c86b18aba5a936/reports/507c203d-a927-4bb3-a74a-770ed0dee597/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-08-05T12:20:00Z UTC
Last seen:
2026-08-05T13:08:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/0b1d8b33e227cfe6f2684a582309a1ae46d83269548a9216d57bc0d797002021/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/6657fa80-7758-43d3-bbe5-319fd62e31d0
Behavior Graph:
Download SVG
%3 guuid=03dde4ab-1600-0000-c52b-40a9550e0000 pid=3669 /usr/bin/sudo guuid=2c1d56b2-1600-0000-c52b-40a96f0e0000 pid=3695 /tmp/sample.bin guuid=03dde4ab-1600-0000-c52b-40a9550e0000 pid=3669->guuid=2c1d56b2-1600-0000-c52b-40a96f0e0000 pid=3695 execve guuid=cd234eb3-1600-0000-c52b-40a9720e0000 pid=3698 /usr/bin/bash guuid=2c1d56b2-1600-0000-c52b-40a96f0e0000 pid=3695->guuid=cd234eb3-1600-0000-c52b-40a9720e0000 pid=3698 clone guuid=51c755b3-1600-0000-c52b-40a9730e0000 pid=3699 /usr/bin/base64 guuid=2c1d56b2-1600-0000-c52b-40a96f0e0000 pid=3695->guuid=51c755b3-1600-0000-c52b-40a9730e0000 pid=3699 execve guuid=e66960b3-1600-0000-c52b-40a9740e0000 pid=3700 /usr/bin/bash guuid=2c1d56b2-1600-0000-c52b-40a96f0e0000 pid=3695->guuid=e66960b3-1600-0000-c52b-40a9740e0000 pid=3700 clone guuid=586c54b4-1600-0000-c52b-40a9780e0000 pid=3704 /usr/bin/cp guuid=2c1d56b2-1600-0000-c52b-40a96f0e0000 pid=3695->guuid=586c54b4-1600-0000-c52b-40a9780e0000 pid=3704 execve guuid=18739eb5-1600-0000-c52b-40a97d0e0000 pid=3709 /usr/bin/mkdir guuid=2c1d56b2-1600-0000-c52b-40a96f0e0000 pid=3695->guuid=18739eb5-1600-0000-c52b-40a97d0e0000 pid=3709 execve guuid=5c8d95b6-1600-0000-c52b-40a9810e0000 pid=3713 /usr/bin/mkdir guuid=2c1d56b2-1600-0000-c52b-40a96f0e0000 pid=3695->guuid=5c8d95b6-1600-0000-c52b-40a9810e0000 pid=3713 execve guuid=3d8e90b7-1600-0000-c52b-40a9850e0000 pid=3717 /usr/bin/mkdir guuid=2c1d56b2-1600-0000-c52b-40a96f0e0000 pid=3695->guuid=3d8e90b7-1600-0000-c52b-40a9850e0000 pid=3717 execve guuid=8d0366b8-1600-0000-c52b-40a9890e0000 pid=3721 /usr/bin/mkdir guuid=2c1d56b2-1600-0000-c52b-40a96f0e0000 pid=3695->guuid=8d0366b8-1600-0000-c52b-40a9890e0000 pid=3721 execve guuid=a8643db9-1600-0000-c52b-40a98d0e0000 pid=3725 /usr/bin/mkdir guuid=2c1d56b2-1600-0000-c52b-40a96f0e0000 pid=3695->guuid=a8643db9-1600-0000-c52b-40a98d0e0000 pid=3725 execve guuid=ceca9bb9-1600-0000-c52b-40a98e0e0000 pid=3726 /usr/bin/mkdir guuid=2c1d56b2-1600-0000-c52b-40a96f0e0000 pid=3695->guuid=ceca9bb9-1600-0000-c52b-40a98e0e0000 pid=3726 execve guuid=1b104bba-1600-0000-c52b-40a9920e0000 pid=3730 /usr/bin/mkdir guuid=2c1d56b2-1600-0000-c52b-40a96f0e0000 pid=3695->guuid=1b104bba-1600-0000-c52b-40a9920e0000 pid=3730 execve guuid=59dd93ba-1600-0000-c52b-40a9930e0000 pid=3731 /usr/bin/mkdir guuid=2c1d56b2-1600-0000-c52b-40a96f0e0000 pid=3695->guuid=59dd93ba-1600-0000-c52b-40a9930e0000 pid=3731 execve guuid=586cefba-1600-0000-c52b-40a9940e0000 pid=3732 /usr/bin/mkdir guuid=2c1d56b2-1600-0000-c52b-40a96f0e0000 pid=3695->guuid=586cefba-1600-0000-c52b-40a9940e0000 pid=3732 execve guuid=8d8c5fbb-1600-0000-c52b-40a9950e0000 pid=3733 /usr/bin/cp guuid=2c1d56b2-1600-0000-c52b-40a96f0e0000 pid=3695->guuid=8d8c5fbb-1600-0000-c52b-40a9950e0000 pid=3733 execve guuid=5574d7bb-1600-0000-c52b-40a9960e0000 pid=3734 /usr/bin/cp guuid=2c1d56b2-1600-0000-c52b-40a96f0e0000 pid=3695->guuid=5574d7bb-1600-0000-c52b-40a9960e0000 pid=3734 execve guuid=998167bc-1600-0000-c52b-40a9980e0000 pid=3736 /usr/bin/cp guuid=2c1d56b2-1600-0000-c52b-40a96f0e0000 pid=3695->guuid=998167bc-1600-0000-c52b-40a9980e0000 pid=3736 execve guuid=a90de4bc-1600-0000-c52b-40a9990e0000 pid=3737 /usr/bin/cp guuid=2c1d56b2-1600-0000-c52b-40a96f0e0000 pid=3695->guuid=a90de4bc-1600-0000-c52b-40a9990e0000 pid=3737 execve guuid=e10e62bd-1600-0000-c52b-40a99b0e0000 pid=3739 /usr/bin/cp guuid=2c1d56b2-1600-0000-c52b-40a96f0e0000 pid=3695->guuid=e10e62bd-1600-0000-c52b-40a99b0e0000 pid=3739 execve guuid=445dd9bd-1600-0000-c52b-40a99c0e0000 pid=3740 /usr/bin/cp guuid=2c1d56b2-1600-0000-c52b-40a96f0e0000 pid=3695->guuid=445dd9bd-1600-0000-c52b-40a99c0e0000 pid=3740 execve guuid=f2bf54be-1600-0000-c52b-40a99e0e0000 pid=3742 /usr/bin/cp guuid=2c1d56b2-1600-0000-c52b-40a96f0e0000 pid=3695->guuid=f2bf54be-1600-0000-c52b-40a99e0e0000 pid=3742 execve guuid=0c49d8be-1600-0000-c52b-40a99f0e0000 pid=3743 /usr/bin/cp guuid=2c1d56b2-1600-0000-c52b-40a96f0e0000 pid=3695->guuid=0c49d8be-1600-0000-c52b-40a99f0e0000 pid=3743 execve guuid=3a4a59bf-1600-0000-c52b-40a9a10e0000 pid=3745 /usr/bin/cp guuid=2c1d56b2-1600-0000-c52b-40a96f0e0000 pid=3695->guuid=3a4a59bf-1600-0000-c52b-40a9a10e0000 pid=3745 execve guuid=d328dfbf-1600-0000-c52b-40a9a30e0000 pid=3747 /usr/bin/cp guuid=2c1d56b2-1600-0000-c52b-40a96f0e0000 pid=3695->guuid=d328dfbf-1600-0000-c52b-40a9a30e0000 pid=3747 execve guuid=1a5067c0-1600-0000-c52b-40a9a40e0000 pid=3748 /usr/bin/cp guuid=2c1d56b2-1600-0000-c52b-40a96f0e0000 pid=3695->guuid=1a5067c0-1600-0000-c52b-40a9a40e0000 pid=3748 execve guuid=d058ebc0-1600-0000-c52b-40a9a60e0000 pid=3750 /usr/bin/cp guuid=2c1d56b2-1600-0000-c52b-40a96f0e0000 pid=3695->guuid=d058ebc0-1600-0000-c52b-40a9a60e0000 pid=3750 execve guuid=f2dc68c1-1600-0000-c52b-40a9a80e0000 pid=3752 /usr/bin/cp guuid=2c1d56b2-1600-0000-c52b-40a96f0e0000 pid=3695->guuid=f2dc68c1-1600-0000-c52b-40a9a80e0000 pid=3752 execve guuid=410adbc1-1600-0000-c52b-40a9a90e0000 pid=3753 /usr/bin/cp guuid=2c1d56b2-1600-0000-c52b-40a96f0e0000 pid=3695->guuid=410adbc1-1600-0000-c52b-40a9a90e0000 pid=3753 execve guuid=88a272c2-1600-0000-c52b-40a9ab0e0000 pid=3755 /usr/bin/touch guuid=2c1d56b2-1600-0000-c52b-40a96f0e0000 pid=3695->guuid=88a272c2-1600-0000-c52b-40a9ab0e0000 pid=3755 execve guuid=c9e7d5c2-1600-0000-c52b-40a9ac0e0000 pid=3756 /usr/bin/chmod guuid=2c1d56b2-1600-0000-c52b-40a96f0e0000 pid=3695->guuid=c9e7d5c2-1600-0000-c52b-40a9ac0e0000 pid=3756 execve guuid=192926c3-1600-0000-c52b-40a9ad0e0000 pid=3757 /usr/bin/chmod guuid=2c1d56b2-1600-0000-c52b-40a96f0e0000 pid=3695->guuid=192926c3-1600-0000-c52b-40a9ad0e0000 pid=3757 execve guuid=ce8c8cc3-1600-0000-c52b-40a9ae0e0000 pid=3758 /usr/bin/chattr guuid=2c1d56b2-1600-0000-c52b-40a96f0e0000 pid=3695->guuid=ce8c8cc3-1600-0000-c52b-40a9ae0e0000 pid=3758 execve guuid=632e08c4-1600-0000-c52b-40a9b20e0000 pid=3762 /usr/bin/chattr guuid=2c1d56b2-1600-0000-c52b-40a96f0e0000 pid=3695->guuid=632e08c4-1600-0000-c52b-40a9b20e0000 pid=3762 execve guuid=b11670c4-1600-0000-c52b-40a9b30e0000 pid=3763 /usr/bin/chattr guuid=2c1d56b2-1600-0000-c52b-40a96f0e0000 pid=3695->guuid=b11670c4-1600-0000-c52b-40a9b30e0000 pid=3763 execve guuid=ed49d2c4-1600-0000-c52b-40a9b40e0000 pid=3764 /usr/bin/chattr guuid=2c1d56b2-1600-0000-c52b-40a96f0e0000 pid=3695->guuid=ed49d2c4-1600-0000-c52b-40a9b40e0000 pid=3764 execve guuid=334932c5-1600-0000-c52b-40a9b60e0000 pid=3766 /usr/bin/chattr guuid=2c1d56b2-1600-0000-c52b-40a96f0e0000 pid=3695->guuid=334932c5-1600-0000-c52b-40a9b60e0000 pid=3766 execve guuid=14be83c5-1600-0000-c52b-40a9b90e0000 pid=3769 /usr/bin/chattr guuid=2c1d56b2-1600-0000-c52b-40a96f0e0000 pid=3695->guuid=14be83c5-1600-0000-c52b-40a9b90e0000 pid=3769 execve guuid=d59ae3c5-1600-0000-c52b-40a9ba0e0000 pid=3770 /usr/bin/chattr guuid=2c1d56b2-1600-0000-c52b-40a96f0e0000 pid=3695->guuid=d59ae3c5-1600-0000-c52b-40a9ba0e0000 pid=3770 execve guuid=50ce55c6-1600-0000-c52b-40a9bc0e0000 pid=3772 /usr/bin/chattr guuid=2c1d56b2-1600-0000-c52b-40a96f0e0000 pid=3695->guuid=50ce55c6-1600-0000-c52b-40a9bc0e0000 pid=3772 execve guuid=c616a5c6-1600-0000-c52b-40a9bd0e0000 pid=3773 /usr/bin/bash guuid=2c1d56b2-1600-0000-c52b-40a96f0e0000 pid=3695->guuid=c616a5c6-1600-0000-c52b-40a9bd0e0000 pid=3773 clone guuid=8467abc6-1600-0000-c52b-40a9be0e0000 pid=3774 /usr/bin/bash guuid=2c1d56b2-1600-0000-c52b-40a96f0e0000 pid=3695->guuid=8467abc6-1600-0000-c52b-40a9be0e0000 pid=3774 clone guuid=bcefc9c6-1600-0000-c52b-40a9c00e0000 pid=3776 /usr/bin/curl net send-data guuid=2c1d56b2-1600-0000-c52b-40a96f0e0000 pid=3695->guuid=bcefc9c6-1600-0000-c52b-40a9c00e0000 pid=3776 execve guuid=9b52d0c6-1600-0000-c52b-40a9c10e0000 pid=3777 /usr/bin/dash guuid=2c1d56b2-1600-0000-c52b-40a96f0e0000 pid=3695->guuid=9b52d0c6-1600-0000-c52b-40a9c10e0000 pid=3777 execve guuid=c598e8ce-1600-0000-c52b-40a9df0e0000 pid=3807 /usr/bin/bash guuid=2c1d56b2-1600-0000-c52b-40a96f0e0000 pid=3695->guuid=c598e8ce-1600-0000-c52b-40a9df0e0000 pid=3807 clone guuid=220defce-1600-0000-c52b-40a9e00e0000 pid=3808 /usr/bin/base64 guuid=2c1d56b2-1600-0000-c52b-40a96f0e0000 pid=3695->guuid=220defce-1600-0000-c52b-40a9e00e0000 pid=3808 execve guuid=74fef4ce-1600-0000-c52b-40a9e20e0000 pid=3810 /usr/bin/tee write-file guuid=2c1d56b2-1600-0000-c52b-40a96f0e0000 pid=3695->guuid=74fef4ce-1600-0000-c52b-40a9e20e0000 pid=3810 execve guuid=e0826dcf-1600-0000-c52b-40a9e50e0000 pid=3813 /usr/bin/bash guuid=2c1d56b2-1600-0000-c52b-40a96f0e0000 pid=3695->guuid=e0826dcf-1600-0000-c52b-40a9e50e0000 pid=3813 execve guuid=5677f3d5-1600-0000-c52b-40a90b0f0000 pid=3851 /usr/bin/bash guuid=2c1d56b2-1600-0000-c52b-40a96f0e0000 pid=3695->guuid=5677f3d5-1600-0000-c52b-40a90b0f0000 pid=3851 execve guuid=c2a778d6-1600-0000-c52b-40a90e0f0000 pid=3854 /usr/bin/rm delete-file guuid=2c1d56b2-1600-0000-c52b-40a96f0e0000 pid=3695->guuid=c2a778d6-1600-0000-c52b-40a90e0f0000 pid=3854 execve guuid=cdaabbd6-1600-0000-c52b-40a90f0f0000 pid=3855 /usr/bin/rm guuid=2c1d56b2-1600-0000-c52b-40a96f0e0000 pid=3695->guuid=cdaabbd6-1600-0000-c52b-40a90f0f0000 pid=3855 execve guuid=b9993bd7-1600-0000-c52b-40a9130f0000 pid=3859 /usr/bin/curl net send-data guuid=2c1d56b2-1600-0000-c52b-40a96f0e0000 pid=3695->guuid=b9993bd7-1600-0000-c52b-40a9130f0000 pid=3859 execve guuid=fdb15dd7-1600-0000-c52b-40a9140f0000 pid=3860 /usr/bin/dash guuid=2c1d56b2-1600-0000-c52b-40a96f0e0000 pid=3695->guuid=fdb15dd7-1600-0000-c52b-40a9140f0000 pid=3860 execve 124ee36c-bdbd-5d46-bbb1-b2cd81367f04 160.119.69.4:80 guuid=bcefc9c6-1600-0000-c52b-40a9c00e0000 pid=3776->124ee36c-bdbd-5d46-bbb1-b2cd81367f04 send: 93B guuid=1e551cd0-1600-0000-c52b-40a9eb0e0000 pid=3819 /usr/bin/bash guuid=e0826dcf-1600-0000-c52b-40a9e50e0000 pid=3813->guuid=1e551cd0-1600-0000-c52b-40a9eb0e0000 pid=3819 clone guuid=a85f26d0-1600-0000-c52b-40a9ec0e0000 pid=3820 /usr/bin/bash guuid=e0826dcf-1600-0000-c52b-40a9e50e0000 pid=3813->guuid=a85f26d0-1600-0000-c52b-40a9ec0e0000 pid=3820 clone guuid=361f47d0-1600-0000-c52b-40a9ed0e0000 pid=3821 /usr/bin/ls guuid=e0826dcf-1600-0000-c52b-40a9e50e0000 pid=3813->guuid=361f47d0-1600-0000-c52b-40a9ed0e0000 pid=3821 execve guuid=3834d1d0-1600-0000-c52b-40a9ef0e0000 pid=3823 /usr/bin/cat guuid=e0826dcf-1600-0000-c52b-40a9e50e0000 pid=3813->guuid=3834d1d0-1600-0000-c52b-40a9ef0e0000 pid=3823 execve guuid=328a18d1-1600-0000-c52b-40a9f20e0000 pid=3826 /usr/bin/ls guuid=e0826dcf-1600-0000-c52b-40a9e50e0000 pid=3813->guuid=328a18d1-1600-0000-c52b-40a9f20e0000 pid=3826 execve guuid=a3e891d1-1600-0000-c52b-40a9f50e0000 pid=3829 /usr/bin/mkdir guuid=e0826dcf-1600-0000-c52b-40a9e50e0000 pid=3813->guuid=a3e891d1-1600-0000-c52b-40a9f50e0000 pid=3829 execve guuid=e189e2d1-1600-0000-c52b-40a9f70e0000 pid=3831 /usr/bin/mv guuid=e0826dcf-1600-0000-c52b-40a9e50e0000 pid=3813->guuid=e189e2d1-1600-0000-c52b-40a9f70e0000 pid=3831 execve guuid=0e4244d2-1600-0000-c52b-40a9f90e0000 pid=3833 /usr/bin/bash guuid=e0826dcf-1600-0000-c52b-40a9e50e0000 pid=3813->guuid=0e4244d2-1600-0000-c52b-40a9f90e0000 pid=3833 clone guuid=2fbb4fd2-1600-0000-c52b-40a9fa0e0000 pid=3834 /usr/bin/base64 write-file guuid=e0826dcf-1600-0000-c52b-40a9e50e0000 pid=3813->guuid=2fbb4fd2-1600-0000-c52b-40a9fa0e0000 pid=3834 execve guuid=e0c0a6d2-1600-0000-c52b-40a9fd0e0000 pid=3837 /usr/bin/rm delete-file guuid=e0826dcf-1600-0000-c52b-40a9e50e0000 pid=3813->guuid=e0c0a6d2-1600-0000-c52b-40a9fd0e0000 pid=3837 execve guuid=a201ecd2-1600-0000-c52b-40a9ff0e0000 pid=3839 /usr/bin/mv guuid=e0826dcf-1600-0000-c52b-40a9e50e0000 pid=3813->guuid=a201ecd2-1600-0000-c52b-40a9ff0e0000 pid=3839 execve guuid=d87b48d3-1600-0000-c52b-40a9010f0000 pid=3841 /usr/bin/ls guuid=e0826dcf-1600-0000-c52b-40a9e50e0000 pid=3813->guuid=d87b48d3-1600-0000-c52b-40a9010f0000 pid=3841 execve guuid=c99ad1d3-1600-0000-c52b-40a9020f0000 pid=3842 /usr/bin/bash guuid=e0826dcf-1600-0000-c52b-40a9e50e0000 pid=3813->guuid=c99ad1d3-1600-0000-c52b-40a9020f0000 pid=3842 clone guuid=7d3ddcd3-1600-0000-c52b-40a9030f0000 pid=3843 /usr/bin/base64 write-file guuid=e0826dcf-1600-0000-c52b-40a9e50e0000 pid=3813->guuid=7d3ddcd3-1600-0000-c52b-40a9030f0000 pid=3843 execve guuid=dce065d4-1600-0000-c52b-40a9040f0000 pid=3844 /usr/bin/ls guuid=e0826dcf-1600-0000-c52b-40a9e50e0000 pid=3813->guuid=dce065d4-1600-0000-c52b-40a9040f0000 pid=3844 execve guuid=bd4eefd4-1600-0000-c52b-40a9060f0000 pid=3846 /usr/bin/cat guuid=e0826dcf-1600-0000-c52b-40a9e50e0000 pid=3813->guuid=bd4eefd4-1600-0000-c52b-40a9060f0000 pid=3846 execve guuid=59176fd5-1600-0000-c52b-40a9090f0000 pid=3849 /usr/bin/ls guuid=e0826dcf-1600-0000-c52b-40a9e50e0000 pid=3813->guuid=59176fd5-1600-0000-c52b-40a9090f0000 pid=3849 execve guuid=b9993bd7-1600-0000-c52b-40a9130f0000 pid=3859->124ee36c-bdbd-5d46-bbb1-b2cd81367f04 send: 93B
Score:
81%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/0b1d8b33e227cfe6f2684a582309a1ae46d83269548a9216d57bc0d797002021
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0b1d8b33e227cfe6f2684a582309a1ae46d83269548a9216d57bc0d797002021/
Threat name:
Linux.Backdoor.WebShell
Create hunting rule
Status:
Malicious
First seen:
2026-08-05 14:43:31 UTC
File Type:
Text (Shell)
AV detection:
17 of 38 (44.74%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=bmoywm7ce7h6n4tijjmcgcnbvzdnqmtjksfjefwvppanpfyaeaqq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260805-r3r48sak91/
Behaviour
Reads runtime system information
Writes file to tmp directory
Deobfuscate/Decode Files or Information
Checks CPU configuration
File and Directory Permissions Modification
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.16
Link:
https://yomi.yoroi.company/submissions/0b1d8b33e227cfe6f2684a582309a1ae46d83269548a9216d57bc0d797002021

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SUSP_LNX_Base64_Exec_Apr24
Create hunting rule
Author:Christian Burkard
Description:Detects suspicious base64 encoded shell commands (as seen in Palo Alto CVE-2024-3400 exploitation)
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 0b1d8b33e227cfe6f2684a582309a1ae46d83269548a9216d57bc0d797002021

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3884408/
  
Delivery method
Distributed via web download

Comments