🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 220c5e01f2e895f956f265bc036b165ce8cafb8e63f2b5c6e9fed3ee06f0c165. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 220c5e01f2e895f956f265bc036b165ce8cafb8e63f2b5c6e9fed3ee06f0c165
SHA3-384 hash: c57ff34b2cedf93e2ad90e21cf6c642ba9da06cc2f1aa8e479e8c58eaca222290e22b18c6322768022e509f8264f28cf
SHA1 hash: 74b88204236ac91b29f980f0556ee87a6e859d05
MD5 hash: 85129599ee2d865e03d0f5e4ac69ac65
humanhash: april-hotel-quebec-leopard
File name:Nx_54317.php
Download: download sample
File size:23 bytes
First seen:2026-10-27 03:49:09 UTC
Last seen:Never
File type:php php
MIME type:text/x-php
ssdeep 3:3/a4GBe:yM
TLSH TNULL
Magika php
Reporter ukkz
Tags:cryptojacking CVE-2026-110447 Nextcloud php webshell


Avatar
ukkz
One-line PHP command shell (system($_GET[c])) dropped as apps/richdocumentscode/Nx_<5 digits>.php on a Nextcloud server in Japan via CVE-2026-110447 (2026-10-15) and used to run commands. The campaign installs XMRig (dropper 9aade612521dab5600f59b0660e19fb8392a42570408673e824f3bbd2532c85b).

Intelligence

File Origin
# of uploads :
1
# of downloads :
107
Origin country :
JP JP
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.PHP.Shell-41.UNOFFICIAL
Create hunting rule

{HEX}php.generic.globals.503.UNOFFICIAL
Create hunting rule

{HEX}php.include.remote.526.UNOFFICIAL
Create hunting rule

Verdict:
Clean
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ae01f477072ea4caff6f2bd
Tags:
n/a
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
backdoor
Link:
https://www.filescan.io/uploads/6ae01f3d4a85ee77e399282c/reports/f4f70bb0-85b6-498d-8585-45970c80bb1a/overview
Verdict:
Malicious
Labled as:
Trojan[Backdoor]/Script.WebShell
Link:
https://www.hybrid-analysis.com/sample/220c5e01f2e895f956f265bc036b165ce8cafb8e63f2b5c6e9fed3ee06f0c165
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-06-24T13:08:00Z UTC
Last seen:
2026-10-28T18:35:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/220c5e01f2e895f956f265bc036b165ce8cafb8e63f2b5c6e9fed3ee06f0c165/results?tab=lookup
Score:
1%
Verdict:
Benign
File Type:
SCRIPT
Link:
https://malprob.io/report/220c5e01f2e895f956f265bc036b165ce8cafb8e63f2b5c6e9fed3ee06f0c165
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/220c5e01f2e895f956f265bc036b165ce8cafb8e63f2b5c6e9fed3ee06f0c165/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/220c5e01f2e895f956f265bc036b165ce8cafb8e63f2b5c6e9fed3ee06f0c165

File information

The table below shows additional information about this malware sample such as delivery method and external references.

  
Delivery method
Other

Comments