🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2605b24e59d3ecb1bca62d27a267a691373cf31343aadc5fbeab39f4554ba3fd. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2605b24e59d3ecb1bca62d27a267a691373cf31343aadc5fbeab39f4554ba3fd
SHA3-384 hash: 0f7d0ed5fa58864c87028a404073d5dd324b4d90beb284664070adaa8e5e93046d14ad3a67e74c75c1a54030ab0f558d
SHA1 hash: df1028078381265acbc763c11a0ae723b9bbf05a
MD5 hash: 9e86919ccc1e4c30a31759c5499f502d
humanhash: arizona-twelve-maine-neptune
File name:wr.php
Download: download sample
File size:27'042 bytes
First seen:2026-08-10 14:52:40 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 768:b8vCB+25j6es8Rp9FYpMSUpi+20qUpi+20YQX:b8l25JPd2QX
TLSH T1CEC28D956A867C44BDC94A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11FACD618B2A
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://160.119.69.4/z/post/noroot.phpn/an/aelf ua-wget

Intelligence

File Origin
# of uploads :
1
# of downloads :
36
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive masquerade
Link:
https://www.filescan.io/uploads/6a79e5f5553c37f8031a8e0d/reports/8972135d-15b5-4a38-a154-8cc69f48c2f3/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-08-10T12:50:00Z UTC
Last seen:
2026-08-10T16:40:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/2605b24e59d3ecb1bca62d27a267a691373cf31343aadc5fbeab39f4554ba3fd/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/e94b91b2-a804-479c-9954-26ecdef35e0f
Behavior Graph:
Download SVG
%3 guuid=4b5445e0-1600-0000-6cbc-8af92e0c0000 pid=3118 /usr/bin/sudo guuid=7e5d61e2-1600-0000-6cbc-8af9330c0000 pid=3123 /tmp/sample.bin guuid=4b5445e0-1600-0000-6cbc-8af92e0c0000 pid=3118->guuid=7e5d61e2-1600-0000-6cbc-8af9330c0000 pid=3123 execve guuid=de69ace3-1600-0000-6cbc-8af9350c0000 pid=3125 /usr/bin/bash guuid=7e5d61e2-1600-0000-6cbc-8af9330c0000 pid=3123->guuid=de69ace3-1600-0000-6cbc-8af9350c0000 pid=3125 clone guuid=aca7e0e3-1600-0000-6cbc-8af9360c0000 pid=3126 /usr/bin/base64 guuid=7e5d61e2-1600-0000-6cbc-8af9330c0000 pid=3123->guuid=aca7e0e3-1600-0000-6cbc-8af9360c0000 pid=3126 execve guuid=0aeb0ee4-1600-0000-6cbc-8af9370c0000 pid=3127 /usr/bin/bash guuid=7e5d61e2-1600-0000-6cbc-8af9330c0000 pid=3123->guuid=0aeb0ee4-1600-0000-6cbc-8af9370c0000 pid=3127 clone guuid=4ebae9e4-1600-0000-6cbc-8af93b0c0000 pid=3131 /usr/bin/cp guuid=7e5d61e2-1600-0000-6cbc-8af9330c0000 pid=3123->guuid=4ebae9e4-1600-0000-6cbc-8af93b0c0000 pid=3131 execve guuid=378474e5-1600-0000-6cbc-8af93d0c0000 pid=3133 /usr/bin/mkdir guuid=7e5d61e2-1600-0000-6cbc-8af9330c0000 pid=3123->guuid=378474e5-1600-0000-6cbc-8af93d0c0000 pid=3133 execve guuid=b229bae5-1600-0000-6cbc-8af93e0c0000 pid=3134 /usr/bin/mkdir guuid=7e5d61e2-1600-0000-6cbc-8af9330c0000 pid=3123->guuid=b229bae5-1600-0000-6cbc-8af93e0c0000 pid=3134 execve guuid=138c05e6-1600-0000-6cbc-8af9400c0000 pid=3136 /usr/bin/mkdir guuid=7e5d61e2-1600-0000-6cbc-8af9330c0000 pid=3123->guuid=138c05e6-1600-0000-6cbc-8af9400c0000 pid=3136 execve guuid=545750e6-1600-0000-6cbc-8af9410c0000 pid=3137 /usr/bin/mkdir guuid=7e5d61e2-1600-0000-6cbc-8af9330c0000 pid=3123->guuid=545750e6-1600-0000-6cbc-8af9410c0000 pid=3137 execve guuid=c4ba9ce6-1600-0000-6cbc-8af9420c0000 pid=3138 /usr/bin/mkdir guuid=7e5d61e2-1600-0000-6cbc-8af9330c0000 pid=3123->guuid=c4ba9ce6-1600-0000-6cbc-8af9420c0000 pid=3138 execve guuid=d86dd9e7-1600-0000-6cbc-8af9440c0000 pid=3140 /usr/bin/mkdir guuid=7e5d61e2-1600-0000-6cbc-8af9330c0000 pid=3123->guuid=d86dd9e7-1600-0000-6cbc-8af9440c0000 pid=3140 execve guuid=024a96e8-1600-0000-6cbc-8af9450c0000 pid=3141 /usr/bin/mkdir guuid=7e5d61e2-1600-0000-6cbc-8af9330c0000 pid=3123->guuid=024a96e8-1600-0000-6cbc-8af9450c0000 pid=3141 execve guuid=89501ee9-1600-0000-6cbc-8af9470c0000 pid=3143 /usr/bin/mkdir guuid=7e5d61e2-1600-0000-6cbc-8af9330c0000 pid=3123->guuid=89501ee9-1600-0000-6cbc-8af9470c0000 pid=3143 execve guuid=185872e9-1600-0000-6cbc-8af94a0c0000 pid=3146 /usr/bin/mkdir guuid=7e5d61e2-1600-0000-6cbc-8af9330c0000 pid=3123->guuid=185872e9-1600-0000-6cbc-8af94a0c0000 pid=3146 execve guuid=78dadae9-1600-0000-6cbc-8af94c0c0000 pid=3148 /usr/bin/cp guuid=7e5d61e2-1600-0000-6cbc-8af9330c0000 pid=3123->guuid=78dadae9-1600-0000-6cbc-8af94c0c0000 pid=3148 execve guuid=b37455ea-1600-0000-6cbc-8af94e0c0000 pid=3150 /usr/bin/cp guuid=7e5d61e2-1600-0000-6cbc-8af9330c0000 pid=3123->guuid=b37455ea-1600-0000-6cbc-8af94e0c0000 pid=3150 execve guuid=522cceea-1600-0000-6cbc-8af9500c0000 pid=3152 /usr/bin/cp guuid=7e5d61e2-1600-0000-6cbc-8af9330c0000 pid=3123->guuid=522cceea-1600-0000-6cbc-8af9500c0000 pid=3152 execve guuid=4fb143eb-1600-0000-6cbc-8af9510c0000 pid=3153 /usr/bin/cp guuid=7e5d61e2-1600-0000-6cbc-8af9330c0000 pid=3123->guuid=4fb143eb-1600-0000-6cbc-8af9510c0000 pid=3153 execve guuid=2e3fb1eb-1600-0000-6cbc-8af9520c0000 pid=3154 /usr/bin/cp guuid=7e5d61e2-1600-0000-6cbc-8af9330c0000 pid=3123->guuid=2e3fb1eb-1600-0000-6cbc-8af9520c0000 pid=3154 execve guuid=7b5529ec-1600-0000-6cbc-8af9530c0000 pid=3155 /usr/bin/cp guuid=7e5d61e2-1600-0000-6cbc-8af9330c0000 pid=3123->guuid=7b5529ec-1600-0000-6cbc-8af9530c0000 pid=3155 execve guuid=c56ba9ec-1600-0000-6cbc-8af9540c0000 pid=3156 /usr/bin/cp guuid=7e5d61e2-1600-0000-6cbc-8af9330c0000 pid=3123->guuid=c56ba9ec-1600-0000-6cbc-8af9540c0000 pid=3156 execve guuid=df531ded-1600-0000-6cbc-8af9550c0000 pid=3157 /usr/bin/cp guuid=7e5d61e2-1600-0000-6cbc-8af9330c0000 pid=3123->guuid=df531ded-1600-0000-6cbc-8af9550c0000 pid=3157 execve guuid=e2cd95ed-1600-0000-6cbc-8af9560c0000 pid=3158 /usr/bin/cp guuid=7e5d61e2-1600-0000-6cbc-8af9330c0000 pid=3123->guuid=e2cd95ed-1600-0000-6cbc-8af9560c0000 pid=3158 execve guuid=efeb0fee-1600-0000-6cbc-8af9570c0000 pid=3159 /usr/bin/cp guuid=7e5d61e2-1600-0000-6cbc-8af9330c0000 pid=3123->guuid=efeb0fee-1600-0000-6cbc-8af9570c0000 pid=3159 execve guuid=e86614ef-1600-0000-6cbc-8af9580c0000 pid=3160 /usr/bin/cp guuid=7e5d61e2-1600-0000-6cbc-8af9330c0000 pid=3123->guuid=e86614ef-1600-0000-6cbc-8af9580c0000 pid=3160 execve guuid=66409cef-1600-0000-6cbc-8af9590c0000 pid=3161 /usr/bin/cp guuid=7e5d61e2-1600-0000-6cbc-8af9330c0000 pid=3123->guuid=66409cef-1600-0000-6cbc-8af9590c0000 pid=3161 execve guuid=f1e817f0-1600-0000-6cbc-8af95a0c0000 pid=3162 /usr/bin/cp guuid=7e5d61e2-1600-0000-6cbc-8af9330c0000 pid=3123->guuid=f1e817f0-1600-0000-6cbc-8af95a0c0000 pid=3162 execve guuid=6e8297f0-1600-0000-6cbc-8af95b0c0000 pid=3163 /usr/bin/cp guuid=7e5d61e2-1600-0000-6cbc-8af9330c0000 pid=3123->guuid=6e8297f0-1600-0000-6cbc-8af95b0c0000 pid=3163 execve guuid=6b6d52f1-1600-0000-6cbc-8af95c0c0000 pid=3164 /usr/bin/touch guuid=7e5d61e2-1600-0000-6cbc-8af9330c0000 pid=3123->guuid=6b6d52f1-1600-0000-6cbc-8af95c0c0000 pid=3164 execve guuid=e8e7b2f1-1600-0000-6cbc-8af95d0c0000 pid=3165 /usr/bin/chmod guuid=7e5d61e2-1600-0000-6cbc-8af9330c0000 pid=3123->guuid=e8e7b2f1-1600-0000-6cbc-8af95d0c0000 pid=3165 execve guuid=76040cf2-1600-0000-6cbc-8af95e0c0000 pid=3166 /usr/bin/chmod guuid=7e5d61e2-1600-0000-6cbc-8af9330c0000 pid=3123->guuid=76040cf2-1600-0000-6cbc-8af95e0c0000 pid=3166 execve guuid=f0bd5df2-1600-0000-6cbc-8af9600c0000 pid=3168 /usr/bin/chattr guuid=7e5d61e2-1600-0000-6cbc-8af9330c0000 pid=3123->guuid=f0bd5df2-1600-0000-6cbc-8af9600c0000 pid=3168 execve guuid=14cbdaf2-1600-0000-6cbc-8af9610c0000 pid=3169 /usr/bin/chattr guuid=7e5d61e2-1600-0000-6cbc-8af9330c0000 pid=3123->guuid=14cbdaf2-1600-0000-6cbc-8af9610c0000 pid=3169 execve guuid=7a143bf3-1600-0000-6cbc-8af9620c0000 pid=3170 /usr/bin/chattr guuid=7e5d61e2-1600-0000-6cbc-8af9330c0000 pid=3123->guuid=7a143bf3-1600-0000-6cbc-8af9620c0000 pid=3170 execve guuid=af2c9ef3-1600-0000-6cbc-8af9630c0000 pid=3171 /usr/bin/chattr guuid=7e5d61e2-1600-0000-6cbc-8af9330c0000 pid=3123->guuid=af2c9ef3-1600-0000-6cbc-8af9630c0000 pid=3171 execve guuid=1c8dfef3-1600-0000-6cbc-8af9640c0000 pid=3172 /usr/bin/chattr guuid=7e5d61e2-1600-0000-6cbc-8af9330c0000 pid=3123->guuid=1c8dfef3-1600-0000-6cbc-8af9640c0000 pid=3172 execve guuid=5bbb5ff4-1600-0000-6cbc-8af9650c0000 pid=3173 /usr/bin/chattr guuid=7e5d61e2-1600-0000-6cbc-8af9330c0000 pid=3123->guuid=5bbb5ff4-1600-0000-6cbc-8af9650c0000 pid=3173 execve guuid=bb61a6f4-1600-0000-6cbc-8af9670c0000 pid=3175 /usr/bin/chattr guuid=7e5d61e2-1600-0000-6cbc-8af9330c0000 pid=3123->guuid=bb61a6f4-1600-0000-6cbc-8af9670c0000 pid=3175 execve guuid=6e28eaf4-1600-0000-6cbc-8af9690c0000 pid=3177 /usr/bin/chattr guuid=7e5d61e2-1600-0000-6cbc-8af9330c0000 pid=3123->guuid=6e28eaf4-1600-0000-6cbc-8af9690c0000 pid=3177 execve guuid=10d62ef5-1600-0000-6cbc-8af96b0c0000 pid=3179 /usr/bin/bash guuid=7e5d61e2-1600-0000-6cbc-8af9330c0000 pid=3123->guuid=10d62ef5-1600-0000-6cbc-8af96b0c0000 pid=3179 clone guuid=cc8935f5-1600-0000-6cbc-8af96c0c0000 pid=3180 /usr/bin/bash guuid=7e5d61e2-1600-0000-6cbc-8af9330c0000 pid=3123->guuid=cc8935f5-1600-0000-6cbc-8af96c0c0000 pid=3180 clone guuid=50335bf5-1600-0000-6cbc-8af96e0c0000 pid=3182 /usr/bin/curl net send-data guuid=7e5d61e2-1600-0000-6cbc-8af9330c0000 pid=3123->guuid=50335bf5-1600-0000-6cbc-8af96e0c0000 pid=3182 execve guuid=e06d5ff5-1600-0000-6cbc-8af96f0c0000 pid=3183 /usr/bin/dash guuid=7e5d61e2-1600-0000-6cbc-8af9330c0000 pid=3123->guuid=e06d5ff5-1600-0000-6cbc-8af96f0c0000 pid=3183 execve guuid=81d6abfc-1600-0000-6cbc-8af9870c0000 pid=3207 /usr/bin/bash guuid=7e5d61e2-1600-0000-6cbc-8af9330c0000 pid=3123->guuid=81d6abfc-1600-0000-6cbc-8af9870c0000 pid=3207 clone guuid=78f9b2fc-1600-0000-6cbc-8af9880c0000 pid=3208 /usr/bin/base64 guuid=7e5d61e2-1600-0000-6cbc-8af9330c0000 pid=3123->guuid=78f9b2fc-1600-0000-6cbc-8af9880c0000 pid=3208 execve guuid=95c6b8fc-1600-0000-6cbc-8af9890c0000 pid=3209 /usr/bin/tee write-file guuid=7e5d61e2-1600-0000-6cbc-8af9330c0000 pid=3123->guuid=95c6b8fc-1600-0000-6cbc-8af9890c0000 pid=3209 execve guuid=5b9f39fd-1600-0000-6cbc-8af98c0c0000 pid=3212 /usr/bin/bash guuid=7e5d61e2-1600-0000-6cbc-8af9330c0000 pid=3123->guuid=5b9f39fd-1600-0000-6cbc-8af98c0c0000 pid=3212 execve guuid=d9860205-1700-0000-6cbc-8af9ae0c0000 pid=3246 /usr/bin/bash guuid=7e5d61e2-1600-0000-6cbc-8af9330c0000 pid=3123->guuid=d9860205-1700-0000-6cbc-8af9ae0c0000 pid=3246 execve guuid=5388a305-1700-0000-6cbc-8af9b10c0000 pid=3249 /usr/bin/rm delete-file guuid=7e5d61e2-1600-0000-6cbc-8af9330c0000 pid=3123->guuid=5388a305-1700-0000-6cbc-8af9b10c0000 pid=3249 execve guuid=1490fa05-1700-0000-6cbc-8af9b30c0000 pid=3251 /usr/bin/rm guuid=7e5d61e2-1600-0000-6cbc-8af9330c0000 pid=3123->guuid=1490fa05-1700-0000-6cbc-8af9b30c0000 pid=3251 execve guuid=ed595b06-1700-0000-6cbc-8af9b50c0000 pid=3253 /usr/bin/curl net send-data guuid=7e5d61e2-1600-0000-6cbc-8af9330c0000 pid=3123->guuid=ed595b06-1700-0000-6cbc-8af9b50c0000 pid=3253 execve guuid=6a4e6306-1700-0000-6cbc-8af9b60c0000 pid=3254 /usr/bin/dash guuid=7e5d61e2-1600-0000-6cbc-8af9330c0000 pid=3123->guuid=6a4e6306-1700-0000-6cbc-8af9b60c0000 pid=3254 execve 124ee36c-bdbd-5d46-bbb1-b2cd81367f04 160.119.69.4:80 guuid=50335bf5-1600-0000-6cbc-8af96e0c0000 pid=3182->124ee36c-bdbd-5d46-bbb1-b2cd81367f04 send: 93B guuid=b9c99ffd-1600-0000-6cbc-8af98e0c0000 pid=3214 /usr/bin/bash guuid=5b9f39fd-1600-0000-6cbc-8af98c0c0000 pid=3212->guuid=b9c99ffd-1600-0000-6cbc-8af98e0c0000 pid=3214 clone guuid=ed07a7fd-1600-0000-6cbc-8af98f0c0000 pid=3215 /usr/bin/bash guuid=5b9f39fd-1600-0000-6cbc-8af98c0c0000 pid=3212->guuid=ed07a7fd-1600-0000-6cbc-8af98f0c0000 pid=3215 clone guuid=3e21d2fd-1600-0000-6cbc-8af9910c0000 pid=3217 /usr/bin/ls guuid=5b9f39fd-1600-0000-6cbc-8af98c0c0000 pid=3212->guuid=3e21d2fd-1600-0000-6cbc-8af9910c0000 pid=3217 execve guuid=16d766fe-1600-0000-6cbc-8af9930c0000 pid=3219 /usr/bin/cat guuid=5b9f39fd-1600-0000-6cbc-8af98c0c0000 pid=3212->guuid=16d766fe-1600-0000-6cbc-8af9930c0000 pid=3219 execve guuid=dce8c3fe-1600-0000-6cbc-8af9950c0000 pid=3221 /usr/bin/ls guuid=5b9f39fd-1600-0000-6cbc-8af98c0c0000 pid=3212->guuid=dce8c3fe-1600-0000-6cbc-8af9950c0000 pid=3221 execve guuid=0db452ff-1600-0000-6cbc-8af9980c0000 pid=3224 /usr/bin/mkdir guuid=5b9f39fd-1600-0000-6cbc-8af98c0c0000 pid=3212->guuid=0db452ff-1600-0000-6cbc-8af9980c0000 pid=3224 execve guuid=9639bfff-1600-0000-6cbc-8af99a0c0000 pid=3226 /usr/bin/mv guuid=5b9f39fd-1600-0000-6cbc-8af98c0c0000 pid=3212->guuid=9639bfff-1600-0000-6cbc-8af99a0c0000 pid=3226 execve guuid=cc1d4800-1700-0000-6cbc-8af99c0c0000 pid=3228 /usr/bin/bash guuid=5b9f39fd-1600-0000-6cbc-8af98c0c0000 pid=3212->guuid=cc1d4800-1700-0000-6cbc-8af99c0c0000 pid=3228 clone guuid=280a5200-1700-0000-6cbc-8af99d0c0000 pid=3229 /usr/bin/base64 write-file guuid=5b9f39fd-1600-0000-6cbc-8af98c0c0000 pid=3212->guuid=280a5200-1700-0000-6cbc-8af99d0c0000 pid=3229 execve guuid=bf4ac300-1700-0000-6cbc-8af99f0c0000 pid=3231 /usr/bin/rm delete-file guuid=5b9f39fd-1600-0000-6cbc-8af98c0c0000 pid=3212->guuid=bf4ac300-1700-0000-6cbc-8af99f0c0000 pid=3231 execve guuid=b2df1a01-1700-0000-6cbc-8af9a00c0000 pid=3232 /usr/bin/mv guuid=5b9f39fd-1600-0000-6cbc-8af98c0c0000 pid=3212->guuid=b2df1a01-1700-0000-6cbc-8af9a00c0000 pid=3232 execve guuid=b7741f02-1700-0000-6cbc-8af9a30c0000 pid=3235 /usr/bin/ls guuid=5b9f39fd-1600-0000-6cbc-8af98c0c0000 pid=3212->guuid=b7741f02-1700-0000-6cbc-8af9a30c0000 pid=3235 execve guuid=8c2ff502-1700-0000-6cbc-8af9a60c0000 pid=3238 /usr/bin/bash guuid=5b9f39fd-1600-0000-6cbc-8af98c0c0000 pid=3212->guuid=8c2ff502-1700-0000-6cbc-8af9a60c0000 pid=3238 clone guuid=8dd0fe02-1700-0000-6cbc-8af9a70c0000 pid=3239 /usr/bin/base64 write-file guuid=5b9f39fd-1600-0000-6cbc-8af98c0c0000 pid=3212->guuid=8dd0fe02-1700-0000-6cbc-8af9a70c0000 pid=3239 execve guuid=52d87303-1700-0000-6cbc-8af9a90c0000 pid=3241 /usr/bin/ls guuid=5b9f39fd-1600-0000-6cbc-8af98c0c0000 pid=3212->guuid=52d87303-1700-0000-6cbc-8af9a90c0000 pid=3241 execve guuid=e7b60404-1700-0000-6cbc-8af9ab0c0000 pid=3243 /usr/bin/cat guuid=5b9f39fd-1600-0000-6cbc-8af98c0c0000 pid=3212->guuid=e7b60404-1700-0000-6cbc-8af9ab0c0000 pid=3243 execve guuid=e9076c04-1700-0000-6cbc-8af9ad0c0000 pid=3245 /usr/bin/ls guuid=5b9f39fd-1600-0000-6cbc-8af98c0c0000 pid=3212->guuid=e9076c04-1700-0000-6cbc-8af9ad0c0000 pid=3245 execve guuid=ed595b06-1700-0000-6cbc-8af9b50c0000 pid=3253->124ee36c-bdbd-5d46-bbb1-b2cd81367f04 send: 93B
Score:
82%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/2605b24e59d3ecb1bca62d27a267a691373cf31343aadc5fbeab39f4554ba3fd
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2605b24e59d3ecb1bca62d27a267a691373cf31343aadc5fbeab39f4554ba3fd/
Threat name:
Linux.Backdoor.WebShell
Create hunting rule
Status:
Malicious
First seen:
2026-08-10 15:34:39 UTC
File Type:
Text (Shell)
AV detection:
12 of 24 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=eyc3etsz2pwldpfgfut2ez5gse3tz4ytiovnyx56vm47ivklup6q._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260810-smqf5sha55/
Behaviour
Reads runtime system information
Writes file to tmp directory
Deobfuscate/Decode Files or Information
Checks CPU configuration
File and Directory Permissions Modification
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.16
Link:
https://yomi.yoroi.company/submissions/2605b24e59d3ecb1bca62d27a267a691373cf31343aadc5fbeab39f4554ba3fd

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SUSP_LNX_Base64_Exec_Apr24
Create hunting rule
Author:Christian Burkard
Description:Detects suspicious base64 encoded shell commands (as seen in Palo Alto CVE-2024-3400 exploitation)
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 2605b24e59d3ecb1bca62d27a267a691373cf31343aadc5fbeab39f4554ba3fd

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3884409/
  
Delivery method
Distributed via web download

Comments