MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2c4cf6717cdc5227d8c96a4fd45af2b03e522d028964de25f76a0142bd1a714b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2c4cf6717cdc5227d8c96a4fd45af2b03e522d028964de25f76a0142bd1a714b
SHA3-384 hash: 32d07ba4f17f1c166eedd0c6aa22ba2acbc0b8e3287ad6b76261dae0c1224dd274461aebc63957886d79684fecbb4b59
SHA1 hash: 7c39dc62b04bbf70f542050471dddb2a85a9bbf3
MD5 hash: 7cb79d9f4a0e00ea6161c4732c7c778b
humanhash: delta-wisconsin-golf-fifteen
File name:wr.php
Download: download sample
File size:27'042 bytes
First seen:2026-07-16 06:40:33 UTC
Last seen:2026-07-16 10:50:30 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 768:28vCB+25j6es8Rl9FYpMSUpi+20qUpi+20YQX:28l25JDd2QX
TLSH T137C27D966A867C44BEC98A3E4CBD2B1D6DF5C3D1224942AC3D8B3C71DC11F9CD618B1A
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://160.119.69.4/z/post/noroot.phpn/an/an/a

Intelligence

File Origin
# of uploads :
2
# of downloads :
45
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.BV.Agent-BNR.76291935.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive masquerade
Link:
https://www.filescan.io/uploads/6a587cf2df70bd3904899e68/reports/09b04304-7eb9-420a-877d-fabb963663a9/overview
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/e80e3695-daab-4806-a5db-d8a28317c021
Behavior Graph:
Download SVG
%3 guuid=dc878d44-1900-0000-c8e9-77af2c140000 pid=5164 /usr/bin/sudo guuid=af970e47-1900-0000-c8e9-77af2d140000 pid=5165 /tmp/sample.bin guuid=dc878d44-1900-0000-c8e9-77af2c140000 pid=5164->guuid=af970e47-1900-0000-c8e9-77af2d140000 pid=5165 execve guuid=b9082148-1900-0000-c8e9-77af2e140000 pid=5166 /usr/bin/bash guuid=af970e47-1900-0000-c8e9-77af2d140000 pid=5165->guuid=b9082148-1900-0000-c8e9-77af2e140000 pid=5166 clone guuid=fae02d48-1900-0000-c8e9-77af2f140000 pid=5167 /usr/bin/base64 guuid=af970e47-1900-0000-c8e9-77af2d140000 pid=5165->guuid=fae02d48-1900-0000-c8e9-77af2f140000 pid=5167 execve guuid=261d5648-1900-0000-c8e9-77af30140000 pid=5168 /usr/bin/bash guuid=af970e47-1900-0000-c8e9-77af2d140000 pid=5165->guuid=261d5648-1900-0000-c8e9-77af30140000 pid=5168 clone guuid=f0486749-1900-0000-c8e9-77af31140000 pid=5169 /usr/bin/cp guuid=af970e47-1900-0000-c8e9-77af2d140000 pid=5165->guuid=f0486749-1900-0000-c8e9-77af31140000 pid=5169 execve guuid=8825f049-1900-0000-c8e9-77af32140000 pid=5170 /usr/bin/mkdir guuid=af970e47-1900-0000-c8e9-77af2d140000 pid=5165->guuid=8825f049-1900-0000-c8e9-77af32140000 pid=5170 execve guuid=1b6c5d4a-1900-0000-c8e9-77af33140000 pid=5171 /usr/bin/mkdir guuid=af970e47-1900-0000-c8e9-77af2d140000 pid=5165->guuid=1b6c5d4a-1900-0000-c8e9-77af33140000 pid=5171 execve guuid=e935c54a-1900-0000-c8e9-77af34140000 pid=5172 /usr/bin/mkdir guuid=af970e47-1900-0000-c8e9-77af2d140000 pid=5165->guuid=e935c54a-1900-0000-c8e9-77af34140000 pid=5172 execve guuid=1a47244b-1900-0000-c8e9-77af35140000 pid=5173 /usr/bin/mkdir guuid=af970e47-1900-0000-c8e9-77af2d140000 pid=5165->guuid=1a47244b-1900-0000-c8e9-77af35140000 pid=5173 execve guuid=0e40874b-1900-0000-c8e9-77af36140000 pid=5174 /usr/bin/mkdir guuid=af970e47-1900-0000-c8e9-77af2d140000 pid=5165->guuid=0e40874b-1900-0000-c8e9-77af36140000 pid=5174 execve guuid=2379e94b-1900-0000-c8e9-77af37140000 pid=5175 /usr/bin/mkdir guuid=af970e47-1900-0000-c8e9-77af2d140000 pid=5165->guuid=2379e94b-1900-0000-c8e9-77af37140000 pid=5175 execve guuid=e729614c-1900-0000-c8e9-77af38140000 pid=5176 /usr/bin/mkdir guuid=af970e47-1900-0000-c8e9-77af2d140000 pid=5165->guuid=e729614c-1900-0000-c8e9-77af38140000 pid=5176 execve guuid=888dc24c-1900-0000-c8e9-77af39140000 pid=5177 /usr/bin/mkdir guuid=af970e47-1900-0000-c8e9-77af2d140000 pid=5165->guuid=888dc24c-1900-0000-c8e9-77af39140000 pid=5177 execve guuid=4a74284d-1900-0000-c8e9-77af3a140000 pid=5178 /usr/bin/mkdir guuid=af970e47-1900-0000-c8e9-77af2d140000 pid=5165->guuid=4a74284d-1900-0000-c8e9-77af3a140000 pid=5178 execve guuid=977f8b4d-1900-0000-c8e9-77af3b140000 pid=5179 /usr/bin/cp guuid=af970e47-1900-0000-c8e9-77af2d140000 pid=5165->guuid=977f8b4d-1900-0000-c8e9-77af3b140000 pid=5179 execve guuid=91e6fc4d-1900-0000-c8e9-77af3c140000 pid=5180 /usr/bin/cp guuid=af970e47-1900-0000-c8e9-77af2d140000 pid=5165->guuid=91e6fc4d-1900-0000-c8e9-77af3c140000 pid=5180 execve guuid=982d774e-1900-0000-c8e9-77af3d140000 pid=5181 /usr/bin/cp guuid=af970e47-1900-0000-c8e9-77af2d140000 pid=5165->guuid=982d774e-1900-0000-c8e9-77af3d140000 pid=5181 execve guuid=6bade64e-1900-0000-c8e9-77af3e140000 pid=5182 /usr/bin/cp guuid=af970e47-1900-0000-c8e9-77af2d140000 pid=5165->guuid=6bade64e-1900-0000-c8e9-77af3e140000 pid=5182 execve guuid=58433f50-1900-0000-c8e9-77af3f140000 pid=5183 /usr/bin/cp guuid=af970e47-1900-0000-c8e9-77af2d140000 pid=5165->guuid=58433f50-1900-0000-c8e9-77af3f140000 pid=5183 execve guuid=1e90a750-1900-0000-c8e9-77af40140000 pid=5184 /usr/bin/cp guuid=af970e47-1900-0000-c8e9-77af2d140000 pid=5165->guuid=1e90a750-1900-0000-c8e9-77af40140000 pid=5184 execve guuid=3bb01651-1900-0000-c8e9-77af41140000 pid=5185 /usr/bin/cp guuid=af970e47-1900-0000-c8e9-77af2d140000 pid=5165->guuid=3bb01651-1900-0000-c8e9-77af41140000 pid=5185 execve guuid=61798951-1900-0000-c8e9-77af42140000 pid=5186 /usr/bin/cp guuid=af970e47-1900-0000-c8e9-77af2d140000 pid=5165->guuid=61798951-1900-0000-c8e9-77af42140000 pid=5186 execve guuid=d823f751-1900-0000-c8e9-77af43140000 pid=5187 /usr/bin/cp guuid=af970e47-1900-0000-c8e9-77af2d140000 pid=5165->guuid=d823f751-1900-0000-c8e9-77af43140000 pid=5187 execve guuid=d7617252-1900-0000-c8e9-77af44140000 pid=5188 /usr/bin/cp guuid=af970e47-1900-0000-c8e9-77af2d140000 pid=5165->guuid=d7617252-1900-0000-c8e9-77af44140000 pid=5188 execve guuid=741fe452-1900-0000-c8e9-77af45140000 pid=5189 /usr/bin/cp guuid=af970e47-1900-0000-c8e9-77af2d140000 pid=5165->guuid=741fe452-1900-0000-c8e9-77af45140000 pid=5189 execve guuid=2ed85653-1900-0000-c8e9-77af46140000 pid=5190 /usr/bin/cp guuid=af970e47-1900-0000-c8e9-77af2d140000 pid=5165->guuid=2ed85653-1900-0000-c8e9-77af46140000 pid=5190 execve guuid=60c3cf53-1900-0000-c8e9-77af47140000 pid=5191 /usr/bin/cp guuid=af970e47-1900-0000-c8e9-77af2d140000 pid=5165->guuid=60c3cf53-1900-0000-c8e9-77af47140000 pid=5191 execve guuid=0c5c4254-1900-0000-c8e9-77af48140000 pid=5192 /usr/bin/cp guuid=af970e47-1900-0000-c8e9-77af2d140000 pid=5165->guuid=0c5c4254-1900-0000-c8e9-77af48140000 pid=5192 execve guuid=02a2b654-1900-0000-c8e9-77af49140000 pid=5193 /usr/bin/touch guuid=af970e47-1900-0000-c8e9-77af2d140000 pid=5165->guuid=02a2b654-1900-0000-c8e9-77af49140000 pid=5193 execve guuid=b7760855-1900-0000-c8e9-77af4a140000 pid=5194 /usr/bin/chmod guuid=af970e47-1900-0000-c8e9-77af2d140000 pid=5165->guuid=b7760855-1900-0000-c8e9-77af4a140000 pid=5194 execve guuid=6dfd5a55-1900-0000-c8e9-77af4b140000 pid=5195 /usr/bin/chmod guuid=af970e47-1900-0000-c8e9-77af2d140000 pid=5165->guuid=6dfd5a55-1900-0000-c8e9-77af4b140000 pid=5195 execve guuid=5820ab55-1900-0000-c8e9-77af4c140000 pid=5196 /usr/bin/chattr guuid=af970e47-1900-0000-c8e9-77af2d140000 pid=5165->guuid=5820ab55-1900-0000-c8e9-77af4c140000 pid=5196 execve guuid=6e921156-1900-0000-c8e9-77af4d140000 pid=5197 /usr/bin/chattr guuid=af970e47-1900-0000-c8e9-77af2d140000 pid=5165->guuid=6e921156-1900-0000-c8e9-77af4d140000 pid=5197 execve guuid=9db46d56-1900-0000-c8e9-77af4e140000 pid=5198 /usr/bin/chattr guuid=af970e47-1900-0000-c8e9-77af2d140000 pid=5165->guuid=9db46d56-1900-0000-c8e9-77af4e140000 pid=5198 execve guuid=34cac356-1900-0000-c8e9-77af4f140000 pid=5199 /usr/bin/chattr guuid=af970e47-1900-0000-c8e9-77af2d140000 pid=5165->guuid=34cac356-1900-0000-c8e9-77af4f140000 pid=5199 execve guuid=7ab31557-1900-0000-c8e9-77af50140000 pid=5200 /usr/bin/chattr guuid=af970e47-1900-0000-c8e9-77af2d140000 pid=5165->guuid=7ab31557-1900-0000-c8e9-77af50140000 pid=5200 execve guuid=defd6357-1900-0000-c8e9-77af51140000 pid=5201 /usr/bin/chattr guuid=af970e47-1900-0000-c8e9-77af2d140000 pid=5165->guuid=defd6357-1900-0000-c8e9-77af51140000 pid=5201 execve guuid=0d33b457-1900-0000-c8e9-77af52140000 pid=5202 /usr/bin/chattr guuid=af970e47-1900-0000-c8e9-77af2d140000 pid=5165->guuid=0d33b457-1900-0000-c8e9-77af52140000 pid=5202 execve guuid=10950258-1900-0000-c8e9-77af53140000 pid=5203 /usr/bin/chattr guuid=af970e47-1900-0000-c8e9-77af2d140000 pid=5165->guuid=10950258-1900-0000-c8e9-77af53140000 pid=5203 execve guuid=ce585958-1900-0000-c8e9-77af54140000 pid=5204 /usr/bin/bash guuid=af970e47-1900-0000-c8e9-77af2d140000 pid=5165->guuid=ce585958-1900-0000-c8e9-77af54140000 pid=5204 clone guuid=6c746758-1900-0000-c8e9-77af55140000 pid=5205 /usr/bin/bash guuid=af970e47-1900-0000-c8e9-77af2d140000 pid=5165->guuid=6c746758-1900-0000-c8e9-77af55140000 pid=5205 clone guuid=715dc458-1900-0000-c8e9-77af56140000 pid=5206 /usr/bin/curl net send-data guuid=af970e47-1900-0000-c8e9-77af2d140000 pid=5165->guuid=715dc458-1900-0000-c8e9-77af56140000 pid=5206 execve guuid=15ebca58-1900-0000-c8e9-77af57140000 pid=5207 /usr/bin/dash guuid=af970e47-1900-0000-c8e9-77af2d140000 pid=5165->guuid=15ebca58-1900-0000-c8e9-77af57140000 pid=5207 execve guuid=d6e3d562-1900-0000-c8e9-77af58140000 pid=5208 /usr/bin/bash guuid=af970e47-1900-0000-c8e9-77af2d140000 pid=5165->guuid=d6e3d562-1900-0000-c8e9-77af58140000 pid=5208 clone guuid=ee81df62-1900-0000-c8e9-77af59140000 pid=5209 /usr/bin/base64 guuid=af970e47-1900-0000-c8e9-77af2d140000 pid=5165->guuid=ee81df62-1900-0000-c8e9-77af59140000 pid=5209 execve guuid=b3c7e962-1900-0000-c8e9-77af5a140000 pid=5210 /usr/bin/tee write-file guuid=af970e47-1900-0000-c8e9-77af2d140000 pid=5165->guuid=b3c7e962-1900-0000-c8e9-77af5a140000 pid=5210 execve guuid=0a9d8a65-1900-0000-c8e9-77af5b140000 pid=5211 /usr/bin/bash guuid=af970e47-1900-0000-c8e9-77af2d140000 pid=5165->guuid=0a9d8a65-1900-0000-c8e9-77af5b140000 pid=5211 execve guuid=7bdfb96c-1900-0000-c8e9-77af6d140000 pid=5229 /usr/bin/bash guuid=af970e47-1900-0000-c8e9-77af2d140000 pid=5165->guuid=7bdfb96c-1900-0000-c8e9-77af6d140000 pid=5229 execve guuid=20fb266d-1900-0000-c8e9-77af6e140000 pid=5230 /usr/bin/rm delete-file guuid=af970e47-1900-0000-c8e9-77af2d140000 pid=5165->guuid=20fb266d-1900-0000-c8e9-77af6e140000 pid=5230 execve guuid=d653766d-1900-0000-c8e9-77af6f140000 pid=5231 /usr/bin/rm guuid=af970e47-1900-0000-c8e9-77af2d140000 pid=5165->guuid=d653766d-1900-0000-c8e9-77af6f140000 pid=5231 execve guuid=b02bd36d-1900-0000-c8e9-77af70140000 pid=5232 /usr/bin/curl net send-data guuid=af970e47-1900-0000-c8e9-77af2d140000 pid=5165->guuid=b02bd36d-1900-0000-c8e9-77af70140000 pid=5232 execve guuid=b86ce06d-1900-0000-c8e9-77af71140000 pid=5233 /usr/bin/dash guuid=af970e47-1900-0000-c8e9-77af2d140000 pid=5165->guuid=b86ce06d-1900-0000-c8e9-77af71140000 pid=5233 execve 124ee36c-bdbd-5d46-bbb1-b2cd81367f04 160.119.69.4:80 guuid=715dc458-1900-0000-c8e9-77af56140000 pid=5206->124ee36c-bdbd-5d46-bbb1-b2cd81367f04 send: 93B guuid=e178e965-1900-0000-c8e9-77af5c140000 pid=5212 /usr/bin/bash guuid=0a9d8a65-1900-0000-c8e9-77af5b140000 pid=5211->guuid=e178e965-1900-0000-c8e9-77af5c140000 pid=5212 clone guuid=4ca5f465-1900-0000-c8e9-77af5d140000 pid=5213 /usr/bin/bash guuid=0a9d8a65-1900-0000-c8e9-77af5b140000 pid=5211->guuid=4ca5f465-1900-0000-c8e9-77af5d140000 pid=5213 clone guuid=f5e52066-1900-0000-c8e9-77af5e140000 pid=5214 /usr/bin/ls guuid=0a9d8a65-1900-0000-c8e9-77af5b140000 pid=5211->guuid=f5e52066-1900-0000-c8e9-77af5e140000 pid=5214 execve guuid=e2b4ac66-1900-0000-c8e9-77af5f140000 pid=5215 /usr/bin/cat guuid=0a9d8a65-1900-0000-c8e9-77af5b140000 pid=5211->guuid=e2b4ac66-1900-0000-c8e9-77af5f140000 pid=5215 execve guuid=90557167-1900-0000-c8e9-77af60140000 pid=5216 /usr/bin/ls guuid=0a9d8a65-1900-0000-c8e9-77af5b140000 pid=5211->guuid=90557167-1900-0000-c8e9-77af60140000 pid=5216 execve guuid=b791e667-1900-0000-c8e9-77af61140000 pid=5217 /usr/bin/mkdir guuid=0a9d8a65-1900-0000-c8e9-77af5b140000 pid=5211->guuid=b791e667-1900-0000-c8e9-77af61140000 pid=5217 execve guuid=e2c74068-1900-0000-c8e9-77af62140000 pid=5218 /usr/bin/mv guuid=0a9d8a65-1900-0000-c8e9-77af5b140000 pid=5211->guuid=e2c74068-1900-0000-c8e9-77af62140000 pid=5218 execve guuid=1d08b168-1900-0000-c8e9-77af63140000 pid=5219 /usr/bin/bash guuid=0a9d8a65-1900-0000-c8e9-77af5b140000 pid=5211->guuid=1d08b168-1900-0000-c8e9-77af63140000 pid=5219 clone guuid=43f8bd68-1900-0000-c8e9-77af64140000 pid=5220 /usr/bin/base64 write-file guuid=0a9d8a65-1900-0000-c8e9-77af5b140000 pid=5211->guuid=43f8bd68-1900-0000-c8e9-77af64140000 pid=5220 execve guuid=bf567069-1900-0000-c8e9-77af65140000 pid=5221 /usr/bin/rm delete-file guuid=0a9d8a65-1900-0000-c8e9-77af5b140000 pid=5211->guuid=bf567069-1900-0000-c8e9-77af65140000 pid=5221 execve guuid=d72db569-1900-0000-c8e9-77af66140000 pid=5222 /usr/bin/mv guuid=0a9d8a65-1900-0000-c8e9-77af5b140000 pid=5211->guuid=d72db569-1900-0000-c8e9-77af66140000 pid=5222 execve guuid=e5451a6a-1900-0000-c8e9-77af67140000 pid=5223 /usr/bin/ls guuid=0a9d8a65-1900-0000-c8e9-77af5b140000 pid=5211->guuid=e5451a6a-1900-0000-c8e9-77af67140000 pid=5223 execve guuid=e50d826a-1900-0000-c8e9-77af68140000 pid=5224 /usr/bin/bash guuid=0a9d8a65-1900-0000-c8e9-77af5b140000 pid=5211->guuid=e50d826a-1900-0000-c8e9-77af68140000 pid=5224 clone guuid=e3eb906a-1900-0000-c8e9-77af69140000 pid=5225 /usr/bin/base64 write-file guuid=0a9d8a65-1900-0000-c8e9-77af5b140000 pid=5211->guuid=e3eb906a-1900-0000-c8e9-77af69140000 pid=5225 execve guuid=a363236b-1900-0000-c8e9-77af6a140000 pid=5226 /usr/bin/ls guuid=0a9d8a65-1900-0000-c8e9-77af5b140000 pid=5211->guuid=a363236b-1900-0000-c8e9-77af6a140000 pid=5226 execve guuid=e8d89f6b-1900-0000-c8e9-77af6b140000 pid=5227 /usr/bin/cat guuid=0a9d8a65-1900-0000-c8e9-77af5b140000 pid=5211->guuid=e8d89f6b-1900-0000-c8e9-77af6b140000 pid=5227 execve guuid=d9ba136c-1900-0000-c8e9-77af6c140000 pid=5228 /usr/bin/ls guuid=0a9d8a65-1900-0000-c8e9-77af5b140000 pid=5211->guuid=d9ba136c-1900-0000-c8e9-77af6c140000 pid=5228 execve guuid=b02bd36d-1900-0000-c8e9-77af70140000 pid=5232->124ee36c-bdbd-5d46-bbb1-b2cd81367f04 send: 93B
Score:
81%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/2c4cf6717cdc5227d8c96a4fd45af2b03e522d028964de25f76a0142bd1a714b
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2c4cf6717cdc5227d8c96a4fd45af2b03e522d028964de25f76a0142bd1a714b/
Gathering data
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=frgpm4l43rjcpwgjnjh5iwxswa7felicrfsn4jpxniaufpi2offq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260716-hfm3bsex9m/
Behaviour
Reads runtime system information
Writes file to tmp directory
Deobfuscate/Decode Files or Information
Checks CPU configuration
File and Directory Permissions Modification
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SUSP_LNX_Base64_Exec_Apr24
Create hunting rule
Author:Christian Burkard
Description:Detects suspicious base64 encoded shell commands (as seen in Palo Alto CVE-2024-3400 exploitation)
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 2c4cf6717cdc5227d8c96a4fd45af2b03e522d028964de25f76a0142bd1a714b

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3884409/
  
Delivery method
Distributed via web download

Comments