MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2d573ab28d97298b53d789d6ffe1ce976d4c32e83d22f85d877cc688013301d1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2d573ab28d97298b53d789d6ffe1ce976d4c32e83d22f85d877cc688013301d1
SHA3-384 hash: 18898b660ade00865e6e10f99772b2ed8e81d3f41dced58064d107398caa83cf8c8a055ea7cdae7f39574ea21dc9c041
SHA1 hash: 5bb1895c14a2304b3998b97d0d3e8bdd9a74816c
MD5 hash: f03d324ae6c499fda8f3142f35c7d1c3
humanhash: florida-nineteen-failed-grey
File name:wr.php
Download: download sample
File size:27'042 bytes
First seen:2026-08-07 19:55:16 UTC
Last seen:2026-08-08 01:44:05 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 768:vC8vCB+25j6es8Rj9FYpMSUpi+20qUpi+20YQX:K8l25Jld2QX
TLSH T118C27D956A867C44BEC94A3E4CBD2B1D6DF5C3E1324942AC3D8B3C719C11F9CD618B1A
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh

Intelligence

File Origin
# of uploads :
2
# of downloads :
49
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive masquerade
Link:
https://www.filescan.io/uploads/6a76383eb384ee5e9c56dc06/reports/67a80924-b2b3-4a59-9d91-cb06555776d5/overview
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/20aa3c82-76bb-42ff-af34-6252a94862b7
Behavior Graph:
Download SVG
%3 guuid=98cb352a-1700-0000-2b58-ea86380d0000 pid=3384 /usr/bin/sudo guuid=9d7fc02d-1700-0000-2b58-ea863d0d0000 pid=3389 /tmp/sample.bin guuid=98cb352a-1700-0000-2b58-ea86380d0000 pid=3384->guuid=9d7fc02d-1700-0000-2b58-ea863d0d0000 pid=3389 execve guuid=e6ae2e2f-1700-0000-2b58-ea863e0d0000 pid=3390 /usr/bin/bash guuid=9d7fc02d-1700-0000-2b58-ea863d0d0000 pid=3389->guuid=e6ae2e2f-1700-0000-2b58-ea863e0d0000 pid=3390 clone guuid=15883b2f-1700-0000-2b58-ea863f0d0000 pid=3391 /usr/bin/base64 guuid=9d7fc02d-1700-0000-2b58-ea863d0d0000 pid=3389->guuid=15883b2f-1700-0000-2b58-ea863f0d0000 pid=3391 execve guuid=c793462f-1700-0000-2b58-ea86400d0000 pid=3392 /usr/bin/bash guuid=9d7fc02d-1700-0000-2b58-ea863d0d0000 pid=3389->guuid=c793462f-1700-0000-2b58-ea86400d0000 pid=3392 clone guuid=181af42f-1700-0000-2b58-ea86410d0000 pid=3393 /usr/bin/cp guuid=9d7fc02d-1700-0000-2b58-ea863d0d0000 pid=3389->guuid=181af42f-1700-0000-2b58-ea86410d0000 pid=3393 execve guuid=cf1d7730-1700-0000-2b58-ea86430d0000 pid=3395 /usr/bin/mkdir guuid=9d7fc02d-1700-0000-2b58-ea863d0d0000 pid=3389->guuid=cf1d7730-1700-0000-2b58-ea86430d0000 pid=3395 execve guuid=74df1c31-1700-0000-2b58-ea86440d0000 pid=3396 /usr/bin/mkdir guuid=9d7fc02d-1700-0000-2b58-ea863d0d0000 pid=3389->guuid=74df1c31-1700-0000-2b58-ea86440d0000 pid=3396 execve guuid=2d529f31-1700-0000-2b58-ea86450d0000 pid=3397 /usr/bin/mkdir guuid=9d7fc02d-1700-0000-2b58-ea863d0d0000 pid=3389->guuid=2d529f31-1700-0000-2b58-ea86450d0000 pid=3397 execve guuid=a2f62f32-1700-0000-2b58-ea86460d0000 pid=3398 /usr/bin/mkdir guuid=9d7fc02d-1700-0000-2b58-ea863d0d0000 pid=3389->guuid=a2f62f32-1700-0000-2b58-ea86460d0000 pid=3398 execve guuid=d8ceac32-1700-0000-2b58-ea86470d0000 pid=3399 /usr/bin/mkdir guuid=9d7fc02d-1700-0000-2b58-ea863d0d0000 pid=3389->guuid=d8ceac32-1700-0000-2b58-ea86470d0000 pid=3399 execve guuid=377b5233-1700-0000-2b58-ea864a0d0000 pid=3402 /usr/bin/mkdir guuid=9d7fc02d-1700-0000-2b58-ea863d0d0000 pid=3389->guuid=377b5233-1700-0000-2b58-ea864a0d0000 pid=3402 execve guuid=7a8ef933-1700-0000-2b58-ea864d0d0000 pid=3405 /usr/bin/mkdir guuid=9d7fc02d-1700-0000-2b58-ea863d0d0000 pid=3389->guuid=7a8ef933-1700-0000-2b58-ea864d0d0000 pid=3405 execve guuid=9c7d8a34-1700-0000-2b58-ea864f0d0000 pid=3407 /usr/bin/mkdir guuid=9d7fc02d-1700-0000-2b58-ea863d0d0000 pid=3389->guuid=9c7d8a34-1700-0000-2b58-ea864f0d0000 pid=3407 execve guuid=6762f534-1700-0000-2b58-ea86510d0000 pid=3409 /usr/bin/mkdir guuid=9d7fc02d-1700-0000-2b58-ea863d0d0000 pid=3389->guuid=6762f534-1700-0000-2b58-ea86510d0000 pid=3409 execve guuid=40db7135-1700-0000-2b58-ea86540d0000 pid=3412 /usr/bin/cp guuid=9d7fc02d-1700-0000-2b58-ea863d0d0000 pid=3389->guuid=40db7135-1700-0000-2b58-ea86540d0000 pid=3412 execve guuid=bcd81936-1700-0000-2b58-ea86570d0000 pid=3415 /usr/bin/cp guuid=9d7fc02d-1700-0000-2b58-ea863d0d0000 pid=3389->guuid=bcd81936-1700-0000-2b58-ea86570d0000 pid=3415 execve guuid=818e5f37-1700-0000-2b58-ea865a0d0000 pid=3418 /usr/bin/cp guuid=9d7fc02d-1700-0000-2b58-ea863d0d0000 pid=3389->guuid=818e5f37-1700-0000-2b58-ea865a0d0000 pid=3418 execve guuid=dbbfd637-1700-0000-2b58-ea865c0d0000 pid=3420 /usr/bin/cp guuid=9d7fc02d-1700-0000-2b58-ea863d0d0000 pid=3389->guuid=dbbfd637-1700-0000-2b58-ea865c0d0000 pid=3420 execve guuid=7bbd4838-1700-0000-2b58-ea865f0d0000 pid=3423 /usr/bin/cp guuid=9d7fc02d-1700-0000-2b58-ea863d0d0000 pid=3389->guuid=7bbd4838-1700-0000-2b58-ea865f0d0000 pid=3423 execve guuid=b5e3eb38-1700-0000-2b58-ea86610d0000 pid=3425 /usr/bin/cp guuid=9d7fc02d-1700-0000-2b58-ea863d0d0000 pid=3389->guuid=b5e3eb38-1700-0000-2b58-ea86610d0000 pid=3425 execve guuid=93ff7d39-1700-0000-2b58-ea86620d0000 pid=3426 /usr/bin/cp guuid=9d7fc02d-1700-0000-2b58-ea863d0d0000 pid=3389->guuid=93ff7d39-1700-0000-2b58-ea86620d0000 pid=3426 execve guuid=bd1fa23a-1700-0000-2b58-ea86630d0000 pid=3427 /usr/bin/cp guuid=9d7fc02d-1700-0000-2b58-ea863d0d0000 pid=3389->guuid=bd1fa23a-1700-0000-2b58-ea86630d0000 pid=3427 execve guuid=31517d3b-1700-0000-2b58-ea86640d0000 pid=3428 /usr/bin/cp guuid=9d7fc02d-1700-0000-2b58-ea863d0d0000 pid=3389->guuid=31517d3b-1700-0000-2b58-ea86640d0000 pid=3428 execve guuid=8acc093c-1700-0000-2b58-ea86650d0000 pid=3429 /usr/bin/cp guuid=9d7fc02d-1700-0000-2b58-ea863d0d0000 pid=3389->guuid=8acc093c-1700-0000-2b58-ea86650d0000 pid=3429 execve guuid=f564fc3c-1700-0000-2b58-ea86660d0000 pid=3430 /usr/bin/cp guuid=9d7fc02d-1700-0000-2b58-ea863d0d0000 pid=3389->guuid=f564fc3c-1700-0000-2b58-ea86660d0000 pid=3430 execve guuid=a506943d-1700-0000-2b58-ea86680d0000 pid=3432 /usr/bin/cp guuid=9d7fc02d-1700-0000-2b58-ea863d0d0000 pid=3389->guuid=a506943d-1700-0000-2b58-ea86680d0000 pid=3432 execve guuid=81c90c3e-1700-0000-2b58-ea86690d0000 pid=3433 /usr/bin/cp guuid=9d7fc02d-1700-0000-2b58-ea863d0d0000 pid=3389->guuid=81c90c3e-1700-0000-2b58-ea86690d0000 pid=3433 execve guuid=15668f3e-1700-0000-2b58-ea866a0d0000 pid=3434 /usr/bin/cp guuid=9d7fc02d-1700-0000-2b58-ea863d0d0000 pid=3389->guuid=15668f3e-1700-0000-2b58-ea866a0d0000 pid=3434 execve guuid=041a5c3f-1700-0000-2b58-ea866b0d0000 pid=3435 /usr/bin/touch guuid=9d7fc02d-1700-0000-2b58-ea863d0d0000 pid=3389->guuid=041a5c3f-1700-0000-2b58-ea866b0d0000 pid=3435 execve guuid=e9e30e40-1700-0000-2b58-ea866c0d0000 pid=3436 /usr/bin/chmod guuid=9d7fc02d-1700-0000-2b58-ea863d0d0000 pid=3389->guuid=e9e30e40-1700-0000-2b58-ea866c0d0000 pid=3436 execve guuid=8f709740-1700-0000-2b58-ea866d0d0000 pid=3437 /usr/bin/chmod guuid=9d7fc02d-1700-0000-2b58-ea863d0d0000 pid=3389->guuid=8f709740-1700-0000-2b58-ea866d0d0000 pid=3437 execve guuid=31b62541-1700-0000-2b58-ea866f0d0000 pid=3439 /usr/bin/chattr guuid=9d7fc02d-1700-0000-2b58-ea863d0d0000 pid=3389->guuid=31b62541-1700-0000-2b58-ea866f0d0000 pid=3439 execve guuid=a85ed541-1700-0000-2b58-ea86710d0000 pid=3441 /usr/bin/chattr guuid=9d7fc02d-1700-0000-2b58-ea863d0d0000 pid=3389->guuid=a85ed541-1700-0000-2b58-ea86710d0000 pid=3441 execve guuid=f5e74a42-1700-0000-2b58-ea86730d0000 pid=3443 /usr/bin/chattr guuid=9d7fc02d-1700-0000-2b58-ea863d0d0000 pid=3389->guuid=f5e74a42-1700-0000-2b58-ea86730d0000 pid=3443 execve guuid=9ff9c242-1700-0000-2b58-ea86750d0000 pid=3445 /usr/bin/chattr guuid=9d7fc02d-1700-0000-2b58-ea863d0d0000 pid=3389->guuid=9ff9c242-1700-0000-2b58-ea86750d0000 pid=3445 execve guuid=4908a743-1700-0000-2b58-ea86780d0000 pid=3448 /usr/bin/chattr guuid=9d7fc02d-1700-0000-2b58-ea863d0d0000 pid=3389->guuid=4908a743-1700-0000-2b58-ea86780d0000 pid=3448 execve guuid=40931844-1700-0000-2b58-ea867b0d0000 pid=3451 /usr/bin/chattr guuid=9d7fc02d-1700-0000-2b58-ea863d0d0000 pid=3389->guuid=40931844-1700-0000-2b58-ea867b0d0000 pid=3451 execve guuid=ba8d8b44-1700-0000-2b58-ea867d0d0000 pid=3453 /usr/bin/chattr guuid=9d7fc02d-1700-0000-2b58-ea863d0d0000 pid=3389->guuid=ba8d8b44-1700-0000-2b58-ea867d0d0000 pid=3453 execve guuid=0f8af444-1700-0000-2b58-ea867f0d0000 pid=3455 /usr/bin/chattr guuid=9d7fc02d-1700-0000-2b58-ea863d0d0000 pid=3389->guuid=0f8af444-1700-0000-2b58-ea867f0d0000 pid=3455 execve guuid=d6b24f45-1700-0000-2b58-ea86810d0000 pid=3457 /usr/bin/bash guuid=9d7fc02d-1700-0000-2b58-ea863d0d0000 pid=3389->guuid=d6b24f45-1700-0000-2b58-ea86810d0000 pid=3457 clone guuid=b1645945-1700-0000-2b58-ea86820d0000 pid=3458 /usr/bin/bash guuid=9d7fc02d-1700-0000-2b58-ea863d0d0000 pid=3389->guuid=b1645945-1700-0000-2b58-ea86820d0000 pid=3458 clone guuid=33548c45-1700-0000-2b58-ea86840d0000 pid=3460 /usr/bin/curl net send-data guuid=9d7fc02d-1700-0000-2b58-ea863d0d0000 pid=3389->guuid=33548c45-1700-0000-2b58-ea86840d0000 pid=3460 execve guuid=53329745-1700-0000-2b58-ea86850d0000 pid=3461 /usr/bin/dash guuid=9d7fc02d-1700-0000-2b58-ea863d0d0000 pid=3389->guuid=53329745-1700-0000-2b58-ea86850d0000 pid=3461 execve guuid=e39a554d-1700-0000-2b58-ea869d0d0000 pid=3485 /usr/bin/bash guuid=9d7fc02d-1700-0000-2b58-ea863d0d0000 pid=3389->guuid=e39a554d-1700-0000-2b58-ea869d0d0000 pid=3485 clone guuid=37b45b4d-1700-0000-2b58-ea869e0d0000 pid=3486 /usr/bin/base64 guuid=9d7fc02d-1700-0000-2b58-ea863d0d0000 pid=3389->guuid=37b45b4d-1700-0000-2b58-ea869e0d0000 pid=3486 execve guuid=5cc2604d-1700-0000-2b58-ea869f0d0000 pid=3487 /usr/bin/tee write-file guuid=9d7fc02d-1700-0000-2b58-ea863d0d0000 pid=3389->guuid=5cc2604d-1700-0000-2b58-ea869f0d0000 pid=3487 execve guuid=ed0bca4d-1700-0000-2b58-ea86a20d0000 pid=3490 /usr/bin/bash guuid=9d7fc02d-1700-0000-2b58-ea863d0d0000 pid=3389->guuid=ed0bca4d-1700-0000-2b58-ea86a20d0000 pid=3490 execve guuid=7a6b0655-1700-0000-2b58-ea86c80d0000 pid=3528 /usr/bin/bash guuid=9d7fc02d-1700-0000-2b58-ea863d0d0000 pid=3389->guuid=7a6b0655-1700-0000-2b58-ea86c80d0000 pid=3528 execve guuid=f7426455-1700-0000-2b58-ea86ca0d0000 pid=3530 /usr/bin/rm delete-file guuid=9d7fc02d-1700-0000-2b58-ea863d0d0000 pid=3389->guuid=f7426455-1700-0000-2b58-ea86ca0d0000 pid=3530 execve guuid=afd5a455-1700-0000-2b58-ea86cc0d0000 pid=3532 /usr/bin/rm guuid=9d7fc02d-1700-0000-2b58-ea863d0d0000 pid=3389->guuid=afd5a455-1700-0000-2b58-ea86cc0d0000 pid=3532 execve guuid=94aeea55-1700-0000-2b58-ea86ce0d0000 pid=3534 /usr/bin/curl net send-data guuid=9d7fc02d-1700-0000-2b58-ea863d0d0000 pid=3389->guuid=94aeea55-1700-0000-2b58-ea86ce0d0000 pid=3534 execve guuid=1f61ff55-1700-0000-2b58-ea86d00d0000 pid=3536 /usr/bin/dash guuid=9d7fc02d-1700-0000-2b58-ea863d0d0000 pid=3389->guuid=1f61ff55-1700-0000-2b58-ea86d00d0000 pid=3536 execve 124ee36c-bdbd-5d46-bbb1-b2cd81367f04 160.119.69.4:80 guuid=33548c45-1700-0000-2b58-ea86840d0000 pid=3460->124ee36c-bdbd-5d46-bbb1-b2cd81367f04 send: 93B guuid=5cd61b4e-1700-0000-2b58-ea86a40d0000 pid=3492 /usr/bin/bash guuid=ed0bca4d-1700-0000-2b58-ea86a20d0000 pid=3490->guuid=5cd61b4e-1700-0000-2b58-ea86a40d0000 pid=3492 clone guuid=59e3214e-1700-0000-2b58-ea86a50d0000 pid=3493 /usr/bin/bash guuid=ed0bca4d-1700-0000-2b58-ea86a20d0000 pid=3490->guuid=59e3214e-1700-0000-2b58-ea86a50d0000 pid=3493 clone guuid=5e865a4e-1700-0000-2b58-ea86a70d0000 pid=3495 /usr/bin/ls guuid=ed0bca4d-1700-0000-2b58-ea86a20d0000 pid=3490->guuid=5e865a4e-1700-0000-2b58-ea86a70d0000 pid=3495 execve guuid=cc9efc4e-1700-0000-2b58-ea86a90d0000 pid=3497 /usr/bin/cat guuid=ed0bca4d-1700-0000-2b58-ea86a20d0000 pid=3490->guuid=cc9efc4e-1700-0000-2b58-ea86a90d0000 pid=3497 execve guuid=55dd434f-1700-0000-2b58-ea86ab0d0000 pid=3499 /usr/bin/ls guuid=ed0bca4d-1700-0000-2b58-ea86a20d0000 pid=3490->guuid=55dd434f-1700-0000-2b58-ea86ab0d0000 pid=3499 execve guuid=6952bb4f-1700-0000-2b58-ea86ad0d0000 pid=3501 /usr/bin/mkdir guuid=ed0bca4d-1700-0000-2b58-ea86a20d0000 pid=3490->guuid=6952bb4f-1700-0000-2b58-ea86ad0d0000 pid=3501 execve guuid=7e033b50-1700-0000-2b58-ea86b00d0000 pid=3504 /usr/bin/mv guuid=ed0bca4d-1700-0000-2b58-ea86a20d0000 pid=3490->guuid=7e033b50-1700-0000-2b58-ea86b00d0000 pid=3504 execve guuid=5720a650-1700-0000-2b58-ea86b20d0000 pid=3506 /usr/bin/bash guuid=ed0bca4d-1700-0000-2b58-ea86a20d0000 pid=3490->guuid=5720a650-1700-0000-2b58-ea86b20d0000 pid=3506 clone guuid=92aab050-1700-0000-2b58-ea86b30d0000 pid=3507 /usr/bin/base64 write-file guuid=ed0bca4d-1700-0000-2b58-ea86a20d0000 pid=3490->guuid=92aab050-1700-0000-2b58-ea86b30d0000 pid=3507 execve guuid=5c7a4551-1700-0000-2b58-ea86b50d0000 pid=3509 /usr/bin/rm delete-file guuid=ed0bca4d-1700-0000-2b58-ea86a20d0000 pid=3490->guuid=5c7a4551-1700-0000-2b58-ea86b50d0000 pid=3509 execve guuid=44b2ce51-1700-0000-2b58-ea86b80d0000 pid=3512 /usr/bin/mv guuid=ed0bca4d-1700-0000-2b58-ea86a20d0000 pid=3490->guuid=44b2ce51-1700-0000-2b58-ea86b80d0000 pid=3512 execve guuid=dc806c52-1700-0000-2b58-ea86ba0d0000 pid=3514 /usr/bin/ls guuid=ed0bca4d-1700-0000-2b58-ea86a20d0000 pid=3490->guuid=dc806c52-1700-0000-2b58-ea86ba0d0000 pid=3514 execve guuid=71dcf152-1700-0000-2b58-ea86bd0d0000 pid=3517 /usr/bin/bash guuid=ed0bca4d-1700-0000-2b58-ea86a20d0000 pid=3490->guuid=71dcf152-1700-0000-2b58-ea86bd0d0000 pid=3517 clone guuid=dc010653-1700-0000-2b58-ea86be0d0000 pid=3518 /usr/bin/base64 write-file guuid=ed0bca4d-1700-0000-2b58-ea86a20d0000 pid=3490->guuid=dc010653-1700-0000-2b58-ea86be0d0000 pid=3518 execve guuid=895b9b53-1700-0000-2b58-ea86c10d0000 pid=3521 /usr/bin/ls guuid=ed0bca4d-1700-0000-2b58-ea86a20d0000 pid=3490->guuid=895b9b53-1700-0000-2b58-ea86c10d0000 pid=3521 execve guuid=36882d54-1700-0000-2b58-ea86c30d0000 pid=3523 /usr/bin/cat guuid=ed0bca4d-1700-0000-2b58-ea86a20d0000 pid=3490->guuid=36882d54-1700-0000-2b58-ea86c30d0000 pid=3523 execve guuid=5c0e8454-1700-0000-2b58-ea86c60d0000 pid=3526 /usr/bin/ls guuid=ed0bca4d-1700-0000-2b58-ea86a20d0000 pid=3490->guuid=5c0e8454-1700-0000-2b58-ea86c60d0000 pid=3526 execve guuid=94aeea55-1700-0000-2b58-ea86ce0d0000 pid=3534->124ee36c-bdbd-5d46-bbb1-b2cd81367f04 send: 93B
Score:
82%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/2d573ab28d97298b53d789d6ffe1ce976d4c32e83d22f85d877cc688013301d1
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2d573ab28d97298b53d789d6ffe1ce976d4c32e83d22f85d877cc688013301d1/
Gathering data
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=fvltvmuns4uywu6xrhlp7yoos5wuymxihurpqxmhptdiqajtahiq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260807-yngtaasfja/
Behaviour
Reads runtime system information
Writes file to tmp directory
Deobfuscate/Decode Files or Information
Checks CPU configuration
File and Directory Permissions Modification
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.16
Link:
https://yomi.yoroi.company/submissions/2d573ab28d97298b53d789d6ffe1ce976d4c32e83d22f85d877cc688013301d1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SUSP_LNX_Base64_Exec_Apr24
Create hunting rule
Author:Christian Burkard
Description:Detects suspicious base64 encoded shell commands (as seen in Palo Alto CVE-2024-3400 exploitation)
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 2d573ab28d97298b53d789d6ffe1ce976d4c32e83d22f85d877cc688013301d1

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3884408/
  
Delivery method
Distributed via web download

Comments