MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 30d51cc7e46c06f93cf8d5589611ef5555eb22ae54d420bb9dae8d01164d51ba. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 30d51cc7e46c06f93cf8d5589611ef5555eb22ae54d420bb9dae8d01164d51ba
SHA3-384 hash: ef9da2e94543f43a6cfb5b63c424385177dc8b58942e9a7d7423206b4bd2f8424f81721abde08894168177578df57e37
SHA1 hash: ffb4acf8d4daf449b356c12c4488cbed5d128854
MD5 hash: 9a6f548604fac0b4a135dd83080cf8d6
humanhash: floor-lactose-cold-avocado
File name:wr.php
Download: download sample
File size:27'042 bytes
First seen:2026-07-24 01:00:07 UTC
Last seen:2026-07-24 23:51:09 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 768:i8vCB+25j6es8Ra9FYpMSUpi+20qUpi+20YQX:i8l25JMd2QX
TLSH T147C28D966A867C44BDC98A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C12F9CD618B1A
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://160.119.69.4/z/post/noroot.phpn/an/aelf ua-wget

Intelligence

File Origin
# of uploads :
7
# of downloads :
78
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.BV.Agent-BNQ.65718592.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive masquerade
Link:
https://www.filescan.io/uploads/6a62b9469decceeb4b649033/reports/99b462ae-ec83-4482-81dc-66b16504a2c1/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-07-23T23:34:00Z UTC
Last seen:
2026-07-24T04:01:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/30d51cc7e46c06f93cf8d5589611ef5555eb22ae54d420bb9dae8d01164d51ba/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/17a3f9a0-b135-4206-86a0-e4f9dfb9910f
Behavior Graph:
Download SVG
%3 guuid=28b4ec79-1800-0000-602d-63289e120000 pid=4766 /usr/bin/sudo guuid=775abb7d-1800-0000-602d-6328b1120000 pid=4785 /tmp/sample.bin guuid=28b4ec79-1800-0000-602d-63289e120000 pid=4766->guuid=775abb7d-1800-0000-602d-6328b1120000 pid=4785 execve guuid=90279f7e-1800-0000-602d-6328b6120000 pid=4790 /usr/bin/bash guuid=775abb7d-1800-0000-602d-6328b1120000 pid=4785->guuid=90279f7e-1800-0000-602d-6328b6120000 pid=4790 clone guuid=7f19a57e-1800-0000-602d-6328b7120000 pid=4791 /usr/bin/base64 guuid=775abb7d-1800-0000-602d-6328b1120000 pid=4785->guuid=7f19a57e-1800-0000-602d-6328b7120000 pid=4791 execve guuid=1be1ae7e-1800-0000-602d-6328b8120000 pid=4792 /usr/bin/bash guuid=775abb7d-1800-0000-602d-6328b1120000 pid=4785->guuid=1be1ae7e-1800-0000-602d-6328b8120000 pid=4792 clone guuid=259db37f-1800-0000-602d-6328be120000 pid=4798 /usr/bin/cp guuid=775abb7d-1800-0000-602d-6328b1120000 pid=4785->guuid=259db37f-1800-0000-602d-6328be120000 pid=4798 execve guuid=f9ae2380-1800-0000-602d-6328c1120000 pid=4801 /usr/bin/mkdir guuid=775abb7d-1800-0000-602d-6328b1120000 pid=4785->guuid=f9ae2380-1800-0000-602d-6328c1120000 pid=4801 execve guuid=941c7180-1800-0000-602d-6328c3120000 pid=4803 /usr/bin/mkdir guuid=775abb7d-1800-0000-602d-6328b1120000 pid=4785->guuid=941c7180-1800-0000-602d-6328c3120000 pid=4803 execve guuid=d782da80-1800-0000-602d-6328c6120000 pid=4806 /usr/bin/mkdir guuid=775abb7d-1800-0000-602d-6328b1120000 pid=4785->guuid=d782da80-1800-0000-602d-6328c6120000 pid=4806 execve guuid=06612c81-1800-0000-602d-6328c8120000 pid=4808 /usr/bin/mkdir guuid=775abb7d-1800-0000-602d-6328b1120000 pid=4785->guuid=06612c81-1800-0000-602d-6328c8120000 pid=4808 execve guuid=d8ab8581-1800-0000-602d-6328cb120000 pid=4811 /usr/bin/mkdir guuid=775abb7d-1800-0000-602d-6328b1120000 pid=4785->guuid=d8ab8581-1800-0000-602d-6328cb120000 pid=4811 execve guuid=5e4acd81-1800-0000-602d-6328cd120000 pid=4813 /usr/bin/mkdir guuid=775abb7d-1800-0000-602d-6328b1120000 pid=4785->guuid=5e4acd81-1800-0000-602d-6328cd120000 pid=4813 execve guuid=a9342082-1800-0000-602d-6328cf120000 pid=4815 /usr/bin/mkdir guuid=775abb7d-1800-0000-602d-6328b1120000 pid=4785->guuid=a9342082-1800-0000-602d-6328cf120000 pid=4815 execve guuid=eb6f6982-1800-0000-602d-6328d2120000 pid=4818 /usr/bin/mkdir guuid=775abb7d-1800-0000-602d-6328b1120000 pid=4785->guuid=eb6f6982-1800-0000-602d-6328d2120000 pid=4818 execve guuid=3124bb82-1800-0000-602d-6328d4120000 pid=4820 /usr/bin/mkdir guuid=775abb7d-1800-0000-602d-6328b1120000 pid=4785->guuid=3124bb82-1800-0000-602d-6328d4120000 pid=4820 execve guuid=bcec1b83-1800-0000-602d-6328d6120000 pid=4822 /usr/bin/cp guuid=775abb7d-1800-0000-602d-6328b1120000 pid=4785->guuid=bcec1b83-1800-0000-602d-6328d6120000 pid=4822 execve guuid=271f9a83-1800-0000-602d-6328d8120000 pid=4824 /usr/bin/cp guuid=775abb7d-1800-0000-602d-6328b1120000 pid=4785->guuid=271f9a83-1800-0000-602d-6328d8120000 pid=4824 execve guuid=108cfd83-1800-0000-602d-6328db120000 pid=4827 /usr/bin/cp guuid=775abb7d-1800-0000-602d-6328b1120000 pid=4785->guuid=108cfd83-1800-0000-602d-6328db120000 pid=4827 execve guuid=063b5d84-1800-0000-602d-6328de120000 pid=4830 /usr/bin/cp guuid=775abb7d-1800-0000-602d-6328b1120000 pid=4785->guuid=063b5d84-1800-0000-602d-6328de120000 pid=4830 execve guuid=c70abd84-1800-0000-602d-6328e0120000 pid=4832 /usr/bin/cp guuid=775abb7d-1800-0000-602d-6328b1120000 pid=4785->guuid=c70abd84-1800-0000-602d-6328e0120000 pid=4832 execve guuid=1eed1b85-1800-0000-602d-6328e3120000 pid=4835 /usr/bin/cp guuid=775abb7d-1800-0000-602d-6328b1120000 pid=4785->guuid=1eed1b85-1800-0000-602d-6328e3120000 pid=4835 execve guuid=07027f85-1800-0000-602d-6328e6120000 pid=4838 /usr/bin/cp guuid=775abb7d-1800-0000-602d-6328b1120000 pid=4785->guuid=07027f85-1800-0000-602d-6328e6120000 pid=4838 execve guuid=c7d7d885-1800-0000-602d-6328e8120000 pid=4840 /usr/bin/cp guuid=775abb7d-1800-0000-602d-6328b1120000 pid=4785->guuid=c7d7d885-1800-0000-602d-6328e8120000 pid=4840 execve guuid=817f3486-1800-0000-602d-6328eb120000 pid=4843 /usr/bin/cp guuid=775abb7d-1800-0000-602d-6328b1120000 pid=4785->guuid=817f3486-1800-0000-602d-6328eb120000 pid=4843 execve guuid=c4519286-1800-0000-602d-6328ed120000 pid=4845 /usr/bin/cp guuid=775abb7d-1800-0000-602d-6328b1120000 pid=4785->guuid=c4519286-1800-0000-602d-6328ed120000 pid=4845 execve guuid=6124ed86-1800-0000-602d-6328f0120000 pid=4848 /usr/bin/cp guuid=775abb7d-1800-0000-602d-6328b1120000 pid=4785->guuid=6124ed86-1800-0000-602d-6328f0120000 pid=4848 execve guuid=ba1b4a87-1800-0000-602d-6328f2120000 pid=4850 /usr/bin/cp guuid=775abb7d-1800-0000-602d-6328b1120000 pid=4785->guuid=ba1b4a87-1800-0000-602d-6328f2120000 pid=4850 execve guuid=ff9da687-1800-0000-602d-6328f5120000 pid=4853 /usr/bin/cp guuid=775abb7d-1800-0000-602d-6328b1120000 pid=4785->guuid=ff9da687-1800-0000-602d-6328f5120000 pid=4853 execve guuid=4ba52688-1800-0000-602d-6328f7120000 pid=4855 /usr/bin/cp guuid=775abb7d-1800-0000-602d-6328b1120000 pid=4785->guuid=4ba52688-1800-0000-602d-6328f7120000 pid=4855 execve guuid=2fa99e88-1800-0000-602d-6328f8120000 pid=4856 /usr/bin/touch guuid=775abb7d-1800-0000-602d-6328b1120000 pid=4785->guuid=2fa99e88-1800-0000-602d-6328f8120000 pid=4856 execve guuid=c932e188-1800-0000-602d-6328fa120000 pid=4858 /usr/bin/chmod guuid=775abb7d-1800-0000-602d-6328b1120000 pid=4785->guuid=c932e188-1800-0000-602d-6328fa120000 pid=4858 execve guuid=8c852d89-1800-0000-602d-6328fc120000 pid=4860 /usr/bin/chmod guuid=775abb7d-1800-0000-602d-6328b1120000 pid=4785->guuid=8c852d89-1800-0000-602d-6328fc120000 pid=4860 execve guuid=abd76d89-1800-0000-602d-6328fe120000 pid=4862 /usr/bin/chattr guuid=775abb7d-1800-0000-602d-6328b1120000 pid=4785->guuid=abd76d89-1800-0000-602d-6328fe120000 pid=4862 execve guuid=d5882e8a-1800-0000-602d-632800130000 pid=4864 /usr/bin/chattr guuid=775abb7d-1800-0000-602d-6328b1120000 pid=4785->guuid=d5882e8a-1800-0000-602d-632800130000 pid=4864 execve guuid=442c6d8a-1800-0000-602d-632802130000 pid=4866 /usr/bin/chattr guuid=775abb7d-1800-0000-602d-6328b1120000 pid=4785->guuid=442c6d8a-1800-0000-602d-632802130000 pid=4866 execve guuid=d5fda98a-1800-0000-602d-632803130000 pid=4867 /usr/bin/chattr guuid=775abb7d-1800-0000-602d-6328b1120000 pid=4785->guuid=d5fda98a-1800-0000-602d-632803130000 pid=4867 execve guuid=d67cea8a-1800-0000-602d-632804130000 pid=4868 /usr/bin/chattr guuid=775abb7d-1800-0000-602d-6328b1120000 pid=4785->guuid=d67cea8a-1800-0000-602d-632804130000 pid=4868 execve guuid=dbc52f8b-1800-0000-602d-632805130000 pid=4869 /usr/bin/chattr guuid=775abb7d-1800-0000-602d-6328b1120000 pid=4785->guuid=dbc52f8b-1800-0000-602d-632805130000 pid=4869 execve guuid=a0e3738b-1800-0000-602d-632807130000 pid=4871 /usr/bin/chattr guuid=775abb7d-1800-0000-602d-6328b1120000 pid=4785->guuid=a0e3738b-1800-0000-602d-632807130000 pid=4871 execve guuid=2a96b08b-1800-0000-602d-632808130000 pid=4872 /usr/bin/chattr guuid=775abb7d-1800-0000-602d-6328b1120000 pid=4785->guuid=2a96b08b-1800-0000-602d-632808130000 pid=4872 execve guuid=aa76f38b-1800-0000-602d-63280a130000 pid=4874 /usr/bin/bash guuid=775abb7d-1800-0000-602d-6328b1120000 pid=4785->guuid=aa76f38b-1800-0000-602d-63280a130000 pid=4874 clone guuid=361ef98b-1800-0000-602d-63280b130000 pid=4875 /usr/bin/bash guuid=775abb7d-1800-0000-602d-6328b1120000 pid=4785->guuid=361ef98b-1800-0000-602d-63280b130000 pid=4875 clone guuid=064a148c-1800-0000-602d-63280c130000 pid=4876 /usr/bin/curl net guuid=775abb7d-1800-0000-602d-6328b1120000 pid=4785->guuid=064a148c-1800-0000-602d-63280c130000 pid=4876 execve guuid=7483198c-1800-0000-602d-63280d130000 pid=4877 /usr/bin/dash guuid=775abb7d-1800-0000-602d-6328b1120000 pid=4785->guuid=7483198c-1800-0000-602d-63280d130000 pid=4877 execve 124ee36c-bdbd-5d46-bbb1-b2cd81367f04 160.119.69.4:80 guuid=064a148c-1800-0000-602d-63280c130000 pid=4876->124ee36c-bdbd-5d46-bbb1-b2cd81367f04 con
Score:
82%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/30d51cc7e46c06f93cf8d5589611ef5555eb22ae54d420bb9dae8d01164d51ba
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/30d51cc7e46c06f93cf8d5589611ef5555eb22ae54d420bb9dae8d01164d51ba/
Threat name:
Linux.Backdoor.WebShell
Create hunting rule
Status:
Malicious
First seen:
2026-07-24 01:10:34 UTC
AV detection:
15 of 38 (39.47%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=gdkrzr7enqdpsphy2vmjmeppkvk6wivoktkcbo45v2gqcfsnkg5a._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260724-bc434sywex/
Behaviour
Reads runtime system information
Writes file to tmp directory
Deobfuscate/Decode Files or Information
Checks CPU configuration
File and Directory Permissions Modification
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.16
Link:
https://yomi.yoroi.company/submissions/30d51cc7e46c06f93cf8d5589611ef5555eb22ae54d420bb9dae8d01164d51ba

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SUSP_LNX_Base64_Exec_Apr24
Create hunting rule
Author:Christian Burkard
Description:Detects suspicious base64 encoded shell commands (as seen in Palo Alto CVE-2024-3400 exploitation)
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 30d51cc7e46c06f93cf8d5589611ef5555eb22ae54d420bb9dae8d01164d51ba

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3884409/
  
Delivery method
Distributed via web download

Comments