MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3891fb8aaf593ea0627de79d0ce9686f41d003140ea656919e87e4fc2699d310. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3891fb8aaf593ea0627de79d0ce9686f41d003140ea656919e87e4fc2699d310
SHA3-384 hash: d568691c377b918a4c23d013ada75f3d0d5e26cf1ed693927d16b9398de9569bb4602e3d99a1ff21f0ada12c574a4191
SHA1 hash: 762e8db54ed37ca17f2dfd81455c4dfe0e34911e
MD5 hash: 377d0b677f02dcb380bd92fd483491e0
humanhash: pizza-may-utah-louisiana
File name:wr.php
Download: download sample
File size:27'042 bytes
First seen:2026-07-15 06:48:39 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 768:S8vCB+25j6es8RXM19FYpMSUpi+20qUpi+20YQX:S8l25Jcd2QX
TLSH T1C1C28D96AA967C44BDC94A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11FACC618B1A
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://160.119.69.4/z/post/noroot.phpn/an/an/a

Intelligence

File Origin
# of uploads :
1
# of downloads :
60
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.BV.Agent-BNQ.32229274.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive masquerade
Link:
https://www.filescan.io/uploads/6a572d7f1c063fc484316874/reports/db7b6741-b5a0-45d2-91dd-ffb6cb7233fa/overview
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/2d897810-4f5a-4d43-a139-237ab19f70af
Behavior Graph:
Download SVG
%3 guuid=dc9a7c5a-1900-0000-9aa6-cb802c140000 pid=5164 /usr/bin/sudo guuid=32ab805c-1900-0000-9aa6-cb802d140000 pid=5165 /tmp/sample.bin guuid=dc9a7c5a-1900-0000-9aa6-cb802c140000 pid=5164->guuid=32ab805c-1900-0000-9aa6-cb802d140000 pid=5165 execve guuid=c9c3675d-1900-0000-9aa6-cb802e140000 pid=5166 /usr/bin/bash guuid=32ab805c-1900-0000-9aa6-cb802d140000 pid=5165->guuid=c9c3675d-1900-0000-9aa6-cb802e140000 pid=5166 clone guuid=fdff755d-1900-0000-9aa6-cb802f140000 pid=5167 /usr/bin/base64 guuid=32ab805c-1900-0000-9aa6-cb802d140000 pid=5165->guuid=fdff755d-1900-0000-9aa6-cb802f140000 pid=5167 execve guuid=c9fa855d-1900-0000-9aa6-cb8030140000 pid=5168 /usr/bin/bash guuid=32ab805c-1900-0000-9aa6-cb802d140000 pid=5165->guuid=c9fa855d-1900-0000-9aa6-cb8030140000 pid=5168 clone guuid=6f41385e-1900-0000-9aa6-cb8031140000 pid=5169 /usr/bin/cp guuid=32ab805c-1900-0000-9aa6-cb802d140000 pid=5165->guuid=6f41385e-1900-0000-9aa6-cb8031140000 pid=5169 execve guuid=c4d0de5e-1900-0000-9aa6-cb8032140000 pid=5170 /usr/bin/mkdir guuid=32ab805c-1900-0000-9aa6-cb802d140000 pid=5165->guuid=c4d0de5e-1900-0000-9aa6-cb8032140000 pid=5170 execve guuid=9f513b5f-1900-0000-9aa6-cb8033140000 pid=5171 /usr/bin/mkdir guuid=32ab805c-1900-0000-9aa6-cb802d140000 pid=5165->guuid=9f513b5f-1900-0000-9aa6-cb8033140000 pid=5171 execve guuid=a676925f-1900-0000-9aa6-cb8034140000 pid=5172 /usr/bin/mkdir guuid=32ab805c-1900-0000-9aa6-cb802d140000 pid=5165->guuid=a676925f-1900-0000-9aa6-cb8034140000 pid=5172 execve guuid=f0f71760-1900-0000-9aa6-cb8035140000 pid=5173 /usr/bin/mkdir guuid=32ab805c-1900-0000-9aa6-cb802d140000 pid=5165->guuid=f0f71760-1900-0000-9aa6-cb8035140000 pid=5173 execve guuid=eade7760-1900-0000-9aa6-cb8036140000 pid=5174 /usr/bin/mkdir guuid=32ab805c-1900-0000-9aa6-cb802d140000 pid=5165->guuid=eade7760-1900-0000-9aa6-cb8036140000 pid=5174 execve guuid=6817de60-1900-0000-9aa6-cb8037140000 pid=5175 /usr/bin/mkdir guuid=32ab805c-1900-0000-9aa6-cb802d140000 pid=5165->guuid=6817de60-1900-0000-9aa6-cb8037140000 pid=5175 execve guuid=3ca74c61-1900-0000-9aa6-cb8038140000 pid=5176 /usr/bin/mkdir guuid=32ab805c-1900-0000-9aa6-cb802d140000 pid=5165->guuid=3ca74c61-1900-0000-9aa6-cb8038140000 pid=5176 execve guuid=9accc961-1900-0000-9aa6-cb8039140000 pid=5177 /usr/bin/mkdir guuid=32ab805c-1900-0000-9aa6-cb802d140000 pid=5165->guuid=9accc961-1900-0000-9aa6-cb8039140000 pid=5177 execve guuid=ebfa3962-1900-0000-9aa6-cb803a140000 pid=5178 /usr/bin/mkdir guuid=32ab805c-1900-0000-9aa6-cb802d140000 pid=5165->guuid=ebfa3962-1900-0000-9aa6-cb803a140000 pid=5178 execve guuid=04e49f62-1900-0000-9aa6-cb803b140000 pid=5179 /usr/bin/cp guuid=32ab805c-1900-0000-9aa6-cb802d140000 pid=5165->guuid=04e49f62-1900-0000-9aa6-cb803b140000 pid=5179 execve guuid=55431763-1900-0000-9aa6-cb803c140000 pid=5180 /usr/bin/cp guuid=32ab805c-1900-0000-9aa6-cb802d140000 pid=5165->guuid=55431763-1900-0000-9aa6-cb803c140000 pid=5180 execve guuid=e7459363-1900-0000-9aa6-cb803d140000 pid=5181 /usr/bin/cp guuid=32ab805c-1900-0000-9aa6-cb802d140000 pid=5165->guuid=e7459363-1900-0000-9aa6-cb803d140000 pid=5181 execve guuid=394a0c64-1900-0000-9aa6-cb803e140000 pid=5182 /usr/bin/cp guuid=32ab805c-1900-0000-9aa6-cb802d140000 pid=5165->guuid=394a0c64-1900-0000-9aa6-cb803e140000 pid=5182 execve guuid=e8068564-1900-0000-9aa6-cb803f140000 pid=5183 /usr/bin/cp guuid=32ab805c-1900-0000-9aa6-cb802d140000 pid=5165->guuid=e8068564-1900-0000-9aa6-cb803f140000 pid=5183 execve guuid=00d1f564-1900-0000-9aa6-cb8040140000 pid=5184 /usr/bin/cp guuid=32ab805c-1900-0000-9aa6-cb802d140000 pid=5165->guuid=00d1f564-1900-0000-9aa6-cb8040140000 pid=5184 execve guuid=8fa17265-1900-0000-9aa6-cb8041140000 pid=5185 /usr/bin/cp guuid=32ab805c-1900-0000-9aa6-cb802d140000 pid=5165->guuid=8fa17265-1900-0000-9aa6-cb8041140000 pid=5185 execve guuid=ce81ac66-1900-0000-9aa6-cb8042140000 pid=5186 /usr/bin/cp guuid=32ab805c-1900-0000-9aa6-cb802d140000 pid=5165->guuid=ce81ac66-1900-0000-9aa6-cb8042140000 pid=5186 execve guuid=fa0c6267-1900-0000-9aa6-cb8043140000 pid=5187 /usr/bin/cp guuid=32ab805c-1900-0000-9aa6-cb802d140000 pid=5165->guuid=fa0c6267-1900-0000-9aa6-cb8043140000 pid=5187 execve guuid=d299d467-1900-0000-9aa6-cb8044140000 pid=5188 /usr/bin/cp guuid=32ab805c-1900-0000-9aa6-cb802d140000 pid=5165->guuid=d299d467-1900-0000-9aa6-cb8044140000 pid=5188 execve guuid=a08a5c68-1900-0000-9aa6-cb8045140000 pid=5189 /usr/bin/cp guuid=32ab805c-1900-0000-9aa6-cb802d140000 pid=5165->guuid=a08a5c68-1900-0000-9aa6-cb8045140000 pid=5189 execve guuid=e1fed968-1900-0000-9aa6-cb8046140000 pid=5190 /usr/bin/cp guuid=32ab805c-1900-0000-9aa6-cb802d140000 pid=5165->guuid=e1fed968-1900-0000-9aa6-cb8046140000 pid=5190 execve guuid=e5945d69-1900-0000-9aa6-cb8047140000 pid=5191 /usr/bin/cp guuid=32ab805c-1900-0000-9aa6-cb802d140000 pid=5165->guuid=e5945d69-1900-0000-9aa6-cb8047140000 pid=5191 execve guuid=4a017e6a-1900-0000-9aa6-cb8048140000 pid=5192 /usr/bin/cp guuid=32ab805c-1900-0000-9aa6-cb802d140000 pid=5165->guuid=4a017e6a-1900-0000-9aa6-cb8048140000 pid=5192 execve guuid=383f246b-1900-0000-9aa6-cb8049140000 pid=5193 /usr/bin/touch guuid=32ab805c-1900-0000-9aa6-cb802d140000 pid=5165->guuid=383f246b-1900-0000-9aa6-cb8049140000 pid=5193 execve guuid=9fe98a6b-1900-0000-9aa6-cb804a140000 pid=5194 /usr/bin/chmod guuid=32ab805c-1900-0000-9aa6-cb802d140000 pid=5165->guuid=9fe98a6b-1900-0000-9aa6-cb804a140000 pid=5194 execve guuid=c99aff6b-1900-0000-9aa6-cb804b140000 pid=5195 /usr/bin/chmod guuid=32ab805c-1900-0000-9aa6-cb802d140000 pid=5165->guuid=c99aff6b-1900-0000-9aa6-cb804b140000 pid=5195 execve guuid=7ade776c-1900-0000-9aa6-cb804c140000 pid=5196 /usr/bin/chattr guuid=32ab805c-1900-0000-9aa6-cb802d140000 pid=5165->guuid=7ade776c-1900-0000-9aa6-cb804c140000 pid=5196 execve guuid=fc7a646f-1900-0000-9aa6-cb804d140000 pid=5197 /usr/bin/chattr guuid=32ab805c-1900-0000-9aa6-cb802d140000 pid=5165->guuid=fc7a646f-1900-0000-9aa6-cb804d140000 pid=5197 execve guuid=70d1c46f-1900-0000-9aa6-cb804e140000 pid=5198 /usr/bin/chattr guuid=32ab805c-1900-0000-9aa6-cb802d140000 pid=5165->guuid=70d1c46f-1900-0000-9aa6-cb804e140000 pid=5198 execve guuid=7da72170-1900-0000-9aa6-cb804f140000 pid=5199 /usr/bin/chattr guuid=32ab805c-1900-0000-9aa6-cb802d140000 pid=5165->guuid=7da72170-1900-0000-9aa6-cb804f140000 pid=5199 execve guuid=eae4a870-1900-0000-9aa6-cb8050140000 pid=5200 /usr/bin/chattr guuid=32ab805c-1900-0000-9aa6-cb802d140000 pid=5165->guuid=eae4a870-1900-0000-9aa6-cb8050140000 pid=5200 execve guuid=5fab2b71-1900-0000-9aa6-cb8051140000 pid=5201 /usr/bin/chattr guuid=32ab805c-1900-0000-9aa6-cb802d140000 pid=5165->guuid=5fab2b71-1900-0000-9aa6-cb8051140000 pid=5201 execve guuid=0a3db471-1900-0000-9aa6-cb8052140000 pid=5202 /usr/bin/chattr guuid=32ab805c-1900-0000-9aa6-cb802d140000 pid=5165->guuid=0a3db471-1900-0000-9aa6-cb8052140000 pid=5202 execve guuid=f0de4072-1900-0000-9aa6-cb8053140000 pid=5203 /usr/bin/chattr guuid=32ab805c-1900-0000-9aa6-cb802d140000 pid=5165->guuid=f0de4072-1900-0000-9aa6-cb8053140000 pid=5203 execve guuid=0dadc772-1900-0000-9aa6-cb8054140000 pid=5204 /usr/bin/bash guuid=32ab805c-1900-0000-9aa6-cb802d140000 pid=5165->guuid=0dadc772-1900-0000-9aa6-cb8054140000 pid=5204 clone guuid=d051da72-1900-0000-9aa6-cb8055140000 pid=5205 /usr/bin/bash guuid=32ab805c-1900-0000-9aa6-cb802d140000 pid=5165->guuid=d051da72-1900-0000-9aa6-cb8055140000 pid=5205 clone guuid=8f793a73-1900-0000-9aa6-cb8056140000 pid=5206 /usr/bin/curl net send-data guuid=32ab805c-1900-0000-9aa6-cb802d140000 pid=5165->guuid=8f793a73-1900-0000-9aa6-cb8056140000 pid=5206 execve guuid=5a534873-1900-0000-9aa6-cb8057140000 pid=5207 /usr/bin/dash guuid=32ab805c-1900-0000-9aa6-cb802d140000 pid=5165->guuid=5a534873-1900-0000-9aa6-cb8057140000 pid=5207 execve guuid=2e28b29b-1900-0000-9aa6-cb8058140000 pid=5208 /usr/bin/bash guuid=32ab805c-1900-0000-9aa6-cb802d140000 pid=5165->guuid=2e28b29b-1900-0000-9aa6-cb8058140000 pid=5208 clone guuid=e6a0cf9b-1900-0000-9aa6-cb8059140000 pid=5209 /usr/bin/base64 guuid=32ab805c-1900-0000-9aa6-cb802d140000 pid=5165->guuid=e6a0cf9b-1900-0000-9aa6-cb8059140000 pid=5209 execve guuid=fb18f59b-1900-0000-9aa6-cb805a140000 pid=5210 /usr/bin/tee write-file guuid=32ab805c-1900-0000-9aa6-cb802d140000 pid=5165->guuid=fb18f59b-1900-0000-9aa6-cb805a140000 pid=5210 execve guuid=fce0069f-1900-0000-9aa6-cb805b140000 pid=5211 /usr/bin/bash guuid=32ab805c-1900-0000-9aa6-cb802d140000 pid=5165->guuid=fce0069f-1900-0000-9aa6-cb805b140000 pid=5211 execve guuid=569fb1a6-1900-0000-9aa6-cb806d140000 pid=5229 /usr/bin/bash guuid=32ab805c-1900-0000-9aa6-cb802d140000 pid=5165->guuid=569fb1a6-1900-0000-9aa6-cb806d140000 pid=5229 execve guuid=34591ca7-1900-0000-9aa6-cb806e140000 pid=5230 /usr/bin/rm delete-file guuid=32ab805c-1900-0000-9aa6-cb802d140000 pid=5165->guuid=34591ca7-1900-0000-9aa6-cb806e140000 pid=5230 execve guuid=86af67a7-1900-0000-9aa6-cb806f140000 pid=5231 /usr/bin/rm guuid=32ab805c-1900-0000-9aa6-cb802d140000 pid=5165->guuid=86af67a7-1900-0000-9aa6-cb806f140000 pid=5231 execve guuid=8f11b2a7-1900-0000-9aa6-cb8070140000 pid=5232 /usr/bin/curl net send-data guuid=32ab805c-1900-0000-9aa6-cb802d140000 pid=5165->guuid=8f11b2a7-1900-0000-9aa6-cb8070140000 pid=5232 execve guuid=0ae4bca7-1900-0000-9aa6-cb8071140000 pid=5233 /usr/bin/dash guuid=32ab805c-1900-0000-9aa6-cb802d140000 pid=5165->guuid=0ae4bca7-1900-0000-9aa6-cb8071140000 pid=5233 execve 124ee36c-bdbd-5d46-bbb1-b2cd81367f04 160.119.69.4:80 guuid=8f793a73-1900-0000-9aa6-cb8056140000 pid=5206->124ee36c-bdbd-5d46-bbb1-b2cd81367f04 send: 93B guuid=4be0799f-1900-0000-9aa6-cb805c140000 pid=5212 /usr/bin/bash guuid=fce0069f-1900-0000-9aa6-cb805b140000 pid=5211->guuid=4be0799f-1900-0000-9aa6-cb805c140000 pid=5212 clone guuid=6f2d829f-1900-0000-9aa6-cb805d140000 pid=5213 /usr/bin/bash guuid=fce0069f-1900-0000-9aa6-cb805b140000 pid=5211->guuid=6f2d829f-1900-0000-9aa6-cb805d140000 pid=5213 clone guuid=3408ab9f-1900-0000-9aa6-cb805e140000 pid=5214 /usr/bin/ls guuid=fce0069f-1900-0000-9aa6-cb805b140000 pid=5211->guuid=3408ab9f-1900-0000-9aa6-cb805e140000 pid=5214 execve guuid=4b5587a0-1900-0000-9aa6-cb805f140000 pid=5215 /usr/bin/cat guuid=fce0069f-1900-0000-9aa6-cb805b140000 pid=5211->guuid=4b5587a0-1900-0000-9aa6-cb805f140000 pid=5215 execve guuid=7938cba0-1900-0000-9aa6-cb8060140000 pid=5216 /usr/bin/ls guuid=fce0069f-1900-0000-9aa6-cb805b140000 pid=5211->guuid=7938cba0-1900-0000-9aa6-cb8060140000 pid=5216 execve guuid=25738ea1-1900-0000-9aa6-cb8061140000 pid=5217 /usr/bin/mkdir guuid=fce0069f-1900-0000-9aa6-cb805b140000 pid=5211->guuid=25738ea1-1900-0000-9aa6-cb8061140000 pid=5217 execve guuid=111810a2-1900-0000-9aa6-cb8062140000 pid=5218 /usr/bin/mv guuid=fce0069f-1900-0000-9aa6-cb805b140000 pid=5211->guuid=111810a2-1900-0000-9aa6-cb8062140000 pid=5218 execve guuid=e6769ba2-1900-0000-9aa6-cb8063140000 pid=5219 /usr/bin/bash guuid=fce0069f-1900-0000-9aa6-cb805b140000 pid=5211->guuid=e6769ba2-1900-0000-9aa6-cb8063140000 pid=5219 clone guuid=2b24a3a2-1900-0000-9aa6-cb8064140000 pid=5220 /usr/bin/base64 write-file guuid=fce0069f-1900-0000-9aa6-cb805b140000 pid=5211->guuid=2b24a3a2-1900-0000-9aa6-cb8064140000 pid=5220 execve guuid=504645a3-1900-0000-9aa6-cb8065140000 pid=5221 /usr/bin/rm delete-file guuid=fce0069f-1900-0000-9aa6-cb805b140000 pid=5211->guuid=504645a3-1900-0000-9aa6-cb8065140000 pid=5221 execve guuid=46219ea3-1900-0000-9aa6-cb8066140000 pid=5222 /usr/bin/mv guuid=fce0069f-1900-0000-9aa6-cb805b140000 pid=5211->guuid=46219ea3-1900-0000-9aa6-cb8066140000 pid=5222 execve guuid=7f7679a4-1900-0000-9aa6-cb8067140000 pid=5223 /usr/bin/ls guuid=fce0069f-1900-0000-9aa6-cb805b140000 pid=5211->guuid=7f7679a4-1900-0000-9aa6-cb8067140000 pid=5223 execve guuid=09dc17a5-1900-0000-9aa6-cb8068140000 pid=5224 /usr/bin/bash guuid=fce0069f-1900-0000-9aa6-cb805b140000 pid=5211->guuid=09dc17a5-1900-0000-9aa6-cb8068140000 pid=5224 clone guuid=106721a5-1900-0000-9aa6-cb8069140000 pid=5225 /usr/bin/base64 write-file guuid=fce0069f-1900-0000-9aa6-cb805b140000 pid=5211->guuid=106721a5-1900-0000-9aa6-cb8069140000 pid=5225 execve guuid=de3075a5-1900-0000-9aa6-cb806a140000 pid=5226 /usr/bin/ls guuid=fce0069f-1900-0000-9aa6-cb805b140000 pid=5211->guuid=de3075a5-1900-0000-9aa6-cb806a140000 pid=5226 execve guuid=6b6be7a5-1900-0000-9aa6-cb806b140000 pid=5227 /usr/bin/cat guuid=fce0069f-1900-0000-9aa6-cb805b140000 pid=5211->guuid=6b6be7a5-1900-0000-9aa6-cb806b140000 pid=5227 execve guuid=0c6537a6-1900-0000-9aa6-cb806c140000 pid=5228 /usr/bin/ls guuid=fce0069f-1900-0000-9aa6-cb805b140000 pid=5211->guuid=0c6537a6-1900-0000-9aa6-cb806c140000 pid=5228 execve guuid=8f11b2a7-1900-0000-9aa6-cb8070140000 pid=5232->124ee36c-bdbd-5d46-bbb1-b2cd81367f04 send: 93B
Score:
81%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/3891fb8aaf593ea0627de79d0ce9686f41d003140ea656919e87e4fc2699d310
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3891fb8aaf593ea0627de79d0ce9686f41d003140ea656919e87e4fc2699d310/
Threat name:
Script-BAT.Trojan.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2026-07-15 06:49:41 UTC
File Type:
Text (Shell)
AV detection:
9 of 36 (25.00%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hci7xcvple7kayt546oqz2lin5a5aayub2tfnem6q7spyjuz2mia._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260715-hlmczsg12y/
Behaviour
Reads runtime system information
Writes file to tmp directory
Deobfuscate/Decode Files or Information
Checks CPU configuration
File and Directory Permissions Modification
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.16
Link:
https://yomi.yoroi.company/submissions/3891fb8aaf593ea0627de79d0ce9686f41d003140ea656919e87e4fc2699d310

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SUSP_LNX_Base64_Exec_Apr24
Create hunting rule
Author:Christian Burkard
Description:Detects suspicious base64 encoded shell commands (as seen in Palo Alto CVE-2024-3400 exploitation)
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 3891fb8aaf593ea0627de79d0ce9686f41d003140ea656919e87e4fc2699d310

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3884409/
  
Delivery method
Distributed via web download

Comments