MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3a3b5dea778c2d82e0e1d1a041289a3cd113c5ed7e44bca41f4936e2e7abea23. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3a3b5dea778c2d82e0e1d1a041289a3cd113c5ed7e44bca41f4936e2e7abea23
SHA3-384 hash: b7132274115c559736091b7c7887f561da84c01fa57228de759ecfb1bc7174051faa535dac4f795f816f18879cc47e0b
SHA1 hash: 0ad95839d8be5cd146e66e8b8592ea48b102b860
MD5 hash: 2e84649b3de3b8db170077cfcb562eac
humanhash: twelve-salami-six-april
File name:wr.php
Download: download sample
File size:27'042 bytes
First seen:2026-08-27 16:18:34 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 768:18vCB+25j6es8RW79FYpMSUpi+20qUpi+20YQX:18l25JOd2QX
TLSH T1AEC27D966A867C44BEC94A3E4CBD2B1D6DF5C3D1324942AC3D8A3C71DC11FACD618B1A
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh

Intelligence

File Origin
# of uploads :
1
# of downloads :
36
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Gathering data
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive masquerade
Link:
https://www.filescan.io/uploads/6a9063839a19b987c625f2db/reports/ddf94fa3-3b4c-40da-a8e9-f0270c027d5b/overview
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/b2ed733b-4f08-444b-8645-c3a25b0271bc
Behavior Graph:
Download SVG
%3 guuid=785170dd-1600-0000-f286-3ce9c90c0000 pid=3273 /usr/bin/sudo guuid=de9f10e0-1600-0000-f286-3ce9d20c0000 pid=3282 /tmp/sample.bin guuid=785170dd-1600-0000-f286-3ce9c90c0000 pid=3273->guuid=de9f10e0-1600-0000-f286-3ce9d20c0000 pid=3282 execve guuid=8a9525e1-1600-0000-f286-3ce9d60c0000 pid=3286 /usr/bin/bash guuid=de9f10e0-1600-0000-f286-3ce9d20c0000 pid=3282->guuid=8a9525e1-1600-0000-f286-3ce9d60c0000 pid=3286 clone guuid=9daf53e1-1600-0000-f286-3ce9d80c0000 pid=3288 /usr/bin/base64 guuid=de9f10e0-1600-0000-f286-3ce9d20c0000 pid=3282->guuid=9daf53e1-1600-0000-f286-3ce9d80c0000 pid=3288 execve guuid=e6d37fe1-1600-0000-f286-3ce9d90c0000 pid=3289 /usr/bin/bash guuid=de9f10e0-1600-0000-f286-3ce9d20c0000 pid=3282->guuid=e6d37fe1-1600-0000-f286-3ce9d90c0000 pid=3289 clone guuid=0fc566e2-1600-0000-f286-3ce9dc0c0000 pid=3292 /usr/bin/cp guuid=de9f10e0-1600-0000-f286-3ce9d20c0000 pid=3282->guuid=0fc566e2-1600-0000-f286-3ce9dc0c0000 pid=3292 execve guuid=7c01d0e2-1600-0000-f286-3ce9de0c0000 pid=3294 /usr/bin/mkdir guuid=de9f10e0-1600-0000-f286-3ce9d20c0000 pid=3282->guuid=7c01d0e2-1600-0000-f286-3ce9de0c0000 pid=3294 execve guuid=978519e3-1600-0000-f286-3ce9df0c0000 pid=3295 /usr/bin/mkdir guuid=de9f10e0-1600-0000-f286-3ce9d20c0000 pid=3282->guuid=978519e3-1600-0000-f286-3ce9df0c0000 pid=3295 execve guuid=1e285fe3-1600-0000-f286-3ce9e00c0000 pid=3296 /usr/bin/mkdir guuid=de9f10e0-1600-0000-f286-3ce9d20c0000 pid=3282->guuid=1e285fe3-1600-0000-f286-3ce9e00c0000 pid=3296 execve guuid=be78a4e3-1600-0000-f286-3ce9e20c0000 pid=3298 /usr/bin/mkdir guuid=de9f10e0-1600-0000-f286-3ce9d20c0000 pid=3282->guuid=be78a4e3-1600-0000-f286-3ce9e20c0000 pid=3298 execve guuid=8f06e9e3-1600-0000-f286-3ce9e30c0000 pid=3299 /usr/bin/mkdir guuid=de9f10e0-1600-0000-f286-3ce9d20c0000 pid=3282->guuid=8f06e9e3-1600-0000-f286-3ce9e30c0000 pid=3299 execve guuid=09bf2de4-1600-0000-f286-3ce9e50c0000 pid=3301 /usr/bin/mkdir guuid=de9f10e0-1600-0000-f286-3ce9d20c0000 pid=3282->guuid=09bf2de4-1600-0000-f286-3ce9e50c0000 pid=3301 execve guuid=ab2e77e4-1600-0000-f286-3ce9e70c0000 pid=3303 /usr/bin/mkdir guuid=de9f10e0-1600-0000-f286-3ce9d20c0000 pid=3282->guuid=ab2e77e4-1600-0000-f286-3ce9e70c0000 pid=3303 execve guuid=2adfbce4-1600-0000-f286-3ce9e80c0000 pid=3304 /usr/bin/mkdir guuid=de9f10e0-1600-0000-f286-3ce9d20c0000 pid=3282->guuid=2adfbce4-1600-0000-f286-3ce9e80c0000 pid=3304 execve guuid=94f704e5-1600-0000-f286-3ce9ea0c0000 pid=3306 /usr/bin/mkdir guuid=de9f10e0-1600-0000-f286-3ce9d20c0000 pid=3282->guuid=94f704e5-1600-0000-f286-3ce9ea0c0000 pid=3306 execve guuid=ada94fe5-1600-0000-f286-3ce9ec0c0000 pid=3308 /usr/bin/cp guuid=de9f10e0-1600-0000-f286-3ce9d20c0000 pid=3282->guuid=ada94fe5-1600-0000-f286-3ce9ec0c0000 pid=3308 execve guuid=df6babe5-1600-0000-f286-3ce9ef0c0000 pid=3311 /usr/bin/cp guuid=de9f10e0-1600-0000-f286-3ce9d20c0000 pid=3282->guuid=df6babe5-1600-0000-f286-3ce9ef0c0000 pid=3311 execve guuid=34e813e6-1600-0000-f286-3ce9f10c0000 pid=3313 /usr/bin/cp guuid=de9f10e0-1600-0000-f286-3ce9d20c0000 pid=3282->guuid=34e813e6-1600-0000-f286-3ce9f10c0000 pid=3313 execve guuid=ffbd66e6-1600-0000-f286-3ce9f40c0000 pid=3316 /usr/bin/cp guuid=de9f10e0-1600-0000-f286-3ce9d20c0000 pid=3282->guuid=ffbd66e6-1600-0000-f286-3ce9f40c0000 pid=3316 execve guuid=24fecce6-1600-0000-f286-3ce9f60c0000 pid=3318 /usr/bin/cp guuid=de9f10e0-1600-0000-f286-3ce9d20c0000 pid=3282->guuid=24fecce6-1600-0000-f286-3ce9f60c0000 pid=3318 execve guuid=6c5663e7-1600-0000-f286-3ce9fa0c0000 pid=3322 /usr/bin/cp guuid=de9f10e0-1600-0000-f286-3ce9d20c0000 pid=3282->guuid=6c5663e7-1600-0000-f286-3ce9fa0c0000 pid=3322 execve guuid=8d2bcae7-1600-0000-f286-3ce9fc0c0000 pid=3324 /usr/bin/cp guuid=de9f10e0-1600-0000-f286-3ce9d20c0000 pid=3282->guuid=8d2bcae7-1600-0000-f286-3ce9fc0c0000 pid=3324 execve guuid=edcd2ae8-1600-0000-f286-3ce9ff0c0000 pid=3327 /usr/bin/cp guuid=de9f10e0-1600-0000-f286-3ce9d20c0000 pid=3282->guuid=edcd2ae8-1600-0000-f286-3ce9ff0c0000 pid=3327 execve guuid=1c278fe8-1600-0000-f286-3ce9010d0000 pid=3329 /usr/bin/cp guuid=de9f10e0-1600-0000-f286-3ce9d20c0000 pid=3282->guuid=1c278fe8-1600-0000-f286-3ce9010d0000 pid=3329 execve guuid=5ff7f7e8-1600-0000-f286-3ce9040d0000 pid=3332 /usr/bin/cp guuid=de9f10e0-1600-0000-f286-3ce9d20c0000 pid=3282->guuid=5ff7f7e8-1600-0000-f286-3ce9040d0000 pid=3332 execve guuid=6cd954e9-1600-0000-f286-3ce9060d0000 pid=3334 /usr/bin/cp guuid=de9f10e0-1600-0000-f286-3ce9d20c0000 pid=3282->guuid=6cd954e9-1600-0000-f286-3ce9060d0000 pid=3334 execve guuid=124ab7e9-1600-0000-f286-3ce9080d0000 pid=3336 /usr/bin/cp guuid=de9f10e0-1600-0000-f286-3ce9d20c0000 pid=3282->guuid=124ab7e9-1600-0000-f286-3ce9080d0000 pid=3336 execve guuid=4fc41cea-1600-0000-f286-3ce90b0d0000 pid=3339 /usr/bin/cp guuid=de9f10e0-1600-0000-f286-3ce9d20c0000 pid=3282->guuid=4fc41cea-1600-0000-f286-3ce90b0d0000 pid=3339 execve guuid=c59c80ea-1600-0000-f286-3ce90e0d0000 pid=3342 /usr/bin/cp guuid=de9f10e0-1600-0000-f286-3ce9d20c0000 pid=3282->guuid=c59c80ea-1600-0000-f286-3ce90e0d0000 pid=3342 execve guuid=f4a5f9ea-1600-0000-f286-3ce9100d0000 pid=3344 /usr/bin/touch guuid=de9f10e0-1600-0000-f286-3ce9d20c0000 pid=3282->guuid=f4a5f9ea-1600-0000-f286-3ce9100d0000 pid=3344 execve guuid=8d793deb-1600-0000-f286-3ce9120d0000 pid=3346 /usr/bin/chmod guuid=de9f10e0-1600-0000-f286-3ce9d20c0000 pid=3282->guuid=8d793deb-1600-0000-f286-3ce9120d0000 pid=3346 execve guuid=3e2b89eb-1600-0000-f286-3ce9140d0000 pid=3348 /usr/bin/chmod guuid=de9f10e0-1600-0000-f286-3ce9d20c0000 pid=3282->guuid=3e2b89eb-1600-0000-f286-3ce9140d0000 pid=3348 execve guuid=bd15cfeb-1600-0000-f286-3ce9160d0000 pid=3350 /usr/bin/chattr guuid=de9f10e0-1600-0000-f286-3ce9d20c0000 pid=3282->guuid=bd15cfeb-1600-0000-f286-3ce9160d0000 pid=3350 execve guuid=0a0e3aec-1600-0000-f286-3ce9180d0000 pid=3352 /usr/bin/chattr guuid=de9f10e0-1600-0000-f286-3ce9d20c0000 pid=3282->guuid=0a0e3aec-1600-0000-f286-3ce9180d0000 pid=3352 execve guuid=37f079ec-1600-0000-f286-3ce91a0d0000 pid=3354 /usr/bin/chattr guuid=de9f10e0-1600-0000-f286-3ce9d20c0000 pid=3282->guuid=37f079ec-1600-0000-f286-3ce91a0d0000 pid=3354 execve guuid=26b1b9ec-1600-0000-f286-3ce91c0d0000 pid=3356 /usr/bin/chattr guuid=de9f10e0-1600-0000-f286-3ce9d20c0000 pid=3282->guuid=26b1b9ec-1600-0000-f286-3ce91c0d0000 pid=3356 execve guuid=a624faec-1600-0000-f286-3ce91d0d0000 pid=3357 /usr/bin/chattr guuid=de9f10e0-1600-0000-f286-3ce9d20c0000 pid=3282->guuid=a624faec-1600-0000-f286-3ce91d0d0000 pid=3357 execve guuid=897238ed-1600-0000-f286-3ce91e0d0000 pid=3358 /usr/bin/chattr guuid=de9f10e0-1600-0000-f286-3ce9d20c0000 pid=3282->guuid=897238ed-1600-0000-f286-3ce91e0d0000 pid=3358 execve guuid=036b7ded-1600-0000-f286-3ce9200d0000 pid=3360 /usr/bin/chattr guuid=de9f10e0-1600-0000-f286-3ce9d20c0000 pid=3282->guuid=036b7ded-1600-0000-f286-3ce9200d0000 pid=3360 execve guuid=bbb2beed-1600-0000-f286-3ce9210d0000 pid=3361 /usr/bin/chattr guuid=de9f10e0-1600-0000-f286-3ce9d20c0000 pid=3282->guuid=bbb2beed-1600-0000-f286-3ce9210d0000 pid=3361 execve guuid=c1fd00ee-1600-0000-f286-3ce9230d0000 pid=3363 /usr/bin/bash guuid=de9f10e0-1600-0000-f286-3ce9d20c0000 pid=3282->guuid=c1fd00ee-1600-0000-f286-3ce9230d0000 pid=3363 clone guuid=e2bc05ee-1600-0000-f286-3ce9240d0000 pid=3364 /usr/bin/bash guuid=de9f10e0-1600-0000-f286-3ce9d20c0000 pid=3282->guuid=e2bc05ee-1600-0000-f286-3ce9240d0000 pid=3364 clone guuid=b4fd29ee-1600-0000-f286-3ce9250d0000 pid=3365 /usr/bin/curl net send-data guuid=de9f10e0-1600-0000-f286-3ce9d20c0000 pid=3282->guuid=b4fd29ee-1600-0000-f286-3ce9250d0000 pid=3365 execve guuid=2dbe2fee-1600-0000-f286-3ce9260d0000 pid=3366 /usr/bin/dash guuid=de9f10e0-1600-0000-f286-3ce9d20c0000 pid=3282->guuid=2dbe2fee-1600-0000-f286-3ce9260d0000 pid=3366 execve guuid=a98afbf6-1600-0000-f286-3ce93e0d0000 pid=3390 /usr/bin/bash guuid=de9f10e0-1600-0000-f286-3ce9d20c0000 pid=3282->guuid=a98afbf6-1600-0000-f286-3ce93e0d0000 pid=3390 clone guuid=3b6702f7-1600-0000-f286-3ce93f0d0000 pid=3391 /usr/bin/base64 guuid=de9f10e0-1600-0000-f286-3ce9d20c0000 pid=3282->guuid=3b6702f7-1600-0000-f286-3ce93f0d0000 pid=3391 execve guuid=ca2507f7-1600-0000-f286-3ce9400d0000 pid=3392 /usr/bin/tee write-file guuid=de9f10e0-1600-0000-f286-3ce9d20c0000 pid=3282->guuid=ca2507f7-1600-0000-f286-3ce9400d0000 pid=3392 execve guuid=94e5b9f7-1600-0000-f286-3ce9430d0000 pid=3395 /usr/bin/bash guuid=de9f10e0-1600-0000-f286-3ce9d20c0000 pid=3282->guuid=94e5b9f7-1600-0000-f286-3ce9430d0000 pid=3395 execve guuid=1820e6fc-1600-0000-f286-3ce9650d0000 pid=3429 /usr/bin/bash guuid=de9f10e0-1600-0000-f286-3ce9d20c0000 pid=3282->guuid=1820e6fc-1600-0000-f286-3ce9650d0000 pid=3429 execve guuid=6b1738fd-1600-0000-f286-3ce9670d0000 pid=3431 /usr/bin/rm delete-file guuid=de9f10e0-1600-0000-f286-3ce9d20c0000 pid=3282->guuid=6b1738fd-1600-0000-f286-3ce9670d0000 pid=3431 execve guuid=272778fd-1600-0000-f286-3ce9690d0000 pid=3433 /usr/bin/rm guuid=de9f10e0-1600-0000-f286-3ce9d20c0000 pid=3282->guuid=272778fd-1600-0000-f286-3ce9690d0000 pid=3433 execve guuid=a3eaccfd-1600-0000-f286-3ce96b0d0000 pid=3435 /usr/bin/curl net send-data guuid=de9f10e0-1600-0000-f286-3ce9d20c0000 pid=3282->guuid=a3eaccfd-1600-0000-f286-3ce96b0d0000 pid=3435 execve guuid=bfaed4fd-1600-0000-f286-3ce96c0d0000 pid=3436 /usr/bin/dash guuid=de9f10e0-1600-0000-f286-3ce9d20c0000 pid=3282->guuid=bfaed4fd-1600-0000-f286-3ce96c0d0000 pid=3436 execve 124ee36c-bdbd-5d46-bbb1-b2cd81367f04 160.119.69.4:80 guuid=b4fd29ee-1600-0000-f286-3ce9250d0000 pid=3365->124ee36c-bdbd-5d46-bbb1-b2cd81367f04 send: 93B guuid=d6b405f8-1600-0000-f286-3ce9450d0000 pid=3397 /usr/bin/bash guuid=94e5b9f7-1600-0000-f286-3ce9430d0000 pid=3395->guuid=d6b405f8-1600-0000-f286-3ce9450d0000 pid=3397 clone guuid=db9c0af8-1600-0000-f286-3ce9460d0000 pid=3398 /usr/bin/bash guuid=94e5b9f7-1600-0000-f286-3ce9430d0000 pid=3395->guuid=db9c0af8-1600-0000-f286-3ce9460d0000 pid=3398 clone guuid=f8532df8-1600-0000-f286-3ce9470d0000 pid=3399 /usr/bin/ls guuid=94e5b9f7-1600-0000-f286-3ce9430d0000 pid=3395->guuid=f8532df8-1600-0000-f286-3ce9470d0000 pid=3399 execve guuid=24c7a0f8-1600-0000-f286-3ce94a0d0000 pid=3402 /usr/bin/cat guuid=94e5b9f7-1600-0000-f286-3ce9430d0000 pid=3395->guuid=24c7a0f8-1600-0000-f286-3ce94a0d0000 pid=3402 execve guuid=5c07e8f8-1600-0000-f286-3ce94c0d0000 pid=3404 /usr/bin/ls guuid=94e5b9f7-1600-0000-f286-3ce9430d0000 pid=3395->guuid=5c07e8f8-1600-0000-f286-3ce94c0d0000 pid=3404 execve guuid=3fb247f9-1600-0000-f286-3ce94e0d0000 pid=3406 /usr/bin/mkdir guuid=94e5b9f7-1600-0000-f286-3ce9430d0000 pid=3395->guuid=3fb247f9-1600-0000-f286-3ce94e0d0000 pid=3406 execve guuid=82fe9bf9-1600-0000-f286-3ce9500d0000 pid=3408 /usr/bin/mv guuid=94e5b9f7-1600-0000-f286-3ce9430d0000 pid=3395->guuid=82fe9bf9-1600-0000-f286-3ce9500d0000 pid=3408 execve guuid=1c9af2f9-1600-0000-f286-3ce9520d0000 pid=3410 /usr/bin/bash guuid=94e5b9f7-1600-0000-f286-3ce9430d0000 pid=3395->guuid=1c9af2f9-1600-0000-f286-3ce9520d0000 pid=3410 clone guuid=7f44f7f9-1600-0000-f286-3ce9530d0000 pid=3411 /usr/bin/base64 write-file guuid=94e5b9f7-1600-0000-f286-3ce9430d0000 pid=3395->guuid=7f44f7f9-1600-0000-f286-3ce9530d0000 pid=3411 execve guuid=6df14ffa-1600-0000-f286-3ce9550d0000 pid=3413 /usr/bin/rm delete-file guuid=94e5b9f7-1600-0000-f286-3ce9430d0000 pid=3395->guuid=6df14ffa-1600-0000-f286-3ce9550d0000 pid=3413 execve guuid=3e709cfa-1600-0000-f286-3ce9570d0000 pid=3415 /usr/bin/mv guuid=94e5b9f7-1600-0000-f286-3ce9430d0000 pid=3395->guuid=3e709cfa-1600-0000-f286-3ce9570d0000 pid=3415 execve guuid=cf4611fb-1600-0000-f286-3ce9590d0000 pid=3417 /usr/bin/ls guuid=94e5b9f7-1600-0000-f286-3ce9430d0000 pid=3395->guuid=cf4611fb-1600-0000-f286-3ce9590d0000 pid=3417 execve guuid=eaa47efb-1600-0000-f286-3ce95c0d0000 pid=3420 /usr/bin/bash guuid=94e5b9f7-1600-0000-f286-3ce9430d0000 pid=3395->guuid=eaa47efb-1600-0000-f286-3ce95c0d0000 pid=3420 clone guuid=f5bd83fb-1600-0000-f286-3ce95d0d0000 pid=3421 /usr/bin/base64 write-file guuid=94e5b9f7-1600-0000-f286-3ce9430d0000 pid=3395->guuid=f5bd83fb-1600-0000-f286-3ce95d0d0000 pid=3421 execve guuid=81fbd3fb-1600-0000-f286-3ce95f0d0000 pid=3423 /usr/bin/ls guuid=94e5b9f7-1600-0000-f286-3ce9430d0000 pid=3395->guuid=81fbd3fb-1600-0000-f286-3ce95f0d0000 pid=3423 execve guuid=7e9f33fc-1600-0000-f286-3ce9610d0000 pid=3425 /usr/bin/cat guuid=94e5b9f7-1600-0000-f286-3ce9430d0000 pid=3395->guuid=7e9f33fc-1600-0000-f286-3ce9610d0000 pid=3425 execve guuid=bb2178fc-1600-0000-f286-3ce9630d0000 pid=3427 /usr/bin/ls guuid=94e5b9f7-1600-0000-f286-3ce9430d0000 pid=3395->guuid=bb2178fc-1600-0000-f286-3ce9630d0000 pid=3427 execve guuid=a3eaccfd-1600-0000-f286-3ce96b0d0000 pid=3435->124ee36c-bdbd-5d46-bbb1-b2cd81367f04 send: 93B
Score:
81%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/3a3b5dea778c2d82e0e1d1a041289a3cd113c5ed7e44bca41f4936e2e7abea23
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3a3b5dea778c2d82e0e1d1a041289a3cd113c5ed7e44bca41f4936e2e7abea23/
Gathering data
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hi5v32txrqwyfyhb2gqecke2htirhrpnpzclzja7je3ofz5l5irq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260827-tsk92sw1bt/
Behaviour
Reads runtime system information
Writes file to tmp directory
Deobfuscate/Decode Files or Information
Checks CPU configuration
File and Directory Permissions Modification
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SUSP_LNX_Base64_Exec_Apr24
Create hunting rule
Author:Christian Burkard
Description:Detects suspicious base64 encoded shell commands (as seen in Palo Alto CVE-2024-3400 exploitation)
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 3a3b5dea778c2d82e0e1d1a041289a3cd113c5ed7e44bca41f4936e2e7abea23

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3884409/
  
Delivery method
Distributed via web download

Comments