MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3cc5453e4fbcbc686b1830265f08b5c5ad43e2ef51e677e99ff8c275e905991c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3cc5453e4fbcbc686b1830265f08b5c5ad43e2ef51e677e99ff8c275e905991c
SHA3-384 hash: e9da989e713dbc5d3fffca31113d337a3ebf0d20f16e1522b9a6c3706132fae1c92de46c2548d9eb730f122b9da9b752
SHA1 hash: 623dca57f43ef976cf08e52d2b7f637e8b21b714
MD5 hash: eeb6c32815951c7f49556fbc093ae255
humanhash: orange-fanta-skylark-river
File name:wr.php
Download: download sample
File size:27'042 bytes
First seen:2026-07-23 06:56:30 UTC
Last seen:2026-07-24 02:27:33 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 768:48vCB+25j6es8Rc9FYpMSUpi+20qUpi+20YQX:48l25Jqd2QX
TLSH T19CC27D956A867C44BEC94A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C12FACD618B1A
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://160.119.69.4/z/post/noroot.phpn/an/aelf ua-wget

Intelligence

File Origin
# of uploads :
3
# of downloads :
86
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.BV.Agent-BNQ.76862783.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive masquerade
Link:
https://www.filescan.io/uploads/6a61bb2808c86426ff02d9dc/reports/c8116d91-f8bb-4910-b4e3-3efde20ecb7a/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-07-23T04:37:00Z UTC
Last seen:
2026-07-23T05:01:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/3cc5453e4fbcbc686b1830265f08b5c5ad43e2ef51e677e99ff8c275e905991c/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/cfb4adc2-ee04-42bb-8dee-aa551a9707ff
Behavior Graph:
Download SVG
%3 guuid=bf23160b-1700-0000-f81f-6b24710e0000 pid=3697 /usr/bin/sudo guuid=7789ba0e-1700-0000-f81f-6b24790e0000 pid=3705 /tmp/sample.bin guuid=bf23160b-1700-0000-f81f-6b24710e0000 pid=3697->guuid=7789ba0e-1700-0000-f81f-6b24790e0000 pid=3705 execve guuid=0f0bb30f-1700-0000-f81f-6b247c0e0000 pid=3708 /usr/bin/bash guuid=7789ba0e-1700-0000-f81f-6b24790e0000 pid=3705->guuid=0f0bb30f-1700-0000-f81f-6b247c0e0000 pid=3708 clone guuid=865cc70f-1700-0000-f81f-6b247d0e0000 pid=3709 /usr/bin/base64 guuid=7789ba0e-1700-0000-f81f-6b24790e0000 pid=3705->guuid=865cc70f-1700-0000-f81f-6b247d0e0000 pid=3709 execve guuid=55f3d50f-1700-0000-f81f-6b247e0e0000 pid=3710 /usr/bin/bash guuid=7789ba0e-1700-0000-f81f-6b24790e0000 pid=3705->guuid=55f3d50f-1700-0000-f81f-6b247e0e0000 pid=3710 clone guuid=3c4e2013-1700-0000-f81f-6b24820e0000 pid=3714 /usr/bin/cp guuid=7789ba0e-1700-0000-f81f-6b24790e0000 pid=3705->guuid=3c4e2013-1700-0000-f81f-6b24820e0000 pid=3714 execve guuid=ba1e5c14-1700-0000-f81f-6b24860e0000 pid=3718 /usr/bin/mkdir guuid=7789ba0e-1700-0000-f81f-6b24790e0000 pid=3705->guuid=ba1e5c14-1700-0000-f81f-6b24860e0000 pid=3718 execve guuid=b1442d15-1700-0000-f81f-6b248a0e0000 pid=3722 /usr/bin/mkdir guuid=7789ba0e-1700-0000-f81f-6b24790e0000 pid=3705->guuid=b1442d15-1700-0000-f81f-6b248a0e0000 pid=3722 execve guuid=b0d9e015-1700-0000-f81f-6b248e0e0000 pid=3726 /usr/bin/mkdir guuid=7789ba0e-1700-0000-f81f-6b24790e0000 pid=3705->guuid=b0d9e015-1700-0000-f81f-6b248e0e0000 pid=3726 execve guuid=47b79d16-1700-0000-f81f-6b24900e0000 pid=3728 /usr/bin/mkdir guuid=7789ba0e-1700-0000-f81f-6b24790e0000 pid=3705->guuid=47b79d16-1700-0000-f81f-6b24900e0000 pid=3728 execve guuid=3ece5817-1700-0000-f81f-6b24920e0000 pid=3730 /usr/bin/mkdir guuid=7789ba0e-1700-0000-f81f-6b24790e0000 pid=3705->guuid=3ece5817-1700-0000-f81f-6b24920e0000 pid=3730 execve guuid=d01b1518-1700-0000-f81f-6b24940e0000 pid=3732 /usr/bin/mkdir guuid=7789ba0e-1700-0000-f81f-6b24790e0000 pid=3705->guuid=d01b1518-1700-0000-f81f-6b24940e0000 pid=3732 execve guuid=cd68ea18-1700-0000-f81f-6b24970e0000 pid=3735 /usr/bin/mkdir guuid=7789ba0e-1700-0000-f81f-6b24790e0000 pid=3705->guuid=cd68ea18-1700-0000-f81f-6b24970e0000 pid=3735 execve guuid=ddea8719-1700-0000-f81f-6b24990e0000 pid=3737 /usr/bin/mkdir guuid=7789ba0e-1700-0000-f81f-6b24790e0000 pid=3705->guuid=ddea8719-1700-0000-f81f-6b24990e0000 pid=3737 execve guuid=66873e1a-1700-0000-f81f-6b249b0e0000 pid=3739 /usr/bin/mkdir guuid=7789ba0e-1700-0000-f81f-6b24790e0000 pid=3705->guuid=66873e1a-1700-0000-f81f-6b249b0e0000 pid=3739 execve guuid=5a10ff1a-1700-0000-f81f-6b249d0e0000 pid=3741 /usr/bin/cp guuid=7789ba0e-1700-0000-f81f-6b24790e0000 pid=3705->guuid=5a10ff1a-1700-0000-f81f-6b249d0e0000 pid=3741 execve guuid=1ca5091c-1700-0000-f81f-6b24a10e0000 pid=3745 /usr/bin/cp guuid=7789ba0e-1700-0000-f81f-6b24790e0000 pid=3705->guuid=1ca5091c-1700-0000-f81f-6b24a10e0000 pid=3745 execve guuid=03e2181d-1700-0000-f81f-6b24a50e0000 pid=3749 /usr/bin/cp guuid=7789ba0e-1700-0000-f81f-6b24790e0000 pid=3705->guuid=03e2181d-1700-0000-f81f-6b24a50e0000 pid=3749 execve guuid=a035f81d-1700-0000-f81f-6b24a80e0000 pid=3752 /usr/bin/cp guuid=7789ba0e-1700-0000-f81f-6b24790e0000 pid=3705->guuid=a035f81d-1700-0000-f81f-6b24a80e0000 pid=3752 execve guuid=01cf021f-1700-0000-f81f-6b24ab0e0000 pid=3755 /usr/bin/cp guuid=7789ba0e-1700-0000-f81f-6b24790e0000 pid=3705->guuid=01cf021f-1700-0000-f81f-6b24ab0e0000 pid=3755 execve guuid=371d5d20-1700-0000-f81f-6b24ae0e0000 pid=3758 /usr/bin/cp guuid=7789ba0e-1700-0000-f81f-6b24790e0000 pid=3705->guuid=371d5d20-1700-0000-f81f-6b24ae0e0000 pid=3758 execve guuid=c3ab5321-1700-0000-f81f-6b24b10e0000 pid=3761 /usr/bin/cp guuid=7789ba0e-1700-0000-f81f-6b24790e0000 pid=3705->guuid=c3ab5321-1700-0000-f81f-6b24b10e0000 pid=3761 execve guuid=d52d6422-1700-0000-f81f-6b24b50e0000 pid=3765 /usr/bin/cp guuid=7789ba0e-1700-0000-f81f-6b24790e0000 pid=3705->guuid=d52d6422-1700-0000-f81f-6b24b50e0000 pid=3765 execve guuid=93612e23-1700-0000-f81f-6b24b90e0000 pid=3769 /usr/bin/cp guuid=7789ba0e-1700-0000-f81f-6b24790e0000 pid=3705->guuid=93612e23-1700-0000-f81f-6b24b90e0000 pid=3769 execve guuid=04072b24-1700-0000-f81f-6b24bb0e0000 pid=3771 /usr/bin/cp guuid=7789ba0e-1700-0000-f81f-6b24790e0000 pid=3705->guuid=04072b24-1700-0000-f81f-6b24bb0e0000 pid=3771 execve guuid=b64dfb24-1700-0000-f81f-6b24c00e0000 pid=3776 /usr/bin/cp guuid=7789ba0e-1700-0000-f81f-6b24790e0000 pid=3705->guuid=b64dfb24-1700-0000-f81f-6b24c00e0000 pid=3776 execve guuid=5bf3e025-1700-0000-f81f-6b24c40e0000 pid=3780 /usr/bin/cp guuid=7789ba0e-1700-0000-f81f-6b24790e0000 pid=3705->guuid=5bf3e025-1700-0000-f81f-6b24c40e0000 pid=3780 execve guuid=1906df26-1700-0000-f81f-6b24c60e0000 pid=3782 /usr/bin/cp guuid=7789ba0e-1700-0000-f81f-6b24790e0000 pid=3705->guuid=1906df26-1700-0000-f81f-6b24c60e0000 pid=3782 execve guuid=3f39cc27-1700-0000-f81f-6b24c80e0000 pid=3784 /usr/bin/cp guuid=7789ba0e-1700-0000-f81f-6b24790e0000 pid=3705->guuid=3f39cc27-1700-0000-f81f-6b24c80e0000 pid=3784 execve guuid=013bc928-1700-0000-f81f-6b24cb0e0000 pid=3787 /usr/bin/touch guuid=7789ba0e-1700-0000-f81f-6b24790e0000 pid=3705->guuid=013bc928-1700-0000-f81f-6b24cb0e0000 pid=3787 execve guuid=b7de8729-1700-0000-f81f-6b24cd0e0000 pid=3789 /usr/bin/chmod guuid=7789ba0e-1700-0000-f81f-6b24790e0000 pid=3705->guuid=b7de8729-1700-0000-f81f-6b24cd0e0000 pid=3789 execve guuid=f28f1d2a-1700-0000-f81f-6b24cf0e0000 pid=3791 /usr/bin/chmod guuid=7789ba0e-1700-0000-f81f-6b24790e0000 pid=3705->guuid=f28f1d2a-1700-0000-f81f-6b24cf0e0000 pid=3791 execve guuid=9c13c92a-1700-0000-f81f-6b24d30e0000 pid=3795 /usr/bin/chattr guuid=7789ba0e-1700-0000-f81f-6b24790e0000 pid=3705->guuid=9c13c92a-1700-0000-f81f-6b24d30e0000 pid=3795 execve guuid=6e4c7e2b-1700-0000-f81f-6b24d70e0000 pid=3799 /usr/bin/chattr guuid=7789ba0e-1700-0000-f81f-6b24790e0000 pid=3705->guuid=6e4c7e2b-1700-0000-f81f-6b24d70e0000 pid=3799 execve guuid=1cf90e2c-1700-0000-f81f-6b24d80e0000 pid=3800 /usr/bin/chattr guuid=7789ba0e-1700-0000-f81f-6b24790e0000 pid=3705->guuid=1cf90e2c-1700-0000-f81f-6b24d80e0000 pid=3800 execve guuid=126fcc2c-1700-0000-f81f-6b24da0e0000 pid=3802 /usr/bin/chattr guuid=7789ba0e-1700-0000-f81f-6b24790e0000 pid=3705->guuid=126fcc2c-1700-0000-f81f-6b24da0e0000 pid=3802 execve guuid=0cd7632d-1700-0000-f81f-6b24dc0e0000 pid=3804 /usr/bin/chattr guuid=7789ba0e-1700-0000-f81f-6b24790e0000 pid=3705->guuid=0cd7632d-1700-0000-f81f-6b24dc0e0000 pid=3804 execve guuid=43a8f92d-1700-0000-f81f-6b24e00e0000 pid=3808 /usr/bin/chattr guuid=7789ba0e-1700-0000-f81f-6b24790e0000 pid=3705->guuid=43a8f92d-1700-0000-f81f-6b24e00e0000 pid=3808 execve guuid=8129912e-1700-0000-f81f-6b24e40e0000 pid=3812 /usr/bin/chattr guuid=7789ba0e-1700-0000-f81f-6b24790e0000 pid=3705->guuid=8129912e-1700-0000-f81f-6b24e40e0000 pid=3812 execve guuid=8e352e2f-1700-0000-f81f-6b24e50e0000 pid=3813 /usr/bin/chattr guuid=7789ba0e-1700-0000-f81f-6b24790e0000 pid=3705->guuid=8e352e2f-1700-0000-f81f-6b24e50e0000 pid=3813 execve guuid=3a89d02f-1700-0000-f81f-6b24e70e0000 pid=3815 /usr/bin/bash guuid=7789ba0e-1700-0000-f81f-6b24790e0000 pid=3705->guuid=3a89d02f-1700-0000-f81f-6b24e70e0000 pid=3815 clone guuid=a8b0dc2f-1700-0000-f81f-6b24e80e0000 pid=3816 /usr/bin/bash guuid=7789ba0e-1700-0000-f81f-6b24790e0000 pid=3705->guuid=a8b0dc2f-1700-0000-f81f-6b24e80e0000 pid=3816 clone guuid=a6d63430-1700-0000-f81f-6b24ea0e0000 pid=3818 /usr/bin/curl net send-data guuid=7789ba0e-1700-0000-f81f-6b24790e0000 pid=3705->guuid=a6d63430-1700-0000-f81f-6b24ea0e0000 pid=3818 execve guuid=d4004030-1700-0000-f81f-6b24eb0e0000 pid=3819 /usr/bin/dash guuid=7789ba0e-1700-0000-f81f-6b24790e0000 pid=3705->guuid=d4004030-1700-0000-f81f-6b24eb0e0000 pid=3819 execve guuid=323b4e39-1700-0000-f81f-6b24000f0000 pid=3840 /usr/bin/bash guuid=7789ba0e-1700-0000-f81f-6b24790e0000 pid=3705->guuid=323b4e39-1700-0000-f81f-6b24000f0000 pid=3840 clone guuid=b6535839-1700-0000-f81f-6b24010f0000 pid=3841 /usr/bin/base64 guuid=7789ba0e-1700-0000-f81f-6b24790e0000 pid=3705->guuid=b6535839-1700-0000-f81f-6b24010f0000 pid=3841 execve guuid=00d96239-1700-0000-f81f-6b24020f0000 pid=3842 /usr/bin/tee write-file guuid=7789ba0e-1700-0000-f81f-6b24790e0000 pid=3705->guuid=00d96239-1700-0000-f81f-6b24020f0000 pid=3842 execve guuid=2715243b-1700-0000-f81f-6b24070f0000 pid=3847 /usr/bin/bash guuid=7789ba0e-1700-0000-f81f-6b24790e0000 pid=3705->guuid=2715243b-1700-0000-f81f-6b24070f0000 pid=3847 execve guuid=f4ba3248-1700-0000-f81f-6b243e0f0000 pid=3902 /usr/bin/bash guuid=7789ba0e-1700-0000-f81f-6b24790e0000 pid=3705->guuid=f4ba3248-1700-0000-f81f-6b243e0f0000 pid=3902 execve guuid=4999c148-1700-0000-f81f-6b24400f0000 pid=3904 /usr/bin/rm delete-file guuid=7789ba0e-1700-0000-f81f-6b24790e0000 pid=3705->guuid=4999c148-1700-0000-f81f-6b24400f0000 pid=3904 execve guuid=c4a62449-1700-0000-f81f-6b24420f0000 pid=3906 /usr/bin/rm guuid=7789ba0e-1700-0000-f81f-6b24790e0000 pid=3705->guuid=c4a62449-1700-0000-f81f-6b24420f0000 pid=3906 execve guuid=7c208f49-1700-0000-f81f-6b24440f0000 pid=3908 /usr/bin/curl net send-data guuid=7789ba0e-1700-0000-f81f-6b24790e0000 pid=3705->guuid=7c208f49-1700-0000-f81f-6b24440f0000 pid=3908 execve guuid=8b2f9749-1700-0000-f81f-6b24450f0000 pid=3909 /usr/bin/dash guuid=7789ba0e-1700-0000-f81f-6b24790e0000 pid=3705->guuid=8b2f9749-1700-0000-f81f-6b24450f0000 pid=3909 execve 124ee36c-bdbd-5d46-bbb1-b2cd81367f04 160.119.69.4:80 guuid=a6d63430-1700-0000-f81f-6b24ea0e0000 pid=3818->124ee36c-bdbd-5d46-bbb1-b2cd81367f04 send: 93B guuid=bba6283c-1700-0000-f81f-6b240b0f0000 pid=3851 /usr/bin/bash guuid=2715243b-1700-0000-f81f-6b24070f0000 pid=3847->guuid=bba6283c-1700-0000-f81f-6b240b0f0000 pid=3851 clone guuid=d064383c-1700-0000-f81f-6b240c0f0000 pid=3852 /usr/bin/bash guuid=2715243b-1700-0000-f81f-6b24070f0000 pid=3847->guuid=d064383c-1700-0000-f81f-6b240c0f0000 pid=3852 clone guuid=f3dda33c-1700-0000-f81f-6b240e0f0000 pid=3854 /usr/bin/ls guuid=2715243b-1700-0000-f81f-6b24070f0000 pid=3847->guuid=f3dda33c-1700-0000-f81f-6b240e0f0000 pid=3854 execve guuid=ffb8303e-1700-0000-f81f-6b24130f0000 pid=3859 /usr/bin/cat guuid=2715243b-1700-0000-f81f-6b24070f0000 pid=3847->guuid=ffb8303e-1700-0000-f81f-6b24130f0000 pid=3859 execve guuid=d88e0d3f-1700-0000-f81f-6b24170f0000 pid=3863 /usr/bin/ls guuid=2715243b-1700-0000-f81f-6b24070f0000 pid=3847->guuid=d88e0d3f-1700-0000-f81f-6b24170f0000 pid=3863 execve guuid=62916440-1700-0000-f81f-6b241a0f0000 pid=3866 /usr/bin/mkdir guuid=2715243b-1700-0000-f81f-6b24070f0000 pid=3847->guuid=62916440-1700-0000-f81f-6b241a0f0000 pid=3866 execve guuid=f6b60b41-1700-0000-f81f-6b241d0f0000 pid=3869 /usr/bin/mv guuid=2715243b-1700-0000-f81f-6b24070f0000 pid=3847->guuid=f6b60b41-1700-0000-f81f-6b241d0f0000 pid=3869 execve guuid=ded3e041-1700-0000-f81f-6b24200f0000 pid=3872 /usr/bin/bash guuid=2715243b-1700-0000-f81f-6b24070f0000 pid=3847->guuid=ded3e041-1700-0000-f81f-6b24200f0000 pid=3872 clone guuid=3df4eb41-1700-0000-f81f-6b24210f0000 pid=3873 /usr/bin/base64 write-file guuid=2715243b-1700-0000-f81f-6b24070f0000 pid=3847->guuid=3df4eb41-1700-0000-f81f-6b24210f0000 pid=3873 execve guuid=613fa842-1700-0000-f81f-6b24240f0000 pid=3876 /usr/bin/rm delete-file guuid=2715243b-1700-0000-f81f-6b24070f0000 pid=3847->guuid=613fa842-1700-0000-f81f-6b24240f0000 pid=3876 execve guuid=02674043-1700-0000-f81f-6b24270f0000 pid=3879 /usr/bin/mv guuid=2715243b-1700-0000-f81f-6b24070f0000 pid=3847->guuid=02674043-1700-0000-f81f-6b24270f0000 pid=3879 execve guuid=9cb92344-1700-0000-f81f-6b24290f0000 pid=3881 /usr/bin/ls guuid=2715243b-1700-0000-f81f-6b24070f0000 pid=3847->guuid=9cb92344-1700-0000-f81f-6b24290f0000 pid=3881 execve guuid=5e9c1345-1700-0000-f81f-6b242d0f0000 pid=3885 /usr/bin/bash guuid=2715243b-1700-0000-f81f-6b24070f0000 pid=3847->guuid=5e9c1345-1700-0000-f81f-6b242d0f0000 pid=3885 clone guuid=b6e02845-1700-0000-f81f-6b242e0f0000 pid=3886 /usr/bin/base64 write-file guuid=2715243b-1700-0000-f81f-6b24070f0000 pid=3847->guuid=b6e02845-1700-0000-f81f-6b242e0f0000 pid=3886 execve guuid=f07cef45-1700-0000-f81f-6b24310f0000 pid=3889 /usr/bin/ls guuid=2715243b-1700-0000-f81f-6b24070f0000 pid=3847->guuid=f07cef45-1700-0000-f81f-6b24310f0000 pid=3889 execve guuid=8e68f646-1700-0000-f81f-6b24360f0000 pid=3894 /usr/bin/cat guuid=2715243b-1700-0000-f81f-6b24070f0000 pid=3847->guuid=8e68f646-1700-0000-f81f-6b24360f0000 pid=3894 execve guuid=2ba17947-1700-0000-f81f-6b243a0f0000 pid=3898 /usr/bin/ls guuid=2715243b-1700-0000-f81f-6b24070f0000 pid=3847->guuid=2ba17947-1700-0000-f81f-6b243a0f0000 pid=3898 execve guuid=7c208f49-1700-0000-f81f-6b24440f0000 pid=3908->124ee36c-bdbd-5d46-bbb1-b2cd81367f04 send: 93B
Score:
81%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/3cc5453e4fbcbc686b1830265f08b5c5ad43e2ef51e677e99ff8c275e905991c
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3cc5453e4fbcbc686b1830265f08b5c5ad43e2ef51e677e99ff8c275e905991c/
Threat name:
Linux.Backdoor.WebShell
Create hunting rule
Status:
Malicious
First seen:
2026-07-23 06:57:44 UTC
File Type:
Text (Shell)
AV detection:
15 of 38 (39.47%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=htcukpspxs6gq2yygatf6cfvywwuhyxpkhthp2m77dbhl2ifteoa._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260723-hqnfvafm7v/
Behaviour
Reads runtime system information
Writes file to tmp directory
Deobfuscate/Decode Files or Information
Checks CPU configuration
File and Directory Permissions Modification
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.16
Link:
https://yomi.yoroi.company/submissions/3cc5453e4fbcbc686b1830265f08b5c5ad43e2ef51e677e99ff8c275e905991c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SUSP_LNX_Base64_Exec_Apr24
Create hunting rule
Author:Christian Burkard
Description:Detects suspicious base64 encoded shell commands (as seen in Palo Alto CVE-2024-3400 exploitation)
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 3cc5453e4fbcbc686b1830265f08b5c5ad43e2ef51e677e99ff8c275e905991c

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3884408/
  
Delivery method
Distributed via web download

Comments