MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3ee8b4e38efa5f872f5f1f4fac720d80eb7c079fc538ef75f2d8a8dc7068ef9f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3ee8b4e38efa5f872f5f1f4fac720d80eb7c079fc538ef75f2d8a8dc7068ef9f
SHA3-384 hash: cbdc29e19161e79c9d143f7893675f778a719d980f136396d837cd18719db7e3b5637bc4ade5c4d1bb62b37c4362d9bc
SHA1 hash: 9142c74cd0de1543afb2bea83c609c0a6b309fbd
MD5 hash: b2008a2aab04bc0c7a015aeebe01c7d0
humanhash: crazy-kitten-item-early
File name:wr.php
Download: download sample
File size:27'042 bytes
First seen:2026-07-20 00:12:45 UTC
Last seen:2026-07-20 14:38:19 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 768:s8vCB+25j6es8Rh9FYpMSUpi+20qUpi+20YQX:s8l25JXd2QX
TLSH T100C27D956A867C44BEC98A3E4CBD2B1D6DF5C3D1324942AC3D4B3C719C11F9CD618B1A
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://160.119.69.4/z/post/noroot.phpn/an/aelf ua-wget

Intelligence

File Origin
# of uploads :
3
# of downloads :
70
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.BV.Agent-BNQ.97311985.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive masquerade
Link:
https://www.filescan.io/uploads/6a5d682c02d769b4a5159573/reports/fa6a0354-d1d0-4876-82b6-ae264341426c/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-07-19T22:36:00Z UTC
Last seen:
2026-07-19T23:30:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/3ee8b4e38efa5f872f5f1f4fac720d80eb7c079fc538ef75f2d8a8dc7068ef9f/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/923f3d3e-f583-43d9-96b5-6231ed7aa7e5
Behavior Graph:
Download SVG
%3 guuid=20a52e07-1700-0000-14d2-1db5350c0000 pid=3125 /usr/bin/sudo guuid=86fbe609-1700-0000-14d2-1db53b0c0000 pid=3131 /tmp/sample.bin guuid=20a52e07-1700-0000-14d2-1db5350c0000 pid=3125->guuid=86fbe609-1700-0000-14d2-1db53b0c0000 pid=3131 execve guuid=dbb7b20a-1700-0000-14d2-1db53e0c0000 pid=3134 /usr/bin/bash guuid=86fbe609-1700-0000-14d2-1db53b0c0000 pid=3131->guuid=dbb7b20a-1700-0000-14d2-1db53e0c0000 pid=3134 clone guuid=9e44cd0a-1700-0000-14d2-1db53f0c0000 pid=3135 /usr/bin/base64 guuid=86fbe609-1700-0000-14d2-1db53b0c0000 pid=3131->guuid=9e44cd0a-1700-0000-14d2-1db53f0c0000 pid=3135 execve guuid=94d4e80a-1700-0000-14d2-1db5400c0000 pid=3136 /usr/bin/bash guuid=86fbe609-1700-0000-14d2-1db53b0c0000 pid=3131->guuid=94d4e80a-1700-0000-14d2-1db5400c0000 pid=3136 clone guuid=93e7490c-1700-0000-14d2-1db5420c0000 pid=3138 /usr/bin/cp guuid=86fbe609-1700-0000-14d2-1db53b0c0000 pid=3131->guuid=93e7490c-1700-0000-14d2-1db5420c0000 pid=3138 execve guuid=b92ecb0c-1700-0000-14d2-1db5440c0000 pid=3140 /usr/bin/mkdir guuid=86fbe609-1700-0000-14d2-1db53b0c0000 pid=3131->guuid=b92ecb0c-1700-0000-14d2-1db5440c0000 pid=3140 execve guuid=011a3b0d-1700-0000-14d2-1db5470c0000 pid=3143 /usr/bin/mkdir guuid=86fbe609-1700-0000-14d2-1db53b0c0000 pid=3131->guuid=011a3b0d-1700-0000-14d2-1db5470c0000 pid=3143 execve guuid=27feac0d-1700-0000-14d2-1db5490c0000 pid=3145 /usr/bin/mkdir guuid=86fbe609-1700-0000-14d2-1db53b0c0000 pid=3131->guuid=27feac0d-1700-0000-14d2-1db5490c0000 pid=3145 execve guuid=d8a32a0e-1700-0000-14d2-1db54c0c0000 pid=3148 /usr/bin/mkdir guuid=86fbe609-1700-0000-14d2-1db53b0c0000 pid=3131->guuid=d8a32a0e-1700-0000-14d2-1db54c0c0000 pid=3148 execve guuid=61959d0e-1700-0000-14d2-1db54d0c0000 pid=3149 /usr/bin/mkdir guuid=86fbe609-1700-0000-14d2-1db53b0c0000 pid=3131->guuid=61959d0e-1700-0000-14d2-1db54d0c0000 pid=3149 execve guuid=7e141f0f-1700-0000-14d2-1db54f0c0000 pid=3151 /usr/bin/mkdir guuid=86fbe609-1700-0000-14d2-1db53b0c0000 pid=3131->guuid=7e141f0f-1700-0000-14d2-1db54f0c0000 pid=3151 execve guuid=4b319e0f-1700-0000-14d2-1db5500c0000 pid=3152 /usr/bin/mkdir guuid=86fbe609-1700-0000-14d2-1db53b0c0000 pid=3131->guuid=4b319e0f-1700-0000-14d2-1db5500c0000 pid=3152 execve guuid=7b640a10-1700-0000-14d2-1db5520c0000 pid=3154 /usr/bin/mkdir guuid=86fbe609-1700-0000-14d2-1db53b0c0000 pid=3131->guuid=7b640a10-1700-0000-14d2-1db5520c0000 pid=3154 execve guuid=601e7a10-1700-0000-14d2-1db5550c0000 pid=3157 /usr/bin/mkdir guuid=86fbe609-1700-0000-14d2-1db53b0c0000 pid=3131->guuid=601e7a10-1700-0000-14d2-1db5550c0000 pid=3157 execve guuid=2713f810-1700-0000-14d2-1db5570c0000 pid=3159 /usr/bin/cp guuid=86fbe609-1700-0000-14d2-1db53b0c0000 pid=3131->guuid=2713f810-1700-0000-14d2-1db5570c0000 pid=3159 execve guuid=147f7b11-1700-0000-14d2-1db55a0c0000 pid=3162 /usr/bin/cp guuid=86fbe609-1700-0000-14d2-1db53b0c0000 pid=3131->guuid=147f7b11-1700-0000-14d2-1db55a0c0000 pid=3162 execve guuid=bf7e0612-1700-0000-14d2-1db55b0c0000 pid=3163 /usr/bin/cp guuid=86fbe609-1700-0000-14d2-1db53b0c0000 pid=3131->guuid=bf7e0612-1700-0000-14d2-1db55b0c0000 pid=3163 execve guuid=e5849a12-1700-0000-14d2-1db55c0c0000 pid=3164 /usr/bin/cp guuid=86fbe609-1700-0000-14d2-1db53b0c0000 pid=3131->guuid=e5849a12-1700-0000-14d2-1db55c0c0000 pid=3164 execve guuid=a6d23b13-1700-0000-14d2-1db55e0c0000 pid=3166 /usr/bin/cp guuid=86fbe609-1700-0000-14d2-1db53b0c0000 pid=3131->guuid=a6d23b13-1700-0000-14d2-1db55e0c0000 pid=3166 execve guuid=640cd813-1700-0000-14d2-1db55f0c0000 pid=3167 /usr/bin/cp guuid=86fbe609-1700-0000-14d2-1db53b0c0000 pid=3131->guuid=640cd813-1700-0000-14d2-1db55f0c0000 pid=3167 execve guuid=f3577a14-1700-0000-14d2-1db5600c0000 pid=3168 /usr/bin/cp guuid=86fbe609-1700-0000-14d2-1db53b0c0000 pid=3131->guuid=f3577a14-1700-0000-14d2-1db5600c0000 pid=3168 execve guuid=00de1015-1700-0000-14d2-1db5630c0000 pid=3171 /usr/bin/cp guuid=86fbe609-1700-0000-14d2-1db53b0c0000 pid=3131->guuid=00de1015-1700-0000-14d2-1db5630c0000 pid=3171 execve guuid=4437a615-1700-0000-14d2-1db5660c0000 pid=3174 /usr/bin/cp guuid=86fbe609-1700-0000-14d2-1db53b0c0000 pid=3131->guuid=4437a615-1700-0000-14d2-1db5660c0000 pid=3174 execve guuid=3f194416-1700-0000-14d2-1db5690c0000 pid=3177 /usr/bin/cp guuid=86fbe609-1700-0000-14d2-1db53b0c0000 pid=3131->guuid=3f194416-1700-0000-14d2-1db5690c0000 pid=3177 execve guuid=b413ea16-1700-0000-14d2-1db56b0c0000 pid=3179 /usr/bin/cp guuid=86fbe609-1700-0000-14d2-1db53b0c0000 pid=3131->guuid=b413ea16-1700-0000-14d2-1db56b0c0000 pid=3179 execve guuid=94e78517-1700-0000-14d2-1db56d0c0000 pid=3181 /usr/bin/cp guuid=86fbe609-1700-0000-14d2-1db53b0c0000 pid=3131->guuid=94e78517-1700-0000-14d2-1db56d0c0000 pid=3181 execve guuid=1c551918-1700-0000-14d2-1db5700c0000 pid=3184 /usr/bin/cp guuid=86fbe609-1700-0000-14d2-1db53b0c0000 pid=3131->guuid=1c551918-1700-0000-14d2-1db5700c0000 pid=3184 execve guuid=98669018-1700-0000-14d2-1db5720c0000 pid=3186 /usr/bin/cp guuid=86fbe609-1700-0000-14d2-1db53b0c0000 pid=3131->guuid=98669018-1700-0000-14d2-1db5720c0000 pid=3186 execve guuid=82581c19-1700-0000-14d2-1db5750c0000 pid=3189 /usr/bin/touch guuid=86fbe609-1700-0000-14d2-1db53b0c0000 pid=3131->guuid=82581c19-1700-0000-14d2-1db5750c0000 pid=3189 execve guuid=d13a7d19-1700-0000-14d2-1db5760c0000 pid=3190 /usr/bin/chmod guuid=86fbe609-1700-0000-14d2-1db53b0c0000 pid=3131->guuid=d13a7d19-1700-0000-14d2-1db5760c0000 pid=3190 execve guuid=cda1db19-1700-0000-14d2-1db5780c0000 pid=3192 /usr/bin/chmod guuid=86fbe609-1700-0000-14d2-1db53b0c0000 pid=3131->guuid=cda1db19-1700-0000-14d2-1db5780c0000 pid=3192 execve guuid=4042411a-1700-0000-14d2-1db5790c0000 pid=3193 /usr/bin/chattr guuid=86fbe609-1700-0000-14d2-1db53b0c0000 pid=3131->guuid=4042411a-1700-0000-14d2-1db5790c0000 pid=3193 execve guuid=63b0c41a-1700-0000-14d2-1db57b0c0000 pid=3195 /usr/bin/chattr guuid=86fbe609-1700-0000-14d2-1db53b0c0000 pid=3131->guuid=63b0c41a-1700-0000-14d2-1db57b0c0000 pid=3195 execve guuid=0e8e261b-1700-0000-14d2-1db57d0c0000 pid=3197 /usr/bin/chattr guuid=86fbe609-1700-0000-14d2-1db53b0c0000 pid=3131->guuid=0e8e261b-1700-0000-14d2-1db57d0c0000 pid=3197 execve guuid=6e47891b-1700-0000-14d2-1db57f0c0000 pid=3199 /usr/bin/chattr guuid=86fbe609-1700-0000-14d2-1db53b0c0000 pid=3131->guuid=6e47891b-1700-0000-14d2-1db57f0c0000 pid=3199 execve guuid=f68bea1b-1700-0000-14d2-1db5810c0000 pid=3201 /usr/bin/chattr guuid=86fbe609-1700-0000-14d2-1db53b0c0000 pid=3131->guuid=f68bea1b-1700-0000-14d2-1db5810c0000 pid=3201 execve guuid=1c2e471c-1700-0000-14d2-1db5830c0000 pid=3203 /usr/bin/chattr guuid=86fbe609-1700-0000-14d2-1db53b0c0000 pid=3131->guuid=1c2e471c-1700-0000-14d2-1db5830c0000 pid=3203 execve guuid=745aa61c-1700-0000-14d2-1db5850c0000 pid=3205 /usr/bin/chattr guuid=86fbe609-1700-0000-14d2-1db53b0c0000 pid=3131->guuid=745aa61c-1700-0000-14d2-1db5850c0000 pid=3205 execve guuid=ec93fa1c-1700-0000-14d2-1db5860c0000 pid=3206 /usr/bin/chattr guuid=86fbe609-1700-0000-14d2-1db53b0c0000 pid=3131->guuid=ec93fa1c-1700-0000-14d2-1db5860c0000 pid=3206 execve guuid=dd873e1d-1700-0000-14d2-1db5880c0000 pid=3208 /usr/bin/bash guuid=86fbe609-1700-0000-14d2-1db53b0c0000 pid=3131->guuid=dd873e1d-1700-0000-14d2-1db5880c0000 pid=3208 clone guuid=a492441d-1700-0000-14d2-1db5890c0000 pid=3209 /usr/bin/bash guuid=86fbe609-1700-0000-14d2-1db53b0c0000 pid=3131->guuid=a492441d-1700-0000-14d2-1db5890c0000 pid=3209 clone guuid=5133611d-1700-0000-14d2-1db58a0c0000 pid=3210 /usr/bin/curl net send-data guuid=86fbe609-1700-0000-14d2-1db53b0c0000 pid=3131->guuid=5133611d-1700-0000-14d2-1db58a0c0000 pid=3210 execve guuid=681b661d-1700-0000-14d2-1db58b0c0000 pid=3211 /usr/bin/dash guuid=86fbe609-1700-0000-14d2-1db53b0c0000 pid=3131->guuid=681b661d-1700-0000-14d2-1db58b0c0000 pid=3211 execve guuid=94f22422-1700-0000-14d2-1db59e0c0000 pid=3230 /usr/bin/bash guuid=86fbe609-1700-0000-14d2-1db53b0c0000 pid=3131->guuid=94f22422-1700-0000-14d2-1db59e0c0000 pid=3230 clone guuid=56a62b22-1700-0000-14d2-1db5a00c0000 pid=3232 /usr/bin/base64 guuid=86fbe609-1700-0000-14d2-1db53b0c0000 pid=3131->guuid=56a62b22-1700-0000-14d2-1db5a00c0000 pid=3232 execve guuid=0c423022-1700-0000-14d2-1db5a10c0000 pid=3233 /usr/bin/tee write-file guuid=86fbe609-1700-0000-14d2-1db53b0c0000 pid=3131->guuid=0c423022-1700-0000-14d2-1db5a10c0000 pid=3233 execve guuid=5d139a22-1700-0000-14d2-1db5a20c0000 pid=3234 /usr/bin/bash guuid=86fbe609-1700-0000-14d2-1db53b0c0000 pid=3131->guuid=5d139a22-1700-0000-14d2-1db5a20c0000 pid=3234 execve guuid=d2ba6727-1700-0000-14d2-1db5c70c0000 pid=3271 /usr/bin/bash guuid=86fbe609-1700-0000-14d2-1db53b0c0000 pid=3131->guuid=d2ba6727-1700-0000-14d2-1db5c70c0000 pid=3271 execve guuid=c151b827-1700-0000-14d2-1db5c90c0000 pid=3273 /usr/bin/rm delete-file guuid=86fbe609-1700-0000-14d2-1db53b0c0000 pid=3131->guuid=c151b827-1700-0000-14d2-1db5c90c0000 pid=3273 execve guuid=32f4f427-1700-0000-14d2-1db5cb0c0000 pid=3275 /usr/bin/rm guuid=86fbe609-1700-0000-14d2-1db53b0c0000 pid=3131->guuid=32f4f427-1700-0000-14d2-1db5cb0c0000 pid=3275 execve guuid=c3af2f28-1700-0000-14d2-1db5cd0c0000 pid=3277 /usr/bin/curl net send-data guuid=86fbe609-1700-0000-14d2-1db53b0c0000 pid=3131->guuid=c3af2f28-1700-0000-14d2-1db5cd0c0000 pid=3277 execve guuid=88713528-1700-0000-14d2-1db5ce0c0000 pid=3278 /usr/bin/dash guuid=86fbe609-1700-0000-14d2-1db53b0c0000 pid=3131->guuid=88713528-1700-0000-14d2-1db5ce0c0000 pid=3278 execve 124ee36c-bdbd-5d46-bbb1-b2cd81367f04 160.119.69.4:80 guuid=5133611d-1700-0000-14d2-1db58a0c0000 pid=3210->124ee36c-bdbd-5d46-bbb1-b2cd81367f04 send: 93B guuid=23cfe622-1700-0000-14d2-1db5a50c0000 pid=3237 /usr/bin/bash guuid=5d139a22-1700-0000-14d2-1db5a20c0000 pid=3234->guuid=23cfe622-1700-0000-14d2-1db5a50c0000 pid=3237 clone guuid=61b2ec22-1700-0000-14d2-1db5a60c0000 pid=3238 /usr/bin/bash guuid=5d139a22-1700-0000-14d2-1db5a20c0000 pid=3234->guuid=61b2ec22-1700-0000-14d2-1db5a60c0000 pid=3238 clone guuid=1f700c23-1700-0000-14d2-1db5a70c0000 pid=3239 /usr/bin/ls guuid=5d139a22-1700-0000-14d2-1db5a20c0000 pid=3234->guuid=1f700c23-1700-0000-14d2-1db5a70c0000 pid=3239 execve guuid=c64f8023-1700-0000-14d2-1db5aa0c0000 pid=3242 /usr/bin/cat guuid=5d139a22-1700-0000-14d2-1db5a20c0000 pid=3234->guuid=c64f8023-1700-0000-14d2-1db5aa0c0000 pid=3242 execve guuid=2ffbc523-1700-0000-14d2-1db5ac0c0000 pid=3244 /usr/bin/ls guuid=5d139a22-1700-0000-14d2-1db5a20c0000 pid=3234->guuid=2ffbc523-1700-0000-14d2-1db5ac0c0000 pid=3244 execve guuid=156f2e24-1700-0000-14d2-1db5af0c0000 pid=3247 /usr/bin/mkdir guuid=5d139a22-1700-0000-14d2-1db5a20c0000 pid=3234->guuid=156f2e24-1700-0000-14d2-1db5af0c0000 pid=3247 execve guuid=18567e24-1700-0000-14d2-1db5b10c0000 pid=3249 /usr/bin/mv guuid=5d139a22-1700-0000-14d2-1db5a20c0000 pid=3234->guuid=18567e24-1700-0000-14d2-1db5b10c0000 pid=3249 execve guuid=ecc5d324-1700-0000-14d2-1db5b30c0000 pid=3251 /usr/bin/bash guuid=5d139a22-1700-0000-14d2-1db5a20c0000 pid=3234->guuid=ecc5d324-1700-0000-14d2-1db5b30c0000 pid=3251 clone guuid=689ad824-1700-0000-14d2-1db5b40c0000 pid=3252 /usr/bin/base64 write-file guuid=5d139a22-1700-0000-14d2-1db5a20c0000 pid=3234->guuid=689ad824-1700-0000-14d2-1db5b40c0000 pid=3252 execve guuid=e17e2625-1700-0000-14d2-1db5b70c0000 pid=3255 /usr/bin/rm delete-file guuid=5d139a22-1700-0000-14d2-1db5a20c0000 pid=3234->guuid=e17e2625-1700-0000-14d2-1db5b70c0000 pid=3255 execve guuid=f6ac6325-1700-0000-14d2-1db5b90c0000 pid=3257 /usr/bin/mv guuid=5d139a22-1700-0000-14d2-1db5a20c0000 pid=3234->guuid=f6ac6325-1700-0000-14d2-1db5b90c0000 pid=3257 execve guuid=98a2b925-1700-0000-14d2-1db5bb0c0000 pid=3259 /usr/bin/ls guuid=5d139a22-1700-0000-14d2-1db5a20c0000 pid=3234->guuid=98a2b925-1700-0000-14d2-1db5bb0c0000 pid=3259 execve guuid=71041726-1700-0000-14d2-1db5be0c0000 pid=3262 /usr/bin/bash guuid=5d139a22-1700-0000-14d2-1db5a20c0000 pid=3234->guuid=71041726-1700-0000-14d2-1db5be0c0000 pid=3262 clone guuid=98b61d26-1700-0000-14d2-1db5bf0c0000 pid=3263 /usr/bin/base64 write-file guuid=5d139a22-1700-0000-14d2-1db5a20c0000 pid=3234->guuid=98b61d26-1700-0000-14d2-1db5bf0c0000 pid=3263 execve guuid=40776526-1700-0000-14d2-1db5c10c0000 pid=3265 /usr/bin/ls guuid=5d139a22-1700-0000-14d2-1db5a20c0000 pid=3234->guuid=40776526-1700-0000-14d2-1db5c10c0000 pid=3265 execve guuid=6806bf26-1700-0000-14d2-1db5c30c0000 pid=3267 /usr/bin/cat guuid=5d139a22-1700-0000-14d2-1db5a20c0000 pid=3234->guuid=6806bf26-1700-0000-14d2-1db5c30c0000 pid=3267 execve guuid=22270027-1700-0000-14d2-1db5c50c0000 pid=3269 /usr/bin/ls guuid=5d139a22-1700-0000-14d2-1db5a20c0000 pid=3234->guuid=22270027-1700-0000-14d2-1db5c50c0000 pid=3269 execve guuid=c3af2f28-1700-0000-14d2-1db5cd0c0000 pid=3277->124ee36c-bdbd-5d46-bbb1-b2cd81367f04 send: 93B
Score:
81%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/3ee8b4e38efa5f872f5f1f4fac720d80eb7c079fc538ef75f2d8a8dc7068ef9f
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3ee8b4e38efa5f872f5f1f4fac720d80eb7c079fc538ef75f2d8a8dc7068ef9f/
Threat name:
Linux.Backdoor.WebShell
Create hunting rule
Status:
Malicious
First seen:
2026-07-20 00:13:41 UTC
File Type:
Text (Shell)
AV detection:
10 of 24 (41.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=h3uljy4o7jpyol27d5h2y4qnqdvxyb47yu4o65ps3cuny4di56pq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260720-ah13zahv7n/
Behaviour
Reads runtime system information
Writes file to tmp directory
Deobfuscate/Decode Files or Information
Checks CPU configuration
File and Directory Permissions Modification
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.39
Link:
https://yomi.yoroi.company/submissions/3ee8b4e38efa5f872f5f1f4fac720d80eb7c079fc538ef75f2d8a8dc7068ef9f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SUSP_LNX_Base64_Exec_Apr24
Create hunting rule
Author:Christian Burkard
Description:Detects suspicious base64 encoded shell commands (as seen in Palo Alto CVE-2024-3400 exploitation)
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 3ee8b4e38efa5f872f5f1f4fac720d80eb7c079fc538ef75f2d8a8dc7068ef9f

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3884408/
  
Delivery method
Distributed via web download

Comments