MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3fa676cea2dee5e06065e38e122253965f1a4bf8b7ea68f164aec67185a456e1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 4


Intelligence 4 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3fa676cea2dee5e06065e38e122253965f1a4bf8b7ea68f164aec67185a456e1
SHA3-384 hash: 9a63ae65deb922ae9bc78822357b6af84c66b1f4506589c483f96e0b75d9a8df48a66ee6086791d98e37d2383a0bd75f
SHA1 hash: e7983d6fb377f1a13257aaf2d9f5022476a66b99
MD5 hash: a74924e6ee1bf0c131ae6c83c2b497bc
humanhash: hamper-nitrogen-delta-venus
File name:wr.php
Download: download sample
File size:27'042 bytes
First seen:2026-07-24 19:33:56 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 768:18vCB+25j6es8Re9FYpMSUpi+20qUpi+20YQX:18l25J4d2QX
TLSH T10FC27D956A867C44BDC94A3E4CBD2B0D6DF5C3E1324D42AC3D8A3C719C15FACD618B1A
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh

Intelligence

File Origin
# of uploads :
1
# of downloads :
68
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive masquerade
Link:
https://www.filescan.io/uploads/6a63be4a682d01dca9a3cc41/reports/679f827f-3a73-4597-a568-6cd4eaced5a9/overview
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/941cd5fd-075d-424d-b76b-557bbc8d1b98
Behavior Graph:
Download SVG
%3 guuid=1c5e45a5-1600-0000-41eb-a4672e0e0000 pid=3630 /usr/bin/sudo guuid=86775fa8-1600-0000-41eb-a467380e0000 pid=3640 /tmp/sample.bin guuid=1c5e45a5-1600-0000-41eb-a4672e0e0000 pid=3630->guuid=86775fa8-1600-0000-41eb-a467380e0000 pid=3640 execve guuid=406769a9-1600-0000-41eb-a4673c0e0000 pid=3644 /usr/bin/bash guuid=86775fa8-1600-0000-41eb-a467380e0000 pid=3640->guuid=406769a9-1600-0000-41eb-a4673c0e0000 pid=3644 clone guuid=46be78a9-1600-0000-41eb-a4673e0e0000 pid=3646 /usr/bin/base64 guuid=86775fa8-1600-0000-41eb-a467380e0000 pid=3640->guuid=46be78a9-1600-0000-41eb-a4673e0e0000 pid=3646 execve guuid=a7c789a9-1600-0000-41eb-a4673f0e0000 pid=3647 /usr/bin/bash guuid=86775fa8-1600-0000-41eb-a467380e0000 pid=3640->guuid=a7c789a9-1600-0000-41eb-a4673f0e0000 pid=3647 clone guuid=bb5630aa-1600-0000-41eb-a467420e0000 pid=3650 /usr/bin/cp guuid=86775fa8-1600-0000-41eb-a467380e0000 pid=3640->guuid=bb5630aa-1600-0000-41eb-a467420e0000 pid=3650 execve guuid=8407aaaa-1600-0000-41eb-a467430e0000 pid=3651 /usr/bin/mkdir guuid=86775fa8-1600-0000-41eb-a467380e0000 pid=3640->guuid=8407aaaa-1600-0000-41eb-a467430e0000 pid=3651 execve guuid=8fac14ab-1600-0000-41eb-a467490e0000 pid=3657 /usr/bin/mkdir guuid=86775fa8-1600-0000-41eb-a467380e0000 pid=3640->guuid=8fac14ab-1600-0000-41eb-a467490e0000 pid=3657 execve guuid=888975ab-1600-0000-41eb-a4674a0e0000 pid=3658 /usr/bin/mkdir guuid=86775fa8-1600-0000-41eb-a467380e0000 pid=3640->guuid=888975ab-1600-0000-41eb-a4674a0e0000 pid=3658 execve guuid=9e26d9ab-1600-0000-41eb-a4674b0e0000 pid=3659 /usr/bin/mkdir guuid=86775fa8-1600-0000-41eb-a467380e0000 pid=3640->guuid=9e26d9ab-1600-0000-41eb-a4674b0e0000 pid=3659 execve guuid=e00f3fac-1600-0000-41eb-a4674f0e0000 pid=3663 /usr/bin/mkdir guuid=86775fa8-1600-0000-41eb-a467380e0000 pid=3640->guuid=e00f3fac-1600-0000-41eb-a4674f0e0000 pid=3663 execve guuid=8fc2a5ac-1600-0000-41eb-a467510e0000 pid=3665 /usr/bin/mkdir guuid=86775fa8-1600-0000-41eb-a467380e0000 pid=3640->guuid=8fc2a5ac-1600-0000-41eb-a467510e0000 pid=3665 execve guuid=9d8a4cad-1600-0000-41eb-a467540e0000 pid=3668 /usr/bin/mkdir guuid=86775fa8-1600-0000-41eb-a467380e0000 pid=3640->guuid=9d8a4cad-1600-0000-41eb-a467540e0000 pid=3668 execve guuid=4e61b6ad-1600-0000-41eb-a467560e0000 pid=3670 /usr/bin/mkdir guuid=86775fa8-1600-0000-41eb-a467380e0000 pid=3640->guuid=4e61b6ad-1600-0000-41eb-a467560e0000 pid=3670 execve guuid=607c06ae-1600-0000-41eb-a467580e0000 pid=3672 /usr/bin/mkdir guuid=86775fa8-1600-0000-41eb-a467380e0000 pid=3640->guuid=607c06ae-1600-0000-41eb-a467580e0000 pid=3672 execve guuid=6b9470ae-1600-0000-41eb-a4675b0e0000 pid=3675 /usr/bin/cp guuid=86775fa8-1600-0000-41eb-a467380e0000 pid=3640->guuid=6b9470ae-1600-0000-41eb-a4675b0e0000 pid=3675 execve guuid=edcbe6ae-1600-0000-41eb-a4675c0e0000 pid=3676 /usr/bin/cp guuid=86775fa8-1600-0000-41eb-a467380e0000 pid=3640->guuid=edcbe6ae-1600-0000-41eb-a4675c0e0000 pid=3676 execve guuid=cc3057af-1600-0000-41eb-a4675f0e0000 pid=3679 /usr/bin/cp guuid=86775fa8-1600-0000-41eb-a467380e0000 pid=3640->guuid=cc3057af-1600-0000-41eb-a4675f0e0000 pid=3679 execve guuid=576fcdaf-1600-0000-41eb-a467620e0000 pid=3682 /usr/bin/cp guuid=86775fa8-1600-0000-41eb-a467380e0000 pid=3640->guuid=576fcdaf-1600-0000-41eb-a467620e0000 pid=3682 execve guuid=249f4eb0-1600-0000-41eb-a467650e0000 pid=3685 /usr/bin/cp guuid=86775fa8-1600-0000-41eb-a467380e0000 pid=3640->guuid=249f4eb0-1600-0000-41eb-a467650e0000 pid=3685 execve guuid=b111c3b0-1600-0000-41eb-a467680e0000 pid=3688 /usr/bin/cp guuid=86775fa8-1600-0000-41eb-a467380e0000 pid=3640->guuid=b111c3b0-1600-0000-41eb-a467680e0000 pid=3688 execve guuid=9e70a2b1-1600-0000-41eb-a4676b0e0000 pid=3691 /usr/bin/cp guuid=86775fa8-1600-0000-41eb-a467380e0000 pid=3640->guuid=9e70a2b1-1600-0000-41eb-a4676b0e0000 pid=3691 execve guuid=ca901ab2-1600-0000-41eb-a4676c0e0000 pid=3692 /usr/bin/cp guuid=86775fa8-1600-0000-41eb-a467380e0000 pid=3640->guuid=ca901ab2-1600-0000-41eb-a4676c0e0000 pid=3692 execve guuid=e932a4b2-1600-0000-41eb-a4676e0e0000 pid=3694 /usr/bin/cp guuid=86775fa8-1600-0000-41eb-a467380e0000 pid=3640->guuid=e932a4b2-1600-0000-41eb-a4676e0e0000 pid=3694 execve guuid=67b81ab3-1600-0000-41eb-a467700e0000 pid=3696 /usr/bin/cp guuid=86775fa8-1600-0000-41eb-a467380e0000 pid=3640->guuid=67b81ab3-1600-0000-41eb-a467700e0000 pid=3696 execve guuid=2d5dabb3-1600-0000-41eb-a467740e0000 pid=3700 /usr/bin/cp guuid=86775fa8-1600-0000-41eb-a467380e0000 pid=3640->guuid=2d5dabb3-1600-0000-41eb-a467740e0000 pid=3700 execve guuid=fab56cb4-1600-0000-41eb-a4677a0e0000 pid=3706 /usr/bin/cp guuid=86775fa8-1600-0000-41eb-a467380e0000 pid=3640->guuid=fab56cb4-1600-0000-41eb-a4677a0e0000 pid=3706 execve guuid=9355c9b4-1600-0000-41eb-a4677f0e0000 pid=3711 /usr/bin/cp guuid=86775fa8-1600-0000-41eb-a467380e0000 pid=3640->guuid=9355c9b4-1600-0000-41eb-a4677f0e0000 pid=3711 execve guuid=5f852bb5-1600-0000-41eb-a467820e0000 pid=3714 /usr/bin/cp guuid=86775fa8-1600-0000-41eb-a467380e0000 pid=3640->guuid=5f852bb5-1600-0000-41eb-a467820e0000 pid=3714 execve guuid=ba95a9b5-1600-0000-41eb-a467860e0000 pid=3718 /usr/bin/touch guuid=86775fa8-1600-0000-41eb-a467380e0000 pid=3640->guuid=ba95a9b5-1600-0000-41eb-a467860e0000 pid=3718 execve guuid=d80921b6-1600-0000-41eb-a4678e0e0000 pid=3726 /usr/bin/chmod guuid=86775fa8-1600-0000-41eb-a467380e0000 pid=3640->guuid=d80921b6-1600-0000-41eb-a4678e0e0000 pid=3726 execve guuid=98ff67b6-1600-0000-41eb-a4678f0e0000 pid=3727 /usr/bin/chmod guuid=86775fa8-1600-0000-41eb-a467380e0000 pid=3640->guuid=98ff67b6-1600-0000-41eb-a4678f0e0000 pid=3727 execve guuid=2f62c0b6-1600-0000-41eb-a467900e0000 pid=3728 /usr/bin/chattr guuid=86775fa8-1600-0000-41eb-a467380e0000 pid=3640->guuid=2f62c0b6-1600-0000-41eb-a467900e0000 pid=3728 execve guuid=885573b7-1600-0000-41eb-a467910e0000 pid=3729 /usr/bin/chattr guuid=86775fa8-1600-0000-41eb-a467380e0000 pid=3640->guuid=885573b7-1600-0000-41eb-a467910e0000 pid=3729 execve guuid=00bcd8b7-1600-0000-41eb-a467920e0000 pid=3730 /usr/bin/chattr guuid=86775fa8-1600-0000-41eb-a467380e0000 pid=3640->guuid=00bcd8b7-1600-0000-41eb-a467920e0000 pid=3730 execve guuid=932332b8-1600-0000-41eb-a467950e0000 pid=3733 /usr/bin/chattr guuid=86775fa8-1600-0000-41eb-a467380e0000 pid=3640->guuid=932332b8-1600-0000-41eb-a467950e0000 pid=3733 execve guuid=92b49eb8-1600-0000-41eb-a467960e0000 pid=3734 /usr/bin/chattr guuid=86775fa8-1600-0000-41eb-a467380e0000 pid=3640->guuid=92b49eb8-1600-0000-41eb-a467960e0000 pid=3734 execve guuid=2c7d1ab9-1600-0000-41eb-a467980e0000 pid=3736 /usr/bin/chattr guuid=86775fa8-1600-0000-41eb-a467380e0000 pid=3640->guuid=2c7d1ab9-1600-0000-41eb-a467980e0000 pid=3736 execve guuid=cf9878b9-1600-0000-41eb-a4679a0e0000 pid=3738 /usr/bin/chattr guuid=86775fa8-1600-0000-41eb-a467380e0000 pid=3640->guuid=cf9878b9-1600-0000-41eb-a4679a0e0000 pid=3738 execve guuid=10afc7b9-1600-0000-41eb-a4679c0e0000 pid=3740 /usr/bin/chattr guuid=86775fa8-1600-0000-41eb-a467380e0000 pid=3640->guuid=10afc7b9-1600-0000-41eb-a4679c0e0000 pid=3740 execve guuid=876526ba-1600-0000-41eb-a4679e0e0000 pid=3742 /usr/bin/bash guuid=86775fa8-1600-0000-41eb-a467380e0000 pid=3640->guuid=876526ba-1600-0000-41eb-a4679e0e0000 pid=3742 clone guuid=61982dba-1600-0000-41eb-a4679f0e0000 pid=3743 /usr/bin/bash guuid=86775fa8-1600-0000-41eb-a467380e0000 pid=3640->guuid=61982dba-1600-0000-41eb-a4679f0e0000 pid=3743 clone guuid=fdd385ba-1600-0000-41eb-a467a20e0000 pid=3746 /usr/bin/curl net send-data guuid=86775fa8-1600-0000-41eb-a467380e0000 pid=3640->guuid=fdd385ba-1600-0000-41eb-a467a20e0000 pid=3746 execve guuid=16d98bba-1600-0000-41eb-a467a30e0000 pid=3747 /usr/bin/dash guuid=86775fa8-1600-0000-41eb-a467380e0000 pid=3640->guuid=16d98bba-1600-0000-41eb-a467a30e0000 pid=3747 execve guuid=c5b829c1-1600-0000-41eb-a467bc0e0000 pid=3772 /usr/bin/bash guuid=86775fa8-1600-0000-41eb-a467380e0000 pid=3640->guuid=c5b829c1-1600-0000-41eb-a467bc0e0000 pid=3772 clone guuid=f7ab38c1-1600-0000-41eb-a467bd0e0000 pid=3773 /usr/bin/base64 guuid=86775fa8-1600-0000-41eb-a467380e0000 pid=3640->guuid=f7ab38c1-1600-0000-41eb-a467bd0e0000 pid=3773 execve guuid=907147c1-1600-0000-41eb-a467be0e0000 pid=3774 /usr/bin/tee write-file guuid=86775fa8-1600-0000-41eb-a467380e0000 pid=3640->guuid=907147c1-1600-0000-41eb-a467be0e0000 pid=3774 execve guuid=5343c4c2-1600-0000-41eb-a467c50e0000 pid=3781 /usr/bin/bash guuid=86775fa8-1600-0000-41eb-a467380e0000 pid=3640->guuid=5343c4c2-1600-0000-41eb-a467c50e0000 pid=3781 execve guuid=4e4e4ac8-1600-0000-41eb-a467e50e0000 pid=3813 /usr/bin/bash guuid=86775fa8-1600-0000-41eb-a467380e0000 pid=3640->guuid=4e4e4ac8-1600-0000-41eb-a467e50e0000 pid=3813 execve guuid=8b619cc8-1600-0000-41eb-a467e80e0000 pid=3816 /usr/bin/rm delete-file guuid=86775fa8-1600-0000-41eb-a467380e0000 pid=3640->guuid=8b619cc8-1600-0000-41eb-a467e80e0000 pid=3816 execve guuid=e338d9c8-1600-0000-41eb-a467ec0e0000 pid=3820 /usr/bin/rm guuid=86775fa8-1600-0000-41eb-a467380e0000 pid=3640->guuid=e338d9c8-1600-0000-41eb-a467ec0e0000 pid=3820 execve guuid=5a2310c9-1600-0000-41eb-a467ed0e0000 pid=3821 /usr/bin/curl net send-data guuid=86775fa8-1600-0000-41eb-a467380e0000 pid=3640->guuid=5a2310c9-1600-0000-41eb-a467ed0e0000 pid=3821 execve guuid=98f514c9-1600-0000-41eb-a467ee0e0000 pid=3822 /usr/bin/dash guuid=86775fa8-1600-0000-41eb-a467380e0000 pid=3640->guuid=98f514c9-1600-0000-41eb-a467ee0e0000 pid=3822 execve 124ee36c-bdbd-5d46-bbb1-b2cd81367f04 160.119.69.4:80 guuid=fdd385ba-1600-0000-41eb-a467a20e0000 pid=3746->124ee36c-bdbd-5d46-bbb1-b2cd81367f04 send: 93B guuid=b4674bc3-1600-0000-41eb-a467c70e0000 pid=3783 /usr/bin/bash guuid=5343c4c2-1600-0000-41eb-a467c50e0000 pid=3781->guuid=b4674bc3-1600-0000-41eb-a467c70e0000 pid=3783 clone guuid=449d50c3-1600-0000-41eb-a467c80e0000 pid=3784 /usr/bin/bash guuid=5343c4c2-1600-0000-41eb-a467c50e0000 pid=3781->guuid=449d50c3-1600-0000-41eb-a467c80e0000 pid=3784 clone guuid=9f8987c3-1600-0000-41eb-a467c90e0000 pid=3785 /usr/bin/ls guuid=5343c4c2-1600-0000-41eb-a467c50e0000 pid=3781->guuid=9f8987c3-1600-0000-41eb-a467c90e0000 pid=3785 execve guuid=cc0af3c3-1600-0000-41eb-a467cc0e0000 pid=3788 /usr/bin/cat guuid=5343c4c2-1600-0000-41eb-a467c50e0000 pid=3781->guuid=cc0af3c3-1600-0000-41eb-a467cc0e0000 pid=3788 execve guuid=040037c4-1600-0000-41eb-a467ce0e0000 pid=3790 /usr/bin/ls guuid=5343c4c2-1600-0000-41eb-a467c50e0000 pid=3781->guuid=040037c4-1600-0000-41eb-a467ce0e0000 pid=3790 execve guuid=60b09ec4-1600-0000-41eb-a467d00e0000 pid=3792 /usr/bin/mkdir guuid=5343c4c2-1600-0000-41eb-a467c50e0000 pid=3781->guuid=60b09ec4-1600-0000-41eb-a467d00e0000 pid=3792 execve guuid=5fc5eac4-1600-0000-41eb-a467d20e0000 pid=3794 /usr/bin/mv guuid=5343c4c2-1600-0000-41eb-a467c50e0000 pid=3781->guuid=5fc5eac4-1600-0000-41eb-a467d20e0000 pid=3794 execve guuid=ed1d40c5-1600-0000-41eb-a467d40e0000 pid=3796 /usr/bin/bash guuid=5343c4c2-1600-0000-41eb-a467c50e0000 pid=3781->guuid=ed1d40c5-1600-0000-41eb-a467d40e0000 pid=3796 clone guuid=7f2045c5-1600-0000-41eb-a467d50e0000 pid=3797 /usr/bin/base64 write-file guuid=5343c4c2-1600-0000-41eb-a467c50e0000 pid=3781->guuid=7f2045c5-1600-0000-41eb-a467d50e0000 pid=3797 execve guuid=7d3a97c5-1600-0000-41eb-a467d70e0000 pid=3799 /usr/bin/rm delete-file guuid=5343c4c2-1600-0000-41eb-a467c50e0000 pid=3781->guuid=7d3a97c5-1600-0000-41eb-a467d70e0000 pid=3799 execve guuid=5c78d9c5-1600-0000-41eb-a467d80e0000 pid=3800 /usr/bin/mv guuid=5343c4c2-1600-0000-41eb-a467c50e0000 pid=3781->guuid=5c78d9c5-1600-0000-41eb-a467d80e0000 pid=3800 execve guuid=70c642c6-1600-0000-41eb-a467d90e0000 pid=3801 /usr/bin/ls guuid=5343c4c2-1600-0000-41eb-a467c50e0000 pid=3781->guuid=70c642c6-1600-0000-41eb-a467d90e0000 pid=3801 execve guuid=005bbac6-1600-0000-41eb-a467da0e0000 pid=3802 /usr/bin/bash guuid=5343c4c2-1600-0000-41eb-a467c50e0000 pid=3781->guuid=005bbac6-1600-0000-41eb-a467da0e0000 pid=3802 clone guuid=269cc0c6-1600-0000-41eb-a467db0e0000 pid=3803 /usr/bin/base64 write-file guuid=5343c4c2-1600-0000-41eb-a467c50e0000 pid=3781->guuid=269cc0c6-1600-0000-41eb-a467db0e0000 pid=3803 execve guuid=6c8e12c7-1600-0000-41eb-a467df0e0000 pid=3807 /usr/bin/ls guuid=5343c4c2-1600-0000-41eb-a467c50e0000 pid=3781->guuid=6c8e12c7-1600-0000-41eb-a467df0e0000 pid=3807 execve guuid=f40a7fc7-1600-0000-41eb-a467e00e0000 pid=3808 /usr/bin/cat guuid=5343c4c2-1600-0000-41eb-a467c50e0000 pid=3781->guuid=f40a7fc7-1600-0000-41eb-a467e00e0000 pid=3808 execve guuid=ebf2d5c7-1600-0000-41eb-a467e20e0000 pid=3810 /usr/bin/ls guuid=5343c4c2-1600-0000-41eb-a467c50e0000 pid=3781->guuid=ebf2d5c7-1600-0000-41eb-a467e20e0000 pid=3810 execve guuid=5a2310c9-1600-0000-41eb-a467ed0e0000 pid=3821->124ee36c-bdbd-5d46-bbb1-b2cd81367f04 send: 93B
Score:
81%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/3fa676cea2dee5e06065e38e122253965f1a4bf8b7ea68f164aec67185a456e1
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3fa676cea2dee5e06065e38e122253965f1a4bf8b7ea68f164aec67185a456e1/
Gathering data
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=h6thntvc33s6aydf4ohbeistszprus7yw7vgr4lev3dhdbnek3qq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260724-yacx6s1fph/
Behaviour
Reads runtime system information
Writes file to tmp directory
Deobfuscate/Decode Files or Information
Checks CPU configuration
File and Directory Permissions Modification
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SUSP_LNX_Base64_Exec_Apr24
Create hunting rule
Author:Christian Burkard
Description:Detects suspicious base64 encoded shell commands (as seen in Palo Alto CVE-2024-3400 exploitation)
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 3fa676cea2dee5e06065e38e122253965f1a4bf8b7ea68f164aec67185a456e1

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3884409/
  
Delivery method
Distributed via web download

Comments