🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4df4bad80eb6db91b138f9852b9c2cbf42daf7637e9e5e9a9e7ab9000e1bf5c6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 4df4bad80eb6db91b138f9852b9c2cbf42daf7637e9e5e9a9e7ab9000e1bf5c6
SHA3-384 hash: e9915413a8dd05f6e8753f1dbe3e32228f59274011c869a6b60d62fdcd65061dcecd284431c8a63e2beb05d5b05bc9fb
SHA1 hash: 21e275328248200f4776d1d5838da2b26b724e9d
MD5 hash: be45798f06e71d0fe8ba7ec188fb44a0
humanhash: cold-speaker-cola-lithium
File name:wr.php
Download: download sample
File size:27'042 bytes
First seen:2026-09-01 09:45:37 UTC
Last seen:2026-09-02 08:21:04 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 768:h8vCB+25j6es8R/4O9FYpMSUpi+20qUpi+20YQX:h8l25Jwod2QX
TLSH T1EAC28D966A867C44BEC94A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11FACD618B1A
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://160.119.69.4/z/post/noroot.phpn/an/aelf ua-wget

Intelligence

File Origin
# of uploads :
4
# of downloads :
54
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.DownLoader.2862.27688.3786.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive masquerade
Link:
https://www.filescan.io/uploads/6a969ee538b14ee63037a3ec/reports/94b19608-1232-46e1-822a-43d6ddbfc205/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-09-01T07:17:00Z UTC
Last seen:
2026-09-02T23:51:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/4df4bad80eb6db91b138f9852b9c2cbf42daf7637e9e5e9a9e7ab9000e1bf5c6/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/7c42349a-7e11-4699-b8fa-b87a6ae8d58b
Behavior Graph:
Download SVG
%3 guuid=d27b568b-1600-0000-beaa-3cfb450c0000 pid=3141 /usr/bin/sudo guuid=9cdcbc8d-1600-0000-beaa-3cfb500c0000 pid=3152 /tmp/sample.bin guuid=d27b568b-1600-0000-beaa-3cfb450c0000 pid=3141->guuid=9cdcbc8d-1600-0000-beaa-3cfb500c0000 pid=3152 execve guuid=35e52f8e-1600-0000-beaa-3cfb520c0000 pid=3154 /usr/bin/bash guuid=9cdcbc8d-1600-0000-beaa-3cfb500c0000 pid=3152->guuid=35e52f8e-1600-0000-beaa-3cfb520c0000 pid=3154 clone guuid=6062368e-1600-0000-beaa-3cfb530c0000 pid=3155 /usr/bin/base64 guuid=9cdcbc8d-1600-0000-beaa-3cfb500c0000 pid=3152->guuid=6062368e-1600-0000-beaa-3cfb530c0000 pid=3155 execve guuid=d6853d8e-1600-0000-beaa-3cfb540c0000 pid=3156 /usr/bin/bash guuid=9cdcbc8d-1600-0000-beaa-3cfb500c0000 pid=3152->guuid=d6853d8e-1600-0000-beaa-3cfb540c0000 pid=3156 clone guuid=8fd5ab8e-1600-0000-beaa-3cfb570c0000 pid=3159 /usr/bin/cp guuid=9cdcbc8d-1600-0000-beaa-3cfb500c0000 pid=3152->guuid=8fd5ab8e-1600-0000-beaa-3cfb570c0000 pid=3159 execve guuid=361b188f-1600-0000-beaa-3cfb590c0000 pid=3161 /usr/bin/mkdir guuid=9cdcbc8d-1600-0000-beaa-3cfb500c0000 pid=3152->guuid=361b188f-1600-0000-beaa-3cfb590c0000 pid=3161 execve guuid=4398808f-1600-0000-beaa-3cfb5a0c0000 pid=3162 /usr/bin/mkdir guuid=9cdcbc8d-1600-0000-beaa-3cfb500c0000 pid=3152->guuid=4398808f-1600-0000-beaa-3cfb5a0c0000 pid=3162 execve guuid=1fe2e18f-1600-0000-beaa-3cfb5b0c0000 pid=3163 /usr/bin/mkdir guuid=9cdcbc8d-1600-0000-beaa-3cfb500c0000 pid=3152->guuid=1fe2e18f-1600-0000-beaa-3cfb5b0c0000 pid=3163 execve guuid=578a3d90-1600-0000-beaa-3cfb5c0c0000 pid=3164 /usr/bin/mkdir guuid=9cdcbc8d-1600-0000-beaa-3cfb500c0000 pid=3152->guuid=578a3d90-1600-0000-beaa-3cfb5c0c0000 pid=3164 execve guuid=d8878e90-1600-0000-beaa-3cfb5e0c0000 pid=3166 /usr/bin/mkdir guuid=9cdcbc8d-1600-0000-beaa-3cfb500c0000 pid=3152->guuid=d8878e90-1600-0000-beaa-3cfb5e0c0000 pid=3166 execve guuid=21d8dd90-1600-0000-beaa-3cfb600c0000 pid=3168 /usr/bin/mkdir guuid=9cdcbc8d-1600-0000-beaa-3cfb500c0000 pid=3152->guuid=21d8dd90-1600-0000-beaa-3cfb600c0000 pid=3168 execve guuid=5d314491-1600-0000-beaa-3cfb630c0000 pid=3171 /usr/bin/mkdir guuid=9cdcbc8d-1600-0000-beaa-3cfb500c0000 pid=3152->guuid=5d314491-1600-0000-beaa-3cfb630c0000 pid=3171 execve guuid=e1a19c91-1600-0000-beaa-3cfb640c0000 pid=3172 /usr/bin/mkdir guuid=9cdcbc8d-1600-0000-beaa-3cfb500c0000 pid=3152->guuid=e1a19c91-1600-0000-beaa-3cfb640c0000 pid=3172 execve guuid=da8ee691-1600-0000-beaa-3cfb660c0000 pid=3174 /usr/bin/mkdir guuid=9cdcbc8d-1600-0000-beaa-3cfb500c0000 pid=3152->guuid=da8ee691-1600-0000-beaa-3cfb660c0000 pid=3174 execve guuid=7af03392-1600-0000-beaa-3cfb690c0000 pid=3177 /usr/bin/cp guuid=9cdcbc8d-1600-0000-beaa-3cfb500c0000 pid=3152->guuid=7af03392-1600-0000-beaa-3cfb690c0000 pid=3177 execve guuid=4116a592-1600-0000-beaa-3cfb6b0c0000 pid=3179 /usr/bin/cp guuid=9cdcbc8d-1600-0000-beaa-3cfb500c0000 pid=3152->guuid=4116a592-1600-0000-beaa-3cfb6b0c0000 pid=3179 execve guuid=323f0193-1600-0000-beaa-3cfb6e0c0000 pid=3182 /usr/bin/cp guuid=9cdcbc8d-1600-0000-beaa-3cfb500c0000 pid=3152->guuid=323f0193-1600-0000-beaa-3cfb6e0c0000 pid=3182 execve guuid=71f85593-1600-0000-beaa-3cfb700c0000 pid=3184 /usr/bin/cp guuid=9cdcbc8d-1600-0000-beaa-3cfb500c0000 pid=3152->guuid=71f85593-1600-0000-beaa-3cfb700c0000 pid=3184 execve guuid=36fdab93-1600-0000-beaa-3cfb720c0000 pid=3186 /usr/bin/cp guuid=9cdcbc8d-1600-0000-beaa-3cfb500c0000 pid=3152->guuid=36fdab93-1600-0000-beaa-3cfb720c0000 pid=3186 execve guuid=c6c71294-1600-0000-beaa-3cfb750c0000 pid=3189 /usr/bin/cp guuid=9cdcbc8d-1600-0000-beaa-3cfb500c0000 pid=3152->guuid=c6c71294-1600-0000-beaa-3cfb750c0000 pid=3189 execve guuid=b3ef6c94-1600-0000-beaa-3cfb770c0000 pid=3191 /usr/bin/cp guuid=9cdcbc8d-1600-0000-beaa-3cfb500c0000 pid=3152->guuid=b3ef6c94-1600-0000-beaa-3cfb770c0000 pid=3191 execve guuid=093cc294-1600-0000-beaa-3cfb790c0000 pid=3193 /usr/bin/cp guuid=9cdcbc8d-1600-0000-beaa-3cfb500c0000 pid=3152->guuid=093cc294-1600-0000-beaa-3cfb790c0000 pid=3193 execve guuid=b1691b95-1600-0000-beaa-3cfb7c0c0000 pid=3196 /usr/bin/cp guuid=9cdcbc8d-1600-0000-beaa-3cfb500c0000 pid=3152->guuid=b1691b95-1600-0000-beaa-3cfb7c0c0000 pid=3196 execve guuid=19db7195-1600-0000-beaa-3cfb7d0c0000 pid=3197 /usr/bin/cp guuid=9cdcbc8d-1600-0000-beaa-3cfb500c0000 pid=3152->guuid=19db7195-1600-0000-beaa-3cfb7d0c0000 pid=3197 execve guuid=f986d695-1600-0000-beaa-3cfb7f0c0000 pid=3199 /usr/bin/cp guuid=9cdcbc8d-1600-0000-beaa-3cfb500c0000 pid=3152->guuid=f986d695-1600-0000-beaa-3cfb7f0c0000 pid=3199 execve guuid=f0464896-1600-0000-beaa-3cfb800c0000 pid=3200 /usr/bin/cp guuid=9cdcbc8d-1600-0000-beaa-3cfb500c0000 pid=3152->guuid=f0464896-1600-0000-beaa-3cfb800c0000 pid=3200 execve guuid=25efa496-1600-0000-beaa-3cfb820c0000 pid=3202 /usr/bin/cp guuid=9cdcbc8d-1600-0000-beaa-3cfb500c0000 pid=3152->guuid=25efa496-1600-0000-beaa-3cfb820c0000 pid=3202 execve guuid=2d42f796-1600-0000-beaa-3cfb850c0000 pid=3205 /usr/bin/cp guuid=9cdcbc8d-1600-0000-beaa-3cfb500c0000 pid=3152->guuid=2d42f796-1600-0000-beaa-3cfb850c0000 pid=3205 execve guuid=621a7397-1600-0000-beaa-3cfb880c0000 pid=3208 /usr/bin/touch guuid=9cdcbc8d-1600-0000-beaa-3cfb500c0000 pid=3152->guuid=621a7397-1600-0000-beaa-3cfb880c0000 pid=3208 execve guuid=a7b2f697-1600-0000-beaa-3cfb8a0c0000 pid=3210 /usr/bin/chmod guuid=9cdcbc8d-1600-0000-beaa-3cfb500c0000 pid=3152->guuid=a7b2f697-1600-0000-beaa-3cfb8a0c0000 pid=3210 execve guuid=3e2e3698-1600-0000-beaa-3cfb8c0c0000 pid=3212 /usr/bin/chmod guuid=9cdcbc8d-1600-0000-beaa-3cfb500c0000 pid=3152->guuid=3e2e3698-1600-0000-beaa-3cfb8c0c0000 pid=3212 execve guuid=cf378c98-1600-0000-beaa-3cfb8d0c0000 pid=3213 /usr/bin/chattr guuid=9cdcbc8d-1600-0000-beaa-3cfb500c0000 pid=3152->guuid=cf378c98-1600-0000-beaa-3cfb8d0c0000 pid=3213 execve guuid=185df998-1600-0000-beaa-3cfb8e0c0000 pid=3214 /usr/bin/chattr guuid=9cdcbc8d-1600-0000-beaa-3cfb500c0000 pid=3152->guuid=185df998-1600-0000-beaa-3cfb8e0c0000 pid=3214 execve guuid=d34c4999-1600-0000-beaa-3cfb900c0000 pid=3216 /usr/bin/chattr guuid=9cdcbc8d-1600-0000-beaa-3cfb500c0000 pid=3152->guuid=d34c4999-1600-0000-beaa-3cfb900c0000 pid=3216 execve guuid=96e3a999-1600-0000-beaa-3cfb920c0000 pid=3218 /usr/bin/chattr guuid=9cdcbc8d-1600-0000-beaa-3cfb500c0000 pid=3152->guuid=96e3a999-1600-0000-beaa-3cfb920c0000 pid=3218 execve guuid=f649ec99-1600-0000-beaa-3cfb940c0000 pid=3220 /usr/bin/chattr guuid=9cdcbc8d-1600-0000-beaa-3cfb500c0000 pid=3152->guuid=f649ec99-1600-0000-beaa-3cfb940c0000 pid=3220 execve guuid=71ad309a-1600-0000-beaa-3cfb960c0000 pid=3222 /usr/bin/chattr guuid=9cdcbc8d-1600-0000-beaa-3cfb500c0000 pid=3152->guuid=71ad309a-1600-0000-beaa-3cfb960c0000 pid=3222 execve guuid=4cb3769a-1600-0000-beaa-3cfb980c0000 pid=3224 /usr/bin/chattr guuid=9cdcbc8d-1600-0000-beaa-3cfb500c0000 pid=3152->guuid=4cb3769a-1600-0000-beaa-3cfb980c0000 pid=3224 execve guuid=cf59b89a-1600-0000-beaa-3cfb9a0c0000 pid=3226 /usr/bin/chattr guuid=9cdcbc8d-1600-0000-beaa-3cfb500c0000 pid=3152->guuid=cf59b89a-1600-0000-beaa-3cfb9a0c0000 pid=3226 execve guuid=c894f99a-1600-0000-beaa-3cfb9c0c0000 pid=3228 /usr/bin/bash guuid=9cdcbc8d-1600-0000-beaa-3cfb500c0000 pid=3152->guuid=c894f99a-1600-0000-beaa-3cfb9c0c0000 pid=3228 clone guuid=40b2ff9a-1600-0000-beaa-3cfb9d0c0000 pid=3229 /usr/bin/bash guuid=9cdcbc8d-1600-0000-beaa-3cfb500c0000 pid=3152->guuid=40b2ff9a-1600-0000-beaa-3cfb9d0c0000 pid=3229 clone guuid=f2784d9b-1600-0000-beaa-3cfb9f0c0000 pid=3231 /usr/bin/curl net send-data guuid=9cdcbc8d-1600-0000-beaa-3cfb500c0000 pid=3152->guuid=f2784d9b-1600-0000-beaa-3cfb9f0c0000 pid=3231 execve guuid=79f1519b-1600-0000-beaa-3cfba00c0000 pid=3232 /usr/bin/dash guuid=9cdcbc8d-1600-0000-beaa-3cfb500c0000 pid=3152->guuid=79f1519b-1600-0000-beaa-3cfba00c0000 pid=3232 execve guuid=c6c6b6a3-1600-0000-beaa-3cfbb20c0000 pid=3250 /usr/bin/bash guuid=9cdcbc8d-1600-0000-beaa-3cfb500c0000 pid=3152->guuid=c6c6b6a3-1600-0000-beaa-3cfbb20c0000 pid=3250 clone guuid=67dbc5a3-1600-0000-beaa-3cfbb30c0000 pid=3251 /usr/bin/base64 guuid=9cdcbc8d-1600-0000-beaa-3cfb500c0000 pid=3152->guuid=67dbc5a3-1600-0000-beaa-3cfbb30c0000 pid=3251 execve guuid=7cdfd0a3-1600-0000-beaa-3cfbb40c0000 pid=3252 /usr/bin/tee write-file guuid=9cdcbc8d-1600-0000-beaa-3cfb500c0000 pid=3152->guuid=7cdfd0a3-1600-0000-beaa-3cfbb40c0000 pid=3252 execve guuid=28e56ca4-1600-0000-beaa-3cfbb50c0000 pid=3253 /usr/bin/bash guuid=9cdcbc8d-1600-0000-beaa-3cfb500c0000 pid=3152->guuid=28e56ca4-1600-0000-beaa-3cfbb50c0000 pid=3253 execve guuid=2195b6ac-1600-0000-beaa-3cfbca0c0000 pid=3274 /usr/bin/bash guuid=9cdcbc8d-1600-0000-beaa-3cfb500c0000 pid=3152->guuid=2195b6ac-1600-0000-beaa-3cfbca0c0000 pid=3274 execve guuid=dac225ad-1600-0000-beaa-3cfbcd0c0000 pid=3277 /usr/bin/rm delete-file guuid=9cdcbc8d-1600-0000-beaa-3cfb500c0000 pid=3152->guuid=dac225ad-1600-0000-beaa-3cfbcd0c0000 pid=3277 execve guuid=52f376ad-1600-0000-beaa-3cfbcf0c0000 pid=3279 /usr/bin/rm guuid=9cdcbc8d-1600-0000-beaa-3cfb500c0000 pid=3152->guuid=52f376ad-1600-0000-beaa-3cfbcf0c0000 pid=3279 execve guuid=3173bdad-1600-0000-beaa-3cfbd10c0000 pid=3281 /usr/bin/curl net send-data guuid=9cdcbc8d-1600-0000-beaa-3cfb500c0000 pid=3152->guuid=3173bdad-1600-0000-beaa-3cfbd10c0000 pid=3281 execve guuid=484ec3ad-1600-0000-beaa-3cfbd20c0000 pid=3282 /usr/bin/dash guuid=9cdcbc8d-1600-0000-beaa-3cfb500c0000 pid=3152->guuid=484ec3ad-1600-0000-beaa-3cfbd20c0000 pid=3282 execve 124ee36c-bdbd-5d46-bbb1-b2cd81367f04 160.119.69.4:80 guuid=f2784d9b-1600-0000-beaa-3cfb9f0c0000 pid=3231->124ee36c-bdbd-5d46-bbb1-b2cd81367f04 send: 93B guuid=f03efba4-1600-0000-beaa-3cfbb60c0000 pid=3254 /usr/bin/bash guuid=28e56ca4-1600-0000-beaa-3cfbb50c0000 pid=3253->guuid=f03efba4-1600-0000-beaa-3cfbb60c0000 pid=3254 clone guuid=ab2004a5-1600-0000-beaa-3cfbb70c0000 pid=3255 /usr/bin/bash guuid=28e56ca4-1600-0000-beaa-3cfbb50c0000 pid=3253->guuid=ab2004a5-1600-0000-beaa-3cfbb70c0000 pid=3255 clone guuid=29632ca5-1600-0000-beaa-3cfbb80c0000 pid=3256 /usr/bin/ls guuid=28e56ca4-1600-0000-beaa-3cfbb50c0000 pid=3253->guuid=29632ca5-1600-0000-beaa-3cfbb80c0000 pid=3256 execve guuid=d7f2e5a5-1600-0000-beaa-3cfbb90c0000 pid=3257 /usr/bin/cat guuid=28e56ca4-1600-0000-beaa-3cfbb50c0000 pid=3253->guuid=d7f2e5a5-1600-0000-beaa-3cfbb90c0000 pid=3257 execve guuid=13fc5fa6-1600-0000-beaa-3cfbba0c0000 pid=3258 /usr/bin/ls guuid=28e56ca4-1600-0000-beaa-3cfbb50c0000 pid=3253->guuid=13fc5fa6-1600-0000-beaa-3cfbba0c0000 pid=3258 execve guuid=10151da7-1600-0000-beaa-3cfbbb0c0000 pid=3259 /usr/bin/mkdir guuid=28e56ca4-1600-0000-beaa-3cfbb50c0000 pid=3253->guuid=10151da7-1600-0000-beaa-3cfbbb0c0000 pid=3259 execve guuid=eb3ea5a7-1600-0000-beaa-3cfbbc0c0000 pid=3260 /usr/bin/mv guuid=28e56ca4-1600-0000-beaa-3cfbb50c0000 pid=3253->guuid=eb3ea5a7-1600-0000-beaa-3cfbbc0c0000 pid=3260 execve guuid=446e49a8-1600-0000-beaa-3cfbbd0c0000 pid=3261 /usr/bin/bash guuid=28e56ca4-1600-0000-beaa-3cfbb50c0000 pid=3253->guuid=446e49a8-1600-0000-beaa-3cfbbd0c0000 pid=3261 clone guuid=bd815da8-1600-0000-beaa-3cfbbe0c0000 pid=3262 /usr/bin/base64 write-file guuid=28e56ca4-1600-0000-beaa-3cfbb50c0000 pid=3253->guuid=bd815da8-1600-0000-beaa-3cfbbe0c0000 pid=3262 execve guuid=06930ea9-1600-0000-beaa-3cfbbf0c0000 pid=3263 /usr/bin/rm delete-file guuid=28e56ca4-1600-0000-beaa-3cfbb50c0000 pid=3253->guuid=06930ea9-1600-0000-beaa-3cfbbf0c0000 pid=3263 execve guuid=9e716aa9-1600-0000-beaa-3cfbc00c0000 pid=3264 /usr/bin/mv guuid=28e56ca4-1600-0000-beaa-3cfbb50c0000 pid=3253->guuid=9e716aa9-1600-0000-beaa-3cfbc00c0000 pid=3264 execve guuid=cf0ce9a9-1600-0000-beaa-3cfbc10c0000 pid=3265 /usr/bin/ls guuid=28e56ca4-1600-0000-beaa-3cfbb50c0000 pid=3253->guuid=cf0ce9a9-1600-0000-beaa-3cfbc10c0000 pid=3265 execve guuid=30606eaa-1600-0000-beaa-3cfbc20c0000 pid=3266 /usr/bin/bash guuid=28e56ca4-1600-0000-beaa-3cfbb50c0000 pid=3253->guuid=30606eaa-1600-0000-beaa-3cfbc20c0000 pid=3266 clone guuid=268776aa-1600-0000-beaa-3cfbc30c0000 pid=3267 /usr/bin/base64 write-file guuid=28e56ca4-1600-0000-beaa-3cfbb50c0000 pid=3253->guuid=268776aa-1600-0000-beaa-3cfbc30c0000 pid=3267 execve guuid=03ab51ab-1600-0000-beaa-3cfbc50c0000 pid=3269 /usr/bin/ls guuid=28e56ca4-1600-0000-beaa-3cfbb50c0000 pid=3253->guuid=03ab51ab-1600-0000-beaa-3cfbc50c0000 pid=3269 execve guuid=503bc8ab-1600-0000-beaa-3cfbc60c0000 pid=3270 /usr/bin/cat guuid=28e56ca4-1600-0000-beaa-3cfbb50c0000 pid=3253->guuid=503bc8ab-1600-0000-beaa-3cfbc60c0000 pid=3270 execve guuid=3cc518ac-1600-0000-beaa-3cfbc70c0000 pid=3271 /usr/bin/ls guuid=28e56ca4-1600-0000-beaa-3cfbb50c0000 pid=3253->guuid=3cc518ac-1600-0000-beaa-3cfbc70c0000 pid=3271 execve guuid=3173bdad-1600-0000-beaa-3cfbd10c0000 pid=3281->124ee36c-bdbd-5d46-bbb1-b2cd81367f04 send: 93B
Score:
82%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/4df4bad80eb6db91b138f9852b9c2cbf42daf7637e9e5e9a9e7ab9000e1bf5c6
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/4df4bad80eb6db91b138f9852b9c2cbf42daf7637e9e5e9a9e7ab9000e1bf5c6/
Threat name:
Linux.Backdoor.WebShell
Create hunting rule
Status:
Malicious
First seen:
2026-09-01 09:46:18 UTC
File Type:
Text (Shell)
AV detection:
12 of 24 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=jx2lvwaow3nzdmjy7gcsxhbmx5bnv53dp2pf5gu6pk4qadq36xda._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260901-lrqt5sweqg/
Behaviour
Reads runtime system information
Writes file to tmp directory
Deobfuscate/Decode Files or Information
Checks CPU configuration
File and Directory Permissions Modification
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.16
Link:
https://yomi.yoroi.company/submissions/4df4bad80eb6db91b138f9852b9c2cbf42daf7637e9e5e9a9e7ab9000e1bf5c6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SUSP_LNX_Base64_Exec_Apr24
Create hunting rule
Author:Christian Burkard
Description:Detects suspicious base64 encoded shell commands (as seen in Palo Alto CVE-2024-3400 exploitation)
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 4df4bad80eb6db91b138f9852b9c2cbf42daf7637e9e5e9a9e7ab9000e1bf5c6

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3884408/
  
Delivery method
Distributed via web download

Comments