🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 59d42ff1cad50cd84342e6ce6beb2896e63d36971b83bc42817bb227db04260f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 59d42ff1cad50cd84342e6ce6beb2896e63d36971b83bc42817bb227db04260f
SHA3-384 hash: 2f12de7a1363cc20d1abdd0aee455b81a7e9004c18ff9103c2a0a820d75f68aa8e05f826ca8d277f831d733c2718c394
SHA1 hash: 7f85fedcc2cb02206b4b35340014685a43997013
MD5 hash: 4d5a6ee922591d3cee3cf461bd03b915
humanhash: neptune-blossom-burger-network
File name:wr.php
Download: download sample
File size:27'042 bytes
First seen:2026-08-14 23:26:18 UTC
Last seen:2026-08-15 05:20:32 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 768:S8vCB+25j6es8Rwv9FYpMSUpi+20qUpi+20YQX:S8l25JCd2QX
TLSH T112C28D956A967C44BEC98A3E4CBD2B0D6DF5C3D1324942AC3D8B3C719C11FACD618B1A
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://160.119.69.4/z/post/noroot.phpn/an/aelf ua-wget

Intelligence

File Origin
# of uploads :
2
# of downloads :
80
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.DownLoader.2862.19878.20603.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive masquerade
Link:
https://www.filescan.io/uploads/6a7fa428cc7d04a12a915906/reports/17c50479-7da3-433b-b5e2-9fb232dc1392/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-08-14T21:38:00Z UTC
Last seen:
2026-08-14T22:14:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/59d42ff1cad50cd84342e6ce6beb2896e63d36971b83bc42817bb227db04260f/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/ef3b655f-3606-4ebe-a440-b9bf9a57027d
Behavior Graph:
Download SVG
%3 guuid=51d30c95-1600-0000-3306-4c91f10c0000 pid=3313 /usr/bin/sudo guuid=9d218d96-1600-0000-3306-4c91f90c0000 pid=3321 /tmp/sample.bin guuid=51d30c95-1600-0000-3306-4c91f10c0000 pid=3313->guuid=9d218d96-1600-0000-3306-4c91f90c0000 pid=3321 execve guuid=4f1c3697-1600-0000-3306-4c91fc0c0000 pid=3324 /usr/bin/bash guuid=9d218d96-1600-0000-3306-4c91f90c0000 pid=3321->guuid=4f1c3697-1600-0000-3306-4c91fc0c0000 pid=3324 clone guuid=6df44197-1600-0000-3306-4c91fd0c0000 pid=3325 /usr/bin/base64 guuid=9d218d96-1600-0000-3306-4c91f90c0000 pid=3321->guuid=6df44197-1600-0000-3306-4c91fd0c0000 pid=3325 execve guuid=ddc05197-1600-0000-3306-4c91fe0c0000 pid=3326 /usr/bin/bash guuid=9d218d96-1600-0000-3306-4c91f90c0000 pid=3321->guuid=ddc05197-1600-0000-3306-4c91fe0c0000 pid=3326 clone guuid=50ace897-1600-0000-3306-4c91010d0000 pid=3329 /usr/bin/cp guuid=9d218d96-1600-0000-3306-4c91f90c0000 pid=3321->guuid=50ace897-1600-0000-3306-4c91010d0000 pid=3329 execve guuid=86365e98-1600-0000-3306-4c91040d0000 pid=3332 /usr/bin/mkdir guuid=9d218d96-1600-0000-3306-4c91f90c0000 pid=3321->guuid=86365e98-1600-0000-3306-4c91040d0000 pid=3332 execve guuid=9a93b398-1600-0000-3306-4c91060d0000 pid=3334 /usr/bin/mkdir guuid=9d218d96-1600-0000-3306-4c91f90c0000 pid=3321->guuid=9a93b398-1600-0000-3306-4c91060d0000 pid=3334 execve guuid=93a60399-1600-0000-3306-4c91080d0000 pid=3336 /usr/bin/mkdir guuid=9d218d96-1600-0000-3306-4c91f90c0000 pid=3321->guuid=93a60399-1600-0000-3306-4c91080d0000 pid=3336 execve guuid=df575599-1600-0000-3306-4c910a0d0000 pid=3338 /usr/bin/mkdir guuid=9d218d96-1600-0000-3306-4c91f90c0000 pid=3321->guuid=df575599-1600-0000-3306-4c910a0d0000 pid=3338 execve guuid=5f1dbb99-1600-0000-3306-4c910c0d0000 pid=3340 /usr/bin/mkdir guuid=9d218d96-1600-0000-3306-4c91f90c0000 pid=3321->guuid=5f1dbb99-1600-0000-3306-4c910c0d0000 pid=3340 execve guuid=cf681e9a-1600-0000-3306-4c910e0d0000 pid=3342 /usr/bin/mkdir guuid=9d218d96-1600-0000-3306-4c91f90c0000 pid=3321->guuid=cf681e9a-1600-0000-3306-4c910e0d0000 pid=3342 execve guuid=ec4e819a-1600-0000-3306-4c91110d0000 pid=3345 /usr/bin/mkdir guuid=9d218d96-1600-0000-3306-4c91f90c0000 pid=3321->guuid=ec4e819a-1600-0000-3306-4c91110d0000 pid=3345 execve guuid=6473e39a-1600-0000-3306-4c91140d0000 pid=3348 /usr/bin/mkdir guuid=9d218d96-1600-0000-3306-4c91f90c0000 pid=3321->guuid=6473e39a-1600-0000-3306-4c91140d0000 pid=3348 execve guuid=456d2e9b-1600-0000-3306-4c91160d0000 pid=3350 /usr/bin/mkdir guuid=9d218d96-1600-0000-3306-4c91f90c0000 pid=3321->guuid=456d2e9b-1600-0000-3306-4c91160d0000 pid=3350 execve guuid=fbe5749b-1600-0000-3306-4c91180d0000 pid=3352 /usr/bin/cp guuid=9d218d96-1600-0000-3306-4c91f90c0000 pid=3321->guuid=fbe5749b-1600-0000-3306-4c91180d0000 pid=3352 execve guuid=7de5d19b-1600-0000-3306-4c911b0d0000 pid=3355 /usr/bin/cp guuid=9d218d96-1600-0000-3306-4c91f90c0000 pid=3321->guuid=7de5d19b-1600-0000-3306-4c911b0d0000 pid=3355 execve guuid=7b41339c-1600-0000-3306-4c911d0d0000 pid=3357 /usr/bin/cp guuid=9d218d96-1600-0000-3306-4c91f90c0000 pid=3321->guuid=7b41339c-1600-0000-3306-4c911d0d0000 pid=3357 execve guuid=6349949c-1600-0000-3306-4c91200d0000 pid=3360 /usr/bin/cp guuid=9d218d96-1600-0000-3306-4c91f90c0000 pid=3321->guuid=6349949c-1600-0000-3306-4c91200d0000 pid=3360 execve guuid=4ec5f09c-1600-0000-3306-4c91220d0000 pid=3362 /usr/bin/cp guuid=9d218d96-1600-0000-3306-4c91f90c0000 pid=3321->guuid=4ec5f09c-1600-0000-3306-4c91220d0000 pid=3362 execve guuid=54a78a9d-1600-0000-3306-4c91250d0000 pid=3365 /usr/bin/cp guuid=9d218d96-1600-0000-3306-4c91f90c0000 pid=3321->guuid=54a78a9d-1600-0000-3306-4c91250d0000 pid=3365 execve guuid=61f7e49d-1600-0000-3306-4c91270d0000 pid=3367 /usr/bin/cp guuid=9d218d96-1600-0000-3306-4c91f90c0000 pid=3321->guuid=61f7e49d-1600-0000-3306-4c91270d0000 pid=3367 execve guuid=d7eb469e-1600-0000-3306-4c91290d0000 pid=3369 /usr/bin/cp guuid=9d218d96-1600-0000-3306-4c91f90c0000 pid=3321->guuid=d7eb469e-1600-0000-3306-4c91290d0000 pid=3369 execve guuid=526aa39e-1600-0000-3306-4c912b0d0000 pid=3371 /usr/bin/cp guuid=9d218d96-1600-0000-3306-4c91f90c0000 pid=3321->guuid=526aa39e-1600-0000-3306-4c912b0d0000 pid=3371 execve guuid=a125fe9e-1600-0000-3306-4c912d0d0000 pid=3373 /usr/bin/cp guuid=9d218d96-1600-0000-3306-4c91f90c0000 pid=3321->guuid=a125fe9e-1600-0000-3306-4c912d0d0000 pid=3373 execve guuid=36785b9f-1600-0000-3306-4c91300d0000 pid=3376 /usr/bin/cp guuid=9d218d96-1600-0000-3306-4c91f90c0000 pid=3321->guuid=36785b9f-1600-0000-3306-4c91300d0000 pid=3376 execve guuid=c87eb89f-1600-0000-3306-4c91320d0000 pid=3378 /usr/bin/cp guuid=9d218d96-1600-0000-3306-4c91f90c0000 pid=3321->guuid=c87eb89f-1600-0000-3306-4c91320d0000 pid=3378 execve guuid=768014a0-1600-0000-3306-4c91340d0000 pid=3380 /usr/bin/cp guuid=9d218d96-1600-0000-3306-4c91f90c0000 pid=3321->guuid=768014a0-1600-0000-3306-4c91340d0000 pid=3380 execve guuid=acdc70a0-1600-0000-3306-4c91360d0000 pid=3382 /usr/bin/cp guuid=9d218d96-1600-0000-3306-4c91f90c0000 pid=3321->guuid=acdc70a0-1600-0000-3306-4c91360d0000 pid=3382 execve guuid=89fad0a0-1600-0000-3306-4c91390d0000 pid=3385 /usr/bin/touch guuid=9d218d96-1600-0000-3306-4c91f90c0000 pid=3321->guuid=89fad0a0-1600-0000-3306-4c91390d0000 pid=3385 execve guuid=7bcd1aa1-1600-0000-3306-4c913b0d0000 pid=3387 /usr/bin/chmod guuid=9d218d96-1600-0000-3306-4c91f90c0000 pid=3321->guuid=7bcd1aa1-1600-0000-3306-4c913b0d0000 pid=3387 execve guuid=4fc052a1-1600-0000-3306-4c913d0d0000 pid=3389 /usr/bin/chmod guuid=9d218d96-1600-0000-3306-4c91f90c0000 pid=3321->guuid=4fc052a1-1600-0000-3306-4c913d0d0000 pid=3389 execve guuid=ad5a90a1-1600-0000-3306-4c913f0d0000 pid=3391 /usr/bin/chattr guuid=9d218d96-1600-0000-3306-4c91f90c0000 pid=3321->guuid=ad5a90a1-1600-0000-3306-4c913f0d0000 pid=3391 execve guuid=d276f3a1-1600-0000-3306-4c91420d0000 pid=3394 /usr/bin/chattr guuid=9d218d96-1600-0000-3306-4c91f90c0000 pid=3321->guuid=d276f3a1-1600-0000-3306-4c91420d0000 pid=3394 execve guuid=089135a2-1600-0000-3306-4c91440d0000 pid=3396 /usr/bin/chattr guuid=9d218d96-1600-0000-3306-4c91f90c0000 pid=3321->guuid=089135a2-1600-0000-3306-4c91440d0000 pid=3396 execve guuid=97aa72a2-1600-0000-3306-4c91460d0000 pid=3398 /usr/bin/chattr guuid=9d218d96-1600-0000-3306-4c91f90c0000 pid=3321->guuid=97aa72a2-1600-0000-3306-4c91460d0000 pid=3398 execve guuid=c979b1a2-1600-0000-3306-4c91480d0000 pid=3400 /usr/bin/chattr guuid=9d218d96-1600-0000-3306-4c91f90c0000 pid=3321->guuid=c979b1a2-1600-0000-3306-4c91480d0000 pid=3400 execve guuid=64f1eda2-1600-0000-3306-4c914c0d0000 pid=3404 /usr/bin/chattr guuid=9d218d96-1600-0000-3306-4c91f90c0000 pid=3321->guuid=64f1eda2-1600-0000-3306-4c914c0d0000 pid=3404 execve guuid=27e52ba3-1600-0000-3306-4c914d0d0000 pid=3405 /usr/bin/chattr guuid=9d218d96-1600-0000-3306-4c91f90c0000 pid=3321->guuid=27e52ba3-1600-0000-3306-4c914d0d0000 pid=3405 execve guuid=81ba68a3-1600-0000-3306-4c914e0d0000 pid=3406 /usr/bin/chattr guuid=9d218d96-1600-0000-3306-4c91f90c0000 pid=3321->guuid=81ba68a3-1600-0000-3306-4c914e0d0000 pid=3406 execve guuid=f955a7a3-1600-0000-3306-4c914f0d0000 pid=3407 /usr/bin/bash guuid=9d218d96-1600-0000-3306-4c91f90c0000 pid=3321->guuid=f955a7a3-1600-0000-3306-4c914f0d0000 pid=3407 clone guuid=d0e7aba3-1600-0000-3306-4c91500d0000 pid=3408 /usr/bin/bash guuid=9d218d96-1600-0000-3306-4c91f90c0000 pid=3321->guuid=d0e7aba3-1600-0000-3306-4c91500d0000 pid=3408 clone guuid=6f44eaa3-1600-0000-3306-4c91510d0000 pid=3409 /usr/bin/curl net send-data guuid=9d218d96-1600-0000-3306-4c91f90c0000 pid=3321->guuid=6f44eaa3-1600-0000-3306-4c91510d0000 pid=3409 execve guuid=1be1eea3-1600-0000-3306-4c91520d0000 pid=3410 /usr/bin/dash guuid=9d218d96-1600-0000-3306-4c91f90c0000 pid=3321->guuid=1be1eea3-1600-0000-3306-4c91520d0000 pid=3410 execve guuid=010043ce-1600-0000-3306-4c91a30d0000 pid=3491 /usr/bin/bash guuid=9d218d96-1600-0000-3306-4c91f90c0000 pid=3321->guuid=010043ce-1600-0000-3306-4c91a30d0000 pid=3491 clone guuid=377e4bce-1600-0000-3306-4c91a40d0000 pid=3492 /usr/bin/base64 guuid=9d218d96-1600-0000-3306-4c91f90c0000 pid=3321->guuid=377e4bce-1600-0000-3306-4c91a40d0000 pid=3492 execve guuid=a1ee53ce-1600-0000-3306-4c91a50d0000 pid=3493 /usr/bin/tee write-file guuid=9d218d96-1600-0000-3306-4c91f90c0000 pid=3321->guuid=a1ee53ce-1600-0000-3306-4c91a50d0000 pid=3493 execve guuid=d0bf4ccf-1600-0000-3306-4c91a90d0000 pid=3497 /usr/bin/bash guuid=9d218d96-1600-0000-3306-4c91f90c0000 pid=3321->guuid=d0bf4ccf-1600-0000-3306-4c91a90d0000 pid=3497 execve guuid=4f5d2bd4-1600-0000-3306-4c91cd0d0000 pid=3533 /usr/bin/bash guuid=9d218d96-1600-0000-3306-4c91f90c0000 pid=3321->guuid=4f5d2bd4-1600-0000-3306-4c91cd0d0000 pid=3533 execve guuid=90f477d4-1600-0000-3306-4c91cf0d0000 pid=3535 /usr/bin/rm delete-file guuid=9d218d96-1600-0000-3306-4c91f90c0000 pid=3321->guuid=90f477d4-1600-0000-3306-4c91cf0d0000 pid=3535 execve guuid=4ef8b0d4-1600-0000-3306-4c91d10d0000 pid=3537 /usr/bin/rm guuid=9d218d96-1600-0000-3306-4c91f90c0000 pid=3321->guuid=4ef8b0d4-1600-0000-3306-4c91d10d0000 pid=3537 execve guuid=2d3fe8d4-1600-0000-3306-4c91d30d0000 pid=3539 /usr/bin/curl net send-data guuid=9d218d96-1600-0000-3306-4c91f90c0000 pid=3321->guuid=2d3fe8d4-1600-0000-3306-4c91d30d0000 pid=3539 execve guuid=93dbedd4-1600-0000-3306-4c91d40d0000 pid=3540 /usr/bin/dash guuid=9d218d96-1600-0000-3306-4c91f90c0000 pid=3321->guuid=93dbedd4-1600-0000-3306-4c91d40d0000 pid=3540 execve 124ee36c-bdbd-5d46-bbb1-b2cd81367f04 160.119.69.4:80 guuid=6f44eaa3-1600-0000-3306-4c91510d0000 pid=3409->124ee36c-bdbd-5d46-bbb1-b2cd81367f04 send: 93B guuid=3a94adcf-1600-0000-3306-4c91ab0d0000 pid=3499 /usr/bin/bash guuid=d0bf4ccf-1600-0000-3306-4c91a90d0000 pid=3497->guuid=3a94adcf-1600-0000-3306-4c91ab0d0000 pid=3499 clone guuid=97f4b3cf-1600-0000-3306-4c91ac0d0000 pid=3500 /usr/bin/bash guuid=d0bf4ccf-1600-0000-3306-4c91a90d0000 pid=3497->guuid=97f4b3cf-1600-0000-3306-4c91ac0d0000 pid=3500 clone guuid=b549decf-1600-0000-3306-4c91ae0d0000 pid=3502 /usr/bin/ls guuid=d0bf4ccf-1600-0000-3306-4c91a90d0000 pid=3497->guuid=b549decf-1600-0000-3306-4c91ae0d0000 pid=3502 execve guuid=f43a53d0-1600-0000-3306-4c91b00d0000 pid=3504 /usr/bin/cat guuid=d0bf4ccf-1600-0000-3306-4c91a90d0000 pid=3497->guuid=f43a53d0-1600-0000-3306-4c91b00d0000 pid=3504 execve guuid=893897d0-1600-0000-3306-4c91b20d0000 pid=3506 /usr/bin/ls guuid=d0bf4ccf-1600-0000-3306-4c91a90d0000 pid=3497->guuid=893897d0-1600-0000-3306-4c91b20d0000 pid=3506 execve guuid=3dacf1d0-1600-0000-3306-4c91b50d0000 pid=3509 /usr/bin/mkdir guuid=d0bf4ccf-1600-0000-3306-4c91a90d0000 pid=3497->guuid=3dacf1d0-1600-0000-3306-4c91b50d0000 pid=3509 execve guuid=068b34d1-1600-0000-3306-4c91b70d0000 pid=3511 /usr/bin/mv guuid=d0bf4ccf-1600-0000-3306-4c91a90d0000 pid=3497->guuid=068b34d1-1600-0000-3306-4c91b70d0000 pid=3511 execve guuid=62008ad1-1600-0000-3306-4c91b90d0000 pid=3513 /usr/bin/bash guuid=d0bf4ccf-1600-0000-3306-4c91a90d0000 pid=3497->guuid=62008ad1-1600-0000-3306-4c91b90d0000 pid=3513 clone guuid=859a8ed1-1600-0000-3306-4c91ba0d0000 pid=3514 /usr/bin/base64 write-file guuid=d0bf4ccf-1600-0000-3306-4c91a90d0000 pid=3497->guuid=859a8ed1-1600-0000-3306-4c91ba0d0000 pid=3514 execve guuid=ed9cdad1-1600-0000-3306-4c91bc0d0000 pid=3516 /usr/bin/rm delete-file guuid=d0bf4ccf-1600-0000-3306-4c91a90d0000 pid=3497->guuid=ed9cdad1-1600-0000-3306-4c91bc0d0000 pid=3516 execve guuid=779e1bd2-1600-0000-3306-4c91be0d0000 pid=3518 /usr/bin/mv guuid=d0bf4ccf-1600-0000-3306-4c91a90d0000 pid=3497->guuid=779e1bd2-1600-0000-3306-4c91be0d0000 pid=3518 execve guuid=dd5e7ad2-1600-0000-3306-4c91c00d0000 pid=3520 /usr/bin/ls guuid=d0bf4ccf-1600-0000-3306-4c91a90d0000 pid=3497->guuid=dd5e7ad2-1600-0000-3306-4c91c00d0000 pid=3520 execve guuid=202cd3d2-1600-0000-3306-4c91c30d0000 pid=3523 /usr/bin/bash guuid=d0bf4ccf-1600-0000-3306-4c91a90d0000 pid=3497->guuid=202cd3d2-1600-0000-3306-4c91c30d0000 pid=3523 clone guuid=22e9d8d2-1600-0000-3306-4c91c40d0000 pid=3524 /usr/bin/base64 write-file guuid=d0bf4ccf-1600-0000-3306-4c91a90d0000 pid=3497->guuid=22e9d8d2-1600-0000-3306-4c91c40d0000 pid=3524 execve guuid=00b024d3-1600-0000-3306-4c91c50d0000 pid=3525 /usr/bin/ls guuid=d0bf4ccf-1600-0000-3306-4c91a90d0000 pid=3497->guuid=00b024d3-1600-0000-3306-4c91c50d0000 pid=3525 execve guuid=0b227ed3-1600-0000-3306-4c91c80d0000 pid=3528 /usr/bin/cat guuid=d0bf4ccf-1600-0000-3306-4c91a90d0000 pid=3497->guuid=0b227ed3-1600-0000-3306-4c91c80d0000 pid=3528 execve guuid=37efbfd3-1600-0000-3306-4c91ca0d0000 pid=3530 /usr/bin/ls guuid=d0bf4ccf-1600-0000-3306-4c91a90d0000 pid=3497->guuid=37efbfd3-1600-0000-3306-4c91ca0d0000 pid=3530 execve guuid=2d3fe8d4-1600-0000-3306-4c91d30d0000 pid=3539->124ee36c-bdbd-5d46-bbb1-b2cd81367f04 send: 93B
Score:
81%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/59d42ff1cad50cd84342e6ce6beb2896e63d36971b83bc42817bb227db04260f
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/59d42ff1cad50cd84342e6ce6beb2896e63d36971b83bc42817bb227db04260f/
Threat name:
Linux.Backdoor.WebShell
Create hunting rule
Status:
Malicious
First seen:
2026-08-14 23:27:26 UTC
File Type:
Text (Shell)
AV detection:
12 of 24 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=lhkc74ok2ugnqq2c43hgx2zis3td2nuxdob3yqubpozcpwyeeyhq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260814-3e3fvatfkg/
Behaviour
Reads runtime system information
Writes file to tmp directory
Deobfuscate/Decode Files or Information
Checks CPU configuration
File and Directory Permissions Modification
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.16
Link:
https://yomi.yoroi.company/submissions/59d42ff1cad50cd84342e6ce6beb2896e63d36971b83bc42817bb227db04260f

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SUSP_LNX_Base64_Exec_Apr24
Create hunting rule
Author:Christian Burkard
Description:Detects suspicious base64 encoded shell commands (as seen in Palo Alto CVE-2024-3400 exploitation)
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 59d42ff1cad50cd84342e6ce6beb2896e63d36971b83bc42817bb227db04260f

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3884408/
  
Delivery method
Distributed via web download

Comments