MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 62301a83ed74f7ca070cd9b4b2809f5d80e521eaeef6d3fe19b5064a587149fc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry



Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash: 62301a83ed74f7ca070cd9b4b2809f5d80e521eaeef6d3fe19b5064a587149fc
SHA3-384 hash: 48f8a6a612995c29a0c3b937ad6905e043fd606ac114ecd5f086726ef7d37465b18a1d9cd0c33313300a2823cc70967e
SHA1 hash: 6999a6dce32b54ecf70eb4aee4e0b5686049a368
MD5 hash: 006deccde3c06f8378457f554d029eeb
humanhash: kansas-music-nine-london
File name:wr.php
Download: download sample
File size:27'042 bytes
First seen:2026-07-18 06:24:13 UTC
Last seen:2026-07-18 20:35:38 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 768:m8vCB+25j6es8R39FYpMSUpi+20qUpi+20YQX:m8l25JRd2QX
TLSH T172C27D966A867C44BDC98A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11FACD618B1A
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://160.119.69.4/z/post/noroot.phpn/an/aelf ua-wget

Intelligence


File Origin
# of uploads :
2
# of downloads :
74
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive masquerade
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-07-18T05:00:00Z UTC
Last seen:
2026-07-18T05:07:00Z UTC
Hits:
~10
Status:
terminated
Behavior Graph:
%3 guuid=459e6e31-1700-0000-46d8-42c5350c0000 pid=3125 /usr/bin/sudo guuid=706f5635-1700-0000-46d8-42c5360c0000 pid=3126 /tmp/sample.bin guuid=459e6e31-1700-0000-46d8-42c5350c0000 pid=3125->guuid=706f5635-1700-0000-46d8-42c5360c0000 pid=3126 execve guuid=1ef21f36-1700-0000-46d8-42c5370c0000 pid=3127 /usr/bin/bash guuid=706f5635-1700-0000-46d8-42c5360c0000 pid=3126->guuid=1ef21f36-1700-0000-46d8-42c5370c0000 pid=3127 clone guuid=fe6f2f36-1700-0000-46d8-42c5380c0000 pid=3128 /usr/bin/base64 guuid=706f5635-1700-0000-46d8-42c5360c0000 pid=3126->guuid=fe6f2f36-1700-0000-46d8-42c5380c0000 pid=3128 execve guuid=18bc3c36-1700-0000-46d8-42c5390c0000 pid=3129 /usr/bin/bash guuid=706f5635-1700-0000-46d8-42c5360c0000 pid=3126->guuid=18bc3c36-1700-0000-46d8-42c5390c0000 pid=3129 clone guuid=432be837-1700-0000-46d8-42c53a0c0000 pid=3130 /usr/bin/cp guuid=706f5635-1700-0000-46d8-42c5360c0000 pid=3126->guuid=432be837-1700-0000-46d8-42c53a0c0000 pid=3130 execve guuid=24959438-1700-0000-46d8-42c53b0c0000 pid=3131 /usr/bin/mkdir guuid=706f5635-1700-0000-46d8-42c5360c0000 pid=3126->guuid=24959438-1700-0000-46d8-42c53b0c0000 pid=3131 execve guuid=a77f5e39-1700-0000-46d8-42c53c0c0000 pid=3132 /usr/bin/mkdir guuid=706f5635-1700-0000-46d8-42c5360c0000 pid=3126->guuid=a77f5e39-1700-0000-46d8-42c53c0c0000 pid=3132 execve guuid=29a1203a-1700-0000-46d8-42c53d0c0000 pid=3133 /usr/bin/mkdir guuid=706f5635-1700-0000-46d8-42c5360c0000 pid=3126->guuid=29a1203a-1700-0000-46d8-42c53d0c0000 pid=3133 execve guuid=9c1bde3a-1700-0000-46d8-42c53e0c0000 pid=3134 /usr/bin/mkdir guuid=706f5635-1700-0000-46d8-42c5360c0000 pid=3126->guuid=9c1bde3a-1700-0000-46d8-42c53e0c0000 pid=3134 execve guuid=1ac9843c-1700-0000-46d8-42c53f0c0000 pid=3135 /usr/bin/mkdir guuid=706f5635-1700-0000-46d8-42c5360c0000 pid=3126->guuid=1ac9843c-1700-0000-46d8-42c53f0c0000 pid=3135 execve guuid=994cf33c-1700-0000-46d8-42c5410c0000 pid=3137 /usr/bin/mkdir guuid=706f5635-1700-0000-46d8-42c5360c0000 pid=3126->guuid=994cf33c-1700-0000-46d8-42c5410c0000 pid=3137 execve guuid=8c918d3d-1700-0000-46d8-42c5420c0000 pid=3138 /usr/bin/mkdir guuid=706f5635-1700-0000-46d8-42c5360c0000 pid=3126->guuid=8c918d3d-1700-0000-46d8-42c5420c0000 pid=3138 execve guuid=1e06113e-1700-0000-46d8-42c5430c0000 pid=3139 /usr/bin/mkdir guuid=706f5635-1700-0000-46d8-42c5360c0000 pid=3126->guuid=1e06113e-1700-0000-46d8-42c5430c0000 pid=3139 execve guuid=98d68a3e-1700-0000-46d8-42c5450c0000 pid=3141 /usr/bin/mkdir guuid=706f5635-1700-0000-46d8-42c5360c0000 pid=3126->guuid=98d68a3e-1700-0000-46d8-42c5450c0000 pid=3141 execve guuid=9af3003f-1700-0000-46d8-42c5470c0000 pid=3143 /usr/bin/cp guuid=706f5635-1700-0000-46d8-42c5360c0000 pid=3126->guuid=9af3003f-1700-0000-46d8-42c5470c0000 pid=3143 execve guuid=621e7e3f-1700-0000-46d8-42c5490c0000 pid=3145 /usr/bin/cp guuid=706f5635-1700-0000-46d8-42c5360c0000 pid=3126->guuid=621e7e3f-1700-0000-46d8-42c5490c0000 pid=3145 execve guuid=a5eaf73f-1700-0000-46d8-42c54c0c0000 pid=3148 /usr/bin/cp guuid=706f5635-1700-0000-46d8-42c5360c0000 pid=3126->guuid=a5eaf73f-1700-0000-46d8-42c54c0c0000 pid=3148 execve guuid=f7056d40-1700-0000-46d8-42c54e0c0000 pid=3150 /usr/bin/cp guuid=706f5635-1700-0000-46d8-42c5360c0000 pid=3126->guuid=f7056d40-1700-0000-46d8-42c54e0c0000 pid=3150 execve guuid=232ed940-1700-0000-46d8-42c5500c0000 pid=3152 /usr/bin/cp guuid=706f5635-1700-0000-46d8-42c5360c0000 pid=3126->guuid=232ed940-1700-0000-46d8-42c5500c0000 pid=3152 execve guuid=eeda9f41-1700-0000-46d8-42c5510c0000 pid=3153 /usr/bin/cp guuid=706f5635-1700-0000-46d8-42c5360c0000 pid=3126->guuid=eeda9f41-1700-0000-46d8-42c5510c0000 pid=3153 execve guuid=3ff70d42-1700-0000-46d8-42c5530c0000 pid=3155 /usr/bin/cp guuid=706f5635-1700-0000-46d8-42c5360c0000 pid=3126->guuid=3ff70d42-1700-0000-46d8-42c5530c0000 pid=3155 execve guuid=03e6a242-1700-0000-46d8-42c5560c0000 pid=3158 /usr/bin/cp guuid=706f5635-1700-0000-46d8-42c5360c0000 pid=3126->guuid=03e6a242-1700-0000-46d8-42c5560c0000 pid=3158 execve guuid=5b7af442-1700-0000-46d8-42c5590c0000 pid=3161 /usr/bin/cp guuid=706f5635-1700-0000-46d8-42c5360c0000 pid=3126->guuid=5b7af442-1700-0000-46d8-42c5590c0000 pid=3161 execve guuid=bc344f43-1700-0000-46d8-42c55a0c0000 pid=3162 /usr/bin/cp guuid=706f5635-1700-0000-46d8-42c5360c0000 pid=3126->guuid=bc344f43-1700-0000-46d8-42c55a0c0000 pid=3162 execve guuid=15c5ab43-1700-0000-46d8-42c55c0c0000 pid=3164 /usr/bin/cp guuid=706f5635-1700-0000-46d8-42c5360c0000 pid=3126->guuid=15c5ab43-1700-0000-46d8-42c55c0c0000 pid=3164 execve guuid=fa071d44-1700-0000-46d8-42c55d0c0000 pid=3165 /usr/bin/cp guuid=706f5635-1700-0000-46d8-42c5360c0000 pid=3126->guuid=fa071d44-1700-0000-46d8-42c55d0c0000 pid=3165 execve guuid=ce00c144-1700-0000-46d8-42c55e0c0000 pid=3166 /usr/bin/cp guuid=706f5635-1700-0000-46d8-42c5360c0000 pid=3126->guuid=ce00c144-1700-0000-46d8-42c55e0c0000 pid=3166 execve guuid=8eb73445-1700-0000-46d8-42c5600c0000 pid=3168 /usr/bin/cp guuid=706f5635-1700-0000-46d8-42c5360c0000 pid=3126->guuid=8eb73445-1700-0000-46d8-42c5600c0000 pid=3168 execve guuid=f76ccf45-1700-0000-46d8-42c5610c0000 pid=3169 /usr/bin/touch guuid=706f5635-1700-0000-46d8-42c5360c0000 pid=3126->guuid=f76ccf45-1700-0000-46d8-42c5610c0000 pid=3169 execve guuid=f4613746-1700-0000-46d8-42c5620c0000 pid=3170 /usr/bin/chmod guuid=706f5635-1700-0000-46d8-42c5360c0000 pid=3126->guuid=f4613746-1700-0000-46d8-42c5620c0000 pid=3170 execve guuid=2f77a546-1700-0000-46d8-42c5640c0000 pid=3172 /usr/bin/chmod guuid=706f5635-1700-0000-46d8-42c5360c0000 pid=3126->guuid=2f77a546-1700-0000-46d8-42c5640c0000 pid=3172 execve guuid=a7eff646-1700-0000-46d8-42c5660c0000 pid=3174 /usr/bin/chattr guuid=706f5635-1700-0000-46d8-42c5360c0000 pid=3126->guuid=a7eff646-1700-0000-46d8-42c5660c0000 pid=3174 execve guuid=a5265e47-1700-0000-46d8-42c5680c0000 pid=3176 /usr/bin/chattr guuid=706f5635-1700-0000-46d8-42c5360c0000 pid=3126->guuid=a5265e47-1700-0000-46d8-42c5680c0000 pid=3176 execve guuid=3bcaa947-1700-0000-46d8-42c56a0c0000 pid=3178 /usr/bin/chattr guuid=706f5635-1700-0000-46d8-42c5360c0000 pid=3126->guuid=3bcaa947-1700-0000-46d8-42c56a0c0000 pid=3178 execve guuid=00d7fb47-1700-0000-46d8-42c56d0c0000 pid=3181 /usr/bin/chattr guuid=706f5635-1700-0000-46d8-42c5360c0000 pid=3126->guuid=00d7fb47-1700-0000-46d8-42c56d0c0000 pid=3181 execve guuid=fa4d4748-1700-0000-46d8-42c56e0c0000 pid=3182 /usr/bin/chattr guuid=706f5635-1700-0000-46d8-42c5360c0000 pid=3126->guuid=fa4d4748-1700-0000-46d8-42c56e0c0000 pid=3182 execve guuid=b5eaaa48-1700-0000-46d8-42c56f0c0000 pid=3183 /usr/bin/chattr guuid=706f5635-1700-0000-46d8-42c5360c0000 pid=3126->guuid=b5eaaa48-1700-0000-46d8-42c56f0c0000 pid=3183 execve guuid=e1411849-1700-0000-46d8-42c5700c0000 pid=3184 /usr/bin/chattr guuid=706f5635-1700-0000-46d8-42c5360c0000 pid=3126->guuid=e1411849-1700-0000-46d8-42c5700c0000 pid=3184 execve guuid=988f8049-1700-0000-46d8-42c5710c0000 pid=3185 /usr/bin/chattr guuid=706f5635-1700-0000-46d8-42c5360c0000 pid=3126->guuid=988f8049-1700-0000-46d8-42c5710c0000 pid=3185 execve guuid=913fdb49-1700-0000-46d8-42c5720c0000 pid=3186 /usr/bin/bash guuid=706f5635-1700-0000-46d8-42c5360c0000 pid=3126->guuid=913fdb49-1700-0000-46d8-42c5720c0000 pid=3186 clone guuid=6438e349-1700-0000-46d8-42c5730c0000 pid=3187 /usr/bin/bash guuid=706f5635-1700-0000-46d8-42c5360c0000 pid=3126->guuid=6438e349-1700-0000-46d8-42c5730c0000 pid=3187 clone guuid=1ece004a-1700-0000-46d8-42c5740c0000 pid=3188 /usr/bin/curl net send-data guuid=706f5635-1700-0000-46d8-42c5360c0000 pid=3126->guuid=1ece004a-1700-0000-46d8-42c5740c0000 pid=3188 execve guuid=a693074a-1700-0000-46d8-42c5750c0000 pid=3189 /usr/bin/dash guuid=706f5635-1700-0000-46d8-42c5360c0000 pid=3126->guuid=a693074a-1700-0000-46d8-42c5750c0000 pid=3189 execve guuid=29da1a53-1700-0000-46d8-42c57e0c0000 pid=3198 /usr/bin/bash guuid=706f5635-1700-0000-46d8-42c5360c0000 pid=3126->guuid=29da1a53-1700-0000-46d8-42c57e0c0000 pid=3198 clone guuid=48d02253-1700-0000-46d8-42c5800c0000 pid=3200 /usr/bin/base64 guuid=706f5635-1700-0000-46d8-42c5360c0000 pid=3126->guuid=48d02253-1700-0000-46d8-42c5800c0000 pid=3200 execve guuid=f3ce2753-1700-0000-46d8-42c5810c0000 pid=3201 /usr/bin/tee write-file guuid=706f5635-1700-0000-46d8-42c5360c0000 pid=3126->guuid=f3ce2753-1700-0000-46d8-42c5810c0000 pid=3201 execve guuid=a2ceb053-1700-0000-46d8-42c5840c0000 pid=3204 /usr/bin/bash guuid=706f5635-1700-0000-46d8-42c5360c0000 pid=3126->guuid=a2ceb053-1700-0000-46d8-42c5840c0000 pid=3204 execve guuid=3e6f5259-1700-0000-46d8-42c5a00c0000 pid=3232 /usr/bin/bash guuid=706f5635-1700-0000-46d8-42c5360c0000 pid=3126->guuid=3e6f5259-1700-0000-46d8-42c5a00c0000 pid=3232 execve guuid=670d485a-1700-0000-46d8-42c5a10c0000 pid=3233 /usr/bin/rm delete-file guuid=706f5635-1700-0000-46d8-42c5360c0000 pid=3126->guuid=670d485a-1700-0000-46d8-42c5a10c0000 pid=3233 execve guuid=c839a55a-1700-0000-46d8-42c5a20c0000 pid=3234 /usr/bin/rm guuid=706f5635-1700-0000-46d8-42c5360c0000 pid=3126->guuid=c839a55a-1700-0000-46d8-42c5a20c0000 pid=3234 execve guuid=e543fb5a-1700-0000-46d8-42c5a30c0000 pid=3235 /usr/bin/curl net send-data guuid=706f5635-1700-0000-46d8-42c5360c0000 pid=3126->guuid=e543fb5a-1700-0000-46d8-42c5a30c0000 pid=3235 execve guuid=0555035b-1700-0000-46d8-42c5a40c0000 pid=3236 /usr/bin/dash guuid=706f5635-1700-0000-46d8-42c5360c0000 pid=3126->guuid=0555035b-1700-0000-46d8-42c5a40c0000 pid=3236 execve 124ee36c-bdbd-5d46-bbb1-b2cd81367f04 160.119.69.4:80 guuid=1ece004a-1700-0000-46d8-42c5740c0000 pid=3188->124ee36c-bdbd-5d46-bbb1-b2cd81367f04 send: 93B guuid=3491f953-1700-0000-46d8-42c5860c0000 pid=3206 /usr/bin/bash guuid=a2ceb053-1700-0000-46d8-42c5840c0000 pid=3204->guuid=3491f953-1700-0000-46d8-42c5860c0000 pid=3206 clone guuid=83fffe53-1700-0000-46d8-42c5870c0000 pid=3207 /usr/bin/bash guuid=a2ceb053-1700-0000-46d8-42c5840c0000 pid=3204->guuid=83fffe53-1700-0000-46d8-42c5870c0000 pid=3207 clone guuid=86421854-1700-0000-46d8-42c5880c0000 pid=3208 /usr/bin/ls guuid=a2ceb053-1700-0000-46d8-42c5840c0000 pid=3204->guuid=86421854-1700-0000-46d8-42c5880c0000 pid=3208 execve guuid=ed8c9c54-1700-0000-46d8-42c58a0c0000 pid=3210 /usr/bin/cat guuid=a2ceb053-1700-0000-46d8-42c5840c0000 pid=3204->guuid=ed8c9c54-1700-0000-46d8-42c58a0c0000 pid=3210 execve guuid=f535d854-1700-0000-46d8-42c58c0c0000 pid=3212 /usr/bin/ls guuid=a2ceb053-1700-0000-46d8-42c5840c0000 pid=3204->guuid=f535d854-1700-0000-46d8-42c58c0c0000 pid=3212 execve guuid=72b93655-1700-0000-46d8-42c58d0c0000 pid=3213 /usr/bin/mkdir guuid=a2ceb053-1700-0000-46d8-42c5840c0000 pid=3204->guuid=72b93655-1700-0000-46d8-42c58d0c0000 pid=3213 execve guuid=a4529155-1700-0000-46d8-42c58e0c0000 pid=3214 /usr/bin/mv guuid=a2ceb053-1700-0000-46d8-42c5840c0000 pid=3204->guuid=a4529155-1700-0000-46d8-42c58e0c0000 pid=3214 execve guuid=cdf2f455-1700-0000-46d8-42c5900c0000 pid=3216 /usr/bin/bash guuid=a2ceb053-1700-0000-46d8-42c5840c0000 pid=3204->guuid=cdf2f455-1700-0000-46d8-42c5900c0000 pid=3216 clone guuid=68700056-1700-0000-46d8-42c5910c0000 pid=3217 /usr/bin/base64 write-file guuid=a2ceb053-1700-0000-46d8-42c5840c0000 pid=3204->guuid=68700056-1700-0000-46d8-42c5910c0000 pid=3217 execve guuid=9401a356-1700-0000-46d8-42c5930c0000 pid=3219 /usr/bin/rm delete-file guuid=a2ceb053-1700-0000-46d8-42c5840c0000 pid=3204->guuid=9401a356-1700-0000-46d8-42c5930c0000 pid=3219 execve guuid=31a8ef56-1700-0000-46d8-42c5940c0000 pid=3220 /usr/bin/mv guuid=a2ceb053-1700-0000-46d8-42c5840c0000 pid=3204->guuid=31a8ef56-1700-0000-46d8-42c5940c0000 pid=3220 execve guuid=f9276257-1700-0000-46d8-42c5970c0000 pid=3223 /usr/bin/ls guuid=a2ceb053-1700-0000-46d8-42c5840c0000 pid=3204->guuid=f9276257-1700-0000-46d8-42c5970c0000 pid=3223 execve guuid=c2d2db57-1700-0000-46d8-42c5980c0000 pid=3224 /usr/bin/bash guuid=a2ceb053-1700-0000-46d8-42c5840c0000 pid=3204->guuid=c2d2db57-1700-0000-46d8-42c5980c0000 pid=3224 clone guuid=d7bee557-1700-0000-46d8-42c5990c0000 pid=3225 /usr/bin/base64 write-file guuid=a2ceb053-1700-0000-46d8-42c5840c0000 pid=3204->guuid=d7bee557-1700-0000-46d8-42c5990c0000 pid=3225 execve guuid=ea263658-1700-0000-46d8-42c59b0c0000 pid=3227 /usr/bin/ls guuid=a2ceb053-1700-0000-46d8-42c5840c0000 pid=3204->guuid=ea263658-1700-0000-46d8-42c59b0c0000 pid=3227 execve guuid=0c529758-1700-0000-46d8-42c59d0c0000 pid=3229 /usr/bin/cat guuid=a2ceb053-1700-0000-46d8-42c5840c0000 pid=3204->guuid=0c529758-1700-0000-46d8-42c59d0c0000 pid=3229 execve guuid=6a37d658-1700-0000-46d8-42c59f0c0000 pid=3231 /usr/bin/ls guuid=a2ceb053-1700-0000-46d8-42c5840c0000 pid=3204->guuid=6a37d658-1700-0000-46d8-42c59f0c0000 pid=3231 execve guuid=e543fb5a-1700-0000-46d8-42c5a30c0000 pid=3235->124ee36c-bdbd-5d46-bbb1-b2cd81367f04 send: 93B
Threat name:
Linux.Trojan.Generic
Status:
Suspicious
First seen:
2026-07-18 06:24:45 UTC
File Type:
Text (Shell)
AV detection:
11 of 24 (45.83%)
Threat level:
  5/5
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Behaviour
Reads runtime system information
Writes file to tmp directory
Deobfuscate/Decode Files or Information
Checks CPU configuration
File and Directory Permissions Modification
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures


MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SUSP_LNX_Base64_Exec_Apr24
Author:Christian Burkard
Description:Detects suspicious base64 encoded shell commands (as seen in Palo Alto CVE-2024-3400 exploitation)
Reference:Internal Research

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 62301a83ed74f7ca070cd9b4b2809f5d80e521eaeef6d3fe19b5064a587149fc

(this sample)

  
Delivery method
Distributed via web download

Comments