🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 63d404aa43bfb74d8619dc7ceb950bd73e8525672c91077d40227c8bdf9ec387. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 63d404aa43bfb74d8619dc7ceb950bd73e8525672c91077d40227c8bdf9ec387
SHA3-384 hash: a146a7e41455def55e3e8d148262dc45dcce2bbcb5d468bf8bb415386fc2c8bbf754fbfd591301172c484757abb67285
SHA1 hash: 9655c42ec866cfa14801545146414e39a5445c4d
MD5 hash: 706ec467a208f53f0f38639ec671dcc9
humanhash: carbon-nitrogen-emma-mockingbird
File name:wr.php
Download: download sample
File size:27'042 bytes
First seen:2026-08-28 09:10:31 UTC
Last seen:2026-08-29 08:43:06 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 768:p8vCB+25j6es8Rk9FYpMSUpi+20qUpi+20YQX:p8l25JCd2QX
TLSH T10FC27D966A867C44BEC94A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11FACD618B1A
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://160.119.69.4/z/post/noroot.phpn/an/aelf ua-wget

Intelligence

File Origin
# of uploads :
3
# of downloads :
54
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive masquerade
Link:
https://www.filescan.io/uploads/6a9150b29f72a4c3cab89df5/reports/ea8b2452-a793-47a4-8735-7aa819711f99/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-08-28T07:20:00Z UTC
Last seen:
2026-08-29T20:13:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/63d404aa43bfb74d8619dc7ceb950bd73e8525672c91077d40227c8bdf9ec387/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/78a4cb24-6b91-44e1-bdd4-73af716de59f
Behavior Graph:
Download SVG
%3 guuid=c255addd-1700-0000-50f6-9949c0080000 pid=2240 /usr/bin/sudo guuid=72f8e5e0-1700-0000-50f6-9949c6080000 pid=2246 /tmp/sample.bin guuid=c255addd-1700-0000-50f6-9949c0080000 pid=2240->guuid=72f8e5e0-1700-0000-50f6-9949c6080000 pid=2246 execve guuid=070f03e3-1700-0000-50f6-9949c9080000 pid=2249 /usr/bin/bash guuid=72f8e5e0-1700-0000-50f6-9949c6080000 pid=2246->guuid=070f03e3-1700-0000-50f6-9949c9080000 pid=2249 clone guuid=156a5be3-1700-0000-50f6-9949cb080000 pid=2251 /usr/bin/base64 guuid=72f8e5e0-1700-0000-50f6-9949c6080000 pid=2246->guuid=156a5be3-1700-0000-50f6-9949cb080000 pid=2251 execve guuid=6f6c88e3-1700-0000-50f6-9949cc080000 pid=2252 /usr/bin/bash guuid=72f8e5e0-1700-0000-50f6-9949c6080000 pid=2246->guuid=6f6c88e3-1700-0000-50f6-9949cc080000 pid=2252 clone guuid=d25713e5-1700-0000-50f6-9949cd080000 pid=2253 /usr/bin/cp guuid=72f8e5e0-1700-0000-50f6-9949c6080000 pid=2246->guuid=d25713e5-1700-0000-50f6-9949cd080000 pid=2253 execve guuid=998846e6-1700-0000-50f6-9949d1080000 pid=2257 /usr/bin/mkdir guuid=72f8e5e0-1700-0000-50f6-9949c6080000 pid=2246->guuid=998846e6-1700-0000-50f6-9949d1080000 pid=2257 execve guuid=a2ca2be7-1700-0000-50f6-9949d5080000 pid=2261 /usr/bin/mkdir guuid=72f8e5e0-1700-0000-50f6-9949c6080000 pid=2246->guuid=a2ca2be7-1700-0000-50f6-9949d5080000 pid=2261 execve guuid=2e101be8-1700-0000-50f6-9949d9080000 pid=2265 /usr/bin/mkdir guuid=72f8e5e0-1700-0000-50f6-9949c6080000 pid=2246->guuid=2e101be8-1700-0000-50f6-9949d9080000 pid=2265 execve guuid=4d33f6e8-1700-0000-50f6-9949dc080000 pid=2268 /usr/bin/mkdir guuid=72f8e5e0-1700-0000-50f6-9949c6080000 pid=2246->guuid=4d33f6e8-1700-0000-50f6-9949dc080000 pid=2268 execve guuid=ba19dce9-1700-0000-50f6-9949de080000 pid=2270 /usr/bin/mkdir guuid=72f8e5e0-1700-0000-50f6-9949c6080000 pid=2246->guuid=ba19dce9-1700-0000-50f6-9949de080000 pid=2270 execve guuid=3878bfea-1700-0000-50f6-9949e2080000 pid=2274 /usr/bin/mkdir guuid=72f8e5e0-1700-0000-50f6-9949c6080000 pid=2246->guuid=3878bfea-1700-0000-50f6-9949e2080000 pid=2274 execve guuid=8d0cb6eb-1700-0000-50f6-9949e6080000 pid=2278 /usr/bin/mkdir guuid=72f8e5e0-1700-0000-50f6-9949c6080000 pid=2246->guuid=8d0cb6eb-1700-0000-50f6-9949e6080000 pid=2278 execve guuid=223cc0ec-1700-0000-50f6-9949ea080000 pid=2282 /usr/bin/mkdir guuid=72f8e5e0-1700-0000-50f6-9949c6080000 pid=2246->guuid=223cc0ec-1700-0000-50f6-9949ea080000 pid=2282 execve guuid=6e50aded-1700-0000-50f6-9949ec080000 pid=2284 /usr/bin/mkdir guuid=72f8e5e0-1700-0000-50f6-9949c6080000 pid=2246->guuid=6e50aded-1700-0000-50f6-9949ec080000 pid=2284 execve guuid=1543bdee-1700-0000-50f6-9949ee080000 pid=2286 /usr/bin/cp guuid=72f8e5e0-1700-0000-50f6-9949c6080000 pid=2246->guuid=1543bdee-1700-0000-50f6-9949ee080000 pid=2286 execve guuid=1bb44ef0-1700-0000-50f6-9949f5080000 pid=2293 /usr/bin/cp guuid=72f8e5e0-1700-0000-50f6-9949c6080000 pid=2246->guuid=1bb44ef0-1700-0000-50f6-9949f5080000 pid=2293 execve guuid=18e084f1-1700-0000-50f6-9949f9080000 pid=2297 /usr/bin/cp guuid=72f8e5e0-1700-0000-50f6-9949c6080000 pid=2246->guuid=18e084f1-1700-0000-50f6-9949f9080000 pid=2297 execve guuid=3f1bf2f1-1700-0000-50f6-9949fa080000 pid=2298 /usr/bin/cp guuid=72f8e5e0-1700-0000-50f6-9949c6080000 pid=2246->guuid=3f1bf2f1-1700-0000-50f6-9949fa080000 pid=2298 execve guuid=ded961f2-1700-0000-50f6-9949fb080000 pid=2299 /usr/bin/cp guuid=72f8e5e0-1700-0000-50f6-9949c6080000 pid=2246->guuid=ded961f2-1700-0000-50f6-9949fb080000 pid=2299 execve guuid=6bdcd4f2-1700-0000-50f6-9949fc080000 pid=2300 /usr/bin/cp guuid=72f8e5e0-1700-0000-50f6-9949c6080000 pid=2246->guuid=6bdcd4f2-1700-0000-50f6-9949fc080000 pid=2300 execve guuid=576641f3-1700-0000-50f6-9949fd080000 pid=2301 /usr/bin/cp guuid=72f8e5e0-1700-0000-50f6-9949c6080000 pid=2246->guuid=576641f3-1700-0000-50f6-9949fd080000 pid=2301 execve guuid=26acb4f3-1700-0000-50f6-9949fe080000 pid=2302 /usr/bin/cp guuid=72f8e5e0-1700-0000-50f6-9949c6080000 pid=2246->guuid=26acb4f3-1700-0000-50f6-9949fe080000 pid=2302 execve guuid=46e925f5-1700-0000-50f6-9949ff080000 pid=2303 /usr/bin/cp guuid=72f8e5e0-1700-0000-50f6-9949c6080000 pid=2246->guuid=46e925f5-1700-0000-50f6-9949ff080000 pid=2303 execve guuid=3135e6f5-1700-0000-50f6-994900090000 pid=2304 /usr/bin/cp guuid=72f8e5e0-1700-0000-50f6-9949c6080000 pid=2246->guuid=3135e6f5-1700-0000-50f6-994900090000 pid=2304 execve guuid=75c85af6-1700-0000-50f6-994901090000 pid=2305 /usr/bin/cp guuid=72f8e5e0-1700-0000-50f6-9949c6080000 pid=2246->guuid=75c85af6-1700-0000-50f6-994901090000 pid=2305 execve guuid=76eab1f6-1700-0000-50f6-994903090000 pid=2307 /usr/bin/cp guuid=72f8e5e0-1700-0000-50f6-9949c6080000 pid=2246->guuid=76eab1f6-1700-0000-50f6-994903090000 pid=2307 execve guuid=e44219f7-1700-0000-50f6-994905090000 pid=2309 /usr/bin/cp guuid=72f8e5e0-1700-0000-50f6-9949c6080000 pid=2246->guuid=e44219f7-1700-0000-50f6-994905090000 pid=2309 execve guuid=9ee973f7-1700-0000-50f6-994907090000 pid=2311 /usr/bin/cp guuid=72f8e5e0-1700-0000-50f6-9949c6080000 pid=2246->guuid=9ee973f7-1700-0000-50f6-994907090000 pid=2311 execve guuid=15b6d9f7-1700-0000-50f6-99490a090000 pid=2314 /usr/bin/touch guuid=72f8e5e0-1700-0000-50f6-9949c6080000 pid=2246->guuid=15b6d9f7-1700-0000-50f6-99490a090000 pid=2314 execve guuid=98c41bf8-1700-0000-50f6-99490c090000 pid=2316 /usr/bin/chmod guuid=72f8e5e0-1700-0000-50f6-9949c6080000 pid=2246->guuid=98c41bf8-1700-0000-50f6-99490c090000 pid=2316 execve guuid=6afb5df8-1700-0000-50f6-99490e090000 pid=2318 /usr/bin/chmod guuid=72f8e5e0-1700-0000-50f6-9949c6080000 pid=2246->guuid=6afb5df8-1700-0000-50f6-99490e090000 pid=2318 execve guuid=2b15a2f8-1700-0000-50f6-994910090000 pid=2320 /usr/bin/chattr guuid=72f8e5e0-1700-0000-50f6-9949c6080000 pid=2246->guuid=2b15a2f8-1700-0000-50f6-994910090000 pid=2320 execve guuid=83ec07f9-1700-0000-50f6-994912090000 pid=2322 /usr/bin/chattr guuid=72f8e5e0-1700-0000-50f6-9949c6080000 pid=2246->guuid=83ec07f9-1700-0000-50f6-994912090000 pid=2322 execve guuid=051a5cf9-1700-0000-50f6-994913090000 pid=2323 /usr/bin/chattr guuid=72f8e5e0-1700-0000-50f6-9949c6080000 pid=2246->guuid=051a5cf9-1700-0000-50f6-994913090000 pid=2323 execve guuid=c691b0f9-1700-0000-50f6-994915090000 pid=2325 /usr/bin/chattr guuid=72f8e5e0-1700-0000-50f6-9949c6080000 pid=2246->guuid=c691b0f9-1700-0000-50f6-994915090000 pid=2325 execve guuid=cd8a0bfa-1700-0000-50f6-994916090000 pid=2326 /usr/bin/chattr guuid=72f8e5e0-1700-0000-50f6-9949c6080000 pid=2246->guuid=cd8a0bfa-1700-0000-50f6-994916090000 pid=2326 execve guuid=2e7f56fa-1700-0000-50f6-994918090000 pid=2328 /usr/bin/chattr guuid=72f8e5e0-1700-0000-50f6-9949c6080000 pid=2246->guuid=2e7f56fa-1700-0000-50f6-994918090000 pid=2328 execve guuid=f0a5a1fa-1700-0000-50f6-99491a090000 pid=2330 /usr/bin/chattr guuid=72f8e5e0-1700-0000-50f6-9949c6080000 pid=2246->guuid=f0a5a1fa-1700-0000-50f6-99491a090000 pid=2330 execve guuid=599eebfa-1700-0000-50f6-99491c090000 pid=2332 /usr/bin/chattr guuid=72f8e5e0-1700-0000-50f6-9949c6080000 pid=2246->guuid=599eebfa-1700-0000-50f6-99491c090000 pid=2332 execve guuid=c58036fb-1700-0000-50f6-99491e090000 pid=2334 /usr/bin/bash guuid=72f8e5e0-1700-0000-50f6-9949c6080000 pid=2246->guuid=c58036fb-1700-0000-50f6-99491e090000 pid=2334 clone guuid=d40944fb-1700-0000-50f6-99491f090000 pid=2335 /usr/bin/bash guuid=72f8e5e0-1700-0000-50f6-9949c6080000 pid=2246->guuid=d40944fb-1700-0000-50f6-99491f090000 pid=2335 clone guuid=fdc964fb-1700-0000-50f6-994920090000 pid=2336 /usr/bin/curl net send-data guuid=72f8e5e0-1700-0000-50f6-9949c6080000 pid=2246->guuid=fdc964fb-1700-0000-50f6-994920090000 pid=2336 execve guuid=59966bfb-1700-0000-50f6-994921090000 pid=2337 /usr/bin/dash guuid=72f8e5e0-1700-0000-50f6-9949c6080000 pid=2246->guuid=59966bfb-1700-0000-50f6-994921090000 pid=2337 execve guuid=f4949405-1800-0000-50f6-99493a090000 pid=2362 /usr/bin/bash guuid=72f8e5e0-1700-0000-50f6-9949c6080000 pid=2246->guuid=f4949405-1800-0000-50f6-99493a090000 pid=2362 clone guuid=f4f59905-1800-0000-50f6-99493b090000 pid=2363 /usr/bin/base64 guuid=72f8e5e0-1700-0000-50f6-9949c6080000 pid=2246->guuid=f4f59905-1800-0000-50f6-99493b090000 pid=2363 execve guuid=2beea305-1800-0000-50f6-99493c090000 pid=2364 /usr/bin/tee write-file guuid=72f8e5e0-1700-0000-50f6-9949c6080000 pid=2246->guuid=2beea305-1800-0000-50f6-99493c090000 pid=2364 execve guuid=0b395806-1800-0000-50f6-994940090000 pid=2368 /usr/bin/bash guuid=72f8e5e0-1700-0000-50f6-9949c6080000 pid=2246->guuid=0b395806-1800-0000-50f6-994940090000 pid=2368 execve guuid=e03ece0b-1800-0000-50f6-994964090000 pid=2404 /usr/bin/bash guuid=72f8e5e0-1700-0000-50f6-9949c6080000 pid=2246->guuid=e03ece0b-1800-0000-50f6-994964090000 pid=2404 execve guuid=8706210c-1800-0000-50f6-994965090000 pid=2405 /usr/bin/rm delete-file guuid=72f8e5e0-1700-0000-50f6-9949c6080000 pid=2246->guuid=8706210c-1800-0000-50f6-994965090000 pid=2405 execve guuid=593f6a0c-1800-0000-50f6-994966090000 pid=2406 /usr/bin/rm guuid=72f8e5e0-1700-0000-50f6-9949c6080000 pid=2246->guuid=593f6a0c-1800-0000-50f6-994966090000 pid=2406 execve guuid=b6b3ac0c-1800-0000-50f6-994967090000 pid=2407 /usr/bin/curl net send-data guuid=72f8e5e0-1700-0000-50f6-9949c6080000 pid=2246->guuid=b6b3ac0c-1800-0000-50f6-994967090000 pid=2407 execve guuid=4e68b40c-1800-0000-50f6-994968090000 pid=2408 /usr/bin/dash guuid=72f8e5e0-1700-0000-50f6-9949c6080000 pid=2246->guuid=4e68b40c-1800-0000-50f6-994968090000 pid=2408 execve 124ee36c-bdbd-5d46-bbb1-b2cd81367f04 160.119.69.4:80 guuid=fdc964fb-1700-0000-50f6-994920090000 pid=2336->124ee36c-bdbd-5d46-bbb1-b2cd81367f04 send: 93B guuid=bdf1c006-1800-0000-50f6-994943090000 pid=2371 /usr/bin/bash guuid=0b395806-1800-0000-50f6-994940090000 pid=2368->guuid=bdf1c006-1800-0000-50f6-994943090000 pid=2371 clone guuid=6206c606-1800-0000-50f6-994944090000 pid=2372 /usr/bin/bash guuid=0b395806-1800-0000-50f6-994940090000 pid=2368->guuid=6206c606-1800-0000-50f6-994944090000 pid=2372 clone guuid=5028e506-1800-0000-50f6-994945090000 pid=2373 /usr/bin/ls guuid=0b395806-1800-0000-50f6-994940090000 pid=2368->guuid=5028e506-1800-0000-50f6-994945090000 pid=2373 execve guuid=6f645607-1800-0000-50f6-994948090000 pid=2376 /usr/bin/cat guuid=0b395806-1800-0000-50f6-994940090000 pid=2368->guuid=6f645607-1800-0000-50f6-994948090000 pid=2376 execve guuid=0dbe9c07-1800-0000-50f6-99494a090000 pid=2378 /usr/bin/ls guuid=0b395806-1800-0000-50f6-994940090000 pid=2368->guuid=0dbe9c07-1800-0000-50f6-99494a090000 pid=2378 execve guuid=9b3c0d08-1800-0000-50f6-99494d090000 pid=2381 /usr/bin/mkdir guuid=0b395806-1800-0000-50f6-994940090000 pid=2368->guuid=9b3c0d08-1800-0000-50f6-99494d090000 pid=2381 execve guuid=8a167908-1800-0000-50f6-99494f090000 pid=2383 /usr/bin/mv guuid=0b395806-1800-0000-50f6-994940090000 pid=2368->guuid=8a167908-1800-0000-50f6-99494f090000 pid=2383 execve guuid=67b7f708-1800-0000-50f6-994950090000 pid=2384 /usr/bin/bash guuid=0b395806-1800-0000-50f6-994940090000 pid=2368->guuid=67b7f708-1800-0000-50f6-994950090000 pid=2384 clone guuid=7d8afe08-1800-0000-50f6-994951090000 pid=2385 /usr/bin/base64 write-file guuid=0b395806-1800-0000-50f6-994940090000 pid=2368->guuid=7d8afe08-1800-0000-50f6-994951090000 pid=2385 execve guuid=fd436509-1800-0000-50f6-994953090000 pid=2387 /usr/bin/rm delete-file guuid=0b395806-1800-0000-50f6-994940090000 pid=2368->guuid=fd436509-1800-0000-50f6-994953090000 pid=2387 execve guuid=a86ca509-1800-0000-50f6-994955090000 pid=2389 /usr/bin/mv guuid=0b395806-1800-0000-50f6-994940090000 pid=2368->guuid=a86ca509-1800-0000-50f6-994955090000 pid=2389 execve guuid=ddf6060a-1800-0000-50f6-994958090000 pid=2392 /usr/bin/ls guuid=0b395806-1800-0000-50f6-994940090000 pid=2368->guuid=ddf6060a-1800-0000-50f6-994958090000 pid=2392 execve guuid=60c1680a-1800-0000-50f6-99495a090000 pid=2394 /usr/bin/bash guuid=0b395806-1800-0000-50f6-994940090000 pid=2368->guuid=60c1680a-1800-0000-50f6-99495a090000 pid=2394 clone guuid=e8e76d0a-1800-0000-50f6-99495b090000 pid=2395 /usr/bin/base64 write-file guuid=0b395806-1800-0000-50f6-994940090000 pid=2368->guuid=e8e76d0a-1800-0000-50f6-99495b090000 pid=2395 execve guuid=a0c5bd0a-1800-0000-50f6-99495d090000 pid=2397 /usr/bin/ls guuid=0b395806-1800-0000-50f6-994940090000 pid=2368->guuid=a0c5bd0a-1800-0000-50f6-99495d090000 pid=2397 execve guuid=5ea8210b-1800-0000-50f6-994960090000 pid=2400 /usr/bin/cat guuid=0b395806-1800-0000-50f6-994940090000 pid=2368->guuid=5ea8210b-1800-0000-50f6-994960090000 pid=2400 execve guuid=d882660b-1800-0000-50f6-994962090000 pid=2402 /usr/bin/ls guuid=0b395806-1800-0000-50f6-994940090000 pid=2368->guuid=d882660b-1800-0000-50f6-994962090000 pid=2402 execve guuid=b6b3ac0c-1800-0000-50f6-994967090000 pid=2407->124ee36c-bdbd-5d46-bbb1-b2cd81367f04 send: 93B
Score:
81%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/63d404aa43bfb74d8619dc7ceb950bd73e8525672c91077d40227c8bdf9ec387
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/63d404aa43bfb74d8619dc7ceb950bd73e8525672c91077d40227c8bdf9ec387/
Threat name:
Linux.Backdoor.WebShell
Create hunting rule
Status:
Malicious
First seen:
2026-08-28 09:11:18 UTC
File Type:
Text (Shell)
AV detection:
12 of 24 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=mpkajksdx63u3bqz3r6oxfil247ikjlhfsiqo7kaej6ixx46yodq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260828-k5pzbswbjd/
Behaviour
Reads runtime system information
Writes file to tmp directory
Deobfuscate/Decode Files or Information
Checks CPU configuration
File and Directory Permissions Modification
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.16
Link:
https://yomi.yoroi.company/submissions/63d404aa43bfb74d8619dc7ceb950bd73e8525672c91077d40227c8bdf9ec387

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SUSP_LNX_Base64_Exec_Apr24
Create hunting rule
Author:Christian Burkard
Description:Detects suspicious base64 encoded shell commands (as seen in Palo Alto CVE-2024-3400 exploitation)
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 63d404aa43bfb74d8619dc7ceb950bd73e8525672c91077d40227c8bdf9ec387

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3884408/
  
Delivery method
Distributed via web download

Comments