MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6873c2ef47abf2571c6008e7e23b8e15ec48612e2e85c3149bd8653e7f9e6b5b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6873c2ef47abf2571c6008e7e23b8e15ec48612e2e85c3149bd8653e7f9e6b5b
SHA3-384 hash: 1cece69e4bf2fa042483234c4e97748c2fa7a77b40d16090aafcf0b7ffa77085e5454371ab79eb5cf1662e28642ad400
SHA1 hash: a35bde91c20a18339ea3d58dcd58cb84e9e5dce1
MD5 hash: 1e572fda8f730b502ffb349ae7096f02
humanhash: magazine-speaker-nebraska-sixteen
File name:wr.php
Download: download sample
File size:27'042 bytes
First seen:2026-08-20 16:29:29 UTC
Last seen:2026-08-21 06:33:57 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 768:88vCB+25j6es8RT9FYpMSUpi+20qUpi+20YQX:88l25JVd2QX
TLSH T10DC27D966A867C44BEC94A3E4CBD2B1D6DF5C3D1324942AC3D8A3C71DC11FACD618B1A
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://160.119.69.4/z/post/noroot.phpn/an/aelf ua-wget

Intelligence

File Origin
# of uploads :
2
# of downloads :
54
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.DownLoader.2862.22916.3729.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive masquerade
Link:
https://www.filescan.io/uploads/6a872b9d8072038c12ed70e7/reports/26772a56-aaa5-449d-b889-31240a9c2d8c/overview
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/6c78d29b-0d42-43bc-a9b9-07043469c5f0
Behavior Graph:
Download SVG
%3 guuid=c86ac4ad-1600-0000-5ee7-bc06260c0000 pid=3110 /usr/bin/sudo guuid=2bce91af-1600-0000-5ee7-bc062a0c0000 pid=3114 /tmp/sample.bin guuid=c86ac4ad-1600-0000-5ee7-bc06260c0000 pid=3110->guuid=2bce91af-1600-0000-5ee7-bc062a0c0000 pid=3114 execve guuid=c7a274b0-1600-0000-5ee7-bc062b0c0000 pid=3115 /usr/bin/bash guuid=2bce91af-1600-0000-5ee7-bc062a0c0000 pid=3114->guuid=c7a274b0-1600-0000-5ee7-bc062b0c0000 pid=3115 clone guuid=875884b0-1600-0000-5ee7-bc062c0c0000 pid=3116 /usr/bin/base64 guuid=2bce91af-1600-0000-5ee7-bc062a0c0000 pid=3114->guuid=875884b0-1600-0000-5ee7-bc062c0c0000 pid=3116 execve guuid=1f9c9cb0-1600-0000-5ee7-bc062d0c0000 pid=3117 /usr/bin/bash guuid=2bce91af-1600-0000-5ee7-bc062a0c0000 pid=3114->guuid=1f9c9cb0-1600-0000-5ee7-bc062d0c0000 pid=3117 clone guuid=315030b1-1600-0000-5ee7-bc062e0c0000 pid=3118 /usr/bin/cp guuid=2bce91af-1600-0000-5ee7-bc062a0c0000 pid=3114->guuid=315030b1-1600-0000-5ee7-bc062e0c0000 pid=3118 execve guuid=1a2ec0b1-1600-0000-5ee7-bc062f0c0000 pid=3119 /usr/bin/mkdir guuid=2bce91af-1600-0000-5ee7-bc062a0c0000 pid=3114->guuid=1a2ec0b1-1600-0000-5ee7-bc062f0c0000 pid=3119 execve guuid=fb7b36b2-1600-0000-5ee7-bc06300c0000 pid=3120 /usr/bin/mkdir guuid=2bce91af-1600-0000-5ee7-bc062a0c0000 pid=3114->guuid=fb7b36b2-1600-0000-5ee7-bc06300c0000 pid=3120 execve guuid=4d5f9fb2-1600-0000-5ee7-bc06310c0000 pid=3121 /usr/bin/mkdir guuid=2bce91af-1600-0000-5ee7-bc062a0c0000 pid=3114->guuid=4d5f9fb2-1600-0000-5ee7-bc06310c0000 pid=3121 execve guuid=a8bd10b3-1600-0000-5ee7-bc06320c0000 pid=3122 /usr/bin/mkdir guuid=2bce91af-1600-0000-5ee7-bc062a0c0000 pid=3114->guuid=a8bd10b3-1600-0000-5ee7-bc06320c0000 pid=3122 execve guuid=07e680b3-1600-0000-5ee7-bc06330c0000 pid=3123 /usr/bin/mkdir guuid=2bce91af-1600-0000-5ee7-bc062a0c0000 pid=3114->guuid=07e680b3-1600-0000-5ee7-bc06330c0000 pid=3123 execve guuid=3b14f7b3-1600-0000-5ee7-bc06340c0000 pid=3124 /usr/bin/mkdir guuid=2bce91af-1600-0000-5ee7-bc062a0c0000 pid=3114->guuid=3b14f7b3-1600-0000-5ee7-bc06340c0000 pid=3124 execve guuid=766b6cb4-1600-0000-5ee7-bc06350c0000 pid=3125 /usr/bin/mkdir guuid=2bce91af-1600-0000-5ee7-bc062a0c0000 pid=3114->guuid=766b6cb4-1600-0000-5ee7-bc06350c0000 pid=3125 execve guuid=d89cddb4-1600-0000-5ee7-bc06360c0000 pid=3126 /usr/bin/mkdir guuid=2bce91af-1600-0000-5ee7-bc062a0c0000 pid=3114->guuid=d89cddb4-1600-0000-5ee7-bc06360c0000 pid=3126 execve guuid=8b2c4cb5-1600-0000-5ee7-bc06370c0000 pid=3127 /usr/bin/mkdir guuid=2bce91af-1600-0000-5ee7-bc062a0c0000 pid=3114->guuid=8b2c4cb5-1600-0000-5ee7-bc06370c0000 pid=3127 execve guuid=4bf9bcb5-1600-0000-5ee7-bc06380c0000 pid=3128 /usr/bin/cp guuid=2bce91af-1600-0000-5ee7-bc062a0c0000 pid=3114->guuid=4bf9bcb5-1600-0000-5ee7-bc06380c0000 pid=3128 execve guuid=2ef322b6-1600-0000-5ee7-bc063a0c0000 pid=3130 /usr/bin/cp guuid=2bce91af-1600-0000-5ee7-bc062a0c0000 pid=3114->guuid=2ef322b6-1600-0000-5ee7-bc063a0c0000 pid=3130 execve guuid=0384e1b6-1600-0000-5ee7-bc063b0c0000 pid=3131 /usr/bin/cp guuid=2bce91af-1600-0000-5ee7-bc062a0c0000 pid=3114->guuid=0384e1b6-1600-0000-5ee7-bc063b0c0000 pid=3131 execve guuid=f6c05ab7-1600-0000-5ee7-bc063c0c0000 pid=3132 /usr/bin/cp guuid=2bce91af-1600-0000-5ee7-bc062a0c0000 pid=3114->guuid=f6c05ab7-1600-0000-5ee7-bc063c0c0000 pid=3132 execve guuid=2a13bcb7-1600-0000-5ee7-bc063e0c0000 pid=3134 /usr/bin/cp guuid=2bce91af-1600-0000-5ee7-bc062a0c0000 pid=3114->guuid=2a13bcb7-1600-0000-5ee7-bc063e0c0000 pid=3134 execve guuid=941e32b8-1600-0000-5ee7-bc06410c0000 pid=3137 /usr/bin/cp guuid=2bce91af-1600-0000-5ee7-bc062a0c0000 pid=3114->guuid=941e32b8-1600-0000-5ee7-bc06410c0000 pid=3137 execve guuid=2d509db8-1600-0000-5ee7-bc06430c0000 pid=3139 /usr/bin/cp guuid=2bce91af-1600-0000-5ee7-bc062a0c0000 pid=3114->guuid=2d509db8-1600-0000-5ee7-bc06430c0000 pid=3139 execve guuid=02ac3fb9-1600-0000-5ee7-bc06460c0000 pid=3142 /usr/bin/cp guuid=2bce91af-1600-0000-5ee7-bc062a0c0000 pid=3114->guuid=02ac3fb9-1600-0000-5ee7-bc06460c0000 pid=3142 execve guuid=a2e5a1b9-1600-0000-5ee7-bc06480c0000 pid=3144 /usr/bin/cp guuid=2bce91af-1600-0000-5ee7-bc062a0c0000 pid=3114->guuid=a2e5a1b9-1600-0000-5ee7-bc06480c0000 pid=3144 execve guuid=4751fdb9-1600-0000-5ee7-bc06490c0000 pid=3145 /usr/bin/cp guuid=2bce91af-1600-0000-5ee7-bc062a0c0000 pid=3114->guuid=4751fdb9-1600-0000-5ee7-bc06490c0000 pid=3145 execve guuid=a7f555ba-1600-0000-5ee7-bc064a0c0000 pid=3146 /usr/bin/cp guuid=2bce91af-1600-0000-5ee7-bc062a0c0000 pid=3114->guuid=a7f555ba-1600-0000-5ee7-bc064a0c0000 pid=3146 execve guuid=9ee4b1ba-1600-0000-5ee7-bc064b0c0000 pid=3147 /usr/bin/cp guuid=2bce91af-1600-0000-5ee7-bc062a0c0000 pid=3114->guuid=9ee4b1ba-1600-0000-5ee7-bc064b0c0000 pid=3147 execve guuid=cb0a0cbb-1600-0000-5ee7-bc064d0c0000 pid=3149 /usr/bin/cp guuid=2bce91af-1600-0000-5ee7-bc062a0c0000 pid=3114->guuid=cb0a0cbb-1600-0000-5ee7-bc064d0c0000 pid=3149 execve guuid=38be6abb-1600-0000-5ee7-bc064f0c0000 pid=3151 /usr/bin/cp guuid=2bce91af-1600-0000-5ee7-bc062a0c0000 pid=3114->guuid=38be6abb-1600-0000-5ee7-bc064f0c0000 pid=3151 execve guuid=069fc9bb-1600-0000-5ee7-bc06500c0000 pid=3152 /usr/bin/touch guuid=2bce91af-1600-0000-5ee7-bc062a0c0000 pid=3114->guuid=069fc9bb-1600-0000-5ee7-bc06500c0000 pid=3152 execve guuid=3bab11bc-1600-0000-5ee7-bc06520c0000 pid=3154 /usr/bin/chmod guuid=2bce91af-1600-0000-5ee7-bc062a0c0000 pid=3114->guuid=3bab11bc-1600-0000-5ee7-bc06520c0000 pid=3154 execve guuid=ebcd4abc-1600-0000-5ee7-bc06530c0000 pid=3155 /usr/bin/chmod guuid=2bce91af-1600-0000-5ee7-bc062a0c0000 pid=3114->guuid=ebcd4abc-1600-0000-5ee7-bc06530c0000 pid=3155 execve guuid=50f682bc-1600-0000-5ee7-bc06540c0000 pid=3156 /usr/bin/chattr guuid=2bce91af-1600-0000-5ee7-bc062a0c0000 pid=3114->guuid=50f682bc-1600-0000-5ee7-bc06540c0000 pid=3156 execve guuid=69d2eabc-1600-0000-5ee7-bc06560c0000 pid=3158 /usr/bin/chattr guuid=2bce91af-1600-0000-5ee7-bc062a0c0000 pid=3114->guuid=69d2eabc-1600-0000-5ee7-bc06560c0000 pid=3158 execve guuid=010128bd-1600-0000-5ee7-bc06570c0000 pid=3159 /usr/bin/chattr guuid=2bce91af-1600-0000-5ee7-bc062a0c0000 pid=3114->guuid=010128bd-1600-0000-5ee7-bc06570c0000 pid=3159 execve guuid=144362bd-1600-0000-5ee7-bc06590c0000 pid=3161 /usr/bin/chattr guuid=2bce91af-1600-0000-5ee7-bc062a0c0000 pid=3114->guuid=144362bd-1600-0000-5ee7-bc06590c0000 pid=3161 execve guuid=76b39ebd-1600-0000-5ee7-bc065a0c0000 pid=3162 /usr/bin/chattr guuid=2bce91af-1600-0000-5ee7-bc062a0c0000 pid=3114->guuid=76b39ebd-1600-0000-5ee7-bc065a0c0000 pid=3162 execve guuid=e1acd7bd-1600-0000-5ee7-bc065b0c0000 pid=3163 /usr/bin/chattr guuid=2bce91af-1600-0000-5ee7-bc062a0c0000 pid=3114->guuid=e1acd7bd-1600-0000-5ee7-bc065b0c0000 pid=3163 execve guuid=427c14be-1600-0000-5ee7-bc065d0c0000 pid=3165 /usr/bin/chattr guuid=2bce91af-1600-0000-5ee7-bc062a0c0000 pid=3114->guuid=427c14be-1600-0000-5ee7-bc065d0c0000 pid=3165 execve guuid=23654dbe-1600-0000-5ee7-bc065e0c0000 pid=3166 /usr/bin/chattr guuid=2bce91af-1600-0000-5ee7-bc062a0c0000 pid=3114->guuid=23654dbe-1600-0000-5ee7-bc065e0c0000 pid=3166 execve guuid=23e887be-1600-0000-5ee7-bc065f0c0000 pid=3167 /usr/bin/bash guuid=2bce91af-1600-0000-5ee7-bc062a0c0000 pid=3114->guuid=23e887be-1600-0000-5ee7-bc065f0c0000 pid=3167 clone guuid=6b3f8dbe-1600-0000-5ee7-bc06600c0000 pid=3168 /usr/bin/bash guuid=2bce91af-1600-0000-5ee7-bc062a0c0000 pid=3114->guuid=6b3f8dbe-1600-0000-5ee7-bc06600c0000 pid=3168 clone guuid=c388a7be-1600-0000-5ee7-bc06610c0000 pid=3169 /usr/bin/curl net send-data guuid=2bce91af-1600-0000-5ee7-bc062a0c0000 pid=3114->guuid=c388a7be-1600-0000-5ee7-bc06610c0000 pid=3169 execve guuid=24aeafbe-1600-0000-5ee7-bc06620c0000 pid=3170 /usr/bin/dash guuid=2bce91af-1600-0000-5ee7-bc062a0c0000 pid=3114->guuid=24aeafbe-1600-0000-5ee7-bc06620c0000 pid=3170 execve guuid=293853c8-1600-0000-5ee7-bc066a0c0000 pid=3178 /usr/bin/bash guuid=2bce91af-1600-0000-5ee7-bc062a0c0000 pid=3114->guuid=293853c8-1600-0000-5ee7-bc066a0c0000 pid=3178 clone guuid=ed8059c8-1600-0000-5ee7-bc066b0c0000 pid=3179 /usr/bin/base64 guuid=2bce91af-1600-0000-5ee7-bc062a0c0000 pid=3114->guuid=ed8059c8-1600-0000-5ee7-bc066b0c0000 pid=3179 execve guuid=1e1e60c8-1600-0000-5ee7-bc066c0c0000 pid=3180 /usr/bin/tee write-file guuid=2bce91af-1600-0000-5ee7-bc062a0c0000 pid=3114->guuid=1e1e60c8-1600-0000-5ee7-bc066c0c0000 pid=3180 execve guuid=265569c9-1600-0000-5ee7-bc066d0c0000 pid=3181 /usr/bin/bash guuid=2bce91af-1600-0000-5ee7-bc062a0c0000 pid=3114->guuid=265569c9-1600-0000-5ee7-bc066d0c0000 pid=3181 execve guuid=2b966dcf-1600-0000-5ee7-bc06920c0000 pid=3218 /usr/bin/bash guuid=2bce91af-1600-0000-5ee7-bc062a0c0000 pid=3114->guuid=2b966dcf-1600-0000-5ee7-bc06920c0000 pid=3218 execve guuid=9359c7cf-1600-0000-5ee7-bc06940c0000 pid=3220 /usr/bin/rm delete-file guuid=2bce91af-1600-0000-5ee7-bc062a0c0000 pid=3114->guuid=9359c7cf-1600-0000-5ee7-bc06940c0000 pid=3220 execve guuid=54f306d0-1600-0000-5ee7-bc06950c0000 pid=3221 /usr/bin/rm guuid=2bce91af-1600-0000-5ee7-bc062a0c0000 pid=3114->guuid=54f306d0-1600-0000-5ee7-bc06950c0000 pid=3221 execve guuid=07434ad0-1600-0000-5ee7-bc06970c0000 pid=3223 /usr/bin/curl net send-data guuid=2bce91af-1600-0000-5ee7-bc062a0c0000 pid=3114->guuid=07434ad0-1600-0000-5ee7-bc06970c0000 pid=3223 execve guuid=b99d53d0-1600-0000-5ee7-bc06980c0000 pid=3224 /usr/bin/dash guuid=2bce91af-1600-0000-5ee7-bc062a0c0000 pid=3114->guuid=b99d53d0-1600-0000-5ee7-bc06980c0000 pid=3224 execve 124ee36c-bdbd-5d46-bbb1-b2cd81367f04 160.119.69.4:80 guuid=c388a7be-1600-0000-5ee7-bc06610c0000 pid=3169->124ee36c-bdbd-5d46-bbb1-b2cd81367f04 send: 93B guuid=fe34b7c9-1600-0000-5ee7-bc066f0c0000 pid=3183 /usr/bin/bash guuid=265569c9-1600-0000-5ee7-bc066d0c0000 pid=3181->guuid=fe34b7c9-1600-0000-5ee7-bc066f0c0000 pid=3183 clone guuid=e77ebec9-1600-0000-5ee7-bc06700c0000 pid=3184 /usr/bin/bash guuid=265569c9-1600-0000-5ee7-bc066d0c0000 pid=3181->guuid=e77ebec9-1600-0000-5ee7-bc06700c0000 pid=3184 clone guuid=640822ca-1600-0000-5ee7-bc06710c0000 pid=3185 /usr/bin/ls guuid=265569c9-1600-0000-5ee7-bc066d0c0000 pid=3181->guuid=640822ca-1600-0000-5ee7-bc06710c0000 pid=3185 execve guuid=568da0ca-1600-0000-5ee7-bc06720c0000 pid=3186 /usr/bin/cat guuid=265569c9-1600-0000-5ee7-bc066d0c0000 pid=3181->guuid=568da0ca-1600-0000-5ee7-bc06720c0000 pid=3186 execve guuid=44fff2ca-1600-0000-5ee7-bc06750c0000 pid=3189 /usr/bin/ls guuid=265569c9-1600-0000-5ee7-bc066d0c0000 pid=3181->guuid=44fff2ca-1600-0000-5ee7-bc06750c0000 pid=3189 execve guuid=7732b2cb-1600-0000-5ee7-bc06780c0000 pid=3192 /usr/bin/mkdir guuid=265569c9-1600-0000-5ee7-bc066d0c0000 pid=3181->guuid=7732b2cb-1600-0000-5ee7-bc06780c0000 pid=3192 execve guuid=ec4bf8cb-1600-0000-5ee7-bc067a0c0000 pid=3194 /usr/bin/mv guuid=265569c9-1600-0000-5ee7-bc066d0c0000 pid=3181->guuid=ec4bf8cb-1600-0000-5ee7-bc067a0c0000 pid=3194 execve guuid=23c54dcc-1600-0000-5ee7-bc067d0c0000 pid=3197 /usr/bin/bash guuid=265569c9-1600-0000-5ee7-bc066d0c0000 pid=3181->guuid=23c54dcc-1600-0000-5ee7-bc067d0c0000 pid=3197 clone guuid=0a7454cc-1600-0000-5ee7-bc067e0c0000 pid=3198 /usr/bin/base64 write-file guuid=265569c9-1600-0000-5ee7-bc066d0c0000 pid=3181->guuid=0a7454cc-1600-0000-5ee7-bc067e0c0000 pid=3198 execve guuid=1ee4a6cc-1600-0000-5ee7-bc06800c0000 pid=3200 /usr/bin/rm delete-file guuid=265569c9-1600-0000-5ee7-bc066d0c0000 pid=3181->guuid=1ee4a6cc-1600-0000-5ee7-bc06800c0000 pid=3200 execve guuid=e244eacc-1600-0000-5ee7-bc06820c0000 pid=3202 /usr/bin/mv guuid=265569c9-1600-0000-5ee7-bc066d0c0000 pid=3181->guuid=e244eacc-1600-0000-5ee7-bc06820c0000 pid=3202 execve guuid=17cf4ecd-1600-0000-5ee7-bc06850c0000 pid=3205 /usr/bin/ls guuid=265569c9-1600-0000-5ee7-bc066d0c0000 pid=3181->guuid=17cf4ecd-1600-0000-5ee7-bc06850c0000 pid=3205 execve guuid=e5efbacd-1600-0000-5ee7-bc06870c0000 pid=3207 /usr/bin/bash guuid=265569c9-1600-0000-5ee7-bc066d0c0000 pid=3181->guuid=e5efbacd-1600-0000-5ee7-bc06870c0000 pid=3207 clone guuid=256bc9cd-1600-0000-5ee7-bc06880c0000 pid=3208 /usr/bin/base64 write-file guuid=265569c9-1600-0000-5ee7-bc066d0c0000 pid=3181->guuid=256bc9cd-1600-0000-5ee7-bc06880c0000 pid=3208 execve guuid=632f4dce-1600-0000-5ee7-bc068b0c0000 pid=3211 /usr/bin/ls guuid=265569c9-1600-0000-5ee7-bc066d0c0000 pid=3181->guuid=632f4dce-1600-0000-5ee7-bc068b0c0000 pid=3211 execve guuid=677fa8ce-1600-0000-5ee7-bc068d0c0000 pid=3213 /usr/bin/cat guuid=265569c9-1600-0000-5ee7-bc066d0c0000 pid=3181->guuid=677fa8ce-1600-0000-5ee7-bc068d0c0000 pid=3213 execve guuid=46d108cf-1600-0000-5ee7-bc06900c0000 pid=3216 /usr/bin/ls guuid=265569c9-1600-0000-5ee7-bc066d0c0000 pid=3181->guuid=46d108cf-1600-0000-5ee7-bc06900c0000 pid=3216 execve guuid=07434ad0-1600-0000-5ee7-bc06970c0000 pid=3223->124ee36c-bdbd-5d46-bbb1-b2cd81367f04 send: 93B
Score:
81%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/6873c2ef47abf2571c6008e7e23b8e15ec48612e2e85c3149bd8653e7f9e6b5b
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6873c2ef47abf2571c6008e7e23b8e15ec48612e2e85c3149bd8653e7f9e6b5b/
Threat name:
Linux.Backdoor.WebShell
Create hunting rule
Status:
Malicious
First seen:
2026-08-20 16:30:31 UTC
File Type:
Text (Shell)
AV detection:
16 of 36 (44.44%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nbz4f32hvpzfohdabdt6eo4ocxweqyjof2c4gfe33bst4746nnnq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260820-tzze9a1cph/
Behaviour
Reads runtime system information
Writes file to tmp directory
Deobfuscate/Decode Files or Information
Checks CPU configuration
File and Directory Permissions Modification
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.15
Link:
https://yomi.yoroi.company/submissions/6873c2ef47abf2571c6008e7e23b8e15ec48612e2e85c3149bd8653e7f9e6b5b

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SUSP_LNX_Base64_Exec_Apr24
Create hunting rule
Author:Christian Burkard
Description:Detects suspicious base64 encoded shell commands (as seen in Palo Alto CVE-2024-3400 exploitation)
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 6873c2ef47abf2571c6008e7e23b8e15ec48612e2e85c3149bd8653e7f9e6b5b

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3884408/
  
Delivery method
Distributed via web download

Comments