MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6a64706cfd7e1754f2626bdf2c1f66ec46e63565ec481b4efe7d5d931e8e7a8f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6a64706cfd7e1754f2626bdf2c1f66ec46e63565ec481b4efe7d5d931e8e7a8f
SHA3-384 hash: 4b7c057e1cf433532ebc696292cd8eaa3163fac3c42f703a8de25489b1a1da772f490ae6a3147f9eb3a30c0160ff3add
SHA1 hash: 3f474ae323bdbb9fa909db6257d74aa03be3a6a8
MD5 hash: 12af0da6790e23e21e38ea4678d08d8d
humanhash: spring-nitrogen-alabama-cola
File name:wr.php
Download: download sample
File size:27'042 bytes
First seen:2026-08-15 09:06:26 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 768:i8vCB+25j6es8RE9FYpMSUpi+20qUpi+20YQX:i8l25Jid2QX
TLSH T1EEC27D966A867C44BDC94A3E4CBD2B1D6DF5C3D1324942AC3D8A3C71DC11FACD618B2A
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh

Intelligence

File Origin
# of uploads :
1
# of downloads :
59
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.DownLoader.2862.18192.3726.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive masquerade
Link:
https://www.filescan.io/uploads/6a802c452752423dccbd29eb/reports/1b90825e-0b67-447f-ae10-663d18ca9aec/overview
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/7382209b-6496-4de6-b1eb-12a8a9bdfa58
Behavior Graph:
Download SVG
%3 guuid=b6b3300a-1700-0000-0f6a-3a24540d0000 pid=3412 /usr/bin/sudo guuid=62893711-1700-0000-0f6a-3a24600d0000 pid=3424 /tmp/sample.bin guuid=b6b3300a-1700-0000-0f6a-3a24540d0000 pid=3412->guuid=62893711-1700-0000-0f6a-3a24600d0000 pid=3424 execve guuid=1eddf711-1700-0000-0f6a-3a24620d0000 pid=3426 /usr/bin/bash guuid=62893711-1700-0000-0f6a-3a24600d0000 pid=3424->guuid=1eddf711-1700-0000-0f6a-3a24620d0000 pid=3426 clone guuid=c932fe11-1700-0000-0f6a-3a24630d0000 pid=3427 /usr/bin/base64 guuid=62893711-1700-0000-0f6a-3a24600d0000 pid=3424->guuid=c932fe11-1700-0000-0f6a-3a24630d0000 pid=3427 execve guuid=41a50612-1700-0000-0f6a-3a24640d0000 pid=3428 /usr/bin/bash guuid=62893711-1700-0000-0f6a-3a24600d0000 pid=3424->guuid=41a50612-1700-0000-0f6a-3a24640d0000 pid=3428 clone guuid=c043f213-1700-0000-0f6a-3a24680d0000 pid=3432 /usr/bin/cp guuid=62893711-1700-0000-0f6a-3a24600d0000 pid=3424->guuid=c043f213-1700-0000-0f6a-3a24680d0000 pid=3432 execve guuid=ce0f8a14-1700-0000-0f6a-3a246a0d0000 pid=3434 /usr/bin/mkdir guuid=62893711-1700-0000-0f6a-3a24600d0000 pid=3424->guuid=ce0f8a14-1700-0000-0f6a-3a246a0d0000 pid=3434 execve guuid=4dc01f15-1700-0000-0f6a-3a246b0d0000 pid=3435 /usr/bin/mkdir guuid=62893711-1700-0000-0f6a-3a24600d0000 pid=3424->guuid=4dc01f15-1700-0000-0f6a-3a246b0d0000 pid=3435 execve guuid=37889015-1700-0000-0f6a-3a246d0d0000 pid=3437 /usr/bin/mkdir guuid=62893711-1700-0000-0f6a-3a24600d0000 pid=3424->guuid=37889015-1700-0000-0f6a-3a246d0d0000 pid=3437 execve guuid=a8ea1a16-1700-0000-0f6a-3a246e0d0000 pid=3438 /usr/bin/mkdir guuid=62893711-1700-0000-0f6a-3a24600d0000 pid=3424->guuid=a8ea1a16-1700-0000-0f6a-3a246e0d0000 pid=3438 execve guuid=89af8a16-1700-0000-0f6a-3a24700d0000 pid=3440 /usr/bin/mkdir guuid=62893711-1700-0000-0f6a-3a24600d0000 pid=3424->guuid=89af8a16-1700-0000-0f6a-3a24700d0000 pid=3440 execve guuid=8cb4f016-1700-0000-0f6a-3a24710d0000 pid=3441 /usr/bin/mkdir guuid=62893711-1700-0000-0f6a-3a24600d0000 pid=3424->guuid=8cb4f016-1700-0000-0f6a-3a24710d0000 pid=3441 execve guuid=f3ff6217-1700-0000-0f6a-3a24730d0000 pid=3443 /usr/bin/mkdir guuid=62893711-1700-0000-0f6a-3a24600d0000 pid=3424->guuid=f3ff6217-1700-0000-0f6a-3a24730d0000 pid=3443 execve guuid=ffacdd17-1700-0000-0f6a-3a24740d0000 pid=3444 /usr/bin/mkdir guuid=62893711-1700-0000-0f6a-3a24600d0000 pid=3424->guuid=ffacdd17-1700-0000-0f6a-3a24740d0000 pid=3444 execve guuid=bc0a4318-1700-0000-0f6a-3a24760d0000 pid=3446 /usr/bin/mkdir guuid=62893711-1700-0000-0f6a-3a24600d0000 pid=3424->guuid=bc0a4318-1700-0000-0f6a-3a24760d0000 pid=3446 execve guuid=95a5a518-1700-0000-0f6a-3a24770d0000 pid=3447 /usr/bin/cp guuid=62893711-1700-0000-0f6a-3a24600d0000 pid=3424->guuid=95a5a518-1700-0000-0f6a-3a24770d0000 pid=3447 execve guuid=a07f3019-1700-0000-0f6a-3a24790d0000 pid=3449 /usr/bin/cp guuid=62893711-1700-0000-0f6a-3a24600d0000 pid=3424->guuid=a07f3019-1700-0000-0f6a-3a24790d0000 pid=3449 execve guuid=4e7bb819-1700-0000-0f6a-3a247b0d0000 pid=3451 /usr/bin/cp guuid=62893711-1700-0000-0f6a-3a24600d0000 pid=3424->guuid=4e7bb819-1700-0000-0f6a-3a247b0d0000 pid=3451 execve guuid=d96a551a-1700-0000-0f6a-3a247d0d0000 pid=3453 /usr/bin/cp guuid=62893711-1700-0000-0f6a-3a24600d0000 pid=3424->guuid=d96a551a-1700-0000-0f6a-3a247d0d0000 pid=3453 execve guuid=1038e81a-1700-0000-0f6a-3a247e0d0000 pid=3454 /usr/bin/cp guuid=62893711-1700-0000-0f6a-3a24600d0000 pid=3424->guuid=1038e81a-1700-0000-0f6a-3a247e0d0000 pid=3454 execve guuid=6947861b-1700-0000-0f6a-3a24800d0000 pid=3456 /usr/bin/cp guuid=62893711-1700-0000-0f6a-3a24600d0000 pid=3424->guuid=6947861b-1700-0000-0f6a-3a24800d0000 pid=3456 execve guuid=8fc9121c-1700-0000-0f6a-3a24810d0000 pid=3457 /usr/bin/cp guuid=62893711-1700-0000-0f6a-3a24600d0000 pid=3424->guuid=8fc9121c-1700-0000-0f6a-3a24810d0000 pid=3457 execve guuid=5be5c01c-1700-0000-0f6a-3a24860d0000 pid=3462 /usr/bin/cp guuid=62893711-1700-0000-0f6a-3a24600d0000 pid=3424->guuid=5be5c01c-1700-0000-0f6a-3a24860d0000 pid=3462 execve guuid=d34f411d-1700-0000-0f6a-3a24870d0000 pid=3463 /usr/bin/cp guuid=62893711-1700-0000-0f6a-3a24600d0000 pid=3424->guuid=d34f411d-1700-0000-0f6a-3a24870d0000 pid=3463 execve guuid=7131e71d-1700-0000-0f6a-3a24880d0000 pid=3464 /usr/bin/cp guuid=62893711-1700-0000-0f6a-3a24600d0000 pid=3424->guuid=7131e71d-1700-0000-0f6a-3a24880d0000 pid=3464 execve guuid=43f9771e-1700-0000-0f6a-3a24890d0000 pid=3465 /usr/bin/cp guuid=62893711-1700-0000-0f6a-3a24600d0000 pid=3424->guuid=43f9771e-1700-0000-0f6a-3a24890d0000 pid=3465 execve guuid=eac2311f-1700-0000-0f6a-3a248a0d0000 pid=3466 /usr/bin/cp guuid=62893711-1700-0000-0f6a-3a24600d0000 pid=3424->guuid=eac2311f-1700-0000-0f6a-3a248a0d0000 pid=3466 execve guuid=9f267720-1700-0000-0f6a-3a248d0d0000 pid=3469 /usr/bin/cp guuid=62893711-1700-0000-0f6a-3a24600d0000 pid=3424->guuid=9f267720-1700-0000-0f6a-3a248d0d0000 pid=3469 execve guuid=a21b0f21-1700-0000-0f6a-3a248e0d0000 pid=3470 /usr/bin/cp guuid=62893711-1700-0000-0f6a-3a24600d0000 pid=3424->guuid=a21b0f21-1700-0000-0f6a-3a248e0d0000 pid=3470 execve guuid=eb16a521-1700-0000-0f6a-3a24900d0000 pid=3472 /usr/bin/touch guuid=62893711-1700-0000-0f6a-3a24600d0000 pid=3424->guuid=eb16a521-1700-0000-0f6a-3a24900d0000 pid=3472 execve guuid=8dca0522-1700-0000-0f6a-3a24910d0000 pid=3473 /usr/bin/chmod guuid=62893711-1700-0000-0f6a-3a24600d0000 pid=3424->guuid=8dca0522-1700-0000-0f6a-3a24910d0000 pid=3473 execve guuid=b77f5b22-1700-0000-0f6a-3a24930d0000 pid=3475 /usr/bin/chmod guuid=62893711-1700-0000-0f6a-3a24600d0000 pid=3424->guuid=b77f5b22-1700-0000-0f6a-3a24930d0000 pid=3475 execve guuid=302cb422-1700-0000-0f6a-3a24950d0000 pid=3477 /usr/bin/chattr guuid=62893711-1700-0000-0f6a-3a24600d0000 pid=3424->guuid=302cb422-1700-0000-0f6a-3a24950d0000 pid=3477 execve guuid=c1664023-1700-0000-0f6a-3a24980d0000 pid=3480 /usr/bin/chattr guuid=62893711-1700-0000-0f6a-3a24600d0000 pid=3424->guuid=c1664023-1700-0000-0f6a-3a24980d0000 pid=3480 execve guuid=57dd9523-1700-0000-0f6a-3a249a0d0000 pid=3482 /usr/bin/chattr guuid=62893711-1700-0000-0f6a-3a24600d0000 pid=3424->guuid=57dd9523-1700-0000-0f6a-3a249a0d0000 pid=3482 execve guuid=bb34e523-1700-0000-0f6a-3a249c0d0000 pid=3484 /usr/bin/chattr guuid=62893711-1700-0000-0f6a-3a24600d0000 pid=3424->guuid=bb34e523-1700-0000-0f6a-3a249c0d0000 pid=3484 execve guuid=c8c05924-1700-0000-0f6a-3a249e0d0000 pid=3486 /usr/bin/chattr guuid=62893711-1700-0000-0f6a-3a24600d0000 pid=3424->guuid=c8c05924-1700-0000-0f6a-3a249e0d0000 pid=3486 execve guuid=9911cd24-1700-0000-0f6a-3a24a00d0000 pid=3488 /usr/bin/chattr guuid=62893711-1700-0000-0f6a-3a24600d0000 pid=3424->guuid=9911cd24-1700-0000-0f6a-3a24a00d0000 pid=3488 execve guuid=0bc53e25-1700-0000-0f6a-3a24a20d0000 pid=3490 /usr/bin/chattr guuid=62893711-1700-0000-0f6a-3a24600d0000 pid=3424->guuid=0bc53e25-1700-0000-0f6a-3a24a20d0000 pid=3490 execve guuid=ead49f25-1700-0000-0f6a-3a24a40d0000 pid=3492 /usr/bin/chattr guuid=62893711-1700-0000-0f6a-3a24600d0000 pid=3424->guuid=ead49f25-1700-0000-0f6a-3a24a40d0000 pid=3492 execve guuid=3f400626-1700-0000-0f6a-3a24a50d0000 pid=3493 /usr/bin/bash guuid=62893711-1700-0000-0f6a-3a24600d0000 pid=3424->guuid=3f400626-1700-0000-0f6a-3a24a50d0000 pid=3493 clone guuid=2f350f26-1700-0000-0f6a-3a24a60d0000 pid=3494 /usr/bin/bash guuid=62893711-1700-0000-0f6a-3a24600d0000 pid=3424->guuid=2f350f26-1700-0000-0f6a-3a24a60d0000 pid=3494 clone guuid=9d334226-1700-0000-0f6a-3a24a80d0000 pid=3496 /usr/bin/curl net send-data guuid=62893711-1700-0000-0f6a-3a24600d0000 pid=3424->guuid=9d334226-1700-0000-0f6a-3a24a80d0000 pid=3496 execve guuid=2e8b4a26-1700-0000-0f6a-3a24a90d0000 pid=3497 /usr/bin/dash guuid=62893711-1700-0000-0f6a-3a24600d0000 pid=3424->guuid=2e8b4a26-1700-0000-0f6a-3a24a90d0000 pid=3497 execve guuid=eccafa2b-1700-0000-0f6a-3a24b80d0000 pid=3512 /usr/bin/bash guuid=62893711-1700-0000-0f6a-3a24600d0000 pid=3424->guuid=eccafa2b-1700-0000-0f6a-3a24b80d0000 pid=3512 clone guuid=f5f8032c-1700-0000-0f6a-3a24b90d0000 pid=3513 /usr/bin/base64 guuid=62893711-1700-0000-0f6a-3a24600d0000 pid=3424->guuid=f5f8032c-1700-0000-0f6a-3a24b90d0000 pid=3513 execve guuid=4b570c2c-1700-0000-0f6a-3a24ba0d0000 pid=3514 /usr/bin/tee write-file guuid=62893711-1700-0000-0f6a-3a24600d0000 pid=3424->guuid=4b570c2c-1700-0000-0f6a-3a24ba0d0000 pid=3514 execve guuid=203c742c-1700-0000-0f6a-3a24bd0d0000 pid=3517 /usr/bin/bash guuid=62893711-1700-0000-0f6a-3a24600d0000 pid=3424->guuid=203c742c-1700-0000-0f6a-3a24bd0d0000 pid=3517 execve guuid=4f5ea033-1700-0000-0f6a-3a24de0d0000 pid=3550 /usr/bin/bash guuid=62893711-1700-0000-0f6a-3a24600d0000 pid=3424->guuid=4f5ea033-1700-0000-0f6a-3a24de0d0000 pid=3550 execve guuid=e537fe33-1700-0000-0f6a-3a24e00d0000 pid=3552 /usr/bin/rm delete-file guuid=62893711-1700-0000-0f6a-3a24600d0000 pid=3424->guuid=e537fe33-1700-0000-0f6a-3a24e00d0000 pid=3552 execve guuid=c04b4834-1700-0000-0f6a-3a24e20d0000 pid=3554 /usr/bin/rm guuid=62893711-1700-0000-0f6a-3a24600d0000 pid=3424->guuid=c04b4834-1700-0000-0f6a-3a24e20d0000 pid=3554 execve guuid=2aa39434-1700-0000-0f6a-3a24e30d0000 pid=3555 /usr/bin/curl net send-data guuid=62893711-1700-0000-0f6a-3a24600d0000 pid=3424->guuid=2aa39434-1700-0000-0f6a-3a24e30d0000 pid=3555 execve guuid=850c9b34-1700-0000-0f6a-3a24e40d0000 pid=3556 /usr/bin/dash guuid=62893711-1700-0000-0f6a-3a24600d0000 pid=3424->guuid=850c9b34-1700-0000-0f6a-3a24e40d0000 pid=3556 execve 124ee36c-bdbd-5d46-bbb1-b2cd81367f04 160.119.69.4:80 guuid=9d334226-1700-0000-0f6a-3a24a80d0000 pid=3496->124ee36c-bdbd-5d46-bbb1-b2cd81367f04 send: 93B guuid=b332c42c-1700-0000-0f6a-3a24bf0d0000 pid=3519 /usr/bin/bash guuid=203c742c-1700-0000-0f6a-3a24bd0d0000 pid=3517->guuid=b332c42c-1700-0000-0f6a-3a24bf0d0000 pid=3519 clone guuid=9949ca2c-1700-0000-0f6a-3a24c00d0000 pid=3520 /usr/bin/bash guuid=203c742c-1700-0000-0f6a-3a24bd0d0000 pid=3517->guuid=9949ca2c-1700-0000-0f6a-3a24c00d0000 pid=3520 clone guuid=e08ae72c-1700-0000-0f6a-3a24c10d0000 pid=3521 /usr/bin/ls guuid=203c742c-1700-0000-0f6a-3a24bd0d0000 pid=3517->guuid=e08ae72c-1700-0000-0f6a-3a24c10d0000 pid=3521 execve guuid=f5f6582d-1700-0000-0f6a-3a24c40d0000 pid=3524 /usr/bin/cat guuid=203c742c-1700-0000-0f6a-3a24bd0d0000 pid=3517->guuid=f5f6582d-1700-0000-0f6a-3a24c40d0000 pid=3524 execve guuid=8ca0992d-1700-0000-0f6a-3a24c60d0000 pid=3526 /usr/bin/ls guuid=203c742c-1700-0000-0f6a-3a24bd0d0000 pid=3517->guuid=8ca0992d-1700-0000-0f6a-3a24c60d0000 pid=3526 execve guuid=d942182e-1700-0000-0f6a-3a24c80d0000 pid=3528 /usr/bin/mkdir guuid=203c742c-1700-0000-0f6a-3a24bd0d0000 pid=3517->guuid=d942182e-1700-0000-0f6a-3a24c80d0000 pid=3528 execve guuid=b7da662e-1700-0000-0f6a-3a24ca0d0000 pid=3530 /usr/bin/mv guuid=203c742c-1700-0000-0f6a-3a24bd0d0000 pid=3517->guuid=b7da662e-1700-0000-0f6a-3a24ca0d0000 pid=3530 execve guuid=2331a22f-1700-0000-0f6a-3a24cd0d0000 pid=3533 /usr/bin/bash guuid=203c742c-1700-0000-0f6a-3a24bd0d0000 pid=3517->guuid=2331a22f-1700-0000-0f6a-3a24cd0d0000 pid=3533 clone guuid=c8fab02f-1700-0000-0f6a-3a24ce0d0000 pid=3534 /usr/bin/base64 write-file guuid=203c742c-1700-0000-0f6a-3a24bd0d0000 pid=3517->guuid=c8fab02f-1700-0000-0f6a-3a24ce0d0000 pid=3534 execve guuid=efc16630-1700-0000-0f6a-3a24d10d0000 pid=3537 /usr/bin/rm delete-file guuid=203c742c-1700-0000-0f6a-3a24bd0d0000 pid=3517->guuid=efc16630-1700-0000-0f6a-3a24d10d0000 pid=3537 execve guuid=0648b730-1700-0000-0f6a-3a24d20d0000 pid=3538 /usr/bin/mv guuid=203c742c-1700-0000-0f6a-3a24bd0d0000 pid=3517->guuid=0648b730-1700-0000-0f6a-3a24d20d0000 pid=3538 execve guuid=efd83731-1700-0000-0f6a-3a24d40d0000 pid=3540 /usr/bin/ls guuid=203c742c-1700-0000-0f6a-3a24bd0d0000 pid=3517->guuid=efd83731-1700-0000-0f6a-3a24d40d0000 pid=3540 execve guuid=781ead31-1700-0000-0f6a-3a24d50d0000 pid=3541 /usr/bin/bash guuid=203c742c-1700-0000-0f6a-3a24bd0d0000 pid=3517->guuid=781ead31-1700-0000-0f6a-3a24d50d0000 pid=3541 clone guuid=126cb831-1700-0000-0f6a-3a24d60d0000 pid=3542 /usr/bin/base64 write-file guuid=203c742c-1700-0000-0f6a-3a24bd0d0000 pid=3517->guuid=126cb831-1700-0000-0f6a-3a24d60d0000 pid=3542 execve guuid=3c3d3d32-1700-0000-0f6a-3a24d70d0000 pid=3543 /usr/bin/ls guuid=203c742c-1700-0000-0f6a-3a24bd0d0000 pid=3517->guuid=3c3d3d32-1700-0000-0f6a-3a24d70d0000 pid=3543 execve guuid=681dd732-1700-0000-0f6a-3a24da0d0000 pid=3546 /usr/bin/cat guuid=203c742c-1700-0000-0f6a-3a24bd0d0000 pid=3517->guuid=681dd732-1700-0000-0f6a-3a24da0d0000 pid=3546 execve guuid=44b22633-1700-0000-0f6a-3a24db0d0000 pid=3547 /usr/bin/ls guuid=203c742c-1700-0000-0f6a-3a24bd0d0000 pid=3517->guuid=44b22633-1700-0000-0f6a-3a24db0d0000 pid=3547 execve guuid=2aa39434-1700-0000-0f6a-3a24e30d0000 pid=3555->124ee36c-bdbd-5d46-bbb1-b2cd81367f04 send: 93B
Score:
81%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/6a64706cfd7e1754f2626bdf2c1f66ec46e63565ec481b4efe7d5d931e8e7a8f
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6a64706cfd7e1754f2626bdf2c1f66ec46e63565ec481b4efe7d5d931e8e7a8f/
Threat name:
Linux.Backdoor.WebShell
Create hunting rule
Status:
Malicious
First seen:
2026-08-15 09:07:30 UTC
File Type:
Text (Shell)
AV detection:
16 of 36 (44.44%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=njsha3h5pylvj4tcnppsyh3g5rdomnlf5rebwtx6pvozghuopkhq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260815-k2zpcshm5x/
Behaviour
Reads runtime system information
Writes file to tmp directory
Deobfuscate/Decode Files or Information
Checks CPU configuration
File and Directory Permissions Modification
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SUSP_LNX_Base64_Exec_Apr24
Create hunting rule
Author:Christian Burkard
Description:Detects suspicious base64 encoded shell commands (as seen in Palo Alto CVE-2024-3400 exploitation)
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 6a64706cfd7e1754f2626bdf2c1f66ec46e63565ec481b4efe7d5d931e8e7a8f

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3884408/
  
Delivery method
Distributed via web download

Comments