MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7f4947195d352f01a517e5f472d3ae734d22b1d8a6fc5a69b42e6db42f9a11ef. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7f4947195d352f01a517e5f472d3ae734d22b1d8a6fc5a69b42e6db42f9a11ef
SHA3-384 hash: 6d5e7cb10fb7067654f02623f08c4ca5a2c145fca253b19f4bae6b277e8948c3ac641616bbb6b0f57f95a6ea3419869b
SHA1 hash: cf525bddad87af6136de6a2ece8a3308f6b72ce1
MD5 hash: ef4bebc790aacb3ed0ccb59844ceda52
humanhash: cup-three-kansas-arizona
File name:wr.php
Download: download sample
File size:27'042 bytes
First seen:2026-07-28 18:52:35 UTC
Last seen:2026-07-29 13:08:47 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 768:68vCB+25j6es8RZ9FYpMSUpi+20qUpi+20YQX:68l25J/d2QX
TLSH T158C27D956A867C44BEC98A3E4CBD2B0D6DF5C3D1324952AC3D8B3C719C12F9CD618B1A
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://160.119.69.4/z/post/noroot.phpn/an/aelf ua-wget

Intelligence

File Origin
# of uploads :
4
# of downloads :
77
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.BV.Agent-BNQ.69791691.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
File Type:
unix shell
First seen:
2026-07-28T17:05:00Z UTC
Last seen:
2026-07-28T18:30:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/7f4947195d352f01a517e5f472d3ae734d22b1d8a6fc5a69b42e6db42f9a11ef/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/a2d2afd4-54b6-4148-af31-c9b8da14ad82
Behavior Graph:
Download SVG
%3 guuid=73be3fdf-1600-0000-01d7-b3d7e10e0000 pid=3809 /usr/bin/sudo guuid=9ad63ee1-1600-0000-01d7-b3d7ed0e0000 pid=3821 /tmp/sample.bin guuid=73be3fdf-1600-0000-01d7-b3d7e10e0000 pid=3809->guuid=9ad63ee1-1600-0000-01d7-b3d7ed0e0000 pid=3821 execve guuid=84987de2-1600-0000-01d7-b3d7f40e0000 pid=3828 /usr/bin/bash guuid=9ad63ee1-1600-0000-01d7-b3d7ed0e0000 pid=3821->guuid=84987de2-1600-0000-01d7-b3d7f40e0000 pid=3828 clone guuid=ac7db5e2-1600-0000-01d7-b3d7f50e0000 pid=3829 /usr/bin/base64 guuid=9ad63ee1-1600-0000-01d7-b3d7ed0e0000 pid=3821->guuid=ac7db5e2-1600-0000-01d7-b3d7f50e0000 pid=3829 execve guuid=27ede2e2-1600-0000-01d7-b3d7f60e0000 pid=3830 /usr/bin/bash guuid=9ad63ee1-1600-0000-01d7-b3d7ed0e0000 pid=3821->guuid=27ede2e2-1600-0000-01d7-b3d7f60e0000 pid=3830 clone guuid=30b7bce3-1600-0000-01d7-b3d7f70e0000 pid=3831 /usr/bin/cp guuid=9ad63ee1-1600-0000-01d7-b3d7ed0e0000 pid=3821->guuid=30b7bce3-1600-0000-01d7-b3d7f70e0000 pid=3831 execve guuid=b2736be4-1600-0000-01d7-b3d7fa0e0000 pid=3834 /usr/bin/mkdir guuid=9ad63ee1-1600-0000-01d7-b3d7ed0e0000 pid=3821->guuid=b2736be4-1600-0000-01d7-b3d7fa0e0000 pid=3834 execve guuid=93c225e5-1600-0000-01d7-b3d7ff0e0000 pid=3839 /usr/bin/mkdir guuid=9ad63ee1-1600-0000-01d7-b3d7ed0e0000 pid=3821->guuid=93c225e5-1600-0000-01d7-b3d7ff0e0000 pid=3839 execve guuid=c868cee5-1600-0000-01d7-b3d7000f0000 pid=3840 /usr/bin/mkdir guuid=9ad63ee1-1600-0000-01d7-b3d7ed0e0000 pid=3821->guuid=c868cee5-1600-0000-01d7-b3d7000f0000 pid=3840 execve guuid=972746e6-1600-0000-01d7-b3d7010f0000 pid=3841 /usr/bin/mkdir guuid=9ad63ee1-1600-0000-01d7-b3d7ed0e0000 pid=3821->guuid=972746e6-1600-0000-01d7-b3d7010f0000 pid=3841 execve guuid=80a39ee6-1600-0000-01d7-b3d7050f0000 pid=3845 /usr/bin/mkdir guuid=9ad63ee1-1600-0000-01d7-b3d7ed0e0000 pid=3821->guuid=80a39ee6-1600-0000-01d7-b3d7050f0000 pid=3845 execve guuid=f83ffbe6-1600-0000-01d7-b3d7060f0000 pid=3846 /usr/bin/mkdir guuid=9ad63ee1-1600-0000-01d7-b3d7ed0e0000 pid=3821->guuid=f83ffbe6-1600-0000-01d7-b3d7060f0000 pid=3846 execve guuid=b9b05ceb-1600-0000-01d7-b3d7100f0000 pid=3856 /usr/bin/mkdir guuid=9ad63ee1-1600-0000-01d7-b3d7ed0e0000 pid=3821->guuid=b9b05ceb-1600-0000-01d7-b3d7100f0000 pid=3856 execve guuid=a8e6b4eb-1600-0000-01d7-b3d7120f0000 pid=3858 /usr/bin/mkdir guuid=9ad63ee1-1600-0000-01d7-b3d7ed0e0000 pid=3821->guuid=a8e6b4eb-1600-0000-01d7-b3d7120f0000 pid=3858 execve guuid=8b932cec-1600-0000-01d7-b3d7140f0000 pid=3860 /usr/bin/mkdir guuid=9ad63ee1-1600-0000-01d7-b3d7ed0e0000 pid=3821->guuid=8b932cec-1600-0000-01d7-b3d7140f0000 pid=3860 execve guuid=4fa3a4ec-1600-0000-01d7-b3d7150f0000 pid=3861 /usr/bin/cp guuid=9ad63ee1-1600-0000-01d7-b3d7ed0e0000 pid=3821->guuid=4fa3a4ec-1600-0000-01d7-b3d7150f0000 pid=3861 execve guuid=f7e147ed-1600-0000-01d7-b3d7190f0000 pid=3865 /usr/bin/cp guuid=9ad63ee1-1600-0000-01d7-b3d7ed0e0000 pid=3821->guuid=f7e147ed-1600-0000-01d7-b3d7190f0000 pid=3865 execve guuid=5f10d0ed-1600-0000-01d7-b3d71d0f0000 pid=3869 /usr/bin/cp guuid=9ad63ee1-1600-0000-01d7-b3d7ed0e0000 pid=3821->guuid=5f10d0ed-1600-0000-01d7-b3d71d0f0000 pid=3869 execve guuid=a9d1a6f0-1600-0000-01d7-b3d72c0f0000 pid=3884 /usr/bin/cp guuid=9ad63ee1-1600-0000-01d7-b3d7ed0e0000 pid=3821->guuid=a9d1a6f0-1600-0000-01d7-b3d72c0f0000 pid=3884 execve guuid=758928f2-1600-0000-01d7-b3d7320f0000 pid=3890 /usr/bin/cp guuid=9ad63ee1-1600-0000-01d7-b3d7ed0e0000 pid=3821->guuid=758928f2-1600-0000-01d7-b3d7320f0000 pid=3890 execve guuid=33faccf2-1600-0000-01d7-b3d7370f0000 pid=3895 /usr/bin/cp guuid=9ad63ee1-1600-0000-01d7-b3d7ed0e0000 pid=3821->guuid=33faccf2-1600-0000-01d7-b3d7370f0000 pid=3895 execve guuid=c93c76f3-1600-0000-01d7-b3d73a0f0000 pid=3898 /usr/bin/cp guuid=9ad63ee1-1600-0000-01d7-b3d7ed0e0000 pid=3821->guuid=c93c76f3-1600-0000-01d7-b3d73a0f0000 pid=3898 execve guuid=69c620f4-1600-0000-01d7-b3d73e0f0000 pid=3902 /usr/bin/cp guuid=9ad63ee1-1600-0000-01d7-b3d7ed0e0000 pid=3821->guuid=69c620f4-1600-0000-01d7-b3d73e0f0000 pid=3902 execve guuid=377ccdf4-1600-0000-01d7-b3d7410f0000 pid=3905 /usr/bin/cp guuid=9ad63ee1-1600-0000-01d7-b3d7ed0e0000 pid=3821->guuid=377ccdf4-1600-0000-01d7-b3d7410f0000 pid=3905 execve guuid=41e67bf5-1600-0000-01d7-b3d7480f0000 pid=3912 /usr/bin/cp guuid=9ad63ee1-1600-0000-01d7-b3d7ed0e0000 pid=3821->guuid=41e67bf5-1600-0000-01d7-b3d7480f0000 pid=3912 execve guuid=3c5e24f6-1600-0000-01d7-b3d74b0f0000 pid=3915 /usr/bin/cp guuid=9ad63ee1-1600-0000-01d7-b3d7ed0e0000 pid=3821->guuid=3c5e24f6-1600-0000-01d7-b3d74b0f0000 pid=3915 execve guuid=5817caf6-1600-0000-01d7-b3d74e0f0000 pid=3918 /usr/bin/cp guuid=9ad63ee1-1600-0000-01d7-b3d7ed0e0000 pid=3821->guuid=5817caf6-1600-0000-01d7-b3d74e0f0000 pid=3918 execve guuid=51bd54f7-1600-0000-01d7-b3d7510f0000 pid=3921 /usr/bin/cp guuid=9ad63ee1-1600-0000-01d7-b3d7ed0e0000 pid=3821->guuid=51bd54f7-1600-0000-01d7-b3d7510f0000 pid=3921 execve guuid=4de0b5f7-1600-0000-01d7-b3d7540f0000 pid=3924 /usr/bin/cp guuid=9ad63ee1-1600-0000-01d7-b3d7ed0e0000 pid=3821->guuid=4de0b5f7-1600-0000-01d7-b3d7540f0000 pid=3924 execve guuid=cc8764f8-1600-0000-01d7-b3d7580f0000 pid=3928 /usr/bin/touch guuid=9ad63ee1-1600-0000-01d7-b3d7ed0e0000 pid=3821->guuid=cc8764f8-1600-0000-01d7-b3d7580f0000 pid=3928 execve guuid=71badff8-1600-0000-01d7-b3d75d0f0000 pid=3933 /usr/bin/chmod guuid=9ad63ee1-1600-0000-01d7-b3d7ed0e0000 pid=3821->guuid=71badff8-1600-0000-01d7-b3d75d0f0000 pid=3933 execve guuid=3e9d43f9-1600-0000-01d7-b3d7620f0000 pid=3938 /usr/bin/chmod guuid=9ad63ee1-1600-0000-01d7-b3d7ed0e0000 pid=3821->guuid=3e9d43f9-1600-0000-01d7-b3d7620f0000 pid=3938 execve guuid=6d929cf9-1600-0000-01d7-b3d7640f0000 pid=3940 /usr/bin/chattr guuid=9ad63ee1-1600-0000-01d7-b3d7ed0e0000 pid=3821->guuid=6d929cf9-1600-0000-01d7-b3d7640f0000 pid=3940 execve guuid=5a7904fa-1600-0000-01d7-b3d7670f0000 pid=3943 /usr/bin/chattr guuid=9ad63ee1-1600-0000-01d7-b3d7ed0e0000 pid=3821->guuid=5a7904fa-1600-0000-01d7-b3d7670f0000 pid=3943 execve guuid=31a546fa-1600-0000-01d7-b3d7690f0000 pid=3945 /usr/bin/chattr guuid=9ad63ee1-1600-0000-01d7-b3d7ed0e0000 pid=3821->guuid=31a546fa-1600-0000-01d7-b3d7690f0000 pid=3945 execve guuid=eac887fa-1600-0000-01d7-b3d76b0f0000 pid=3947 /usr/bin/chattr guuid=9ad63ee1-1600-0000-01d7-b3d7ed0e0000 pid=3821->guuid=eac887fa-1600-0000-01d7-b3d76b0f0000 pid=3947 execve guuid=2c39cafa-1600-0000-01d7-b3d76d0f0000 pid=3949 /usr/bin/chattr guuid=9ad63ee1-1600-0000-01d7-b3d7ed0e0000 pid=3821->guuid=2c39cafa-1600-0000-01d7-b3d76d0f0000 pid=3949 execve guuid=5ea10cfb-1600-0000-01d7-b3d76f0f0000 pid=3951 /usr/bin/chattr guuid=9ad63ee1-1600-0000-01d7-b3d7ed0e0000 pid=3821->guuid=5ea10cfb-1600-0000-01d7-b3d76f0f0000 pid=3951 execve guuid=020d60fb-1600-0000-01d7-b3d7710f0000 pid=3953 /usr/bin/chattr guuid=9ad63ee1-1600-0000-01d7-b3d7ed0e0000 pid=3821->guuid=020d60fb-1600-0000-01d7-b3d7710f0000 pid=3953 execve guuid=a21da5fb-1600-0000-01d7-b3d7730f0000 pid=3955 /usr/bin/chattr guuid=9ad63ee1-1600-0000-01d7-b3d7ed0e0000 pid=3821->guuid=a21da5fb-1600-0000-01d7-b3d7730f0000 pid=3955 execve guuid=5030eefb-1600-0000-01d7-b3d7760f0000 pid=3958 /usr/bin/bash guuid=9ad63ee1-1600-0000-01d7-b3d7ed0e0000 pid=3821->guuid=5030eefb-1600-0000-01d7-b3d7760f0000 pid=3958 clone guuid=e774f6fb-1600-0000-01d7-b3d7770f0000 pid=3959 /usr/bin/bash guuid=9ad63ee1-1600-0000-01d7-b3d7ed0e0000 pid=3821->guuid=e774f6fb-1600-0000-01d7-b3d7770f0000 pid=3959 clone guuid=f15114fc-1600-0000-01d7-b3d7780f0000 pid=3960 /usr/bin/curl net send-data guuid=9ad63ee1-1600-0000-01d7-b3d7ed0e0000 pid=3821->guuid=f15114fc-1600-0000-01d7-b3d7780f0000 pid=3960 execve guuid=32641afc-1600-0000-01d7-b3d7790f0000 pid=3961 /usr/bin/dash guuid=9ad63ee1-1600-0000-01d7-b3d7ed0e0000 pid=3821->guuid=32641afc-1600-0000-01d7-b3d7790f0000 pid=3961 execve guuid=e3916b04-1700-0000-01d7-b3d7910f0000 pid=3985 /usr/bin/bash guuid=9ad63ee1-1600-0000-01d7-b3d7ed0e0000 pid=3821->guuid=e3916b04-1700-0000-01d7-b3d7910f0000 pid=3985 clone guuid=13627304-1700-0000-01d7-b3d7920f0000 pid=3986 /usr/bin/base64 guuid=9ad63ee1-1600-0000-01d7-b3d7ed0e0000 pid=3821->guuid=13627304-1700-0000-01d7-b3d7920f0000 pid=3986 execve guuid=a4947b04-1700-0000-01d7-b3d7930f0000 pid=3987 /usr/bin/tee write-file guuid=9ad63ee1-1600-0000-01d7-b3d7ed0e0000 pid=3821->guuid=a4947b04-1700-0000-01d7-b3d7930f0000 pid=3987 execve guuid=023a0b05-1700-0000-01d7-b3d7950f0000 pid=3989 /usr/bin/bash guuid=9ad63ee1-1600-0000-01d7-b3d7ed0e0000 pid=3821->guuid=023a0b05-1700-0000-01d7-b3d7950f0000 pid=3989 execve guuid=3b8e720c-1700-0000-01d7-b3d7bc0f0000 pid=4028 /usr/bin/bash guuid=9ad63ee1-1600-0000-01d7-b3d7ed0e0000 pid=3821->guuid=3b8e720c-1700-0000-01d7-b3d7bc0f0000 pid=4028 execve guuid=f49fe90c-1700-0000-01d7-b3d7bf0f0000 pid=4031 /usr/bin/rm delete-file guuid=9ad63ee1-1600-0000-01d7-b3d7ed0e0000 pid=3821->guuid=f49fe90c-1700-0000-01d7-b3d7bf0f0000 pid=4031 execve guuid=e8e0380d-1700-0000-01d7-b3d7c00f0000 pid=4032 /usr/bin/rm guuid=9ad63ee1-1600-0000-01d7-b3d7ed0e0000 pid=3821->guuid=e8e0380d-1700-0000-01d7-b3d7c00f0000 pid=4032 execve guuid=1a88850d-1700-0000-01d7-b3d7c20f0000 pid=4034 /usr/bin/curl net send-data guuid=9ad63ee1-1600-0000-01d7-b3d7ed0e0000 pid=3821->guuid=1a88850d-1700-0000-01d7-b3d7c20f0000 pid=4034 execve guuid=0aa68d0d-1700-0000-01d7-b3d7c30f0000 pid=4035 /usr/bin/dash guuid=9ad63ee1-1600-0000-01d7-b3d7ed0e0000 pid=3821->guuid=0aa68d0d-1700-0000-01d7-b3d7c30f0000 pid=4035 execve 124ee36c-bdbd-5d46-bbb1-b2cd81367f04 160.119.69.4:80 guuid=f15114fc-1600-0000-01d7-b3d7780f0000 pid=3960->124ee36c-bdbd-5d46-bbb1-b2cd81367f04 send: 93B guuid=5c258805-1700-0000-01d7-b3d7960f0000 pid=3990 /usr/bin/bash guuid=023a0b05-1700-0000-01d7-b3d7950f0000 pid=3989->guuid=5c258805-1700-0000-01d7-b3d7960f0000 pid=3990 clone guuid=532e9c05-1700-0000-01d7-b3d7970f0000 pid=3991 /usr/bin/bash guuid=023a0b05-1700-0000-01d7-b3d7950f0000 pid=3989->guuid=532e9c05-1700-0000-01d7-b3d7970f0000 pid=3991 clone guuid=56060b06-1700-0000-01d7-b3d79b0f0000 pid=3995 /usr/bin/ls guuid=023a0b05-1700-0000-01d7-b3d7950f0000 pid=3989->guuid=56060b06-1700-0000-01d7-b3d79b0f0000 pid=3995 execve guuid=2e43a906-1700-0000-01d7-b3d79f0f0000 pid=3999 /usr/bin/cat guuid=023a0b05-1700-0000-01d7-b3d7950f0000 pid=3989->guuid=2e43a906-1700-0000-01d7-b3d79f0f0000 pid=3999 execve guuid=92691107-1700-0000-01d7-b3d7a00f0000 pid=4000 /usr/bin/ls guuid=023a0b05-1700-0000-01d7-b3d7950f0000 pid=3989->guuid=92691107-1700-0000-01d7-b3d7a00f0000 pid=4000 execve guuid=19939c07-1700-0000-01d7-b3d7a30f0000 pid=4003 /usr/bin/mkdir guuid=023a0b05-1700-0000-01d7-b3d7950f0000 pid=3989->guuid=19939c07-1700-0000-01d7-b3d7a30f0000 pid=4003 execve guuid=bde00208-1700-0000-01d7-b3d7a50f0000 pid=4005 /usr/bin/mv guuid=023a0b05-1700-0000-01d7-b3d7950f0000 pid=3989->guuid=bde00208-1700-0000-01d7-b3d7a50f0000 pid=4005 execve guuid=04847e08-1700-0000-01d7-b3d7a70f0000 pid=4007 /usr/bin/bash guuid=023a0b05-1700-0000-01d7-b3d7950f0000 pid=3989->guuid=04847e08-1700-0000-01d7-b3d7a70f0000 pid=4007 clone guuid=b6e18408-1700-0000-01d7-b3d7a80f0000 pid=4008 /usr/bin/base64 write-file guuid=023a0b05-1700-0000-01d7-b3d7950f0000 pid=3989->guuid=b6e18408-1700-0000-01d7-b3d7a80f0000 pid=4008 execve guuid=6e751709-1700-0000-01d7-b3d7ab0f0000 pid=4011 /usr/bin/rm delete-file guuid=023a0b05-1700-0000-01d7-b3d7950f0000 pid=3989->guuid=6e751709-1700-0000-01d7-b3d7ab0f0000 pid=4011 execve guuid=ca856f09-1700-0000-01d7-b3d7ad0f0000 pid=4013 /usr/bin/mv guuid=023a0b05-1700-0000-01d7-b3d7950f0000 pid=3989->guuid=ca856f09-1700-0000-01d7-b3d7ad0f0000 pid=4013 execve guuid=128cfb09-1700-0000-01d7-b3d7af0f0000 pid=4015 /usr/bin/ls guuid=023a0b05-1700-0000-01d7-b3d7950f0000 pid=3989->guuid=128cfb09-1700-0000-01d7-b3d7af0f0000 pid=4015 execve guuid=bf2b890a-1700-0000-01d7-b3d7b10f0000 pid=4017 /usr/bin/bash guuid=023a0b05-1700-0000-01d7-b3d7950f0000 pid=3989->guuid=bf2b890a-1700-0000-01d7-b3d7b10f0000 pid=4017 clone guuid=d270900a-1700-0000-01d7-b3d7b30f0000 pid=4019 /usr/bin/base64 write-file guuid=023a0b05-1700-0000-01d7-b3d7950f0000 pid=3989->guuid=d270900a-1700-0000-01d7-b3d7b30f0000 pid=4019 execve guuid=352e050b-1700-0000-01d7-b3d7b50f0000 pid=4021 /usr/bin/ls guuid=023a0b05-1700-0000-01d7-b3d7950f0000 pid=3989->guuid=352e050b-1700-0000-01d7-b3d7b50f0000 pid=4021 execve guuid=094e8f0b-1700-0000-01d7-b3d7b90f0000 pid=4025 /usr/bin/cat guuid=023a0b05-1700-0000-01d7-b3d7950f0000 pid=3989->guuid=094e8f0b-1700-0000-01d7-b3d7b90f0000 pid=4025 execve guuid=8149eb0b-1700-0000-01d7-b3d7ba0f0000 pid=4026 /usr/bin/ls guuid=023a0b05-1700-0000-01d7-b3d7950f0000 pid=3989->guuid=8149eb0b-1700-0000-01d7-b3d7ba0f0000 pid=4026 execve guuid=1a88850d-1700-0000-01d7-b3d7c20f0000 pid=4034->124ee36c-bdbd-5d46-bbb1-b2cd81367f04 send: 93B
Score:
82%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/7f4947195d352f01a517e5f472d3ae734d22b1d8a6fc5a69b42e6db42f9a11ef
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7f4947195d352f01a517e5f472d3ae734d22b1d8a6fc5a69b42e6db42f9a11ef/
Threat name:
Linux.Backdoor.WebShell
Create hunting rule
Status:
Malicious
First seen:
2026-07-28 18:53:47 UTC
File Type:
Text (Shell)
AV detection:
11 of 24 (45.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=p5euogk5guxqdjix4x2hfu5oongsfmoyu36fu2nufzw3il42chxq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260728-xjxs9sfm6y/
Behaviour
Reads runtime system information
Writes file to tmp directory
Deobfuscate/Decode Files or Information
Checks CPU configuration
File and Directory Permissions Modification
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.16
Link:
https://yomi.yoroi.company/submissions/7f4947195d352f01a517e5f472d3ae734d22b1d8a6fc5a69b42e6db42f9a11ef

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SUSP_LNX_Base64_Exec_Apr24
Create hunting rule
Author:Christian Burkard
Description:Detects suspicious base64 encoded shell commands (as seen in Palo Alto CVE-2024-3400 exploitation)
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 7f4947195d352f01a517e5f472d3ae734d22b1d8a6fc5a69b42e6db42f9a11ef

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3884408/
  
Delivery method
Distributed via web download

Comments