🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 81591d89a7283bb11e05ce80e00256bea9218acbfcec5542cd9ffda9bd18db8a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry



Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments

SHA256 hash: 81591d89a7283bb11e05ce80e00256bea9218acbfcec5542cd9ffda9bd18db8a
SHA3-384 hash: e76d172e98968ca6cb100951e11e81758048031cb5bdd6c080601066d1b4a394d9dc128e9a091e731d9978da475c569a
SHA1 hash: 55d1c660585e53c3dff552ed6aea123f0ee9332c
MD5 hash: 5411fa5970b362c4f8de9d337ad0e0c2
humanhash: floor-hotel-solar-west
File name:wr.php
Download: download sample
File size:27'042 bytes
First seen:2026-09-14 03:47:38 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 768:X8vCB+25j6es8RGcH9FYpMSUpi+20qUpi+20YQX:X8l25JPhd2QX
TLSH T1A5C28E966A867C44BEC98B3E4CBD2B1D6DF5C3D1324942AC3D8A3C719C11F9CD618B1A
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://160.119.69.4/z/post/noroot.phpn/an/aelf ua-wget

Intelligence


File Origin
# of uploads :
1
# of downloads :
63
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive masquerade
Status:
terminated
Behavior Graph:
%3 guuid=370b88da-1600-0000-d14e-37294b0d0000 pid=3403 /usr/bin/sudo guuid=4e74bce0-1600-0000-d14e-37294f0d0000 pid=3407 /tmp/sample.bin guuid=370b88da-1600-0000-d14e-37294b0d0000 pid=3403->guuid=4e74bce0-1600-0000-d14e-37294f0d0000 pid=3407 execve guuid=e14174e1-1600-0000-d14e-3729500d0000 pid=3408 /usr/bin/bash guuid=4e74bce0-1600-0000-d14e-37294f0d0000 pid=3407->guuid=e14174e1-1600-0000-d14e-3729500d0000 pid=3408 clone guuid=82c1a4e1-1600-0000-d14e-3729510d0000 pid=3409 /usr/bin/base64 guuid=4e74bce0-1600-0000-d14e-37294f0d0000 pid=3407->guuid=82c1a4e1-1600-0000-d14e-3729510d0000 pid=3409 execve guuid=8910d5e1-1600-0000-d14e-3729520d0000 pid=3410 /usr/bin/bash guuid=4e74bce0-1600-0000-d14e-37294f0d0000 pid=3407->guuid=8910d5e1-1600-0000-d14e-3729520d0000 pid=3410 clone guuid=27b940e3-1600-0000-d14e-3729540d0000 pid=3412 /usr/bin/cp guuid=4e74bce0-1600-0000-d14e-37294f0d0000 pid=3407->guuid=27b940e3-1600-0000-d14e-3729540d0000 pid=3412 execve guuid=e17628e4-1600-0000-d14e-3729550d0000 pid=3413 /usr/bin/mkdir guuid=4e74bce0-1600-0000-d14e-37294f0d0000 pid=3407->guuid=e17628e4-1600-0000-d14e-3729550d0000 pid=3413 execve guuid=8045c1e4-1600-0000-d14e-3729570d0000 pid=3415 /usr/bin/mkdir guuid=4e74bce0-1600-0000-d14e-37294f0d0000 pid=3407->guuid=8045c1e4-1600-0000-d14e-3729570d0000 pid=3415 execve guuid=b7d754e6-1600-0000-d14e-37295d0d0000 pid=3421 /usr/bin/mkdir guuid=4e74bce0-1600-0000-d14e-37294f0d0000 pid=3407->guuid=b7d754e6-1600-0000-d14e-37295d0d0000 pid=3421 execve guuid=9b0528e7-1600-0000-d14e-3729600d0000 pid=3424 /usr/bin/mkdir guuid=4e74bce0-1600-0000-d14e-37294f0d0000 pid=3407->guuid=9b0528e7-1600-0000-d14e-3729600d0000 pid=3424 execve guuid=8cc32fe9-1600-0000-d14e-37296a0d0000 pid=3434 /usr/bin/mkdir guuid=4e74bce0-1600-0000-d14e-37294f0d0000 pid=3407->guuid=8cc32fe9-1600-0000-d14e-37296a0d0000 pid=3434 execve guuid=317051ea-1600-0000-d14e-3729700d0000 pid=3440 /usr/bin/mkdir guuid=4e74bce0-1600-0000-d14e-37294f0d0000 pid=3407->guuid=317051ea-1600-0000-d14e-3729700d0000 pid=3440 execve guuid=355d38eb-1600-0000-d14e-3729750d0000 pid=3445 /usr/bin/mkdir guuid=4e74bce0-1600-0000-d14e-37294f0d0000 pid=3407->guuid=355d38eb-1600-0000-d14e-3729750d0000 pid=3445 execve guuid=06e3c7eb-1600-0000-d14e-3729780d0000 pid=3448 /usr/bin/mkdir guuid=4e74bce0-1600-0000-d14e-37294f0d0000 pid=3407->guuid=06e3c7eb-1600-0000-d14e-3729780d0000 pid=3448 execve guuid=0a86b4ec-1600-0000-d14e-37297d0d0000 pid=3453 /usr/bin/mkdir guuid=4e74bce0-1600-0000-d14e-37294f0d0000 pid=3407->guuid=0a86b4ec-1600-0000-d14e-37297d0d0000 pid=3453 execve guuid=40ac5bed-1600-0000-d14e-37297f0d0000 pid=3455 /usr/bin/cp guuid=4e74bce0-1600-0000-d14e-37294f0d0000 pid=3407->guuid=40ac5bed-1600-0000-d14e-37297f0d0000 pid=3455 execve guuid=1d64e1ed-1600-0000-d14e-3729800d0000 pid=3456 /usr/bin/cp guuid=4e74bce0-1600-0000-d14e-37294f0d0000 pid=3407->guuid=1d64e1ed-1600-0000-d14e-3729800d0000 pid=3456 execve guuid=497747ef-1600-0000-d14e-3729830d0000 pid=3459 /usr/bin/cp guuid=4e74bce0-1600-0000-d14e-37294f0d0000 pid=3407->guuid=497747ef-1600-0000-d14e-3729830d0000 pid=3459 execve guuid=9384b6ef-1600-0000-d14e-3729850d0000 pid=3461 /usr/bin/cp guuid=4e74bce0-1600-0000-d14e-37294f0d0000 pid=3407->guuid=9384b6ef-1600-0000-d14e-3729850d0000 pid=3461 execve guuid=c87a16f0-1600-0000-d14e-3729860d0000 pid=3462 /usr/bin/cp guuid=4e74bce0-1600-0000-d14e-37294f0d0000 pid=3407->guuid=c87a16f0-1600-0000-d14e-3729860d0000 pid=3462 execve guuid=0f2d75f0-1600-0000-d14e-3729880d0000 pid=3464 /usr/bin/cp guuid=4e74bce0-1600-0000-d14e-37294f0d0000 pid=3407->guuid=0f2d75f0-1600-0000-d14e-3729880d0000 pid=3464 execve guuid=955ed5f0-1600-0000-d14e-3729890d0000 pid=3465 /usr/bin/cp guuid=4e74bce0-1600-0000-d14e-37294f0d0000 pid=3407->guuid=955ed5f0-1600-0000-d14e-3729890d0000 pid=3465 execve guuid=9bfa37f1-1600-0000-d14e-37298a0d0000 pid=3466 /usr/bin/cp guuid=4e74bce0-1600-0000-d14e-37294f0d0000 pid=3407->guuid=9bfa37f1-1600-0000-d14e-37298a0d0000 pid=3466 execve guuid=f3da94f1-1600-0000-d14e-37298c0d0000 pid=3468 /usr/bin/cp guuid=4e74bce0-1600-0000-d14e-37294f0d0000 pid=3407->guuid=f3da94f1-1600-0000-d14e-37298c0d0000 pid=3468 execve guuid=0a3af5f1-1600-0000-d14e-37298e0d0000 pid=3470 /usr/bin/cp guuid=4e74bce0-1600-0000-d14e-37294f0d0000 pid=3407->guuid=0a3af5f1-1600-0000-d14e-37298e0d0000 pid=3470 execve guuid=e4f156f2-1600-0000-d14e-37298f0d0000 pid=3471 /usr/bin/cp guuid=4e74bce0-1600-0000-d14e-37294f0d0000 pid=3407->guuid=e4f156f2-1600-0000-d14e-37298f0d0000 pid=3471 execve guuid=4383f1f2-1600-0000-d14e-3729900d0000 pid=3472 /usr/bin/cp guuid=4e74bce0-1600-0000-d14e-37294f0d0000 pid=3407->guuid=4383f1f2-1600-0000-d14e-3729900d0000 pid=3472 execve guuid=02b874f3-1600-0000-d14e-3729920d0000 pid=3474 /usr/bin/cp guuid=4e74bce0-1600-0000-d14e-37294f0d0000 pid=3407->guuid=02b874f3-1600-0000-d14e-3729920d0000 pid=3474 execve guuid=3873fcf3-1600-0000-d14e-3729940d0000 pid=3476 /usr/bin/cp guuid=4e74bce0-1600-0000-d14e-37294f0d0000 pid=3407->guuid=3873fcf3-1600-0000-d14e-3729940d0000 pid=3476 execve guuid=dceb75f4-1600-0000-d14e-3729960d0000 pid=3478 /usr/bin/touch guuid=4e74bce0-1600-0000-d14e-37294f0d0000 pid=3407->guuid=dceb75f4-1600-0000-d14e-3729960d0000 pid=3478 execve guuid=440dd2f4-1600-0000-d14e-3729970d0000 pid=3479 /usr/bin/chmod guuid=4e74bce0-1600-0000-d14e-37294f0d0000 pid=3407->guuid=440dd2f4-1600-0000-d14e-3729970d0000 pid=3479 execve guuid=0fb81af5-1600-0000-d14e-3729980d0000 pid=3480 /usr/bin/chmod guuid=4e74bce0-1600-0000-d14e-37294f0d0000 pid=3407->guuid=0fb81af5-1600-0000-d14e-3729980d0000 pid=3480 execve guuid=572b74f5-1600-0000-d14e-37299a0d0000 pid=3482 /usr/bin/chattr guuid=4e74bce0-1600-0000-d14e-37294f0d0000 pid=3407->guuid=572b74f5-1600-0000-d14e-37299a0d0000 pid=3482 execve guuid=91b6d7f5-1600-0000-d14e-37299b0d0000 pid=3483 /usr/bin/chattr guuid=4e74bce0-1600-0000-d14e-37294f0d0000 pid=3407->guuid=91b6d7f5-1600-0000-d14e-37299b0d0000 pid=3483 execve guuid=b9842ff6-1600-0000-d14e-37299d0d0000 pid=3485 /usr/bin/chattr guuid=4e74bce0-1600-0000-d14e-37294f0d0000 pid=3407->guuid=b9842ff6-1600-0000-d14e-37299d0d0000 pid=3485 execve guuid=5a9279f6-1600-0000-d14e-37299f0d0000 pid=3487 /usr/bin/chattr guuid=4e74bce0-1600-0000-d14e-37294f0d0000 pid=3407->guuid=5a9279f6-1600-0000-d14e-37299f0d0000 pid=3487 execve guuid=0920c2f6-1600-0000-d14e-3729a10d0000 pid=3489 /usr/bin/chattr guuid=4e74bce0-1600-0000-d14e-37294f0d0000 pid=3407->guuid=0920c2f6-1600-0000-d14e-3729a10d0000 pid=3489 execve guuid=136212f7-1600-0000-d14e-3729a30d0000 pid=3491 /usr/bin/chattr guuid=4e74bce0-1600-0000-d14e-37294f0d0000 pid=3407->guuid=136212f7-1600-0000-d14e-3729a30d0000 pid=3491 execve guuid=0b615df7-1600-0000-d14e-3729a50d0000 pid=3493 /usr/bin/chattr guuid=4e74bce0-1600-0000-d14e-37294f0d0000 pid=3407->guuid=0b615df7-1600-0000-d14e-3729a50d0000 pid=3493 execve guuid=1421a8f7-1600-0000-d14e-3729a70d0000 pid=3495 /usr/bin/chattr guuid=4e74bce0-1600-0000-d14e-37294f0d0000 pid=3407->guuid=1421a8f7-1600-0000-d14e-3729a70d0000 pid=3495 execve guuid=795ef2f7-1600-0000-d14e-3729a90d0000 pid=3497 /usr/bin/bash guuid=4e74bce0-1600-0000-d14e-37294f0d0000 pid=3407->guuid=795ef2f7-1600-0000-d14e-3729a90d0000 pid=3497 clone guuid=d36300f8-1600-0000-d14e-3729aa0d0000 pid=3498 /usr/bin/bash guuid=4e74bce0-1600-0000-d14e-37294f0d0000 pid=3407->guuid=d36300f8-1600-0000-d14e-3729aa0d0000 pid=3498 clone guuid=67a627f8-1600-0000-d14e-3729ac0d0000 pid=3500 /usr/bin/curl net send-data guuid=4e74bce0-1600-0000-d14e-37294f0d0000 pid=3407->guuid=67a627f8-1600-0000-d14e-3729ac0d0000 pid=3500 execve guuid=8a1934f8-1600-0000-d14e-3729ad0d0000 pid=3501 /usr/bin/dash guuid=4e74bce0-1600-0000-d14e-37294f0d0000 pid=3407->guuid=8a1934f8-1600-0000-d14e-3729ad0d0000 pid=3501 execve guuid=2cad9100-1700-0000-d14e-3729c10d0000 pid=3521 /usr/bin/bash guuid=4e74bce0-1600-0000-d14e-37294f0d0000 pid=3407->guuid=2cad9100-1700-0000-d14e-3729c10d0000 pid=3521 clone guuid=f93c9c00-1700-0000-d14e-3729c20d0000 pid=3522 /usr/bin/base64 guuid=4e74bce0-1600-0000-d14e-37294f0d0000 pid=3407->guuid=f93c9c00-1700-0000-d14e-3729c20d0000 pid=3522 execve guuid=616da500-1700-0000-d14e-3729c30d0000 pid=3523 /usr/bin/tee write-file guuid=4e74bce0-1600-0000-d14e-37294f0d0000 pid=3407->guuid=616da500-1700-0000-d14e-3729c30d0000 pid=3523 execve guuid=1c4d1a02-1700-0000-d14e-3729c70d0000 pid=3527 /usr/bin/bash guuid=4e74bce0-1600-0000-d14e-37294f0d0000 pid=3407->guuid=1c4d1a02-1700-0000-d14e-3729c70d0000 pid=3527 execve guuid=f3a5d20b-1700-0000-d14e-3729f00d0000 pid=3568 /usr/bin/bash guuid=4e74bce0-1600-0000-d14e-37294f0d0000 pid=3407->guuid=f3a5d20b-1700-0000-d14e-3729f00d0000 pid=3568 execve guuid=4e21510c-1700-0000-d14e-3729f10d0000 pid=3569 /usr/bin/rm delete-file guuid=4e74bce0-1600-0000-d14e-37294f0d0000 pid=3407->guuid=4e21510c-1700-0000-d14e-3729f10d0000 pid=3569 execve guuid=981bb50c-1700-0000-d14e-3729f50d0000 pid=3573 /usr/bin/rm guuid=4e74bce0-1600-0000-d14e-37294f0d0000 pid=3407->guuid=981bb50c-1700-0000-d14e-3729f50d0000 pid=3573 execve guuid=82810d0d-1700-0000-d14e-3729f70d0000 pid=3575 /usr/bin/curl net send-data guuid=4e74bce0-1600-0000-d14e-37294f0d0000 pid=3407->guuid=82810d0d-1700-0000-d14e-3729f70d0000 pid=3575 execve guuid=acf9150d-1700-0000-d14e-3729f80d0000 pid=3576 /usr/bin/dash guuid=4e74bce0-1600-0000-d14e-37294f0d0000 pid=3407->guuid=acf9150d-1700-0000-d14e-3729f80d0000 pid=3576 execve 124ee36c-bdbd-5d46-bbb1-b2cd81367f04 160.119.69.4:80 guuid=67a627f8-1600-0000-d14e-3729ac0d0000 pid=3500->124ee36c-bdbd-5d46-bbb1-b2cd81367f04 send: 93B guuid=fce52303-1700-0000-d14e-3729c90d0000 pid=3529 /usr/bin/bash guuid=1c4d1a02-1700-0000-d14e-3729c70d0000 pid=3527->guuid=fce52303-1700-0000-d14e-3729c90d0000 pid=3529 clone guuid=dd637203-1700-0000-d14e-3729ca0d0000 pid=3530 /usr/bin/bash guuid=1c4d1a02-1700-0000-d14e-3729c70d0000 pid=3527->guuid=dd637203-1700-0000-d14e-3729ca0d0000 pid=3530 clone guuid=1267e003-1700-0000-d14e-3729cc0d0000 pid=3532 /usr/bin/ls guuid=1c4d1a02-1700-0000-d14e-3729c70d0000 pid=3527->guuid=1267e003-1700-0000-d14e-3729cc0d0000 pid=3532 execve guuid=6339f404-1700-0000-d14e-3729cf0d0000 pid=3535 /usr/bin/cat guuid=1c4d1a02-1700-0000-d14e-3729c70d0000 pid=3527->guuid=6339f404-1700-0000-d14e-3729cf0d0000 pid=3535 execve guuid=a57f6f05-1700-0000-d14e-3729d10d0000 pid=3537 /usr/bin/ls guuid=1c4d1a02-1700-0000-d14e-3729c70d0000 pid=3527->guuid=a57f6f05-1700-0000-d14e-3729d10d0000 pid=3537 execve guuid=2b760806-1700-0000-d14e-3729d40d0000 pid=3540 /usr/bin/mkdir guuid=1c4d1a02-1700-0000-d14e-3729c70d0000 pid=3527->guuid=2b760806-1700-0000-d14e-3729d40d0000 pid=3540 execve guuid=e7738d06-1700-0000-d14e-3729d60d0000 pid=3542 /usr/bin/mv guuid=1c4d1a02-1700-0000-d14e-3729c70d0000 pid=3527->guuid=e7738d06-1700-0000-d14e-3729d60d0000 pid=3542 execve guuid=49c71207-1700-0000-d14e-3729d90d0000 pid=3545 /usr/bin/bash guuid=1c4d1a02-1700-0000-d14e-3729c70d0000 pid=3527->guuid=49c71207-1700-0000-d14e-3729d90d0000 pid=3545 clone guuid=7d151a07-1700-0000-d14e-3729da0d0000 pid=3546 /usr/bin/base64 write-file guuid=1c4d1a02-1700-0000-d14e-3729c70d0000 pid=3527->guuid=7d151a07-1700-0000-d14e-3729da0d0000 pid=3546 execve guuid=72f6d507-1700-0000-d14e-3729dc0d0000 pid=3548 /usr/bin/rm delete-file guuid=1c4d1a02-1700-0000-d14e-3729c70d0000 pid=3527->guuid=72f6d507-1700-0000-d14e-3729dc0d0000 pid=3548 execve guuid=77634c08-1700-0000-d14e-3729e00d0000 pid=3552 /usr/bin/mv guuid=1c4d1a02-1700-0000-d14e-3729c70d0000 pid=3527->guuid=77634c08-1700-0000-d14e-3729e00d0000 pid=3552 execve guuid=8f2fee08-1700-0000-d14e-3729e10d0000 pid=3553 /usr/bin/ls guuid=1c4d1a02-1700-0000-d14e-3729c70d0000 pid=3527->guuid=8f2fee08-1700-0000-d14e-3729e10d0000 pid=3553 execve guuid=17d68009-1700-0000-d14e-3729e20d0000 pid=3554 /usr/bin/bash guuid=1c4d1a02-1700-0000-d14e-3729c70d0000 pid=3527->guuid=17d68009-1700-0000-d14e-3729e20d0000 pid=3554 clone guuid=329e8d09-1700-0000-d14e-3729e30d0000 pid=3555 /usr/bin/base64 write-file guuid=1c4d1a02-1700-0000-d14e-3729c70d0000 pid=3527->guuid=329e8d09-1700-0000-d14e-3729e30d0000 pid=3555 execve guuid=471e060a-1700-0000-d14e-3729e60d0000 pid=3558 /usr/bin/ls guuid=1c4d1a02-1700-0000-d14e-3729c70d0000 pid=3527->guuid=471e060a-1700-0000-d14e-3729e60d0000 pid=3558 execve guuid=5154a30a-1700-0000-d14e-3729e80d0000 pid=3560 /usr/bin/cat guuid=1c4d1a02-1700-0000-d14e-3729c70d0000 pid=3527->guuid=5154a30a-1700-0000-d14e-3729e80d0000 pid=3560 execve guuid=b408230b-1700-0000-d14e-3729eb0d0000 pid=3563 /usr/bin/ls guuid=1c4d1a02-1700-0000-d14e-3729c70d0000 pid=3527->guuid=b408230b-1700-0000-d14e-3729eb0d0000 pid=3563 execve guuid=82810d0d-1700-0000-d14e-3729f70d0000 pid=3575->124ee36c-bdbd-5d46-bbb1-b2cd81367f04 send: 93B
Threat name:
Linux.Backdoor.WebShell
Status:
Malicious
First seen:
2026-09-14 03:48:25 UTC
File Type:
Text (Shell)
AV detection:
16 of 36 (44.44%)
Threat level:
  5/5
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Behaviour
Reads runtime system information
Writes file to tmp directory
Deobfuscate/Decode Files or Information
Checks CPU configuration
File and Directory Permissions Modification
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures


MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SUSP_LNX_Base64_Exec_Apr24
Author:Christian Burkard
Description:Detects suspicious base64 encoded shell commands (as seen in Palo Alto CVE-2024-3400 exploitation)
Reference:Internal Research

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 81591d89a7283bb11e05ce80e00256bea9218acbfcec5542cd9ffda9bd18db8a

(this sample)

  
Delivery method
Distributed via web download

Comments