🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 896ae0ba6b9686c9ff56a7455f72be69289ee55ab0e2aae9168cb7f5baa01817. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 896ae0ba6b9686c9ff56a7455f72be69289ee55ab0e2aae9168cb7f5baa01817
SHA3-384 hash: da5b97c0c7b71c34c514ab4d5b14ae36badbf8b5c61b79168923b63b8eb0b1f330fb67e4fc41d87f6340702f4b2b3342
SHA1 hash: 249a07e3a0b3d780f3b5f0f8267812512441e06a
MD5 hash: 39576cc0fa308c776d4c5376fcc8ec29
humanhash: asparagus-pluto-blue-sodium
File name:wr.php
Download: download sample
File size:27'042 bytes
First seen:2026-07-19 00:02:51 UTC
Last seen:2026-07-19 17:41:04 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 768:g8vCB+25j6es8Rs99FYpMSUpi+20qUpi+20YQX:g8l25JWd2QX
TLSH T1CAC27D966A867C44BEC94A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11FACC618B1A
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://160.119.69.4/z/post/noroot.phpn/an/aelf ua-wget

Intelligence

File Origin
# of uploads :
3
# of downloads :
76
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.BV.Agent-BNQ.79332841.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive masquerade
Link:
https://www.filescan.io/uploads/6a5c1459443a831fe6a43f54/reports/59c0eac7-e560-4ee5-a2c5-a07cf905e3c3/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-07-18T22:08:00Z UTC
Last seen:
2026-07-18T22:30:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/896ae0ba6b9686c9ff56a7455f72be69289ee55ab0e2aae9168cb7f5baa01817/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/e8ce79a2-24af-42ed-a2a7-2bcdb262ec98
Behavior Graph:
Download SVG
%3 guuid=a23848be-1800-0000-68fa-707e0d090000 pid=2317 /usr/bin/sudo guuid=1a1667c0-1800-0000-68fa-707e11090000 pid=2321 /tmp/sample.bin guuid=a23848be-1800-0000-68fa-707e0d090000 pid=2317->guuid=1a1667c0-1800-0000-68fa-707e11090000 pid=2321 execve guuid=99be11c1-1800-0000-68fa-707e15090000 pid=2325 /usr/bin/bash guuid=1a1667c0-1800-0000-68fa-707e11090000 pid=2321->guuid=99be11c1-1800-0000-68fa-707e15090000 pid=2325 clone guuid=3cf120c1-1800-0000-68fa-707e16090000 pid=2326 /usr/bin/base64 guuid=1a1667c0-1800-0000-68fa-707e11090000 pid=2321->guuid=3cf120c1-1800-0000-68fa-707e16090000 pid=2326 execve guuid=0ccc37c1-1800-0000-68fa-707e17090000 pid=2327 /usr/bin/bash guuid=1a1667c0-1800-0000-68fa-707e11090000 pid=2321->guuid=0ccc37c1-1800-0000-68fa-707e17090000 pid=2327 clone guuid=7ffb9bc1-1800-0000-68fa-707e19090000 pid=2329 /usr/bin/cp guuid=1a1667c0-1800-0000-68fa-707e11090000 pid=2321->guuid=7ffb9bc1-1800-0000-68fa-707e19090000 pid=2329 execve guuid=2529fec1-1800-0000-68fa-707e1b090000 pid=2331 /usr/bin/mkdir guuid=1a1667c0-1800-0000-68fa-707e11090000 pid=2321->guuid=2529fec1-1800-0000-68fa-707e1b090000 pid=2331 execve guuid=46c464c2-1800-0000-68fa-707e1e090000 pid=2334 /usr/bin/mkdir guuid=1a1667c0-1800-0000-68fa-707e11090000 pid=2321->guuid=46c464c2-1800-0000-68fa-707e1e090000 pid=2334 execve guuid=7460b3c2-1800-0000-68fa-707e20090000 pid=2336 /usr/bin/mkdir guuid=1a1667c0-1800-0000-68fa-707e11090000 pid=2321->guuid=7460b3c2-1800-0000-68fa-707e20090000 pid=2336 execve guuid=bfb905c3-1800-0000-68fa-707e21090000 pid=2337 /usr/bin/mkdir guuid=1a1667c0-1800-0000-68fa-707e11090000 pid=2321->guuid=bfb905c3-1800-0000-68fa-707e21090000 pid=2337 execve guuid=23ac6ac3-1800-0000-68fa-707e23090000 pid=2339 /usr/bin/mkdir guuid=1a1667c0-1800-0000-68fa-707e11090000 pid=2321->guuid=23ac6ac3-1800-0000-68fa-707e23090000 pid=2339 execve guuid=aa43d9c3-1800-0000-68fa-707e24090000 pid=2340 /usr/bin/mkdir guuid=1a1667c0-1800-0000-68fa-707e11090000 pid=2321->guuid=aa43d9c3-1800-0000-68fa-707e24090000 pid=2340 execve guuid=426035c4-1800-0000-68fa-707e25090000 pid=2341 /usr/bin/mkdir guuid=1a1667c0-1800-0000-68fa-707e11090000 pid=2321->guuid=426035c4-1800-0000-68fa-707e25090000 pid=2341 execve guuid=c58e8fc4-1800-0000-68fa-707e27090000 pid=2343 /usr/bin/mkdir guuid=1a1667c0-1800-0000-68fa-707e11090000 pid=2321->guuid=c58e8fc4-1800-0000-68fa-707e27090000 pid=2343 execve guuid=0b53e2c4-1800-0000-68fa-707e29090000 pid=2345 /usr/bin/mkdir guuid=1a1667c0-1800-0000-68fa-707e11090000 pid=2321->guuid=0b53e2c4-1800-0000-68fa-707e29090000 pid=2345 execve guuid=75ae31c5-1800-0000-68fa-707e2b090000 pid=2347 /usr/bin/cp guuid=1a1667c0-1800-0000-68fa-707e11090000 pid=2321->guuid=75ae31c5-1800-0000-68fa-707e2b090000 pid=2347 execve guuid=70c495c5-1800-0000-68fa-707e2e090000 pid=2350 /usr/bin/cp guuid=1a1667c0-1800-0000-68fa-707e11090000 pid=2321->guuid=70c495c5-1800-0000-68fa-707e2e090000 pid=2350 execve guuid=a7c1fac5-1800-0000-68fa-707e30090000 pid=2352 /usr/bin/cp guuid=1a1667c0-1800-0000-68fa-707e11090000 pid=2321->guuid=a7c1fac5-1800-0000-68fa-707e30090000 pid=2352 execve guuid=198f60c6-1800-0000-68fa-707e33090000 pid=2355 /usr/bin/cp guuid=1a1667c0-1800-0000-68fa-707e11090000 pid=2321->guuid=198f60c6-1800-0000-68fa-707e33090000 pid=2355 execve guuid=b305c7c6-1800-0000-68fa-707e34090000 pid=2356 /usr/bin/cp guuid=1a1667c0-1800-0000-68fa-707e11090000 pid=2321->guuid=b305c7c6-1800-0000-68fa-707e34090000 pid=2356 execve guuid=ad7b53c7-1800-0000-68fa-707e36090000 pid=2358 /usr/bin/cp guuid=1a1667c0-1800-0000-68fa-707e11090000 pid=2321->guuid=ad7b53c7-1800-0000-68fa-707e36090000 pid=2358 execve guuid=4940ffc7-1800-0000-68fa-707e37090000 pid=2359 /usr/bin/cp guuid=1a1667c0-1800-0000-68fa-707e11090000 pid=2321->guuid=4940ffc7-1800-0000-68fa-707e37090000 pid=2359 execve guuid=ccc59dc8-1800-0000-68fa-707e38090000 pid=2360 /usr/bin/cp guuid=1a1667c0-1800-0000-68fa-707e11090000 pid=2321->guuid=ccc59dc8-1800-0000-68fa-707e38090000 pid=2360 execve guuid=b14332c9-1800-0000-68fa-707e3a090000 pid=2362 /usr/bin/cp guuid=1a1667c0-1800-0000-68fa-707e11090000 pid=2321->guuid=b14332c9-1800-0000-68fa-707e3a090000 pid=2362 execve guuid=e21fbdc9-1800-0000-68fa-707e3c090000 pid=2364 /usr/bin/cp guuid=1a1667c0-1800-0000-68fa-707e11090000 pid=2321->guuid=e21fbdc9-1800-0000-68fa-707e3c090000 pid=2364 execve guuid=114f4aca-1800-0000-68fa-707e3e090000 pid=2366 /usr/bin/cp guuid=1a1667c0-1800-0000-68fa-707e11090000 pid=2321->guuid=114f4aca-1800-0000-68fa-707e3e090000 pid=2366 execve guuid=5ae4d0ca-1800-0000-68fa-707e41090000 pid=2369 /usr/bin/cp guuid=1a1667c0-1800-0000-68fa-707e11090000 pid=2321->guuid=5ae4d0ca-1800-0000-68fa-707e41090000 pid=2369 execve guuid=9b4138cb-1800-0000-68fa-707e43090000 pid=2371 /usr/bin/cp guuid=1a1667c0-1800-0000-68fa-707e11090000 pid=2321->guuid=9b4138cb-1800-0000-68fa-707e43090000 pid=2371 execve guuid=ce72a3cb-1800-0000-68fa-707e45090000 pid=2373 /usr/bin/cp guuid=1a1667c0-1800-0000-68fa-707e11090000 pid=2321->guuid=ce72a3cb-1800-0000-68fa-707e45090000 pid=2373 execve guuid=4b7229cc-1800-0000-68fa-707e48090000 pid=2376 /usr/bin/touch guuid=1a1667c0-1800-0000-68fa-707e11090000 pid=2321->guuid=4b7229cc-1800-0000-68fa-707e48090000 pid=2376 execve guuid=66b46ccc-1800-0000-68fa-707e4a090000 pid=2378 /usr/bin/chmod guuid=1a1667c0-1800-0000-68fa-707e11090000 pid=2321->guuid=66b46ccc-1800-0000-68fa-707e4a090000 pid=2378 execve guuid=db44b3cc-1800-0000-68fa-707e4c090000 pid=2380 /usr/bin/chmod guuid=1a1667c0-1800-0000-68fa-707e11090000 pid=2321->guuid=db44b3cc-1800-0000-68fa-707e4c090000 pid=2380 execve guuid=990cfbcc-1800-0000-68fa-707e4e090000 pid=2382 /usr/bin/chattr guuid=1a1667c0-1800-0000-68fa-707e11090000 pid=2321->guuid=990cfbcc-1800-0000-68fa-707e4e090000 pid=2382 execve guuid=d5778acd-1800-0000-68fa-707e51090000 pid=2385 /usr/bin/chattr guuid=1a1667c0-1800-0000-68fa-707e11090000 pid=2321->guuid=d5778acd-1800-0000-68fa-707e51090000 pid=2385 execve guuid=39b5fdcd-1800-0000-68fa-707e54090000 pid=2388 /usr/bin/chattr guuid=1a1667c0-1800-0000-68fa-707e11090000 pid=2321->guuid=39b5fdcd-1800-0000-68fa-707e54090000 pid=2388 execve guuid=715a51ce-1800-0000-68fa-707e56090000 pid=2390 /usr/bin/chattr guuid=1a1667c0-1800-0000-68fa-707e11090000 pid=2321->guuid=715a51ce-1800-0000-68fa-707e56090000 pid=2390 execve guuid=3100bfce-1800-0000-68fa-707e58090000 pid=2392 /usr/bin/chattr guuid=1a1667c0-1800-0000-68fa-707e11090000 pid=2321->guuid=3100bfce-1800-0000-68fa-707e58090000 pid=2392 execve guuid=398615cf-1800-0000-68fa-707e5a090000 pid=2394 /usr/bin/chattr guuid=1a1667c0-1800-0000-68fa-707e11090000 pid=2321->guuid=398615cf-1800-0000-68fa-707e5a090000 pid=2394 execve guuid=078698cf-1800-0000-68fa-707e5b090000 pid=2395 /usr/bin/chattr guuid=1a1667c0-1800-0000-68fa-707e11090000 pid=2321->guuid=078698cf-1800-0000-68fa-707e5b090000 pid=2395 execve guuid=2aaf1fd0-1800-0000-68fa-707e5c090000 pid=2396 /usr/bin/chattr guuid=1a1667c0-1800-0000-68fa-707e11090000 pid=2321->guuid=2aaf1fd0-1800-0000-68fa-707e5c090000 pid=2396 execve guuid=724f76d0-1800-0000-68fa-707e5e090000 pid=2398 /usr/bin/bash guuid=1a1667c0-1800-0000-68fa-707e11090000 pid=2321->guuid=724f76d0-1800-0000-68fa-707e5e090000 pid=2398 clone guuid=09d87bd0-1800-0000-68fa-707e5f090000 pid=2399 /usr/bin/bash guuid=1a1667c0-1800-0000-68fa-707e11090000 pid=2321->guuid=09d87bd0-1800-0000-68fa-707e5f090000 pid=2399 clone guuid=d755ced0-1800-0000-68fa-707e62090000 pid=2402 /usr/bin/curl net send-data guuid=1a1667c0-1800-0000-68fa-707e11090000 pid=2321->guuid=d755ced0-1800-0000-68fa-707e62090000 pid=2402 execve guuid=4c54d4d0-1800-0000-68fa-707e63090000 pid=2403 /usr/bin/dash guuid=1a1667c0-1800-0000-68fa-707e11090000 pid=2321->guuid=4c54d4d0-1800-0000-68fa-707e63090000 pid=2403 execve guuid=796c1cd8-1800-0000-68fa-707e70090000 pid=2416 /usr/bin/bash guuid=1a1667c0-1800-0000-68fa-707e11090000 pid=2321->guuid=796c1cd8-1800-0000-68fa-707e70090000 pid=2416 clone guuid=904d25d8-1800-0000-68fa-707e71090000 pid=2417 /usr/bin/base64 guuid=1a1667c0-1800-0000-68fa-707e11090000 pid=2321->guuid=904d25d8-1800-0000-68fa-707e71090000 pid=2417 execve guuid=086d2cd8-1800-0000-68fa-707e72090000 pid=2418 /usr/bin/tee write-file guuid=1a1667c0-1800-0000-68fa-707e11090000 pid=2321->guuid=086d2cd8-1800-0000-68fa-707e72090000 pid=2418 execve guuid=52bec0d8-1800-0000-68fa-707e75090000 pid=2421 /usr/bin/bash guuid=1a1667c0-1800-0000-68fa-707e11090000 pid=2321->guuid=52bec0d8-1800-0000-68fa-707e75090000 pid=2421 execve guuid=fcdf45df-1800-0000-68fa-707e98090000 pid=2456 /usr/bin/bash guuid=1a1667c0-1800-0000-68fa-707e11090000 pid=2321->guuid=fcdf45df-1800-0000-68fa-707e98090000 pid=2456 execve guuid=0ffdefdf-1800-0000-68fa-707e99090000 pid=2457 /usr/bin/rm delete-file guuid=1a1667c0-1800-0000-68fa-707e11090000 pid=2321->guuid=0ffdefdf-1800-0000-68fa-707e99090000 pid=2457 execve guuid=41b843e0-1800-0000-68fa-707e9b090000 pid=2459 /usr/bin/rm guuid=1a1667c0-1800-0000-68fa-707e11090000 pid=2321->guuid=41b843e0-1800-0000-68fa-707e9b090000 pid=2459 execve guuid=55e783e0-1800-0000-68fa-707e9d090000 pid=2461 /usr/bin/curl net send-data guuid=1a1667c0-1800-0000-68fa-707e11090000 pid=2321->guuid=55e783e0-1800-0000-68fa-707e9d090000 pid=2461 execve guuid=da4e8ae0-1800-0000-68fa-707e9e090000 pid=2462 /usr/bin/dash guuid=1a1667c0-1800-0000-68fa-707e11090000 pid=2321->guuid=da4e8ae0-1800-0000-68fa-707e9e090000 pid=2462 execve 124ee36c-bdbd-5d46-bbb1-b2cd81367f04 160.119.69.4:80 guuid=d755ced0-1800-0000-68fa-707e62090000 pid=2402->124ee36c-bdbd-5d46-bbb1-b2cd81367f04 send: 93B guuid=afe32fd9-1800-0000-68fa-707e77090000 pid=2423 /usr/bin/bash guuid=52bec0d8-1800-0000-68fa-707e75090000 pid=2421->guuid=afe32fd9-1800-0000-68fa-707e77090000 pid=2423 clone guuid=59ba37d9-1800-0000-68fa-707e78090000 pid=2424 /usr/bin/bash guuid=52bec0d8-1800-0000-68fa-707e75090000 pid=2421->guuid=59ba37d9-1800-0000-68fa-707e78090000 pid=2424 clone guuid=89e75fd9-1800-0000-68fa-707e79090000 pid=2425 /usr/bin/ls guuid=52bec0d8-1800-0000-68fa-707e75090000 pid=2421->guuid=89e75fd9-1800-0000-68fa-707e79090000 pid=2425 execve guuid=4d2de0d9-1800-0000-68fa-707e7c090000 pid=2428 /usr/bin/cat guuid=52bec0d8-1800-0000-68fa-707e75090000 pid=2421->guuid=4d2de0d9-1800-0000-68fa-707e7c090000 pid=2428 execve guuid=edbb47da-1800-0000-68fa-707e7e090000 pid=2430 /usr/bin/ls guuid=52bec0d8-1800-0000-68fa-707e75090000 pid=2421->guuid=edbb47da-1800-0000-68fa-707e7e090000 pid=2430 execve guuid=49cabada-1800-0000-68fa-707e80090000 pid=2432 /usr/bin/mkdir guuid=52bec0d8-1800-0000-68fa-707e75090000 pid=2421->guuid=49cabada-1800-0000-68fa-707e80090000 pid=2432 execve guuid=03aa13db-1800-0000-68fa-707e82090000 pid=2434 /usr/bin/mv guuid=52bec0d8-1800-0000-68fa-707e75090000 pid=2421->guuid=03aa13db-1800-0000-68fa-707e82090000 pid=2434 execve guuid=2bb385db-1800-0000-68fa-707e84090000 pid=2436 /usr/bin/bash guuid=52bec0d8-1800-0000-68fa-707e75090000 pid=2421->guuid=2bb385db-1800-0000-68fa-707e84090000 pid=2436 clone guuid=75128fdb-1800-0000-68fa-707e85090000 pid=2437 /usr/bin/base64 write-file guuid=52bec0d8-1800-0000-68fa-707e75090000 pid=2421->guuid=75128fdb-1800-0000-68fa-707e85090000 pid=2437 execve guuid=82f9dddb-1800-0000-68fa-707e86090000 pid=2438 /usr/bin/rm delete-file guuid=52bec0d8-1800-0000-68fa-707e75090000 pid=2421->guuid=82f9dddb-1800-0000-68fa-707e86090000 pid=2438 execve guuid=aa3124dc-1800-0000-68fa-707e88090000 pid=2440 /usr/bin/mv guuid=52bec0d8-1800-0000-68fa-707e75090000 pid=2421->guuid=aa3124dc-1800-0000-68fa-707e88090000 pid=2440 execve guuid=5bcdabdc-1800-0000-68fa-707e8b090000 pid=2443 /usr/bin/ls guuid=52bec0d8-1800-0000-68fa-707e75090000 pid=2421->guuid=5bcdabdc-1800-0000-68fa-707e8b090000 pid=2443 execve guuid=14b438dd-1800-0000-68fa-707e8e090000 pid=2446 /usr/bin/bash guuid=52bec0d8-1800-0000-68fa-707e75090000 pid=2421->guuid=14b438dd-1800-0000-68fa-707e8e090000 pid=2446 clone guuid=da3041dd-1800-0000-68fa-707e8f090000 pid=2447 /usr/bin/base64 write-file guuid=52bec0d8-1800-0000-68fa-707e75090000 pid=2421->guuid=da3041dd-1800-0000-68fa-707e8f090000 pid=2447 execve guuid=6698aedd-1800-0000-68fa-707e92090000 pid=2450 /usr/bin/ls guuid=52bec0d8-1800-0000-68fa-707e75090000 pid=2421->guuid=6698aedd-1800-0000-68fa-707e92090000 pid=2450 execve guuid=7f154dde-1800-0000-68fa-707e94090000 pid=2452 /usr/bin/cat guuid=52bec0d8-1800-0000-68fa-707e75090000 pid=2421->guuid=7f154dde-1800-0000-68fa-707e94090000 pid=2452 execve guuid=93c8acde-1800-0000-68fa-707e96090000 pid=2454 /usr/bin/ls guuid=52bec0d8-1800-0000-68fa-707e75090000 pid=2421->guuid=93c8acde-1800-0000-68fa-707e96090000 pid=2454 execve guuid=55e783e0-1800-0000-68fa-707e9d090000 pid=2461->124ee36c-bdbd-5d46-bbb1-b2cd81367f04 send: 93B
Score:
81%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/896ae0ba6b9686c9ff56a7455f72be69289ee55ab0e2aae9168cb7f5baa01817
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/896ae0ba6b9686c9ff56a7455f72be69289ee55ab0e2aae9168cb7f5baa01817/
Threat name:
Linux.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-07-19 00:04:02 UTC
File Type:
Text (Shell)
AV detection:
10 of 24 (41.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rfvobotls2dmt72wu5cv64v6neuj5zk2wdrkv2iwrs37lovadalq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260719-accs7aat8s/
Behaviour
Reads runtime system information
Writes file to tmp directory
Deobfuscate/Decode Files or Information
Checks CPU configuration
File and Directory Permissions Modification
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.10
Link:
https://yomi.yoroi.company/submissions/896ae0ba6b9686c9ff56a7455f72be69289ee55ab0e2aae9168cb7f5baa01817

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SUSP_LNX_Base64_Exec_Apr24
Create hunting rule
Author:Christian Burkard
Description:Detects suspicious base64 encoded shell commands (as seen in Palo Alto CVE-2024-3400 exploitation)
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 896ae0ba6b9686c9ff56a7455f72be69289ee55ab0e2aae9168cb7f5baa01817

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3884409/
  
Delivery method
Distributed via web download

Comments