MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8e5a69334b73f3fb0e415042d6d62fbbdc994e8d7f5d2f989072d6adffad85b5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8e5a69334b73f3fb0e415042d6d62fbbdc994e8d7f5d2f989072d6adffad85b5
SHA3-384 hash: 49fdc7bba1f825a47bb448f5473e3874e932210a1df44b00f4b69ff8104c2771e0e107384133d68e5113ccf5a194cba0
SHA1 hash: d71d1fda189b66ae5ba05f59b7f5f94ea9fa4023
MD5 hash: f843a09d44d377023171c33f992b3c96
humanhash: sad-sixteen-beer-xray
File name:wr.php
Download: download sample
File size:27'042 bytes
First seen:2026-08-04 20:13:28 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 768:tm8vCB+25j6es8Rnkv9FYpMSUpi+20qUpi+20YQX:I8l25Jkd2QX
TLSH T1E3C28D966A867C44BDC94A3E4CBE2B1D6DF5C3D1324942AC3D8A3C71DC11FACD618B1A
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh

Intelligence

File Origin
# of uploads :
1
# of downloads :
62
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive masquerade
Link:
https://www.filescan.io/uploads/6a72482305e91df9a153547e/reports/fdc31358-6e7d-419f-b36e-1e8d042e9f23/overview
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/58be4023-cec2-43e9-9f3f-0e25c23a84f9
Behavior Graph:
Download SVG
%3 guuid=7c9ca5b8-1800-0000-de7f-acddf00b0000 pid=3056 /usr/bin/sudo guuid=7c96e8bc-1800-0000-de7f-acddf20b0000 pid=3058 /tmp/sample.bin guuid=7c9ca5b8-1800-0000-de7f-acddf00b0000 pid=3056->guuid=7c96e8bc-1800-0000-de7f-acddf20b0000 pid=3058 execve guuid=95d66fbe-1800-0000-de7f-acddf50b0000 pid=3061 /usr/bin/bash guuid=7c96e8bc-1800-0000-de7f-acddf20b0000 pid=3058->guuid=95d66fbe-1800-0000-de7f-acddf50b0000 pid=3061 clone guuid=0000a0be-1800-0000-de7f-acddf60b0000 pid=3062 /usr/bin/base64 guuid=7c96e8bc-1800-0000-de7f-acddf20b0000 pid=3058->guuid=0000a0be-1800-0000-de7f-acddf60b0000 pid=3062 execve guuid=aaaed1be-1800-0000-de7f-acddf80b0000 pid=3064 /usr/bin/bash guuid=7c96e8bc-1800-0000-de7f-acddf20b0000 pid=3058->guuid=aaaed1be-1800-0000-de7f-acddf80b0000 pid=3064 clone guuid=6aa3a1bf-1800-0000-de7f-acddfb0b0000 pid=3067 /usr/bin/cp guuid=7c96e8bc-1800-0000-de7f-acddf20b0000 pid=3058->guuid=6aa3a1bf-1800-0000-de7f-acddfb0b0000 pid=3067 execve guuid=bc9c0ac0-1800-0000-de7f-acddfe0b0000 pid=3070 /usr/bin/mkdir guuid=7c96e8bc-1800-0000-de7f-acddf20b0000 pid=3058->guuid=bc9c0ac0-1800-0000-de7f-acddfe0b0000 pid=3070 execve guuid=d4cd55c0-1800-0000-de7f-acdd000c0000 pid=3072 /usr/bin/mkdir guuid=7c96e8bc-1800-0000-de7f-acddf20b0000 pid=3058->guuid=d4cd55c0-1800-0000-de7f-acdd000c0000 pid=3072 execve guuid=84b29bc0-1800-0000-de7f-acdd020c0000 pid=3074 /usr/bin/mkdir guuid=7c96e8bc-1800-0000-de7f-acddf20b0000 pid=3058->guuid=84b29bc0-1800-0000-de7f-acdd020c0000 pid=3074 execve guuid=a87ee0c0-1800-0000-de7f-acdd030c0000 pid=3075 /usr/bin/mkdir guuid=7c96e8bc-1800-0000-de7f-acddf20b0000 pid=3058->guuid=a87ee0c0-1800-0000-de7f-acdd030c0000 pid=3075 execve guuid=a6e72fc1-1800-0000-de7f-acdd050c0000 pid=3077 /usr/bin/mkdir guuid=7c96e8bc-1800-0000-de7f-acddf20b0000 pid=3058->guuid=a6e72fc1-1800-0000-de7f-acdd050c0000 pid=3077 execve guuid=118ca0c1-1800-0000-de7f-acdd080c0000 pid=3080 /usr/bin/mkdir guuid=7c96e8bc-1800-0000-de7f-acddf20b0000 pid=3058->guuid=118ca0c1-1800-0000-de7f-acdd080c0000 pid=3080 execve guuid=57f00cc2-1800-0000-de7f-acdd0b0c0000 pid=3083 /usr/bin/mkdir guuid=7c96e8bc-1800-0000-de7f-acddf20b0000 pid=3058->guuid=57f00cc2-1800-0000-de7f-acdd0b0c0000 pid=3083 execve guuid=478a71c2-1800-0000-de7f-acdd0d0c0000 pid=3085 /usr/bin/mkdir guuid=7c96e8bc-1800-0000-de7f-acddf20b0000 pid=3058->guuid=478a71c2-1800-0000-de7f-acdd0d0c0000 pid=3085 execve guuid=06e0b7c2-1800-0000-de7f-acdd0f0c0000 pid=3087 /usr/bin/mkdir guuid=7c96e8bc-1800-0000-de7f-acddf20b0000 pid=3058->guuid=06e0b7c2-1800-0000-de7f-acdd0f0c0000 pid=3087 execve guuid=1433fdc2-1800-0000-de7f-acdd110c0000 pid=3089 /usr/bin/cp guuid=7c96e8bc-1800-0000-de7f-acddf20b0000 pid=3058->guuid=1433fdc2-1800-0000-de7f-acdd110c0000 pid=3089 execve guuid=d6ef88c3-1800-0000-de7f-acdd130c0000 pid=3091 /usr/bin/cp guuid=7c96e8bc-1800-0000-de7f-acddf20b0000 pid=3058->guuid=d6ef88c3-1800-0000-de7f-acdd130c0000 pid=3091 execve guuid=bfd001c4-1800-0000-de7f-acdd160c0000 pid=3094 /usr/bin/cp guuid=7c96e8bc-1800-0000-de7f-acddf20b0000 pid=3058->guuid=bfd001c4-1800-0000-de7f-acdd160c0000 pid=3094 execve guuid=55d869c4-1800-0000-de7f-acdd180c0000 pid=3096 /usr/bin/cp guuid=7c96e8bc-1800-0000-de7f-acddf20b0000 pid=3058->guuid=55d869c4-1800-0000-de7f-acdd180c0000 pid=3096 execve guuid=2b90d1c4-1800-0000-de7f-acdd1b0c0000 pid=3099 /usr/bin/cp guuid=7c96e8bc-1800-0000-de7f-acddf20b0000 pid=3058->guuid=2b90d1c4-1800-0000-de7f-acdd1b0c0000 pid=3099 execve guuid=7c403dc5-1800-0000-de7f-acdd1d0c0000 pid=3101 /usr/bin/cp guuid=7c96e8bc-1800-0000-de7f-acddf20b0000 pid=3058->guuid=7c403dc5-1800-0000-de7f-acdd1d0c0000 pid=3101 execve guuid=2a2fbbc5-1800-0000-de7f-acdd1e0c0000 pid=3102 /usr/bin/cp guuid=7c96e8bc-1800-0000-de7f-acddf20b0000 pid=3058->guuid=2a2fbbc5-1800-0000-de7f-acdd1e0c0000 pid=3102 execve guuid=ef01eac6-1800-0000-de7f-acdd200c0000 pid=3104 /usr/bin/cp guuid=7c96e8bc-1800-0000-de7f-acddf20b0000 pid=3058->guuid=ef01eac6-1800-0000-de7f-acdd200c0000 pid=3104 execve guuid=951d68c7-1800-0000-de7f-acdd210c0000 pid=3105 /usr/bin/cp guuid=7c96e8bc-1800-0000-de7f-acddf20b0000 pid=3058->guuid=951d68c7-1800-0000-de7f-acdd210c0000 pid=3105 execve guuid=aeccf3c7-1800-0000-de7f-acdd240c0000 pid=3108 /usr/bin/cp guuid=7c96e8bc-1800-0000-de7f-acddf20b0000 pid=3058->guuid=aeccf3c7-1800-0000-de7f-acdd240c0000 pid=3108 execve guuid=0ee280c8-1800-0000-de7f-acdd270c0000 pid=3111 /usr/bin/cp guuid=7c96e8bc-1800-0000-de7f-acddf20b0000 pid=3058->guuid=0ee280c8-1800-0000-de7f-acdd270c0000 pid=3111 execve guuid=30330fc9-1800-0000-de7f-acdd2a0c0000 pid=3114 /usr/bin/cp guuid=7c96e8bc-1800-0000-de7f-acddf20b0000 pid=3058->guuid=30330fc9-1800-0000-de7f-acdd2a0c0000 pid=3114 execve guuid=b6c099c9-1800-0000-de7f-acdd2e0c0000 pid=3118 /usr/bin/cp guuid=7c96e8bc-1800-0000-de7f-acddf20b0000 pid=3058->guuid=b6c099c9-1800-0000-de7f-acdd2e0c0000 pid=3118 execve guuid=981b2bca-1800-0000-de7f-acdd300c0000 pid=3120 /usr/bin/cp guuid=7c96e8bc-1800-0000-de7f-acddf20b0000 pid=3058->guuid=981b2bca-1800-0000-de7f-acdd300c0000 pid=3120 execve guuid=b317d4ca-1800-0000-de7f-acdd310c0000 pid=3121 /usr/bin/touch guuid=7c96e8bc-1800-0000-de7f-acddf20b0000 pid=3058->guuid=b317d4ca-1800-0000-de7f-acdd310c0000 pid=3121 execve guuid=45214bcb-1800-0000-de7f-acdd320c0000 pid=3122 /usr/bin/chmod guuid=7c96e8bc-1800-0000-de7f-acddf20b0000 pid=3058->guuid=45214bcb-1800-0000-de7f-acdd320c0000 pid=3122 execve guuid=128a9ecb-1800-0000-de7f-acdd330c0000 pid=3123 /usr/bin/chmod guuid=7c96e8bc-1800-0000-de7f-acddf20b0000 pid=3058->guuid=128a9ecb-1800-0000-de7f-acdd330c0000 pid=3123 execve guuid=f7b0f6cb-1800-0000-de7f-acdd340c0000 pid=3124 /usr/bin/chattr guuid=7c96e8bc-1800-0000-de7f-acddf20b0000 pid=3058->guuid=f7b0f6cb-1800-0000-de7f-acdd340c0000 pid=3124 execve guuid=939e69cc-1800-0000-de7f-acdd350c0000 pid=3125 /usr/bin/chattr guuid=7c96e8bc-1800-0000-de7f-acddf20b0000 pid=3058->guuid=939e69cc-1800-0000-de7f-acdd350c0000 pid=3125 execve guuid=ef5ac2cc-1800-0000-de7f-acdd360c0000 pid=3126 /usr/bin/chattr guuid=7c96e8bc-1800-0000-de7f-acddf20b0000 pid=3058->guuid=ef5ac2cc-1800-0000-de7f-acdd360c0000 pid=3126 execve guuid=4fa120cd-1800-0000-de7f-acdd370c0000 pid=3127 /usr/bin/chattr guuid=7c96e8bc-1800-0000-de7f-acddf20b0000 pid=3058->guuid=4fa120cd-1800-0000-de7f-acdd370c0000 pid=3127 execve guuid=22697dcd-1800-0000-de7f-acdd380c0000 pid=3128 /usr/bin/chattr guuid=7c96e8bc-1800-0000-de7f-acddf20b0000 pid=3058->guuid=22697dcd-1800-0000-de7f-acdd380c0000 pid=3128 execve guuid=65f4cfcd-1800-0000-de7f-acdd390c0000 pid=3129 /usr/bin/chattr guuid=7c96e8bc-1800-0000-de7f-acddf20b0000 pid=3058->guuid=65f4cfcd-1800-0000-de7f-acdd390c0000 pid=3129 execve guuid=e3162bce-1800-0000-de7f-acdd3a0c0000 pid=3130 /usr/bin/chattr guuid=7c96e8bc-1800-0000-de7f-acddf20b0000 pid=3058->guuid=e3162bce-1800-0000-de7f-acdd3a0c0000 pid=3130 execve guuid=7af49ece-1800-0000-de7f-acdd3b0c0000 pid=3131 /usr/bin/chattr guuid=7c96e8bc-1800-0000-de7f-acddf20b0000 pid=3058->guuid=7af49ece-1800-0000-de7f-acdd3b0c0000 pid=3131 execve guuid=13ffd7cf-1800-0000-de7f-acdd3c0c0000 pid=3132 /usr/bin/bash guuid=7c96e8bc-1800-0000-de7f-acddf20b0000 pid=3058->guuid=13ffd7cf-1800-0000-de7f-acdd3c0c0000 pid=3132 clone guuid=cefddecf-1800-0000-de7f-acdd3d0c0000 pid=3133 /usr/bin/bash guuid=7c96e8bc-1800-0000-de7f-acddf20b0000 pid=3058->guuid=cefddecf-1800-0000-de7f-acdd3d0c0000 pid=3133 clone guuid=8e640ed0-1800-0000-de7f-acdd3e0c0000 pid=3134 /usr/bin/curl net send-data guuid=7c96e8bc-1800-0000-de7f-acddf20b0000 pid=3058->guuid=8e640ed0-1800-0000-de7f-acdd3e0c0000 pid=3134 execve guuid=ce0b16d0-1800-0000-de7f-acdd3f0c0000 pid=3135 /usr/bin/dash guuid=7c96e8bc-1800-0000-de7f-acddf20b0000 pid=3058->guuid=ce0b16d0-1800-0000-de7f-acdd3f0c0000 pid=3135 execve guuid=73dfa8dd-1800-0000-de7f-acdd400c0000 pid=3136 /usr/bin/bash guuid=7c96e8bc-1800-0000-de7f-acddf20b0000 pid=3058->guuid=73dfa8dd-1800-0000-de7f-acdd400c0000 pid=3136 clone guuid=7c4bb3dd-1800-0000-de7f-acdd410c0000 pid=3137 /usr/bin/base64 guuid=7c96e8bc-1800-0000-de7f-acddf20b0000 pid=3058->guuid=7c4bb3dd-1800-0000-de7f-acdd410c0000 pid=3137 execve guuid=1b83bcdd-1800-0000-de7f-acdd420c0000 pid=3138 /usr/bin/tee write-file guuid=7c96e8bc-1800-0000-de7f-acddf20b0000 pid=3058->guuid=1b83bcdd-1800-0000-de7f-acdd420c0000 pid=3138 execve guuid=295909df-1800-0000-de7f-acdd460c0000 pid=3142 /usr/bin/bash guuid=7c96e8bc-1800-0000-de7f-acddf20b0000 pid=3058->guuid=295909df-1800-0000-de7f-acdd460c0000 pid=3142 execve guuid=840108e5-1800-0000-de7f-acdd640c0000 pid=3172 /usr/bin/bash guuid=7c96e8bc-1800-0000-de7f-acddf20b0000 pid=3058->guuid=840108e5-1800-0000-de7f-acdd640c0000 pid=3172 execve guuid=bf055ce5-1800-0000-de7f-acdd660c0000 pid=3174 /usr/bin/rm delete-file guuid=7c96e8bc-1800-0000-de7f-acddf20b0000 pid=3058->guuid=bf055ce5-1800-0000-de7f-acdd660c0000 pid=3174 execve guuid=142997e5-1800-0000-de7f-acdd680c0000 pid=3176 /usr/bin/rm guuid=7c96e8bc-1800-0000-de7f-acddf20b0000 pid=3058->guuid=142997e5-1800-0000-de7f-acdd680c0000 pid=3176 execve guuid=4e1fcfe5-1800-0000-de7f-acdd6a0c0000 pid=3178 /usr/bin/curl net send-data guuid=7c96e8bc-1800-0000-de7f-acddf20b0000 pid=3058->guuid=4e1fcfe5-1800-0000-de7f-acdd6a0c0000 pid=3178 execve guuid=f925d5e5-1800-0000-de7f-acdd6b0c0000 pid=3179 /usr/bin/dash guuid=7c96e8bc-1800-0000-de7f-acddf20b0000 pid=3058->guuid=f925d5e5-1800-0000-de7f-acdd6b0c0000 pid=3179 execve 124ee36c-bdbd-5d46-bbb1-b2cd81367f04 160.119.69.4:80 guuid=8e640ed0-1800-0000-de7f-acdd3e0c0000 pid=3134->124ee36c-bdbd-5d46-bbb1-b2cd81367f04 send: 93B guuid=23ae77df-1800-0000-de7f-acdd490c0000 pid=3145 /usr/bin/bash guuid=295909df-1800-0000-de7f-acdd460c0000 pid=3142->guuid=23ae77df-1800-0000-de7f-acdd490c0000 pid=3145 clone guuid=35e17edf-1800-0000-de7f-acdd4a0c0000 pid=3146 /usr/bin/bash guuid=295909df-1800-0000-de7f-acdd460c0000 pid=3142->guuid=35e17edf-1800-0000-de7f-acdd4a0c0000 pid=3146 clone guuid=2835b3df-1800-0000-de7f-acdd4c0c0000 pid=3148 /usr/bin/ls guuid=295909df-1800-0000-de7f-acdd460c0000 pid=3142->guuid=2835b3df-1800-0000-de7f-acdd4c0c0000 pid=3148 execve guuid=42655be0-1800-0000-de7f-acdd4e0c0000 pid=3150 /usr/bin/cat guuid=295909df-1800-0000-de7f-acdd460c0000 pid=3142->guuid=42655be0-1800-0000-de7f-acdd4e0c0000 pid=3150 execve guuid=18d8c7e0-1800-0000-de7f-acdd500c0000 pid=3152 /usr/bin/ls guuid=295909df-1800-0000-de7f-acdd460c0000 pid=3142->guuid=18d8c7e0-1800-0000-de7f-acdd500c0000 pid=3152 execve guuid=0c714de1-1800-0000-de7f-acdd510c0000 pid=3153 /usr/bin/mkdir guuid=295909df-1800-0000-de7f-acdd460c0000 pid=3142->guuid=0c714de1-1800-0000-de7f-acdd510c0000 pid=3153 execve guuid=e3a0aae1-1800-0000-de7f-acdd520c0000 pid=3154 /usr/bin/mv guuid=295909df-1800-0000-de7f-acdd460c0000 pid=3142->guuid=e3a0aae1-1800-0000-de7f-acdd520c0000 pid=3154 execve guuid=9a6511e2-1800-0000-de7f-acdd530c0000 pid=3155 /usr/bin/bash guuid=295909df-1800-0000-de7f-acdd460c0000 pid=3142->guuid=9a6511e2-1800-0000-de7f-acdd530c0000 pid=3155 clone guuid=18f718e2-1800-0000-de7f-acdd550c0000 pid=3157 /usr/bin/base64 write-file guuid=295909df-1800-0000-de7f-acdd460c0000 pid=3142->guuid=18f718e2-1800-0000-de7f-acdd550c0000 pid=3157 execve guuid=014d68e2-1800-0000-de7f-acdd570c0000 pid=3159 /usr/bin/rm delete-file guuid=295909df-1800-0000-de7f-acdd460c0000 pid=3142->guuid=014d68e2-1800-0000-de7f-acdd570c0000 pid=3159 execve guuid=1b01ace2-1800-0000-de7f-acdd590c0000 pid=3161 /usr/bin/mv guuid=295909df-1800-0000-de7f-acdd460c0000 pid=3142->guuid=1b01ace2-1800-0000-de7f-acdd590c0000 pid=3161 execve guuid=585b11e3-1800-0000-de7f-acdd5c0c0000 pid=3164 /usr/bin/ls guuid=295909df-1800-0000-de7f-acdd460c0000 pid=3142->guuid=585b11e3-1800-0000-de7f-acdd5c0c0000 pid=3164 execve guuid=d3396de3-1800-0000-de7f-acdd5e0c0000 pid=3166 /usr/bin/bash guuid=295909df-1800-0000-de7f-acdd460c0000 pid=3142->guuid=d3396de3-1800-0000-de7f-acdd5e0c0000 pid=3166 clone guuid=224b73e3-1800-0000-de7f-acdd5f0c0000 pid=3167 /usr/bin/base64 write-file guuid=295909df-1800-0000-de7f-acdd460c0000 pid=3142->guuid=224b73e3-1800-0000-de7f-acdd5f0c0000 pid=3167 execve guuid=5b57b9e3-1800-0000-de7f-acdd600c0000 pid=3168 /usr/bin/ls guuid=295909df-1800-0000-de7f-acdd460c0000 pid=3142->guuid=5b57b9e3-1800-0000-de7f-acdd600c0000 pid=3168 execve guuid=c05723e4-1800-0000-de7f-acdd620c0000 pid=3170 /usr/bin/cat guuid=295909df-1800-0000-de7f-acdd460c0000 pid=3142->guuid=c05723e4-1800-0000-de7f-acdd620c0000 pid=3170 execve guuid=c79a86e4-1800-0000-de7f-acdd630c0000 pid=3171 /usr/bin/ls guuid=295909df-1800-0000-de7f-acdd460c0000 pid=3142->guuid=c79a86e4-1800-0000-de7f-acdd630c0000 pid=3171 execve guuid=4e1fcfe5-1800-0000-de7f-acdd6a0c0000 pid=3178->124ee36c-bdbd-5d46-bbb1-b2cd81367f04 send: 93B
Score:
81%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/8e5a69334b73f3fb0e415042d6d62fbbdc994e8d7f5d2f989072d6adffad85b5
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8e5a69334b73f3fb0e415042d6d62fbbdc994e8d7f5d2f989072d6adffad85b5/
Threat name:
Linux.Backdoor.WebShell
Create hunting rule
Status:
Malicious
First seen:
2026-08-04 20:14:35 UTC
File Type:
Text (Shell)
AV detection:
16 of 36 (44.44%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rzngsm2lopz7wdsbkbbnnvrpxpojstunp5os7geqollk375nqw2q._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260804-yznqzadn6v/
Behaviour
Reads runtime system information
Writes file to tmp directory
Deobfuscate/Decode Files or Information
Checks CPU configuration
File and Directory Permissions Modification
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SUSP_LNX_Base64_Exec_Apr24
Create hunting rule
Author:Christian Burkard
Description:Detects suspicious base64 encoded shell commands (as seen in Palo Alto CVE-2024-3400 exploitation)
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 8e5a69334b73f3fb0e415042d6d62fbbdc994e8d7f5d2f989072d6adffad85b5

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3884409/
  
Delivery method
Distributed via web download

Comments