MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 95ad73d21dd38ec3a931bd347e41405117bda832fb28c2cc44d463cd88e80786. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry



Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments

SHA256 hash: 95ad73d21dd38ec3a931bd347e41405117bda832fb28c2cc44d463cd88e80786
SHA3-384 hash: fe61132a51ed1cba3dded7681534d71beec56ea4bf4e5dd58ac1a8b8f670db5f16b31abc36e39d77d338f53534819f23
SHA1 hash: 6ec0090166af34dd81613e1632db768da9751664
MD5 hash: fffd404ed2dbff6969672a5ab2bd691e
humanhash: bravo-enemy-victor-three
File name:wr.php
Download: download sample
File size:27'042 bytes
First seen:2026-07-16 12:11:25 UTC
Last seen:2026-07-16 23:23:02 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 768:M8vCB+25j6es8Rw9FYpMSUpi+20qUpi+20YQX:M8l25J2d2QX
TLSH T137C27D966A867C44BDC94A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11FACD618B1A
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://160.119.69.4/z/post/noroot.phpn/an/aelf ua-wget

Intelligence


File Origin
# of uploads :
3
# of downloads :
73
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive masquerade
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-07-16T10:29:00Z UTC
Last seen:
2026-07-16T11:01:00Z UTC
Hits:
~10
Status:
terminated
Behavior Graph:
%3 guuid=213f128a-1900-0000-c984-f6c84b0e0000 pid=3659 /usr/bin/sudo guuid=7713868d-1900-0000-c984-f6c8580e0000 pid=3672 /tmp/sample.bin guuid=213f128a-1900-0000-c984-f6c84b0e0000 pid=3659->guuid=7713868d-1900-0000-c984-f6c8580e0000 pid=3672 execve guuid=fb48f68d-1900-0000-c984-f6c85b0e0000 pid=3675 /usr/bin/bash guuid=7713868d-1900-0000-c984-f6c8580e0000 pid=3672->guuid=fb48f68d-1900-0000-c984-f6c85b0e0000 pid=3675 clone guuid=0b4fff8d-1900-0000-c984-f6c85c0e0000 pid=3676 /usr/bin/base64 guuid=7713868d-1900-0000-c984-f6c8580e0000 pid=3672->guuid=0b4fff8d-1900-0000-c984-f6c85c0e0000 pid=3676 execve guuid=e879058e-1900-0000-c984-f6c85d0e0000 pid=3677 /usr/bin/bash guuid=7713868d-1900-0000-c984-f6c8580e0000 pid=3672->guuid=e879058e-1900-0000-c984-f6c85d0e0000 pid=3677 clone guuid=2df0a88e-1900-0000-c984-f6c8620e0000 pid=3682 /usr/bin/cp guuid=7713868d-1900-0000-c984-f6c8580e0000 pid=3672->guuid=2df0a88e-1900-0000-c984-f6c8620e0000 pid=3682 execve guuid=f605398f-1900-0000-c984-f6c8640e0000 pid=3684 /usr/bin/mkdir guuid=7713868d-1900-0000-c984-f6c8580e0000 pid=3672->guuid=f605398f-1900-0000-c984-f6c8640e0000 pid=3684 execve guuid=c266b28f-1900-0000-c984-f6c8670e0000 pid=3687 /usr/bin/mkdir guuid=7713868d-1900-0000-c984-f6c8580e0000 pid=3672->guuid=c266b28f-1900-0000-c984-f6c8670e0000 pid=3687 execve guuid=3adc2d90-1900-0000-c984-f6c8690e0000 pid=3689 /usr/bin/mkdir guuid=7713868d-1900-0000-c984-f6c8580e0000 pid=3672->guuid=3adc2d90-1900-0000-c984-f6c8690e0000 pid=3689 execve guuid=d97c9090-1900-0000-c984-f6c86b0e0000 pid=3691 /usr/bin/mkdir guuid=7713868d-1900-0000-c984-f6c8580e0000 pid=3672->guuid=d97c9090-1900-0000-c984-f6c86b0e0000 pid=3691 execve guuid=77da0a91-1900-0000-c984-f6c86f0e0000 pid=3695 /usr/bin/mkdir guuid=7713868d-1900-0000-c984-f6c8580e0000 pid=3672->guuid=77da0a91-1900-0000-c984-f6c86f0e0000 pid=3695 execve guuid=b69eb491-1900-0000-c984-f6c8730e0000 pid=3699 /usr/bin/mkdir guuid=7713868d-1900-0000-c984-f6c8580e0000 pid=3672->guuid=b69eb491-1900-0000-c984-f6c8730e0000 pid=3699 execve guuid=997d3d92-1900-0000-c984-f6c8750e0000 pid=3701 /usr/bin/mkdir guuid=7713868d-1900-0000-c984-f6c8580e0000 pid=3672->guuid=997d3d92-1900-0000-c984-f6c8750e0000 pid=3701 execve guuid=cc3b2c93-1900-0000-c984-f6c8790e0000 pid=3705 /usr/bin/mkdir guuid=7713868d-1900-0000-c984-f6c8580e0000 pid=3672->guuid=cc3b2c93-1900-0000-c984-f6c8790e0000 pid=3705 execve guuid=37bdfb93-1900-0000-c984-f6c87c0e0000 pid=3708 /usr/bin/mkdir guuid=7713868d-1900-0000-c984-f6c8580e0000 pid=3672->guuid=37bdfb93-1900-0000-c984-f6c87c0e0000 pid=3708 execve guuid=8d917494-1900-0000-c984-f6c87d0e0000 pid=3709 /usr/bin/cp guuid=7713868d-1900-0000-c984-f6c8580e0000 pid=3672->guuid=8d917494-1900-0000-c984-f6c87d0e0000 pid=3709 execve guuid=451a4295-1900-0000-c984-f6c8810e0000 pid=3713 /usr/bin/cp guuid=7713868d-1900-0000-c984-f6c8580e0000 pid=3672->guuid=451a4295-1900-0000-c984-f6c8810e0000 pid=3713 execve guuid=e13de795-1900-0000-c984-f6c8830e0000 pid=3715 /usr/bin/cp guuid=7713868d-1900-0000-c984-f6c8580e0000 pid=3672->guuid=e13de795-1900-0000-c984-f6c8830e0000 pid=3715 execve guuid=ac384396-1900-0000-c984-f6c8860e0000 pid=3718 /usr/bin/cp guuid=7713868d-1900-0000-c984-f6c8580e0000 pid=3672->guuid=ac384396-1900-0000-c984-f6c8860e0000 pid=3718 execve guuid=ea18ad96-1900-0000-c984-f6c8880e0000 pid=3720 /usr/bin/cp guuid=7713868d-1900-0000-c984-f6c8580e0000 pid=3672->guuid=ea18ad96-1900-0000-c984-f6c8880e0000 pid=3720 execve guuid=3d0a1897-1900-0000-c984-f6c88b0e0000 pid=3723 /usr/bin/cp guuid=7713868d-1900-0000-c984-f6c8580e0000 pid=3672->guuid=3d0a1897-1900-0000-c984-f6c88b0e0000 pid=3723 execve guuid=570d6d97-1900-0000-c984-f6c88d0e0000 pid=3725 /usr/bin/cp guuid=7713868d-1900-0000-c984-f6c8580e0000 pid=3672->guuid=570d6d97-1900-0000-c984-f6c88d0e0000 pid=3725 execve guuid=86d0e897-1900-0000-c984-f6c8900e0000 pid=3728 /usr/bin/cp guuid=7713868d-1900-0000-c984-f6c8580e0000 pid=3672->guuid=86d0e897-1900-0000-c984-f6c8900e0000 pid=3728 execve guuid=fc454698-1900-0000-c984-f6c8920e0000 pid=3730 /usr/bin/cp guuid=7713868d-1900-0000-c984-f6c8580e0000 pid=3672->guuid=fc454698-1900-0000-c984-f6c8920e0000 pid=3730 execve guuid=c1f09b98-1900-0000-c984-f6c8940e0000 pid=3732 /usr/bin/cp guuid=7713868d-1900-0000-c984-f6c8580e0000 pid=3672->guuid=c1f09b98-1900-0000-c984-f6c8940e0000 pid=3732 execve guuid=a7952299-1900-0000-c984-f6c8970e0000 pid=3735 /usr/bin/cp guuid=7713868d-1900-0000-c984-f6c8580e0000 pid=3672->guuid=a7952299-1900-0000-c984-f6c8970e0000 pid=3735 execve guuid=1efacb99-1900-0000-c984-f6c89b0e0000 pid=3739 /usr/bin/cp guuid=7713868d-1900-0000-c984-f6c8580e0000 pid=3672->guuid=1efacb99-1900-0000-c984-f6c89b0e0000 pid=3739 execve guuid=d2274d9a-1900-0000-c984-f6c89d0e0000 pid=3741 /usr/bin/cp guuid=7713868d-1900-0000-c984-f6c8580e0000 pid=3672->guuid=d2274d9a-1900-0000-c984-f6c89d0e0000 pid=3741 execve guuid=8922da9a-1900-0000-c984-f6c8a30e0000 pid=3747 /usr/bin/cp guuid=7713868d-1900-0000-c984-f6c8580e0000 pid=3672->guuid=8922da9a-1900-0000-c984-f6c8a30e0000 pid=3747 execve guuid=11cd3e9b-1900-0000-c984-f6c8a70e0000 pid=3751 /usr/bin/touch guuid=7713868d-1900-0000-c984-f6c8580e0000 pid=3672->guuid=11cd3e9b-1900-0000-c984-f6c8a70e0000 pid=3751 execve guuid=77478a9b-1900-0000-c984-f6c8a90e0000 pid=3753 /usr/bin/chmod guuid=7713868d-1900-0000-c984-f6c8580e0000 pid=3672->guuid=77478a9b-1900-0000-c984-f6c8a90e0000 pid=3753 execve guuid=9f92fa9b-1900-0000-c984-f6c8ac0e0000 pid=3756 /usr/bin/chmod guuid=7713868d-1900-0000-c984-f6c8580e0000 pid=3672->guuid=9f92fa9b-1900-0000-c984-f6c8ac0e0000 pid=3756 execve guuid=4b7f5e9c-1900-0000-c984-f6c8af0e0000 pid=3759 /usr/bin/chattr guuid=7713868d-1900-0000-c984-f6c8580e0000 pid=3672->guuid=4b7f5e9c-1900-0000-c984-f6c8af0e0000 pid=3759 execve guuid=909ebe9c-1900-0000-c984-f6c8b20e0000 pid=3762 /usr/bin/chattr guuid=7713868d-1900-0000-c984-f6c8580e0000 pid=3672->guuid=909ebe9c-1900-0000-c984-f6c8b20e0000 pid=3762 execve guuid=7fad049d-1900-0000-c984-f6c8b50e0000 pid=3765 /usr/bin/chattr guuid=7713868d-1900-0000-c984-f6c8580e0000 pid=3672->guuid=7fad049d-1900-0000-c984-f6c8b50e0000 pid=3765 execve guuid=2593529d-1900-0000-c984-f6c8b80e0000 pid=3768 /usr/bin/chattr guuid=7713868d-1900-0000-c984-f6c8580e0000 pid=3672->guuid=2593529d-1900-0000-c984-f6c8b80e0000 pid=3768 execve guuid=b9a99e9d-1900-0000-c984-f6c8ba0e0000 pid=3770 /usr/bin/chattr guuid=7713868d-1900-0000-c984-f6c8580e0000 pid=3672->guuid=b9a99e9d-1900-0000-c984-f6c8ba0e0000 pid=3770 execve guuid=7bb3e39d-1900-0000-c984-f6c8bc0e0000 pid=3772 /usr/bin/chattr guuid=7713868d-1900-0000-c984-f6c8580e0000 pid=3672->guuid=7bb3e39d-1900-0000-c984-f6c8bc0e0000 pid=3772 execve guuid=5eff359e-1900-0000-c984-f6c8bf0e0000 pid=3775 /usr/bin/chattr guuid=7713868d-1900-0000-c984-f6c8580e0000 pid=3672->guuid=5eff359e-1900-0000-c984-f6c8bf0e0000 pid=3775 execve guuid=9ac57d9e-1900-0000-c984-f6c8c20e0000 pid=3778 /usr/bin/chattr guuid=7713868d-1900-0000-c984-f6c8580e0000 pid=3672->guuid=9ac57d9e-1900-0000-c984-f6c8c20e0000 pid=3778 execve guuid=4b56c99e-1900-0000-c984-f6c8c40e0000 pid=3780 /usr/bin/bash guuid=7713868d-1900-0000-c984-f6c8580e0000 pid=3672->guuid=4b56c99e-1900-0000-c984-f6c8c40e0000 pid=3780 clone guuid=a581d09e-1900-0000-c984-f6c8c50e0000 pid=3781 /usr/bin/bash guuid=7713868d-1900-0000-c984-f6c8580e0000 pid=3672->guuid=a581d09e-1900-0000-c984-f6c8c50e0000 pid=3781 clone guuid=11e3f39e-1900-0000-c984-f6c8c70e0000 pid=3783 /usr/bin/curl net send-data guuid=7713868d-1900-0000-c984-f6c8580e0000 pid=3672->guuid=11e3f39e-1900-0000-c984-f6c8c70e0000 pid=3783 execve guuid=66b3fe9e-1900-0000-c984-f6c8c80e0000 pid=3784 /usr/bin/dash guuid=7713868d-1900-0000-c984-f6c8580e0000 pid=3672->guuid=66b3fe9e-1900-0000-c984-f6c8c80e0000 pid=3784 execve guuid=0b0558a3-1900-0000-c984-f6c8e30e0000 pid=3811 /usr/bin/bash guuid=7713868d-1900-0000-c984-f6c8580e0000 pid=3672->guuid=0b0558a3-1900-0000-c984-f6c8e30e0000 pid=3811 clone guuid=599963a3-1900-0000-c984-f6c8e40e0000 pid=3812 /usr/bin/base64 guuid=7713868d-1900-0000-c984-f6c8580e0000 pid=3672->guuid=599963a3-1900-0000-c984-f6c8e40e0000 pid=3812 execve guuid=07bd6ba3-1900-0000-c984-f6c8e50e0000 pid=3813 /usr/bin/tee write-file guuid=7713868d-1900-0000-c984-f6c8580e0000 pid=3672->guuid=07bd6ba3-1900-0000-c984-f6c8e50e0000 pid=3813 execve guuid=e265fea3-1900-0000-c984-f6c8e90e0000 pid=3817 /usr/bin/bash guuid=7713868d-1900-0000-c984-f6c8580e0000 pid=3672->guuid=e265fea3-1900-0000-c984-f6c8e90e0000 pid=3817 execve guuid=39f2a8a9-1900-0000-c984-f6c8150f0000 pid=3861 /usr/bin/bash guuid=7713868d-1900-0000-c984-f6c8580e0000 pid=3672->guuid=39f2a8a9-1900-0000-c984-f6c8150f0000 pid=3861 execve guuid=91b4f4a9-1900-0000-c984-f6c8160f0000 pid=3862 /usr/bin/rm delete-file guuid=7713868d-1900-0000-c984-f6c8580e0000 pid=3672->guuid=91b4f4a9-1900-0000-c984-f6c8160f0000 pid=3862 execve guuid=e2a835aa-1900-0000-c984-f6c8180f0000 pid=3864 /usr/bin/rm guuid=7713868d-1900-0000-c984-f6c8580e0000 pid=3672->guuid=e2a835aa-1900-0000-c984-f6c8180f0000 pid=3864 execve guuid=0a1777aa-1900-0000-c984-f6c8190f0000 pid=3865 /usr/bin/curl net send-data guuid=7713868d-1900-0000-c984-f6c8580e0000 pid=3672->guuid=0a1777aa-1900-0000-c984-f6c8190f0000 pid=3865 execve guuid=89677daa-1900-0000-c984-f6c81a0f0000 pid=3866 /usr/bin/dash guuid=7713868d-1900-0000-c984-f6c8580e0000 pid=3672->guuid=89677daa-1900-0000-c984-f6c81a0f0000 pid=3866 execve 124ee36c-bdbd-5d46-bbb1-b2cd81367f04 160.119.69.4:80 guuid=11e3f39e-1900-0000-c984-f6c8c70e0000 pid=3783->124ee36c-bdbd-5d46-bbb1-b2cd81367f04 send: 93B guuid=4bc551a4-1900-0000-c984-f6c8eb0e0000 pid=3819 /usr/bin/bash guuid=e265fea3-1900-0000-c984-f6c8e90e0000 pid=3817->guuid=4bc551a4-1900-0000-c984-f6c8eb0e0000 pid=3819 clone guuid=622859a4-1900-0000-c984-f6c8ec0e0000 pid=3820 /usr/bin/bash guuid=e265fea3-1900-0000-c984-f6c8e90e0000 pid=3817->guuid=622859a4-1900-0000-c984-f6c8ec0e0000 pid=3820 clone guuid=05618ea4-1900-0000-c984-f6c8ed0e0000 pid=3821 /usr/bin/ls guuid=e265fea3-1900-0000-c984-f6c8e90e0000 pid=3817->guuid=05618ea4-1900-0000-c984-f6c8ed0e0000 pid=3821 execve guuid=4b730ea5-1900-0000-c984-f6c8f00e0000 pid=3824 /usr/bin/cat guuid=e265fea3-1900-0000-c984-f6c8e90e0000 pid=3817->guuid=4b730ea5-1900-0000-c984-f6c8f00e0000 pid=3824 execve guuid=7bdb53a5-1900-0000-c984-f6c8f20e0000 pid=3826 /usr/bin/ls guuid=e265fea3-1900-0000-c984-f6c8e90e0000 pid=3817->guuid=7bdb53a5-1900-0000-c984-f6c8f20e0000 pid=3826 execve guuid=73c4b9a5-1900-0000-c984-f6c8f60e0000 pid=3830 /usr/bin/mkdir guuid=e265fea3-1900-0000-c984-f6c8e90e0000 pid=3817->guuid=73c4b9a5-1900-0000-c984-f6c8f60e0000 pid=3830 execve guuid=cad429a6-1900-0000-c984-f6c8f70e0000 pid=3831 /usr/bin/mv guuid=e265fea3-1900-0000-c984-f6c8e90e0000 pid=3817->guuid=cad429a6-1900-0000-c984-f6c8f70e0000 pid=3831 execve guuid=264493a6-1900-0000-c984-f6c8fb0e0000 pid=3835 /usr/bin/bash guuid=e265fea3-1900-0000-c984-f6c8e90e0000 pid=3817->guuid=264493a6-1900-0000-c984-f6c8fb0e0000 pid=3835 clone guuid=a0fa9ca6-1900-0000-c984-f6c8fc0e0000 pid=3836 /usr/bin/base64 write-file guuid=e265fea3-1900-0000-c984-f6c8e90e0000 pid=3817->guuid=a0fa9ca6-1900-0000-c984-f6c8fc0e0000 pid=3836 execve guuid=bd8909a7-1900-0000-c984-f6c8000f0000 pid=3840 /usr/bin/rm delete-file guuid=e265fea3-1900-0000-c984-f6c8e90e0000 pid=3817->guuid=bd8909a7-1900-0000-c984-f6c8000f0000 pid=3840 execve guuid=ad0b4fa7-1900-0000-c984-f6c8030f0000 pid=3843 /usr/bin/mv guuid=e265fea3-1900-0000-c984-f6c8e90e0000 pid=3817->guuid=ad0b4fa7-1900-0000-c984-f6c8030f0000 pid=3843 execve guuid=20d3a0a7-1900-0000-c984-f6c8050f0000 pid=3845 /usr/bin/ls guuid=e265fea3-1900-0000-c984-f6c8e90e0000 pid=3817->guuid=20d3a0a7-1900-0000-c984-f6c8050f0000 pid=3845 execve guuid=232b0ea8-1900-0000-c984-f6c8090f0000 pid=3849 /usr/bin/bash guuid=e265fea3-1900-0000-c984-f6c8e90e0000 pid=3817->guuid=232b0ea8-1900-0000-c984-f6c8090f0000 pid=3849 clone guuid=674814a8-1900-0000-c984-f6c80b0f0000 pid=3851 /usr/bin/base64 write-file guuid=e265fea3-1900-0000-c984-f6c8e90e0000 pid=3817->guuid=674814a8-1900-0000-c984-f6c80b0f0000 pid=3851 execve guuid=8eb55ba8-1900-0000-c984-f6c80d0f0000 pid=3853 /usr/bin/ls guuid=e265fea3-1900-0000-c984-f6c8e90e0000 pid=3817->guuid=8eb55ba8-1900-0000-c984-f6c80d0f0000 pid=3853 execve guuid=e253b5a8-1900-0000-c984-f6c80f0f0000 pid=3855 /usr/bin/cat guuid=e265fea3-1900-0000-c984-f6c8e90e0000 pid=3817->guuid=e253b5a8-1900-0000-c984-f6c80f0f0000 pid=3855 execve guuid=0f8d10a9-1900-0000-c984-f6c8110f0000 pid=3857 /usr/bin/ls guuid=e265fea3-1900-0000-c984-f6c8e90e0000 pid=3817->guuid=0f8d10a9-1900-0000-c984-f6c8110f0000 pid=3857 execve guuid=0a1777aa-1900-0000-c984-f6c8190f0000 pid=3865->124ee36c-bdbd-5d46-bbb1-b2cd81367f04 send: 93B
Threat name:
Linux.Trojan.Generic
Status:
Suspicious
First seen:
2026-07-16 12:14:49 UTC
File Type:
Text (Shell)
AV detection:
10 of 24 (41.67%)
Threat level:
  5/5
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Behaviour
Reads runtime system information
Writes file to tmp directory
Deobfuscate/Decode Files or Information
Checks CPU configuration
File and Directory Permissions Modification
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures


MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SUSP_LNX_Base64_Exec_Apr24
Author:Christian Burkard
Description:Detects suspicious base64 encoded shell commands (as seen in Palo Alto CVE-2024-3400 exploitation)
Reference:Internal Research

File information


The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh 95ad73d21dd38ec3a931bd347e41405117bda832fb28c2cc44d463cd88e80786

(this sample)

  
Delivery method
Distributed via web download

Comments