🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a820797ca6c4df75c6f15aa7923d51c678ece75954b71e85cbb3b3aaef129028. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: a820797ca6c4df75c6f15aa7923d51c678ece75954b71e85cbb3b3aaef129028
SHA3-384 hash: 848bacf445a129d00972100e71fbb466361b299734613410618ffd4b7ce42aeecb7fdb7cea42f9810108a0bd9db99619
SHA1 hash: 2c1e6cbe5f878b4099c4a7b972d264f25263b407
MD5 hash: da5c22c6993e1906502352cc86271124
humanhash: finch-west-gee-ceiling
File name:wr.php
Download: download sample
File size:27'042 bytes
First seen:2026-08-09 13:37:24 UTC
Last seen:2026-08-09 19:09:07 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 768:+8vCB+25j6es8Rg9FYpMSUpi+20qUpi+20YQX:+8l25Jmd2QX
TLSH T17CC27D956A867C44BDC98A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11FACD618B1A
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://160.119.69.4/z/post/noroot.phpn/an/aelf ua-wget

Intelligence

File Origin
# of uploads :
2
# of downloads :
47
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.DownLoader.2862.8284.10752.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive masquerade
Link:
https://www.filescan.io/uploads/6a78829b750d670a1ccb4d7b/reports/6d7ffc8a-67d1-46a9-afab-b777bf58b6ed/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-08-09T11:39:00Z UTC
Last seen:
2026-08-10T05:44:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/a820797ca6c4df75c6f15aa7923d51c678ece75954b71e85cbb3b3aaef129028/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/662dbab0-18ed-4f01-90ee-854dd369b46f
Behavior Graph:
Download SVG
%3 guuid=03266bd3-1900-0000-64ee-91f003070000 pid=1795 /usr/bin/sudo guuid=befd6fd6-1900-0000-64ee-91f006070000 pid=1798 /tmp/sample.bin guuid=03266bd3-1900-0000-64ee-91f003070000 pid=1795->guuid=befd6fd6-1900-0000-64ee-91f006070000 pid=1798 execve guuid=94d666d7-1900-0000-64ee-91f007070000 pid=1799 /usr/bin/bash guuid=befd6fd6-1900-0000-64ee-91f006070000 pid=1798->guuid=94d666d7-1900-0000-64ee-91f007070000 pid=1799 clone guuid=c8d678d7-1900-0000-64ee-91f008070000 pid=1800 /usr/bin/base64 guuid=befd6fd6-1900-0000-64ee-91f006070000 pid=1798->guuid=c8d678d7-1900-0000-64ee-91f008070000 pid=1800 execve guuid=b1de80d7-1900-0000-64ee-91f009070000 pid=1801 /usr/bin/bash guuid=befd6fd6-1900-0000-64ee-91f006070000 pid=1798->guuid=b1de80d7-1900-0000-64ee-91f009070000 pid=1801 clone guuid=3e15cad8-1900-0000-64ee-91f00d070000 pid=1805 /usr/bin/cp guuid=befd6fd6-1900-0000-64ee-91f006070000 pid=1798->guuid=3e15cad8-1900-0000-64ee-91f00d070000 pid=1805 execve guuid=a0237fd9-1900-0000-64ee-91f010070000 pid=1808 /usr/bin/mkdir guuid=befd6fd6-1900-0000-64ee-91f006070000 pid=1798->guuid=a0237fd9-1900-0000-64ee-91f010070000 pid=1808 execve guuid=7e692eda-1900-0000-64ee-91f013070000 pid=1811 /usr/bin/mkdir guuid=befd6fd6-1900-0000-64ee-91f006070000 pid=1798->guuid=7e692eda-1900-0000-64ee-91f013070000 pid=1811 execve guuid=05c2c2da-1900-0000-64ee-91f015070000 pid=1813 /usr/bin/mkdir guuid=befd6fd6-1900-0000-64ee-91f006070000 pid=1798->guuid=05c2c2da-1900-0000-64ee-91f015070000 pid=1813 execve guuid=8dbe57db-1900-0000-64ee-91f017070000 pid=1815 /usr/bin/mkdir guuid=befd6fd6-1900-0000-64ee-91f006070000 pid=1798->guuid=8dbe57db-1900-0000-64ee-91f017070000 pid=1815 execve guuid=700a12dc-1900-0000-64ee-91f018070000 pid=1816 /usr/bin/mkdir guuid=befd6fd6-1900-0000-64ee-91f006070000 pid=1798->guuid=700a12dc-1900-0000-64ee-91f018070000 pid=1816 execve guuid=53a7cbdc-1900-0000-64ee-91f019070000 pid=1817 /usr/bin/mkdir guuid=befd6fd6-1900-0000-64ee-91f006070000 pid=1798->guuid=53a7cbdc-1900-0000-64ee-91f019070000 pid=1817 execve guuid=b40370dd-1900-0000-64ee-91f01b070000 pid=1819 /usr/bin/mkdir guuid=befd6fd6-1900-0000-64ee-91f006070000 pid=1798->guuid=b40370dd-1900-0000-64ee-91f01b070000 pid=1819 execve guuid=dee4f8dd-1900-0000-64ee-91f01e070000 pid=1822 /usr/bin/mkdir guuid=befd6fd6-1900-0000-64ee-91f006070000 pid=1798->guuid=dee4f8dd-1900-0000-64ee-91f01e070000 pid=1822 execve guuid=6cfa7fde-1900-0000-64ee-91f022070000 pid=1826 /usr/bin/mkdir guuid=befd6fd6-1900-0000-64ee-91f006070000 pid=1798->guuid=6cfa7fde-1900-0000-64ee-91f022070000 pid=1826 execve guuid=39da0fdf-1900-0000-64ee-91f024070000 pid=1828 /usr/bin/cp guuid=befd6fd6-1900-0000-64ee-91f006070000 pid=1798->guuid=39da0fdf-1900-0000-64ee-91f024070000 pid=1828 execve guuid=a75fe5df-1900-0000-64ee-91f027070000 pid=1831 /usr/bin/cp guuid=befd6fd6-1900-0000-64ee-91f006070000 pid=1798->guuid=a75fe5df-1900-0000-64ee-91f027070000 pid=1831 execve guuid=54e0a0e0-1900-0000-64ee-91f02b070000 pid=1835 /usr/bin/cp guuid=befd6fd6-1900-0000-64ee-91f006070000 pid=1798->guuid=54e0a0e0-1900-0000-64ee-91f02b070000 pid=1835 execve guuid=cd375ce1-1900-0000-64ee-91f02f070000 pid=1839 /usr/bin/cp guuid=befd6fd6-1900-0000-64ee-91f006070000 pid=1798->guuid=cd375ce1-1900-0000-64ee-91f02f070000 pid=1839 execve guuid=5f9229e2-1900-0000-64ee-91f031070000 pid=1841 /usr/bin/cp guuid=befd6fd6-1900-0000-64ee-91f006070000 pid=1798->guuid=5f9229e2-1900-0000-64ee-91f031070000 pid=1841 execve guuid=62d124e3-1900-0000-64ee-91f032070000 pid=1842 /usr/bin/cp guuid=befd6fd6-1900-0000-64ee-91f006070000 pid=1798->guuid=62d124e3-1900-0000-64ee-91f032070000 pid=1842 execve guuid=98c51ae4-1900-0000-64ee-91f033070000 pid=1843 /usr/bin/cp guuid=befd6fd6-1900-0000-64ee-91f006070000 pid=1798->guuid=98c51ae4-1900-0000-64ee-91f033070000 pid=1843 execve guuid=c7abdce4-1900-0000-64ee-91f036070000 pid=1846 /usr/bin/cp guuid=befd6fd6-1900-0000-64ee-91f006070000 pid=1798->guuid=c7abdce4-1900-0000-64ee-91f036070000 pid=1846 execve guuid=984397e5-1900-0000-64ee-91f038070000 pid=1848 /usr/bin/cp guuid=befd6fd6-1900-0000-64ee-91f006070000 pid=1798->guuid=984397e5-1900-0000-64ee-91f038070000 pid=1848 execve guuid=0ac958e6-1900-0000-64ee-91f03b070000 pid=1851 /usr/bin/cp guuid=befd6fd6-1900-0000-64ee-91f006070000 pid=1798->guuid=0ac958e6-1900-0000-64ee-91f03b070000 pid=1851 execve guuid=f54816e7-1900-0000-64ee-91f03e070000 pid=1854 /usr/bin/cp guuid=befd6fd6-1900-0000-64ee-91f006070000 pid=1798->guuid=f54816e7-1900-0000-64ee-91f03e070000 pid=1854 execve guuid=0055d4e7-1900-0000-64ee-91f042070000 pid=1858 /usr/bin/cp guuid=befd6fd6-1900-0000-64ee-91f006070000 pid=1798->guuid=0055d4e7-1900-0000-64ee-91f042070000 pid=1858 execve guuid=a4d098e8-1900-0000-64ee-91f044070000 pid=1860 /usr/bin/cp guuid=befd6fd6-1900-0000-64ee-91f006070000 pid=1798->guuid=a4d098e8-1900-0000-64ee-91f044070000 pid=1860 execve guuid=964270e9-1900-0000-64ee-91f046070000 pid=1862 /usr/bin/cp guuid=befd6fd6-1900-0000-64ee-91f006070000 pid=1798->guuid=964270e9-1900-0000-64ee-91f046070000 pid=1862 execve guuid=907b30ea-1900-0000-64ee-91f049070000 pid=1865 /usr/bin/touch guuid=befd6fd6-1900-0000-64ee-91f006070000 pid=1798->guuid=907b30ea-1900-0000-64ee-91f049070000 pid=1865 execve guuid=7552bbea-1900-0000-64ee-91f04b070000 pid=1867 /usr/bin/chmod guuid=befd6fd6-1900-0000-64ee-91f006070000 pid=1798->guuid=7552bbea-1900-0000-64ee-91f04b070000 pid=1867 execve guuid=54d22aeb-1900-0000-64ee-91f04e070000 pid=1870 /usr/bin/chmod guuid=befd6fd6-1900-0000-64ee-91f006070000 pid=1798->guuid=54d22aeb-1900-0000-64ee-91f04e070000 pid=1870 execve guuid=a97aa1eb-1900-0000-64ee-91f050070000 pid=1872 /usr/bin/chattr guuid=befd6fd6-1900-0000-64ee-91f006070000 pid=1798->guuid=a97aa1eb-1900-0000-64ee-91f050070000 pid=1872 execve guuid=2ec62cec-1900-0000-64ee-91f052070000 pid=1874 /usr/bin/chattr guuid=befd6fd6-1900-0000-64ee-91f006070000 pid=1798->guuid=2ec62cec-1900-0000-64ee-91f052070000 pid=1874 execve guuid=67f9c0ec-1900-0000-64ee-91f053070000 pid=1875 /usr/bin/chattr guuid=befd6fd6-1900-0000-64ee-91f006070000 pid=1798->guuid=67f9c0ec-1900-0000-64ee-91f053070000 pid=1875 execve guuid=74ea74ed-1900-0000-64ee-91f054070000 pid=1876 /usr/bin/chattr guuid=befd6fd6-1900-0000-64ee-91f006070000 pid=1798->guuid=74ea74ed-1900-0000-64ee-91f054070000 pid=1876 execve guuid=66381fee-1900-0000-64ee-91f055070000 pid=1877 /usr/bin/chattr guuid=befd6fd6-1900-0000-64ee-91f006070000 pid=1798->guuid=66381fee-1900-0000-64ee-91f055070000 pid=1877 execve guuid=20fcbfee-1900-0000-64ee-91f056070000 pid=1878 /usr/bin/chattr guuid=befd6fd6-1900-0000-64ee-91f006070000 pid=1798->guuid=20fcbfee-1900-0000-64ee-91f056070000 pid=1878 execve guuid=ff6464ef-1900-0000-64ee-91f057070000 pid=1879 /usr/bin/chattr guuid=befd6fd6-1900-0000-64ee-91f006070000 pid=1798->guuid=ff6464ef-1900-0000-64ee-91f057070000 pid=1879 execve guuid=19d308f0-1900-0000-64ee-91f058070000 pid=1880 /usr/bin/chattr guuid=befd6fd6-1900-0000-64ee-91f006070000 pid=1798->guuid=19d308f0-1900-0000-64ee-91f058070000 pid=1880 execve guuid=1396aff0-1900-0000-64ee-91f059070000 pid=1881 /usr/bin/bash guuid=befd6fd6-1900-0000-64ee-91f006070000 pid=1798->guuid=1396aff0-1900-0000-64ee-91f059070000 pid=1881 clone guuid=efb5b7f0-1900-0000-64ee-91f05a070000 pid=1882 /usr/bin/bash guuid=befd6fd6-1900-0000-64ee-91f006070000 pid=1798->guuid=efb5b7f0-1900-0000-64ee-91f05a070000 pid=1882 clone guuid=c282e6f0-1900-0000-64ee-91f05c070000 pid=1884 /usr/bin/curl net send-data guuid=befd6fd6-1900-0000-64ee-91f006070000 pid=1798->guuid=c282e6f0-1900-0000-64ee-91f05c070000 pid=1884 execve guuid=cc62f3f0-1900-0000-64ee-91f05d070000 pid=1885 /usr/bin/dash guuid=befd6fd6-1900-0000-64ee-91f006070000 pid=1798->guuid=cc62f3f0-1900-0000-64ee-91f05d070000 pid=1885 execve guuid=38dbdbfe-1900-0000-64ee-91f06c070000 pid=1900 /usr/bin/bash guuid=befd6fd6-1900-0000-64ee-91f006070000 pid=1798->guuid=38dbdbfe-1900-0000-64ee-91f06c070000 pid=1900 clone guuid=29dce4fe-1900-0000-64ee-91f06d070000 pid=1901 /usr/bin/base64 guuid=befd6fd6-1900-0000-64ee-91f006070000 pid=1798->guuid=29dce4fe-1900-0000-64ee-91f06d070000 pid=1901 execve guuid=0e8eeefe-1900-0000-64ee-91f06e070000 pid=1902 /usr/bin/tee write-file guuid=befd6fd6-1900-0000-64ee-91f006070000 pid=1798->guuid=0e8eeefe-1900-0000-64ee-91f06e070000 pid=1902 execve guuid=ae38d1ff-1900-0000-64ee-91f070070000 pid=1904 /usr/bin/bash guuid=befd6fd6-1900-0000-64ee-91f006070000 pid=1798->guuid=ae38d1ff-1900-0000-64ee-91f070070000 pid=1904 execve guuid=5fe4f405-1a00-0000-64ee-91f08d070000 pid=1933 /usr/bin/bash guuid=befd6fd6-1900-0000-64ee-91f006070000 pid=1798->guuid=5fe4f405-1a00-0000-64ee-91f08d070000 pid=1933 execve guuid=994d6306-1a00-0000-64ee-91f08e070000 pid=1934 /usr/bin/rm delete-file guuid=befd6fd6-1900-0000-64ee-91f006070000 pid=1798->guuid=994d6306-1a00-0000-64ee-91f08e070000 pid=1934 execve guuid=c628ae06-1a00-0000-64ee-91f08f070000 pid=1935 /usr/bin/rm guuid=befd6fd6-1900-0000-64ee-91f006070000 pid=1798->guuid=c628ae06-1a00-0000-64ee-91f08f070000 pid=1935 execve guuid=a365f506-1a00-0000-64ee-91f090070000 pid=1936 /usr/bin/curl net send-data guuid=befd6fd6-1900-0000-64ee-91f006070000 pid=1798->guuid=a365f506-1a00-0000-64ee-91f090070000 pid=1936 execve guuid=dbcefb06-1a00-0000-64ee-91f091070000 pid=1937 /usr/bin/dash guuid=befd6fd6-1900-0000-64ee-91f006070000 pid=1798->guuid=dbcefb06-1a00-0000-64ee-91f091070000 pid=1937 execve 124ee36c-bdbd-5d46-bbb1-b2cd81367f04 160.119.69.4:80 guuid=c282e6f0-1900-0000-64ee-91f05c070000 pid=1884->124ee36c-bdbd-5d46-bbb1-b2cd81367f04 send: 93B guuid=fcf81d00-1a00-0000-64ee-91f072070000 pid=1906 /usr/bin/bash guuid=ae38d1ff-1900-0000-64ee-91f070070000 pid=1904->guuid=fcf81d00-1a00-0000-64ee-91f072070000 pid=1906 clone guuid=9a012500-1a00-0000-64ee-91f073070000 pid=1907 /usr/bin/bash guuid=ae38d1ff-1900-0000-64ee-91f070070000 pid=1904->guuid=9a012500-1a00-0000-64ee-91f073070000 pid=1907 clone guuid=e1c84a00-1a00-0000-64ee-91f074070000 pid=1908 /usr/bin/ls guuid=ae38d1ff-1900-0000-64ee-91f070070000 pid=1904->guuid=e1c84a00-1a00-0000-64ee-91f074070000 pid=1908 execve guuid=30c4c700-1a00-0000-64ee-91f075070000 pid=1909 /usr/bin/cat guuid=ae38d1ff-1900-0000-64ee-91f070070000 pid=1904->guuid=30c4c700-1a00-0000-64ee-91f075070000 pid=1909 execve guuid=c0bf0d01-1a00-0000-64ee-91f077070000 pid=1911 /usr/bin/ls guuid=ae38d1ff-1900-0000-64ee-91f070070000 pid=1904->guuid=c0bf0d01-1a00-0000-64ee-91f077070000 pid=1911 execve guuid=42c06f01-1a00-0000-64ee-91f079070000 pid=1913 /usr/bin/mkdir guuid=ae38d1ff-1900-0000-64ee-91f070070000 pid=1904->guuid=42c06f01-1a00-0000-64ee-91f079070000 pid=1913 execve guuid=249eba01-1a00-0000-64ee-91f07a070000 pid=1914 /usr/bin/mv guuid=ae38d1ff-1900-0000-64ee-91f070070000 pid=1904->guuid=249eba01-1a00-0000-64ee-91f07a070000 pid=1914 execve guuid=c98e2802-1a00-0000-64ee-91f07c070000 pid=1916 /usr/bin/bash guuid=ae38d1ff-1900-0000-64ee-91f070070000 pid=1904->guuid=c98e2802-1a00-0000-64ee-91f07c070000 pid=1916 clone guuid=db822d02-1a00-0000-64ee-91f07d070000 pid=1917 /usr/bin/base64 write-file guuid=ae38d1ff-1900-0000-64ee-91f070070000 pid=1904->guuid=db822d02-1a00-0000-64ee-91f07d070000 pid=1917 execve guuid=db74a402-1a00-0000-64ee-91f07f070000 pid=1919 /usr/bin/rm delete-file guuid=ae38d1ff-1900-0000-64ee-91f070070000 pid=1904->guuid=db74a402-1a00-0000-64ee-91f07f070000 pid=1919 execve guuid=0180fe02-1a00-0000-64ee-91f081070000 pid=1921 /usr/bin/mv guuid=ae38d1ff-1900-0000-64ee-91f070070000 pid=1904->guuid=0180fe02-1a00-0000-64ee-91f081070000 pid=1921 execve guuid=c376a603-1a00-0000-64ee-91f084070000 pid=1924 /usr/bin/ls guuid=ae38d1ff-1900-0000-64ee-91f070070000 pid=1904->guuid=c376a603-1a00-0000-64ee-91f084070000 pid=1924 execve guuid=ffd74c04-1a00-0000-64ee-91f087070000 pid=1927 /usr/bin/bash guuid=ae38d1ff-1900-0000-64ee-91f070070000 pid=1904->guuid=ffd74c04-1a00-0000-64ee-91f087070000 pid=1927 clone guuid=25695604-1a00-0000-64ee-91f088070000 pid=1928 /usr/bin/base64 write-file guuid=ae38d1ff-1900-0000-64ee-91f070070000 pid=1904->guuid=25695604-1a00-0000-64ee-91f088070000 pid=1928 execve guuid=62afb604-1a00-0000-64ee-91f08a070000 pid=1930 /usr/bin/ls guuid=ae38d1ff-1900-0000-64ee-91f070070000 pid=1904->guuid=62afb604-1a00-0000-64ee-91f08a070000 pid=1930 execve guuid=cecc1405-1a00-0000-64ee-91f08b070000 pid=1931 /usr/bin/cat guuid=ae38d1ff-1900-0000-64ee-91f070070000 pid=1904->guuid=cecc1405-1a00-0000-64ee-91f08b070000 pid=1931 execve guuid=9f186405-1a00-0000-64ee-91f08c070000 pid=1932 /usr/bin/ls guuid=ae38d1ff-1900-0000-64ee-91f070070000 pid=1904->guuid=9f186405-1a00-0000-64ee-91f08c070000 pid=1932 execve guuid=a365f506-1a00-0000-64ee-91f090070000 pid=1936->124ee36c-bdbd-5d46-bbb1-b2cd81367f04 send: 93B
Score:
81%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/a820797ca6c4df75c6f15aa7923d51c678ece75954b71e85cbb3b3aaef129028
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/a820797ca6c4df75c6f15aa7923d51c678ece75954b71e85cbb3b3aaef129028/
Threat name:
Linux.Backdoor.WebShell
Create hunting rule
Status:
Malicious
First seen:
2026-08-09 13:38:18 UTC
File Type:
Text (Shell)
AV detection:
13 of 24 (54.17%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vaqhs7fgytpxlrxrlktzepkryz4ozz2zks3r5bolwoz2v3yssaua._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260809-qw3fysfp51/
Behaviour
Reads runtime system information
Writes file to tmp directory
Deobfuscate/Decode Files or Information
Checks CPU configuration
File and Directory Permissions Modification
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.16
Link:
https://yomi.yoroi.company/submissions/a820797ca6c4df75c6f15aa7923d51c678ece75954b71e85cbb3b3aaef129028

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SUSP_LNX_Base64_Exec_Apr24
Create hunting rule
Author:Christian Burkard
Description:Detects suspicious base64 encoded shell commands (as seen in Palo Alto CVE-2024-3400 exploitation)
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh a820797ca6c4df75c6f15aa7923d51c678ece75954b71e85cbb3b3aaef129028

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3884409/
  
Delivery method
Distributed via web download

Comments