🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ab455bbad0945e254612d4b8deacf31c4fb15d0a5a83728d0fe5da0a6ef61b84. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ab455bbad0945e254612d4b8deacf31c4fb15d0a5a83728d0fe5da0a6ef61b84
SHA3-384 hash: c4a3719c74e830323ef0467d9c134ffafcb42c5e7e48667193b560d1dc836365b278d2effd974a56c230f0119034d00e
SHA1 hash: 49b8f904994b452f3f1bf9936cc12696539dad1a
MD5 hash: 80192bdbe56fa8c2b4ee66613aa30149
humanhash: december-orange-mobile-eleven
File name:wr.php
Download: download sample
File size:27'042 bytes
First seen:2026-07-27 06:51:09 UTC
Last seen:2026-07-28 01:56:43 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 768:6k8vCB+25j6es8R2l9FYpMSUpi+20qUpi+20YQX:z8l25JMd2QX
TLSH T148C27C966A867C44BEC94A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11FACD618B1A
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://160.119.69.4/z/post/noroot.phpn/an/aelf ua-wget

Intelligence

File Origin
# of uploads :
4
# of downloads :
81
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.BV.Agent-BNQ.17166624.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive masquerade
Link:
https://www.filescan.io/uploads/6a670002a1abe6dc0016145e/reports/079f0b47-7be1-4bcf-b149-603397bb6ec3/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-07-27T05:31:00Z UTC
Last seen:
2026-07-28T00:58:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/ab455bbad0945e254612d4b8deacf31c4fb15d0a5a83728d0fe5da0a6ef61b84/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/7b1b4c19-a390-47de-acad-94f43946a1b7
Behavior Graph:
Download SVG
%3 guuid=822ee4a8-1900-0000-f685-dfa1a1090000 pid=2465 /usr/bin/sudo guuid=38cb1cab-1900-0000-f685-dfa1a7090000 pid=2471 /tmp/sample.bin guuid=822ee4a8-1900-0000-f685-dfa1a1090000 pid=2465->guuid=38cb1cab-1900-0000-f685-dfa1a7090000 pid=2471 execve guuid=fb8343ac-1900-0000-f685-dfa1ab090000 pid=2475 /usr/bin/bash guuid=38cb1cab-1900-0000-f685-dfa1a7090000 pid=2471->guuid=fb8343ac-1900-0000-f685-dfa1ab090000 pid=2475 clone guuid=059671ac-1900-0000-f685-dfa1ad090000 pid=2477 /usr/bin/base64 guuid=38cb1cab-1900-0000-f685-dfa1a7090000 pid=2471->guuid=059671ac-1900-0000-f685-dfa1ad090000 pid=2477 execve guuid=07a29fac-1900-0000-f685-dfa1ae090000 pid=2478 /usr/bin/bash guuid=38cb1cab-1900-0000-f685-dfa1a7090000 pid=2471->guuid=07a29fac-1900-0000-f685-dfa1ae090000 pid=2478 clone guuid=06744aad-1900-0000-f685-dfa1b1090000 pid=2481 /usr/bin/cp guuid=38cb1cab-1900-0000-f685-dfa1a7090000 pid=2471->guuid=06744aad-1900-0000-f685-dfa1b1090000 pid=2481 execve guuid=3334d2ad-1900-0000-f685-dfa1b4090000 pid=2484 /usr/bin/mkdir guuid=38cb1cab-1900-0000-f685-dfa1a7090000 pid=2471->guuid=3334d2ad-1900-0000-f685-dfa1b4090000 pid=2484 execve guuid=a9fa24ae-1900-0000-f685-dfa1b6090000 pid=2486 /usr/bin/mkdir guuid=38cb1cab-1900-0000-f685-dfa1a7090000 pid=2471->guuid=a9fa24ae-1900-0000-f685-dfa1b6090000 pid=2486 execve guuid=f04171ae-1900-0000-f685-dfa1b8090000 pid=2488 /usr/bin/mkdir guuid=38cb1cab-1900-0000-f685-dfa1a7090000 pid=2471->guuid=f04171ae-1900-0000-f685-dfa1b8090000 pid=2488 execve guuid=65d2b8ae-1900-0000-f685-dfa1ba090000 pid=2490 /usr/bin/mkdir guuid=38cb1cab-1900-0000-f685-dfa1a7090000 pid=2471->guuid=65d2b8ae-1900-0000-f685-dfa1ba090000 pid=2490 execve guuid=cb8502b0-1900-0000-f685-dfa1be090000 pid=2494 /usr/bin/mkdir guuid=38cb1cab-1900-0000-f685-dfa1a7090000 pid=2471->guuid=cb8502b0-1900-0000-f685-dfa1be090000 pid=2494 execve guuid=b37e83b0-1900-0000-f685-dfa1c0090000 pid=2496 /usr/bin/mkdir guuid=38cb1cab-1900-0000-f685-dfa1a7090000 pid=2471->guuid=b37e83b0-1900-0000-f685-dfa1c0090000 pid=2496 execve guuid=65280bb1-1900-0000-f685-dfa1c3090000 pid=2499 /usr/bin/mkdir guuid=38cb1cab-1900-0000-f685-dfa1a7090000 pid=2471->guuid=65280bb1-1900-0000-f685-dfa1c3090000 pid=2499 execve guuid=8725abb1-1900-0000-f685-dfa1c6090000 pid=2502 /usr/bin/mkdir guuid=38cb1cab-1900-0000-f685-dfa1a7090000 pid=2471->guuid=8725abb1-1900-0000-f685-dfa1c6090000 pid=2502 execve guuid=9fc654b2-1900-0000-f685-dfa1c8090000 pid=2504 /usr/bin/mkdir guuid=38cb1cab-1900-0000-f685-dfa1a7090000 pid=2471->guuid=9fc654b2-1900-0000-f685-dfa1c8090000 pid=2504 execve guuid=a1e3c2b2-1900-0000-f685-dfa1cb090000 pid=2507 /usr/bin/cp guuid=38cb1cab-1900-0000-f685-dfa1a7090000 pid=2471->guuid=a1e3c2b2-1900-0000-f685-dfa1cb090000 pid=2507 execve guuid=f5f9c0b3-1900-0000-f685-dfa1ce090000 pid=2510 /usr/bin/cp guuid=38cb1cab-1900-0000-f685-dfa1a7090000 pid=2471->guuid=f5f9c0b3-1900-0000-f685-dfa1ce090000 pid=2510 execve guuid=2d4349b4-1900-0000-f685-dfa1d0090000 pid=2512 /usr/bin/cp guuid=38cb1cab-1900-0000-f685-dfa1a7090000 pid=2471->guuid=2d4349b4-1900-0000-f685-dfa1d0090000 pid=2512 execve guuid=a3f6e4b4-1900-0000-f685-dfa1d3090000 pid=2515 /usr/bin/cp guuid=38cb1cab-1900-0000-f685-dfa1a7090000 pid=2471->guuid=a3f6e4b4-1900-0000-f685-dfa1d3090000 pid=2515 execve guuid=73a5d8b5-1900-0000-f685-dfa1d7090000 pid=2519 /usr/bin/cp guuid=38cb1cab-1900-0000-f685-dfa1a7090000 pid=2471->guuid=73a5d8b5-1900-0000-f685-dfa1d7090000 pid=2519 execve guuid=cba9a2b6-1900-0000-f685-dfa1da090000 pid=2522 /usr/bin/cp guuid=38cb1cab-1900-0000-f685-dfa1a7090000 pid=2471->guuid=cba9a2b6-1900-0000-f685-dfa1da090000 pid=2522 execve guuid=b10c10b7-1900-0000-f685-dfa1dc090000 pid=2524 /usr/bin/cp guuid=38cb1cab-1900-0000-f685-dfa1a7090000 pid=2471->guuid=b10c10b7-1900-0000-f685-dfa1dc090000 pid=2524 execve guuid=6f5c6db7-1900-0000-f685-dfa1df090000 pid=2527 /usr/bin/cp guuid=38cb1cab-1900-0000-f685-dfa1a7090000 pid=2471->guuid=6f5c6db7-1900-0000-f685-dfa1df090000 pid=2527 execve guuid=44add8b7-1900-0000-f685-dfa1e1090000 pid=2529 /usr/bin/cp guuid=38cb1cab-1900-0000-f685-dfa1a7090000 pid=2471->guuid=44add8b7-1900-0000-f685-dfa1e1090000 pid=2529 execve guuid=882660b8-1900-0000-f685-dfa1e4090000 pid=2532 /usr/bin/cp guuid=38cb1cab-1900-0000-f685-dfa1a7090000 pid=2471->guuid=882660b8-1900-0000-f685-dfa1e4090000 pid=2532 execve guuid=66e8dab8-1900-0000-f685-dfa1e6090000 pid=2534 /usr/bin/cp guuid=38cb1cab-1900-0000-f685-dfa1a7090000 pid=2471->guuid=66e8dab8-1900-0000-f685-dfa1e6090000 pid=2534 execve guuid=922b49b9-1900-0000-f685-dfa1e8090000 pid=2536 /usr/bin/cp guuid=38cb1cab-1900-0000-f685-dfa1a7090000 pid=2471->guuid=922b49b9-1900-0000-f685-dfa1e8090000 pid=2536 execve guuid=e8fbcab9-1900-0000-f685-dfa1ea090000 pid=2538 /usr/bin/cp guuid=38cb1cab-1900-0000-f685-dfa1a7090000 pid=2471->guuid=e8fbcab9-1900-0000-f685-dfa1ea090000 pid=2538 execve guuid=5d3c5fba-1900-0000-f685-dfa1ec090000 pid=2540 /usr/bin/cp guuid=38cb1cab-1900-0000-f685-dfa1a7090000 pid=2471->guuid=5d3c5fba-1900-0000-f685-dfa1ec090000 pid=2540 execve guuid=5fb0eaba-1900-0000-f685-dfa1ee090000 pid=2542 /usr/bin/touch guuid=38cb1cab-1900-0000-f685-dfa1a7090000 pid=2471->guuid=5fb0eaba-1900-0000-f685-dfa1ee090000 pid=2542 execve guuid=69dc53bb-1900-0000-f685-dfa1f0090000 pid=2544 /usr/bin/chmod guuid=38cb1cab-1900-0000-f685-dfa1a7090000 pid=2471->guuid=69dc53bb-1900-0000-f685-dfa1f0090000 pid=2544 execve guuid=b4ecb9bb-1900-0000-f685-dfa1f2090000 pid=2546 /usr/bin/chmod guuid=38cb1cab-1900-0000-f685-dfa1a7090000 pid=2471->guuid=b4ecb9bb-1900-0000-f685-dfa1f2090000 pid=2546 execve guuid=7eb01abc-1900-0000-f685-dfa1f4090000 pid=2548 /usr/bin/chattr guuid=38cb1cab-1900-0000-f685-dfa1a7090000 pid=2471->guuid=7eb01abc-1900-0000-f685-dfa1f4090000 pid=2548 execve guuid=037ba2bc-1900-0000-f685-dfa1f6090000 pid=2550 /usr/bin/chattr guuid=38cb1cab-1900-0000-f685-dfa1a7090000 pid=2471->guuid=037ba2bc-1900-0000-f685-dfa1f6090000 pid=2550 execve guuid=34f20dbd-1900-0000-f685-dfa1f8090000 pid=2552 /usr/bin/chattr guuid=38cb1cab-1900-0000-f685-dfa1a7090000 pid=2471->guuid=34f20dbd-1900-0000-f685-dfa1f8090000 pid=2552 execve guuid=98907abd-1900-0000-f685-dfa1fa090000 pid=2554 /usr/bin/chattr guuid=38cb1cab-1900-0000-f685-dfa1a7090000 pid=2471->guuid=98907abd-1900-0000-f685-dfa1fa090000 pid=2554 execve guuid=ee29d7bd-1900-0000-f685-dfa1fb090000 pid=2555 /usr/bin/chattr guuid=38cb1cab-1900-0000-f685-dfa1a7090000 pid=2471->guuid=ee29d7bd-1900-0000-f685-dfa1fb090000 pid=2555 execve guuid=ab4b1cbe-1900-0000-f685-dfa1fd090000 pid=2557 /usr/bin/chattr guuid=38cb1cab-1900-0000-f685-dfa1a7090000 pid=2471->guuid=ab4b1cbe-1900-0000-f685-dfa1fd090000 pid=2557 execve guuid=dc0e5ebe-1900-0000-f685-dfa1ff090000 pid=2559 /usr/bin/chattr guuid=38cb1cab-1900-0000-f685-dfa1a7090000 pid=2471->guuid=dc0e5ebe-1900-0000-f685-dfa1ff090000 pid=2559 execve guuid=5267a4be-1900-0000-f685-dfa1000a0000 pid=2560 /usr/bin/chattr guuid=38cb1cab-1900-0000-f685-dfa1a7090000 pid=2471->guuid=5267a4be-1900-0000-f685-dfa1000a0000 pid=2560 execve guuid=258d00bf-1900-0000-f685-dfa1020a0000 pid=2562 /usr/bin/bash guuid=38cb1cab-1900-0000-f685-dfa1a7090000 pid=2471->guuid=258d00bf-1900-0000-f685-dfa1020a0000 pid=2562 clone guuid=0f002dbf-1900-0000-f685-dfa1030a0000 pid=2563 /usr/bin/bash guuid=38cb1cab-1900-0000-f685-dfa1a7090000 pid=2471->guuid=0f002dbf-1900-0000-f685-dfa1030a0000 pid=2563 clone guuid=a9564fbf-1900-0000-f685-dfa1050a0000 pid=2565 /usr/bin/curl net send-data guuid=38cb1cab-1900-0000-f685-dfa1a7090000 pid=2471->guuid=a9564fbf-1900-0000-f685-dfa1050a0000 pid=2565 execve guuid=8e2859bf-1900-0000-f685-dfa1060a0000 pid=2566 /usr/bin/dash guuid=38cb1cab-1900-0000-f685-dfa1a7090000 pid=2471->guuid=8e2859bf-1900-0000-f685-dfa1060a0000 pid=2566 execve guuid=14ba12ca-1900-0000-f685-dfa11a0a0000 pid=2586 /usr/bin/bash guuid=38cb1cab-1900-0000-f685-dfa1a7090000 pid=2471->guuid=14ba12ca-1900-0000-f685-dfa11a0a0000 pid=2586 clone guuid=15331aca-1900-0000-f685-dfa11c0a0000 pid=2588 /usr/bin/base64 guuid=38cb1cab-1900-0000-f685-dfa1a7090000 pid=2471->guuid=15331aca-1900-0000-f685-dfa11c0a0000 pid=2588 execve guuid=258c25ca-1900-0000-f685-dfa11d0a0000 pid=2589 /usr/bin/tee write-file guuid=38cb1cab-1900-0000-f685-dfa1a7090000 pid=2471->guuid=258c25ca-1900-0000-f685-dfa11d0a0000 pid=2589 execve guuid=3302bcca-1900-0000-f685-dfa1200a0000 pid=2592 /usr/bin/bash guuid=38cb1cab-1900-0000-f685-dfa1a7090000 pid=2471->guuid=3302bcca-1900-0000-f685-dfa1200a0000 pid=2592 execve guuid=ca8986d2-1900-0000-f685-dfa14a0a0000 pid=2634 /usr/bin/bash guuid=38cb1cab-1900-0000-f685-dfa1a7090000 pid=2471->guuid=ca8986d2-1900-0000-f685-dfa14a0a0000 pid=2634 execve guuid=2177e5d2-1900-0000-f685-dfa14d0a0000 pid=2637 /usr/bin/rm delete-file guuid=38cb1cab-1900-0000-f685-dfa1a7090000 pid=2471->guuid=2177e5d2-1900-0000-f685-dfa14d0a0000 pid=2637 execve guuid=e8353dd3-1900-0000-f685-dfa14f0a0000 pid=2639 /usr/bin/rm guuid=38cb1cab-1900-0000-f685-dfa1a7090000 pid=2471->guuid=e8353dd3-1900-0000-f685-dfa14f0a0000 pid=2639 execve guuid=15ef88d3-1900-0000-f685-dfa1500a0000 pid=2640 /usr/bin/curl net send-data guuid=38cb1cab-1900-0000-f685-dfa1a7090000 pid=2471->guuid=15ef88d3-1900-0000-f685-dfa1500a0000 pid=2640 execve guuid=344a94d3-1900-0000-f685-dfa1520a0000 pid=2642 /usr/bin/dash guuid=38cb1cab-1900-0000-f685-dfa1a7090000 pid=2471->guuid=344a94d3-1900-0000-f685-dfa1520a0000 pid=2642 execve 124ee36c-bdbd-5d46-bbb1-b2cd81367f04 160.119.69.4:80 guuid=a9564fbf-1900-0000-f685-dfa1050a0000 pid=2565->124ee36c-bdbd-5d46-bbb1-b2cd81367f04 send: 93B guuid=872f77cb-1900-0000-f685-dfa1230a0000 pid=2595 /usr/bin/bash guuid=3302bcca-1900-0000-f685-dfa1200a0000 pid=2592->guuid=872f77cb-1900-0000-f685-dfa1230a0000 pid=2595 clone guuid=4f12a5cb-1900-0000-f685-dfa1240a0000 pid=2596 /usr/bin/bash guuid=3302bcca-1900-0000-f685-dfa1200a0000 pid=2592->guuid=4f12a5cb-1900-0000-f685-dfa1240a0000 pid=2596 clone guuid=25b940cc-1900-0000-f685-dfa1270a0000 pid=2599 /usr/bin/ls guuid=3302bcca-1900-0000-f685-dfa1200a0000 pid=2592->guuid=25b940cc-1900-0000-f685-dfa1270a0000 pid=2599 execve guuid=1615f1cc-1900-0000-f685-dfa12a0a0000 pid=2602 /usr/bin/cat guuid=3302bcca-1900-0000-f685-dfa1200a0000 pid=2592->guuid=1615f1cc-1900-0000-f685-dfa12a0a0000 pid=2602 execve guuid=0d7951cd-1900-0000-f685-dfa12c0a0000 pid=2604 /usr/bin/ls guuid=3302bcca-1900-0000-f685-dfa1200a0000 pid=2592->guuid=0d7951cd-1900-0000-f685-dfa12c0a0000 pid=2604 execve guuid=be4fe3cd-1900-0000-f685-dfa12f0a0000 pid=2607 /usr/bin/mkdir guuid=3302bcca-1900-0000-f685-dfa1200a0000 pid=2592->guuid=be4fe3cd-1900-0000-f685-dfa12f0a0000 pid=2607 execve guuid=cb3355ce-1900-0000-f685-dfa1310a0000 pid=2609 /usr/bin/mv guuid=3302bcca-1900-0000-f685-dfa1200a0000 pid=2592->guuid=cb3355ce-1900-0000-f685-dfa1310a0000 pid=2609 execve guuid=4d9aeace-1900-0000-f685-dfa1340a0000 pid=2612 /usr/bin/bash guuid=3302bcca-1900-0000-f685-dfa1200a0000 pid=2592->guuid=4d9aeace-1900-0000-f685-dfa1340a0000 pid=2612 clone guuid=338ff6ce-1900-0000-f685-dfa1350a0000 pid=2613 /usr/bin/base64 write-file guuid=3302bcca-1900-0000-f685-dfa1200a0000 pid=2592->guuid=338ff6ce-1900-0000-f685-dfa1350a0000 pid=2613 execve guuid=79dc62cf-1900-0000-f685-dfa1370a0000 pid=2615 /usr/bin/rm delete-file guuid=3302bcca-1900-0000-f685-dfa1200a0000 pid=2592->guuid=79dc62cf-1900-0000-f685-dfa1370a0000 pid=2615 execve guuid=5d05a6cf-1900-0000-f685-dfa1390a0000 pid=2617 /usr/bin/mv guuid=3302bcca-1900-0000-f685-dfa1200a0000 pid=2592->guuid=5d05a6cf-1900-0000-f685-dfa1390a0000 pid=2617 execve guuid=d87305d0-1900-0000-f685-dfa13c0a0000 pid=2620 /usr/bin/ls guuid=3302bcca-1900-0000-f685-dfa1200a0000 pid=2592->guuid=d87305d0-1900-0000-f685-dfa13c0a0000 pid=2620 execve guuid=54c1abd0-1900-0000-f685-dfa13f0a0000 pid=2623 /usr/bin/bash guuid=3302bcca-1900-0000-f685-dfa1200a0000 pid=2592->guuid=54c1abd0-1900-0000-f685-dfa13f0a0000 pid=2623 clone guuid=9f5eb3d0-1900-0000-f685-dfa1400a0000 pid=2624 /usr/bin/base64 write-file guuid=3302bcca-1900-0000-f685-dfa1200a0000 pid=2592->guuid=9f5eb3d0-1900-0000-f685-dfa1400a0000 pid=2624 execve guuid=d9c133d1-1900-0000-f685-dfa1430a0000 pid=2627 /usr/bin/ls guuid=3302bcca-1900-0000-f685-dfa1200a0000 pid=2592->guuid=d9c133d1-1900-0000-f685-dfa1430a0000 pid=2627 execve guuid=83afc1d1-1900-0000-f685-dfa1450a0000 pid=2629 /usr/bin/cat guuid=3302bcca-1900-0000-f685-dfa1200a0000 pid=2592->guuid=83afc1d1-1900-0000-f685-dfa1450a0000 pid=2629 execve guuid=ff3408d2-1900-0000-f685-dfa1480a0000 pid=2632 /usr/bin/ls guuid=3302bcca-1900-0000-f685-dfa1200a0000 pid=2592->guuid=ff3408d2-1900-0000-f685-dfa1480a0000 pid=2632 execve guuid=15ef88d3-1900-0000-f685-dfa1500a0000 pid=2640->124ee36c-bdbd-5d46-bbb1-b2cd81367f04 send: 93B
Score:
81%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/ab455bbad0945e254612d4b8deacf31c4fb15d0a5a83728d0fe5da0a6ef61b84
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ab455bbad0945e254612d4b8deacf31c4fb15d0a5a83728d0fe5da0a6ef61b84/
Threat name:
Linux.Backdoor.WebShell
Create hunting rule
Status:
Malicious
First seen:
2026-07-27 06:52:49 UTC
File Type:
Text (Shell)
AV detection:
11 of 24 (45.83%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vncvxowqsrpckrqs2s4n5lhtdrh3cxiklkbxfdip4xnau3xwdoca._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260727-hmwytaxeme/
Behaviour
Reads runtime system information
Writes file to tmp directory
Deobfuscate/Decode Files or Information
Checks CPU configuration
File and Directory Permissions Modification
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.16
Link:
https://yomi.yoroi.company/submissions/ab455bbad0945e254612d4b8deacf31c4fb15d0a5a83728d0fe5da0a6ef61b84

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SUSP_LNX_Base64_Exec_Apr24
Create hunting rule
Author:Christian Burkard
Description:Detects suspicious base64 encoded shell commands (as seen in Palo Alto CVE-2024-3400 exploitation)
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh ab455bbad0945e254612d4b8deacf31c4fb15d0a5a83728d0fe5da0a6ef61b84

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3884408/
  
Delivery method
Distributed via web download

Comments