MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b05e5a35c253f04717a7c3bbb32fa72871adced0ecae78294ae50cbd8add30f6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b05e5a35c253f04717a7c3bbb32fa72871adced0ecae78294ae50cbd8add30f6
SHA3-384 hash: 28c1eefc9153a6a54c94473ef1d5f2da6a468389de2237367ca8ea4e1c649261b8f1022846d542386ecafa8346329f77
SHA1 hash: 876cb7dc315f655ca8d4edcb4efce984e726692b
MD5 hash: 254db95fd5e53bc6d54a9b0791b18714
humanhash: oregon-tennessee-speaker-mobile
File name:wr.php
Download: download sample
File size:27'042 bytes
First seen:2026-07-25 12:33:48 UTC
Last seen:2026-07-26 06:16:15 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 768:BI8vCB+25j6es8R99FYpMSUpi+20qUpi+20YQX:BI8l25Jrd2QX
TLSH T1B4C27C966A867C44BEC94A3E4CBE2B1D6DF5C3D1324942AC3D8A3C71DC11F9CD618B1A
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://160.119.69.4/z/post/noroot.phpn/an/aelf ua-wget

Intelligence

File Origin
# of uploads :
2
# of downloads :
61
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.BV.Agent-BNQ.43751318.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive masquerade
Link:
https://www.filescan.io/uploads/6a64ad5a934bbe9eeeda7cfe/reports/94f6c731-b1d3-4ff6-b3a2-5daf087cd710/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-07-25T10:13:00Z UTC
Last seen:
2026-07-25T10:30:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/b05e5a35c253f04717a7c3bbb32fa72871adced0ecae78294ae50cbd8add30f6/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/5b6d8fc1-ef8e-421b-9806-9fb99d44b7bd
Behavior Graph:
Download SVG
%3 guuid=997891ac-1600-0000-2fa1-f017f90c0000 pid=3321 /usr/bin/sudo guuid=645510ae-1600-0000-2fa1-f017000d0000 pid=3328 /tmp/sample.bin guuid=997891ac-1600-0000-2fa1-f017f90c0000 pid=3321->guuid=645510ae-1600-0000-2fa1-f017000d0000 pid=3328 execve guuid=bfa066ae-1600-0000-2fa1-f017020d0000 pid=3330 /usr/bin/bash guuid=645510ae-1600-0000-2fa1-f017000d0000 pid=3328->guuid=bfa066ae-1600-0000-2fa1-f017020d0000 pid=3330 clone guuid=f3586dae-1600-0000-2fa1-f017030d0000 pid=3331 /usr/bin/base64 guuid=645510ae-1600-0000-2fa1-f017000d0000 pid=3328->guuid=f3586dae-1600-0000-2fa1-f017030d0000 pid=3331 execve guuid=7edb79ae-1600-0000-2fa1-f017040d0000 pid=3332 /usr/bin/bash guuid=645510ae-1600-0000-2fa1-f017000d0000 pid=3328->guuid=7edb79ae-1600-0000-2fa1-f017040d0000 pid=3332 clone guuid=ecc44faf-1600-0000-2fa1-f017070d0000 pid=3335 /usr/bin/cp guuid=645510ae-1600-0000-2fa1-f017000d0000 pid=3328->guuid=ecc44faf-1600-0000-2fa1-f017070d0000 pid=3335 execve guuid=f351b7af-1600-0000-2fa1-f0170a0d0000 pid=3338 /usr/bin/mkdir guuid=645510ae-1600-0000-2fa1-f017000d0000 pid=3328->guuid=f351b7af-1600-0000-2fa1-f0170a0d0000 pid=3338 execve guuid=036900b0-1600-0000-2fa1-f0170c0d0000 pid=3340 /usr/bin/mkdir guuid=645510ae-1600-0000-2fa1-f017000d0000 pid=3328->guuid=036900b0-1600-0000-2fa1-f0170c0d0000 pid=3340 execve guuid=7c5042b0-1600-0000-2fa1-f0170f0d0000 pid=3343 /usr/bin/mkdir guuid=645510ae-1600-0000-2fa1-f017000d0000 pid=3328->guuid=7c5042b0-1600-0000-2fa1-f0170f0d0000 pid=3343 execve guuid=228284b0-1600-0000-2fa1-f017110d0000 pid=3345 /usr/bin/mkdir guuid=645510ae-1600-0000-2fa1-f017000d0000 pid=3328->guuid=228284b0-1600-0000-2fa1-f017110d0000 pid=3345 execve guuid=221cc7b0-1600-0000-2fa1-f017130d0000 pid=3347 /usr/bin/mkdir guuid=645510ae-1600-0000-2fa1-f017000d0000 pid=3328->guuid=221cc7b0-1600-0000-2fa1-f017130d0000 pid=3347 execve guuid=8c4809b1-1600-0000-2fa1-f017150d0000 pid=3349 /usr/bin/mkdir guuid=645510ae-1600-0000-2fa1-f017000d0000 pid=3328->guuid=8c4809b1-1600-0000-2fa1-f017150d0000 pid=3349 execve guuid=5c2f57b1-1600-0000-2fa1-f017170d0000 pid=3351 /usr/bin/mkdir guuid=645510ae-1600-0000-2fa1-f017000d0000 pid=3328->guuid=5c2f57b1-1600-0000-2fa1-f017170d0000 pid=3351 execve guuid=4f099db1-1600-0000-2fa1-f0171a0d0000 pid=3354 /usr/bin/mkdir guuid=645510ae-1600-0000-2fa1-f017000d0000 pid=3328->guuid=4f099db1-1600-0000-2fa1-f0171a0d0000 pid=3354 execve guuid=e6a4e1b1-1600-0000-2fa1-f0171c0d0000 pid=3356 /usr/bin/mkdir guuid=645510ae-1600-0000-2fa1-f017000d0000 pid=3328->guuid=e6a4e1b1-1600-0000-2fa1-f0171c0d0000 pid=3356 execve guuid=e17328b2-1600-0000-2fa1-f0171e0d0000 pid=3358 /usr/bin/cp guuid=645510ae-1600-0000-2fa1-f017000d0000 pid=3328->guuid=e17328b2-1600-0000-2fa1-f0171e0d0000 pid=3358 execve guuid=844599b2-1600-0000-2fa1-f017210d0000 pid=3361 /usr/bin/cp guuid=645510ae-1600-0000-2fa1-f017000d0000 pid=3328->guuid=844599b2-1600-0000-2fa1-f017210d0000 pid=3361 execve guuid=5bcaf2b2-1600-0000-2fa1-f017240d0000 pid=3364 /usr/bin/cp guuid=645510ae-1600-0000-2fa1-f017000d0000 pid=3328->guuid=5bcaf2b2-1600-0000-2fa1-f017240d0000 pid=3364 execve guuid=64984eb3-1600-0000-2fa1-f017260d0000 pid=3366 /usr/bin/cp guuid=645510ae-1600-0000-2fa1-f017000d0000 pid=3328->guuid=64984eb3-1600-0000-2fa1-f017260d0000 pid=3366 execve guuid=2193aab3-1600-0000-2fa1-f017290d0000 pid=3369 /usr/bin/cp guuid=645510ae-1600-0000-2fa1-f017000d0000 pid=3328->guuid=2193aab3-1600-0000-2fa1-f017290d0000 pid=3369 execve guuid=4cba06b4-1600-0000-2fa1-f0172c0d0000 pid=3372 /usr/bin/cp guuid=645510ae-1600-0000-2fa1-f017000d0000 pid=3328->guuid=4cba06b4-1600-0000-2fa1-f0172c0d0000 pid=3372 execve guuid=6ae7b8b4-1600-0000-2fa1-f017300d0000 pid=3376 /usr/bin/cp guuid=645510ae-1600-0000-2fa1-f017000d0000 pid=3328->guuid=6ae7b8b4-1600-0000-2fa1-f017300d0000 pid=3376 execve guuid=68e45fb5-1600-0000-2fa1-f017340d0000 pid=3380 /usr/bin/cp guuid=645510ae-1600-0000-2fa1-f017000d0000 pid=3328->guuid=68e45fb5-1600-0000-2fa1-f017340d0000 pid=3380 execve guuid=49aeceb5-1600-0000-2fa1-f017370d0000 pid=3383 /usr/bin/cp guuid=645510ae-1600-0000-2fa1-f017000d0000 pid=3328->guuid=49aeceb5-1600-0000-2fa1-f017370d0000 pid=3383 execve guuid=5e3e33b6-1600-0000-2fa1-f017390d0000 pid=3385 /usr/bin/cp guuid=645510ae-1600-0000-2fa1-f017000d0000 pid=3328->guuid=5e3e33b6-1600-0000-2fa1-f017390d0000 pid=3385 execve guuid=fd8187b6-1600-0000-2fa1-f0173c0d0000 pid=3388 /usr/bin/cp guuid=645510ae-1600-0000-2fa1-f017000d0000 pid=3328->guuid=fd8187b6-1600-0000-2fa1-f0173c0d0000 pid=3388 execve guuid=1c82fbb6-1600-0000-2fa1-f0173e0d0000 pid=3390 /usr/bin/cp guuid=645510ae-1600-0000-2fa1-f017000d0000 pid=3328->guuid=1c82fbb6-1600-0000-2fa1-f0173e0d0000 pid=3390 execve guuid=d98b5cb7-1600-0000-2fa1-f017400d0000 pid=3392 /usr/bin/cp guuid=645510ae-1600-0000-2fa1-f017000d0000 pid=3328->guuid=d98b5cb7-1600-0000-2fa1-f017400d0000 pid=3392 execve guuid=7e63c2b7-1600-0000-2fa1-f017460d0000 pid=3398 /usr/bin/cp guuid=645510ae-1600-0000-2fa1-f017000d0000 pid=3328->guuid=7e63c2b7-1600-0000-2fa1-f017460d0000 pid=3398 execve guuid=98307cb8-1600-0000-2fa1-f017470d0000 pid=3399 /usr/bin/touch guuid=645510ae-1600-0000-2fa1-f017000d0000 pid=3328->guuid=98307cb8-1600-0000-2fa1-f017470d0000 pid=3399 execve guuid=d4ffd2b8-1600-0000-2fa1-f017480d0000 pid=3400 /usr/bin/chmod guuid=645510ae-1600-0000-2fa1-f017000d0000 pid=3328->guuid=d4ffd2b8-1600-0000-2fa1-f017480d0000 pid=3400 execve guuid=8f0418b9-1600-0000-2fa1-f017490d0000 pid=3401 /usr/bin/chmod guuid=645510ae-1600-0000-2fa1-f017000d0000 pid=3328->guuid=8f0418b9-1600-0000-2fa1-f017490d0000 pid=3401 execve guuid=8e8c70b9-1600-0000-2fa1-f0174a0d0000 pid=3402 /usr/bin/chattr guuid=645510ae-1600-0000-2fa1-f017000d0000 pid=3328->guuid=8e8c70b9-1600-0000-2fa1-f0174a0d0000 pid=3402 execve guuid=ce4b3eba-1600-0000-2fa1-f0174b0d0000 pid=3403 /usr/bin/chattr guuid=645510ae-1600-0000-2fa1-f017000d0000 pid=3328->guuid=ce4b3eba-1600-0000-2fa1-f0174b0d0000 pid=3403 execve guuid=9b8091ba-1600-0000-2fa1-f0174c0d0000 pid=3404 /usr/bin/chattr guuid=645510ae-1600-0000-2fa1-f017000d0000 pid=3328->guuid=9b8091ba-1600-0000-2fa1-f0174c0d0000 pid=3404 execve guuid=7b12ebba-1600-0000-2fa1-f0174d0d0000 pid=3405 /usr/bin/chattr guuid=645510ae-1600-0000-2fa1-f017000d0000 pid=3328->guuid=7b12ebba-1600-0000-2fa1-f0174d0d0000 pid=3405 execve guuid=148e3cbb-1600-0000-2fa1-f0174e0d0000 pid=3406 /usr/bin/chattr guuid=645510ae-1600-0000-2fa1-f017000d0000 pid=3328->guuid=148e3cbb-1600-0000-2fa1-f0174e0d0000 pid=3406 execve guuid=9a4793bb-1600-0000-2fa1-f0174f0d0000 pid=3407 /usr/bin/chattr guuid=645510ae-1600-0000-2fa1-f017000d0000 pid=3328->guuid=9a4793bb-1600-0000-2fa1-f0174f0d0000 pid=3407 execve guuid=1342eabb-1600-0000-2fa1-f017500d0000 pid=3408 /usr/bin/chattr guuid=645510ae-1600-0000-2fa1-f017000d0000 pid=3328->guuid=1342eabb-1600-0000-2fa1-f017500d0000 pid=3408 execve guuid=18713abc-1600-0000-2fa1-f017510d0000 pid=3409 /usr/bin/chattr guuid=645510ae-1600-0000-2fa1-f017000d0000 pid=3328->guuid=18713abc-1600-0000-2fa1-f017510d0000 pid=3409 execve guuid=848591bc-1600-0000-2fa1-f017520d0000 pid=3410 /usr/bin/bash guuid=645510ae-1600-0000-2fa1-f017000d0000 pid=3328->guuid=848591bc-1600-0000-2fa1-f017520d0000 pid=3410 clone guuid=587f96bc-1600-0000-2fa1-f017530d0000 pid=3411 /usr/bin/bash guuid=645510ae-1600-0000-2fa1-f017000d0000 pid=3328->guuid=587f96bc-1600-0000-2fa1-f017530d0000 pid=3411 clone guuid=2507bdbc-1600-0000-2fa1-f017540d0000 pid=3412 /usr/bin/curl net send-data guuid=645510ae-1600-0000-2fa1-f017000d0000 pid=3328->guuid=2507bdbc-1600-0000-2fa1-f017540d0000 pid=3412 execve guuid=44cec9bc-1600-0000-2fa1-f017550d0000 pid=3413 /usr/bin/dash guuid=645510ae-1600-0000-2fa1-f017000d0000 pid=3328->guuid=44cec9bc-1600-0000-2fa1-f017550d0000 pid=3413 execve guuid=4c495bc9-1600-0000-2fa1-f017640d0000 pid=3428 /usr/bin/bash guuid=645510ae-1600-0000-2fa1-f017000d0000 pid=3328->guuid=4c495bc9-1600-0000-2fa1-f017640d0000 pid=3428 clone guuid=64c474c9-1600-0000-2fa1-f017650d0000 pid=3429 /usr/bin/base64 guuid=645510ae-1600-0000-2fa1-f017000d0000 pid=3328->guuid=64c474c9-1600-0000-2fa1-f017650d0000 pid=3429 execve guuid=94848cc9-1600-0000-2fa1-f017660d0000 pid=3430 /usr/bin/tee write-file guuid=645510ae-1600-0000-2fa1-f017000d0000 pid=3328->guuid=94848cc9-1600-0000-2fa1-f017660d0000 pid=3430 execve guuid=4900b5ca-1600-0000-2fa1-f0176a0d0000 pid=3434 /usr/bin/bash guuid=645510ae-1600-0000-2fa1-f017000d0000 pid=3328->guuid=4900b5ca-1600-0000-2fa1-f0176a0d0000 pid=3434 execve guuid=de8ac9d1-1600-0000-2fa1-f0178b0d0000 pid=3467 /usr/bin/bash guuid=645510ae-1600-0000-2fa1-f017000d0000 pid=3328->guuid=de8ac9d1-1600-0000-2fa1-f0178b0d0000 pid=3467 execve guuid=67cc2bd2-1600-0000-2fa1-f0178d0d0000 pid=3469 /usr/bin/rm delete-file guuid=645510ae-1600-0000-2fa1-f017000d0000 pid=3328->guuid=67cc2bd2-1600-0000-2fa1-f0178d0d0000 pid=3469 execve guuid=0fa388d2-1600-0000-2fa1-f0178f0d0000 pid=3471 /usr/bin/rm guuid=645510ae-1600-0000-2fa1-f017000d0000 pid=3328->guuid=0fa388d2-1600-0000-2fa1-f0178f0d0000 pid=3471 execve guuid=74deded2-1600-0000-2fa1-f017910d0000 pid=3473 /usr/bin/curl net send-data guuid=645510ae-1600-0000-2fa1-f017000d0000 pid=3328->guuid=74deded2-1600-0000-2fa1-f017910d0000 pid=3473 execve guuid=c6fde4d2-1600-0000-2fa1-f017920d0000 pid=3474 /usr/bin/dash guuid=645510ae-1600-0000-2fa1-f017000d0000 pid=3328->guuid=c6fde4d2-1600-0000-2fa1-f017920d0000 pid=3474 execve 124ee36c-bdbd-5d46-bbb1-b2cd81367f04 160.119.69.4:80 guuid=2507bdbc-1600-0000-2fa1-f017540d0000 pid=3412->124ee36c-bdbd-5d46-bbb1-b2cd81367f04 send: 93B guuid=652d73cb-1600-0000-2fa1-f0176d0d0000 pid=3437 /usr/bin/bash guuid=4900b5ca-1600-0000-2fa1-f0176a0d0000 pid=3434->guuid=652d73cb-1600-0000-2fa1-f0176d0d0000 pid=3437 clone guuid=d23d7dcb-1600-0000-2fa1-f0176e0d0000 pid=3438 /usr/bin/bash guuid=4900b5ca-1600-0000-2fa1-f0176a0d0000 pid=3434->guuid=d23d7dcb-1600-0000-2fa1-f0176e0d0000 pid=3438 clone guuid=2874bfcb-1600-0000-2fa1-f017700d0000 pid=3440 /usr/bin/ls guuid=4900b5ca-1600-0000-2fa1-f0176a0d0000 pid=3434->guuid=2874bfcb-1600-0000-2fa1-f017700d0000 pid=3440 execve guuid=fbae7acc-1600-0000-2fa1-f017710d0000 pid=3441 /usr/bin/cat guuid=4900b5ca-1600-0000-2fa1-f0176a0d0000 pid=3434->guuid=fbae7acc-1600-0000-2fa1-f017710d0000 pid=3441 execve guuid=681ff5cc-1600-0000-2fa1-f017720d0000 pid=3442 /usr/bin/ls guuid=4900b5ca-1600-0000-2fa1-f0176a0d0000 pid=3434->guuid=681ff5cc-1600-0000-2fa1-f017720d0000 pid=3442 execve guuid=69987ecd-1600-0000-2fa1-f017740d0000 pid=3444 /usr/bin/mkdir guuid=4900b5ca-1600-0000-2fa1-f0176a0d0000 pid=3434->guuid=69987ecd-1600-0000-2fa1-f017740d0000 pid=3444 execve guuid=a5cfd7cd-1600-0000-2fa1-f017750d0000 pid=3445 /usr/bin/mv guuid=4900b5ca-1600-0000-2fa1-f0176a0d0000 pid=3434->guuid=a5cfd7cd-1600-0000-2fa1-f017750d0000 pid=3445 execve guuid=ef8a3fce-1600-0000-2fa1-f017760d0000 pid=3446 /usr/bin/bash guuid=4900b5ca-1600-0000-2fa1-f0176a0d0000 pid=3434->guuid=ef8a3fce-1600-0000-2fa1-f017760d0000 pid=3446 clone guuid=6d5948ce-1600-0000-2fa1-f017770d0000 pid=3447 /usr/bin/base64 write-file guuid=4900b5ca-1600-0000-2fa1-f0176a0d0000 pid=3434->guuid=6d5948ce-1600-0000-2fa1-f017770d0000 pid=3447 execve guuid=7c66afce-1600-0000-2fa1-f017790d0000 pid=3449 /usr/bin/rm delete-file guuid=4900b5ca-1600-0000-2fa1-f0176a0d0000 pid=3434->guuid=7c66afce-1600-0000-2fa1-f017790d0000 pid=3449 execve guuid=fd0bf5ce-1600-0000-2fa1-f0177b0d0000 pid=3451 /usr/bin/mv guuid=4900b5ca-1600-0000-2fa1-f0176a0d0000 pid=3434->guuid=fd0bf5ce-1600-0000-2fa1-f0177b0d0000 pid=3451 execve guuid=d5fc50cf-1600-0000-2fa1-f0177d0d0000 pid=3453 /usr/bin/ls guuid=4900b5ca-1600-0000-2fa1-f0176a0d0000 pid=3434->guuid=d5fc50cf-1600-0000-2fa1-f0177d0d0000 pid=3453 execve guuid=1669ebcf-1600-0000-2fa1-f017800d0000 pid=3456 /usr/bin/bash guuid=4900b5ca-1600-0000-2fa1-f0176a0d0000 pid=3434->guuid=1669ebcf-1600-0000-2fa1-f017800d0000 pid=3456 clone guuid=ae32ffcf-1600-0000-2fa1-f017810d0000 pid=3457 /usr/bin/base64 write-file guuid=4900b5ca-1600-0000-2fa1-f0176a0d0000 pid=3434->guuid=ae32ffcf-1600-0000-2fa1-f017810d0000 pid=3457 execve guuid=ca3292d0-1600-0000-2fa1-f017840d0000 pid=3460 /usr/bin/ls guuid=4900b5ca-1600-0000-2fa1-f0176a0d0000 pid=3434->guuid=ca3292d0-1600-0000-2fa1-f017840d0000 pid=3460 execve guuid=c9c40dd1-1600-0000-2fa1-f017870d0000 pid=3463 /usr/bin/cat guuid=4900b5ca-1600-0000-2fa1-f0176a0d0000 pid=3434->guuid=c9c40dd1-1600-0000-2fa1-f017870d0000 pid=3463 execve guuid=f0a750d1-1600-0000-2fa1-f017890d0000 pid=3465 /usr/bin/ls guuid=4900b5ca-1600-0000-2fa1-f0176a0d0000 pid=3434->guuid=f0a750d1-1600-0000-2fa1-f017890d0000 pid=3465 execve guuid=74deded2-1600-0000-2fa1-f017910d0000 pid=3473->124ee36c-bdbd-5d46-bbb1-b2cd81367f04 send: 93B
Score:
81%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/b05e5a35c253f04717a7c3bbb32fa72871adced0ecae78294ae50cbd8add30f6
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b05e5a35c253f04717a7c3bbb32fa72871adced0ecae78294ae50cbd8add30f6/
Threat name:
Linux.Backdoor.WebShell
Create hunting rule
Status:
Malicious
First seen:
2026-07-25 12:34:39 UTC
File Type:
Text (Shell)
AV detection:
15 of 36 (41.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wbpfunockpyeof5hyo53gl5hfby23twq5sxhqkkk4ugl3cw5gd3a._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260725-pr2hesxshx/
Behaviour
Reads runtime system information
Writes file to tmp directory
Deobfuscate/Decode Files or Information
Checks CPU configuration
File and Directory Permissions Modification
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.16
Link:
https://yomi.yoroi.company/submissions/b05e5a35c253f04717a7c3bbb32fa72871adced0ecae78294ae50cbd8add30f6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SUSP_LNX_Base64_Exec_Apr24
Create hunting rule
Author:Christian Burkard
Description:Detects suspicious base64 encoded shell commands (as seen in Palo Alto CVE-2024-3400 exploitation)
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh b05e5a35c253f04717a7c3bbb32fa72871adced0ecae78294ae50cbd8add30f6

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3884408/
  
Delivery method
Distributed via web download

Comments