MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c11ee1171bb97d0fe11d880aa65aadda5221fd5cf98cfcbc6e27cd9213bb9716. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: c11ee1171bb97d0fe11d880aa65aadda5221fd5cf98cfcbc6e27cd9213bb9716
SHA3-384 hash: 584f02b73c3098d0bc88c3f81840020ee069e67e21ff2bc0e287c62613111d472f8d26c7120d43892fa186ec48cf6e1f
SHA1 hash: 87b3bb78c499fae615e01942c36227a6a2680a09
MD5 hash: f134b162d7f566e4841fddac39995da5
humanhash: wolfram-william-uniform-enemy
File name:wr.php
Download: download sample
File size:27'042 bytes
First seen:2026-07-28 05:44:18 UTC
Last seen:2026-07-28 14:14:48 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 768:CS8vCB+25j6es8RE9FYpMSUpi+20qUpi+20YQX:CS8l25Jid2QX
TLSH T1FAC28D966A867C44BEC94A3E4CBD2B0D6DF5C3D1324942AC3D8B3C719C15FACC618B1A
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://160.119.69.4/z/post/noroot.phpn/an/aelf ua-wget

Intelligence

File Origin
# of uploads :
2
# of downloads :
58
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.BV.Agent-BNQ.36895439.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive masquerade
Link:
https://www.filescan.io/uploads/6a6841cd82de3c91b8f92210/reports/0530ba94-2afc-40c1-91bf-99744082525d/overview
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/2401cb39-4321-4c40-9942-60042178c074
Behavior Graph:
Download SVG
%3 guuid=84c583ff-1900-0000-9d26-f045d0060000 pid=1744 /usr/bin/sudo guuid=80378702-1a00-0000-9d26-f045d7060000 pid=1751 /tmp/sample.bin guuid=84c583ff-1900-0000-9d26-f045d0060000 pid=1744->guuid=80378702-1a00-0000-9d26-f045d7060000 pid=1751 execve guuid=25a10003-1a00-0000-9d26-f045d8060000 pid=1752 /usr/bin/bash guuid=80378702-1a00-0000-9d26-f045d7060000 pid=1751->guuid=25a10003-1a00-0000-9d26-f045d8060000 pid=1752 clone guuid=4b3b0f03-1a00-0000-9d26-f045da060000 pid=1754 /usr/bin/base64 guuid=80378702-1a00-0000-9d26-f045d7060000 pid=1751->guuid=4b3b0f03-1a00-0000-9d26-f045da060000 pid=1754 execve guuid=67841903-1a00-0000-9d26-f045db060000 pid=1755 /usr/bin/bash guuid=80378702-1a00-0000-9d26-f045d7060000 pid=1751->guuid=67841903-1a00-0000-9d26-f045db060000 pid=1755 clone guuid=e293d003-1a00-0000-9d26-f045dc060000 pid=1756 /usr/bin/cp guuid=80378702-1a00-0000-9d26-f045d7060000 pid=1751->guuid=e293d003-1a00-0000-9d26-f045dc060000 pid=1756 execve guuid=f6635f04-1a00-0000-9d26-f045de060000 pid=1758 /usr/bin/mkdir guuid=80378702-1a00-0000-9d26-f045d7060000 pid=1751->guuid=f6635f04-1a00-0000-9d26-f045de060000 pid=1758 execve guuid=89f5f404-1a00-0000-9d26-f045e1060000 pid=1761 /usr/bin/mkdir guuid=80378702-1a00-0000-9d26-f045d7060000 pid=1751->guuid=89f5f404-1a00-0000-9d26-f045e1060000 pid=1761 execve guuid=404c5a05-1a00-0000-9d26-f045e3060000 pid=1763 /usr/bin/mkdir guuid=80378702-1a00-0000-9d26-f045d7060000 pid=1751->guuid=404c5a05-1a00-0000-9d26-f045e3060000 pid=1763 execve guuid=61c0b205-1a00-0000-9d26-f045e5060000 pid=1765 /usr/bin/mkdir guuid=80378702-1a00-0000-9d26-f045d7060000 pid=1751->guuid=61c0b205-1a00-0000-9d26-f045e5060000 pid=1765 execve guuid=220e0f06-1a00-0000-9d26-f045e7060000 pid=1767 /usr/bin/mkdir guuid=80378702-1a00-0000-9d26-f045d7060000 pid=1751->guuid=220e0f06-1a00-0000-9d26-f045e7060000 pid=1767 execve guuid=df8f6e06-1a00-0000-9d26-f045e8060000 pid=1768 /usr/bin/mkdir guuid=80378702-1a00-0000-9d26-f045d7060000 pid=1751->guuid=df8f6e06-1a00-0000-9d26-f045e8060000 pid=1768 execve guuid=962bc706-1a00-0000-9d26-f045ea060000 pid=1770 /usr/bin/mkdir guuid=80378702-1a00-0000-9d26-f045d7060000 pid=1751->guuid=962bc706-1a00-0000-9d26-f045ea060000 pid=1770 execve guuid=fde32707-1a00-0000-9d26-f045eb060000 pid=1771 /usr/bin/mkdir guuid=80378702-1a00-0000-9d26-f045d7060000 pid=1751->guuid=fde32707-1a00-0000-9d26-f045eb060000 pid=1771 execve guuid=315f8707-1a00-0000-9d26-f045ed060000 pid=1773 /usr/bin/mkdir guuid=80378702-1a00-0000-9d26-f045d7060000 pid=1751->guuid=315f8707-1a00-0000-9d26-f045ed060000 pid=1773 execve guuid=e29b0108-1a00-0000-9d26-f045ef060000 pid=1775 /usr/bin/cp guuid=80378702-1a00-0000-9d26-f045d7060000 pid=1751->guuid=e29b0108-1a00-0000-9d26-f045ef060000 pid=1775 execve guuid=f5309b08-1a00-0000-9d26-f045f1060000 pid=1777 /usr/bin/cp guuid=80378702-1a00-0000-9d26-f045d7060000 pid=1751->guuid=f5309b08-1a00-0000-9d26-f045f1060000 pid=1777 execve guuid=4da31c09-1a00-0000-9d26-f045f3060000 pid=1779 /usr/bin/cp guuid=80378702-1a00-0000-9d26-f045d7060000 pid=1751->guuid=4da31c09-1a00-0000-9d26-f045f3060000 pid=1779 execve guuid=8f2cc209-1a00-0000-9d26-f045f6060000 pid=1782 /usr/bin/cp guuid=80378702-1a00-0000-9d26-f045d7060000 pid=1751->guuid=8f2cc209-1a00-0000-9d26-f045f6060000 pid=1782 execve guuid=22a4860a-1a00-0000-9d26-f045f8060000 pid=1784 /usr/bin/cp guuid=80378702-1a00-0000-9d26-f045d7060000 pid=1751->guuid=22a4860a-1a00-0000-9d26-f045f8060000 pid=1784 execve guuid=6b1a1e0b-1a00-0000-9d26-f045f9060000 pid=1785 /usr/bin/cp guuid=80378702-1a00-0000-9d26-f045d7060000 pid=1751->guuid=6b1a1e0b-1a00-0000-9d26-f045f9060000 pid=1785 execve guuid=b044c00b-1a00-0000-9d26-f045fb060000 pid=1787 /usr/bin/cp guuid=80378702-1a00-0000-9d26-f045d7060000 pid=1751->guuid=b044c00b-1a00-0000-9d26-f045fb060000 pid=1787 execve guuid=9ad9760c-1a00-0000-9d26-f045fe060000 pid=1790 /usr/bin/cp guuid=80378702-1a00-0000-9d26-f045d7060000 pid=1751->guuid=9ad9760c-1a00-0000-9d26-f045fe060000 pid=1790 execve guuid=ff29090d-1a00-0000-9d26-f04500070000 pid=1792 /usr/bin/cp guuid=80378702-1a00-0000-9d26-f045d7060000 pid=1751->guuid=ff29090d-1a00-0000-9d26-f04500070000 pid=1792 execve guuid=5618380e-1a00-0000-9d26-f04503070000 pid=1795 /usr/bin/cp guuid=80378702-1a00-0000-9d26-f045d7060000 pid=1751->guuid=5618380e-1a00-0000-9d26-f04503070000 pid=1795 execve guuid=75d7e00e-1a00-0000-9d26-f04505070000 pid=1797 /usr/bin/cp guuid=80378702-1a00-0000-9d26-f045d7060000 pid=1751->guuid=75d7e00e-1a00-0000-9d26-f04505070000 pid=1797 execve guuid=df297a0f-1a00-0000-9d26-f04506070000 pid=1798 /usr/bin/cp guuid=80378702-1a00-0000-9d26-f045d7060000 pid=1751->guuid=df297a0f-1a00-0000-9d26-f04506070000 pid=1798 execve guuid=92432f10-1a00-0000-9d26-f04508070000 pid=1800 /usr/bin/cp guuid=80378702-1a00-0000-9d26-f045d7060000 pid=1751->guuid=92432f10-1a00-0000-9d26-f04508070000 pid=1800 execve guuid=4f35dc10-1a00-0000-9d26-f0450a070000 pid=1802 /usr/bin/cp guuid=80378702-1a00-0000-9d26-f045d7060000 pid=1751->guuid=4f35dc10-1a00-0000-9d26-f0450a070000 pid=1802 execve guuid=70529311-1a00-0000-9d26-f0450c070000 pid=1804 /usr/bin/touch guuid=80378702-1a00-0000-9d26-f045d7060000 pid=1751->guuid=70529311-1a00-0000-9d26-f0450c070000 pid=1804 execve guuid=f9e44712-1a00-0000-9d26-f0450e070000 pid=1806 /usr/bin/chmod guuid=80378702-1a00-0000-9d26-f045d7060000 pid=1751->guuid=f9e44712-1a00-0000-9d26-f0450e070000 pid=1806 execve guuid=ab3fe512-1a00-0000-9d26-f04511070000 pid=1809 /usr/bin/chmod guuid=80378702-1a00-0000-9d26-f045d7060000 pid=1751->guuid=ab3fe512-1a00-0000-9d26-f04511070000 pid=1809 execve guuid=2de48c13-1a00-0000-9d26-f04512070000 pid=1810 /usr/bin/chattr guuid=80378702-1a00-0000-9d26-f045d7060000 pid=1751->guuid=2de48c13-1a00-0000-9d26-f04512070000 pid=1810 execve guuid=78337a14-1a00-0000-9d26-f04514070000 pid=1812 /usr/bin/chattr guuid=80378702-1a00-0000-9d26-f045d7060000 pid=1751->guuid=78337a14-1a00-0000-9d26-f04514070000 pid=1812 execve guuid=400a7215-1a00-0000-9d26-f04515070000 pid=1813 /usr/bin/chattr guuid=80378702-1a00-0000-9d26-f045d7060000 pid=1751->guuid=400a7215-1a00-0000-9d26-f04515070000 pid=1813 execve guuid=ed123116-1a00-0000-9d26-f04516070000 pid=1814 /usr/bin/chattr guuid=80378702-1a00-0000-9d26-f045d7060000 pid=1751->guuid=ed123116-1a00-0000-9d26-f04516070000 pid=1814 execve guuid=d157b016-1a00-0000-9d26-f04519070000 pid=1817 /usr/bin/chattr guuid=80378702-1a00-0000-9d26-f045d7060000 pid=1751->guuid=d157b016-1a00-0000-9d26-f04519070000 pid=1817 execve guuid=f87c2517-1a00-0000-9d26-f0451b070000 pid=1819 /usr/bin/chattr guuid=80378702-1a00-0000-9d26-f045d7060000 pid=1751->guuid=f87c2517-1a00-0000-9d26-f0451b070000 pid=1819 execve guuid=9510cc17-1a00-0000-9d26-f0451d070000 pid=1821 /usr/bin/chattr guuid=80378702-1a00-0000-9d26-f045d7060000 pid=1751->guuid=9510cc17-1a00-0000-9d26-f0451d070000 pid=1821 execve guuid=c2ee5d18-1a00-0000-9d26-f04520070000 pid=1824 /usr/bin/chattr guuid=80378702-1a00-0000-9d26-f045d7060000 pid=1751->guuid=c2ee5d18-1a00-0000-9d26-f04520070000 pid=1824 execve guuid=2deeb618-1a00-0000-9d26-f04521070000 pid=1825 /usr/bin/bash guuid=80378702-1a00-0000-9d26-f045d7060000 pid=1751->guuid=2deeb618-1a00-0000-9d26-f04521070000 pid=1825 clone guuid=7e80c418-1a00-0000-9d26-f04522070000 pid=1826 /usr/bin/bash guuid=80378702-1a00-0000-9d26-f045d7060000 pid=1751->guuid=7e80c418-1a00-0000-9d26-f04522070000 pid=1826 clone guuid=2c0ae818-1a00-0000-9d26-f04523070000 pid=1827 /usr/bin/curl net send-data guuid=80378702-1a00-0000-9d26-f045d7060000 pid=1751->guuid=2c0ae818-1a00-0000-9d26-f04523070000 pid=1827 execve guuid=292bef18-1a00-0000-9d26-f04524070000 pid=1828 /usr/bin/dash guuid=80378702-1a00-0000-9d26-f045d7060000 pid=1751->guuid=292bef18-1a00-0000-9d26-f04524070000 pid=1828 execve guuid=bf9cf622-1a00-0000-9d26-f04532070000 pid=1842 /usr/bin/bash guuid=80378702-1a00-0000-9d26-f045d7060000 pid=1751->guuid=bf9cf622-1a00-0000-9d26-f04532070000 pid=1842 clone guuid=f665ff22-1a00-0000-9d26-f04533070000 pid=1843 /usr/bin/base64 guuid=80378702-1a00-0000-9d26-f045d7060000 pid=1751->guuid=f665ff22-1a00-0000-9d26-f04533070000 pid=1843 execve guuid=d2e10923-1a00-0000-9d26-f04534070000 pid=1844 /usr/bin/tee write-file guuid=80378702-1a00-0000-9d26-f045d7060000 pid=1751->guuid=d2e10923-1a00-0000-9d26-f04534070000 pid=1844 execve guuid=8a7da723-1a00-0000-9d26-f04537070000 pid=1847 /usr/bin/bash guuid=80378702-1a00-0000-9d26-f045d7060000 pid=1751->guuid=8a7da723-1a00-0000-9d26-f04537070000 pid=1847 execve guuid=0979c32b-1a00-0000-9d26-f04558070000 pid=1880 /usr/bin/bash guuid=80378702-1a00-0000-9d26-f045d7060000 pid=1751->guuid=0979c32b-1a00-0000-9d26-f04558070000 pid=1880 execve guuid=3084302c-1a00-0000-9d26-f0455a070000 pid=1882 /usr/bin/rm delete-file guuid=80378702-1a00-0000-9d26-f045d7060000 pid=1751->guuid=3084302c-1a00-0000-9d26-f0455a070000 pid=1882 execve guuid=f4e1a52c-1a00-0000-9d26-f0455c070000 pid=1884 /usr/bin/rm guuid=80378702-1a00-0000-9d26-f045d7060000 pid=1751->guuid=f4e1a52c-1a00-0000-9d26-f0455c070000 pid=1884 execve guuid=a80d132d-1a00-0000-9d26-f0455f070000 pid=1887 /usr/bin/curl net send-data guuid=80378702-1a00-0000-9d26-f045d7060000 pid=1751->guuid=a80d132d-1a00-0000-9d26-f0455f070000 pid=1887 execve guuid=26a3232d-1a00-0000-9d26-f04560070000 pid=1888 /usr/bin/dash guuid=80378702-1a00-0000-9d26-f045d7060000 pid=1751->guuid=26a3232d-1a00-0000-9d26-f04560070000 pid=1888 execve 124ee36c-bdbd-5d46-bbb1-b2cd81367f04 160.119.69.4:80 guuid=2c0ae818-1a00-0000-9d26-f04523070000 pid=1827->124ee36c-bdbd-5d46-bbb1-b2cd81367f04 send: 93B guuid=83d72024-1a00-0000-9d26-f04539070000 pid=1849 /usr/bin/bash guuid=8a7da723-1a00-0000-9d26-f04537070000 pid=1847->guuid=83d72024-1a00-0000-9d26-f04539070000 pid=1849 clone guuid=02182b24-1a00-0000-9d26-f0453a070000 pid=1850 /usr/bin/bash guuid=8a7da723-1a00-0000-9d26-f04537070000 pid=1847->guuid=02182b24-1a00-0000-9d26-f0453a070000 pid=1850 clone guuid=79d65224-1a00-0000-9d26-f0453c070000 pid=1852 /usr/bin/ls guuid=8a7da723-1a00-0000-9d26-f04537070000 pid=1847->guuid=79d65224-1a00-0000-9d26-f0453c070000 pid=1852 execve guuid=084d0b25-1a00-0000-9d26-f0453e070000 pid=1854 /usr/bin/cat guuid=8a7da723-1a00-0000-9d26-f04537070000 pid=1847->guuid=084d0b25-1a00-0000-9d26-f0453e070000 pid=1854 execve guuid=d0fe5725-1a00-0000-9d26-f04540070000 pid=1856 /usr/bin/ls guuid=8a7da723-1a00-0000-9d26-f04537070000 pid=1847->guuid=d0fe5725-1a00-0000-9d26-f04540070000 pid=1856 execve guuid=bf30d225-1a00-0000-9d26-f04542070000 pid=1858 /usr/bin/mkdir guuid=8a7da723-1a00-0000-9d26-f04537070000 pid=1847->guuid=bf30d225-1a00-0000-9d26-f04542070000 pid=1858 execve guuid=2a124726-1a00-0000-9d26-f04544070000 pid=1860 /usr/bin/mv guuid=8a7da723-1a00-0000-9d26-f04537070000 pid=1847->guuid=2a124726-1a00-0000-9d26-f04544070000 pid=1860 execve guuid=ca1ae426-1a00-0000-9d26-f04545070000 pid=1861 /usr/bin/bash guuid=8a7da723-1a00-0000-9d26-f04537070000 pid=1847->guuid=ca1ae426-1a00-0000-9d26-f04545070000 pid=1861 clone guuid=745ff226-1a00-0000-9d26-f04546070000 pid=1862 /usr/bin/base64 write-file guuid=8a7da723-1a00-0000-9d26-f04537070000 pid=1847->guuid=745ff226-1a00-0000-9d26-f04546070000 pid=1862 execve guuid=99308227-1a00-0000-9d26-f04547070000 pid=1863 /usr/bin/rm delete-file guuid=8a7da723-1a00-0000-9d26-f04537070000 pid=1847->guuid=99308227-1a00-0000-9d26-f04547070000 pid=1863 execve guuid=d2e0dc27-1a00-0000-9d26-f0454a070000 pid=1866 /usr/bin/mv guuid=8a7da723-1a00-0000-9d26-f04537070000 pid=1847->guuid=d2e0dc27-1a00-0000-9d26-f0454a070000 pid=1866 execve guuid=f3168d28-1a00-0000-9d26-f0454c070000 pid=1868 /usr/bin/ls guuid=8a7da723-1a00-0000-9d26-f04537070000 pid=1847->guuid=f3168d28-1a00-0000-9d26-f0454c070000 pid=1868 execve guuid=a79b5729-1a00-0000-9d26-f04550070000 pid=1872 /usr/bin/bash guuid=8a7da723-1a00-0000-9d26-f04537070000 pid=1847->guuid=a79b5729-1a00-0000-9d26-f04550070000 pid=1872 clone guuid=e2a96329-1a00-0000-9d26-f04551070000 pid=1873 /usr/bin/base64 write-file guuid=8a7da723-1a00-0000-9d26-f04537070000 pid=1847->guuid=e2a96329-1a00-0000-9d26-f04551070000 pid=1873 execve guuid=127af629-1a00-0000-9d26-f04552070000 pid=1874 /usr/bin/ls guuid=8a7da723-1a00-0000-9d26-f04537070000 pid=1847->guuid=127af629-1a00-0000-9d26-f04552070000 pid=1874 execve guuid=1727bb2a-1a00-0000-9d26-f04554070000 pid=1876 /usr/bin/cat guuid=8a7da723-1a00-0000-9d26-f04537070000 pid=1847->guuid=1727bb2a-1a00-0000-9d26-f04554070000 pid=1876 execve guuid=57ed1a2b-1a00-0000-9d26-f04555070000 pid=1877 /usr/bin/ls guuid=8a7da723-1a00-0000-9d26-f04537070000 pid=1847->guuid=57ed1a2b-1a00-0000-9d26-f04555070000 pid=1877 execve guuid=a80d132d-1a00-0000-9d26-f0455f070000 pid=1887->124ee36c-bdbd-5d46-bbb1-b2cd81367f04 send: 93B
Score:
81%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/c11ee1171bb97d0fe11d880aa65aadda5221fd5cf98cfcbc6e27cd9213bb9716
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/c11ee1171bb97d0fe11d880aa65aadda5221fd5cf98cfcbc6e27cd9213bb9716/
Threat name:
Linux.Backdoor.WebShell
Create hunting rule
Status:
Malicious
First seen:
2026-07-28 05:45:50 UTC
File Type:
Text (Shell)
AV detection:
15 of 36 (41.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=yepocfy3xf6q7yi5rafkmwvn3jjcd7k47ggpzpdoe7gzee53s4la._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260728-gfc2pabr5w/
Behaviour
Reads runtime system information
Writes file to tmp directory
Deobfuscate/Decode Files or Information
Checks CPU configuration
File and Directory Permissions Modification
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.16
Link:
https://yomi.yoroi.company/submissions/c11ee1171bb97d0fe11d880aa65aadda5221fd5cf98cfcbc6e27cd9213bb9716

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SUSP_LNX_Base64_Exec_Apr24
Create hunting rule
Author:Christian Burkard
Description:Detects suspicious base64 encoded shell commands (as seen in Palo Alto CVE-2024-3400 exploitation)
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh c11ee1171bb97d0fe11d880aa65aadda5221fd5cf98cfcbc6e27cd9213bb9716

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3884409/
  
Delivery method
Distributed via web download

Comments