MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cdd3196e256f78a2ef83434e0eaa69a258ea4a1b3bb8ef2a7b22a4bd6fab9c55. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: cdd3196e256f78a2ef83434e0eaa69a258ea4a1b3bb8ef2a7b22a4bd6fab9c55
SHA3-384 hash: 9adda9d4a5fde20ab92951e98a5429b1aaf876939685a3f647cca43dafb39885facd018a396468ea78a767a997829d2f
SHA1 hash: 60f1ba33262cb61097a3b2cbe20aaaa028261b8f
MD5 hash: e6bb48a80f90bd193abce14af82b5804
humanhash: wolfram-autumn-orange-fourteen
File name:wr.php
Download: download sample
File size:27'042 bytes
First seen:2026-08-16 20:28:14 UTC
Last seen:2026-08-17 14:25:52 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 768:g8vCB+25j6es8Ra9FYpMSUpi+20qUpi+20YQX:g8l25JMd2QX
TLSH T136C27D966A867C44BEC98A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11F9CD618B1A
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://160.119.69.4/z/post/noroot.phpn/an/aelf ua-wget

Intelligence

File Origin
# of uploads :
3
# of downloads :
67
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.DownLoader.2862.7285.14664.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive masquerade
Link:
https://www.filescan.io/uploads/6a821d67299c3d73d3937fef/reports/728b5e94-87f2-4e29-8583-ce7636568b6d/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-08-16T18:35:00Z UTC
Last seen:
2026-08-16T19:40:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/cdd3196e256f78a2ef83434e0eaa69a258ea4a1b3bb8ef2a7b22a4bd6fab9c55/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/82963f55-27b9-4c76-9bf5-2e1a22cee407
Behavior Graph:
Download SVG
%3 guuid=040595f2-1600-0000-ba1e-9c3ed20d0000 pid=3538 /usr/bin/sudo guuid=db6d7ef5-1600-0000-ba1e-9c3ed30d0000 pid=3539 /tmp/sample.bin guuid=040595f2-1600-0000-ba1e-9c3ed20d0000 pid=3538->guuid=db6d7ef5-1600-0000-ba1e-9c3ed30d0000 pid=3539 execve guuid=e70a57f6-1600-0000-ba1e-9c3ed40d0000 pid=3540 /usr/bin/bash guuid=db6d7ef5-1600-0000-ba1e-9c3ed30d0000 pid=3539->guuid=e70a57f6-1600-0000-ba1e-9c3ed40d0000 pid=3540 clone guuid=7acd65f6-1600-0000-ba1e-9c3ed50d0000 pid=3541 /usr/bin/base64 guuid=db6d7ef5-1600-0000-ba1e-9c3ed30d0000 pid=3539->guuid=7acd65f6-1600-0000-ba1e-9c3ed50d0000 pid=3541 execve guuid=e8f570f6-1600-0000-ba1e-9c3ed60d0000 pid=3542 /usr/bin/bash guuid=db6d7ef5-1600-0000-ba1e-9c3ed30d0000 pid=3539->guuid=e8f570f6-1600-0000-ba1e-9c3ed60d0000 pid=3542 clone guuid=8cb852f7-1600-0000-ba1e-9c3ed70d0000 pid=3543 /usr/bin/cp guuid=db6d7ef5-1600-0000-ba1e-9c3ed30d0000 pid=3539->guuid=8cb852f7-1600-0000-ba1e-9c3ed70d0000 pid=3543 execve guuid=437901f8-1600-0000-ba1e-9c3ed80d0000 pid=3544 /usr/bin/mkdir guuid=db6d7ef5-1600-0000-ba1e-9c3ed30d0000 pid=3539->guuid=437901f8-1600-0000-ba1e-9c3ed80d0000 pid=3544 execve guuid=59dc7af8-1600-0000-ba1e-9c3ed90d0000 pid=3545 /usr/bin/mkdir guuid=db6d7ef5-1600-0000-ba1e-9c3ed30d0000 pid=3539->guuid=59dc7af8-1600-0000-ba1e-9c3ed90d0000 pid=3545 execve guuid=d992eff8-1600-0000-ba1e-9c3eda0d0000 pid=3546 /usr/bin/mkdir guuid=db6d7ef5-1600-0000-ba1e-9c3ed30d0000 pid=3539->guuid=d992eff8-1600-0000-ba1e-9c3eda0d0000 pid=3546 execve guuid=d3d562f9-1600-0000-ba1e-9c3edc0d0000 pid=3548 /usr/bin/mkdir guuid=db6d7ef5-1600-0000-ba1e-9c3ed30d0000 pid=3539->guuid=d3d562f9-1600-0000-ba1e-9c3edc0d0000 pid=3548 execve guuid=3a40bdf9-1600-0000-ba1e-9c3edf0d0000 pid=3551 /usr/bin/mkdir guuid=db6d7ef5-1600-0000-ba1e-9c3ed30d0000 pid=3539->guuid=3a40bdf9-1600-0000-ba1e-9c3edf0d0000 pid=3551 execve guuid=e3cf12fa-1600-0000-ba1e-9c3ee30d0000 pid=3555 /usr/bin/mkdir guuid=db6d7ef5-1600-0000-ba1e-9c3ed30d0000 pid=3539->guuid=e3cf12fa-1600-0000-ba1e-9c3ee30d0000 pid=3555 execve guuid=48487afa-1600-0000-ba1e-9c3ee50d0000 pid=3557 /usr/bin/mkdir guuid=db6d7ef5-1600-0000-ba1e-9c3ed30d0000 pid=3539->guuid=48487afa-1600-0000-ba1e-9c3ee50d0000 pid=3557 execve guuid=b5f614fb-1600-0000-ba1e-9c3ee70d0000 pid=3559 /usr/bin/mkdir guuid=db6d7ef5-1600-0000-ba1e-9c3ed30d0000 pid=3539->guuid=b5f614fb-1600-0000-ba1e-9c3ee70d0000 pid=3559 execve guuid=a4e7c4fb-1600-0000-ba1e-9c3ee90d0000 pid=3561 /usr/bin/mkdir guuid=db6d7ef5-1600-0000-ba1e-9c3ed30d0000 pid=3539->guuid=a4e7c4fb-1600-0000-ba1e-9c3ee90d0000 pid=3561 execve guuid=88ed6dfc-1600-0000-ba1e-9c3eeb0d0000 pid=3563 /usr/bin/cp guuid=db6d7ef5-1600-0000-ba1e-9c3ed30d0000 pid=3539->guuid=88ed6dfc-1600-0000-ba1e-9c3eeb0d0000 pid=3563 execve guuid=2bc749fd-1600-0000-ba1e-9c3eec0d0000 pid=3564 /usr/bin/cp guuid=db6d7ef5-1600-0000-ba1e-9c3ed30d0000 pid=3539->guuid=2bc749fd-1600-0000-ba1e-9c3eec0d0000 pid=3564 execve guuid=81fd2afe-1600-0000-ba1e-9c3eef0d0000 pid=3567 /usr/bin/cp guuid=db6d7ef5-1600-0000-ba1e-9c3ed30d0000 pid=3539->guuid=81fd2afe-1600-0000-ba1e-9c3eef0d0000 pid=3567 execve guuid=c4c979ff-1600-0000-ba1e-9c3ef00d0000 pid=3568 /usr/bin/cp guuid=db6d7ef5-1600-0000-ba1e-9c3ed30d0000 pid=3539->guuid=c4c979ff-1600-0000-ba1e-9c3ef00d0000 pid=3568 execve guuid=1617db00-1700-0000-ba1e-9c3ef10d0000 pid=3569 /usr/bin/cp guuid=db6d7ef5-1600-0000-ba1e-9c3ed30d0000 pid=3539->guuid=1617db00-1700-0000-ba1e-9c3ef10d0000 pid=3569 execve guuid=f99b0202-1700-0000-ba1e-9c3ef20d0000 pid=3570 /usr/bin/cp guuid=db6d7ef5-1600-0000-ba1e-9c3ed30d0000 pid=3539->guuid=f99b0202-1700-0000-ba1e-9c3ef20d0000 pid=3570 execve guuid=c5e1e302-1700-0000-ba1e-9c3ef30d0000 pid=3571 /usr/bin/cp guuid=db6d7ef5-1600-0000-ba1e-9c3ed30d0000 pid=3539->guuid=c5e1e302-1700-0000-ba1e-9c3ef30d0000 pid=3571 execve guuid=904cda03-1700-0000-ba1e-9c3ef40d0000 pid=3572 /usr/bin/cp guuid=db6d7ef5-1600-0000-ba1e-9c3ed30d0000 pid=3539->guuid=904cda03-1700-0000-ba1e-9c3ef40d0000 pid=3572 execve guuid=95b5bc04-1700-0000-ba1e-9c3ef50d0000 pid=3573 /usr/bin/cp guuid=db6d7ef5-1600-0000-ba1e-9c3ed30d0000 pid=3539->guuid=95b5bc04-1700-0000-ba1e-9c3ef50d0000 pid=3573 execve guuid=cd47be05-1700-0000-ba1e-9c3ef60d0000 pid=3574 /usr/bin/cp guuid=db6d7ef5-1600-0000-ba1e-9c3ed30d0000 pid=3539->guuid=cd47be05-1700-0000-ba1e-9c3ef60d0000 pid=3574 execve guuid=41fa0207-1700-0000-ba1e-9c3efa0d0000 pid=3578 /usr/bin/cp guuid=db6d7ef5-1600-0000-ba1e-9c3ed30d0000 pid=3539->guuid=41fa0207-1700-0000-ba1e-9c3efa0d0000 pid=3578 execve guuid=c7732908-1700-0000-ba1e-9c3efb0d0000 pid=3579 /usr/bin/cp guuid=db6d7ef5-1600-0000-ba1e-9c3ed30d0000 pid=3539->guuid=c7732908-1700-0000-ba1e-9c3efb0d0000 pid=3579 execve guuid=a37c5609-1700-0000-ba1e-9c3efc0d0000 pid=3580 /usr/bin/cp guuid=db6d7ef5-1600-0000-ba1e-9c3ed30d0000 pid=3539->guuid=a37c5609-1700-0000-ba1e-9c3efc0d0000 pid=3580 execve guuid=58dd600a-1700-0000-ba1e-9c3efd0d0000 pid=3581 /usr/bin/cp guuid=db6d7ef5-1600-0000-ba1e-9c3ed30d0000 pid=3539->guuid=58dd600a-1700-0000-ba1e-9c3efd0d0000 pid=3581 execve guuid=ed86290b-1700-0000-ba1e-9c3efe0d0000 pid=3582 /usr/bin/touch guuid=db6d7ef5-1600-0000-ba1e-9c3ed30d0000 pid=3539->guuid=ed86290b-1700-0000-ba1e-9c3efe0d0000 pid=3582 execve guuid=7a75cf0b-1700-0000-ba1e-9c3e020e0000 pid=3586 /usr/bin/chmod guuid=db6d7ef5-1600-0000-ba1e-9c3ed30d0000 pid=3539->guuid=7a75cf0b-1700-0000-ba1e-9c3e020e0000 pid=3586 execve guuid=f286a60c-1700-0000-ba1e-9c3e030e0000 pid=3587 /usr/bin/chmod guuid=db6d7ef5-1600-0000-ba1e-9c3ed30d0000 pid=3539->guuid=f286a60c-1700-0000-ba1e-9c3e030e0000 pid=3587 execve guuid=4abd0e0d-1700-0000-ba1e-9c3e050e0000 pid=3589 /usr/bin/chattr guuid=db6d7ef5-1600-0000-ba1e-9c3ed30d0000 pid=3539->guuid=4abd0e0d-1700-0000-ba1e-9c3e050e0000 pid=3589 execve guuid=0c5b960d-1700-0000-ba1e-9c3e070e0000 pid=3591 /usr/bin/chattr guuid=db6d7ef5-1600-0000-ba1e-9c3ed30d0000 pid=3539->guuid=0c5b960d-1700-0000-ba1e-9c3e070e0000 pid=3591 execve guuid=789df90d-1700-0000-ba1e-9c3e080e0000 pid=3592 /usr/bin/chattr guuid=db6d7ef5-1600-0000-ba1e-9c3ed30d0000 pid=3539->guuid=789df90d-1700-0000-ba1e-9c3e080e0000 pid=3592 execve guuid=68315d0e-1700-0000-ba1e-9c3e0a0e0000 pid=3594 /usr/bin/chattr guuid=db6d7ef5-1600-0000-ba1e-9c3ed30d0000 pid=3539->guuid=68315d0e-1700-0000-ba1e-9c3e0a0e0000 pid=3594 execve guuid=c95bcb0e-1700-0000-ba1e-9c3e0b0e0000 pid=3595 /usr/bin/chattr guuid=db6d7ef5-1600-0000-ba1e-9c3ed30d0000 pid=3539->guuid=c95bcb0e-1700-0000-ba1e-9c3e0b0e0000 pid=3595 execve guuid=82062c0f-1700-0000-ba1e-9c3e0d0e0000 pid=3597 /usr/bin/chattr guuid=db6d7ef5-1600-0000-ba1e-9c3ed30d0000 pid=3539->guuid=82062c0f-1700-0000-ba1e-9c3e0d0e0000 pid=3597 execve guuid=66718d0f-1700-0000-ba1e-9c3e0f0e0000 pid=3599 /usr/bin/chattr guuid=db6d7ef5-1600-0000-ba1e-9c3ed30d0000 pid=3539->guuid=66718d0f-1700-0000-ba1e-9c3e0f0e0000 pid=3599 execve guuid=11b63710-1700-0000-ba1e-9c3e110e0000 pid=3601 /usr/bin/chattr guuid=db6d7ef5-1600-0000-ba1e-9c3ed30d0000 pid=3539->guuid=11b63710-1700-0000-ba1e-9c3e110e0000 pid=3601 execve guuid=73629610-1700-0000-ba1e-9c3e120e0000 pid=3602 /usr/bin/bash guuid=db6d7ef5-1600-0000-ba1e-9c3ed30d0000 pid=3539->guuid=73629610-1700-0000-ba1e-9c3e120e0000 pid=3602 clone guuid=3f54a010-1700-0000-ba1e-9c3e140e0000 pid=3604 /usr/bin/bash guuid=db6d7ef5-1600-0000-ba1e-9c3ed30d0000 pid=3539->guuid=3f54a010-1700-0000-ba1e-9c3e140e0000 pid=3604 clone guuid=b0aad710-1700-0000-ba1e-9c3e150e0000 pid=3605 /usr/bin/curl net send-data guuid=db6d7ef5-1600-0000-ba1e-9c3ed30d0000 pid=3539->guuid=b0aad710-1700-0000-ba1e-9c3e150e0000 pid=3605 execve guuid=28f1df10-1700-0000-ba1e-9c3e160e0000 pid=3606 /usr/bin/dash guuid=db6d7ef5-1600-0000-ba1e-9c3ed30d0000 pid=3539->guuid=28f1df10-1700-0000-ba1e-9c3e160e0000 pid=3606 execve guuid=36daca18-1700-0000-ba1e-9c3e250e0000 pid=3621 /usr/bin/bash guuid=db6d7ef5-1600-0000-ba1e-9c3ed30d0000 pid=3539->guuid=36daca18-1700-0000-ba1e-9c3e250e0000 pid=3621 clone guuid=a10fd218-1700-0000-ba1e-9c3e260e0000 pid=3622 /usr/bin/base64 guuid=db6d7ef5-1600-0000-ba1e-9c3ed30d0000 pid=3539->guuid=a10fd218-1700-0000-ba1e-9c3e260e0000 pid=3622 execve guuid=1630da18-1700-0000-ba1e-9c3e280e0000 pid=3624 /usr/bin/tee write-file guuid=db6d7ef5-1600-0000-ba1e-9c3ed30d0000 pid=3539->guuid=1630da18-1700-0000-ba1e-9c3e280e0000 pid=3624 execve guuid=62a15c1d-1700-0000-ba1e-9c3e320e0000 pid=3634 /usr/bin/bash guuid=db6d7ef5-1600-0000-ba1e-9c3ed30d0000 pid=3539->guuid=62a15c1d-1700-0000-ba1e-9c3e320e0000 pid=3634 execve guuid=92ba3425-1700-0000-ba1e-9c3e630e0000 pid=3683 /usr/bin/bash guuid=db6d7ef5-1600-0000-ba1e-9c3ed30d0000 pid=3539->guuid=92ba3425-1700-0000-ba1e-9c3e630e0000 pid=3683 execve guuid=3f1f9525-1700-0000-ba1e-9c3e650e0000 pid=3685 /usr/bin/rm delete-file guuid=db6d7ef5-1600-0000-ba1e-9c3ed30d0000 pid=3539->guuid=3f1f9525-1700-0000-ba1e-9c3e650e0000 pid=3685 execve guuid=20fddb25-1700-0000-ba1e-9c3e670e0000 pid=3687 /usr/bin/rm guuid=db6d7ef5-1600-0000-ba1e-9c3ed30d0000 pid=3539->guuid=20fddb25-1700-0000-ba1e-9c3e670e0000 pid=3687 execve guuid=8c452026-1700-0000-ba1e-9c3e690e0000 pid=3689 /usr/bin/curl net send-data guuid=db6d7ef5-1600-0000-ba1e-9c3ed30d0000 pid=3539->guuid=8c452026-1700-0000-ba1e-9c3e690e0000 pid=3689 execve guuid=9aff2826-1700-0000-ba1e-9c3e6a0e0000 pid=3690 /usr/bin/dash guuid=db6d7ef5-1600-0000-ba1e-9c3ed30d0000 pid=3539->guuid=9aff2826-1700-0000-ba1e-9c3e6a0e0000 pid=3690 execve 124ee36c-bdbd-5d46-bbb1-b2cd81367f04 160.119.69.4:80 guuid=b0aad710-1700-0000-ba1e-9c3e150e0000 pid=3605->124ee36c-bdbd-5d46-bbb1-b2cd81367f04 send: 93B guuid=d6bb301e-1700-0000-ba1e-9c3e360e0000 pid=3638 /usr/bin/bash guuid=62a15c1d-1700-0000-ba1e-9c3e320e0000 pid=3634->guuid=d6bb301e-1700-0000-ba1e-9c3e360e0000 pid=3638 clone guuid=6fb43a1e-1700-0000-ba1e-9c3e370e0000 pid=3639 /usr/bin/bash guuid=62a15c1d-1700-0000-ba1e-9c3e320e0000 pid=3634->guuid=6fb43a1e-1700-0000-ba1e-9c3e370e0000 pid=3639 clone guuid=52b1751e-1700-0000-ba1e-9c3e3b0e0000 pid=3643 /usr/bin/ls guuid=62a15c1d-1700-0000-ba1e-9c3e320e0000 pid=3634->guuid=52b1751e-1700-0000-ba1e-9c3e3b0e0000 pid=3643 execve guuid=2a10441f-1700-0000-ba1e-9c3e3c0e0000 pid=3644 /usr/bin/cat guuid=62a15c1d-1700-0000-ba1e-9c3e320e0000 pid=3634->guuid=2a10441f-1700-0000-ba1e-9c3e3c0e0000 pid=3644 execve guuid=87a6fc1f-1700-0000-ba1e-9c3e3e0e0000 pid=3646 /usr/bin/ls guuid=62a15c1d-1700-0000-ba1e-9c3e320e0000 pid=3634->guuid=87a6fc1f-1700-0000-ba1e-9c3e3e0e0000 pid=3646 execve guuid=4d64ac20-1700-0000-ba1e-9c3e430e0000 pid=3651 /usr/bin/mkdir guuid=62a15c1d-1700-0000-ba1e-9c3e320e0000 pid=3634->guuid=4d64ac20-1700-0000-ba1e-9c3e430e0000 pid=3651 execve guuid=a6531921-1700-0000-ba1e-9c3e470e0000 pid=3655 /usr/bin/mv guuid=62a15c1d-1700-0000-ba1e-9c3e320e0000 pid=3634->guuid=a6531921-1700-0000-ba1e-9c3e470e0000 pid=3655 execve guuid=8a228d21-1700-0000-ba1e-9c3e490e0000 pid=3657 /usr/bin/bash guuid=62a15c1d-1700-0000-ba1e-9c3e320e0000 pid=3634->guuid=8a228d21-1700-0000-ba1e-9c3e490e0000 pid=3657 clone guuid=81ef9421-1700-0000-ba1e-9c3e4a0e0000 pid=3658 /usr/bin/base64 write-file guuid=62a15c1d-1700-0000-ba1e-9c3e320e0000 pid=3634->guuid=81ef9421-1700-0000-ba1e-9c3e4a0e0000 pid=3658 execve guuid=e19cfc21-1700-0000-ba1e-9c3e4c0e0000 pid=3660 /usr/bin/rm delete-file guuid=62a15c1d-1700-0000-ba1e-9c3e320e0000 pid=3634->guuid=e19cfc21-1700-0000-ba1e-9c3e4c0e0000 pid=3660 execve guuid=97415722-1700-0000-ba1e-9c3e4e0e0000 pid=3662 /usr/bin/mv guuid=62a15c1d-1700-0000-ba1e-9c3e320e0000 pid=3634->guuid=97415722-1700-0000-ba1e-9c3e4e0e0000 pid=3662 execve guuid=b408cb22-1700-0000-ba1e-9c3e510e0000 pid=3665 /usr/bin/ls guuid=62a15c1d-1700-0000-ba1e-9c3e320e0000 pid=3634->guuid=b408cb22-1700-0000-ba1e-9c3e510e0000 pid=3665 execve guuid=3b614b23-1700-0000-ba1e-9c3e550e0000 pid=3669 /usr/bin/bash guuid=62a15c1d-1700-0000-ba1e-9c3e320e0000 pid=3634->guuid=3b614b23-1700-0000-ba1e-9c3e550e0000 pid=3669 clone guuid=edab5323-1700-0000-ba1e-9c3e560e0000 pid=3670 /usr/bin/base64 write-file guuid=62a15c1d-1700-0000-ba1e-9c3e320e0000 pid=3634->guuid=edab5323-1700-0000-ba1e-9c3e560e0000 pid=3670 execve guuid=a63dc623-1700-0000-ba1e-9c3e590e0000 pid=3673 /usr/bin/ls guuid=62a15c1d-1700-0000-ba1e-9c3e320e0000 pid=3634->guuid=a63dc623-1700-0000-ba1e-9c3e590e0000 pid=3673 execve guuid=edb15b24-1700-0000-ba1e-9c3e5d0e0000 pid=3677 /usr/bin/cat guuid=62a15c1d-1700-0000-ba1e-9c3e320e0000 pid=3634->guuid=edb15b24-1700-0000-ba1e-9c3e5d0e0000 pid=3677 execve guuid=84d5ac24-1700-0000-ba1e-9c3e610e0000 pid=3681 /usr/bin/ls guuid=62a15c1d-1700-0000-ba1e-9c3e320e0000 pid=3634->guuid=84d5ac24-1700-0000-ba1e-9c3e610e0000 pid=3681 execve guuid=8c452026-1700-0000-ba1e-9c3e690e0000 pid=3689->124ee36c-bdbd-5d46-bbb1-b2cd81367f04 send: 93B
Score:
81%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/cdd3196e256f78a2ef83434e0eaa69a258ea4a1b3bb8ef2a7b22a4bd6fab9c55
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/cdd3196e256f78a2ef83434e0eaa69a258ea4a1b3bb8ef2a7b22a4bd6fab9c55/
Threat name:
Linux.Backdoor.WebShell
Create hunting rule
Status:
Malicious
First seen:
2026-08-16 20:29:32 UTC
File Type:
Text (Shell)
AV detection:
16 of 36 (44.44%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zxjrs3rfn54kf34dinha5ktjujmousq3ho4o6kt3eksl235ltrkq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260816-y869nswhne/
Behaviour
Reads runtime system information
Writes file to tmp directory
Deobfuscate/Decode Files or Information
Checks CPU configuration
File and Directory Permissions Modification
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.16
Link:
https://yomi.yoroi.company/submissions/cdd3196e256f78a2ef83434e0eaa69a258ea4a1b3bb8ef2a7b22a4bd6fab9c55

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SUSP_LNX_Base64_Exec_Apr24
Create hunting rule
Author:Christian Burkard
Description:Detects suspicious base64 encoded shell commands (as seen in Palo Alto CVE-2024-3400 exploitation)
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh cdd3196e256f78a2ef83434e0eaa69a258ea4a1b3bb8ef2a7b22a4bd6fab9c55

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3884409/
  
Delivery method
Distributed via web download

Comments