MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d254c78168eeeca095efc113e6a352308ca3d2d3910aefa426b52e0a3745bb0e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d254c78168eeeca095efc113e6a352308ca3d2d3910aefa426b52e0a3745bb0e
SHA3-384 hash: 4751d99e5de5e32709bf77a573625776ef236f2f38d85823790a60fb8897210b1ea88190833cf6d83ebb06c9d0eea4fc
SHA1 hash: c1debc1c4ab3753e25532975d52db3ae4a2d175c
MD5 hash: 7c30b3fb64224cff9c85a3883ab807bc
humanhash: artist-mobile-zebra-kentucky
File name:wr.php
Download: download sample
File size:27'042 bytes
First seen:2026-08-10 07:19:29 UTC
Last seen:2026-08-10 21:51:39 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 768:18vCB+25j6es8Rrq9FYpMSUpi+20qUpi+20YQX:18l25J4d2QX
TLSH T163C27D966A867C44BDC98A3E4CBD2B0D6DF5C3D1324942AC3D9A3C719C11FACD618B1A
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://160.119.69.4/z/post/noroot.phpn/an/aelf ua-wget

Intelligence

File Origin
# of uploads :
3
# of downloads :
52
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.DownLoader.2862.1718.2598.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive masquerade
Link:
https://www.filescan.io/uploads/6a797bb8cad448d6d9af4902/reports/0f149ed1-0d85-4709-b028-eaaf0afe1095/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-08-10T05:41:00Z UTC
Last seen:
2026-08-10T05:52:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/d254c78168eeeca095efc113e6a352308ca3d2d3910aefa426b52e0a3745bb0e/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/7faf95bf-a4aa-4915-9a54-b7095722f27f
Behavior Graph:
Download SVG
%3 guuid=d2f83c34-1b00-0000-aaf0-1b88f4090000 pid=2548 /usr/bin/sudo guuid=eecf1338-1b00-0000-aaf0-1b88fd090000 pid=2557 /tmp/sample.bin guuid=d2f83c34-1b00-0000-aaf0-1b88f4090000 pid=2548->guuid=eecf1338-1b00-0000-aaf0-1b88fd090000 pid=2557 execve guuid=88f4e138-1b00-0000-aaf0-1b88ff090000 pid=2559 /usr/bin/bash guuid=eecf1338-1b00-0000-aaf0-1b88fd090000 pid=2557->guuid=88f4e138-1b00-0000-aaf0-1b88ff090000 pid=2559 clone guuid=2dbb1f39-1b00-0000-aaf0-1b88010a0000 pid=2561 /usr/bin/base64 guuid=eecf1338-1b00-0000-aaf0-1b88fd090000 pid=2557->guuid=2dbb1f39-1b00-0000-aaf0-1b88010a0000 pid=2561 execve guuid=fd497b39-1b00-0000-aaf0-1b88020a0000 pid=2562 /usr/bin/bash guuid=eecf1338-1b00-0000-aaf0-1b88fd090000 pid=2557->guuid=fd497b39-1b00-0000-aaf0-1b88020a0000 pid=2562 clone guuid=b734853a-1b00-0000-aaf0-1b88050a0000 pid=2565 /usr/bin/cp guuid=eecf1338-1b00-0000-aaf0-1b88fd090000 pid=2557->guuid=b734853a-1b00-0000-aaf0-1b88050a0000 pid=2565 execve guuid=d0f84b3b-1b00-0000-aaf0-1b88080a0000 pid=2568 /usr/bin/mkdir guuid=eecf1338-1b00-0000-aaf0-1b88fd090000 pid=2557->guuid=d0f84b3b-1b00-0000-aaf0-1b88080a0000 pid=2568 execve guuid=78e6903c-1b00-0000-aaf0-1b880c0a0000 pid=2572 /usr/bin/mkdir guuid=eecf1338-1b00-0000-aaf0-1b88fd090000 pid=2557->guuid=78e6903c-1b00-0000-aaf0-1b880c0a0000 pid=2572 execve guuid=5676913d-1b00-0000-aaf0-1b880f0a0000 pid=2575 /usr/bin/mkdir guuid=eecf1338-1b00-0000-aaf0-1b88fd090000 pid=2557->guuid=5676913d-1b00-0000-aaf0-1b880f0a0000 pid=2575 execve guuid=3916753e-1b00-0000-aaf0-1b88120a0000 pid=2578 /usr/bin/mkdir guuid=eecf1338-1b00-0000-aaf0-1b88fd090000 pid=2557->guuid=3916753e-1b00-0000-aaf0-1b88120a0000 pid=2578 execve guuid=8a6f663f-1b00-0000-aaf0-1b88160a0000 pid=2582 /usr/bin/mkdir guuid=eecf1338-1b00-0000-aaf0-1b88fd090000 pid=2557->guuid=8a6f663f-1b00-0000-aaf0-1b88160a0000 pid=2582 execve guuid=cbde7040-1b00-0000-aaf0-1b881a0a0000 pid=2586 /usr/bin/mkdir guuid=eecf1338-1b00-0000-aaf0-1b88fd090000 pid=2557->guuid=cbde7040-1b00-0000-aaf0-1b881a0a0000 pid=2586 execve guuid=0fd36741-1b00-0000-aaf0-1b881d0a0000 pid=2589 /usr/bin/mkdir guuid=eecf1338-1b00-0000-aaf0-1b88fd090000 pid=2557->guuid=0fd36741-1b00-0000-aaf0-1b881d0a0000 pid=2589 execve guuid=d9341c42-1b00-0000-aaf0-1b88200a0000 pid=2592 /usr/bin/mkdir guuid=eecf1338-1b00-0000-aaf0-1b88fd090000 pid=2557->guuid=d9341c42-1b00-0000-aaf0-1b88200a0000 pid=2592 execve guuid=575ff342-1b00-0000-aaf0-1b88230a0000 pid=2595 /usr/bin/mkdir guuid=eecf1338-1b00-0000-aaf0-1b88fd090000 pid=2557->guuid=575ff342-1b00-0000-aaf0-1b88230a0000 pid=2595 execve guuid=8481d543-1b00-0000-aaf0-1b88270a0000 pid=2599 /usr/bin/cp guuid=eecf1338-1b00-0000-aaf0-1b88fd090000 pid=2557->guuid=8481d543-1b00-0000-aaf0-1b88270a0000 pid=2599 execve guuid=af1cba45-1b00-0000-aaf0-1b882c0a0000 pid=2604 /usr/bin/cp guuid=eecf1338-1b00-0000-aaf0-1b88fd090000 pid=2557->guuid=af1cba45-1b00-0000-aaf0-1b882c0a0000 pid=2604 execve guuid=b5ce4c47-1b00-0000-aaf0-1b88310a0000 pid=2609 /usr/bin/cp guuid=eecf1338-1b00-0000-aaf0-1b88fd090000 pid=2557->guuid=b5ce4c47-1b00-0000-aaf0-1b88310a0000 pid=2609 execve guuid=3aa47e48-1b00-0000-aaf0-1b88350a0000 pid=2613 /usr/bin/cp guuid=eecf1338-1b00-0000-aaf0-1b88fd090000 pid=2557->guuid=3aa47e48-1b00-0000-aaf0-1b88350a0000 pid=2613 execve guuid=d6a5f549-1b00-0000-aaf0-1b883a0a0000 pid=2618 /usr/bin/cp guuid=eecf1338-1b00-0000-aaf0-1b88fd090000 pid=2557->guuid=d6a5f549-1b00-0000-aaf0-1b883a0a0000 pid=2618 execve guuid=c053874b-1b00-0000-aaf0-1b883f0a0000 pid=2623 /usr/bin/cp guuid=eecf1338-1b00-0000-aaf0-1b88fd090000 pid=2557->guuid=c053874b-1b00-0000-aaf0-1b883f0a0000 pid=2623 execve guuid=a7370c4d-1b00-0000-aaf0-1b88420a0000 pid=2626 /usr/bin/cp guuid=eecf1338-1b00-0000-aaf0-1b88fd090000 pid=2557->guuid=a7370c4d-1b00-0000-aaf0-1b88420a0000 pid=2626 execve guuid=23abb74d-1b00-0000-aaf0-1b88460a0000 pid=2630 /usr/bin/cp guuid=eecf1338-1b00-0000-aaf0-1b88fd090000 pid=2557->guuid=23abb74d-1b00-0000-aaf0-1b88460a0000 pid=2630 execve guuid=2f31524e-1b00-0000-aaf0-1b88470a0000 pid=2631 /usr/bin/cp guuid=eecf1338-1b00-0000-aaf0-1b88fd090000 pid=2557->guuid=2f31524e-1b00-0000-aaf0-1b88470a0000 pid=2631 execve guuid=d1b80b4f-1b00-0000-aaf0-1b88480a0000 pid=2632 /usr/bin/cp guuid=eecf1338-1b00-0000-aaf0-1b88fd090000 pid=2557->guuid=d1b80b4f-1b00-0000-aaf0-1b88480a0000 pid=2632 execve guuid=4843d74f-1b00-0000-aaf0-1b88490a0000 pid=2633 /usr/bin/cp guuid=eecf1338-1b00-0000-aaf0-1b88fd090000 pid=2557->guuid=4843d74f-1b00-0000-aaf0-1b88490a0000 pid=2633 execve guuid=64d84150-1b00-0000-aaf0-1b884a0a0000 pid=2634 /usr/bin/cp guuid=eecf1338-1b00-0000-aaf0-1b88fd090000 pid=2557->guuid=64d84150-1b00-0000-aaf0-1b884a0a0000 pid=2634 execve guuid=9a342351-1b00-0000-aaf0-1b884e0a0000 pid=2638 /usr/bin/cp guuid=eecf1338-1b00-0000-aaf0-1b88fd090000 pid=2557->guuid=9a342351-1b00-0000-aaf0-1b884e0a0000 pid=2638 execve guuid=84919451-1b00-0000-aaf0-1b88500a0000 pid=2640 /usr/bin/cp guuid=eecf1338-1b00-0000-aaf0-1b88fd090000 pid=2557->guuid=84919451-1b00-0000-aaf0-1b88500a0000 pid=2640 execve guuid=e0a92652-1b00-0000-aaf0-1b88530a0000 pid=2643 /usr/bin/touch guuid=eecf1338-1b00-0000-aaf0-1b88fd090000 pid=2557->guuid=e0a92652-1b00-0000-aaf0-1b88530a0000 pid=2643 execve guuid=5e35f052-1b00-0000-aaf0-1b88550a0000 pid=2645 /usr/bin/chmod guuid=eecf1338-1b00-0000-aaf0-1b88fd090000 pid=2557->guuid=5e35f052-1b00-0000-aaf0-1b88550a0000 pid=2645 execve guuid=6a326153-1b00-0000-aaf0-1b88570a0000 pid=2647 /usr/bin/chmod guuid=eecf1338-1b00-0000-aaf0-1b88fd090000 pid=2557->guuid=6a326153-1b00-0000-aaf0-1b88570a0000 pid=2647 execve guuid=a031c453-1b00-0000-aaf0-1b885a0a0000 pid=2650 /usr/bin/chattr guuid=eecf1338-1b00-0000-aaf0-1b88fd090000 pid=2557->guuid=a031c453-1b00-0000-aaf0-1b885a0a0000 pid=2650 execve guuid=052f5354-1b00-0000-aaf0-1b885b0a0000 pid=2651 /usr/bin/chattr guuid=eecf1338-1b00-0000-aaf0-1b88fd090000 pid=2557->guuid=052f5354-1b00-0000-aaf0-1b885b0a0000 pid=2651 execve guuid=5288c954-1b00-0000-aaf0-1b885d0a0000 pid=2653 /usr/bin/chattr guuid=eecf1338-1b00-0000-aaf0-1b88fd090000 pid=2557->guuid=5288c954-1b00-0000-aaf0-1b885d0a0000 pid=2653 execve guuid=4e743f55-1b00-0000-aaf0-1b885e0a0000 pid=2654 /usr/bin/chattr guuid=eecf1338-1b00-0000-aaf0-1b88fd090000 pid=2557->guuid=4e743f55-1b00-0000-aaf0-1b885e0a0000 pid=2654 execve guuid=c3d6ac55-1b00-0000-aaf0-1b885f0a0000 pid=2655 /usr/bin/chattr guuid=eecf1338-1b00-0000-aaf0-1b88fd090000 pid=2557->guuid=c3d6ac55-1b00-0000-aaf0-1b885f0a0000 pid=2655 execve guuid=5f1f1356-1b00-0000-aaf0-1b88600a0000 pid=2656 /usr/bin/chattr guuid=eecf1338-1b00-0000-aaf0-1b88fd090000 pid=2557->guuid=5f1f1356-1b00-0000-aaf0-1b88600a0000 pid=2656 execve guuid=ed25b356-1b00-0000-aaf0-1b88620a0000 pid=2658 /usr/bin/chattr guuid=eecf1338-1b00-0000-aaf0-1b88fd090000 pid=2557->guuid=ed25b356-1b00-0000-aaf0-1b88620a0000 pid=2658 execve guuid=9cc3f756-1b00-0000-aaf0-1b88640a0000 pid=2660 /usr/bin/chattr guuid=eecf1338-1b00-0000-aaf0-1b88fd090000 pid=2557->guuid=9cc3f756-1b00-0000-aaf0-1b88640a0000 pid=2660 execve guuid=cd625357-1b00-0000-aaf0-1b88660a0000 pid=2662 /usr/bin/bash guuid=eecf1338-1b00-0000-aaf0-1b88fd090000 pid=2557->guuid=cd625357-1b00-0000-aaf0-1b88660a0000 pid=2662 clone guuid=b2f65957-1b00-0000-aaf0-1b88670a0000 pid=2663 /usr/bin/bash guuid=eecf1338-1b00-0000-aaf0-1b88fd090000 pid=2557->guuid=b2f65957-1b00-0000-aaf0-1b88670a0000 pid=2663 clone guuid=313b8d57-1b00-0000-aaf0-1b88690a0000 pid=2665 /usr/bin/curl net send-data guuid=eecf1338-1b00-0000-aaf0-1b88fd090000 pid=2557->guuid=313b8d57-1b00-0000-aaf0-1b88690a0000 pid=2665 execve guuid=8a149557-1b00-0000-aaf0-1b886a0a0000 pid=2666 /usr/bin/dash guuid=eecf1338-1b00-0000-aaf0-1b88fd090000 pid=2557->guuid=8a149557-1b00-0000-aaf0-1b886a0a0000 pid=2666 execve guuid=7ba2be62-1b00-0000-aaf0-1b887b0a0000 pid=2683 /usr/bin/bash guuid=eecf1338-1b00-0000-aaf0-1b88fd090000 pid=2557->guuid=7ba2be62-1b00-0000-aaf0-1b887b0a0000 pid=2683 clone guuid=393fce62-1b00-0000-aaf0-1b887c0a0000 pid=2684 /usr/bin/base64 guuid=eecf1338-1b00-0000-aaf0-1b88fd090000 pid=2557->guuid=393fce62-1b00-0000-aaf0-1b887c0a0000 pid=2684 execve guuid=ff72d562-1b00-0000-aaf0-1b887d0a0000 pid=2685 /usr/bin/tee write-file guuid=eecf1338-1b00-0000-aaf0-1b88fd090000 pid=2557->guuid=ff72d562-1b00-0000-aaf0-1b887d0a0000 pid=2685 execve guuid=f53abd63-1b00-0000-aaf0-1b887e0a0000 pid=2686 /usr/bin/bash guuid=eecf1338-1b00-0000-aaf0-1b88fd090000 pid=2557->guuid=f53abd63-1b00-0000-aaf0-1b887e0a0000 pid=2686 execve guuid=8e80226c-1b00-0000-aaf0-1b88980a0000 pid=2712 /usr/bin/bash guuid=eecf1338-1b00-0000-aaf0-1b88fd090000 pid=2557->guuid=8e80226c-1b00-0000-aaf0-1b88980a0000 pid=2712 execve guuid=5ad0906c-1b00-0000-aaf0-1b88990a0000 pid=2713 /usr/bin/rm delete-file guuid=eecf1338-1b00-0000-aaf0-1b88fd090000 pid=2557->guuid=5ad0906c-1b00-0000-aaf0-1b88990a0000 pid=2713 execve guuid=4ddbe46c-1b00-0000-aaf0-1b889a0a0000 pid=2714 /usr/bin/rm guuid=eecf1338-1b00-0000-aaf0-1b88fd090000 pid=2557->guuid=4ddbe46c-1b00-0000-aaf0-1b889a0a0000 pid=2714 execve guuid=36d0356d-1b00-0000-aaf0-1b889c0a0000 pid=2716 /usr/bin/curl net send-data guuid=eecf1338-1b00-0000-aaf0-1b88fd090000 pid=2557->guuid=36d0356d-1b00-0000-aaf0-1b889c0a0000 pid=2716 execve guuid=f8633c6d-1b00-0000-aaf0-1b889d0a0000 pid=2717 /usr/bin/dash guuid=eecf1338-1b00-0000-aaf0-1b88fd090000 pid=2557->guuid=f8633c6d-1b00-0000-aaf0-1b889d0a0000 pid=2717 execve 124ee36c-bdbd-5d46-bbb1-b2cd81367f04 160.119.69.4:80 guuid=313b8d57-1b00-0000-aaf0-1b88690a0000 pid=2665->124ee36c-bdbd-5d46-bbb1-b2cd81367f04 send: 93B guuid=41a84164-1b00-0000-aaf0-1b887f0a0000 pid=2687 /usr/bin/bash guuid=f53abd63-1b00-0000-aaf0-1b887e0a0000 pid=2686->guuid=41a84164-1b00-0000-aaf0-1b887f0a0000 pid=2687 clone guuid=72624b64-1b00-0000-aaf0-1b88800a0000 pid=2688 /usr/bin/bash guuid=f53abd63-1b00-0000-aaf0-1b887e0a0000 pid=2686->guuid=72624b64-1b00-0000-aaf0-1b88800a0000 pid=2688 clone guuid=ff528b64-1b00-0000-aaf0-1b88810a0000 pid=2689 /usr/bin/ls guuid=f53abd63-1b00-0000-aaf0-1b887e0a0000 pid=2686->guuid=ff528b64-1b00-0000-aaf0-1b88810a0000 pid=2689 execve guuid=00f44065-1b00-0000-aaf0-1b88820a0000 pid=2690 /usr/bin/cat guuid=f53abd63-1b00-0000-aaf0-1b887e0a0000 pid=2686->guuid=00f44065-1b00-0000-aaf0-1b88820a0000 pid=2690 execve guuid=8628b665-1b00-0000-aaf0-1b88830a0000 pid=2691 /usr/bin/ls guuid=f53abd63-1b00-0000-aaf0-1b887e0a0000 pid=2686->guuid=8628b665-1b00-0000-aaf0-1b88830a0000 pid=2691 execve guuid=c3215a66-1b00-0000-aaf0-1b88840a0000 pid=2692 /usr/bin/mkdir guuid=f53abd63-1b00-0000-aaf0-1b887e0a0000 pid=2686->guuid=c3215a66-1b00-0000-aaf0-1b88840a0000 pid=2692 execve guuid=0018de66-1b00-0000-aaf0-1b88850a0000 pid=2693 /usr/bin/mv guuid=f53abd63-1b00-0000-aaf0-1b887e0a0000 pid=2686->guuid=0018de66-1b00-0000-aaf0-1b88850a0000 pid=2693 execve guuid=9f0d6a67-1b00-0000-aaf0-1b88860a0000 pid=2694 /usr/bin/bash guuid=f53abd63-1b00-0000-aaf0-1b887e0a0000 pid=2686->guuid=9f0d6a67-1b00-0000-aaf0-1b88860a0000 pid=2694 clone guuid=89a67467-1b00-0000-aaf0-1b88870a0000 pid=2695 /usr/bin/base64 write-file guuid=f53abd63-1b00-0000-aaf0-1b887e0a0000 pid=2686->guuid=89a67467-1b00-0000-aaf0-1b88870a0000 pid=2695 execve guuid=62671768-1b00-0000-aaf0-1b88890a0000 pid=2697 /usr/bin/rm delete-file guuid=f53abd63-1b00-0000-aaf0-1b887e0a0000 pid=2686->guuid=62671768-1b00-0000-aaf0-1b88890a0000 pid=2697 execve guuid=9b37b668-1b00-0000-aaf0-1b888c0a0000 pid=2700 /usr/bin/mv guuid=f53abd63-1b00-0000-aaf0-1b887e0a0000 pid=2686->guuid=9b37b668-1b00-0000-aaf0-1b888c0a0000 pid=2700 execve guuid=6cc17069-1b00-0000-aaf0-1b88900a0000 pid=2704 /usr/bin/ls guuid=f53abd63-1b00-0000-aaf0-1b887e0a0000 pid=2686->guuid=6cc17069-1b00-0000-aaf0-1b88900a0000 pid=2704 execve guuid=8184156a-1b00-0000-aaf0-1b88920a0000 pid=2706 /usr/bin/bash guuid=f53abd63-1b00-0000-aaf0-1b887e0a0000 pid=2686->guuid=8184156a-1b00-0000-aaf0-1b88920a0000 pid=2706 clone guuid=9930226a-1b00-0000-aaf0-1b88930a0000 pid=2707 /usr/bin/base64 write-file guuid=f53abd63-1b00-0000-aaf0-1b887e0a0000 pid=2686->guuid=9930226a-1b00-0000-aaf0-1b88930a0000 pid=2707 execve guuid=aba8836a-1b00-0000-aaf0-1b88940a0000 pid=2708 /usr/bin/ls guuid=f53abd63-1b00-0000-aaf0-1b887e0a0000 pid=2686->guuid=aba8836a-1b00-0000-aaf0-1b88940a0000 pid=2708 execve guuid=38bd256b-1b00-0000-aaf0-1b88960a0000 pid=2710 /usr/bin/cat guuid=f53abd63-1b00-0000-aaf0-1b887e0a0000 pid=2686->guuid=38bd256b-1b00-0000-aaf0-1b88960a0000 pid=2710 execve guuid=87be7e6b-1b00-0000-aaf0-1b88970a0000 pid=2711 /usr/bin/ls guuid=f53abd63-1b00-0000-aaf0-1b887e0a0000 pid=2686->guuid=87be7e6b-1b00-0000-aaf0-1b88970a0000 pid=2711 execve guuid=36d0356d-1b00-0000-aaf0-1b889c0a0000 pid=2716->124ee36c-bdbd-5d46-bbb1-b2cd81367f04 send: 93B
Score:
81%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/d254c78168eeeca095efc113e6a352308ca3d2d3910aefa426b52e0a3745bb0e
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d254c78168eeeca095efc113e6a352308ca3d2d3910aefa426b52e0a3745bb0e/
Threat name:
Linux.Backdoor.WebShell
Create hunting rule
Status:
Malicious
First seen:
2026-08-10 10:48:42 UTC
AV detection:
17 of 38 (44.74%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2jkmpali53wkbfppyej6ni2sgcgkhuwtsefo7jbgwuxaun2fxmha._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260810-h5y6wsef99/
Behaviour
Reads runtime system information
Writes file to tmp directory
Deobfuscate/Decode Files or Information
Checks CPU configuration
File and Directory Permissions Modification
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.16
Link:
https://yomi.yoroi.company/submissions/d254c78168eeeca095efc113e6a352308ca3d2d3910aefa426b52e0a3745bb0e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SUSP_LNX_Base64_Exec_Apr24
Create hunting rule
Author:Christian Burkard
Description:Detects suspicious base64 encoded shell commands (as seen in Palo Alto CVE-2024-3400 exploitation)
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh d254c78168eeeca095efc113e6a352308ca3d2d3910aefa426b52e0a3745bb0e

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3884409/
  
Delivery method
Distributed via web download

Comments