MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 d4e2615c29d1daf28c699748945d05f83ab0c395add506de4cde92d41d48366c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: d4e2615c29d1daf28c699748945d05f83ab0c395add506de4cde92d41d48366c
SHA3-384 hash: 0f32ac7e7049e0ff22b604b188f6128387c9cf3b0a5bd9de3c8c094b34c8cdd687e74b9c32184ea46b8a1184664efde7
SHA1 hash: c38912fe93dd53e5ecd08c7ff8a8a4ca326d5274
MD5 hash: d39b5d40e62629f2ea80e98f87877d2a
humanhash: tennessee-autumn-london-tennessee
File name:wr.php
Download: download sample
File size:27'042 bytes
First seen:2026-08-14 06:58:25 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 768:ML/8vCB+25j6es8Rix9FYpMSUpi+20qUpi+20YQX:Y/8l25Jind2QX
TLSH T1CBC27D966A867C44BEC98A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11F9CD618B1A
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://160.119.69.4/z/post/noroot.phpn/an/aelf ua-wget

Intelligence

File Origin
# of uploads :
1
# of downloads :
52
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Gathering data
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive masquerade
Link:
https://www.filescan.io/uploads/6a7ebc969ea9eafe0d0a0c34/reports/9e149320-d21f-4bce-a54a-4de84d59d6c9/overview
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/999d7043-e053-4ec2-89d0-d704c746a77c
Behavior Graph:
Download SVG
%3 guuid=864d92b2-1600-0000-cbc4-c10b870c0000 pid=3207 /usr/bin/sudo guuid=c01c7eb5-1600-0000-cbc4-c10b8b0c0000 pid=3211 /tmp/sample.bin guuid=864d92b2-1600-0000-cbc4-c10b870c0000 pid=3207->guuid=c01c7eb5-1600-0000-cbc4-c10b8b0c0000 pid=3211 execve guuid=b4659ab6-1600-0000-cbc4-c10b8d0c0000 pid=3213 /usr/bin/bash guuid=c01c7eb5-1600-0000-cbc4-c10b8b0c0000 pid=3211->guuid=b4659ab6-1600-0000-cbc4-c10b8d0c0000 pid=3213 clone guuid=149ebeb6-1600-0000-cbc4-c10b8f0c0000 pid=3215 /usr/bin/base64 guuid=c01c7eb5-1600-0000-cbc4-c10b8b0c0000 pid=3211->guuid=149ebeb6-1600-0000-cbc4-c10b8f0c0000 pid=3215 execve guuid=f806d3b6-1600-0000-cbc4-c10b900c0000 pid=3216 /usr/bin/bash guuid=c01c7eb5-1600-0000-cbc4-c10b8b0c0000 pid=3211->guuid=f806d3b6-1600-0000-cbc4-c10b900c0000 pid=3216 clone guuid=e26a60b9-1600-0000-cbc4-c10b950c0000 pid=3221 /usr/bin/cp guuid=c01c7eb5-1600-0000-cbc4-c10b8b0c0000 pid=3211->guuid=e26a60b9-1600-0000-cbc4-c10b950c0000 pid=3221 execve guuid=cd982dba-1600-0000-cbc4-c10b980c0000 pid=3224 /usr/bin/mkdir guuid=c01c7eb5-1600-0000-cbc4-c10b8b0c0000 pid=3211->guuid=cd982dba-1600-0000-cbc4-c10b980c0000 pid=3224 execve guuid=168d7eba-1600-0000-cbc4-c10b990c0000 pid=3225 /usr/bin/mkdir guuid=c01c7eb5-1600-0000-cbc4-c10b8b0c0000 pid=3211->guuid=168d7eba-1600-0000-cbc4-c10b990c0000 pid=3225 execve guuid=203fc7ba-1600-0000-cbc4-c10b9a0c0000 pid=3226 /usr/bin/mkdir guuid=c01c7eb5-1600-0000-cbc4-c10b8b0c0000 pid=3211->guuid=203fc7ba-1600-0000-cbc4-c10b9a0c0000 pid=3226 execve guuid=f7410dbb-1600-0000-cbc4-c10b9c0c0000 pid=3228 /usr/bin/mkdir guuid=c01c7eb5-1600-0000-cbc4-c10b8b0c0000 pid=3211->guuid=f7410dbb-1600-0000-cbc4-c10b9c0c0000 pid=3228 execve guuid=6f9356bb-1600-0000-cbc4-c10b9d0c0000 pid=3229 /usr/bin/mkdir guuid=c01c7eb5-1600-0000-cbc4-c10b8b0c0000 pid=3211->guuid=6f9356bb-1600-0000-cbc4-c10b9d0c0000 pid=3229 execve guuid=7c269ebb-1600-0000-cbc4-c10b9e0c0000 pid=3230 /usr/bin/mkdir guuid=c01c7eb5-1600-0000-cbc4-c10b8b0c0000 pid=3211->guuid=7c269ebb-1600-0000-cbc4-c10b9e0c0000 pid=3230 execve guuid=f46bedbb-1600-0000-cbc4-c10ba00c0000 pid=3232 /usr/bin/mkdir guuid=c01c7eb5-1600-0000-cbc4-c10b8b0c0000 pid=3211->guuid=f46bedbb-1600-0000-cbc4-c10ba00c0000 pid=3232 execve guuid=5a6e36bc-1600-0000-cbc4-c10ba10c0000 pid=3233 /usr/bin/mkdir guuid=c01c7eb5-1600-0000-cbc4-c10b8b0c0000 pid=3211->guuid=5a6e36bc-1600-0000-cbc4-c10ba10c0000 pid=3233 execve guuid=32247fbc-1600-0000-cbc4-c10ba30c0000 pid=3235 /usr/bin/mkdir guuid=c01c7eb5-1600-0000-cbc4-c10b8b0c0000 pid=3211->guuid=32247fbc-1600-0000-cbc4-c10ba30c0000 pid=3235 execve guuid=db89c9bc-1600-0000-cbc4-c10ba40c0000 pid=3236 /usr/bin/cp guuid=c01c7eb5-1600-0000-cbc4-c10b8b0c0000 pid=3211->guuid=db89c9bc-1600-0000-cbc4-c10ba40c0000 pid=3236 execve guuid=fd952ebd-1600-0000-cbc4-c10ba70c0000 pid=3239 /usr/bin/cp guuid=c01c7eb5-1600-0000-cbc4-c10b8b0c0000 pid=3211->guuid=fd952ebd-1600-0000-cbc4-c10ba70c0000 pid=3239 execve guuid=fd3c9fbd-1600-0000-cbc4-c10baa0c0000 pid=3242 /usr/bin/cp guuid=c01c7eb5-1600-0000-cbc4-c10b8b0c0000 pid=3211->guuid=fd3c9fbd-1600-0000-cbc4-c10baa0c0000 pid=3242 execve guuid=c27528be-1600-0000-cbc4-c10bab0c0000 pid=3243 /usr/bin/cp guuid=c01c7eb5-1600-0000-cbc4-c10b8b0c0000 pid=3211->guuid=c27528be-1600-0000-cbc4-c10bab0c0000 pid=3243 execve guuid=19738bbe-1600-0000-cbc4-c10bad0c0000 pid=3245 /usr/bin/cp guuid=c01c7eb5-1600-0000-cbc4-c10b8b0c0000 pid=3211->guuid=19738bbe-1600-0000-cbc4-c10bad0c0000 pid=3245 execve guuid=fc75e0be-1600-0000-cbc4-c10bae0c0000 pid=3246 /usr/bin/cp guuid=c01c7eb5-1600-0000-cbc4-c10b8b0c0000 pid=3211->guuid=fc75e0be-1600-0000-cbc4-c10bae0c0000 pid=3246 execve guuid=3b0865bf-1600-0000-cbc4-c10bb10c0000 pid=3249 /usr/bin/cp guuid=c01c7eb5-1600-0000-cbc4-c10b8b0c0000 pid=3211->guuid=3b0865bf-1600-0000-cbc4-c10bb10c0000 pid=3249 execve guuid=e708bebf-1600-0000-cbc4-c10bb30c0000 pid=3251 /usr/bin/cp guuid=c01c7eb5-1600-0000-cbc4-c10b8b0c0000 pid=3211->guuid=e708bebf-1600-0000-cbc4-c10bb30c0000 pid=3251 execve guuid=ea6f1fc0-1600-0000-cbc4-c10bb60c0000 pid=3254 /usr/bin/cp guuid=c01c7eb5-1600-0000-cbc4-c10b8b0c0000 pid=3211->guuid=ea6f1fc0-1600-0000-cbc4-c10bb60c0000 pid=3254 execve guuid=279d80c0-1600-0000-cbc4-c10bb80c0000 pid=3256 /usr/bin/cp guuid=c01c7eb5-1600-0000-cbc4-c10b8b0c0000 pid=3211->guuid=279d80c0-1600-0000-cbc4-c10bb80c0000 pid=3256 execve guuid=fb3fe2c0-1600-0000-cbc4-c10bba0c0000 pid=3258 /usr/bin/cp guuid=c01c7eb5-1600-0000-cbc4-c10b8b0c0000 pid=3211->guuid=fb3fe2c0-1600-0000-cbc4-c10bba0c0000 pid=3258 execve guuid=a0ba63c1-1600-0000-cbc4-c10bbb0c0000 pid=3259 /usr/bin/cp guuid=c01c7eb5-1600-0000-cbc4-c10b8b0c0000 pid=3211->guuid=a0ba63c1-1600-0000-cbc4-c10bbb0c0000 pid=3259 execve guuid=c62dbcc1-1600-0000-cbc4-c10bbe0c0000 pid=3262 /usr/bin/cp guuid=c01c7eb5-1600-0000-cbc4-c10b8b0c0000 pid=3211->guuid=c62dbcc1-1600-0000-cbc4-c10bbe0c0000 pid=3262 execve guuid=89c629c2-1600-0000-cbc4-c10bc00c0000 pid=3264 /usr/bin/cp guuid=c01c7eb5-1600-0000-cbc4-c10b8b0c0000 pid=3211->guuid=89c629c2-1600-0000-cbc4-c10bc00c0000 pid=3264 execve guuid=99e788c2-1600-0000-cbc4-c10bc30c0000 pid=3267 /usr/bin/touch guuid=c01c7eb5-1600-0000-cbc4-c10b8b0c0000 pid=3211->guuid=99e788c2-1600-0000-cbc4-c10bc30c0000 pid=3267 execve guuid=9ad0d0c2-1600-0000-cbc4-c10bc50c0000 pid=3269 /usr/bin/chmod guuid=c01c7eb5-1600-0000-cbc4-c10b8b0c0000 pid=3211->guuid=9ad0d0c2-1600-0000-cbc4-c10bc50c0000 pid=3269 execve guuid=6c3613c3-1600-0000-cbc4-c10bc70c0000 pid=3271 /usr/bin/chmod guuid=c01c7eb5-1600-0000-cbc4-c10b8b0c0000 pid=3211->guuid=6c3613c3-1600-0000-cbc4-c10bc70c0000 pid=3271 execve guuid=763799c3-1600-0000-cbc4-c10bca0c0000 pid=3274 /usr/bin/chattr guuid=c01c7eb5-1600-0000-cbc4-c10b8b0c0000 pid=3211->guuid=763799c3-1600-0000-cbc4-c10bca0c0000 pid=3274 execve guuid=eb1f2cc4-1600-0000-cbc4-c10bcc0c0000 pid=3276 /usr/bin/chattr guuid=c01c7eb5-1600-0000-cbc4-c10b8b0c0000 pid=3211->guuid=eb1f2cc4-1600-0000-cbc4-c10bcc0c0000 pid=3276 execve guuid=47a191c4-1600-0000-cbc4-c10bcd0c0000 pid=3277 /usr/bin/chattr guuid=c01c7eb5-1600-0000-cbc4-c10b8b0c0000 pid=3211->guuid=47a191c4-1600-0000-cbc4-c10bcd0c0000 pid=3277 execve guuid=6c52ebc4-1600-0000-cbc4-c10bcf0c0000 pid=3279 /usr/bin/chattr guuid=c01c7eb5-1600-0000-cbc4-c10b8b0c0000 pid=3211->guuid=6c52ebc4-1600-0000-cbc4-c10bcf0c0000 pid=3279 execve guuid=f2b33ac5-1600-0000-cbc4-c10bd00c0000 pid=3280 /usr/bin/chattr guuid=c01c7eb5-1600-0000-cbc4-c10b8b0c0000 pid=3211->guuid=f2b33ac5-1600-0000-cbc4-c10bd00c0000 pid=3280 execve guuid=3cf081c5-1600-0000-cbc4-c10bd20c0000 pid=3282 /usr/bin/chattr guuid=c01c7eb5-1600-0000-cbc4-c10b8b0c0000 pid=3211->guuid=3cf081c5-1600-0000-cbc4-c10bd20c0000 pid=3282 execve guuid=e0ddc5c5-1600-0000-cbc4-c10bd40c0000 pid=3284 /usr/bin/chattr guuid=c01c7eb5-1600-0000-cbc4-c10b8b0c0000 pid=3211->guuid=e0ddc5c5-1600-0000-cbc4-c10bd40c0000 pid=3284 execve guuid=e7a007c6-1600-0000-cbc4-c10bd60c0000 pid=3286 /usr/bin/chattr guuid=c01c7eb5-1600-0000-cbc4-c10b8b0c0000 pid=3211->guuid=e7a007c6-1600-0000-cbc4-c10bd60c0000 pid=3286 execve guuid=fd4e4dc6-1600-0000-cbc4-c10bd80c0000 pid=3288 /usr/bin/bash guuid=c01c7eb5-1600-0000-cbc4-c10b8b0c0000 pid=3211->guuid=fd4e4dc6-1600-0000-cbc4-c10bd80c0000 pid=3288 clone guuid=794152c6-1600-0000-cbc4-c10bd90c0000 pid=3289 /usr/bin/bash guuid=c01c7eb5-1600-0000-cbc4-c10b8b0c0000 pid=3211->guuid=794152c6-1600-0000-cbc4-c10bd90c0000 pid=3289 clone guuid=8fc875c6-1600-0000-cbc4-c10bdb0c0000 pid=3291 /usr/bin/curl net send-data guuid=c01c7eb5-1600-0000-cbc4-c10b8b0c0000 pid=3211->guuid=8fc875c6-1600-0000-cbc4-c10bdb0c0000 pid=3291 execve guuid=8e167ac6-1600-0000-cbc4-c10bdc0c0000 pid=3292 /usr/bin/dash guuid=c01c7eb5-1600-0000-cbc4-c10b8b0c0000 pid=3211->guuid=8e167ac6-1600-0000-cbc4-c10bdc0c0000 pid=3292 execve guuid=ddfe5fd1-1600-0000-cbc4-c10bff0c0000 pid=3327 /usr/bin/bash guuid=c01c7eb5-1600-0000-cbc4-c10b8b0c0000 pid=3211->guuid=ddfe5fd1-1600-0000-cbc4-c10bff0c0000 pid=3327 clone guuid=ba2766d1-1600-0000-cbc4-c10b000d0000 pid=3328 /usr/bin/base64 guuid=c01c7eb5-1600-0000-cbc4-c10b8b0c0000 pid=3211->guuid=ba2766d1-1600-0000-cbc4-c10b000d0000 pid=3328 execve guuid=bc616fd1-1600-0000-cbc4-c10b010d0000 pid=3329 /usr/bin/tee write-file guuid=c01c7eb5-1600-0000-cbc4-c10b8b0c0000 pid=3211->guuid=bc616fd1-1600-0000-cbc4-c10b010d0000 pid=3329 execve guuid=9175d4d1-1600-0000-cbc4-c10b040d0000 pid=3332 /usr/bin/bash guuid=c01c7eb5-1600-0000-cbc4-c10b8b0c0000 pid=3211->guuid=9175d4d1-1600-0000-cbc4-c10b040d0000 pid=3332 execve guuid=cd96b6d8-1600-0000-cbc4-c10b2b0d0000 pid=3371 /usr/bin/bash guuid=c01c7eb5-1600-0000-cbc4-c10b8b0c0000 pid=3211->guuid=cd96b6d8-1600-0000-cbc4-c10b2b0d0000 pid=3371 execve guuid=8f291ed9-1600-0000-cbc4-c10b2d0d0000 pid=3373 /usr/bin/rm delete-file guuid=c01c7eb5-1600-0000-cbc4-c10b8b0c0000 pid=3211->guuid=8f291ed9-1600-0000-cbc4-c10b2d0d0000 pid=3373 execve guuid=170764d9-1600-0000-cbc4-c10b2f0d0000 pid=3375 /usr/bin/rm guuid=c01c7eb5-1600-0000-cbc4-c10b8b0c0000 pid=3211->guuid=170764d9-1600-0000-cbc4-c10b2f0d0000 pid=3375 execve guuid=b755a9d9-1600-0000-cbc4-c10b310d0000 pid=3377 /usr/bin/curl net send-data guuid=c01c7eb5-1600-0000-cbc4-c10b8b0c0000 pid=3211->guuid=b755a9d9-1600-0000-cbc4-c10b310d0000 pid=3377 execve guuid=5293b2d9-1600-0000-cbc4-c10b320d0000 pid=3378 /usr/bin/dash guuid=c01c7eb5-1600-0000-cbc4-c10b8b0c0000 pid=3211->guuid=5293b2d9-1600-0000-cbc4-c10b320d0000 pid=3378 execve 124ee36c-bdbd-5d46-bbb1-b2cd81367f04 160.119.69.4:80 guuid=8fc875c6-1600-0000-cbc4-c10bdb0c0000 pid=3291->124ee36c-bdbd-5d46-bbb1-b2cd81367f04 send: 93B guuid=2a6e20d2-1600-0000-cbc4-c10b060d0000 pid=3334 /usr/bin/bash guuid=9175d4d1-1600-0000-cbc4-c10b040d0000 pid=3332->guuid=2a6e20d2-1600-0000-cbc4-c10b060d0000 pid=3334 clone guuid=15a326d2-1600-0000-cbc4-c10b070d0000 pid=3335 /usr/bin/bash guuid=9175d4d1-1600-0000-cbc4-c10b040d0000 pid=3332->guuid=15a326d2-1600-0000-cbc4-c10b070d0000 pid=3335 clone guuid=d84146d2-1600-0000-cbc4-c10b080d0000 pid=3336 /usr/bin/ls guuid=9175d4d1-1600-0000-cbc4-c10b040d0000 pid=3332->guuid=d84146d2-1600-0000-cbc4-c10b080d0000 pid=3336 execve guuid=20cebdd2-1600-0000-cbc4-c10b0b0d0000 pid=3339 /usr/bin/cat guuid=9175d4d1-1600-0000-cbc4-c10b040d0000 pid=3332->guuid=20cebdd2-1600-0000-cbc4-c10b0b0d0000 pid=3339 execve guuid=fa3d0cd3-1600-0000-cbc4-c10b0d0d0000 pid=3341 /usr/bin/ls guuid=9175d4d1-1600-0000-cbc4-c10b040d0000 pid=3332->guuid=fa3d0cd3-1600-0000-cbc4-c10b0d0d0000 pid=3341 execve guuid=f1ae95d3-1600-0000-cbc4-c10b100d0000 pid=3344 /usr/bin/mkdir guuid=9175d4d1-1600-0000-cbc4-c10b040d0000 pid=3332->guuid=f1ae95d3-1600-0000-cbc4-c10b100d0000 pid=3344 execve guuid=1ee92ad4-1600-0000-cbc4-c10b130d0000 pid=3347 /usr/bin/mv guuid=9175d4d1-1600-0000-cbc4-c10b040d0000 pid=3332->guuid=1ee92ad4-1600-0000-cbc4-c10b130d0000 pid=3347 execve guuid=dcaebad4-1600-0000-cbc4-c10b160d0000 pid=3350 /usr/bin/bash guuid=9175d4d1-1600-0000-cbc4-c10b040d0000 pid=3332->guuid=dcaebad4-1600-0000-cbc4-c10b160d0000 pid=3350 clone guuid=7885c4d4-1600-0000-cbc4-c10b180d0000 pid=3352 /usr/bin/base64 write-file guuid=9175d4d1-1600-0000-cbc4-c10b040d0000 pid=3332->guuid=7885c4d4-1600-0000-cbc4-c10b180d0000 pid=3352 execve guuid=3edf4cd5-1600-0000-cbc4-c10b1a0d0000 pid=3354 /usr/bin/rm delete-file guuid=9175d4d1-1600-0000-cbc4-c10b040d0000 pid=3332->guuid=3edf4cd5-1600-0000-cbc4-c10b1a0d0000 pid=3354 execve guuid=a39fd7d5-1600-0000-cbc4-c10b1d0d0000 pid=3357 /usr/bin/mv guuid=9175d4d1-1600-0000-cbc4-c10b040d0000 pid=3332->guuid=a39fd7d5-1600-0000-cbc4-c10b1d0d0000 pid=3357 execve guuid=2ee58cd6-1600-0000-cbc4-c10b200d0000 pid=3360 /usr/bin/ls guuid=9175d4d1-1600-0000-cbc4-c10b040d0000 pid=3332->guuid=2ee58cd6-1600-0000-cbc4-c10b200d0000 pid=3360 execve guuid=0e781bd7-1600-0000-cbc4-c10b220d0000 pid=3362 /usr/bin/bash guuid=9175d4d1-1600-0000-cbc4-c10b040d0000 pid=3332->guuid=0e781bd7-1600-0000-cbc4-c10b220d0000 pid=3362 clone guuid=7fbd25d7-1600-0000-cbc4-c10b230d0000 pid=3363 /usr/bin/base64 write-file guuid=9175d4d1-1600-0000-cbc4-c10b040d0000 pid=3332->guuid=7fbd25d7-1600-0000-cbc4-c10b230d0000 pid=3363 execve guuid=d4b47dd7-1600-0000-cbc4-c10b250d0000 pid=3365 /usr/bin/ls guuid=9175d4d1-1600-0000-cbc4-c10b040d0000 pid=3332->guuid=d4b47dd7-1600-0000-cbc4-c10b250d0000 pid=3365 execve guuid=fcb4f4d7-1600-0000-cbc4-c10b270d0000 pid=3367 /usr/bin/cat guuid=9175d4d1-1600-0000-cbc4-c10b040d0000 pid=3332->guuid=fcb4f4d7-1600-0000-cbc4-c10b270d0000 pid=3367 execve guuid=8a9432d8-1600-0000-cbc4-c10b290d0000 pid=3369 /usr/bin/ls guuid=9175d4d1-1600-0000-cbc4-c10b040d0000 pid=3332->guuid=8a9432d8-1600-0000-cbc4-c10b290d0000 pid=3369 execve guuid=b755a9d9-1600-0000-cbc4-c10b310d0000 pid=3377->124ee36c-bdbd-5d46-bbb1-b2cd81367f04 send: 93B
Score:
82%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/d4e2615c29d1daf28c699748945d05f83ab0c395add506de4cde92d41d48366c
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/d4e2615c29d1daf28c699748945d05f83ab0c395add506de4cde92d41d48366c/
Gathering data
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=2trgcxbj2hnpfddjs5ejixif7a5lbq4vvxkqnxsm32jnihkigzwa._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260814-hrsf7aen3s/
Behaviour
Reads runtime system information
Writes file to tmp directory
Deobfuscate/Decode Files or Information
Checks CPU configuration
File and Directory Permissions Modification
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SUSP_LNX_Base64_Exec_Apr24
Create hunting rule
Author:Christian Burkard
Description:Detects suspicious base64 encoded shell commands (as seen in Palo Alto CVE-2024-3400 exploitation)
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh d4e2615c29d1daf28c699748945d05f83ab0c395add506de4cde92d41d48366c

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3884409/
  
Delivery method
Distributed via web download

Comments