MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dc67eafde293ecd7fbb56ed66efe691e87d06989e756fdb7354c664a3ac0d980. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dc67eafde293ecd7fbb56ed66efe691e87d06989e756fdb7354c664a3ac0d980
SHA3-384 hash: d18741db6be6503e350d827438a8f63d012bbb02a10a87a01e47f57c7e35c17459b83a1c99c46d9d91f2679b4c5bbd7e
SHA1 hash: 35b50fc7fd928b3aeccfbeb52115ce628c4fcfd5
MD5 hash: 64a4225c7dfeda36d46086b1e014e4cb
humanhash: undress-bakerloo-four-winner
File name:wr.php
Download: download sample
File size:27'042 bytes
First seen:2026-08-09 13:26:12 UTC
Last seen:2026-08-10 08:00:45 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 768:yO8vCB+25j6es8Rz9FYpMSUpi+20qUpi+20YQX:h8l25J1d2QX
TLSH T150C26D966A867C44BEC94A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11FACD618B1A
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://160.119.69.4/z/post/noroot.phpn/an/aelf ua-wget

Intelligence

File Origin
# of uploads :
2
# of downloads :
42
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.DownLoader.2862.23000.246.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive masquerade
Link:
https://www.filescan.io/uploads/6a788004750d670a1ccb489b/reports/b26ee25c-483f-4783-92da-b3c374f000cf/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-08-09T11:39:00Z UTC
Last seen:
2026-08-10T21:22:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/dc67eafde293ecd7fbb56ed66efe691e87d06989e756fdb7354c664a3ac0d980/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/e2a3f6b2-57a2-46fa-83d2-388585944691
Behavior Graph:
Download SVG
%3 guuid=8fab27d4-1900-0000-13c4-95c2270d0000 pid=3367 /usr/bin/sudo guuid=620f4bd7-1900-0000-13c4-95c22b0d0000 pid=3371 /tmp/sample.bin guuid=8fab27d4-1900-0000-13c4-95c2270d0000 pid=3367->guuid=620f4bd7-1900-0000-13c4-95c22b0d0000 pid=3371 execve guuid=651dcad7-1900-0000-13c4-95c22d0d0000 pid=3373 /usr/bin/bash guuid=620f4bd7-1900-0000-13c4-95c22b0d0000 pid=3371->guuid=651dcad7-1900-0000-13c4-95c22d0d0000 pid=3373 clone guuid=63cdcfd7-1900-0000-13c4-95c22e0d0000 pid=3374 /usr/bin/base64 guuid=620f4bd7-1900-0000-13c4-95c22b0d0000 pid=3371->guuid=63cdcfd7-1900-0000-13c4-95c22e0d0000 pid=3374 execve guuid=38a0d4d7-1900-0000-13c4-95c22f0d0000 pid=3375 /usr/bin/bash guuid=620f4bd7-1900-0000-13c4-95c22b0d0000 pid=3371->guuid=38a0d4d7-1900-0000-13c4-95c22f0d0000 pid=3375 clone guuid=7c0abbd8-1900-0000-13c4-95c2310d0000 pid=3377 /usr/bin/cp guuid=620f4bd7-1900-0000-13c4-95c22b0d0000 pid=3371->guuid=7c0abbd8-1900-0000-13c4-95c2310d0000 pid=3377 execve guuid=d71074d9-1900-0000-13c4-95c2330d0000 pid=3379 /usr/bin/mkdir guuid=620f4bd7-1900-0000-13c4-95c22b0d0000 pid=3371->guuid=d71074d9-1900-0000-13c4-95c2330d0000 pid=3379 execve guuid=6433ddd9-1900-0000-13c4-95c2350d0000 pid=3381 /usr/bin/mkdir guuid=620f4bd7-1900-0000-13c4-95c22b0d0000 pid=3371->guuid=6433ddd9-1900-0000-13c4-95c2350d0000 pid=3381 execve guuid=c6f561da-1900-0000-13c4-95c2370d0000 pid=3383 /usr/bin/mkdir guuid=620f4bd7-1900-0000-13c4-95c22b0d0000 pid=3371->guuid=c6f561da-1900-0000-13c4-95c2370d0000 pid=3383 execve guuid=34ddcfda-1900-0000-13c4-95c2390d0000 pid=3385 /usr/bin/mkdir guuid=620f4bd7-1900-0000-13c4-95c22b0d0000 pid=3371->guuid=34ddcfda-1900-0000-13c4-95c2390d0000 pid=3385 execve guuid=b8dd2adb-1900-0000-13c4-95c23b0d0000 pid=3387 /usr/bin/mkdir guuid=620f4bd7-1900-0000-13c4-95c22b0d0000 pid=3371->guuid=b8dd2adb-1900-0000-13c4-95c23b0d0000 pid=3387 execve guuid=243e85db-1900-0000-13c4-95c23c0d0000 pid=3388 /usr/bin/mkdir guuid=620f4bd7-1900-0000-13c4-95c22b0d0000 pid=3371->guuid=243e85db-1900-0000-13c4-95c23c0d0000 pid=3388 execve guuid=8f38eddb-1900-0000-13c4-95c23e0d0000 pid=3390 /usr/bin/mkdir guuid=620f4bd7-1900-0000-13c4-95c22b0d0000 pid=3371->guuid=8f38eddb-1900-0000-13c4-95c23e0d0000 pid=3390 execve guuid=bc368adc-1900-0000-13c4-95c2410d0000 pid=3393 /usr/bin/mkdir guuid=620f4bd7-1900-0000-13c4-95c22b0d0000 pid=3371->guuid=bc368adc-1900-0000-13c4-95c2410d0000 pid=3393 execve guuid=0d0455dd-1900-0000-13c4-95c2420d0000 pid=3394 /usr/bin/mkdir guuid=620f4bd7-1900-0000-13c4-95c22b0d0000 pid=3371->guuid=0d0455dd-1900-0000-13c4-95c2420d0000 pid=3394 execve guuid=033540de-1900-0000-13c4-95c2440d0000 pid=3396 /usr/bin/cp guuid=620f4bd7-1900-0000-13c4-95c22b0d0000 pid=3371->guuid=033540de-1900-0000-13c4-95c2440d0000 pid=3396 execve guuid=377151df-1900-0000-13c4-95c2450d0000 pid=3397 /usr/bin/cp guuid=620f4bd7-1900-0000-13c4-95c22b0d0000 pid=3371->guuid=377151df-1900-0000-13c4-95c2450d0000 pid=3397 execve guuid=a1152ee0-1900-0000-13c4-95c2460d0000 pid=3398 /usr/bin/cp guuid=620f4bd7-1900-0000-13c4-95c22b0d0000 pid=3371->guuid=a1152ee0-1900-0000-13c4-95c2460d0000 pid=3398 execve guuid=a54cdae0-1900-0000-13c4-95c2470d0000 pid=3399 /usr/bin/cp guuid=620f4bd7-1900-0000-13c4-95c22b0d0000 pid=3371->guuid=a54cdae0-1900-0000-13c4-95c2470d0000 pid=3399 execve guuid=ab948fe1-1900-0000-13c4-95c2480d0000 pid=3400 /usr/bin/cp guuid=620f4bd7-1900-0000-13c4-95c22b0d0000 pid=3371->guuid=ab948fe1-1900-0000-13c4-95c2480d0000 pid=3400 execve guuid=b77141e2-1900-0000-13c4-95c2490d0000 pid=3401 /usr/bin/cp guuid=620f4bd7-1900-0000-13c4-95c22b0d0000 pid=3371->guuid=b77141e2-1900-0000-13c4-95c2490d0000 pid=3401 execve guuid=ac70f9e2-1900-0000-13c4-95c24a0d0000 pid=3402 /usr/bin/cp guuid=620f4bd7-1900-0000-13c4-95c22b0d0000 pid=3371->guuid=ac70f9e2-1900-0000-13c4-95c24a0d0000 pid=3402 execve guuid=66eaafe3-1900-0000-13c4-95c24c0d0000 pid=3404 /usr/bin/cp guuid=620f4bd7-1900-0000-13c4-95c22b0d0000 pid=3371->guuid=66eaafe3-1900-0000-13c4-95c24c0d0000 pid=3404 execve guuid=ba6c56e4-1900-0000-13c4-95c24e0d0000 pid=3406 /usr/bin/cp guuid=620f4bd7-1900-0000-13c4-95c22b0d0000 pid=3371->guuid=ba6c56e4-1900-0000-13c4-95c24e0d0000 pid=3406 execve guuid=a6083ae5-1900-0000-13c4-95c2500d0000 pid=3408 /usr/bin/cp guuid=620f4bd7-1900-0000-13c4-95c22b0d0000 pid=3371->guuid=a6083ae5-1900-0000-13c4-95c2500d0000 pid=3408 execve guuid=d4403ce6-1900-0000-13c4-95c2520d0000 pid=3410 /usr/bin/cp guuid=620f4bd7-1900-0000-13c4-95c22b0d0000 pid=3371->guuid=d4403ce6-1900-0000-13c4-95c2520d0000 pid=3410 execve guuid=47baf0e6-1900-0000-13c4-95c2540d0000 pid=3412 /usr/bin/cp guuid=620f4bd7-1900-0000-13c4-95c22b0d0000 pid=3371->guuid=47baf0e6-1900-0000-13c4-95c2540d0000 pid=3412 execve guuid=e98ea8e7-1900-0000-13c4-95c2560d0000 pid=3414 /usr/bin/cp guuid=620f4bd7-1900-0000-13c4-95c22b0d0000 pid=3371->guuid=e98ea8e7-1900-0000-13c4-95c2560d0000 pid=3414 execve guuid=1652e3e8-1900-0000-13c4-95c2570d0000 pid=3415 /usr/bin/cp guuid=620f4bd7-1900-0000-13c4-95c22b0d0000 pid=3371->guuid=1652e3e8-1900-0000-13c4-95c2570d0000 pid=3415 execve guuid=9f64abea-1900-0000-13c4-95c2590d0000 pid=3417 /usr/bin/touch guuid=620f4bd7-1900-0000-13c4-95c22b0d0000 pid=3371->guuid=9f64abea-1900-0000-13c4-95c2590d0000 pid=3417 execve guuid=577f58ec-1900-0000-13c4-95c25a0d0000 pid=3418 /usr/bin/chmod guuid=620f4bd7-1900-0000-13c4-95c22b0d0000 pid=3371->guuid=577f58ec-1900-0000-13c4-95c25a0d0000 pid=3418 execve guuid=1b6277ee-1900-0000-13c4-95c25e0d0000 pid=3422 /usr/bin/chmod guuid=620f4bd7-1900-0000-13c4-95c22b0d0000 pid=3371->guuid=1b6277ee-1900-0000-13c4-95c25e0d0000 pid=3422 execve guuid=52fdf7f0-1900-0000-13c4-95c2640d0000 pid=3428 /usr/bin/chattr guuid=620f4bd7-1900-0000-13c4-95c22b0d0000 pid=3371->guuid=52fdf7f0-1900-0000-13c4-95c2640d0000 pid=3428 execve guuid=c1b463f2-1900-0000-13c4-95c2670d0000 pid=3431 /usr/bin/chattr guuid=620f4bd7-1900-0000-13c4-95c22b0d0000 pid=3371->guuid=c1b463f2-1900-0000-13c4-95c2670d0000 pid=3431 execve guuid=573cebf2-1900-0000-13c4-95c26a0d0000 pid=3434 /usr/bin/chattr guuid=620f4bd7-1900-0000-13c4-95c22b0d0000 pid=3371->guuid=573cebf2-1900-0000-13c4-95c26a0d0000 pid=3434 execve guuid=10a86af3-1900-0000-13c4-95c26d0d0000 pid=3437 /usr/bin/chattr guuid=620f4bd7-1900-0000-13c4-95c22b0d0000 pid=3371->guuid=10a86af3-1900-0000-13c4-95c26d0d0000 pid=3437 execve guuid=7ba7e4f3-1900-0000-13c4-95c2700d0000 pid=3440 /usr/bin/chattr guuid=620f4bd7-1900-0000-13c4-95c22b0d0000 pid=3371->guuid=7ba7e4f3-1900-0000-13c4-95c2700d0000 pid=3440 execve guuid=989658f4-1900-0000-13c4-95c2710d0000 pid=3441 /usr/bin/chattr guuid=620f4bd7-1900-0000-13c4-95c22b0d0000 pid=3371->guuid=989658f4-1900-0000-13c4-95c2710d0000 pid=3441 execve guuid=662bbdf4-1900-0000-13c4-95c2720d0000 pid=3442 /usr/bin/chattr guuid=620f4bd7-1900-0000-13c4-95c22b0d0000 pid=3371->guuid=662bbdf4-1900-0000-13c4-95c2720d0000 pid=3442 execve guuid=39f227f5-1900-0000-13c4-95c2730d0000 pid=3443 /usr/bin/chattr guuid=620f4bd7-1900-0000-13c4-95c22b0d0000 pid=3371->guuid=39f227f5-1900-0000-13c4-95c2730d0000 pid=3443 execve guuid=7573cbf5-1900-0000-13c4-95c2740d0000 pid=3444 /usr/bin/bash guuid=620f4bd7-1900-0000-13c4-95c22b0d0000 pid=3371->guuid=7573cbf5-1900-0000-13c4-95c2740d0000 pid=3444 clone guuid=f305d5f5-1900-0000-13c4-95c2750d0000 pid=3445 /usr/bin/bash guuid=620f4bd7-1900-0000-13c4-95c22b0d0000 pid=3371->guuid=f305d5f5-1900-0000-13c4-95c2750d0000 pid=3445 clone guuid=e46f02f6-1900-0000-13c4-95c2760d0000 pid=3446 /usr/bin/curl net send-data guuid=620f4bd7-1900-0000-13c4-95c22b0d0000 pid=3371->guuid=e46f02f6-1900-0000-13c4-95c2760d0000 pid=3446 execve guuid=294d0af6-1900-0000-13c4-95c2770d0000 pid=3447 /usr/bin/dash guuid=620f4bd7-1900-0000-13c4-95c22b0d0000 pid=3371->guuid=294d0af6-1900-0000-13c4-95c2770d0000 pid=3447 execve guuid=44aff7ff-1900-0000-13c4-95c2860d0000 pid=3462 /usr/bin/bash guuid=620f4bd7-1900-0000-13c4-95c22b0d0000 pid=3371->guuid=44aff7ff-1900-0000-13c4-95c2860d0000 pid=3462 clone guuid=ec3c0100-1a00-0000-13c4-95c2870d0000 pid=3463 /usr/bin/base64 guuid=620f4bd7-1900-0000-13c4-95c22b0d0000 pid=3371->guuid=ec3c0100-1a00-0000-13c4-95c2870d0000 pid=3463 execve guuid=acaf0e00-1a00-0000-13c4-95c2880d0000 pid=3464 /usr/bin/tee write-file guuid=620f4bd7-1900-0000-13c4-95c22b0d0000 pid=3371->guuid=acaf0e00-1a00-0000-13c4-95c2880d0000 pid=3464 execve guuid=25470b01-1a00-0000-13c4-95c28a0d0000 pid=3466 /usr/bin/bash guuid=620f4bd7-1900-0000-13c4-95c22b0d0000 pid=3371->guuid=25470b01-1a00-0000-13c4-95c28a0d0000 pid=3466 execve guuid=8775b507-1a00-0000-13c4-95c2a30d0000 pid=3491 /usr/bin/bash guuid=620f4bd7-1900-0000-13c4-95c22b0d0000 pid=3371->guuid=8775b507-1a00-0000-13c4-95c2a30d0000 pid=3491 execve guuid=0f541708-1a00-0000-13c4-95c2a40d0000 pid=3492 /usr/bin/rm delete-file guuid=620f4bd7-1900-0000-13c4-95c22b0d0000 pid=3371->guuid=0f541708-1a00-0000-13c4-95c2a40d0000 pid=3492 execve guuid=b35a7908-1a00-0000-13c4-95c2a60d0000 pid=3494 /usr/bin/rm guuid=620f4bd7-1900-0000-13c4-95c22b0d0000 pid=3371->guuid=b35a7908-1a00-0000-13c4-95c2a60d0000 pid=3494 execve guuid=b47ed208-1a00-0000-13c4-95c2a70d0000 pid=3495 /usr/bin/curl net send-data guuid=620f4bd7-1900-0000-13c4-95c22b0d0000 pid=3371->guuid=b47ed208-1a00-0000-13c4-95c2a70d0000 pid=3495 execve guuid=b234d808-1a00-0000-13c4-95c2a80d0000 pid=3496 /usr/bin/dash guuid=620f4bd7-1900-0000-13c4-95c22b0d0000 pid=3371->guuid=b234d808-1a00-0000-13c4-95c2a80d0000 pid=3496 execve 124ee36c-bdbd-5d46-bbb1-b2cd81367f04 160.119.69.4:80 guuid=e46f02f6-1900-0000-13c4-95c2760d0000 pid=3446->124ee36c-bdbd-5d46-bbb1-b2cd81367f04 send: 93B guuid=2b959401-1a00-0000-13c4-95c28c0d0000 pid=3468 /usr/bin/bash guuid=25470b01-1a00-0000-13c4-95c28a0d0000 pid=3466->guuid=2b959401-1a00-0000-13c4-95c28c0d0000 pid=3468 clone guuid=7bb4a001-1a00-0000-13c4-95c28d0d0000 pid=3469 /usr/bin/bash guuid=25470b01-1a00-0000-13c4-95c28a0d0000 pid=3466->guuid=7bb4a001-1a00-0000-13c4-95c28d0d0000 pid=3469 clone guuid=6144ce01-1a00-0000-13c4-95c28e0d0000 pid=3470 /usr/bin/ls guuid=25470b01-1a00-0000-13c4-95c28a0d0000 pid=3466->guuid=6144ce01-1a00-0000-13c4-95c28e0d0000 pid=3470 execve guuid=84539c02-1a00-0000-13c4-95c2900d0000 pid=3472 /usr/bin/cat guuid=25470b01-1a00-0000-13c4-95c28a0d0000 pid=3466->guuid=84539c02-1a00-0000-13c4-95c2900d0000 pid=3472 execve guuid=06501703-1a00-0000-13c4-95c2910d0000 pid=3473 /usr/bin/ls guuid=25470b01-1a00-0000-13c4-95c28a0d0000 pid=3466->guuid=06501703-1a00-0000-13c4-95c2910d0000 pid=3473 execve guuid=f5b1a303-1a00-0000-13c4-95c2930d0000 pid=3475 /usr/bin/mkdir guuid=25470b01-1a00-0000-13c4-95c28a0d0000 pid=3466->guuid=f5b1a303-1a00-0000-13c4-95c2930d0000 pid=3475 execve guuid=2842f003-1a00-0000-13c4-95c2940d0000 pid=3476 /usr/bin/mv guuid=25470b01-1a00-0000-13c4-95c28a0d0000 pid=3466->guuid=2842f003-1a00-0000-13c4-95c2940d0000 pid=3476 execve guuid=c2b75104-1a00-0000-13c4-95c2950d0000 pid=3477 /usr/bin/bash guuid=25470b01-1a00-0000-13c4-95c28a0d0000 pid=3466->guuid=c2b75104-1a00-0000-13c4-95c2950d0000 pid=3477 clone guuid=ebc05604-1a00-0000-13c4-95c2960d0000 pid=3478 /usr/bin/base64 write-file guuid=25470b01-1a00-0000-13c4-95c28a0d0000 pid=3466->guuid=ebc05604-1a00-0000-13c4-95c2960d0000 pid=3478 execve guuid=baa4ad04-1a00-0000-13c4-95c2980d0000 pid=3480 /usr/bin/rm delete-file guuid=25470b01-1a00-0000-13c4-95c28a0d0000 pid=3466->guuid=baa4ad04-1a00-0000-13c4-95c2980d0000 pid=3480 execve guuid=bb86f304-1a00-0000-13c4-95c2990d0000 pid=3481 /usr/bin/mv guuid=25470b01-1a00-0000-13c4-95c28a0d0000 pid=3466->guuid=bb86f304-1a00-0000-13c4-95c2990d0000 pid=3481 execve guuid=9de57405-1a00-0000-13c4-95c29b0d0000 pid=3483 /usr/bin/ls guuid=25470b01-1a00-0000-13c4-95c28a0d0000 pid=3466->guuid=9de57405-1a00-0000-13c4-95c29b0d0000 pid=3483 execve guuid=5c7bfb05-1a00-0000-13c4-95c29c0d0000 pid=3484 /usr/bin/bash guuid=25470b01-1a00-0000-13c4-95c28a0d0000 pid=3466->guuid=5c7bfb05-1a00-0000-13c4-95c29c0d0000 pid=3484 clone guuid=077e0006-1a00-0000-13c4-95c29d0d0000 pid=3485 /usr/bin/base64 write-file guuid=25470b01-1a00-0000-13c4-95c28a0d0000 pid=3466->guuid=077e0006-1a00-0000-13c4-95c29d0d0000 pid=3485 execve guuid=5d806b06-1a00-0000-13c4-95c29f0d0000 pid=3487 /usr/bin/ls guuid=25470b01-1a00-0000-13c4-95c28a0d0000 pid=3466->guuid=5d806b06-1a00-0000-13c4-95c29f0d0000 pid=3487 execve guuid=7cafde06-1a00-0000-13c4-95c2a00d0000 pid=3488 /usr/bin/cat guuid=25470b01-1a00-0000-13c4-95c28a0d0000 pid=3466->guuid=7cafde06-1a00-0000-13c4-95c2a00d0000 pid=3488 execve guuid=1b9e2d07-1a00-0000-13c4-95c2a10d0000 pid=3489 /usr/bin/ls guuid=25470b01-1a00-0000-13c4-95c28a0d0000 pid=3466->guuid=1b9e2d07-1a00-0000-13c4-95c2a10d0000 pid=3489 execve guuid=b47ed208-1a00-0000-13c4-95c2a70d0000 pid=3495->124ee36c-bdbd-5d46-bbb1-b2cd81367f04 send: 93B
Score:
81%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/dc67eafde293ecd7fbb56ed66efe691e87d06989e756fdb7354c664a3ac0d980
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/dc67eafde293ecd7fbb56ed66efe691e87d06989e756fdb7354c664a3ac0d980/
Threat name:
Linux.Backdoor.WebShell
Create hunting rule
Status:
Malicious
First seen:
2026-08-09 13:26:32 UTC
File Type:
Text (Shell)
AV detection:
12 of 24 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=3rt6v7pcspwnp65vn3lg57tjd2d5a2mj45lp3nzvjrteuowa3gaa._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260809-qpre4sae94/
Behaviour
Reads runtime system information
Writes file to tmp directory
Deobfuscate/Decode Files or Information
Checks CPU configuration
File and Directory Permissions Modification
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.16
Link:
https://yomi.yoroi.company/submissions/dc67eafde293ecd7fbb56ed66efe691e87d06989e756fdb7354c664a3ac0d980

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SUSP_LNX_Base64_Exec_Apr24
Create hunting rule
Author:Christian Burkard
Description:Detects suspicious base64 encoded shell commands (as seen in Palo Alto CVE-2024-3400 exploitation)
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh dc67eafde293ecd7fbb56ed66efe691e87d06989e756fdb7354c664a3ac0d980

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3884408/
  
Delivery method
Distributed via web download

Comments