MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e282912432ea0c44137093d4633a91582c9eb3da56ac7fe5e235a50938d7edcc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 3


Intelligence 3 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e282912432ea0c44137093d4633a91582c9eb3da56ac7fe5e235a50938d7edcc
SHA3-384 hash: 613041774d0f73d9de9d530e91fdea15bbb8c5427c9040b39a7e4555fab278d79c8a43fa4763f2c4c6e103912bbbf421
SHA1 hash: 2b879ef7fd68de6292b0cf525ec4a23f560da8d4
MD5 hash: 6816c8dfdf10cc4ef2a074b117ff6c56
humanhash: finch-purple-robin-quebec
File name:wr.php
Download: download sample
File size:27'042 bytes
First seen:2026-07-28 10:59:47 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 768:Z/8vCB+25j6es8RKU9FYpMSUpi+20qUpi+20YQX:Z/8l25Jjd2QX
TLSH T1C9C28D956A867C44BEC94A3E4CBD2B0D6DF5C3D1324942AC3D8A3C71DC11FACD618B2A
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://160.119.69.4/z/post/noroot.phpn/an/aelf ua-wget

Intelligence

File Origin
# of uploads :
1
# of downloads :
75
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.BV.Agent-BNQ.64646514.UNOFFICIAL
Create hunting rule

Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/29878228-e1ac-44c3-98b1-6dc30edab9e9
Behavior Graph:
Download SVG
%3 guuid=aca9190b-1900-0000-17b5-c269db0c0000 pid=3291 /usr/bin/sudo guuid=2e107510-1900-0000-17b5-c269ea0c0000 pid=3306 /tmp/sample.bin guuid=aca9190b-1900-0000-17b5-c269db0c0000 pid=3291->guuid=2e107510-1900-0000-17b5-c269ea0c0000 pid=3306 execve guuid=bd3c5412-1900-0000-17b5-c269f20c0000 pid=3314 /usr/bin/bash guuid=2e107510-1900-0000-17b5-c269ea0c0000 pid=3306->guuid=bd3c5412-1900-0000-17b5-c269f20c0000 pid=3314 clone guuid=bb596f12-1900-0000-17b5-c269f40c0000 pid=3316 /usr/bin/base64 guuid=2e107510-1900-0000-17b5-c269ea0c0000 pid=3306->guuid=bb596f12-1900-0000-17b5-c269f40c0000 pid=3316 execve guuid=35de8012-1900-0000-17b5-c269f50c0000 pid=3317 /usr/bin/bash guuid=2e107510-1900-0000-17b5-c269ea0c0000 pid=3306->guuid=35de8012-1900-0000-17b5-c269f50c0000 pid=3317 clone guuid=d14c4213-1900-0000-17b5-c269f80c0000 pid=3320 /usr/bin/cp guuid=2e107510-1900-0000-17b5-c269ea0c0000 pid=3306->guuid=d14c4213-1900-0000-17b5-c269f80c0000 pid=3320 execve guuid=08114a14-1900-0000-17b5-c269fb0c0000 pid=3323 /usr/bin/mkdir guuid=2e107510-1900-0000-17b5-c269ea0c0000 pid=3306->guuid=08114a14-1900-0000-17b5-c269fb0c0000 pid=3323 execve guuid=4639c414-1900-0000-17b5-c269fe0c0000 pid=3326 /usr/bin/mkdir guuid=2e107510-1900-0000-17b5-c269ea0c0000 pid=3306->guuid=4639c414-1900-0000-17b5-c269fe0c0000 pid=3326 execve guuid=2f043c15-1900-0000-17b5-c269000d0000 pid=3328 /usr/bin/mkdir guuid=2e107510-1900-0000-17b5-c269ea0c0000 pid=3306->guuid=2f043c15-1900-0000-17b5-c269000d0000 pid=3328 execve guuid=7118e115-1900-0000-17b5-c269040d0000 pid=3332 /usr/bin/mkdir guuid=2e107510-1900-0000-17b5-c269ea0c0000 pid=3306->guuid=7118e115-1900-0000-17b5-c269040d0000 pid=3332 execve guuid=b51f6916-1900-0000-17b5-c269060d0000 pid=3334 /usr/bin/mkdir guuid=2e107510-1900-0000-17b5-c269ea0c0000 pid=3306->guuid=b51f6916-1900-0000-17b5-c269060d0000 pid=3334 execve guuid=196fcf16-1900-0000-17b5-c269080d0000 pid=3336 /usr/bin/mkdir guuid=2e107510-1900-0000-17b5-c269ea0c0000 pid=3306->guuid=196fcf16-1900-0000-17b5-c269080d0000 pid=3336 execve guuid=44b92e17-1900-0000-17b5-c2690a0d0000 pid=3338 /usr/bin/mkdir guuid=2e107510-1900-0000-17b5-c269ea0c0000 pid=3306->guuid=44b92e17-1900-0000-17b5-c2690a0d0000 pid=3338 execve guuid=ca1c8e17-1900-0000-17b5-c2690c0d0000 pid=3340 /usr/bin/mkdir guuid=2e107510-1900-0000-17b5-c269ea0c0000 pid=3306->guuid=ca1c8e17-1900-0000-17b5-c2690c0d0000 pid=3340 execve guuid=0f21fd17-1900-0000-17b5-c2690d0d0000 pid=3341 /usr/bin/mkdir guuid=2e107510-1900-0000-17b5-c269ea0c0000 pid=3306->guuid=0f21fd17-1900-0000-17b5-c2690d0d0000 pid=3341 execve guuid=d95b7318-1900-0000-17b5-c2690f0d0000 pid=3343 /usr/bin/cp guuid=2e107510-1900-0000-17b5-c269ea0c0000 pid=3306->guuid=d95b7318-1900-0000-17b5-c2690f0d0000 pid=3343 execve guuid=cbf12119-1900-0000-17b5-c269110d0000 pid=3345 /usr/bin/cp guuid=2e107510-1900-0000-17b5-c269ea0c0000 pid=3306->guuid=cbf12119-1900-0000-17b5-c269110d0000 pid=3345 execve guuid=0579c519-1900-0000-17b5-c269120d0000 pid=3346 /usr/bin/cp guuid=2e107510-1900-0000-17b5-c269ea0c0000 pid=3306->guuid=0579c519-1900-0000-17b5-c269120d0000 pid=3346 execve guuid=c1054d1a-1900-0000-17b5-c269140d0000 pid=3348 /usr/bin/cp guuid=2e107510-1900-0000-17b5-c269ea0c0000 pid=3306->guuid=c1054d1a-1900-0000-17b5-c269140d0000 pid=3348 execve guuid=6c73cd1a-1900-0000-17b5-c269160d0000 pid=3350 /usr/bin/cp guuid=2e107510-1900-0000-17b5-c269ea0c0000 pid=3306->guuid=6c73cd1a-1900-0000-17b5-c269160d0000 pid=3350 execve guuid=5671531b-1900-0000-17b5-c269180d0000 pid=3352 /usr/bin/cp guuid=2e107510-1900-0000-17b5-c269ea0c0000 pid=3306->guuid=5671531b-1900-0000-17b5-c269180d0000 pid=3352 execve guuid=e254d91b-1900-0000-17b5-c269190d0000 pid=3353 /usr/bin/cp guuid=2e107510-1900-0000-17b5-c269ea0c0000 pid=3306->guuid=e254d91b-1900-0000-17b5-c269190d0000 pid=3353 execve guuid=a3d3521c-1900-0000-17b5-c2691b0d0000 pid=3355 /usr/bin/cp guuid=2e107510-1900-0000-17b5-c269ea0c0000 pid=3306->guuid=a3d3521c-1900-0000-17b5-c2691b0d0000 pid=3355 execve guuid=cfc8d31c-1900-0000-17b5-c2691d0d0000 pid=3357 /usr/bin/cp guuid=2e107510-1900-0000-17b5-c269ea0c0000 pid=3306->guuid=cfc8d31c-1900-0000-17b5-c2691d0d0000 pid=3357 execve guuid=2b8a541d-1900-0000-17b5-c2691f0d0000 pid=3359 /usr/bin/cp guuid=2e107510-1900-0000-17b5-c269ea0c0000 pid=3306->guuid=2b8a541d-1900-0000-17b5-c2691f0d0000 pid=3359 execve guuid=1796cb1d-1900-0000-17b5-c269200d0000 pid=3360 /usr/bin/cp guuid=2e107510-1900-0000-17b5-c269ea0c0000 pid=3306->guuid=1796cb1d-1900-0000-17b5-c269200d0000 pid=3360 execve guuid=39c53b1e-1900-0000-17b5-c269220d0000 pid=3362 /usr/bin/cp guuid=2e107510-1900-0000-17b5-c269ea0c0000 pid=3306->guuid=39c53b1e-1900-0000-17b5-c269220d0000 pid=3362 execve guuid=e16bc11e-1900-0000-17b5-c269240d0000 pid=3364 /usr/bin/cp guuid=2e107510-1900-0000-17b5-c269ea0c0000 pid=3306->guuid=e16bc11e-1900-0000-17b5-c269240d0000 pid=3364 execve guuid=9493311f-1900-0000-17b5-c269260d0000 pid=3366 /usr/bin/cp guuid=2e107510-1900-0000-17b5-c269ea0c0000 pid=3306->guuid=9493311f-1900-0000-17b5-c269260d0000 pid=3366 execve guuid=181d831f-1900-0000-17b5-c269290d0000 pid=3369 /usr/bin/touch guuid=2e107510-1900-0000-17b5-c269ea0c0000 pid=3306->guuid=181d831f-1900-0000-17b5-c269290d0000 pid=3369 execve guuid=32f6c31f-1900-0000-17b5-c2692a0d0000 pid=3370 /usr/bin/chmod guuid=2e107510-1900-0000-17b5-c269ea0c0000 pid=3306->guuid=32f6c31f-1900-0000-17b5-c2692a0d0000 pid=3370 execve guuid=ce533d20-1900-0000-17b5-c2692c0d0000 pid=3372 /usr/bin/chmod guuid=2e107510-1900-0000-17b5-c269ea0c0000 pid=3306->guuid=ce533d20-1900-0000-17b5-c2692c0d0000 pid=3372 execve guuid=959c1e21-1900-0000-17b5-c269300d0000 pid=3376 /usr/bin/chattr guuid=2e107510-1900-0000-17b5-c269ea0c0000 pid=3306->guuid=959c1e21-1900-0000-17b5-c269300d0000 pid=3376 execve guuid=afce3822-1900-0000-17b5-c269340d0000 pid=3380 /usr/bin/chattr guuid=2e107510-1900-0000-17b5-c269ea0c0000 pid=3306->guuid=afce3822-1900-0000-17b5-c269340d0000 pid=3380 execve guuid=d7858222-1900-0000-17b5-c269370d0000 pid=3383 /usr/bin/chattr guuid=2e107510-1900-0000-17b5-c269ea0c0000 pid=3306->guuid=d7858222-1900-0000-17b5-c269370d0000 pid=3383 execve guuid=7f6dd322-1900-0000-17b5-c269380d0000 pid=3384 /usr/bin/chattr guuid=2e107510-1900-0000-17b5-c269ea0c0000 pid=3306->guuid=7f6dd322-1900-0000-17b5-c269380d0000 pid=3384 execve guuid=c0511f23-1900-0000-17b5-c2693b0d0000 pid=3387 /usr/bin/chattr guuid=2e107510-1900-0000-17b5-c269ea0c0000 pid=3306->guuid=c0511f23-1900-0000-17b5-c2693b0d0000 pid=3387 execve guuid=85e16223-1900-0000-17b5-c2693d0d0000 pid=3389 /usr/bin/chattr guuid=2e107510-1900-0000-17b5-c269ea0c0000 pid=3306->guuid=85e16223-1900-0000-17b5-c2693d0d0000 pid=3389 execve guuid=3d70d023-1900-0000-17b5-c2693f0d0000 pid=3391 /usr/bin/chattr guuid=2e107510-1900-0000-17b5-c269ea0c0000 pid=3306->guuid=3d70d023-1900-0000-17b5-c2693f0d0000 pid=3391 execve guuid=27d81b24-1900-0000-17b5-c269410d0000 pid=3393 /usr/bin/chattr guuid=2e107510-1900-0000-17b5-c269ea0c0000 pid=3306->guuid=27d81b24-1900-0000-17b5-c269410d0000 pid=3393 execve guuid=bce77624-1900-0000-17b5-c269430d0000 pid=3395 /usr/bin/bash guuid=2e107510-1900-0000-17b5-c269ea0c0000 pid=3306->guuid=bce77624-1900-0000-17b5-c269430d0000 pid=3395 clone guuid=691d8624-1900-0000-17b5-c269440d0000 pid=3396 /usr/bin/bash guuid=2e107510-1900-0000-17b5-c269ea0c0000 pid=3306->guuid=691d8624-1900-0000-17b5-c269440d0000 pid=3396 clone guuid=6742ab24-1900-0000-17b5-c269460d0000 pid=3398 /usr/bin/curl net send-data guuid=2e107510-1900-0000-17b5-c269ea0c0000 pid=3306->guuid=6742ab24-1900-0000-17b5-c269460d0000 pid=3398 execve guuid=7d67b924-1900-0000-17b5-c269470d0000 pid=3399 /usr/bin/dash guuid=2e107510-1900-0000-17b5-c269ea0c0000 pid=3306->guuid=7d67b924-1900-0000-17b5-c269470d0000 pid=3399 execve guuid=2b9e402b-1900-0000-17b5-c269550d0000 pid=3413 /usr/bin/bash guuid=2e107510-1900-0000-17b5-c269ea0c0000 pid=3306->guuid=2b9e402b-1900-0000-17b5-c269550d0000 pid=3413 clone guuid=06734a2b-1900-0000-17b5-c269560d0000 pid=3414 /usr/bin/base64 guuid=2e107510-1900-0000-17b5-c269ea0c0000 pid=3306->guuid=06734a2b-1900-0000-17b5-c269560d0000 pid=3414 execve guuid=bca54f2b-1900-0000-17b5-c269570d0000 pid=3415 /usr/bin/tee write-file guuid=2e107510-1900-0000-17b5-c269ea0c0000 pid=3306->guuid=bca54f2b-1900-0000-17b5-c269570d0000 pid=3415 execve guuid=d706b02b-1900-0000-17b5-c269580d0000 pid=3416 /usr/bin/bash guuid=2e107510-1900-0000-17b5-c269ea0c0000 pid=3306->guuid=d706b02b-1900-0000-17b5-c269580d0000 pid=3416 execve guuid=6b9fbe31-1900-0000-17b5-c269760d0000 pid=3446 /usr/bin/bash guuid=2e107510-1900-0000-17b5-c269ea0c0000 pid=3306->guuid=6b9fbe31-1900-0000-17b5-c269760d0000 pid=3446 execve guuid=dd936732-1900-0000-17b5-c269780d0000 pid=3448 /usr/bin/rm delete-file guuid=2e107510-1900-0000-17b5-c269ea0c0000 pid=3306->guuid=dd936732-1900-0000-17b5-c269780d0000 pid=3448 execve guuid=ab49b132-1900-0000-17b5-c2697a0d0000 pid=3450 /usr/bin/rm guuid=2e107510-1900-0000-17b5-c269ea0c0000 pid=3306->guuid=ab49b132-1900-0000-17b5-c2697a0d0000 pid=3450 execve guuid=42dc2c33-1900-0000-17b5-c2697b0d0000 pid=3451 /usr/bin/curl net send-data guuid=2e107510-1900-0000-17b5-c269ea0c0000 pid=3306->guuid=42dc2c33-1900-0000-17b5-c2697b0d0000 pid=3451 execve guuid=10433533-1900-0000-17b5-c2697c0d0000 pid=3452 /usr/bin/dash guuid=2e107510-1900-0000-17b5-c269ea0c0000 pid=3306->guuid=10433533-1900-0000-17b5-c2697c0d0000 pid=3452 execve 124ee36c-bdbd-5d46-bbb1-b2cd81367f04 160.119.69.4:80 guuid=6742ab24-1900-0000-17b5-c269460d0000 pid=3398->124ee36c-bdbd-5d46-bbb1-b2cd81367f04 send: 93B guuid=beb0032c-1900-0000-17b5-c269590d0000 pid=3417 /usr/bin/bash guuid=d706b02b-1900-0000-17b5-c269580d0000 pid=3416->guuid=beb0032c-1900-0000-17b5-c269590d0000 pid=3417 clone guuid=20690a2c-1900-0000-17b5-c2695a0d0000 pid=3418 /usr/bin/bash guuid=d706b02b-1900-0000-17b5-c269580d0000 pid=3416->guuid=20690a2c-1900-0000-17b5-c2695a0d0000 pid=3418 clone guuid=b1842a2c-1900-0000-17b5-c2695b0d0000 pid=3419 /usr/bin/ls guuid=d706b02b-1900-0000-17b5-c269580d0000 pid=3416->guuid=b1842a2c-1900-0000-17b5-c2695b0d0000 pid=3419 execve guuid=50d4a62c-1900-0000-17b5-c2695c0d0000 pid=3420 /usr/bin/cat guuid=d706b02b-1900-0000-17b5-c269580d0000 pid=3416->guuid=50d4a62c-1900-0000-17b5-c2695c0d0000 pid=3420 execve guuid=1f77ec2c-1900-0000-17b5-c2695d0d0000 pid=3421 /usr/bin/ls guuid=d706b02b-1900-0000-17b5-c269580d0000 pid=3416->guuid=1f77ec2c-1900-0000-17b5-c2695d0d0000 pid=3421 execve guuid=22ea592d-1900-0000-17b5-c2695e0d0000 pid=3422 /usr/bin/mkdir guuid=d706b02b-1900-0000-17b5-c269580d0000 pid=3416->guuid=22ea592d-1900-0000-17b5-c2695e0d0000 pid=3422 execve guuid=b4bbb72d-1900-0000-17b5-c269610d0000 pid=3425 /usr/bin/mv guuid=d706b02b-1900-0000-17b5-c269580d0000 pid=3416->guuid=b4bbb72d-1900-0000-17b5-c269610d0000 pid=3425 execve guuid=65782f2e-1900-0000-17b5-c269630d0000 pid=3427 /usr/bin/bash guuid=d706b02b-1900-0000-17b5-c269580d0000 pid=3416->guuid=65782f2e-1900-0000-17b5-c269630d0000 pid=3427 clone guuid=a53e432e-1900-0000-17b5-c269640d0000 pid=3428 /usr/bin/base64 write-file guuid=d706b02b-1900-0000-17b5-c269580d0000 pid=3416->guuid=a53e432e-1900-0000-17b5-c269640d0000 pid=3428 execve guuid=4d73af2e-1900-0000-17b5-c269660d0000 pid=3430 /usr/bin/rm delete-file guuid=d706b02b-1900-0000-17b5-c269580d0000 pid=3416->guuid=4d73af2e-1900-0000-17b5-c269660d0000 pid=3430 execve guuid=c4fb082f-1900-0000-17b5-c269680d0000 pid=3432 /usr/bin/mv guuid=d706b02b-1900-0000-17b5-c269580d0000 pid=3416->guuid=c4fb082f-1900-0000-17b5-c269680d0000 pid=3432 execve guuid=9ced8f2f-1900-0000-17b5-c2696b0d0000 pid=3435 /usr/bin/ls guuid=d706b02b-1900-0000-17b5-c269580d0000 pid=3416->guuid=9ced8f2f-1900-0000-17b5-c2696b0d0000 pid=3435 execve guuid=ad740e30-1900-0000-17b5-c2696d0d0000 pid=3437 /usr/bin/bash guuid=d706b02b-1900-0000-17b5-c269580d0000 pid=3416->guuid=ad740e30-1900-0000-17b5-c2696d0d0000 pid=3437 clone guuid=55b61d30-1900-0000-17b5-c2696e0d0000 pid=3438 /usr/bin/base64 write-file guuid=d706b02b-1900-0000-17b5-c269580d0000 pid=3416->guuid=55b61d30-1900-0000-17b5-c2696e0d0000 pid=3438 execve guuid=39447f30-1900-0000-17b5-c269700d0000 pid=3440 /usr/bin/ls guuid=d706b02b-1900-0000-17b5-c269580d0000 pid=3416->guuid=39447f30-1900-0000-17b5-c269700d0000 pid=3440 execve guuid=10120031-1900-0000-17b5-c269720d0000 pid=3442 /usr/bin/cat guuid=d706b02b-1900-0000-17b5-c269580d0000 pid=3416->guuid=10120031-1900-0000-17b5-c269720d0000 pid=3442 execve guuid=2d4d4c31-1900-0000-17b5-c269730d0000 pid=3443 /usr/bin/ls guuid=d706b02b-1900-0000-17b5-c269580d0000 pid=3416->guuid=2d4d4c31-1900-0000-17b5-c269730d0000 pid=3443 execve guuid=42dc2c33-1900-0000-17b5-c2697b0d0000 pid=3451->124ee36c-bdbd-5d46-bbb1-b2cd81367f04 send: 93B
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e282912432ea0c44137093d4633a91582c9eb3da56ac7fe5e235a50938d7edcc/
Threat name:
Linux.Backdoor.WebShell
Create hunting rule
Status:
Malicious
First seen:
2026-07-28 11:01:35 UTC
File Type:
Text (Shell)
AV detection:
15 of 36 (41.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4kbjcjbs5igeie3qspkggourlawj5m62k2wh7zpcgwsqsogx5xga._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260728-m4s1psvdpd/
Behaviour
Reads runtime system information
Writes file to tmp directory
Deobfuscate/Decode Files or Information
Checks CPU configuration
File and Directory Permissions Modification
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.16
Link:
https://yomi.yoroi.company/submissions/e282912432ea0c44137093d4633a91582c9eb3da56ac7fe5e235a50938d7edcc

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SUSP_LNX_Base64_Exec_Apr24
Create hunting rule
Author:Christian Burkard
Description:Detects suspicious base64 encoded shell commands (as seen in Palo Alto CVE-2024-3400 exploitation)
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh e282912432ea0c44137093d4633a91582c9eb3da56ac7fe5e235a50938d7edcc

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3884408/
  
Delivery method
Distributed via web download

Comments