MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e61c0490c2eb840e1a66af3db2e36b9c03617f62ab22ebc84b45a96879a5b2b7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e61c0490c2eb840e1a66af3db2e36b9c03617f62ab22ebc84b45a96879a5b2b7
SHA3-384 hash: ee154d229cb7ea64418eb1af2d53d4271773429059594665c96c30ce70f61f12f918425dec2632e0fddc7bc01d78a4a7
SHA1 hash: 551c42647feda0a0cd71bc879a8aa4639553797f
MD5 hash: b44adb37cab06a32e0e522784a42a9d8
humanhash: sodium-fix-stream-black
File name:wr.php
Download: download sample
File size:27'042 bytes
First seen:2026-07-23 18:19:38 UTC
Last seen:2026-07-24 15:56:12 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 768:S68vCB+25j6es8RCy9FYpMSUpi+20qUpi+20YQX:S68l25JCUd2QX
TLSH T184C26C966A867C44BEC94A3E4CBD2B1D6DF5C3D1324942AC3D8B3C719C11FACD618B1A
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://160.119.69.4/z/post/noroot.phpn/an/aelf ua-wget

Intelligence

File Origin
# of uploads :
3
# of downloads :
81
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.BV.Agent-BNQ.53442236.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
File Type:
unix shell
First seen:
2026-07-23T16:46:00Z UTC
Last seen:
2026-07-23T17:30:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/e61c0490c2eb840e1a66af3db2e36b9c03617f62ab22ebc84b45a96879a5b2b7/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/006d9e6e-ebed-43b7-b6cf-5c8cfd2f161b
Behavior Graph:
Download SVG
%3 guuid=93c3a276-1e00-0000-6227-93c32b130000 pid=4907 /usr/bin/sudo guuid=91e9c67a-1e00-0000-6227-93c336130000 pid=4918 /tmp/sample.bin guuid=93c3a276-1e00-0000-6227-93c32b130000 pid=4907->guuid=91e9c67a-1e00-0000-6227-93c336130000 pid=4918 execve guuid=0338987b-1e00-0000-6227-93c339130000 pid=4921 /usr/bin/bash guuid=91e9c67a-1e00-0000-6227-93c336130000 pid=4918->guuid=0338987b-1e00-0000-6227-93c339130000 pid=4921 clone guuid=2eb9ab7b-1e00-0000-6227-93c33a130000 pid=4922 /usr/bin/base64 guuid=91e9c67a-1e00-0000-6227-93c336130000 pid=4918->guuid=2eb9ab7b-1e00-0000-6227-93c33a130000 pid=4922 execve guuid=380db87b-1e00-0000-6227-93c33b130000 pid=4923 /usr/bin/bash guuid=91e9c67a-1e00-0000-6227-93c336130000 pid=4918->guuid=380db87b-1e00-0000-6227-93c33b130000 pid=4923 clone guuid=76beab7c-1e00-0000-6227-93c33e130000 pid=4926 /usr/bin/cp guuid=91e9c67a-1e00-0000-6227-93c336130000 pid=4918->guuid=76beab7c-1e00-0000-6227-93c33e130000 pid=4926 execve guuid=69f8887d-1e00-0000-6227-93c341130000 pid=4929 /usr/bin/mkdir guuid=91e9c67a-1e00-0000-6227-93c336130000 pid=4918->guuid=69f8887d-1e00-0000-6227-93c341130000 pid=4929 execve guuid=50b6f17d-1e00-0000-6227-93c343130000 pid=4931 /usr/bin/mkdir guuid=91e9c67a-1e00-0000-6227-93c336130000 pid=4918->guuid=50b6f17d-1e00-0000-6227-93c343130000 pid=4931 execve guuid=541b877e-1e00-0000-6227-93c345130000 pid=4933 /usr/bin/mkdir guuid=91e9c67a-1e00-0000-6227-93c336130000 pid=4918->guuid=541b877e-1e00-0000-6227-93c345130000 pid=4933 execve guuid=36501b7f-1e00-0000-6227-93c347130000 pid=4935 /usr/bin/mkdir guuid=91e9c67a-1e00-0000-6227-93c336130000 pid=4918->guuid=36501b7f-1e00-0000-6227-93c347130000 pid=4935 execve guuid=59b0777f-1e00-0000-6227-93c349130000 pid=4937 /usr/bin/mkdir guuid=91e9c67a-1e00-0000-6227-93c336130000 pid=4918->guuid=59b0777f-1e00-0000-6227-93c349130000 pid=4937 execve guuid=f4cc0780-1e00-0000-6227-93c34b130000 pid=4939 /usr/bin/mkdir guuid=91e9c67a-1e00-0000-6227-93c336130000 pid=4918->guuid=f4cc0780-1e00-0000-6227-93c34b130000 pid=4939 execve guuid=b8729c80-1e00-0000-6227-93c34d130000 pid=4941 /usr/bin/mkdir guuid=91e9c67a-1e00-0000-6227-93c336130000 pid=4918->guuid=b8729c80-1e00-0000-6227-93c34d130000 pid=4941 execve guuid=e80a2381-1e00-0000-6227-93c350130000 pid=4944 /usr/bin/mkdir guuid=91e9c67a-1e00-0000-6227-93c336130000 pid=4918->guuid=e80a2381-1e00-0000-6227-93c350130000 pid=4944 execve guuid=8b2fb981-1e00-0000-6227-93c351130000 pid=4945 /usr/bin/mkdir guuid=91e9c67a-1e00-0000-6227-93c336130000 pid=4918->guuid=8b2fb981-1e00-0000-6227-93c351130000 pid=4945 execve guuid=67cb5782-1e00-0000-6227-93c354130000 pid=4948 /usr/bin/cp guuid=91e9c67a-1e00-0000-6227-93c336130000 pid=4918->guuid=67cb5782-1e00-0000-6227-93c354130000 pid=4948 execve guuid=58b80283-1e00-0000-6227-93c356130000 pid=4950 /usr/bin/cp guuid=91e9c67a-1e00-0000-6227-93c336130000 pid=4918->guuid=58b80283-1e00-0000-6227-93c356130000 pid=4950 execve guuid=31fea483-1e00-0000-6227-93c358130000 pid=4952 /usr/bin/cp guuid=91e9c67a-1e00-0000-6227-93c336130000 pid=4918->guuid=31fea483-1e00-0000-6227-93c358130000 pid=4952 execve guuid=43404184-1e00-0000-6227-93c35b130000 pid=4955 /usr/bin/cp guuid=91e9c67a-1e00-0000-6227-93c336130000 pid=4918->guuid=43404184-1e00-0000-6227-93c35b130000 pid=4955 execve guuid=ab9fee84-1e00-0000-6227-93c35d130000 pid=4957 /usr/bin/cp guuid=91e9c67a-1e00-0000-6227-93c336130000 pid=4918->guuid=ab9fee84-1e00-0000-6227-93c35d130000 pid=4957 execve guuid=44a67b85-1e00-0000-6227-93c360130000 pid=4960 /usr/bin/cp guuid=91e9c67a-1e00-0000-6227-93c336130000 pid=4918->guuid=44a67b85-1e00-0000-6227-93c360130000 pid=4960 execve guuid=75c51e86-1e00-0000-6227-93c363130000 pid=4963 /usr/bin/cp guuid=91e9c67a-1e00-0000-6227-93c336130000 pid=4918->guuid=75c51e86-1e00-0000-6227-93c363130000 pid=4963 execve guuid=7a850687-1e00-0000-6227-93c366130000 pid=4966 /usr/bin/cp guuid=91e9c67a-1e00-0000-6227-93c336130000 pid=4918->guuid=7a850687-1e00-0000-6227-93c366130000 pid=4966 execve guuid=b450bb87-1e00-0000-6227-93c368130000 pid=4968 /usr/bin/cp guuid=91e9c67a-1e00-0000-6227-93c336130000 pid=4918->guuid=b450bb87-1e00-0000-6227-93c368130000 pid=4968 execve guuid=7c546388-1e00-0000-6227-93c36b130000 pid=4971 /usr/bin/cp guuid=91e9c67a-1e00-0000-6227-93c336130000 pid=4918->guuid=7c546388-1e00-0000-6227-93c36b130000 pid=4971 execve guuid=1a26ff88-1e00-0000-6227-93c36d130000 pid=4973 /usr/bin/cp guuid=91e9c67a-1e00-0000-6227-93c336130000 pid=4918->guuid=1a26ff88-1e00-0000-6227-93c36d130000 pid=4973 execve guuid=c6489a89-1e00-0000-6227-93c370130000 pid=4976 /usr/bin/cp guuid=91e9c67a-1e00-0000-6227-93c336130000 pid=4918->guuid=c6489a89-1e00-0000-6227-93c370130000 pid=4976 execve guuid=7b2a5f8a-1e00-0000-6227-93c372130000 pid=4978 /usr/bin/cp guuid=91e9c67a-1e00-0000-6227-93c336130000 pid=4918->guuid=7b2a5f8a-1e00-0000-6227-93c372130000 pid=4978 execve guuid=9435758b-1e00-0000-6227-93c375130000 pid=4981 /usr/bin/cp guuid=91e9c67a-1e00-0000-6227-93c336130000 pid=4918->guuid=9435758b-1e00-0000-6227-93c375130000 pid=4981 execve guuid=bf110f8c-1e00-0000-6227-93c377130000 pid=4983 /usr/bin/touch guuid=91e9c67a-1e00-0000-6227-93c336130000 pid=4918->guuid=bf110f8c-1e00-0000-6227-93c377130000 pid=4983 execve guuid=72238e8c-1e00-0000-6227-93c379130000 pid=4985 /usr/bin/chmod guuid=91e9c67a-1e00-0000-6227-93c336130000 pid=4918->guuid=72238e8c-1e00-0000-6227-93c379130000 pid=4985 execve guuid=b4dcfd8c-1e00-0000-6227-93c37b130000 pid=4987 /usr/bin/chmod guuid=91e9c67a-1e00-0000-6227-93c336130000 pid=4918->guuid=b4dcfd8c-1e00-0000-6227-93c37b130000 pid=4987 execve guuid=c0c5c68d-1e00-0000-6227-93c37e130000 pid=4990 /usr/bin/chattr guuid=91e9c67a-1e00-0000-6227-93c336130000 pid=4918->guuid=c0c5c68d-1e00-0000-6227-93c37e130000 pid=4990 execve guuid=1e8a428e-1e00-0000-6227-93c37f130000 pid=4991 /usr/bin/chattr guuid=91e9c67a-1e00-0000-6227-93c336130000 pid=4918->guuid=1e8a428e-1e00-0000-6227-93c37f130000 pid=4991 execve guuid=1e34938e-1e00-0000-6227-93c381130000 pid=4993 /usr/bin/chattr guuid=91e9c67a-1e00-0000-6227-93c336130000 pid=4918->guuid=1e34938e-1e00-0000-6227-93c381130000 pid=4993 execve guuid=ba3ed98e-1e00-0000-6227-93c382130000 pid=4994 /usr/bin/chattr guuid=91e9c67a-1e00-0000-6227-93c336130000 pid=4918->guuid=ba3ed98e-1e00-0000-6227-93c382130000 pid=4994 execve guuid=8f8c218f-1e00-0000-6227-93c384130000 pid=4996 /usr/bin/chattr guuid=91e9c67a-1e00-0000-6227-93c336130000 pid=4918->guuid=8f8c218f-1e00-0000-6227-93c384130000 pid=4996 execve guuid=f148668f-1e00-0000-6227-93c385130000 pid=4997 /usr/bin/chattr guuid=91e9c67a-1e00-0000-6227-93c336130000 pid=4918->guuid=f148668f-1e00-0000-6227-93c385130000 pid=4997 execve guuid=73cdad8f-1e00-0000-6227-93c387130000 pid=4999 /usr/bin/chattr guuid=91e9c67a-1e00-0000-6227-93c336130000 pid=4918->guuid=73cdad8f-1e00-0000-6227-93c387130000 pid=4999 execve guuid=0b425a90-1e00-0000-6227-93c389130000 pid=5001 /usr/bin/chattr guuid=91e9c67a-1e00-0000-6227-93c336130000 pid=4918->guuid=0b425a90-1e00-0000-6227-93c389130000 pid=5001 execve guuid=74e8a991-1e00-0000-6227-93c38d130000 pid=5005 /usr/bin/bash guuid=91e9c67a-1e00-0000-6227-93c336130000 pid=4918->guuid=74e8a991-1e00-0000-6227-93c38d130000 pid=5005 clone guuid=b272b491-1e00-0000-6227-93c38e130000 pid=5006 /usr/bin/bash guuid=91e9c67a-1e00-0000-6227-93c336130000 pid=4918->guuid=b272b491-1e00-0000-6227-93c38e130000 pid=5006 clone guuid=89162592-1e00-0000-6227-93c390130000 pid=5008 /usr/bin/curl net guuid=91e9c67a-1e00-0000-6227-93c336130000 pid=4918->guuid=89162592-1e00-0000-6227-93c390130000 pid=5008 execve guuid=27832f92-1e00-0000-6227-93c391130000 pid=5009 /usr/bin/dash guuid=91e9c67a-1e00-0000-6227-93c336130000 pid=4918->guuid=27832f92-1e00-0000-6227-93c391130000 pid=5009 execve 124ee36c-bdbd-5d46-bbb1-b2cd81367f04 160.119.69.4:80 guuid=89162592-1e00-0000-6227-93c390130000 pid=5008->124ee36c-bdbd-5d46-bbb1-b2cd81367f04 con
Score:
82%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/e61c0490c2eb840e1a66af3db2e36b9c03617f62ab22ebc84b45a96879a5b2b7
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e61c0490c2eb840e1a66af3db2e36b9c03617f62ab22ebc84b45a96879a5b2b7/
Threat name:
Linux.Backdoor.WebShell
Create hunting rule
Status:
Malicious
First seen:
2026-07-23 18:20:55 UTC
File Type:
Text (Shell)
AV detection:
15 of 38 (39.47%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4yoajegc5oca4gtgv463fy3ltqbwc73cvmroxscliwuwq6nfwk3q._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260723-wy58hsvard/
Behaviour
Reads runtime system information
Writes file to tmp directory
Deobfuscate/Decode Files or Information
Checks CPU configuration
File and Directory Permissions Modification
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.16
Link:
https://yomi.yoroi.company/submissions/e61c0490c2eb840e1a66af3db2e36b9c03617f62ab22ebc84b45a96879a5b2b7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SUSP_LNX_Base64_Exec_Apr24
Create hunting rule
Author:Christian Burkard
Description:Detects suspicious base64 encoded shell commands (as seen in Palo Alto CVE-2024-3400 exploitation)
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh e61c0490c2eb840e1a66af3db2e36b9c03617f62ab22ebc84b45a96879a5b2b7

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3884408/
  
Delivery method
Distributed via web download

Comments