MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ee0040d0a0bfc4dcc22b58f4316a4534696d0db69cbaa02b6aabbd41b117e58d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 6


Intelligence 6 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ee0040d0a0bfc4dcc22b58f4316a4534696d0db69cbaa02b6aabbd41b117e58d
SHA3-384 hash: 33dac4f56f023b7d14a812d9ac2547c2b58a29c2455f0f7c086550b29a8952542b80f2a9f5439bab0493d0a427cc0ac5
SHA1 hash: 6527bd1cc84fd53349fce5afb33c71a277f4ed36
MD5 hash: 16f45cedc50f51d5aa7e13d1e9a01533
humanhash: lima-kansas-batman-whiskey
File name:wr.php
Download: download sample
File size:27'042 bytes
First seen:2026-08-24 14:32:41 UTC
Last seen:2026-08-25 12:18:39 UTC
File type: sh
MIME type:text/x-shellscript
ssdeep 768:q8vCB+25j6es8RZ5o9FYpMSUpi+20qUpi+20YQX:q8l25J3+d2QX
TLSH T110C27C96AA867C44BEC94A3E4CBD2B1D6DF5C3D1224942AC3D8A3C71DC11F9CD618B1A
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://160.119.69.4/z/post/noroot.phpn/an/aelf ua-wget

Intelligence

File Origin
# of uploads :
2
# of downloads :
38
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive masquerade
Link:
https://www.filescan.io/uploads/6a8c562b64e0ea1baf1bb4db/reports/c972f2d4-4a2a-4da4-83f3-87837bfd9064/overview
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-08-24T12:49:00Z UTC
Last seen:
2026-08-24T13:26:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/ee0040d0a0bfc4dcc22b58f4316a4534696d0db69cbaa02b6aabbd41b117e58d/results?tab=lookup
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/0132e94c-5e9d-4fdf-97cc-87783158ca4a
Behavior Graph:
Download SVG
%3 guuid=30d94818-1900-0000-1cb0-a267e9080000 pid=2281 /usr/bin/sudo guuid=f5479c20-1900-0000-1cb0-a267f1080000 pid=2289 /tmp/sample.bin guuid=30d94818-1900-0000-1cb0-a267e9080000 pid=2281->guuid=f5479c20-1900-0000-1cb0-a267f1080000 pid=2289 execve guuid=780a8723-1900-0000-1cb0-a267f3080000 pid=2291 /usr/bin/bash guuid=f5479c20-1900-0000-1cb0-a267f1080000 pid=2289->guuid=780a8723-1900-0000-1cb0-a267f3080000 pid=2291 clone guuid=98afeb23-1900-0000-1cb0-a267f4080000 pid=2292 /usr/bin/base64 guuid=f5479c20-1900-0000-1cb0-a267f1080000 pid=2289->guuid=98afeb23-1900-0000-1cb0-a267f4080000 pid=2292 execve guuid=a6034f24-1900-0000-1cb0-a267f5080000 pid=2293 /usr/bin/bash guuid=f5479c20-1900-0000-1cb0-a267f1080000 pid=2289->guuid=a6034f24-1900-0000-1cb0-a267f5080000 pid=2293 clone guuid=1d0a8726-1900-0000-1cb0-a267f9080000 pid=2297 /usr/bin/cp guuid=f5479c20-1900-0000-1cb0-a267f1080000 pid=2289->guuid=1d0a8726-1900-0000-1cb0-a267f9080000 pid=2297 execve guuid=f8a36027-1900-0000-1cb0-a267fb080000 pid=2299 /usr/bin/mkdir guuid=f5479c20-1900-0000-1cb0-a267f1080000 pid=2289->guuid=f8a36027-1900-0000-1cb0-a267fb080000 pid=2299 execve guuid=6e2f0e28-1900-0000-1cb0-a267fc080000 pid=2300 /usr/bin/mkdir guuid=f5479c20-1900-0000-1cb0-a267f1080000 pid=2289->guuid=6e2f0e28-1900-0000-1cb0-a267fc080000 pid=2300 execve guuid=41a11129-1900-0000-1cb0-a267ff080000 pid=2303 /usr/bin/mkdir guuid=f5479c20-1900-0000-1cb0-a267f1080000 pid=2289->guuid=41a11129-1900-0000-1cb0-a267ff080000 pid=2303 execve guuid=0f009b29-1900-0000-1cb0-a26700090000 pid=2304 /usr/bin/mkdir guuid=f5479c20-1900-0000-1cb0-a267f1080000 pid=2289->guuid=0f009b29-1900-0000-1cb0-a26700090000 pid=2304 execve guuid=c99f372a-1900-0000-1cb0-a26702090000 pid=2306 /usr/bin/mkdir guuid=f5479c20-1900-0000-1cb0-a267f1080000 pid=2289->guuid=c99f372a-1900-0000-1cb0-a26702090000 pid=2306 execve guuid=1147062b-1900-0000-1cb0-a26703090000 pid=2307 /usr/bin/mkdir guuid=f5479c20-1900-0000-1cb0-a267f1080000 pid=2289->guuid=1147062b-1900-0000-1cb0-a26703090000 pid=2307 execve guuid=c673cf2b-1900-0000-1cb0-a26705090000 pid=2309 /usr/bin/mkdir guuid=f5479c20-1900-0000-1cb0-a267f1080000 pid=2289->guuid=c673cf2b-1900-0000-1cb0-a26705090000 pid=2309 execve guuid=617e732c-1900-0000-1cb0-a26706090000 pid=2310 /usr/bin/mkdir guuid=f5479c20-1900-0000-1cb0-a267f1080000 pid=2289->guuid=617e732c-1900-0000-1cb0-a26706090000 pid=2310 execve guuid=b5a3212d-1900-0000-1cb0-a26708090000 pid=2312 /usr/bin/mkdir guuid=f5479c20-1900-0000-1cb0-a267f1080000 pid=2289->guuid=b5a3212d-1900-0000-1cb0-a26708090000 pid=2312 execve guuid=15a3f82d-1900-0000-1cb0-a26709090000 pid=2313 /usr/bin/cp guuid=f5479c20-1900-0000-1cb0-a267f1080000 pid=2289->guuid=15a3f82d-1900-0000-1cb0-a26709090000 pid=2313 execve guuid=3e0a0e2f-1900-0000-1cb0-a2670b090000 pid=2315 /usr/bin/cp guuid=f5479c20-1900-0000-1cb0-a267f1080000 pid=2289->guuid=3e0a0e2f-1900-0000-1cb0-a2670b090000 pid=2315 execve guuid=78d8ec2f-1900-0000-1cb0-a2670c090000 pid=2316 /usr/bin/cp guuid=f5479c20-1900-0000-1cb0-a267f1080000 pid=2289->guuid=78d8ec2f-1900-0000-1cb0-a2670c090000 pid=2316 execve guuid=2c43c630-1900-0000-1cb0-a2670e090000 pid=2318 /usr/bin/cp guuid=f5479c20-1900-0000-1cb0-a267f1080000 pid=2289->guuid=2c43c630-1900-0000-1cb0-a2670e090000 pid=2318 execve guuid=de129f31-1900-0000-1cb0-a2670f090000 pid=2319 /usr/bin/cp guuid=f5479c20-1900-0000-1cb0-a267f1080000 pid=2289->guuid=de129f31-1900-0000-1cb0-a2670f090000 pid=2319 execve guuid=bfa49232-1900-0000-1cb0-a26710090000 pid=2320 /usr/bin/cp guuid=f5479c20-1900-0000-1cb0-a267f1080000 pid=2289->guuid=bfa49232-1900-0000-1cb0-a26710090000 pid=2320 execve guuid=b1f38833-1900-0000-1cb0-a26711090000 pid=2321 /usr/bin/cp guuid=f5479c20-1900-0000-1cb0-a267f1080000 pid=2289->guuid=b1f38833-1900-0000-1cb0-a26711090000 pid=2321 execve guuid=6d025234-1900-0000-1cb0-a26712090000 pid=2322 /usr/bin/cp guuid=f5479c20-1900-0000-1cb0-a267f1080000 pid=2289->guuid=6d025234-1900-0000-1cb0-a26712090000 pid=2322 execve guuid=8fc42135-1900-0000-1cb0-a26714090000 pid=2324 /usr/bin/cp guuid=f5479c20-1900-0000-1cb0-a267f1080000 pid=2289->guuid=8fc42135-1900-0000-1cb0-a26714090000 pid=2324 execve guuid=1486df35-1900-0000-1cb0-a26715090000 pid=2325 /usr/bin/cp guuid=f5479c20-1900-0000-1cb0-a267f1080000 pid=2289->guuid=1486df35-1900-0000-1cb0-a26715090000 pid=2325 execve guuid=80d5c736-1900-0000-1cb0-a26717090000 pid=2327 /usr/bin/cp guuid=f5479c20-1900-0000-1cb0-a267f1080000 pid=2289->guuid=80d5c736-1900-0000-1cb0-a26717090000 pid=2327 execve guuid=e9ab9537-1900-0000-1cb0-a26718090000 pid=2328 /usr/bin/cp guuid=f5479c20-1900-0000-1cb0-a267f1080000 pid=2289->guuid=e9ab9537-1900-0000-1cb0-a26718090000 pid=2328 execve guuid=70ef4838-1900-0000-1cb0-a2671b090000 pid=2331 /usr/bin/cp guuid=f5479c20-1900-0000-1cb0-a267f1080000 pid=2289->guuid=70ef4838-1900-0000-1cb0-a2671b090000 pid=2331 execve guuid=4536fc38-1900-0000-1cb0-a2671c090000 pid=2332 /usr/bin/cp guuid=f5479c20-1900-0000-1cb0-a267f1080000 pid=2289->guuid=4536fc38-1900-0000-1cb0-a2671c090000 pid=2332 execve guuid=6582e339-1900-0000-1cb0-a2671e090000 pid=2334 /usr/bin/touch guuid=f5479c20-1900-0000-1cb0-a267f1080000 pid=2289->guuid=6582e339-1900-0000-1cb0-a2671e090000 pid=2334 execve guuid=49807d3a-1900-0000-1cb0-a26720090000 pid=2336 /usr/bin/chmod guuid=f5479c20-1900-0000-1cb0-a267f1080000 pid=2289->guuid=49807d3a-1900-0000-1cb0-a26720090000 pid=2336 execve guuid=f680213b-1900-0000-1cb0-a26722090000 pid=2338 /usr/bin/chmod guuid=f5479c20-1900-0000-1cb0-a267f1080000 pid=2289->guuid=f680213b-1900-0000-1cb0-a26722090000 pid=2338 execve guuid=45dcc13b-1900-0000-1cb0-a26723090000 pid=2339 /usr/bin/chattr guuid=f5479c20-1900-0000-1cb0-a267f1080000 pid=2289->guuid=45dcc13b-1900-0000-1cb0-a26723090000 pid=2339 execve guuid=55c2b53c-1900-0000-1cb0-a26725090000 pid=2341 /usr/bin/chattr guuid=f5479c20-1900-0000-1cb0-a267f1080000 pid=2289->guuid=55c2b53c-1900-0000-1cb0-a26725090000 pid=2341 execve guuid=d0e5823d-1900-0000-1cb0-a26726090000 pid=2342 /usr/bin/chattr guuid=f5479c20-1900-0000-1cb0-a267f1080000 pid=2289->guuid=d0e5823d-1900-0000-1cb0-a26726090000 pid=2342 execve guuid=439c323e-1900-0000-1cb0-a26728090000 pid=2344 /usr/bin/chattr guuid=f5479c20-1900-0000-1cb0-a267f1080000 pid=2289->guuid=439c323e-1900-0000-1cb0-a26728090000 pid=2344 execve guuid=9cefff3e-1900-0000-1cb0-a26729090000 pid=2345 /usr/bin/chattr guuid=f5479c20-1900-0000-1cb0-a267f1080000 pid=2289->guuid=9cefff3e-1900-0000-1cb0-a26729090000 pid=2345 execve guuid=cd20a73f-1900-0000-1cb0-a2672a090000 pid=2346 /usr/bin/chattr guuid=f5479c20-1900-0000-1cb0-a267f1080000 pid=2289->guuid=cd20a73f-1900-0000-1cb0-a2672a090000 pid=2346 execve guuid=47bc4f40-1900-0000-1cb0-a2672b090000 pid=2347 /usr/bin/chattr guuid=f5479c20-1900-0000-1cb0-a267f1080000 pid=2289->guuid=47bc4f40-1900-0000-1cb0-a2672b090000 pid=2347 execve guuid=435ccb40-1900-0000-1cb0-a2672d090000 pid=2349 /usr/bin/chattr guuid=f5479c20-1900-0000-1cb0-a267f1080000 pid=2289->guuid=435ccb40-1900-0000-1cb0-a2672d090000 pid=2349 execve guuid=b7554541-1900-0000-1cb0-a2672f090000 pid=2351 /usr/bin/bash guuid=f5479c20-1900-0000-1cb0-a267f1080000 pid=2289->guuid=b7554541-1900-0000-1cb0-a2672f090000 pid=2351 clone guuid=ca064e41-1900-0000-1cb0-a26730090000 pid=2352 /usr/bin/bash guuid=f5479c20-1900-0000-1cb0-a267f1080000 pid=2289->guuid=ca064e41-1900-0000-1cb0-a26730090000 pid=2352 clone guuid=6b81bb41-1900-0000-1cb0-a26732090000 pid=2354 /usr/bin/curl net send-data guuid=f5479c20-1900-0000-1cb0-a267f1080000 pid=2289->guuid=6b81bb41-1900-0000-1cb0-a26732090000 pid=2354 execve guuid=88f0c541-1900-0000-1cb0-a26733090000 pid=2355 /usr/bin/dash guuid=f5479c20-1900-0000-1cb0-a267f1080000 pid=2289->guuid=88f0c541-1900-0000-1cb0-a26733090000 pid=2355 execve guuid=7a99b94d-1900-0000-1cb0-a26742090000 pid=2370 /usr/bin/bash guuid=f5479c20-1900-0000-1cb0-a267f1080000 pid=2289->guuid=7a99b94d-1900-0000-1cb0-a26742090000 pid=2370 clone guuid=1d94c44d-1900-0000-1cb0-a26743090000 pid=2371 /usr/bin/base64 guuid=f5479c20-1900-0000-1cb0-a267f1080000 pid=2289->guuid=1d94c44d-1900-0000-1cb0-a26743090000 pid=2371 execve guuid=6c73d14d-1900-0000-1cb0-a26744090000 pid=2372 /usr/bin/tee write-file guuid=f5479c20-1900-0000-1cb0-a267f1080000 pid=2289->guuid=6c73d14d-1900-0000-1cb0-a26744090000 pid=2372 execve guuid=0222c84f-1900-0000-1cb0-a26746090000 pid=2374 /usr/bin/bash guuid=f5479c20-1900-0000-1cb0-a267f1080000 pid=2289->guuid=0222c84f-1900-0000-1cb0-a26746090000 pid=2374 execve guuid=a1671863-1900-0000-1cb0-a2677a090000 pid=2426 /usr/bin/bash guuid=f5479c20-1900-0000-1cb0-a267f1080000 pid=2289->guuid=a1671863-1900-0000-1cb0-a2677a090000 pid=2426 execve guuid=8b5d3164-1900-0000-1cb0-a2677b090000 pid=2427 /usr/bin/rm delete-file guuid=f5479c20-1900-0000-1cb0-a267f1080000 pid=2289->guuid=8b5d3164-1900-0000-1cb0-a2677b090000 pid=2427 execve guuid=2ee3a665-1900-0000-1cb0-a2677d090000 pid=2429 /usr/bin/rm guuid=f5479c20-1900-0000-1cb0-a267f1080000 pid=2289->guuid=2ee3a665-1900-0000-1cb0-a2677d090000 pid=2429 execve guuid=86065c66-1900-0000-1cb0-a2677f090000 pid=2431 /usr/bin/curl net send-data guuid=f5479c20-1900-0000-1cb0-a267f1080000 pid=2289->guuid=86065c66-1900-0000-1cb0-a2677f090000 pid=2431 execve guuid=28686966-1900-0000-1cb0-a26780090000 pid=2432 /usr/bin/dash guuid=f5479c20-1900-0000-1cb0-a267f1080000 pid=2289->guuid=28686966-1900-0000-1cb0-a26780090000 pid=2432 execve 124ee36c-bdbd-5d46-bbb1-b2cd81367f04 160.119.69.4:80 guuid=6b81bb41-1900-0000-1cb0-a26732090000 pid=2354->124ee36c-bdbd-5d46-bbb1-b2cd81367f04 send: 93B guuid=97f29951-1900-0000-1cb0-a2674a090000 pid=2378 /usr/bin/bash guuid=0222c84f-1900-0000-1cb0-a26746090000 pid=2374->guuid=97f29951-1900-0000-1cb0-a2674a090000 pid=2378 clone guuid=1184d951-1900-0000-1cb0-a2674c090000 pid=2380 /usr/bin/bash guuid=0222c84f-1900-0000-1cb0-a26746090000 pid=2374->guuid=1184d951-1900-0000-1cb0-a2674c090000 pid=2380 clone guuid=bfc49652-1900-0000-1cb0-a2674f090000 pid=2383 /usr/bin/ls guuid=0222c84f-1900-0000-1cb0-a26746090000 pid=2374->guuid=bfc49652-1900-0000-1cb0-a2674f090000 pid=2383 execve guuid=0d505554-1900-0000-1cb0-a26754090000 pid=2388 /usr/bin/cat guuid=0222c84f-1900-0000-1cb0-a26746090000 pid=2374->guuid=0d505554-1900-0000-1cb0-a26754090000 pid=2388 execve guuid=76824355-1900-0000-1cb0-a26756090000 pid=2390 /usr/bin/ls guuid=0222c84f-1900-0000-1cb0-a26746090000 pid=2374->guuid=76824355-1900-0000-1cb0-a26756090000 pid=2390 execve guuid=1345fe56-1900-0000-1cb0-a26758090000 pid=2392 /usr/bin/mkdir guuid=0222c84f-1900-0000-1cb0-a26746090000 pid=2374->guuid=1345fe56-1900-0000-1cb0-a26758090000 pid=2392 execve guuid=2f9e0d58-1900-0000-1cb0-a26759090000 pid=2393 /usr/bin/mv guuid=0222c84f-1900-0000-1cb0-a26746090000 pid=2374->guuid=2f9e0d58-1900-0000-1cb0-a26759090000 pid=2393 execve guuid=ce3b2859-1900-0000-1cb0-a2675d090000 pid=2397 /usr/bin/bash guuid=0222c84f-1900-0000-1cb0-a26746090000 pid=2374->guuid=ce3b2859-1900-0000-1cb0-a2675d090000 pid=2397 clone guuid=373e3759-1900-0000-1cb0-a2675e090000 pid=2398 /usr/bin/base64 write-file guuid=0222c84f-1900-0000-1cb0-a26746090000 pid=2374->guuid=373e3759-1900-0000-1cb0-a2675e090000 pid=2398 execve guuid=3935775a-1900-0000-1cb0-a26761090000 pid=2401 /usr/bin/rm delete-file guuid=0222c84f-1900-0000-1cb0-a26746090000 pid=2374->guuid=3935775a-1900-0000-1cb0-a26761090000 pid=2401 execve guuid=7d1b625b-1900-0000-1cb0-a26764090000 pid=2404 /usr/bin/mv guuid=0222c84f-1900-0000-1cb0-a26746090000 pid=2374->guuid=7d1b625b-1900-0000-1cb0-a26764090000 pid=2404 execve guuid=516bfd5c-1900-0000-1cb0-a26768090000 pid=2408 /usr/bin/ls guuid=0222c84f-1900-0000-1cb0-a26746090000 pid=2374->guuid=516bfd5c-1900-0000-1cb0-a26768090000 pid=2408 execve guuid=7535085e-1900-0000-1cb0-a2676b090000 pid=2411 /usr/bin/bash guuid=0222c84f-1900-0000-1cb0-a26746090000 pid=2374->guuid=7535085e-1900-0000-1cb0-a2676b090000 pid=2411 clone guuid=d174125e-1900-0000-1cb0-a2676c090000 pid=2412 /usr/bin/base64 write-file guuid=0222c84f-1900-0000-1cb0-a26746090000 pid=2374->guuid=d174125e-1900-0000-1cb0-a2676c090000 pid=2412 execve guuid=eb9d995f-1900-0000-1cb0-a26770090000 pid=2416 /usr/bin/ls guuid=0222c84f-1900-0000-1cb0-a26746090000 pid=2374->guuid=eb9d995f-1900-0000-1cb0-a26770090000 pid=2416 execve guuid=71de1161-1900-0000-1cb0-a26774090000 pid=2420 /usr/bin/cat guuid=0222c84f-1900-0000-1cb0-a26746090000 pid=2374->guuid=71de1161-1900-0000-1cb0-a26774090000 pid=2420 execve guuid=f499d261-1900-0000-1cb0-a26777090000 pid=2423 /usr/bin/ls guuid=0222c84f-1900-0000-1cb0-a26746090000 pid=2374->guuid=f499d261-1900-0000-1cb0-a26777090000 pid=2423 execve guuid=86065c66-1900-0000-1cb0-a2677f090000 pid=2431->124ee36c-bdbd-5d46-bbb1-b2cd81367f04 send: 93B
Score:
82%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/ee0040d0a0bfc4dcc22b58f4316a4534696d0db69cbaa02b6aabbd41b117e58d
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ee0040d0a0bfc4dcc22b58f4316a4534696d0db69cbaa02b6aabbd41b117e58d/
Threat name:
Linux.Backdoor.WebShell
Create hunting rule
Status:
Malicious
First seen:
2026-08-24 14:33:21 UTC
File Type:
Text (Shell)
AV detection:
16 of 36 (44.44%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5yaebufax7cnzqrlld2dc2sfgruw2dnwts5kak3kvo6udmix4wgq._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260824-rwy9zazapa/
Behaviour
Reads runtime system information
Writes file to tmp directory
Deobfuscate/Decode Files or Information
Checks CPU configuration
File and Directory Permissions Modification
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.16
Link:
https://yomi.yoroi.company/submissions/ee0040d0a0bfc4dcc22b58f4316a4534696d0db69cbaa02b6aabbd41b117e58d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SUSP_LNX_Base64_Exec_Apr24
Create hunting rule
Author:Christian Burkard
Description:Detects suspicious base64 encoded shell commands (as seen in Palo Alto CVE-2024-3400 exploitation)
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh ee0040d0a0bfc4dcc22b58f4316a4534696d0db69cbaa02b6aabbd41b117e58d

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3884408/
  
Delivery method
Distributed via web download

Comments