MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f0cc2f4f5fc888962a19f4ee32d31404969749a35d8ec963b5a68db99993a4d0. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 5


Intelligence 5 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f0cc2f4f5fc888962a19f4ee32d31404969749a35d8ec963b5a68db99993a4d0
SHA3-384 hash: 33710b9407206fd95ea608c8aad21936f4624ed02fe39acbcf658fab603eae20db728482600684fb7c3b551d58417e99
SHA1 hash: 690a74cbb4f4a3d7314c26938316f150c49ad362
MD5 hash: 261007d0a10140ec6c5ebd6fdf084076
humanhash: stream-table-montana-happy
File name:wr.php
Download: download sample
File size:27'042 bytes
First seen:2026-08-17 14:10:46 UTC
Last seen:Never
File type: sh
MIME type:text/x-shellscript
ssdeep 768:+8vCB+25j6es8RO9FYpMSUpi+20qUpi+20YQX:+8l25Jod2QX
TLSH T170C27D956A867C44BEC98B3E4CBD2B1D6DF5C3D1324942AC3D8A3C719C11FACD618B1A
TrID 70.0% (.SH) Linux/UNIX shell script (7000/1)
30.0% (.) Unix-like shebang (var.3) (gen) (3000/1)
Magika shell
Reporter abuse_ch
Tags:sh
URLMalware sample (SHA256 hash)SignatureTags
http://160.119.69.4/z/post/noroot.phpn/an/aelf ua-wget

Intelligence

File Origin
# of uploads :
1
# of downloads :
65
Origin country :
DE DE
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.Linux.DownLoader.2862.24940.5189.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive masquerade
Link:
https://www.filescan.io/uploads/6a8316866e3d05c31e8e8e8e/reports/3907a63f-8477-4dd7-acf6-5bc47d0fd5ce/overview
Status:
terminated
Link:
https://sandbox.kunai.rocks/analysis/43b737c6-5839-48d3-8dcc-e3354f6b0cca
Behavior Graph:
Download SVG
%3 guuid=cc42eea2-1700-0000-678d-b9e1c60a0000 pid=2758 /usr/bin/sudo guuid=8d3eaba4-1700-0000-678d-b9e1cd0a0000 pid=2765 /tmp/sample.bin guuid=cc42eea2-1700-0000-678d-b9e1c60a0000 pid=2758->guuid=8d3eaba4-1700-0000-678d-b9e1cd0a0000 pid=2765 execve guuid=9b8145a5-1700-0000-678d-b9e1d00a0000 pid=2768 /usr/bin/bash guuid=8d3eaba4-1700-0000-678d-b9e1cd0a0000 pid=2765->guuid=9b8145a5-1700-0000-678d-b9e1d00a0000 pid=2768 clone guuid=c08470a5-1700-0000-678d-b9e1d20a0000 pid=2770 /usr/bin/base64 guuid=8d3eaba4-1700-0000-678d-b9e1cd0a0000 pid=2765->guuid=c08470a5-1700-0000-678d-b9e1d20a0000 pid=2770 execve guuid=6ce37fa5-1700-0000-678d-b9e1d30a0000 pid=2771 /usr/bin/bash guuid=8d3eaba4-1700-0000-678d-b9e1cd0a0000 pid=2765->guuid=6ce37fa5-1700-0000-678d-b9e1d30a0000 pid=2771 clone guuid=af98fea5-1700-0000-678d-b9e1d60a0000 pid=2774 /usr/bin/cp guuid=8d3eaba4-1700-0000-678d-b9e1cd0a0000 pid=2765->guuid=af98fea5-1700-0000-678d-b9e1d60a0000 pid=2774 execve guuid=f2ca5fa6-1700-0000-678d-b9e1d80a0000 pid=2776 /usr/bin/mkdir guuid=8d3eaba4-1700-0000-678d-b9e1cd0a0000 pid=2765->guuid=f2ca5fa6-1700-0000-678d-b9e1d80a0000 pid=2776 execve guuid=dfeec0a6-1700-0000-678d-b9e1da0a0000 pid=2778 /usr/bin/mkdir guuid=8d3eaba4-1700-0000-678d-b9e1cd0a0000 pid=2765->guuid=dfeec0a6-1700-0000-678d-b9e1da0a0000 pid=2778 execve guuid=330f17a7-1700-0000-678d-b9e1dc0a0000 pid=2780 /usr/bin/mkdir guuid=8d3eaba4-1700-0000-678d-b9e1cd0a0000 pid=2765->guuid=330f17a7-1700-0000-678d-b9e1dc0a0000 pid=2780 execve guuid=bda170a7-1700-0000-678d-b9e1e00a0000 pid=2784 /usr/bin/mkdir guuid=8d3eaba4-1700-0000-678d-b9e1cd0a0000 pid=2765->guuid=bda170a7-1700-0000-678d-b9e1e00a0000 pid=2784 execve guuid=b0d9d3a7-1700-0000-678d-b9e1e10a0000 pid=2785 /usr/bin/mkdir guuid=8d3eaba4-1700-0000-678d-b9e1cd0a0000 pid=2765->guuid=b0d9d3a7-1700-0000-678d-b9e1e10a0000 pid=2785 execve guuid=915b2ea8-1700-0000-678d-b9e1e20a0000 pid=2786 /usr/bin/mkdir guuid=8d3eaba4-1700-0000-678d-b9e1cd0a0000 pid=2765->guuid=915b2ea8-1700-0000-678d-b9e1e20a0000 pid=2786 execve guuid=822b7ca8-1700-0000-678d-b9e1e40a0000 pid=2788 /usr/bin/mkdir guuid=8d3eaba4-1700-0000-678d-b9e1cd0a0000 pid=2765->guuid=822b7ca8-1700-0000-678d-b9e1e40a0000 pid=2788 execve guuid=4a63c8a8-1700-0000-678d-b9e1e60a0000 pid=2790 /usr/bin/mkdir guuid=8d3eaba4-1700-0000-678d-b9e1cd0a0000 pid=2765->guuid=4a63c8a8-1700-0000-678d-b9e1e60a0000 pid=2790 execve guuid=e69919a9-1700-0000-678d-b9e1e80a0000 pid=2792 /usr/bin/mkdir guuid=8d3eaba4-1700-0000-678d-b9e1cd0a0000 pid=2765->guuid=e69919a9-1700-0000-678d-b9e1e80a0000 pid=2792 execve guuid=6d8365a9-1700-0000-678d-b9e1ea0a0000 pid=2794 /usr/bin/cp guuid=8d3eaba4-1700-0000-678d-b9e1cd0a0000 pid=2765->guuid=6d8365a9-1700-0000-678d-b9e1ea0a0000 pid=2794 execve guuid=82a8c5a9-1700-0000-678d-b9e1ec0a0000 pid=2796 /usr/bin/cp guuid=8d3eaba4-1700-0000-678d-b9e1cd0a0000 pid=2765->guuid=82a8c5a9-1700-0000-678d-b9e1ec0a0000 pid=2796 execve guuid=3b062aaa-1700-0000-678d-b9e1ee0a0000 pid=2798 /usr/bin/cp guuid=8d3eaba4-1700-0000-678d-b9e1cd0a0000 pid=2765->guuid=3b062aaa-1700-0000-678d-b9e1ee0a0000 pid=2798 execve guuid=06a087aa-1700-0000-678d-b9e1f00a0000 pid=2800 /usr/bin/cp guuid=8d3eaba4-1700-0000-678d-b9e1cd0a0000 pid=2765->guuid=06a087aa-1700-0000-678d-b9e1f00a0000 pid=2800 execve guuid=c2bcf1aa-1700-0000-678d-b9e1f10a0000 pid=2801 /usr/bin/cp guuid=8d3eaba4-1700-0000-678d-b9e1cd0a0000 pid=2765->guuid=c2bcf1aa-1700-0000-678d-b9e1f10a0000 pid=2801 execve guuid=a8874dab-1700-0000-678d-b9e1f30a0000 pid=2803 /usr/bin/cp guuid=8d3eaba4-1700-0000-678d-b9e1cd0a0000 pid=2765->guuid=a8874dab-1700-0000-678d-b9e1f30a0000 pid=2803 execve guuid=e01ec1ab-1700-0000-678d-b9e1f60a0000 pid=2806 /usr/bin/cp guuid=8d3eaba4-1700-0000-678d-b9e1cd0a0000 pid=2765->guuid=e01ec1ab-1700-0000-678d-b9e1f60a0000 pid=2806 execve guuid=2f3632ac-1700-0000-678d-b9e1f80a0000 pid=2808 /usr/bin/cp guuid=8d3eaba4-1700-0000-678d-b9e1cd0a0000 pid=2765->guuid=2f3632ac-1700-0000-678d-b9e1f80a0000 pid=2808 execve guuid=56898bac-1700-0000-678d-b9e1fb0a0000 pid=2811 /usr/bin/cp guuid=8d3eaba4-1700-0000-678d-b9e1cd0a0000 pid=2765->guuid=56898bac-1700-0000-678d-b9e1fb0a0000 pid=2811 execve guuid=0b4df4ac-1700-0000-678d-b9e1fd0a0000 pid=2813 /usr/bin/cp guuid=8d3eaba4-1700-0000-678d-b9e1cd0a0000 pid=2765->guuid=0b4df4ac-1700-0000-678d-b9e1fd0a0000 pid=2813 execve guuid=605950ad-1700-0000-678d-b9e1fe0a0000 pid=2814 /usr/bin/cp guuid=8d3eaba4-1700-0000-678d-b9e1cd0a0000 pid=2765->guuid=605950ad-1700-0000-678d-b9e1fe0a0000 pid=2814 execve guuid=c17300ae-1700-0000-678d-b9e1010b0000 pid=2817 /usr/bin/cp guuid=8d3eaba4-1700-0000-678d-b9e1cd0a0000 pid=2765->guuid=c17300ae-1700-0000-678d-b9e1010b0000 pid=2817 execve guuid=495a50ae-1700-0000-678d-b9e1040b0000 pid=2820 /usr/bin/cp guuid=8d3eaba4-1700-0000-678d-b9e1cd0a0000 pid=2765->guuid=495a50ae-1700-0000-678d-b9e1040b0000 pid=2820 execve guuid=92869fae-1700-0000-678d-b9e1060b0000 pid=2822 /usr/bin/cp guuid=8d3eaba4-1700-0000-678d-b9e1cd0a0000 pid=2765->guuid=92869fae-1700-0000-678d-b9e1060b0000 pid=2822 execve guuid=3382ffae-1700-0000-678d-b9e1080b0000 pid=2824 /usr/bin/touch guuid=8d3eaba4-1700-0000-678d-b9e1cd0a0000 pid=2765->guuid=3382ffae-1700-0000-678d-b9e1080b0000 pid=2824 execve guuid=11a070af-1700-0000-678d-b9e10b0b0000 pid=2827 /usr/bin/chmod guuid=8d3eaba4-1700-0000-678d-b9e1cd0a0000 pid=2765->guuid=11a070af-1700-0000-678d-b9e10b0b0000 pid=2827 execve guuid=727dbcaf-1700-0000-678d-b9e10d0b0000 pid=2829 /usr/bin/chmod guuid=8d3eaba4-1700-0000-678d-b9e1cd0a0000 pid=2765->guuid=727dbcaf-1700-0000-678d-b9e10d0b0000 pid=2829 execve guuid=e39206b0-1700-0000-678d-b9e10f0b0000 pid=2831 /usr/bin/chattr guuid=8d3eaba4-1700-0000-678d-b9e1cd0a0000 pid=2765->guuid=e39206b0-1700-0000-678d-b9e10f0b0000 pid=2831 execve guuid=ae6c7bb0-1700-0000-678d-b9e1100b0000 pid=2832 /usr/bin/chattr guuid=8d3eaba4-1700-0000-678d-b9e1cd0a0000 pid=2765->guuid=ae6c7bb0-1700-0000-678d-b9e1100b0000 pid=2832 execve guuid=b5c3f0b0-1700-0000-678d-b9e1110b0000 pid=2833 /usr/bin/chattr guuid=8d3eaba4-1700-0000-678d-b9e1cd0a0000 pid=2765->guuid=b5c3f0b0-1700-0000-678d-b9e1110b0000 pid=2833 execve guuid=3b6451b1-1700-0000-678d-b9e1120b0000 pid=2834 /usr/bin/chattr guuid=8d3eaba4-1700-0000-678d-b9e1cd0a0000 pid=2765->guuid=3b6451b1-1700-0000-678d-b9e1120b0000 pid=2834 execve guuid=7d0be9b1-1700-0000-678d-b9e1130b0000 pid=2835 /usr/bin/chattr guuid=8d3eaba4-1700-0000-678d-b9e1cd0a0000 pid=2765->guuid=7d0be9b1-1700-0000-678d-b9e1130b0000 pid=2835 execve guuid=f48848b2-1700-0000-678d-b9e1140b0000 pid=2836 /usr/bin/chattr guuid=8d3eaba4-1700-0000-678d-b9e1cd0a0000 pid=2765->guuid=f48848b2-1700-0000-678d-b9e1140b0000 pid=2836 execve guuid=09c7aab2-1700-0000-678d-b9e1150b0000 pid=2837 /usr/bin/chattr guuid=8d3eaba4-1700-0000-678d-b9e1cd0a0000 pid=2765->guuid=09c7aab2-1700-0000-678d-b9e1150b0000 pid=2837 execve guuid=754d06b3-1700-0000-678d-b9e1160b0000 pid=2838 /usr/bin/chattr guuid=8d3eaba4-1700-0000-678d-b9e1cd0a0000 pid=2765->guuid=754d06b3-1700-0000-678d-b9e1160b0000 pid=2838 execve guuid=b4f46cb3-1700-0000-678d-b9e1170b0000 pid=2839 /usr/bin/bash guuid=8d3eaba4-1700-0000-678d-b9e1cd0a0000 pid=2765->guuid=b4f46cb3-1700-0000-678d-b9e1170b0000 pid=2839 clone guuid=aab27bb3-1700-0000-678d-b9e1180b0000 pid=2840 /usr/bin/bash guuid=8d3eaba4-1700-0000-678d-b9e1cd0a0000 pid=2765->guuid=aab27bb3-1700-0000-678d-b9e1180b0000 pid=2840 clone guuid=67161ab4-1700-0000-678d-b9e11a0b0000 pid=2842 /usr/bin/curl net send-data guuid=8d3eaba4-1700-0000-678d-b9e1cd0a0000 pid=2765->guuid=67161ab4-1700-0000-678d-b9e11a0b0000 pid=2842 execve guuid=f45820b4-1700-0000-678d-b9e11b0b0000 pid=2843 /usr/bin/dash guuid=8d3eaba4-1700-0000-678d-b9e1cd0a0000 pid=2765->guuid=f45820b4-1700-0000-678d-b9e11b0b0000 pid=2843 execve guuid=5d2d33be-1700-0000-678d-b9e12b0b0000 pid=2859 /usr/bin/bash guuid=8d3eaba4-1700-0000-678d-b9e1cd0a0000 pid=2765->guuid=5d2d33be-1700-0000-678d-b9e12b0b0000 pid=2859 clone guuid=920b3bbe-1700-0000-678d-b9e12c0b0000 pid=2860 /usr/bin/base64 guuid=8d3eaba4-1700-0000-678d-b9e1cd0a0000 pid=2765->guuid=920b3bbe-1700-0000-678d-b9e12c0b0000 pid=2860 execve guuid=880142be-1700-0000-678d-b9e12d0b0000 pid=2861 /usr/bin/tee write-file guuid=8d3eaba4-1700-0000-678d-b9e1cd0a0000 pid=2765->guuid=880142be-1700-0000-678d-b9e12d0b0000 pid=2861 execve guuid=d87dedbe-1700-0000-678d-b9e1310b0000 pid=2865 /usr/bin/bash guuid=8d3eaba4-1700-0000-678d-b9e1cd0a0000 pid=2765->guuid=d87dedbe-1700-0000-678d-b9e1310b0000 pid=2865 execve guuid=a61134c8-1700-0000-678d-b9e1550b0000 pid=2901 /usr/bin/bash guuid=8d3eaba4-1700-0000-678d-b9e1cd0a0000 pid=2765->guuid=a61134c8-1700-0000-678d-b9e1550b0000 pid=2901 execve guuid=2d2c19c9-1700-0000-678d-b9e1580b0000 pid=2904 /usr/bin/rm delete-file guuid=8d3eaba4-1700-0000-678d-b9e1cd0a0000 pid=2765->guuid=2d2c19c9-1700-0000-678d-b9e1580b0000 pid=2904 execve guuid=d81d99c9-1700-0000-678d-b9e15a0b0000 pid=2906 /usr/bin/rm guuid=8d3eaba4-1700-0000-678d-b9e1cd0a0000 pid=2765->guuid=d81d99c9-1700-0000-678d-b9e15a0b0000 pid=2906 execve guuid=eeec1aca-1700-0000-678d-b9e15b0b0000 pid=2907 /usr/bin/curl net send-data guuid=8d3eaba4-1700-0000-678d-b9e1cd0a0000 pid=2765->guuid=eeec1aca-1700-0000-678d-b9e15b0b0000 pid=2907 execve guuid=58262aca-1700-0000-678d-b9e15c0b0000 pid=2908 /usr/bin/dash guuid=8d3eaba4-1700-0000-678d-b9e1cd0a0000 pid=2765->guuid=58262aca-1700-0000-678d-b9e15c0b0000 pid=2908 execve 124ee36c-bdbd-5d46-bbb1-b2cd81367f04 160.119.69.4:80 guuid=67161ab4-1700-0000-678d-b9e11a0b0000 pid=2842->124ee36c-bdbd-5d46-bbb1-b2cd81367f04 send: 93B guuid=c5e14abf-1700-0000-678d-b9e1320b0000 pid=2866 /usr/bin/bash guuid=d87dedbe-1700-0000-678d-b9e1310b0000 pid=2865->guuid=c5e14abf-1700-0000-678d-b9e1320b0000 pid=2866 clone guuid=c00851bf-1700-0000-678d-b9e1330b0000 pid=2867 /usr/bin/bash guuid=d87dedbe-1700-0000-678d-b9e1310b0000 pid=2865->guuid=c00851bf-1700-0000-678d-b9e1330b0000 pid=2867 clone guuid=87347cbf-1700-0000-678d-b9e1350b0000 pid=2869 /usr/bin/ls guuid=d87dedbe-1700-0000-678d-b9e1310b0000 pid=2865->guuid=87347cbf-1700-0000-678d-b9e1350b0000 pid=2869 execve guuid=28daf8bf-1700-0000-678d-b9e1370b0000 pid=2871 /usr/bin/cat guuid=d87dedbe-1700-0000-678d-b9e1310b0000 pid=2865->guuid=28daf8bf-1700-0000-678d-b9e1370b0000 pid=2871 execve guuid=c0ff50c0-1700-0000-678d-b9e1380b0000 pid=2872 /usr/bin/ls guuid=d87dedbe-1700-0000-678d-b9e1310b0000 pid=2865->guuid=c0ff50c0-1700-0000-678d-b9e1380b0000 pid=2872 execve guuid=bb93f0c0-1700-0000-678d-b9e1390b0000 pid=2873 /usr/bin/mkdir guuid=d87dedbe-1700-0000-678d-b9e1310b0000 pid=2865->guuid=bb93f0c0-1700-0000-678d-b9e1390b0000 pid=2873 execve guuid=9a5f89c1-1700-0000-678d-b9e13b0b0000 pid=2875 /usr/bin/mv guuid=d87dedbe-1700-0000-678d-b9e1310b0000 pid=2865->guuid=9a5f89c1-1700-0000-678d-b9e13b0b0000 pid=2875 execve guuid=64f477c2-1700-0000-678d-b9e13e0b0000 pid=2878 /usr/bin/bash guuid=d87dedbe-1700-0000-678d-b9e1310b0000 pid=2865->guuid=64f477c2-1700-0000-678d-b9e13e0b0000 pid=2878 clone guuid=b0a282c2-1700-0000-678d-b9e13f0b0000 pid=2879 /usr/bin/base64 write-file guuid=d87dedbe-1700-0000-678d-b9e1310b0000 pid=2865->guuid=b0a282c2-1700-0000-678d-b9e13f0b0000 pid=2879 execve guuid=d2c0eac2-1700-0000-678d-b9e1410b0000 pid=2881 /usr/bin/rm delete-file guuid=d87dedbe-1700-0000-678d-b9e1310b0000 pid=2865->guuid=d2c0eac2-1700-0000-678d-b9e1410b0000 pid=2881 execve guuid=3d8479c3-1700-0000-678d-b9e1440b0000 pid=2884 /usr/bin/mv guuid=d87dedbe-1700-0000-678d-b9e1310b0000 pid=2865->guuid=3d8479c3-1700-0000-678d-b9e1440b0000 pid=2884 execve guuid=a4a86bc4-1700-0000-678d-b9e1470b0000 pid=2887 /usr/bin/ls guuid=d87dedbe-1700-0000-678d-b9e1310b0000 pid=2865->guuid=a4a86bc4-1700-0000-678d-b9e1470b0000 pid=2887 execve guuid=a30641c5-1700-0000-678d-b9e1490b0000 pid=2889 /usr/bin/bash guuid=d87dedbe-1700-0000-678d-b9e1310b0000 pid=2865->guuid=a30641c5-1700-0000-678d-b9e1490b0000 pid=2889 clone guuid=97004dc5-1700-0000-678d-b9e14b0b0000 pid=2891 /usr/bin/base64 write-file guuid=d87dedbe-1700-0000-678d-b9e1310b0000 pid=2865->guuid=97004dc5-1700-0000-678d-b9e14b0b0000 pid=2891 execve guuid=966cd5c5-1700-0000-678d-b9e14c0b0000 pid=2892 /usr/bin/ls guuid=d87dedbe-1700-0000-678d-b9e1310b0000 pid=2865->guuid=966cd5c5-1700-0000-678d-b9e14c0b0000 pid=2892 execve guuid=ff50bbc6-1700-0000-678d-b9e14e0b0000 pid=2894 /usr/bin/cat guuid=d87dedbe-1700-0000-678d-b9e1310b0000 pid=2865->guuid=ff50bbc6-1700-0000-678d-b9e14e0b0000 pid=2894 execve guuid=924339c7-1700-0000-678d-b9e1510b0000 pid=2897 /usr/bin/ls guuid=d87dedbe-1700-0000-678d-b9e1310b0000 pid=2865->guuid=924339c7-1700-0000-678d-b9e1510b0000 pid=2897 execve guuid=eeec1aca-1700-0000-678d-b9e15b0b0000 pid=2907->124ee36c-bdbd-5d46-bbb1-b2cd81367f04 send: 93B
Score:
81%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/f0cc2f4f5fc888962a19f4ee32d31404969749a35d8ec963b5a68db99993a4d0
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/f0cc2f4f5fc888962a19f4ee32d31404969749a35d8ec963b5a68db99993a4d0/
Threat name:
Linux.Backdoor.WebShell
Create hunting rule
Status:
Malicious
First seen:
2026-08-17 14:11:21 UTC
File Type:
Text (Shell)
AV detection:
16 of 36 (44.44%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=6dgc6t27zcejmkqz6txdfuyuasljosndlwhmsy5vu2g3tgmtutia._file
Result
Malware family:
n/a
Score:
  7/10
Tags:
antivm defense_evasion discovery linux
Link:
https://tria.ge/reports/260817-rhblrasyhs/
Behaviour
Reads runtime system information
Writes file to tmp directory
Deobfuscate/Decode Files or Information
Checks CPU configuration
File and Directory Permissions Modification
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.16
Link:
https://yomi.yoroi.company/submissions/f0cc2f4f5fc888962a19f4ee32d31404969749a35d8ec963b5a68db99993a4d0

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SUSP_LNX_Base64_Exec_Apr24
Create hunting rule
Author:Christian Burkard
Description:Detects suspicious base64 encoded shell commands (as seen in Palo Alto CVE-2024-3400 exploitation)
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

sh f0cc2f4f5fc888962a19f4ee32d31404969749a35d8ec963b5a68db99993a4d0

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3884409/
  
Delivery method
Distributed via web download

Comments