MB-4f3bef1f95a022eaaaea086d9da59df0711908633918f724cf865802b698bf45
high
📛 Threat Title
Unknown: wr.php
Description
File type: sh. Size: 27042 bytes. Tags: sh. Reporter: abuse_ch. First seen: 2026-08-04 20:42:01.
Indicators of Compromise (3)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
hash_sha256
4f3bef1f95a022eaaaea086d9da59df0711908633918f724cf865802b698bf45
IOC database
- Type
- hash_sha256
- Value
4f3bef1f95a022eaaaea086d9da59df0711908633918f724cf865802b698bf45- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Unknown
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_sha1
227de81a473fa962ee5263f9950477dcfa380120
IOC database
- Type
- hash_sha1
- Value
227de81a473fa962ee5263f9950477dcfa380120- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_md5
3c950b5c9ccc4009ac37148eb4edcba8
IOC database
- Type
- hash_md5
- Value
3c950b5c9ccc4009ac37148eb4edcba8- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (1)
-
MalwareBazaar sample page
Abuse.ch
File type: sh. Size: 27042 bytes. Tags: sh. Reporter: abuse_ch. First seen: 2026-08-04 20:42:01.
Remediations (10)
-
web:cyrisk.com
CVE-2024-4577 is a severe argument injection vulnerability in PHP that can be exploited for Remote Code Execution (RCE). This flaw stems from errors in character encoding conversions, particularly the "Best-Fit" feature on Windows systems using Apache and PHP-CGI.
-
web:hacktricks.wiki
Remote File Inclusion (RFI): The file is loaded from a remote server (Best: You can write the code and the server will execute it). In php this is disabled...
-
web:rewterz.com
This vulnerability affects Windows systems running PHP in CGI mode and allows attackers to execute any code remotely, leading to full system control. Although it was patched in June 2024, attackers quickly began exploiting it, with proof-of-concept (PoC) code released a day after the patch.
-
web:tuxcare.com
Is your PHP application secure? Explore common PHP vulnerabilities, their risks, and the best practices to safeguard against attacks.
-
web:www.aha.org
The vulnerability is actually a recurrence of an argument injection bug that was patched more than a decade ago. In 2012, while implementing PHP, an overlooked Best-Fit feature of encoding conversion within the Windows operating system allowed unauthenticated attackers to bypass the previous protecton of CVE-2012-1823 by specific character sequences.
-
web:www.bleepingcomputer.com
Threat intelligence company GreyNoise warns that a critical PHP remote code execution vulnerability that impacts Windows systems is now under mass exploitation.
-
web:www.huntress.com
PHP Webshell typically infects systems through vulnerabilities in web applications, weak credentials, or by exploiting unpatched software. Attackers often use phishing emails or compromised websites to deliver the malware.
-
web:www.securityweek.com
GreyNoise warns of mass exploitation of critical vulnerability (CVE-2024-4577) in PHP leading to remote code execution on vulnerable servers.
-
web:www.wiz.io
Detect and mitigate CVE-2024-4577, a critical remote code execution vulnerability in PHP CGI. Organizations are advised to patch urgently.
-
web:www.zend.com
Find an expert overview of common PHP vulnerabilities, including how vulnerabilities are scored, how they are disclosed to the community, and mitigation steps.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.