s2
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

MB-b437a764869ac93e13448746c789757541d6ab3675592ceca3315d6ec1ef8086 high

📛 Threat Title

Unknown: k.php

Category: Unknown Published: Source updated: First seen: Last updated: Source: Abuse.ch

Description

File type: sh. Size: 45534 bytes. Tags: sh. Reporter: abuse_ch. First seen: 2026-05-14 18:48:35.

Indicators of Compromise (4)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

domain k.php VT: VT base fetch failed: HTTPError: 429 Too Many Requests for domains/k.php

IOC database

Type
domain
Value
k.php
First seen
Last seen
Attached to this threat
Appears in
14 threats
Description
Extracted from Threat MB-8cbc78702771f69eb7942d6476a214673d8f36ae1055d6610af0c48137af30c0

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

VirusTotal: VT base fetch failed: HTTPError: 429 Too Many Requests for domains/k.php

hash_sha256 b437a764869ac93e13448746c789757541d6ab3675592ceca3315d6ec1ef8086 VT: VT base fetch failed: HTTPError: 429 Too Many Requests for files/b437a764869ac93e13448746c789757541d6ab3675592ceca3315d6ec1ef8086
1 feed

IOC database

Type
hash_sha256
Value
b437a764869ac93e13448746c789757541d6ab3675592ceca3315d6ec1ef8086
First seen
Last seen
Attached to this threat
Appears in
2 threats
Description
Unknown

Open the full IOC page →

Threat Hunt — feed corroboration

Listed by 1 threat-intel feed vendor: Abuse.ch. Open in Threat Hunt →

Details From VirusTotal

VirusTotal: VT base fetch failed: HTTPError: 429 Too Many Requests for files/b437a764869ac93e13448746c789757541d6ab3675592ceca3315d6ec1ef8086

hash_sha1 2bfbc6a7d0ed5c0cc24c01d613cb4f535d67bf7b VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/files/2bfbc6a7d0ed5c0cc24c01d613cb4f535d67bf7b
1 feed

IOC database

Type
hash_sha1
Value
2bfbc6a7d0ed5c0cc24c01d613cb4f535d67bf7b
First seen
Last seen
Attached to this threat
Appears in
2 threats

Open the full IOC page →

Threat Hunt — feed corroboration

Listed by 1 threat-intel feed vendor: Abuse.ch. Open in Threat Hunt →

Details From VirusTotal

VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/files/2bfbc6a7d0ed5c0cc24c01d613cb4f535d67bf7b

hash_md5 5432c30b2b6671b20f8ce0010bd8c255 VT 23 / 75 1 feed

IOC database

Type
hash_md5
Value
5432c30b2b6671b20f8ce0010bd8c255
First seen
Last seen
Attached to this threat
Appears in
2 threats

Open the full IOC page →

Threat Hunt — feed corroboration

Listed by 1 threat-intel feed vendor: Abuse.ch. Open in Threat Hunt →

Flagged by 23 of 75 VirusTotal vendors

VendorVerdictDetection
alibabacloud malicious Trojan[downloader]:Linux/Malgent.SS#2XGB
Avast malicious BV:Agent-CEL [Trj]
AVG malicious BV:Agent-CEL [Trj]
Avira malicious TR/BAT.Agent.CEL
CTX malicious shell.trojan.bash
Cynet malicious Malicious (score: 99)
ESET-NOD32 malicious Linux/Agent.AOF trojan
F-Secure malicious Trojan.TR/BAT.Agent.CEL
Fortinet malicious BASH/Agent.AOF!tr
Google malicious Detected
huorong malicious Backdoor/Linux.Agent.as
Kaspersky malicious HEUR:Trojan-Downloader.Shell.Agent.bc
Kingsoft malicious Win32.Troj.Undef.a
Lionic malicious Trojan.Script.Agent.a!c
McAfeeD malicious ti!B437A764869A
Microsoft malicious TrojanDownloader:Script/Malgent.STD!MSR
NANO-Antivirus malicious Trojan.Script.Dropper.kpvdnu
Rising malicious Trojan.Agent/BASH!1.13EDF (CLASSIC)
Skyhigh malicious Linux/Downloader.mu
Symantec malicious Trojan.Gen.MBT
Tencent malicious Trojan-DL.Linux.Agent.505004
TrellixENS malicious Linux/Downloader.mu
Varist malicious Unix/Agent.VA

Details From VirusTotal

Basic Properties
MD55432c30b2b6671b20f8ce0010bd8c255
SHA-12bfbc6a7d0ed5c0cc24c01d613cb4f535d67bf7b
SHA-256b437a764869ac93e13448746c789757541d6ab3675592ceca3315d6ec1ef8086
SSDEEP768:b1s9NyXsZztCQ9GKYpr9GKYp82fkR4nnA9GKYpr9GKYp82fkR4nnx:bKHusZQco
TLSHT170136C6526953C25AE99883B5C7F2F0CB9A983E1304491DDBFCA3CF18C15A9CE718B1D
File typeShell script
File type tagshell
File extensionsh
MagicBourne-Again shell script, ASCII text executable, with very long lines (17446u)
File size44.5 KB
History
First seen on VirusTotal2026-05-14 18:50 UTC
Last submission2026-05-14 18:50 UTC
Last analysis2026-05-15 00:03 UTC
Last modified on VirusTotal2026-05-15 19:27 UTC
Known Names
  • 29dcz.exe
  • _b437a764869ac93e13448746c789757541d6ab3675592ceca3315d6ec1ef8086.sh

References (1)

Remediations (10)

  • SCARA: A Semantics-Constrained Autonomous Remediation Agent for Opaque ...
    web:arxiv.org

    To address the four gaps identified above, this paper presents SCARA (Semantics-Constrained Autonomous Remedi-ation Agent), a four-stage framework organized around a tiered remediation model: Tier 1 mitigation (protocol and configuration protection policies), Tier 2 binary hardening (runtime guards via binary instrumentation), and Tier 3 source ...

  • K.php - a RestApps malicious script - FreePBX Community Forums
    web:community.freepbx.org

    If you were impacted by the restapps security regression a week or two ago, it is possible you were hit with a php script that is currently labeled " k.php " If you want to see if you were compromised by this script, I've included some content below that you can check. I do not claim to have identified everything, but I'm hoping this might help someone. Anyways, here are the places you ...

  • Mitigation Instructions for Addressing Outdated PHP - CyRisk
    web:cyrisk.com

    Addressing PHP Vulnerabilities in Common Technologies In the ever-evolving landscape of cybersecurity, keeping software up to date is crucial for maintaining the security and functionality of your systems. A common issue faced by many organizations is outdated PHP installations, which can leave systems vulnerable to security risks. This article provides remediation instructions for upgrading ...

  • PHP - CWE Remediation Guidance
    web:dipsylala.github.io

    Primary Defence: Use json_decode () for untrusted data deserialization instead of unserialize (). If you must use unserialize (), use allowed_classes as a last-resort mitigation (PHP 7.0+).

  • Experts warn of mass exploitation of critical PHP flaw CVE-2024-4577
    web:securityaffairs.com

    Last week, Cisco Talos researchers reported that an unknown threat actor has been exploiting the flaw since as early as January 2025, predominantly targeting organizations in Japan. Now, GreyNoise researches confirm the large scale exploitation of CVE-2024-4577 and warns that it is not limited to Japanese entities.

  • How to Fix PHP Vulnerabilities: A Step-by-Step Guide for Beginners - 8iSoft
    web:www.8isoft.com

    For a step-by-step guide on PHP remediation using 8iSoft YODA, don't miss our exclusive tutorial. Click here to watch the video and enhance your understanding of effective vulnerability management.

  • 9 PHP Vulnerability Examples & How To Fix Them - Net Solutions
    web:www.netsolutions.com

    In this blow, we discuss PHP vulnerabilities like SQL injection attacks, cross-site scripting, session hijacking and how to fix them.

  • Detecting and Removing PHP Webshells: Tools, Indicators & Real Case ...
    web:www.siteguarding.com

    Detecting and Removing PHP Webshells: Tools, Indicators & Real Case Studies Compromised PHP sites often hide webshells - small scripts that give attackers remote command execution, file management, database access, and persistence.

  • CVE-2026-40176 Mitigation Script - Command Injection in PHP Composer
    web:www.vicarius.io

    CVE-2026-40176 - Remediation Script for PHP Composer Command Injection Workaround. .DESCRIPTION This script implements a non-patch workaround to mitigate CVE-2026-40176, a command injection vulnerability in PHP Composer 's Perforce VCS driver. Since the vulnerability is triggered when Composer processes Perforce repository declarations in ...

  • CVE-2025-1861 Impact, Exploitability, and Mitigation Steps | Wiz
    web:www.wiz.io

    Understand the critical aspects of CVE-2025-1861 with a detailed vulnerability assessment, exploitation potential, affected technologies, and remediation guidance.

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.