MB-9b74712f8e5a46e0f9718bf6da01590a033d95da66c6f6a7b3d34fd8a3a385b9
high
📛 Threat Title
Unknown: anore-r2-stage2.php
Description
File type: php. Size: 73531 bytes. Tags: anonsec, cloudflare-r2, kamp4ng, lpe, php, php-webshell. Reporter: boredchilada2. First seen: 2026-09-25 03:14:48.
Indicators of Compromise (3)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
hash_sha256
9b74712f8e5a46e0f9718bf6da01590a033d95da66c6f6a7b3d34fd8a3a385b9
IOC database
- Type
- hash_sha256
- Value
9b74712f8e5a46e0f9718bf6da01590a033d95da66c6f6a7b3d34fd8a3a385b9- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Unknown
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_sha1
1a72f146879b9960d1df79e5bc3dac13b269a22a
IOC database
- Type
- hash_sha1
- Value
1a72f146879b9960d1df79e5bc3dac13b269a22a- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_md5
4b84c7b0d3f4482cdf7aad726292544c
IOC database
- Type
- hash_md5
- Value
4b84c7b0d3f4482cdf7aad726292544c- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (1)
-
MalwareBazaar sample page
Abuse.ch
File type: php. Size: 73531 bytes. Tags: anonsec, cloudflare-r2, kamp4ng, lpe, php, php-webshell. Reporter: boredchilada2. First seen: 2026-09-25 03:14:48.
Remediations (10)
-
web:cvefeed.io
CISA's Known Exploited Vulnerabilities (KEV) catalog is the authoritative list of security flaws that have been confirmed exploited in real-world attacks. CVEFeed.io mirrors every entry, joins it to full CVE and severity data, and tracks new additions so you can prioritize remediation the moment a vulnerability enters the catalog. Because each KEV entry carries direct evidence of active ...
-
web:github.com
Ready-to-use Microsoft Intune Endpoint Analytics Proactive Remediation detection and remediation scripts. - JayRHa/EndpointAnalyticsRemediationScripts
-
web:learn.microsoft.com
Learn how to deal with unwanted mitigations in Windows Security, including a process to remove all mitigations and import a baseline configuration file instead.
-
web:learn.microsoft.com
Microsoft Defender Vulnerability Management allows you to remediate vulnerabilities discovered in your environment through actionable security recommendations. You can create remediation requests that your IT administrator team can use to remediate vulnerabilities using Microsoft Intune.
-
web:panorays.com
Discover the difference between remediation and mitigation in risk management and how each strategy impacts security and resilience.
-
web:scloud.work
When a proactive remediation script fails to work as expected, it's much faster to test it locally than wait for the next sync from Intune. In this post, I'll show you how I troubleshoot Intune remediation scripts directly on a Windows device. This includes script locations, relevant logs, and registry entries that help verify what happened and why. For some samples and an introduction to ...
-
web:support.apple.com
Learn how to solve iOS update and restore errors.
-
web:www.cisa.gov
For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild. Organizations should use the KEV catalog as an input to their vulnerability management prioritization framework. Learn more about ...
-
web:www.cyberkendra.com
Last updated: 23 July 2026 · Now includes in-the-wild exploitation data and the WAF-bypass warning. Written for site owners, admins and defenders who need to act, not just read. The 20-second version: WP2Shell is a pre-authentication remote code execution (RCE) chain in WordPress core — no plugin required, no login required. It affects WordPress 6.9.0-6.9.4 and 7.0.0-7.0.1. WordPress ...
-
web:www.wiz.io
Understand the critical aspects of CVE-2026-86218 with a detailed vulnerability assessment, exploitation potential, affected technologies, and remediation guidance.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.