MALICIOUS — 07ccb92d5ec8f2e7392fbca8c41b31a860f8965e0fdc766e525f3d1c72dc7c42.sh

MALICIOUS — 07ccb92d5ec8f2e7392fbca8c41b31a860f8965e0fdc766e525f3d1c72dc7c42.sh is a shell sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (87/100), attributed to the SAgent family. 3 of 51 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: 07ccb92d5ec8f2e7392fbca8c41b31a860f8965e0fdc766e525f3d1c72dc7c42
• SHA-1: c9c6ac2822223c1a553c8dce741b7918419d5efa
• MD5: a521037bdc564fb7c1c9c3f0972e6c9e
• ssdeep: 24:nBdDfUTQwOzmcJ/mjEZdYoQNKs7r+QtMAGLWdnn:BdDyE7Qhv+AGLWZn
• TLSH: T171142966D22172D6475B178151A6CDF4538B9CC5EF523E0F13B3100EED47323A81A0AA
• Submitted as: 07ccb92d5ec8f2e7392fbca8c41b31a860f8965e0fdc766e525f3d1c72dc7c42.sh
• File type: shell · Size: 1584 bytes
• Verdict: malicious (87/100) · Family: SAgent

Source: MalwareBazaar · first seen 2026-07-31T00:00:00.000Z · SHA-256 verified

Detections (3 of 51 engines)

• Microsoft Defender: Trojan:Linux/SAgent.KK!MTB
• Emsisoft (Emergency Kit): Trojan.Generic.40353333
• Kaspersky (KVRT): HEUR:Trojan-Downloader.Shell.Agent.a

MITRE ATT&CK

• T1105

Why this verdict

The malicious score of 87/100 is the fusion of 6 weighted signals:

• Microsoft Defender flagged Trojan:Linux/SAgent.KK!MTB (rule Trojan:Linux/SAgent.KK!MTB) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Trojan.Generic.40353333 (rule Trojan.Generic.40353333) - engine signal, weight 0.55, confidence 0.85
• 1 behavioral detection(s): Remote payload download (wget/curl) [medium] (rule tl-linux-download-cradle) - dynamic signal, weight 0.40, confidence 0.90
• Embedded network infrastructure: http://5.182.210.61/fc713a, http://5.182.210.61/0efa59, http://5.182.210.61/b22ab5 - static signal, weight 0.35, confidence 0.60
• Contacted 13 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
• Extracted generic config (13 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (linux)

866 behavior events · 0 ATT&CK techniques · 1 dropped files.

Runtime network

• 250.255.255.239.in-addr.arpa
• ntp.ubuntu.com
• 5.182.210.61:80 NL · Amsterdam · AS64425 SKB Enterprise B.V.
• 5.182.210.61 NL · Amsterdam · AS64425 SKB Enterprise B.V.
• 224.0.0.251
• ff02::fb
• ff02::1:3
• 224.0.0.252
• 157.240.8.35 AU · Sydney · AS32934 Facebook, Inc.
• 10.240.0.1
• ff02::1
• ff02::2
• ff02::1:ff4c:1d1d
• 40.84.85.40 US · Boydton · AS8075 Microsoft Corporation
• 4.247.188.224 IN · Pune · AS8075 Microsoft Corporation
• 149.154.167.99 NL · Amsterdam · AS62041 Telegram Messenger Network
• ff02::1:ff12:3456
• 255.255.255.255
• 23.40.52.123
• 20.42.73.27 US · Ashburn · AS8075 Microsoft Corporation

Dropped files

• tmp_tmp.2OsBeoGjW6 - 0f10d724a86780dd20b375b3279e42774bd820223b63d290fb92464ba8d07edd

Embedded URLs

• http://5.182.210.61/fc713a
• http://5.182.210.61/0efa59
• http://5.182.210.61/b22ab5
• http://5.182.210.61/354edc
• http://5.182.210.61/23e522
• http://5.182.210.61/0fabad
• http://5.182.210.61/5fd134
• http://5.182.210.61/11c2a0
• http://5.182.210.61/da7a04
• http://5.182.210.61/96f5c0
• http://5.182.210.61/dd1d24
• http://5.182.210.61/20edef

Embedded IP addresses

• 5.182.210.61
• 157.240.8.35
• 40.84.85.40
• 4.247.188.224
• 149.154.167.99
• 20.42.73.27
• 172.172.255.216
• 20.165.94.63
• 51.116.246.106
• 4.247.188.233

More SAgent samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report