MALICIOUS — 0b6cdce9677964345a98701111e1504efb211e72d9e3130d4d96013991263cfb.sh
MALICIOUS — 0b6cdce9677964345a98701111e1504efb211e72d9e3130d4d96013991263cfb.sh is a shell sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the SAgent family. 3 of 51 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
0b6cdce9677964345a98701111e1504efb211e72d9e3130d4d96013991263cfb - SHA-1:
cde2e7d38b3bcac079e406babbbed1ccfcf7208f - MD5:
348fe736037151600d6fe978ea30ee4f - ssdeep:
96:vmUVU+UmUsEUgUxU1UOUZU4U4UHUjURn:de - TLSH:
T1CF19E2C4991A780C8CDBC39839A7F96865B16BC5FCB39153D0C2F1D8A219731DE258B8 - Submitted as: 0b6cdce9677964345a98701111e1504efb211e72d9e3130d4d96013991263cfb.sh
- File type: shell · Size: 4200 bytes
- Verdict: malicious (98/100) · Family: SAgent
Source: MalwareBazaar · first seen 2026-07-26T00:00:00.000Z · SHA-256 verified
Detections (3 of 51 engines)
- Microsoft Defender: TrojanDownloader:SH/SAgent.B!MTB
- Emsisoft (Emergency Kit): Generic.Linux.Medusa.C.69C7257D
- Kaspersky (KVRT): HEUR:Trojan-Downloader.Shell.Agent.p
MITRE ATT&CK
Why this verdict
The malicious score of 98/100 is the fusion of 11 weighted signals:
- 1 behavioral detection(s): Download-and-execute dropper (wget/curl + chmod) [high] (rule
tl-linux-download-exec) - dynamic signal, weight 0.60, confidence 0.90 - 1 behavioral detection(s): Download-and-execute dropper (wget/curl + chmod) [high] (rule
tl-linux-download-exec) - dynamic signal, weight 0.60, confidence 0.90 - Microsoft Defender flagged TrojanDownloader:SH/SAgent.B!MTB (rule
TrojanDownloader:SH/SAgent.B!MTB) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Generic.Linux.Medusa.C.69C7257D (rule
Generic.Linux.Medusa.C.69C7257D) - engine signal, weight 0.55, confidence 0.85 - Anti-analysis: T1497 - dynamic signal, weight 0.40, confidence 0.75
- Anti-analysis: T1497 - dynamic signal, weight 0.40, confidence 0.75
- Embedded network infrastructure: http://94.154.43.61/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.x86, http://94.154.43.61/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.mips, http://94.154.43.61/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.mpsl - static signal, weight 0.35, confidence 0.60
- Contacted 15 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
- Contacted 15 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
- Extracted generic config (16 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
- Extracted generic config (16 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (linux)
903 behavior events · 0 ATT&CK techniques · 1 dropped files.
Runtime network
- entropy.ubuntu.com
- _dosvc._tcp.local
- ntp.ubuntu.com
- 185.125.189.54:443
- 94.154.43.61:80
- 203.26.79.13
- 185.125.189.54
- 94.154.43.61
- 10.240.0.1
- ff02::fb
- 224.0.0.251
- 74.178.76.44
- 185.125.190.56
- 20.42.65.85
- 4.247.188.233
- 85.210.193.152
- 185.125.190.57
- 4.150.223.114
- 8.8.8.8
- 8.8.4.4
Dropped files
- tmp_tmp.xerkhf4bcN -
9c2067a5e36a8ec0fa03efa38f58dc27817b053bf4a00132c6434518a396a832
Embedded URLs
- http://94.154.43.61/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.x86
- http://94.154.43.61/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.mips
- http://94.154.43.61/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.mpsl
- http://94.154.43.61/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.arm
- http://94.154.43.61/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.arm5
- http://94.154.43.61/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.arm6
- http://94.154.43.61/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.arm7
- http://94.154.43.61/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.ppc
- http://94.154.43.61/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.m68k
- http://94.154.43.61/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.sh4
- http://94.154.43.61/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.spc
- http://94.154.43.61/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.arc
- http://94.154.43.61/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.x86_64
- http://94.154.43.61/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.i686
- http://94.154.43.61/z0l1mxjm4mdl4jjfjf7sb2vdmv/MMaaRRiiOisecTanee.i486
Embedded domains
- entropy.ubuntu.com
- _dosvc._tcp.local
- ntp.ubuntu.com
Embedded IP addresses
- 94.154.43.61
- 203.26.79.13
- 185.125.189.54
- 74.178.76.44
- 185.125.190.56
- 20.42.65.85
- 4.247.188.233
- 85.210.193.152
- 185.125.190.57
- 4.150.223.114
- 91.189.91.157
- 8.8.8.8
- 8.8.4.4
More SAgent samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report