MALICIOUS — 0cb070e16ed2c0c6b1df1df4ffa57be59c4bed42f8ac3803d37d0c54c7c9f958.sh

MALICIOUS — 0cb070e16ed2c0c6b1df1df4ffa57be59c4bed42f8ac3803d37d0c54c7c9f958.sh is a shell sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the SAgent family. 3 of 51 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 0cb070e16ed2c0c6b1df1df4ffa57be59c4bed42f8ac3803d37d0c54c7c9f958
SHA-1: 37761b03f69f2c7fac6106b631fa8fa14e223caf
MD5: 39dab76551b5e819cb75c6128f915ae6
ssdeep: 24:rBPYU4zSj/J/mOYz/QoYehY7XO2lUl9Nl:lYU4zmxaIolYZe9Nl
TLSH: T18514E629E112B2EA577B1382A164CCB1078768C5EF533E4F11B7210FDD9B613F91A42A
Submitted as: 0cb070e16ed2c0c6b1df1df4ffa57be59c4bed42f8ac3803d37d0c54c7c9f958.sh
File type: shell · Size: 1584 bytes
Verdict: malicious (98/100) · Family: SAgent

Source: MalwareBazaar · first seen 2026-07-26T00:00:00.000Z · SHA-256 verified

Detections (3 of 51 engines)

Microsoft Defender: Trojan:Linux/SAgent.KK!MTB
Emsisoft (Emergency Kit): Trojan.Generic.40336287
Kaspersky (KVRT): HEUR:Trojan-Downloader.Shell.Agent.a

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 11 weighted signals:

1 behavioral detection(s): Download-and-execute dropper (wget/curl + chmod) [high] (rule tl-linux-download-exec) - dynamic signal, weight 0.60, confidence 0.90
1 behavioral detection(s): Download-and-execute dropper (wget/curl + chmod) [high] (rule tl-linux-download-exec) - dynamic signal, weight 0.60, confidence 0.90
Microsoft Defender flagged Trojan:Linux/SAgent.KK!MTB (rule Trojan:Linux/SAgent.KK!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.Generic.40336287 (rule Trojan.Generic.40336287) - engine signal, weight 0.55, confidence 0.85
Anti-analysis: T1497 - dynamic signal, weight 0.40, confidence 0.75
Anti-analysis: T1497 - dynamic signal, weight 0.40, confidence 0.75
Embedded network infrastructure: http://5.182.210.61/60bf57, http://5.182.210.61/090c4c, http://5.182.210.61/c0db3a - static signal, weight 0.35, confidence 0.60
Contacted 11 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
Contacted 11 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
Extracted generic config (13 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Extracted generic config (13 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (linux)

903 behavior events · 0 ATT&CK techniques · 1 dropped files.

Runtime network

entropy.ubuntu.com
_dosvc._tcp.local
ntp.ubuntu.com
desktop-hsgcbep
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
185.125.189.52:443
5.182.210.61:80
185.125.189.52
5.182.210.61
203.26.79.13
10.240.0.1
ff02::fb
224.0.0.251
23.40.52.148
23.40.52.111
ff02::1:3
224.0.0.252

Dropped files

tmp_tmp.CEcy5BBh5q - e2efde3f4de6815c011d8fa3d63f84cbeaa29434ab797c751efa10ea93946725

Embedded URLs

http://5.182.210.61/60bf57
http://5.182.210.61/090c4c
http://5.182.210.61/c0db3a
http://5.182.210.61/c6f42c
http://5.182.210.61/ec7f34
http://5.182.210.61/acba5d
http://5.182.210.61/1da144
http://5.182.210.61/d930ad
http://5.182.210.61/2f2c84
http://5.182.210.61/905c95
http://5.182.210.61/305fff
http://5.182.210.61/0faa38

Embedded domains

2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
entropy.ubuntu.com
_dosvc._tcp.local
ntp.ubuntu.com

Embedded IP addresses

5.182.210.61
185.125.189.52
203.26.79.13
23.40.52.148
23.40.52.111
20.42.179.192
91.189.91.157
172.172.255.218
20.42.73.31

More SAgent samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report