SUSPICIOUS — 16c91187c0ebe2e0f8b32c89579d43fa127b34b0d6e21278e949ac8ae90174fc
SUSPICIOUS — 16c91187c0ebe2e0f8b32c89579d43fa127b34b0d6e21278e949ac8ae90174fc is a shell sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (55/100). 3 of 50 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
16c91187c0ebe2e0f8b32c89579d43fa127b34b0d6e21278e949ac8ae90174fc - SHA-1:
b9c56777941b5dc082b37a95c053d903c3bb0974 - MD5:
a79c07a6b62bfd5d0bfb1402412edef8 - ssdeep:
96:r1uT7UcsSorhcEwMafMa8ranaO5iU49iE49iU49ZEJ4DQ3K34:pcZsSorhHwMKMvE3iUiiEiiUiZ3S - TLSH:
T1AE1C79FA5265E6880FC3BF69A9A42F404DEE1D80DFD16C4213C0E32060AD9708AFF559 - Submitted as: 16c91187c0ebe2e0f8b32c89579d43fa127b34b0d6e21278e949ac8ae90174fc
- File type: shell · Size: 5750 bytes
- Verdict: suspicious (55/100)
Detections (3 of 50 engines)
- Microsoft Defender: Trojan:Linux/CoinMiner.AF!MTB
- Emsisoft (Emergency Kit): Generic.Linux.Zojfor.C.0D62781B
- Kaspersky (KVRT): HEUR:Trojan-Downloader.Shell.Miner.f
MITRE ATT&CK
Why this verdict
The suspicious score of 55/100 is the fusion of 4 weighted signals:
- 1 behavioral detection(s): Remote payload download (wget/curl) [medium] (rule
tl-linux-download-cradle) - dynamic signal, weight 0.40, confidence 0.90 - Embedded network infrastructure: http://23.106.155.163:8090/x/cnrig, http://23.106.155.163:8090/x/config.json, http://23.106.155.163:8090/x/xm.rar - static signal, weight 0.35, confidence 0.60
- Contacted 1 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
- Extracted generic config (14 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (linux)
910 behavior events · 0 ATT&CK techniques · 1 dropped files.
Runtime network
- b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- 252.0.0.224.in-addr.arpa
- 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- desktop-hsgcbep
- 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
- ntp.ubuntu.com
- 250.255.255.239.in-addr.arpa
- desktop-hsgcbep._dosvc._tcp.local
- desktop-hsgcbep(1)._dosvc._tcp.local
- ff02::1:3
- 224.0.0.252
- 224.0.0.251
- ff02::fb
- 169.254.255.255
- 10.240.0.1
- 255.255.255.255
- ff02::16
- 10.240.0.255
- 239.255.255.250
- 185.125.190.56
Dropped files
- root_.bash_history -
01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
Embedded URLs
- http://23.106.155.163:8090/x/cnrig
- http://23.106.155.163:8090/x/config.json
- http://23.106.155.163:8090/x/xm.rar
Embedded domains
- update.sh
- lsd.systemten.org
- mr.sh
- localhost.xyz
- bigd1ck.com
- xmr.ipzse.com
- newdat.sh
- lib.pygensim.com
- t.amynx.com
- systemd-service.sh
- kieuanilam.me
Embedded IP addresses
- 3.215.110.66
- 185.181.10.234
- 45.137.151.106
- 111.90.159.106
- 146.71.79.230
- 122.51.164.83
- 185.191.32.198
- 108.174.197.76
- 192.236.161.6
- 88.99.242.92
- 23.106.155.163
- 52.123.252.203
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report