MALICIOUS — 1af779d2b6f4f2c3801bb4e85d872a4fe4ee2168baea1092da9841dba211ba1c.sh

MALICIOUS — 1af779d2b6f4f2c3801bb4e85d872a4fe4ee2168baea1092da9841dba211ba1c.sh is a shell sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (87/100), attributed to the Wacatac family. 3 of 51 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: 1af779d2b6f4f2c3801bb4e85d872a4fe4ee2168baea1092da9841dba211ba1c
• SHA-1: 1f97896bbd339f33fb47cb407e56866241a79ec7
• MD5: 4d46f92ff02b56bfaa593a51fb3f7687
• ssdeep: 24:kXCKysE2hi0ziQvZohaQEusbv5+g8GAX:e9Qp+MsQjsbvoRFX
• TLSH: T1AB11AB1B016842BF07AFA7642348FC6E1C0EB3E76F10D84E5252D81A8741E50BA3B1DE
• Submitted as: 1af779d2b6f4f2c3801bb4e85d872a4fe4ee2168baea1092da9841dba211ba1c.sh
• File type: shell · Size: 852 bytes
• Verdict: malicious (87/100) · Family: Wacatac

Source: MalwareBazaar · first seen 2026-07-29T00:00:00.000Z · SHA-256 verified

Detections (3 of 51 engines)

• Microsoft Defender: Trojan:Script/Wacatac.B!ml
• Emsisoft (Emergency Kit): Trojan.Generic.40347635
• Kaspersky (KVRT): HEUR:Trojan-Downloader.Shell.Agent.a

MITRE ATT&CK

• T1105

Why this verdict

The malicious score of 87/100 is the fusion of 6 weighted signals:

• Microsoft Defender flagged Trojan:Script/Wacatac.B!ml (rule Trojan:Script/Wacatac.B!ml) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Trojan.Generic.40347635 (rule Trojan.Generic.40347635) - engine signal, weight 0.55, confidence 0.85
• 1 behavioral detection(s): Remote payload download (wget/curl) [medium] (rule tl-linux-download-cradle) - dynamic signal, weight 0.40, confidence 0.90
• Embedded network infrastructure: http://129.121.110.105/FGx2, http://129.121.110.105/gTrF, http://129.121.110.105/LAI - static signal, weight 0.35, confidence 0.60
• Contacted 8 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
• Extracted generic config (6 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (linux)

819 behavior events · 0 ATT&CK techniques · 1 dropped files.

Runtime network

• cp601.prod.do.dsp.mp.microsoft.com
• ntp.ubuntu.com
• 250.255.255.239.in-addr.arpa
• 129.121.110.105:80
• 129.121.110.105
• 10.240.0.1
• 91.199.133.133
• 224.0.0.251
• ff02::fb
• ff02::1:3
• 224.0.0.252
• 185.125.190.56
• 185.125.190.57
• 40.126.14.164
• 185.125.190.58
• ff02::16
• 255.255.255.255
• 172.215.188.232
• 224.0.0.22
• ff02::1:ff12:3456

Dropped files

• tmp_tmp.D42z5vzUIo - 5bdf5dd7179d3c1b1d65823fc6d6006f268f7e3d4e6684b4c10a04d6c6315e85

Embedded URLs

• http://129.121.110.105/FGx2
• http://129.121.110.105/gTrF
• http://129.121.110.105/LAI
• http://129.121.110.105/ouwR
• http://129.121.110.105/HFpa

Embedded IP addresses

• 129.121.110.105
• 91.199.133.133
• 40.126.14.164
• 172.215.188.232

More Wacatac samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report