CLEAN — 3f3a11bafabb1a35db913cfe51995f2e357d049e268860175876ae5a93d23892.bin

CLEAN — 3f3a11bafabb1a35db913cfe51995f2e357d049e268860175876ae5a93d23892.bin is a shell sample analyzed by MalwareAnalyzer by Cyble with a clean verdict (0/100). 1 of 53 detection engines flagged it.

Identification

• SHA-256: 3f3a11bafabb1a35db913cfe51995f2e357d049e268860175876ae5a93d23892
• SHA-1: 58c15d76520685b6c151cd48b09375bb94b825be
• MD5: 2ca1a863f6a115127d623d3d181ab9b4
• ssdeep: 24:M1jvF3SbinrGx1wyx1eC2uK6MTzaH+2TMTSIAvF2b2m2p4nKTNXT5eORv:KSbinrS1wO1F2uK6MTu+2TMTSIfy3dAG
• TLSH: T13E12EB180376729ACEC93C60793809BC2B622C4BFBE140A74E90B27225E1E33202D44F
• Submitted as: 3f3a11bafabb1a35db913cfe51995f2e357d049e268860175876ae5a93d23892.bin
• File type: shell · Size: 1157 bytes
• Verdict: clean (0/100)

Source: MalShare · first seen 2026-08-17T06:26:06.324Z · SHA-256 verified

Detections (1 of 53 engines)

• Emsisoft (Emergency Kit): Trojan.GenericKD.81088136

Dynamic analysis (linux)

841 behavior events · 0 ATT&CK techniques · 1 dropped files.

Runtime network

• desktop-hsgcbep
• 250.255.255.239.in-addr.arpa
• desktop-hsgcbep._dosvc._tcp.local
• 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 252.0.0.224.in-addr.arpa
• ntp.ubuntu.com
• ff02::1:3
• 224.0.0.252
• 224.0.0.251
• ff02::fb
• 169.254.255.255
• 10.240.0.255
• 10.240.0.1
• ff02::16
• 224.0.0.22
• 255.255.255.255
• 239.255.255.250
• 172.172.255.216 US · Ashburn · AS8075 Microsoft Limited

Dropped files

• root_.bash_profile - e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Embedded IP addresses

• 172.172.255.216
• 74.178.76.44
• 52.182.141.63
• 72.145.35.101
• 52.168.117.175
• 135.232.92.137

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report