CLEAN — 434f8f7a3d7bcb44e6079bc3c95af42b162b49701c5ca4484fafd3a24df44f9b.sh

CLEAN — 434f8f7a3d7bcb44e6079bc3c95af42b162b49701c5ca4484fafd3a24df44f9b.sh is a shell sample analyzed by MalwareAnalyzer by Cyble with a clean verdict (30/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: 434f8f7a3d7bcb44e6079bc3c95af42b162b49701c5ca4484fafd3a24df44f9b
• SHA-1: 67b05934e33a9fd20acd8a27184745bda8b089c8
• MD5: ac7866cb98798dd06a55607aff29a3e2
• ssdeep: 12:9GIWRzUrO9Gx/Gck9tF9G1zL/G1zD+jvzxTjF5Nzw5F5NVwZF5Na+Kq:NWRQS9uZ239EzrEzijvzxTfNGNsNQq
• TLSH: T1690F46BF83A03D0E43706675038A949C8503B11BC553FE12698285831A3A433F7AD2BC
• Submitted as: 434f8f7a3d7bcb44e6079bc3c95af42b162b49701c5ca4484fafd3a24df44f9b.sh
• File type: shell · Size: 540 bytes
• Verdict: clean (30/100)

Source: MalwareBazaar · first seen 2026-08-02T00:00:00.000Z · SHA-256 verified

Detections (2 of 53 engines)

• Emsisoft (Emergency Kit): Trojan.Generic.40363365
• Kaspersky (KVRT): HEUR:Trojan-Downloader.Shell.Agent.a

Why this verdict

The clean score of 30/100 is the fusion of 3 weighted signals:

• Embedded network infrastructure: http://35.237.91.38/meow, http://35.237.91.38/meowarm64, 35.243.230.5 - static signal, weight 0.35, confidence 0.60
• Contacted 4 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
• Extracted generic config (4 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (linux)

828 behavior events · 0 ATT&CK techniques · 9 dropped files.

Runtime network

• 250.255.255.239.in-addr.arpa
• 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 255.255.254.169.in-addr.arpa
• b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 252.0.0.224.in-addr.arpa
• 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 251.0.0.224.in-addr.arpa
• desktop-hsgcbep
• 224.0.0.251
• ff02::1:3
• 224.0.0.252
• ff02::fb
• 169.254.255.255
• 10.240.0.255
• 10.240.0.1
• ff02::16
• 20.190.167.19
• 135.233.95.144 US · Des Moines · AS8075 Microsoft Limited
• 239.255.255.250
• 91.189.91.157

Dropped files

• home_admin1_.bash_logout - 26882b79471c25f945c970f8233d8ce29d54e9d5eedcd2884f88affa84a18f56
• home_admin1_.bashrc - 342099da4dd28c394d3f8782d90d7465cb2eaa611193f8f378d6918261cb9bb8
• home_admin1_.config_libreoffice_4_user_registrymodifications.xcu - e0a4aae5aa7bb4444f07bf35f5803e05802f023194b14a69abf375810648353b
• home_admin1_.profile - 28b4a453b68dde64f814e94bab14ee651f4f162e15dd9920490aa1d49f05d2a4
• home_user1_.bash_logout - 26882b79471c25f945c970f8233d8ce29d54e9d5eedcd2884f88affa84a18f56
• home_user1_.bashrc - 342099da4dd28c394d3f8782d90d7465cb2eaa611193f8f378d6918261cb9bb8
• home_user1_.config_libreoffice_4_user_registrymodifications.xcu - e0a4aae5aa7bb4444f07bf35f5803e05802f023194b14a69abf375810648353b
• home_user1_.profile - 28b4a453b68dde64f814e94bab14ee651f4f162e15dd9920490aa1d49f05d2a4
• tmp_mew - 8da193366e1554c08b2870c50f737b9587c3372b656151c4a96028af26f51334

Embedded URLs

• http://35.237.91.38/meow
• http://35.237.91.38/meowarm64

Embedded IP addresses

• 35.243.230.5
• 35.237.91.38
• 135.233.95.144
• 40.79.167.10
• 51.104.15.253
• 20.184.175.6

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report