CLEAN — crlf-shebang-longrun

CLEAN — crlf-shebang-longrun is a shell sample analyzed by MalwareAnalyzer by Cyble with a clean verdict (26/100). 0 of 54 detection engines flagged it.

Identification

• SHA-256: 5f7d9b16714a6ea53e06dca28ee78e991b903a58676d04e7ceabc87f595ccec4
• SHA-1: f8dc6fdea35d24ead6f2fe83224f54a03f02d88e
• MD5: b672b065f4fdef74978930d4910b986f
• ssdeep: 6:HWaHoSLzlJbLCZCJTkEQI8TlQfFZAMACvfMAFYCqMXRMXh0rpSw6Gfi7rJ3eXvMI:HwElJvCY4zTlQxAqfMAlqMhWoeKviM
• TLSH: T1CB0EA32DE90A327D230525863C51206649998B8F465113FE52C5BAE0F831F0CD04EC6B
• Submitted as: crlf-shebang-longrun
• File type: shell · Size: 420 bytes
• Verdict: clean (26/100)

Detections (0 of 54 engines)

No engine flagged this sample.

Why this verdict

The clean score of 26/100 is the fusion of 2 weighted signals:

• Embedded network infrastructure: 1.1.1.1 - static signal, weight 0.35, confidence 0.60
• Contacted 5 external host(s) at runtime - network signal, weight 0.12, confidence 0.55

Dynamic analysis (linux)

920 behavior events · 0 ATT&CK techniques · 1 dropped files.

Runtime network

• ntp.ubuntu.com
• _dosvc._tcp.local
• 1.1.1.1:443
• 1.1.1.1
• 10.240.0.1
• 224.0.0.251
• ff02::fb
• 23.221.133.123
• 91.189.91.157
• ff02::16
• 72.154.7.105 US · Moses Lake · AS8075 Microsoft Corporation
• 203.26.79.13 NZ · Auckland · AS24305 EdgeIX Pty Ltd
• 255.255.255.255
• ff02::2
• ff02::1:ff12:3456
• ff02::1
• 20.42.179.204 US · Moses Lake · AS8075 Microsoft Corporation
• 4.247.188.233 IN · Pune · AS8075 Microsoft Corporation
• 74.178.240.61 NL · Amsterdam · AS8075 Microsoft Corporation

Dropped files

• tmp_qa-marker.txt - 39c4420a46007a43333c2c2496faccb429939618813707735265596b05ba74d2

Embedded IP addresses

• 1.1.1.1
• 72.154.7.105
• 203.26.79.13
• 20.42.179.204
• 4.247.188.233
• 74.178.240.61

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report