CLEAN — 6aa5054a95d23277df417a5f69cf292e19bc2ef0406bc0c1884935a44e3ce797.bin

CLEAN — 6aa5054a95d23277df417a5f69cf292e19bc2ef0406bc0c1884935a44e3ce797.bin is a shell sample analyzed by MalwareAnalyzer by Cyble with a clean verdict (21/100). 2 of 53 detection engines flagged it.

Identification

• SHA-256: 6aa5054a95d23277df417a5f69cf292e19bc2ef0406bc0c1884935a44e3ce797
• SHA-1: acd41c3dbcecec4053c32e7c63c7dfddf33b4fc9
• MD5: 8787c21d05601ac3cb1c571b0d5ea65f
• ssdeep: 24:f+NIMmuU1UEXXxAp8sMLp0CxIPaLfcaxq:KI2U1U+Xmp8sMLpRIybd4
• TLSH: T1F014B837E259728A5B6717119624CCF402ABBD46CF722D0F2272261DCD47543AC3B06B
• Submitted as: 6aa5054a95d23277df417a5f69cf292e19bc2ef0406bc0c1884935a44e3ce797.bin
• File type: shell · Size: 1608 bytes
• Verdict: clean (21/100)

Source: MalShare · first seen 2026-08-16T08:01:02.810Z · SHA-256 verified

Detections (2 of 53 engines)

• Emsisoft (Emergency Kit): Trojan.Generic.40416258
• Kaspersky (KVRT): HEUR:Trojan-Downloader.Shell.Agent.a

Why this verdict

The clean score of 21/100 is the fusion of 1 weighted signal:

• Embedded network infrastructure: http://5.182.210.174/af8816, http://5.182.210.174/8e9f60, http://5.182.210.174/fefd81 - static signal, weight 0.35, confidence 0.60

Dynamic analysis (linux)

981 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 252.0.0.224.in-addr.arpa
• 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 250.255.255.239.in-addr.arpa
• desktop-hsgcbep
• ntp.ubuntu.com
• ff02::1:3
• 224.0.0.252
• 169.254.255.255
• 57.155.101.212 SG · Singapore · AS8075 Microsoft Limited UK
• 10.240.0.1
• ff02::fb
• 224.0.0.251
• ff02::16
• 10.240.0.255
• ff02::1
• ff02::1:ff12:3456
• 91.189.91.157
• 239.255.255.250

Embedded URLs

• http://5.182.210.174/af8816
• http://5.182.210.174/8e9f60
• http://5.182.210.174/fefd81
• http://5.182.210.174/d1d1d3
• http://5.182.210.174/b7e327
• http://5.182.210.174/e6af82
• http://5.182.210.174/a74d7e
• http://5.182.210.174/18c0c9
• http://5.182.210.174/dfbfd1
• http://5.182.210.174/ef2a92
• http://5.182.210.174/1493f3
• http://5.182.210.174/1b2ad0

Embedded IP addresses

• 5.182.210.174
• 57.155.101.212
• 20.184.175.10
• 4.150.223.99

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report