MALICIOUS — 7b1cbba56bb80e185cdf2097f5716c31d7e0f88f28ad7220b3b5a2cf73859ec8.bin

MALICIOUS — 7b1cbba56bb80e185cdf2097f5716c31d7e0f88f28ad7220b3b5a2cf73859ec8.bin is a shell sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100). 4 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: 7b1cbba56bb80e185cdf2097f5716c31d7e0f88f28ad7220b3b5a2cf73859ec8
• SHA-1: a5c07f2bba9b7f2c1a9f04c62ab21bd92c5023b8
• MD5: bbe29ca4384fdd7caf60c1836fbff13b
• ssdeep: 96:vvf+srLjrzrHCKxJDUWgyQEol8fHn4El2KxiX1Dl8pPeOKx+mqcl8z:2uGL5l8wEAjDl8pPbzcl8z
• TLSH: T1291EB6EA4050226E4F9B01252043BDA5059B58DEFCF2EAB70481F5CE0769375DD1A8F9
• Submitted as: 7b1cbba56bb80e185cdf2097f5716c31d7e0f88f28ad7220b3b5a2cf73859ec8.bin
• File type: shell · Size: 6734 bytes
• Verdict: malicious (99/100)

Source: MalShare · first seen 2026-10-02T19:03:26.153Z · SHA-256 verified

Detections (4 of 53 engines)

• Hash: MalShare: known-malicious-hash
• Microsoft Defender: TrojanDownloader:Linux/Morila!MTB
• Emsisoft (Emergency Kit): Trojan.Generic.40444902
• Kaspersky (KVRT): HEUR:Trojan-Downloader.Shell.Agent.p

MITRE ATT&CK

• T1105

Why this verdict

The malicious score of 99/100 is the fusion of 9 weighted signals:

• Hash: MalShare flagged known-malicious-hash (rule known-malicious-hash) - engine signal, weight 0.90, confidence 0.95
• Microsoft Defender flagged TrojanDownloader:Linux/Morila!MTB (rule TrojanDownloader:Linux/Morila!MTB) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Trojan.Generic.40444902 (rule Trojan.Generic.40444902) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan-Downloader.Shell.Agent.p (rule HEUR:Trojan-Downloader.Shell.Agent.p) - engine signal, weight 0.55, confidence 0.85
• Obfuscated unknown script: download (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
• 1 behavioral detection(s) across 1 rule(s): Remote payload download (wget/curl) [medium] (rule tl-linux-download-cradle) - dynamic signal, weight 0.40, confidence 0.90
• Embedded network infrastructure: http://213.232.114.14/telnetd, http://213.232.114.14/telnet, http://213.232.114.14/kworker - static signal, weight 0.35, confidence 0.60
• Contacted 2 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
• Extracted generic config (18 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (linux)

861 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• ntp.ubuntu.com
• 213.232.114.14:80 NL · Amsterdam · Virtual Machine Solutions LLC
• 213.232.114.14 NL · Amsterdam · Virtual Machine Solutions LLC
• 10.240.0.1
• 185.125.190.57
• ff02::1:ff12:3456
• ff02::1
• ff02::2
• 255.255.255.255
• ff02::16

Embedded URLs

• http://213.232.114.14/telnetd
• http://213.232.114.14/telnet
• http://213.232.114.14/kworker
• http://213.232.114.14/sshd
• http://213.232.114.14/bash
• http://213.232.114.14/getty
• http://213.232.114.14/kernal
• http://213.232.114.14/gnome
• http://213.232.114.14/ntp
• http://213.232.114.14/ext4
• http://213.232.114.14/watchdogd
• http://213.232.114.14/systemd
• http://213.232.114.14/ntpd
• http://213.232.114.14/login
• http://213.232.114.14/dbus
• http://213.232.114.14/kde
• http://213.232.114.14/crypto

Embedded IP addresses

• 213.232.114.14

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report