MALICIOUS — 7b8cd695424f9b004b459ce886d92e9a24f38957dc9071510ab669a7cb89c417.bin

MALICIOUS — 7b8cd695424f9b004b459ce886d92e9a24f38957dc9071510ab669a7cb89c417.bin is a shell sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100), attributed to the Shell family. 2 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: 7b8cd695424f9b004b459ce886d92e9a24f38957dc9071510ab669a7cb89c417
• SHA-1: 054db30935ad054e6a6f44649808054ee43a45b0
• MD5: 2032f2294942f776a127af3f8f900c77
• ssdeep: 24:FeEBvi1pieBFBvK9hOh4TtqBvTm7T3L1BvWPivB8s7EByTvDp83XrQtqBVSjR35Q:Feovi3lB7v8hOCcvIbLLvAiZ8z07po7Z
• TLSH: T1C71324B510832B5B27DFF152A9CEACED6FE968578C23EACF918D010741DA504412C5CD
• Submitted as: 7b8cd695424f9b004b459ce886d92e9a24f38957dc9071510ab669a7cb89c417.bin
• File type: shell · Size: 1487 bytes
• Verdict: malicious (92/100) · Family: Shell

Source: MalShare · first seen 2026-10-13T20:32:16.292Z · SHA-256 verified

Detections (2 of 53 engines)

• Emsisoft (Emergency Kit): Trojan.Generic.40638979
• Kaspersky (KVRT): HEUR:Trojan-Downloader.Shell.Agent.p

MITRE ATT&CK

• T1105

Why this verdict

The malicious score of 92/100 is the fusion of 7 weighted signals:

• Emsisoft (Emergency Kit) flagged Trojan.Generic.40638979 (rule Trojan.Generic.40638979) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan-Downloader.Shell.Agent.p (rule HEUR:Trojan-Downloader.Shell.Agent.p) - engine signal, weight 0.55, confidence 0.85
• Obfuscated unknown script: download (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
• 1 behavioral detection(s) across 1 rule(s): Remote payload download (wget/curl) [medium] (rule tl-linux-download-cradle) - dynamic signal, weight 0.40, confidence 0.90
• Embedded network infrastructure: http://176.65.139.40/jklarm, http://176.65.139.40/jklarm5, http://176.65.139.40/jklarm6 - static signal, weight 0.35, confidence 0.60
• Contacted 2 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
• Extracted generic config (12 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (linux)

875 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• ntp.ubuntu.com
• 176.65.139.40:80 GB · London · AS219502 Storm Industries LLC
• 176.65.139.40 GB · London · AS219502 Storm Industries LLC
• 10.240.0.1
• 185.125.190.58
• ff02::2
• ff02::1
• ff02::1:ff12:3456
• 255.255.255.255
• ff02::16

Embedded URLs

• http://176.65.139.40/jklarm
• http://176.65.139.40/jklarm5
• http://176.65.139.40/jklarm6
• http://176.65.139.40/jklarm7
• http://176.65.139.40/jklm68k
• http://176.65.139.40/jklmips
• http://176.65.139.40/jklmpsl
• http://176.65.139.40/jklppc
• http://176.65.139.40/jklsh4
• http://176.65.139.40/jklspc
• http://176.65.139.40/jklx86

Embedded domains

• wget.sh

Embedded IP addresses

• 176.65.139.40

More Shell samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report