MALICIOUS — 8e06754e5e64bdf5f61dd604a5f12e9bc10f5502316b5379fb258f84a5d84702.bin

MALICIOUS — 8e06754e5e64bdf5f61dd604a5f12e9bc10f5502316b5379fb258f84a5d84702.bin is a unknown sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (88/100). 3 of 53 detection engines flagged it.

Identification

• SHA-256: 8e06754e5e64bdf5f61dd604a5f12e9bc10f5502316b5379fb258f84a5d84702
• SHA-1: a33c1ef6838d1a13e8e7412e37ff91e56c401911
• MD5: 6d18203a7a5f6133166c2dfacb8b6b96
• ssdeep: 24:odKsdoede6eLgdtxHdWUbd9aT13+dbWgdekdTjKgdeBCtd9gd3:oQsxnlLptTJHdtvc3
• TLSH: T1A412E611AC6CE1BA33EB1989790C78E9834470C2F931A91F3581505D0D87D30EC1A33E
• Submitted as: 8e06754e5e64bdf5f61dd604a5f12e9bc10f5502316b5379fb258f84a5d84702.bin
• File type: unknown · Size: 924 bytes
• Verdict: malicious (88/100)

Source: MalShare · first seen 2026-09-07T18:35:18.652Z · SHA-256 verified

Detections (3 of 53 engines)

• Microsoft Defender: Trojan:Script/Sabsik.EN.A!ml
• Emsisoft (Emergency Kit): Generic.Linux.Medusa.D.0C680167
• Kaspersky (KVRT): HEUR:Trojan-Downloader.Shell.Agent.p

Why this verdict

The malicious score of 88/100 is the fusion of 4 weighted signals:

• Microsoft Defender flagged Trojan:Script/Sabsik.EN.A!ml (rule Trojan:Script/Sabsik.EN.A!ml) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Generic.Linux.Medusa.D.0C680167 (rule Generic.Linux.Medusa.D.0C680167) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan-Downloader.Shell.Agent.p (rule HEUR:Trojan-Downloader.Shell.Agent.p) - engine signal, weight 0.55, confidence 0.85
• Embedded network infrastructure: http://131.123.40.104/GHfjfgvj, http://131.123.40.104/JIPJIPJj, http://131.123.40.104/jhUOH - static signal, weight 0.35, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• http://131.123.40.104/GHfjfgvj
• http://131.123.40.104/JIPJIPJj
• http://131.123.40.104/jhUOH
• http://131.123.40.104/RYrydry
• http://131.123.40.104/UYyuyioy
• http://131.123.40.104/XDzdfxzf
• http://131.123.40.104/JIPJuipjh
• http://131.123.40.104/DFhxdhdf
• http://131.123.40.104/FDFDHFC
• http://131.123.40.104/FTUdftui

Embedded IP addresses

• 131.123.40.104

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report