CLEAN — d3b2791d6a1b2a645cf3989baa1f5200b128553bcf0386266621c319a4e1d057.sh

CLEAN — d3b2791d6a1b2a645cf3989baa1f5200b128553bcf0386266621c319a4e1d057.sh is a shell sample analyzed by MalwareAnalyzer by Cyble with a clean verdict (21/100). 3 of 53 detection engines flagged it.

Identification

SHA-256: d3b2791d6a1b2a645cf3989baa1f5200b128553bcf0386266621c319a4e1d057
SHA-1: cc0f6ad315cd9509c773b188d04c698501e9765c
MD5: 8f45ec279223e7d933ba1f64ce832977
ssdeep: 768:X8vCB+25j6es8RQt9FYpMSUpi+20qUpi+20YQX:X8l25JQbd2QX
TLSH: T16F2D8E843CF8E933D7AA224E6A1266334553A0BDF7C5DF27F0C12750F8368A0628A54D
Submitted as: d3b2791d6a1b2a645cf3989baa1f5200b128553bcf0386266621c319a4e1d057.sh
File type: shell · Size: 27042 bytes
Verdict: clean (21/100)

Source: MalwareBazaar · first seen 2026-08-01T00:00:00.000Z · SHA-256 verified

Detections (3 of 53 engines)

Microsoft Defender: Trojan:Linux/WebShell!AMTB
Emsisoft (Emergency Kit): Trojan.GenericKDZ.118886
Kaspersky (KVRT): Backdoor.Shell.Agent.z

Why this verdict

The clean score of 21/100 is the fusion of 1 weighted signal:

Embedded network infrastructure: http://160.119.69.4/z/post/noroot.php, 160.119.69.4 - static signal, weight 0.35, confidence 0.60

Dynamic analysis (linux)

871 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

desktop-hsgcbep
ntp.ubuntu.com
2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
252.0.0.224.in-addr.arpa
250.255.255.239.in-addr.arpa
ff02::1:3
224.0.0.252
10.240.0.1
10.240.0.255
224.0.0.251
ff02::fb
239.255.255.250
ff02::16
169.254.255.255
185.125.190.58
224.0.0.22
255.255.255.255
149.154.167.99 NL · Amsterdam · AS62041 Telegram Messenger Network

Embedded URLs

http://160.119.69.4/z/post/noroot.php

Embedded IP addresses

160.119.69.4
149.154.167.99

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report