MALICIOUS — f44ae0482cd116b7002e382d762cb01926834dd99edaa573baca24398cffafa7

MALICIOUS — f44ae0482cd116b7002e382d762cb01926834dd99edaa573baca24398cffafa7 is a shell sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (97/100). 3 of 54 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: f44ae0482cd116b7002e382d762cb01926834dd99edaa573baca24398cffafa7
• SHA-1: 61139a8c6336af74e88dc91182caf770cf628bb1
• MD5: b0c09f4b0267fc16c5fd38794efee955
• ssdeep: 24:vmaD/rJLp3SfsRNIYNksQZsNPpqsJLLN4mh1Jm:vmaD/Vd3SUhNJ15NJXNFhTm
• TLSH: T1B5147299A136111E0F6656792443BDE1092BD08EBCF9EC775083F69A1368F71FC144B8
• Submitted as: f44ae0482cd116b7002e382d762cb01926834dd99edaa573baca24398cffafa7
• File type: shell · Size: 1730 bytes
• Verdict: malicious (97/100)

Detections (3 of 54 engines)

• Microsoft Defender: TrojanDownloader:Linux/Morila!MTB
• Emsisoft (Emergency Kit): Generic.Linux.Medusa.C.5E7B3735
• Kaspersky (KVRT): HEUR:Trojan-Downloader.Shell.Agent.p

MITRE ATT&CK

• T1105

Why this verdict

The malicious score of 97/100 is the fusion of 8 weighted signals:

• Microsoft Defender flagged TrojanDownloader:Linux/Morila!MTB (rule TrojanDownloader:Linux/Morila!MTB) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Generic.Linux.Medusa.C.5E7B3735 (rule Generic.Linux.Medusa.C.5E7B3735) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan-Downloader.Shell.Agent.p (rule HEUR:Trojan-Downloader.Shell.Agent.p) - engine signal, weight 0.55, confidence 0.85
• Obfuscated unknown script: download (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
• 1 behavioral detection(s) across 1 rule(s): Remote payload download (wget/curl) [medium] (rule tl-linux-download-cradle) - dynamic signal, weight 0.40, confidence 0.90
• Contacted 6 external host(s) and 1 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
• Embedded network infrastructure: http://45.95.169.115/cc9mips, http://45.95.169.115/cc9mpsl, http://45.95.169.115/cc9sh4 - static signal, weight 0.35, confidence 0.60
• Extracted generic config (14 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (linux)

865 behavior events · 0 ATT&CK techniques · 0 dropped files.

Runtime network

• desktop-hsgcbep
• ntp.ubuntu.com
• 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 252.0.0.224.in-addr.arpa
• b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 45.95.169.115/cc9mips
• 45.95.169.115:80 HR · Zagreb · AS211619 MAXKO d.o.o.
• 45.95.169.115 HR · Zagreb · AS211619 MAXKO d.o.o.
• ff02::1:3
• 224.0.0.252
• 10.240.0.255
• 10.240.0.1
• ff02::fb
• 224.0.0.251
• ff02::1:ff12:3456
• ff02::16
• 52.168.112.67 US · Chantilly · AS8075 Microsoft Corporation
• 172.172.255.216 US · Ashburn · AS8075 Microsoft Limited
• 52.168.117.170 US · Chantilly · AS8075 Microsoft Corporation

Embedded URLs

• http://45.95.169.115/cc9mips
• http://45.95.169.115/cc9mpsl
• http://45.95.169.115/cc9sh4
• http://45.95.169.115/cc9x86
• http://45.95.169.115/cc9arm6
• http://45.95.169.115/cc9i686
• http://45.95.169.115/cc9ppc
• http://45.95.169.115/cc9i586
• http://45.95.169.115/cc9m68k
• http://45.95.169.115/cc9adc
• http://45.95.169.115/cc9dss
• http://45.95.169.115/cc9cco
• http://45.95.169.115/cc9scar

Embedded IP addresses

• 45.95.169.115
• 52.168.112.67
• 172.172.255.216
• 52.168.117.170
• 40.84.85.40

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report