MALICIOUS — f79f81089f28cb3cf9c9508295d4c5ee7261e6b337286fc25e5af20a078ed0aa.bin

MALICIOUS — f79f81089f28cb3cf9c9508295d4c5ee7261e6b337286fc25e5af20a078ed0aa.bin is a shell sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100). 2 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: f79f81089f28cb3cf9c9508295d4c5ee7261e6b337286fc25e5af20a078ed0aa
• SHA-1: feb007bf1dc16be9579508119a9edbb6347d578a
• MD5: 58181e8b583ecf2fdf5af206b28f5982
• ssdeep: 24:VmEiwaUS5rRLhK9n0ZLsKBu/iswrTWyvCD+LZFm6JZ7+9pQOJr0gtR:VDNaUS5rRLhuneLsSuKswrbMOXm6JZ7M
• TLSH: T186132485B25A29DFD172410586BB00AEC06C41CC5E80CF05D481BB4FF398CE6BAB1B1A
• Submitted as: f79f81089f28cb3cf9c9508295d4c5ee7261e6b337286fc25e5af20a078ed0aa.bin
• File type: shell · Size: 1431 bytes
• Verdict: malicious (92/100)

Source: MalShare · first seen 2026-10-03T11:38:28.260Z · SHA-256 verified

Detections (2 of 53 engines)

• Emsisoft (Emergency Kit): Trojan.Generic.40601581
• Kaspersky (KVRT): HEUR:Trojan-Downloader.Shell.Agent.bc

MITRE ATT&CK

• T1105

Why this verdict

The malicious score of 92/100 is the fusion of 7 weighted signals:

• Emsisoft (Emergency Kit) flagged Trojan.Generic.40601581 (rule Trojan.Generic.40601581) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan-Downloader.Shell.Agent.bc (rule HEUR:Trojan-Downloader.Shell.Agent.bc) - engine signal, weight 0.55, confidence 0.85
• Obfuscated unknown script: download (rule script-deobfuscation) - static signal, weight 0.55, confidence 0.75
• 1 behavioral detection(s) across 1 rule(s): Remote payload download (wget/curl) [medium] (rule tl-linux-download-cradle) - dynamic signal, weight 0.40, confidence 0.90
• Embedded network infrastructure: http://2.27.248.149/bins, 2.27.248.149 - static signal, weight 0.35, confidence 0.60
• Contacted 2 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
• Extracted generic config (2 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (linux)

888 behavior events · 0 ATT&CK techniques · 1 dropped files.

Runtime network

• ntp.ubuntu.com
• 2.27.248.149:80 GB · Canterbury · AS207043 DEDIK SERVICES LIMITED
• 2.27.248.149 GB · Canterbury · AS207043 DEDIK SERVICES LIMITED
• 10.240.0.1
• ff02::1
• ff02::2
• 10.240.0.77
• ff02::16
• ff02::1:ff12:3456
• 255.255.255.255
• 185.125.190.58

Dropped files

• tmp_.lotus - e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Embedded URLs

• http://2.27.248.149/bins

Embedded IP addresses

• 2.27.248.149

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report