MALICIOUS — f8357dd81b2c600bae5364af6c9d457a9df0b33ee89c04ddcbfbd35206858ead.bin

MALICIOUS — f8357dd81b2c600bae5364af6c9d457a9df0b33ee89c04ddcbfbd35206858ead.bin is a shell sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (87/100), attributed to the SAgent family. 2 of 51 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: f8357dd81b2c600bae5364af6c9d457a9df0b33ee89c04ddcbfbd35206858ead
• SHA-1: 735365951ff05a5a7f543a9d6bb8465da857b0fd
• MD5: b5f5cb0d032faa3c264b37383efa2e34
• ssdeep: 12:UO6pqyCD6O766YlTrTDV768XGz6twleO26OP96jwGNQ6NaVW6l61fNG6Nu8oH6nu:8CyrzXVwlQLnVWCsmaEa8LCS
• TLSH: T11E14C676A61477EA075723829169CCF1065B9CC5FF663D0F12A2141FEE0B523BC2B01A
• Submitted as: f8357dd81b2c600bae5364af6c9d457a9df0b33ee89c04ddcbfbd35206858ead.bin
• File type: shell · Size: 1584 bytes
• Verdict: malicious (87/100) · Family: SAgent

Source: MalShare · first seen 2026-07-31T16:51:53.334Z · SHA-256 verified

Detections (2 of 51 engines)

• Microsoft Defender: Trojan:Linux/SAgent.KK!MTB
• Kaspersky (KVRT): HEUR:Trojan-Downloader.Shell.Agent.a

MITRE ATT&CK

• T1105

Why this verdict

The malicious score of 87/100 is the fusion of 6 weighted signals:

• Microsoft Defender flagged Trojan:Linux/SAgent.KK!MTB (rule Trojan:Linux/SAgent.KK!MTB) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan-Downloader.Shell.Agent.a (rule HEUR:Trojan-Downloader.Shell.Agent.a) - engine signal, weight 0.55, confidence 0.85
• 1 behavioral detection(s): Remote payload download (wget/curl) [medium] (rule tl-linux-download-cradle) - dynamic signal, weight 0.40, confidence 0.90
• Embedded network infrastructure: http://5.182.210.61/5693ed, http://5.182.210.61/c34a24, http://5.182.210.61/72aaf0 - static signal, weight 0.35, confidence 0.60
• Contacted 5 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
• Extracted generic config (13 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (linux)

887 behavior events · 0 ATT&CK techniques · 1 dropped files.

Runtime network

• ntp.ubuntu.com
• desktop-hsgcbep
• 5.182.210.61:80
• 5.182.210.61
• 40.126.14.163
• 10.240.0.1
• ff02::1:3
• 224.0.0.252
• 10.240.0.255
• 224.0.0.22
• ff02::1:2
• ff02::16
• 91.189.91.157
• 255.255.255.255
• ff02::1:ff12:3456
• ff02::2
• ff02::1
• 4.209.250.170
• ff02::1:ff4c:1d1d

Dropped files

• tmp_tmp.zWDKNBPjB5 - 4460896b2a4283f4768663f0fd8c3637f96d9aa42f61e4279ea8a5acc96e624f

Embedded URLs

• http://5.182.210.61/5693ed
• http://5.182.210.61/c34a24
• http://5.182.210.61/72aaf0
• http://5.182.210.61/f45062
• http://5.182.210.61/a7b8a4
• http://5.182.210.61/d92841
• http://5.182.210.61/936122
• http://5.182.210.61/dea43c
• http://5.182.210.61/77da9e
• http://5.182.210.61/5bd648
• http://5.182.210.61/21d32a
• http://5.182.210.61/84c68d

Embedded IP addresses

• 5.182.210.61
• 40.126.14.163
• 4.209.250.170

More SAgent samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report