- First seen
- Last seen
THREAT SIGNALHigh
Read alongside the verdict
Indicator overview
INDICATOR PROFILEEngine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.
- SHA256
02a13b1bfbb8ca49aa9652813e9b25afedfd6a9a9f5316baa2fc67216ded9f42- SHA1
422a2a1b7c0d9b01286b82c37c5b0c95f5035cb6- MD5
97cc2bf04c529150f05c25c966502bea- Filename
- awoo.sh
- File type
- shell
- MIME
- text/plain
- File size
- 1670
- Filename variants
- 2 reported
- TLSH
T18F3192CD118505772C9ADEB2B3F90A5471C8A4A358D2AF2F98FC74FA44CDD893594743- SSDEEP
24:vdy836sdt3tCSd1OWtlJdgGPzdDezaLdzOtAHksdDRDKwgidBvYodYqcUdlrWrX:vH7USDTD/PzSaL6AHJxFK3isoXcUYX
Connected context
Key findings
OBSERVED EVIDENCEAnalysis takeaway
Elevated engine detections. Related indicators in this report: 15. Review the supporting evidence before taking action.
Detection signal
Malicious. Engine detections are elevated at 62%.
Confidence signal
VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.
Analysis signals
OBSERVEDEngine detections62%
VirusSign confidence100%
Relationship context15 visible
Threat classificationmedusa
Expand a connection to run an additional public query. This page allows up to 3 expansions; each counts toward your query limit.
Graph filters
Saved investigations
Compare when indicators were first seen, last seen and observed. Switch to Lifecycle to connect events for the same IOC.
Review approximate infrastructure locations and geographic concentration.
Commonalities
RELATIONSHIP CONSTELLATION
No observations in this view
Available evidence appears in the other investigation lenses.
SELECT A NODE TO EXPLORE
FILEDOMAINIPURL
Visible connections
Related intelligence
Pivot across connected files and infrastructure with analysis signals and supporting context.
Related IPs
Network IPs associated with this indicator.
5shown
0%
US
communicates
CIDR
23.60.80.0/21
Network
23.32.0.0-23.67.255.255
First seen
2026-06-19T23:23:08Z
Last seen
2026-11-06T03:56:46Z
0%
US
communicates
CIDR
18.176.0.0/12
Network
18.32.0.0-18.255.255.255
First seen
2024-01-26T05:10:15Z
Last seen
2026-11-12T19:34:37Z
0%
US
communicates
CIDR
104.76.208.0/20
Network
104.76.210.0-104.76.210.255
First seen
2023-10-01T04:47:33Z
Last seen
2026-11-12T22:35:38Z
0%
US
communicates
CIDR
23.46.248.0/22
Network
23.32.0.0-23.67.255.255
First seen
2026-08-04T06:07:49Z
Last seen
2026-11-12T19:33:40Z
0%
US
communicates
CIDR
17.253.4.0/22
Network
17.0.0.0-17.255.255.255
First seen
2023-09-29T09:06:07Z
Last seen
2026-11-12T22:30:44Z
Related domains
Domains associated with this indicator.
5shown
0%
.com
communicates
Root
apple.com
TLD
com
Subdomain
radarsubmissions
First seen
2023-09-30T05:17:29Z
Last seen
2026-11-12T21:04:59Z
0%
.com
communicates
Root
apple.com
TLD
com
Subdomain
push
First seen
2023-09-29T09:14:39Z
Last seen
2026-11-12T21:07:57Z
0%
.com
communicates
Root
apple.com
TLD
com
Subdomain
init-p01st.push
First seen
2023-09-28T21:57:41Z
Last seen
2026-11-12T23:47:01Z
5%
low
.net
communicates
Root
akamaiedge.net
TLD
net
Subdomain
e6858.dscx
First seen
2023-09-29T20:29:17Z
Last seen
2026-11-12T23:26:02Z
0%
.net
communicates
Root
phicdn.net
TLD
net
Subdomain
cs9.wac
First seen
2023-09-30T18:20:35Z
Last seen
2026-11-12T21:07:57Z
Related URLs
URLs associated with this indicator.
5shown
17%
medium
communicates
HTTP status
404
Content length
61792
Content SHA256
191c35f09cee196be06da6877a80a0d62b1aaa13b3c775dcc8b22313b0e7bb6a
First seen
2021-09-06T12:31:41Z
Last seen
2025-12-21T19:58:42Z
14%
medium
communicates
HTTP status
404
Content length
61791
Content SHA256
ba0a529f859cdb1d1287280839bb3308718d9de76dd764e51839b759787646f9
First seen
2021-09-06T12:31:41Z
Last seen
2025-12-21T19:58:42Z
17%
medium
communicates
HTTP status
404
Content length
61791
Content SHA256
ea12c5e059bf101290f4cef805ed53daa212e9acbd8e941a01dc7bd7f2d813d1
First seen
2021-09-06T19:02:50Z
Last seen
2025-12-21T19:58:42Z
17%
medium
communicates
HTTP status
404
Content length
61792
Content SHA256
cfc31c3e15dd7bd4d24fecb1ad14b467f50a2fc6760c2196641b2951e39568a5
First seen
2021-09-06T12:31:41Z
Last seen
2025-12-21T19:58:42Z
17%
medium
communicates
HTTP status
404
Content length
61792
Content SHA256
5097e5095b7f78285477a6b0389b738069816abd408f9e5e2ecdbdb9a3d18f69
First seen
2021-09-05T03:13:12Z
Last seen
2025-12-21T19:58:42Z
Analysis details
Severity: hightrojanshellcpu-clockdebug-check
Freshness: Historical · Last seen 845 days ago.
- Detection rate
- 62%
- Threat type
- trojan
- Family
- medusa
- Confidence
- 100%
- detection
- 62 · Engine detection rate; color may also reflect VirusSign confidence.
Overview
- SHA256
02a13b1bfbb8ca49aa9652813e9b25afedfd6a9a9f5316baa2fc67216ded9f42- SHA1
422a2a1b7c0d9b01286b82c37c5b0c95f5035cb6- MD5
97cc2bf04c529150f05c25c966502bea- Filename
- awoo.sh
- File type
- shell
- MIME
- text/plain
- File size
- 1670
- TLSH
T18F3192CD118505772C9ADEB2B3F90A5471C8A4A358D2AF2F98FC74FA44CDD893594743- SSDEEP
24:vdy836sdt3tCSd1OWtlJdgGPzdDezaLdzOtAHksdDRDKwgidBvYodYqcUdlrWrX:vH7USDTD/PzSaL6AHJxFK3isoXcUYX- First seen
- 2021-08-30T17:06:50Z
- Last seen
- 2024-07-20T04:13:57Z
- Filename variants
- 2 reported
Key findings
A focused interpretation of the evidence, relationships and observation history that matter most.
Analysis takeaway
Elevated engine detections. Related indicators in this report: 15. Review the supporting evidence before taking action.
Detection signal
Malicious. Engine detections are elevated at 62%.
Confidence signal
VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.
Threat context
Classification includes type trojan and family medusa.
Relationship context
15 related indicators are shown across 3 relationship group(s). Additional relationship intelligence is available through API and data access.
Observation timeline
16 timestamped observations are arranged from 2021-08-30 to 2026-08-04. These are observation or metadata times, not execution order.
Why this verdict
Review the reported detections, analysis confidence and supporting context.
Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.
Reported engine detection rate, not the probability that this indicator is malicious.
VirusSign analysis confidence; separate from detection rate and actor-association confidence.
3 relationship group(s) provide pivot and infrastructure context.
Classification context: type trojan, family medusa.
Last seen 845 days ago.
Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.
File profile
summarySelected file intelligence summary.
- Filename
- awoo.sh
- File type
- shell
- MIME
- text/plain
- Size
- 1670
Observed behavior
selected detailsSelected behavioral observations and reported framework mappings.
View details · 5 shown
- All domains contacted by the sample do not resolve. The sample is likely an old dropper which does no longer work.
- Classification label
- Connects to IPs without corresponding DNS lookups
- Downloads files from webservers via HTTP
- Executes the "chmod" command used to modify permissions
5 shown
View MITRE ATT&CK details · 5 shown
- T1036 — Creates files inside the user directoryTactics: TA0005
- T1071 · T1095 · T1105 — Downloads files from webservers via HTTPTactics: TA0011
- T1064 — Executes batch filesTactics: TA0002 · TA0005
- T1222 — Executes the "chmod" command used to modify permissionsTactics: TA0112
- T1048 — Executes the "curl" command used to transfer data via the network (typically using HTTP/S)Tactics: TA0010
5 shown
Network activity
selected detailsSelected observations and details. Additional structured data are available through API and data access.
Network activity5+
HTTP, TCP, UDPports 443, 80, 67
- 5+ outbound connections observed
- 3 domains, 5+ IPs, 5+ URLs
- Common ports: 443, 80, 67
- Protocols: HTTP, TCP, UDP
View details · 5 shown
- Domain
- 139.28.37.49
- URL
- http://139.28.37.49/sisi/x86
- Protocol
- HTTP
- Domain
- 139.28.37.49
- URL
- http://139.28.37.49/sisi/sh4
- Protocol
- HTTP
- Domain
- 139.28.37.49
- URL
- http://139.28.37.49/sisi/ppc
- Protocol
- HTTP
- Domain
- 139.28.37.49
- URL
- http://139.28.37.49/sisi/mpsl
- Protocol
- HTTP
- Domain
- 139.28.37.49
- URL
- http://139.28.37.49/sisi/m68k
- Protocol
- HTTP
5 shown
DNS request activity5+
A5+ response IPs
- 5+ DNS requests observed
- 5+ unique queries
- 5+ response IPs
- Query types: A
- Response codes: NOERROR
View details · 5 shown
- Query
- e6858.dscx.akamaiedge.net
- Type
- A
- Answers
- 23.60.85.12
- Response
- NOERROR
- Query
- gateway.fe.apple-dns.net
- Query
- e673.dsce9.akamaiedge.net
- Type
- A
- Answers
- 23.60.84.30
- Response
- NOERROR
- Query
- cs9.wac.phicdn.net
- Type
- A
- Answers
- 72.21.91.29
- Response
- NOERROR
- Query
- apple.com
- Type
- A
- Answers
- 17.253.144.10
- Response
- NOERROR
5 shown
C2 candidates1
HTTP
- 1 C2 candidate communications
- 1 domains, 0 IPs
- Protocols: HTTP
View details · 1 shown
- Domain
- 139.28.37.49
- Protocol
- HTTP