Report - 133b66956fee…35941246d9

Malicious HighFILE

Quota 36

First seen: 2026-11-07T06:13:40Z
Last seen: 2026-11-08T04:00:27Z

THREAT SIGNALMedium-high Read alongside the verdict

CONFIDENCE100%VirusSign analysis

FAMILYmedusadownloader

RELATED INDICATORS16Connections in this report

ANALYSISMaliciousFresh

Indicator overview

INDICATOR PROFILE

Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.

SHA256: 133b66956fee092042543cbd67da59ce0d1fb308f6afb83ce5bba735941246d9
SHA1: c561d898ed3716d36bf8c5757cb69d2534f7b570
MD5: 1501396a2ba95b0cb1602e586cebd7ed
Filename: e.sh
File type: shell
MIME: text/plain
File size: 1395
Filename variants: 2 reported
TLSH: T140212ECA66B25E712CA5ED27727F480836A0D5CA54C66F467CEC38FA94CDE087041A97
SSDEEP: 24:I22CcqJBsrbQtc4kqc6q2Kb2NIVks2WLiub++AV:H2CcDrbB4k2q2ORJ2WLi6hAV

Connected context

Key findings

OBSERVED EVIDENCE

Analysis takeaway

Elevated engine detections. Related indicators in this report: 16. Review the supporting evidence before taking action.

Detection signal

Malicious. Engine detections are elevated at 57%.

Confidence signal

VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.

Analysis signals

OBSERVED

Engine detections57%

VirusSign confidence100%

Relationship context16 visible

Threat classificationmedusa

Expand a connection to run an additional public query. This page allows up to 3 expansions; each counts toward your query limit.

RELATIONSHIP CONSTELLATION

SELECT A NODE TO EXPLORE

FILEDOMAINIPURL

Visible connections

Related intelligence

Pivot across connected files and infrastructure with analysis signals and supporting context.

16 shown

Dropped / child files

Files dropped, bundled, or created by the queried file.

5shown

2045780509bcd21ed717ec0a27fa7daf54da84a275216fc0c2c9bdac1bc15ed1

14% high elf 12288 bytes drops

Filename arm7 Family mirai Type trojan File type elf MIME application/x-elf

1540ff8fa104ffdc5f1dd0561e1b335969b6b735300150a636071f23984f3d08

5% high elf 8192 bytes drops

Filename m68k Family wacatac Type trojan File type elf MIME application/x-elf

12050b0fda9583659ce6bde984d851c9be547a815a11c8ef1ea31831f87cab86

0% elf 8192 bytes drops

Filename ppc File type elf MIME application/x-elf Size 8192 SHA1 a77c1363f08e7a00c2e9260dcd025583f08ceb76

0f4f3c667b00c8fa2c348950ff81963a26e3cd89b1fabb001a48af5c6d9622c5

0% elf 8192 bytes drops

Filename x86_64 File type elf MIME application/x-elf Size 8192 SHA1 6ed3f0a41ae24b1cdcdcdbd58961dde8f7c4b7f1

005293f04189deeda21c6493aad329b59b6f1517e64fb00611fd6a622f698b25

15% high elf 14177 bytes drops

Filename arm5 Family svirtu Type trojan File type elf MIME application/x-elf

Related IPs

Network IPs associated with this indicator.

5shown

141.98.10.86

33% high LT communicates

CIDR 141.98.8.0/22 Network 141.98.10.0-141.98.10.255 First seen 2023-10-02T17:52:13Z Last seen 2026-11-11T01:16:24Z

185.125.188.60

0% GB communicates

CIDR 185.125.188.0/22 Network 185.125.188.0-185.125.191.255 First seen 2023-12-12T04:33:57Z Last seen 2026-11-11T15:09:14Z

185.125.188.55

0% GB communicates

CIDR 185.125.188.0/22 Network 185.125.188.0-185.125.191.255 First seen 2023-10-01T07:36:54Z Last seen 2026-11-11T15:09:14Z

169.254.169.254

0% communicates

First seen 2021-02-13T15:17:29Z Last seen 2026-11-11T15:08:29Z

185.125.188.59

0% GB communicates

CIDR 185.125.188.0/22 Network 185.125.188.0-185.125.191.255 First seen 2023-09-30T18:03:12Z Last seen 2026-11-11T15:09:14Z

Related domains

Domains associated with this indicator.

1shown

api.snapcraft.io

0% .io communicates

Root snapcraft.io TLD io Subdomain api First seen 2023-10-01T01:10:27Z Last seen 2026-11-11T15:09:14Z

Related URLs

URLs associated with this indicator.

5shown

http://141.98.10.86/x86

33% high communicates

HTTP status 200 Content length 40976 Content SHA256 f49da692e4a7297499b7e0769dff2dc9dbc2e1dbe16623e025a4c2ab7e937fd6 First seen 2026-11-07T07:07:28Z Last seen 2026-11-07T11:24:56Z

http://141.98.10.86/mpsl

33% high communicates

HTTP status 200 Content length 53284 Content SHA256 6c8cc37f36eb02f743eb68cd97671ec928b31b9d9868a56d6a676bd44ddb954a First seen 2026-11-07T06:29:40Z Last seen 2026-11-07T11:24:56Z

http://141.98.10.86/sh4

33% high communicates

HTTP status 200 Content length 108256 Content SHA256 c024fa621dae82448d62a5b202c8d47d05854e6503718f3dfe7e1f95266dade3 First seen 2026-11-07T07:07:28Z Last seen 2026-11-07T11:24:56Z

http://141.98.10.86/arm7

33% high communicates

HTTP status 200 Content length 72064 Content SHA256 dd40528420f0750d8c8efa15d736345a1deebcc94ed0f857911e526fdae8b8e6 First seen 2026-11-07T07:07:28Z Last seen 2026-11-07T11:24:56Z

http://141.98.10.86/arm

33% high communicates

HTTP status 200 Content length 47924 Content SHA256 ea6af2af5afbe8181e3344589713960076a4086260ce188ed1ff7016b96ed4ab First seen 2026-11-07T07:07:28Z Last seen 2026-11-07T11:24:56Z

Analysis details

Severity: highdownloadershellpersistencedebug-checkself-deletemirai

Freshness: Fresh · Last seen 3 days ago.

Detection rate: 57%
Threat type: downloader
Family: medusa
Confidence: 100%
detection: 57 · Engine detection rate; color may also reflect VirusSign confidence.

Overview

SHA256: 133b66956fee092042543cbd67da59ce0d1fb308f6afb83ce5bba735941246d9
SHA1: c561d898ed3716d36bf8c5757cb69d2534f7b570
MD5: 1501396a2ba95b0cb1602e586cebd7ed
Filename: e.sh
File type: shell
MIME: text/plain
File size: 1395
TLSH: T140212ECA66B25E712CA5ED27727F480836A0D5CA54C66F467CEC38FA94CDE087041A97
SSDEEP: 24:I22CcqJBsrbQtc4kqc6q2Kb2NIVks2WLiub++AV:H2CcDrbB4k2q2ORJ2WLi6hAV
First seen: 2026-11-07T06:13:40Z
Last seen: 2026-11-08T04:00:27Z
Filename variants: 2 reported

Key findings

A focused interpretation of the evidence, relationships and observation history that matter most.

Analysis takeaway

Elevated engine detections. Related indicators in this report: 16. Review the supporting evidence before taking action.

Detection signal

Malicious. Engine detections are elevated at 57%.

Confidence signal

VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.

Threat context

Classification includes type downloader and family medusa.

Relationship context

16 related indicators are shown across 4 relationship group(s). Additional relationship intelligence is available through API and data access.

Observation timeline

17 timestamped observations are arranged from 2021-02-13 to 2026-11-07. These are observation or metadata times, not execution order.

Why this verdict

Review the reported detections, analysis confidence and supporting context.

evidence

Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.

Engine detections 57%

Reported engine detection rate, not the probability that this indicator is malicious.

VirusSign confidence 100%

VirusSign analysis confidence; separate from detection rate and actor-association confidence.

Relationship context 16 visible

4 relationship group(s) provide pivot and infrastructure context.

Threat classification medusa

Classification context: type downloader, family medusa.

Intelligence freshness Fresh

Last seen 3 days ago.

Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.

File profile

summary

Selected file intelligence summary.

Filename: e.sh
File type: shell
MIME: text/plain
Size: 1395

Observed behavior

selected details

Selected behavioral observations and reported framework mappings.

debug-checkpersistenceself-delete

View details · 5 shown

Classification label
Connects to IPs without corresponding DNS lookups
Creates hidden files and/or directories
Creates hidden files without content (potentially used as a mutex)
Deletes files from disk

5 shown

View MITRE ATT&CK details · 5 shown

T1564 — Creates hidden files without content (potentially used as a mutex)
Tactics: TA0005
T1564.001 — Creates hidden files, links and/or directories
Tactics: TA0005
T1070.004 — Deletes files from disk
Tactics: TA0005
T1571 — Detected TCP or UDP traffic on non-standard ports
Tactics: TA0011
T1071 · T1095 · T1105 — Downloads files from webservers via HTTP
Tactics: TA0011

5 shown

View MBC details · 5 shown

Command and Control
Objectives: OB0004
Communication
Objectives: OC0006
Defense Evasion
Objectives: OB0006
C0047 — Delete File
Objectives: OC0001
B0033 — Denial of Service
Objectives: OB0008

5 shown

Network activity

selected details

Selected observations and details. Additional structured data are available through API and data access.

Network activity5+

HTTP, TCPports 443, 80, 53179

5+ outbound connections observed
1 domains, 4 IPs, 5+ URLs
Common ports: 443, 80, 53179
Protocols: HTTP, TCP

View details · 5 shown

Domain: 141.98.10.86
URL: http://141.98.10.86/x86_64
Protocol: HTTP

Domain: 141.98.10.86
URL: http://141.98.10.86/x86
Protocol: HTTP

Domain: 141.98.10.86
URL: http://141.98.10.86/sh4
Protocol: HTTP

Domain: 141.98.10.86
URL: http://141.98.10.86/ppc
Protocol: HTTP

Domain: 141.98.10.86
URL: http://141.98.10.86/mpsl
Protocol: HTTP

5 shown

DNS request activity1

A5+ response IPs

1 DNS requests observed
1 unique queries
5+ response IPs
Query types: A
Response codes: NOERROR

View details · 1 shown

Query: api.snapcraft.io
Type: A
Answers: 185.125.188.57, 185.125.188.60, 185.125.188.59, 185.125.188.58, 185.125.188.55, 185.125.188.54
Response: NOERROR

C2 candidates3

TCP, HTTPports 53179, 80

3 C2 candidate communications
1 domains, 1 IPs
Common ports: 53179, 80
Protocols: TCP, HTTP

View details · 3 shown

IP: 141.98.10.86
Port: 53179
Protocol: TCP

Domain: 141.98.10.86
Protocol: HTTP

IP: 141.98.10.86
Port: 80
Protocol: TCP

Files are hashed locally in your browser and never uploaded. Only the SHA-256 is sent for lookup. Standard query quota applies.

Appearance

Indicator overview

Connected context

Key findings

Analysis signals

No observations in this view

Visible connections

Related intelligence

Dropped / child files

Related IPs

Related domains

Related URLs

Analysis details

Overview

Key findings

Why this verdict

File profile

Observed behavior

Network activity

Explore further connections

Structured report export

Explore more details

Put this intelligence to work

A quick security check