Report - 3e34c6c090ff…b15e28b606

Suspicious HighFILE

Quota 44

First seen: 2026-11-14T06:58:29Z
Last seen: 2026-11-15T04:09:40Z

THREAT SIGNALMedium-low Read alongside the verdict

CONFIDENCE58%VirusSign analysis

FAMILYshelldownloader

RELATED INDICATORS16Connections in this report

ANALYSISSuspiciousFresh

Indicator overview

INDICATOR PROFILE

The VirusSign analysis is supported by the detection, confidence, classification and relationship signals available for this indicator.

SHA256: 3e34c6c090fff1b91e1fa2a2cb7ec593f0fa46c62d5635255decf4b15e28b606
SHA1: 84e99528e3e016c11f07336477a537ff4514c4df
MD5: 8b504a9440dd2d24f2753afd10c98892
Filename: 3e34c6c0_sora.sh.bin
File type: shell
MIME: text/plain
File size: 1060
TLSH: T1C31189E3B4B0DA377B0E48BEA25EB9645CC3153B9870BD24A0C67D213F6C95A5446F23
SSDEEP: 24:csNKtXqoWN0tGzPFdwwFCHaboWPFxMxQ0zfK:c07G4oWtxMxq

Connected context

Key findings

OBSERVED EVIDENCE

Analysis takeaway

Review the detections and related infrastructure.

Detection signal

Suspicious. A limited set of engine detections is present (5%).

Confidence signal

VirusSign confidence is elevated at 58%. Use it as supporting evidence together with detections, family and relationship context.

Analysis signals

OBSERVED

Engine detections5%

VirusSign confidence58%

Relationship context16 visible

Threat classificationshell

Related intelligence

Pivot across connected files and infrastructure with analysis signals and supporting context.

16 shown

Dropped / child files

Files dropped, bundled, or created by the queried file.

5shown

0c83773d8a17581fd64b0d5d819b60fe7f4a753339b691bc66b4d4c09ef2e354

5% high elf 777536 bytes drops

Filename 0c83773d_017d788e205a0a985fc2d8ae861c78cf709fe88b2ad8c8037d537d0b1ba64154.bin Family wacatac Type trojan File type elf MIME application/x-elf

09762e1bfa644a8efe83d474e25f0837b543cf113854039afaaa923b1d92e0fc

14% high elf 5909824 bytes drops

Filename 09762e1b_5ddadd96a6e43eba7e16a20827ac47c5616e02ec075e792d33e6319546fbd9fa.bin Family gafgyt Type trojan File type elf MIME application/x-elf

d8ef2632cdafde63931f80ec7ae24dbcb3b40d617781f6f44dde7c36128ceae9

5% high elf 13032 bytes drops

Filename d8ef2632_.k.bin Family wacatac Type trojan File type elf MIME application/x-elf

5cbf33c796ccbbf9da459605ac83beb2aeedd832d6842cff9a93d686dcb69e7b

0% elf 41992 bytes drops

Filename 5cbf33c7_vsgqcaak0.exe.bin File type elf MIME application/x-elf Size 41992 SHA1 5556d8e417eb0916d185a94de4d3ff7f256cacf4

5451207e59dea293646f77cdf0ea6113a6950edb08d80f127932e4fb3ba7ae38

0% elf 41992 bytes drops

Filename 5451207e_852778a6eff202f20aa8b6b9e8526ccbf9fbbb0ab32232be49187f28e8963d85.bin File type elf MIME application/x-elf Size 41992 SHA1 445703b42d9372f05fef19b797b3552a336ef130

Related IPs

Network IPs associated with this indicator.

5shown

185.34.144.137

11% medium US communicates

CIDR 185.34.144.0/22 Network 185.34.144.0-185.34.147.255 First seen 2025-12-23T08:02:53Z Last seen 2026-11-15T04:09:40Z

185.125.190.110

GB communicates

CIDR 185.125.188.0/22 Network 185.125.188.0-185.125.191.255 First seen 2022-11-20T19:58:16Z Last seen 2026-11-15T04:09:44Z

185.125.190.109

GB communicates

CIDR 185.125.188.0/22 Network 185.125.188.0-185.125.191.255 First seen 2022-11-21T12:49:05Z Last seen 2026-11-15T04:09:44Z

185.125.190.108

GB communicates

CIDR 185.125.188.0/22 Network 185.125.188.0-185.125.191.255 First seen 2022-11-20T19:58:16Z Last seen 2026-11-15T04:09:44Z

185.125.190.107

GB communicates

CIDR 185.125.188.0/22 Network 185.125.188.0-185.125.191.255 First seen 2022-11-20T19:58:16Z Last seen 2026-11-15T04:09:44Z

Related domains

Domains associated with this indicator.

1shown

api.snapcraft.io

0% .io communicates

Root snapcraft.io TLD io Subdomain api First seen 2023-10-01T01:10:27Z Last seen 2026-11-15T04:09:44Z

Related URLs

URLs associated with this indicator.

5shown

http://185.34.144.137:8888/bot.x86

5% low communicates

HTTP status 200 Content length 6326776 Content SHA256 c809e408bb2e3683562617029d3c3167ed9556c1f7338b0829f35357d27ba8f5 First seen 2026-11-14T09:31:38Z Last seen 2026-11-14T11:35:48Z

http://185.34.144.137:8888/bot.x86_64

5% medium communicates

HTTP status 200 Content length 731184 Content SHA256 c2df8b03376d66027450ddc639037b90d245ee76b110d992a88b5087b7ddfd0c First seen 2026-11-14T09:31:38Z Last seen 2026-11-14T19:00:41Z

http://185.34.144.137:8888/bot.mips

5% medium communicates

HTTP status 200 Content length 95052 Content SHA256 fe419f0107b5c06e99b13f9b00ee37314a9665a7b6ba127eb0605ff81142270c First seen 2026-11-14T09:31:38Z Last seen 2026-11-14T19:00:41Z

http://185.34.144.137:8888/bot.aarch64

5% medium communicates

HTTP status 200 Content length 54904 Content SHA256 a707615eba9b2cd86d84d5a0aeb208a8f9aa0a96bd92fa7c2a29f1d6daa44c39 First seen 2026-11-14T09:31:38Z Last seen 2026-11-14T19:00:41Z

http://185.34.144.137:8888/bot.armel

5% low communicates

HTTP status 200 Content length 54504 Content SHA256 696adc0309b1218f89e3547d94599d78eaf28780a77463c1ddb4763a315a02c6 First seen 2026-11-14T09:31:38Z Last seen 2026-11-14T19:00:41Z

Analysis details

Severity: highdownloadershelldebug-checkself-delete

Freshness: Fresh · Last seen today.

Detection rate: 5%
Threat type: downloader
Family: shell
Confidence: 58%
detection: 5 · Engine detection rate; color may also reflect VirusSign confidence.

Overview

SHA256: 3e34c6c090fff1b91e1fa2a2cb7ec593f0fa46c62d5635255decf4b15e28b606
SHA1: 84e99528e3e016c11f07336477a537ff4514c4df
MD5: 8b504a9440dd2d24f2753afd10c98892
Filename: 3e34c6c0_sora.sh.bin
File type: shell
MIME: text/plain
File size: 1060
TLSH: T1C31189E3B4B0DA377B0E48BEA25EB9645CC3153B9870BD24A0C67D213F6C95A5446F23
SSDEEP: 24:csNKtXqoWN0tGzPFdwwFCHaboWPFxMxQ0zfK:c07G4oWtxMxq
First seen: 2026-11-14T06:58:29Z
Last seen: 2026-11-15T04:09:40Z

Key findings

A focused interpretation of the evidence, relationships and observation history that matter most.

Analysis takeaway

Review the detections and related infrastructure.

Detection signal

Suspicious. A limited set of engine detections is present (5%).

Confidence signal

VirusSign confidence is elevated at 58%. Use it as supporting evidence together with detections, family and relationship context.

Threat context

Classification includes type downloader and family shell.

Relationship context

16 related indicators are shown across 4 relationship group(s). Additional relationship intelligence is available through API and data access.

Observation timeline

17 timestamped observations are arranged from 2022-11-20 to 2026-11-14. These are observation or metadata times, not execution order.

Why this verdict

Review the reported detections, analysis confidence and supporting context.

evidence

The VirusSign analysis is supported by the detection, confidence, classification and relationship signals available for this indicator.

Engine detections 5%

Reported engine detection rate. A low rate alone does not establish that the indicator is benign.

VirusSign confidence 58%

VirusSign analysis confidence; separate from detection rate and actor-association confidence.

Relationship context 16 visible

4 relationship group(s) provide pivot and infrastructure context.

Threat classification shell

Classification context: type downloader, family shell.

Intelligence freshness Fresh

Last seen today.

Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.

File profile

summary

Selected file intelligence summary.

Filename: 3e34c6c0_sora.sh.bin
File type: shell
MIME: text/plain
Size: 1060

Observed behavior

selected details

Selected behavioral observations and reported framework mappings.

debug-checkself-delete

View details · 5 shown

Classification label
Connects to IPs without corresponding DNS lookups
Creates hidden files and/or directories
Deletes files from disk
Detected TCP or UDP traffic on non-standard ports

5 shown

View MITRE ATT&CK details · 5 shown

T1564.001 — Creates hidden files, links and/or directories
Tactics: TA0005
T1070.004 — Deletes files from disk
Tactics: TA0005
T1571 — Detected TCP or UDP traffic on non-standard ports
Tactics: TA0011
T1071 · T1095 · T1105 — Downloads files from webservers via HTTP
Tactics: TA0011
T1222 — Executes the "chmod" command used to modify permissions
Tactics: TA0112

5 shown

View MBC details · 5 shown

Command and Control
Objectives: OB0004
Communication
Objectives: OC0006
Defense Evasion
Objectives: OB0006
C0047 — Delete File
Objectives: OC0001
B0033 — Denial of Service
Objectives: OB0008

5 shown

Network activity

selected details

Selected observations and details. Additional structured data are available through API and data access.

Network activity5+

HTTP, TCPports 443, 8888

5+ outbound connections observed
1 domains, 3 IPs, 5+ URLs
Common ports: 443, 8888
Protocols: HTTP, TCP

View details · 5 shown

Domain: 185.34.144.137
URL: http://185.34.144.137:8888/bot.x86_64
Protocol: HTTP

Domain: 185.34.144.137
URL: http://185.34.144.137:8888/bot.mipsel
Protocol: HTTP

Domain: 185.34.144.137
URL: http://185.34.144.137:8888/bot.mips
Protocol: HTTP

Domain: 185.34.144.137
URL: http://185.34.144.137:8888/bot.armhf
Protocol: HTTP

Domain: 185.34.144.137
URL: http://185.34.144.137:8888/bot.aarch64
Protocol: HTTP

5 shown

DNS request activity1

A5+ response IPs

1 DNS requests observed
1 unique queries
5+ response IPs
Query types: A
Response codes: NOERROR

View details · 1 shown

Query: api.snapcraft.io
Type: A
Answers: 185.125.190.106, 185.125.190.105, 185.125.190.109, 185.125.190.108, 185.125.190.110, 185.125.190.107
Response: NOERROR

C2 candidates2

HTTP, TCPports 8888

2 C2 candidate communications
1 domains, 1 IPs
Common ports: 8888
Protocols: HTTP, TCP

View details · 2 shown

IP: 185.34.144.137
Port: 8888
Protocol: TCP

Domain: 185.34.144.137
Protocol: HTTP

Files are hashed locally in your browser and never uploaded. Only the SHA-256 is sent for lookup. Standard query quota applies.

Appearance

Indicator overview

Connected context

Key findings

Analysis signals

No observations in this view

Visible connections

Related intelligence

Dropped / child files

Related IPs

Related domains

Related URLs

Analysis details

Overview

Key findings

Why this verdict

File profile

Observed behavior

Network activity

Explore further connections

Structured report export

Explore more details

Put this intelligence to work

A quick security check