- First seen
- Last seen
THREAT SIGNALMedium-high
Read alongside the verdict
Indicator overview
INDICATOR PROFILEEngine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.
- SHA256
5b549d8d2404e2fb907eaf180df1551abc2200f559852795caa1fbedd981cf3e- SHA1
1c2c35f78f606c313e72ea15d970539515ee7eaa- MD5
aeeb45528700c6ef4be02b0ef4f3ee4e- File type
- shell
- MIME
- text/plain
- File size
- 60374
- TLSH
T17143BF06B40113F0D551C1E84D03B497366BB81F08EF7E59F8EDA0119FB6BAD96F2A28- SSDEEP
1536:Wed4W2/dBio+vu5KWoUsPAiWa3xh4mL0WdzqyeGnPCP4pvIQBW0txbxEkYShpU02:Wed4W2/dBio+vu5KWoUsPAiWa3xh4mLU- First seen
- 2023-11-03T17:49:42Z
- Last seen
- 2026-10-09T06:05:32Z
Connected context
Key findings
OBSERVED EVIDENCEAnalysis takeaway
Elevated engine detections. Related indicators in this report: 12. Review the supporting evidence before taking action.
Detection signal
Malicious. Engine detections are elevated at 38%.
Confidence signal
VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.
Analysis signals
OBSERVEDEngine detections38%
VirusSign confidence100%
Relationship context12 visible
Threat classificationshell
Expand a connection to run an additional public query. This page allows up to 3 expansions; each counts toward your query limit.
Graph filters
Saved investigations
Compare when indicators were first seen, last seen and observed. Switch to Lifecycle to connect events for the same IOC.
Review approximate infrastructure locations and geographic concentration.
Commonalities
RELATIONSHIP CONSTELLATION
No observations in this view
Available evidence appears in the other investigation lenses.
SELECT A NODE TO EXPLORE
FILEDOMAINIPURL
Visible connections
Related intelligence
Pivot across connected files and infrastructure with analysis signals and supporting context.
Dropped / child files
Files dropped, bundled, or created by the queried file.
5shown
11%
high
shell
35987 bytes
drops
Filename
m6
Family
shell
Type
trojan
File type
shell
MIME
text/plain
32%
high
shell
60472 bytes
drops
Filename
xbash
Family
shell
Type
trojan
File type
shell
MIME
text/plain
0%
text
3 bytes
drops
Filename
count.txt
File type
text
MIME
text/plain
Size
3
SHA1
12c8b9fa0057d43eb662678f9e47df871071bb50
0%
javascript
8 bytes
drops
Filename
6lowpanfrag_high_thresh
File type
javascript
MIME
application/javascript
Size
8
SHA1
b42b445a489a0d695aa76dfce1e6ccd73bbafb8d
0%
text
5 bytes
drops
Filename
3830d5c3ddfd5cd38a049b759396e72e-le64.cache-6.TMP-IpUjMV
File type
text
MIME
text/plain
Size
5
SHA1
4343433d93fa2b7b1f64837b18cbf448e91b350d
Related IPs
Network IPs associated with this indicator.
3shown
5%
medium
MD
communicates
CIDR
45.142.212.0/22
Network
45.142.212.0-45.142.212.255
First seen
2026-08-22T18:37:25Z
Last seen
2026-08-22T18:37:25Z
21%
high
LT
communicates
CIDR
5.133.65.0/24
Network
5.133.65.0-5.133.65.255
First seen
2026-08-20T12:52:04Z
Last seen
2026-09-04T10:35:35Z
Related URLs
URLs associated with this indicator.
4shown
9%
medium
communicates
HTTP status
200
Content length
6260352
Content SHA256
6abdd9effedb3ecc70326493f3676d3c6bbd0d3cc0d8d172885b344a3fa07e27
First seen
2023-01-21T10:21:23Z
Last seen
2025-12-06T12:02:18Z
18%
medium
communicates
HTTP status
200
Content length
60483
Content SHA256
3d950369f24aae2b8b7e70e619523e523ff689e1f7e014ca8fbf9c1316dc15cc
First seen
2023-02-01T10:35:56Z
Last seen
2025-01-31T19:30:16Z
18%
medium
communicates
HTTP status
200
Content length
247765
Content SHA256
56647030cb7c091ba1699b76a1b8de9188846bf674574dd82f7630be284403f0
First seen
2022-12-18T05:09:11Z
Last seen
2025-02-02T05:40:35Z
23%
medium
communicates
HTTP status
200
Content length
6260352
Content SHA256
6abdd9effedb3ecc70326493f3676d3c6bbd0d3cc0d8d172885b344a3fa07e27
First seen
2022-10-28T13:47:08Z
Last seen
2026-02-01T20:12:16Z
Analysis details
Severity: hightrojanpersistenceshelldebug-checkexec-delay
Freshness: Aging · Last seen 34 days ago.
- Detection rate
- 38%
- Threat type
- trojan
- Family
- shell
- Confidence
- 100%
- detection
- 38 · Engine detection rate; color may also reflect VirusSign confidence.
Overview
- SHA256
5b549d8d2404e2fb907eaf180df1551abc2200f559852795caa1fbedd981cf3e- SHA1
1c2c35f78f606c313e72ea15d970539515ee7eaa- MD5
aeeb45528700c6ef4be02b0ef4f3ee4e- File type
- shell
- MIME
- text/plain
- File size
- 60374
- TLSH
T17143BF06B40113F0D551C1E84D03B497366BB81F08EF7E59F8EDA0119FB6BAD96F2A28- SSDEEP
1536:Wed4W2/dBio+vu5KWoUsPAiWa3xh4mL0WdzqyeGnPCP4pvIQBW0txbxEkYShpU02:Wed4W2/dBio+vu5KWoUsPAiWa3xh4mLU- First seen
- 2023-11-03T17:49:42Z
- Last seen
- 2026-10-09T06:05:32Z
Key findings
A focused interpretation of the evidence, relationships and observation history that matter most.
Analysis takeaway
Elevated engine detections. Related indicators in this report: 12. Review the supporting evidence before taking action.
Detection signal
Malicious. Engine detections are elevated at 38%.
Confidence signal
VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.
Threat context
Classification includes type trojan and family shell.
Relationship context
12 related indicators are shown across 3 relationship group(s). Additional relationship intelligence is available through API and data access.
Observation timeline
13 timestamped observations are arranged from 2015-07-06 to 2026-08-22. These are observation or metadata times, not execution order.
Why this verdict
Review the reported detections, analysis confidence and supporting context.
Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.
Reported engine detection rate, not the probability that this indicator is malicious.
VirusSign analysis confidence; separate from detection rate and actor-association confidence.
3 relationship group(s) provide pivot and infrastructure context.
Classification context: type trojan, family shell.
Last seen 34 days ago.
Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.
File profile
summarySelected file intelligence summary.
- File type
- shell
- MIME
- text/plain
- Size
- 60374
Observed behavior
selected detailsSelected behavioral observations and reported framework mappings.
View details · 5 shown
- Changes permissions of common UNIX (system) binary directories
- Classification label
- Connects to IPs without corresponding DNS lookups
- Deletes log files
- Downloads files from webservers via HTTP
5 shown
View MITRE ATT&CK details · 5 shown
- T1070 — Deletes log filesTactics: TA0005
- T1071 · T1095 · T1105 — Downloads files from webservers via HTTPTactics: TA0011
- T1036 — Drops files in suspicious directoriesTactics: TA0005
- T1003 — Enumerates processes within the "proc" file systemTactics: TA0006
- T1064 — Executes commands using a shell command-line interpreterTactics: TA0002 · TA0005
5 shown
Network activity
selected detailsSelected observations and details. Additional structured data are available through API and data access.
Network activity5+
HTTP, TCPports 80
- 5+ outbound connections observed
- 2 domains, 3 IPs, 4 URLs
- Common ports: 80
- Protocols: HTTP, TCP
View details · 5 shown
- Domain
- 5.133.65.53
- URL
- http://5.133.65.53/soft/linux/xfit.sh
- Protocol
- HTTP
- Domain
- 5.133.65.53
- URL
- http://5.133.65.53/soft/linux/xbash
- Protocol
- HTTP
- Domain
- 5.133.65.53
- URL
- http://5.133.65.53/soft/linux/cronman
- Protocol
- HTTP
- IP
- 5.133.65.53
- Port
- 80
- Protocol
- TCP
- Domain
- 45.142.212.30
- URL
- http://45.142.212.30/soft/linux/xfit.sh
- Protocol
- HTTP
5 shown
C2 candidates4
HTTP, TCPports 80
- 4 C2 candidate communications
- 2 domains, 2 IPs
- Common ports: 80
- Protocols: HTTP, TCP
View details · 4 shown
- Domain
- 5.133.65.53
- Protocol
- HTTP
- IP
- 5.133.65.53
- Port
- 80
- Protocol
- TCP
- Domain
- 45.142.212.30
- Protocol
- HTTP
- IP
- 45.142.212.30
- Port
- 80
- Protocol
- TCP